@stage-labs/metro 0.1.0-beta.181 → 0.1.0-beta.183

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.181",
+  "version": "0.1.0-beta.183",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.181",
+  "version": "0.1.0-beta.183",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/home-fs.ts

@@ -0,0 +1,113 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { createWriteStream, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import type { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { writeAtomic } from '@metro-labs/core/secure-fs';
+import { agentUser, asUser, type AgentUser } from './user.js';
+
+const WRITE = [
+  'set -e',
+  'mkdir -p -- "$(dirname -- "$1")"',
+  'tmp=$(mktemp -- "$1.metro-XXXXXX")',
+  'trap \'rm -f -- "$tmp"\' EXIT',
+  'cat > "$tmp"',
+  'chmod -- "$2" "$tmp"',
+  'if [ -n "$3" ]; then touch -d "@$3" -- "$tmp"; fi',
+  'mv -f -- "$tmp" "$1"',
+  'trap - EXIT',
+].join('\n');
+
+const octal = (mode: number): string => mode.toString(8);
+const epoch = (mtime: Date | undefined): string => (mtime === undefined ? '' : String(Math.floor(mtime.getTime() / 1000)));
+
+function runAs(user: AgentUser, script: string, args: string[], input?: string): void {
+  const [file, argv] = asUser(user, 'sh', ['-c', script, 'metro', ...args]);
+  const run = spawnSync(file, argv, { input, encoding: 'utf8', stdio: ['pipe', 'ignore', 'pipe'] });
+  if (run.error !== undefined) throw run.error;
+  if (run.status !== 0) throw new Error(`as ${user.name}: ${run.stderr.trim() || `exit ${String(run.status)}`}`);
+}
+
+export function writeHomeText(path: string, text: string, mode = 0o644, mtime?: Date, user = agentUser()): void {
+  if (user !== null) {
+    runAs(user, WRITE, [path, octal(mode), epoch(mtime)], text);
+    return;
+  }
+  writeAtomic(path, text, mode);
+  if (mtime !== undefined) utimesSync(path, mtime, mtime);
+}
+
+export function writeHomeInPlace(path: string, text: string, mode = 0o644, user = agentUser()): void {
+  if (user !== null) {
+    runAs(user, 'mkdir -p -- "$(dirname -- "$1")"; cat > "$1"; chmod -- "$2" "$1"', [path, octal(mode)], text);
+    return;
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, text, { mode });
+}
+
+function filesUnder(root: string, rel = ''): string[] {
+  return readdirSync(join(root, rel), { withFileTypes: true }).flatMap((entry) => {
+    const inner = rel === '' ? entry.name : `${rel}/${entry.name}`;
+    if (entry.isDirectory()) return filesUnder(root, inner);
+    return entry.isFile() ? [inner] : [];
+  });
+}
+
+export function copyIntoHome(from: string, to: string, user = agentUser()): number {
+  removeHome(to, true, user);
+  const files = filesUnder(from);
+  for (const rel of files) {
+    const source = join(from, rel);
+    writeHomeText(join(to, rel), readFileSync(source, 'utf8'), statSync(source).mode & 0o777, undefined, user);
+  }
+  return files.length;
+}
+
+export function removeHome(path: string, recursive = false, user = agentUser()): void {
+  if (user !== null) {
+    runAs(user, recursive ? 'rm -rf -- "$1"' : 'rm -f -- "$1"', [path]);
+    return;
+  }
+  rmSync(path, { recursive, force: true });
+}
+
+export function moveHome(from: string, to: string, user = agentUser()): void {
+  if (user !== null) {
+    runAs(user, 'mv -f -- "$1" "$2"', [from, to]);
+    return;
+  }
+  renameSync(from, to);
+}
+
+async function receiveAs(user: AgentUser, path: string, source: Readable, mode: number): Promise<void> {
+  const [file, argv] = asUser(user, 'sh', ['-c', WRITE, 'metro', path, octal(mode), '']);
+  const child = spawn(file, argv, { stdio: ['pipe', 'ignore', 'pipe'] });
+  let stderr = '';
+  child.stderr.on('data', (chunk: Buffer) => {
+    stderr += chunk.toString('utf8');
+  });
+  const closed = new Promise<number | null>((resolve, reject) => {
+    child.on('error', reject);
+    child.on('close', resolve);
+  });
+  await pipeline(source, child.stdin);
+  const status = await closed;
+  if (status !== 0) throw new Error(`as ${user.name}: ${stderr.trim() || `exit ${String(status)}`}`);
+}
+
+export async function receiveHomeFile(path: string, source: Readable, mode = 0o600, user = agentUser()): Promise<void> {
+  if (user !== null) {
+    await receiveAs(user, path, source, mode);
+    return;
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.metro-${String(process.pid)}.part`;
+  try {
+    await pipeline(source, createWriteStream(tmp, { mode }));
+    renameSync(tmp, path);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/provision.ts

@@ -0,0 +1,136 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { agentsDir } from '../agents/files.js';
+import { copyIntoHome } from './home-fs.js';
+import { agentMarketplaceDir, agentUser, asUser, claudeBin, forgetAgentUser, wantedAgentUser, type AgentUser } from './user.js';
+import { watchAgentView } from './view.js';
+
+const INSTALL_MS = 10 * 60_000;
+const INSTALLER = 'curl -fsSL https://claude.ai/install.sh | bash';
+const MIGRATED = '.agent-user-migrated';
+
+export type Provisioned = 'off' | 'unsupported' | 'failed' | 'ready';
+
+function run(file: string, args: string[]): void {
+  const done = spawnSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  if (done.error !== undefined) throw done.error;
+  if (done.status !== 0) throw new Error(`${file} ${args.join(' ')}: ${done.stderr.trim() || `exit ${String(done.status)}`}`);
+}
+
+function ensureUser(name: string): AgentUser | null {
+  if (agentUser() === null) {
+    run('useradd', ['--create-home', '--shell', '/bin/bash', name]);
+    log.info({ user: name }, 'agent-user: created the user Claude Code runs as');
+    forgetAgentUser();
+  }
+  const user = agentUser();
+  if (user !== null) run('chmod', ['700', user.home]);
+  return user;
+}
+
+const absent = (path: string): boolean => {
+  try {
+    lstatSync(path);
+    return false;
+  } catch {
+    return true;
+  }
+};
+
+const encodedCwd = (dir: string): string => dir.replace(/[^A-Za-z0-9]/g, '-');
+
+function moveProject(user: AgentUser, from: string): void {
+  const projects = join(user.home, '.claude', 'projects');
+  const old = join(projects, encodedCwd(from));
+  const next = join(projects, encodedCwd(user.home));
+  if (existsSync(old) && absent(next)) run('mv', ['-T', old, next]);
+}
+
+function migrateClaude(user: AgentUser, dir: string): void {
+  const marker = join(dir, MIGRATED);
+  if (existsSync(marker)) return;
+  const home = homedir();
+  const copied: string[] = [];
+  for (const name of ['.claude', '.claude.json']) {
+    const from = join(home, name);
+    const to = join(user.home, name);
+    if (!existsSync(from) || !absent(to)) continue;
+    run('cp', ['-aT', from, to]);
+    run('chown', ['-hR', `${user.name}:${String(user.gid)}`, to]);
+    copied.push(name);
+  }
+  if (copied.includes('.claude')) moveProject(user, home);
+  run('touch', [marker]);
+  log.info({ user: user.name, copied }, 'agent-user: moved the Claude Code folder and login to the agent user once; root keeps its copy');
+}
+
+function installClaude(user: AgentUser): Promise<void> {
+  if (existsSync(claudeBin(user))) return Promise.resolve();
+  const [file, args] = asUser(user, 'bash', ['-c', INSTALLER]);
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { stdio: ['ignore', 'ignore', 'pipe'], cwd: '/', timeout: INSTALL_MS });
+    let said = '';
+    child.stderr.on('data', (chunk: Buffer) => {
+      said = `${said}${chunk.toString('utf8')}`.slice(-2000);
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0 && existsSync(claudeBin(user))) {
+        log.info({ user: user.name }, 'agent-user: installed Claude Code for the agent user');
+        resolve();
+      } else reject(new Error(`the Claude Code installer failed: ${said.trim() || `exit ${String(code)}`}`));
+    });
+  });
+}
+
+const pluginVersion = (dir: string): string | null => {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(join(dir, 'plugin', '.claude-plugin', 'plugin.json'), 'utf8'));
+    return isRecord(parsed) && typeof parsed.version === 'string' ? parsed.version : null;
+  } catch {
+    return null;
+  }
+};
+
+function copyMarketplace(user: AgentUser, env: NodeJS.ProcessEnv): void {
+  const store = env.METRO_RUNTIME_STORE?.trim() ?? '';
+  const from = join(store, 'marketplace');
+  if (store === '' || !existsSync(join(from, '.claude-plugin', 'marketplace.json'))) return;
+  const to = agentMarketplaceDir(user);
+  if (pluginVersion(from) !== null && pluginVersion(from) === pluginVersion(to)) return;
+  const files = copyIntoHome(from, to, user);
+  log.info({ files, version: pluginVersion(from) }, 'agent-user: copied the metro plugin where the agent user can load it');
+}
+
+function stopRootSession(): void {
+  const running = spawnSync('tmux', ['has-session', '-t', 'metro'], { stdio: 'ignore' });
+  if (running.error !== undefined || running.status !== 0) return;
+  spawnSync('tmux', ['kill-session', '-t', 'metro'], { stdio: 'ignore' });
+  log.info('agent-user: stopped the Claude session root was running; it comes back as the agent user');
+}
+
+export async function provisionAgentUser(dir = agentsDir(), env: NodeJS.ProcessEnv = process.env): Promise<Provisioned> {
+  const name = wantedAgentUser(dir);
+  if (name === null) return 'off';
+  if (process.platform !== 'linux' || process.getuid?.() !== 0) {
+    log.warn({ user: name }, 'agent-user: running Claude Code as its own user needs Linux and a daemon running as root; the Claude session stays stopped');
+    return 'unsupported';
+  }
+  try {
+    const user = ensureUser(name);
+    if (user === null) throw new Error(`the user ${name} could not be found after creating it`);
+    migrateClaude(user, dir);
+    await installClaude(user);
+    copyMarketplace(user, env);
+    watchAgentView();
+    stopRootSession();
+    return 'ready';
+  } catch (err) {
+    log.error({ user: name, err: errMsg(err) }, 'agent-user: could not prepare the agent user; the Claude session stays stopped');
+    return 'failed';
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/user.ts

@@ -0,0 +1,92 @@
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+import { isRecord } from '@metro-labs/core/is-record';
+import { readJson } from '@metro-labs/core/secure-fs';
+import { agentsDir } from '../agents/files.js';
+
+export const CONFIG_FILE = 'agent-user.json';
+const NAME_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+const AGENT_PATH = ['.local/bin', '/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin'];
+
+export interface AgentUser {
+  name: string;
+  uid: number;
+  gid: number;
+  home: string;
+}
+
+export interface UserHost {
+  platform: string;
+  uid: number | undefined;
+  lookup: (name: string) => AgentUser | null;
+}
+
+function lookupUser(name: string): AgentUser | null {
+  const run = spawnSync('getent', ['passwd', name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  if (run.error !== undefined || run.status !== 0) return null;
+  const [, , uid = '', gid = '', , home = ''] = run.stdout.trim().split(':');
+  const u = Number(uid);
+  const g = Number(gid);
+  return Number.isInteger(u) && u > 0 && Number.isInteger(g) && home.startsWith('/') ? { name, uid: u, gid: g, home } : null;
+}
+
+const realHost: UserHost = { platform: process.platform, uid: process.getuid?.(), lookup: lookupUser };
+
+export function wantedAgentUser(dir = agentsDir()): string | null {
+  const raw = readJson<unknown>(join(dir, CONFIG_FILE), null);
+  if (!isRecord(raw) || raw.enabled === false) return null;
+  const name = typeof raw.user === 'string' ? raw.user : 'agent';
+  return NAME_RE.test(name) && name !== 'root' ? name : null;
+}
+
+let cached: { key: string; user: AgentUser | null } | null = null;
+
+export function agentUser(dir = agentsDir(), host: UserHost = realHost): AgentUser | null {
+  const name = wantedAgentUser(dir);
+  if (name === null || host.platform !== 'linux' || host.uid !== 0) return null;
+  const key = `${dir}\n${name}`;
+  if (cached?.key === key && cached.user !== null) return cached.user;
+  cached = { key, user: host.lookup(name) };
+  return cached.user;
+}
+
+export function forgetAgentUser(): void {
+  cached = null;
+}
+
+export function agentEnv(user: AgentUser, extra: Record<string, string> = {}): Record<string, string> {
+  return {
+    HOME: user.home,
+    USER: user.name,
+    LOGNAME: user.name,
+    SHELL: '/bin/bash',
+    LANG: process.env.LANG ?? 'C.UTF-8',
+    TERM: process.env.TERM ?? 'xterm-256color',
+    PATH: AGENT_PATH.map((p) => (p.startsWith('/') ? p : join(user.home, p))).join(':'),
+    ...extra,
+  };
+}
+
+export function asUser(user: AgentUser | null, file: string, args: readonly string[], extra: Record<string, string> = {}): [string, string[]] {
+  if (user === null) return [file, [...args]];
+  const env = Object.entries(agentEnv(user, extra)).map(([k, v]) => `${k}=${v}`);
+  return ['runuser', ['-u', user.name, '--', 'env', '-i', ...env, file, ...args]];
+}
+
+export const asAgent = (file: string, args: readonly string[], extra: Record<string, string> = {}): [string, string[]] =>
+  asUser(agentUser(), file, args, extra);
+
+export const agentCommand = (command: readonly string[], extra: Record<string, string> = {}): string[] => {
+  const [file = '', ...args] = command;
+  const [bin, argv] = asAgent(file, args, extra);
+  return [bin, ...argv];
+};
+
+export function claudeBin(user = agentUser()): string {
+  return user === null ? 'claude' : join(user.home, '.local', 'bin', 'claude');
+}
+
+export const claudeHome = (user = agentUser()): string | null => (user === null ? null : user.home);
+
+export const agentMarketplaceDir = (user: AgentUser): string => join(user.home, '.metro', 'marketplace');
+export const agentViewDir = (user: AgentUser): string => join(user.home, '.metro', 'agents');

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { agentsDir } from '../agents/files.js';
+import { removeHome, writeHomeText } from './home-fs.js';
+import { agentUser, agentViewDir, type AgentUser } from './user.js';
+
+const COPIED = ['policy.json', 'claude-setup.json', 'system-prompt.md'] as const;
+const SYNC_MS = 5_000;
+
+const readText = (path: string): string | null => {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return null;
+  }
+};
+
+const readRecord = (path: string): Record<string, unknown> | null => {
+  const text = readText(path);
+  if (text === null) return null;
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return isRecord(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+};
+
+const json = (value: unknown): string => `${JSON.stringify(value, null, 2)}\n`;
+
+function agentFile(dir: string): string | null {
+  const file = readRecord(join(dir, 'agent.json'));
+  if (file === null || typeof file.id !== 'string' || typeof file.key !== 'string') return null;
+  return json({ version: 1, id: file.id, key: file.key });
+}
+
+function modelFile(dir: string): string | null {
+  const cfg = readRecord(join(dir, 'model.json'));
+  if (cfg === null || !Array.isArray(cfg.connections)) return null;
+  const connections = cfg.connections.filter(isRecord).map((c) => ({ id: c.id, provider: c.provider, model: c.model }));
+  return json({ version: 2, route: cfg.route, connections });
+}
+
+export function viewFiles(dir = agentsDir()): Map<string, string | null> {
+  const files = new Map<string, string | null>([
+    ['agent.json', agentFile(dir)],
+    ['model.json', modelFile(dir)],
+  ]);
+  for (const name of COPIED) files.set(name, existsSync(join(dir, name)) ? readText(join(dir, name)) : null);
+  return files;
+}
+
+const written = new Map<string, string | null>();
+
+export function syncAgentView(user: AgentUser | null = agentUser(), dir = agentsDir()): number {
+  if (user === null) return 0;
+  const target = agentViewDir(user);
+  let changed = 0;
+  for (const [name, text] of viewFiles(dir)) {
+    const path = join(target, name);
+    if (written.has(path) && written.get(path) === text) continue;
+    if (text === null) removeHome(path, false, user);
+    else writeHomeText(path, text, 0o600, undefined, user);
+    written.set(path, text);
+    changed += 1;
+  }
+  return changed;
+}
+
+let timer: ReturnType<typeof setInterval> | null = null;
+
+export function watchAgentView(everyMs = SYNC_MS): void {
+  if (timer !== null) return;
+  const tick = (): void => {
+    try {
+      const changed = syncAgentView();
+      if (changed > 0) log.info({ changed }, 'agent-user: refreshed the Metro files the agent may read');
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'agent-user: could not refresh the Metro files the agent may read');
+    }
+  };
+  tick();
+  timer = setInterval(tick, everyMs);
+  timer.unref();
+}

package/runtime/node_modules/@metro-labs/daemon/src/approvals/needs.ts

@@ -0,0 +1,2 @@
+export const NEEDS_APPROVAL = (where: string, tool: string): string =>
+  `Needs the owner's approval for ${where} (${tool}). Make this exact call from a background worker so Claude Code asks the owner in chat, and wait for the answer. An approval given only in the terminal does not count.`;

package/runtime/node_modules/@metro-labs/daemon/src/approvals/pending.ts

@@ -27,6 +27,27 @@ const HOUR_MS = 3_600_000;
 
 const held = new Map<string, Held>();
 
+interface Grant {
+  tool: string;
+  preview: string;
+  at: number;
+}
+
+const GRANT_TTL_MS = 10 * 60_000;
+const GRANTS_MAX = 200;
+let grants: Grant[] = [];
+
+function grant(entry: Held, now = Date.now()): void {
+  grants = [...grants.filter((g) => now - g.at < GRANT_TTL_MS), { tool: entry.tool, preview: entry.preview, at: now }].slice(-GRANTS_MAX);
+}
+
+export function takeGrant(toolMatches: (tool: string) => boolean, args: Record<string, unknown>, now = Date.now()): boolean {
+  const at = grants.findIndex((g) => now - g.at < GRANT_TTL_MS && toolMatches(g.tool) && previewMatches(g.preview, args));
+  if (at < 0) return false;
+  grants = grants.filter((_, i) => i !== at);
+  return true;
+}
+
 export function approvalTtlMs(env: NodeJS.ProcessEnv = process.env): number {
   const hours = Number(env.METRO_APPROVAL_TTL_H);
   return (Number.isFinite(hours) && hours > 0 ? hours : DEFAULT_TTL_H) * HOUR_MS;
@@ -82,6 +103,7 @@ export async function answerPrompt(
   const entry = held.get(requestId);
   if (entry === undefined) return undefined;
   held.delete(requestId);
+  if (behavior === 'allow' && via !== 'expiry') grant(entry);
   log.info({ requestId, tool: entry.tool, behavior, by: who === via ? via : `${via} ${who}` }, 'approvals: a Claude Code permission prompt answered');
   await entry.send(behavior);
   await tellChat(entry, via, behavior);
@@ -123,4 +145,5 @@ export function startPromptExpiry(): () => void {
 
 export function forgetAllPrompts(): void {
   held.clear();
+  grants = [];
 }

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -23,6 +23,7 @@ import { agentsDir, fileSource } from '../agents/files.js';
 import { syncPluginServers } from '../connectors/plugin-sync.js';
 import { loadConnectorPolicies, readLocalConnectors } from '../connectors/store.js';
 import { ensureMetroPlugin } from '../claude/plugin-install.js';
+import { provisionAgentUser } from '../agent-user/provision.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
 import { tryClaudeSetup } from '../claude/setup.js';
 import { applyLocalOwner } from './local-owner.js';
@@ -147,6 +148,15 @@ installBearerSessions(agentsDir(), localOwner);
     'dispatcher ready',
   );
   markDaemonReady();
+  startClaude().catch((err: unknown) => {
+    log.warn({ err: errMsg(err) }, 'claude: could not start the Claude Code side');
+  });
+}
+
+async function startClaude(): Promise<void> {
+  const agentUser = await provisionAgentUser();
+  if (agentUser !== 'off') log.info({ agentUser }, 'agent-user: Claude Code runs as its own user');
+  if (agentUser === 'failed' || agentUser === 'unsupported') return;
   ensureMetroPlugin()
     .then((outcome) => {
       log.info({ outcome }, 'plugin: metro plugin for Claude Code');

package/runtime/node_modules/@metro-labs/daemon/src/claude/files.ts

@@ -5,16 +5,15 @@ import {
   openSync,
   readdirSync,
   readSync,
-  rmSync,
   statSync,
-  utimesSync,
 } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
-import { writeAtomic } from '@metro-labs/core/secure-fs';
+import { removeHome, writeHomeText } from '../agent-user/home-fs.js';
+import { agentUser } from '../agent-user/user.js';
 
 export const PROJECT_RE = /^[A-Za-z0-9._-]{1,200}$/;
 export const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9-]{7,63}$/;
@@ -36,7 +35,8 @@ export function claudeDir(): string {
   if (explicit !== undefined && explicit !== '') return explicit;
   const cfg = process.env.CLAUDE_CONFIG_DIR?.trim();
   if (cfg !== undefined && cfg !== '') return cfg;
-  return join(homedir(), '.claude');
+  const user = agentUser();
+  return join(user === null ? homedir() : user.home, '.claude');
 }
 
 const str = (v: unknown): string | null => (typeof v === 'string' && v !== '' ? v : null);
@@ -284,8 +284,8 @@ export function deleteClaudeSession(project: string, session: string, dir = clau
   const id = safeName(session, SESSION_RE, 'session id');
   const file = join(root, `${id}.jsonl`);
   if (!existsSync(file)) throw new ApiError('no such session', 404);
-  rmSync(file);
-  rmSync(join(root, id), { recursive: true, force: true });
+  removeHome(file);
+  removeHome(join(root, id), true);
 }
 
 export interface MemoryFile {
@@ -361,9 +361,7 @@ export function writeMemoryFile(project: string, name: string, text: string, dir
   if (Buffer.byteLength(text, 'utf8') > MEMORY_MAX)
     throw new ApiError(`a memory file is at most ${String(MEMORY_MAX)} bytes`, 400);
   const path = memoryPath(project, name, dir);
-  writeAtomic(path, text, MEMORY_MODE);
-  const stamp = stampOf(modifiedAt);
-  if (stamp !== null) utimesSync(path, stamp, stamp);
+  writeHomeText(path, text, MEMORY_MODE, stampOf(modifiedAt) ?? undefined);
   const stat = statSync(path);
   return { name, bytes: stat.size, modifiedAt: stat.mtime.toISOString() };
 }
@@ -371,7 +369,7 @@ export function writeMemoryFile(project: string, name: string, text: string, dir
 export function deleteMemoryFile(project: string, name: string, dir = claudeDir()): string {
   const path = memoryPath(project, name, dir);
   if (!existsSync(path)) throw new ApiError('no such memory file', 404);
-  rmSync(path);
+  removeHome(path);
   return name;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/login.ts

@@ -4,8 +4,9 @@ import { markOnboardingDone } from './onboarding.js';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, asAgent, claudeBin } from '../agent-user/user.js';
 
-const LOGIN_COMMAND = ['claude', 'auth', 'login', '--claudeai'];
+const LOGIN_ARGS = ['auth', 'login', '--claudeai'];
 const STATUS_COMMAND = ['auth', 'status', '--json'];
 const TTL_MS = 10 * 60_000;
 const OUTPUT_MAX = 8_000;
@@ -94,7 +95,7 @@ function forgetClaudeChecks(): void {
 
 export function claudeInstalled(): boolean {
   return remembered(checks.installed, () => {
-    const run = spawnSync('claude', ['--version'], { stdio: 'ignore' });
+    const run = spawnSync(...asAgent(claudeBin(), ['--version']), { stdio: 'ignore' });
     return run.error === undefined && run.status === 0;
   }, (c) => {
     checks.installed = c;
@@ -113,7 +114,7 @@ export function claudeAccount(): ClaudeAccount {
 }
 
 function readAccount(): ClaudeAccount {
-  const run = spawnSync('claude', STATUS_COMMAND, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   if (run.error !== undefined || typeof run.stdout !== 'string') return { signedIn: false, account: null };
   try {
     const parsed: unknown = JSON.parse(run.stdout);
@@ -133,7 +134,7 @@ function note(session: Live, chunk: string): void {
 export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now()): LoginView {
   sweep(now);
   if (live !== null && live.state === 'pending') return view(live);
-  const command = deps.command ?? LOGIN_COMMAND;
+  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], { TERM: 'xterm-256color' });
   const session: Live = {
     id: randomBytes(9).toString('base64url'),
     startedAt: now,

package/runtime/node_modules/@metro-labs/daemon/src/claude/onboarding.ts

@@ -1,7 +1,9 @@
-import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { isRecord } from '@metro-labs/core/is-record';
+import { writeHomeText } from '../agent-user/home-fs.js';
+import { agentUser } from '../agent-user/user.js';
 
 const FILE = '.claude.json';
 const FLAG = 'hasCompletedOnboarding';
@@ -12,6 +14,8 @@ const given = (value: string | undefined): string | undefined =>
   value !== undefined && value.trim() !== '' ? value.trim() : undefined;
 
 export function claudeConfigPath(env: NodeJS.ProcessEnv = process.env): string {
+  const user = agentUser();
+  if (user !== null) return join(user.home, FILE);
   return join(given(env.CLAUDE_CONFIG_DIR) ?? given(env.HOME) ?? homedir(), FILE);
 }
 
@@ -29,7 +33,7 @@ export function markOnboardingDone(path = claudeConfigPath()): OnboardingMark {
   const config = readConfig(path);
   if (config === null) return 'unreadable';
   if (config[FLAG] === true) return 'already';
-  writeFileSync(path, `${JSON.stringify({ ...config, [FLAG]: true }, null, 2)}\n`, { mode: 0o600 });
+  writeHomeText(path, `${JSON.stringify({ ...config, [FLAG]: true }, null, 2)}\n`, 0o600);
   return 'marked';
 }
 
@@ -51,6 +55,6 @@ export function trustFolder(dir: string, path = claudeConfigPath()): OnboardingM
   const project = isRecord(projects[key]) ? projects[key] : {};
   if (project[TRUST] === true) return 'already';
   const next = { ...config, projects: { ...projects, [key]: { ...project, [TRUST]: true } } };
-  writeFileSync(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  writeHomeText(path, `${JSON.stringify(next, null, 2)}\n`, 0o600);
   return 'marked';
 }

package/runtime/node_modules/@metro-labs/daemon/src/claude/plugin-install.ts

@@ -4,6 +4,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
+import { agentMarketplaceDir, agentUser, asAgent, claudeBin } from '../agent-user/user.js';
 
 const MARKETPLACE = 'metro';
 const PLUGIN = 'metro@metro';
@@ -25,13 +26,21 @@ export interface PluginInstallDeps {
 
 export type PluginOutcome = 'skipped' | 'unchanged' | 'installed' | 'updated' | 'failed';
 
-export function stagedMarketplaceDir(env: NodeJS.ProcessEnv = process.env): string | null {
+export function storeMarketplaceDir(env: NodeJS.ProcessEnv = process.env): string | null {
   const store = env.METRO_RUNTIME_STORE?.trim() ?? '';
   if (store === '') return null;
   const dir = join(store, 'marketplace');
   return existsSync(join(dir, '.claude-plugin', 'marketplace.json')) ? dir : null;
 }
 
+export function stagedMarketplaceDir(env: NodeJS.ProcessEnv = process.env): string | null {
+  const store = storeMarketplaceDir(env);
+  const user = agentUser();
+  if (store === null || user === null) return store;
+  const copy = agentMarketplaceDir(user);
+  return existsSync(join(copy, '.claude-plugin', 'marketplace.json')) ? copy : null;
+}
+
 export function stagedPluginVersion(dir: string): string | null {
   try {
     const parsed: unknown = JSON.parse(readFileSync(join(dir, 'plugin', '.claude-plugin', 'plugin.json'), 'utf8'));
@@ -45,13 +54,13 @@ const runner =
   (bin: string): Run =>
   (args) =>
     new Promise((resolve) => {
-      execFile(bin, args, { encoding: 'utf8', timeout: STEP_MS, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      execFile(...asAgent(bin, args), { encoding: 'utf8', timeout: STEP_MS, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
         const status = err === null ? 0 : typeof (err as { code?: unknown }).code === 'number' ? (err as { code: number }).code : 1;
         resolve({ status, stdout, stderr });
       });
     });
 
-export async function findClaude(candidates = ['claude', join(homedir(), '.local', 'bin', 'claude')]): Promise<Run | null> {
+export async function findClaude(candidates = agentUser() === null ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [claudeBin()]): Promise<Run | null> {
   for (const bin of candidates) {
     const run = runner(bin);
     if ((await run(['--version'])).status === 0) return run;

package/runtime/node_modules/@metro-labs/daemon/src/claude/session-files.ts

@@ -1,5 +1,6 @@
-import { createWriteStream, existsSync, mkdirSync, renameSync, rmSync, statSync } from 'node:fs';
-import type { Readable } from 'node:stream';
+import { existsSync, statSync } from 'node:fs';
+import { Transform, type Readable } from 'node:stream';
+import { moveHome, receiveHomeFile, removeHome } from '../agent-user/home-fs.js';
 import { join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
@@ -25,42 +26,41 @@ export function sessionFilePath(project: string, session: string, dir = claudeDi
 
 const HEAD_BYTES = 64 * 1024;
 
-async function spool(body: Readable, tmp: string): Promise<string> {
-  const out = createWriteStream(tmp, { mode: FILE_MODE });
-  const head: Buffer[] = [];
+function watched(body: Readable, head: Buffer[]): Transform {
   let total = 0;
   let kept = 0;
-  for await (const chunk of body) {
-    const buf = chunk as Buffer;
-    total += buf.length;
-    if (total > SESSION_FILE_MAX) {
-      out.destroy();
-      rmSync(tmp, { force: true });
-      throw new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 413);
-    }
-    if (kept < HEAD_BYTES) {
-      head.push(buf.subarray(0, HEAD_BYTES - kept));
-      kept += buf.length;
-    }
-    if (!out.write(buf)) await new Promise<void>((r) => out.once('drain', r));
-  }
-  await new Promise<void>((resolve, reject) => {
-    out.once('error', reject);
-    out.end(resolve);
+  const check = new Transform({
+    transform(chunk: Buffer, _enc, done): void {
+      total += chunk.length;
+      if (total > SESSION_FILE_MAX) {
+        done(new ApiError(`a session file is at most ${String(SESSION_FILE_MAX)} bytes`, 413));
+        return;
+      }
+      if (kept < HEAD_BYTES) {
+        head.push(chunk.subarray(0, HEAD_BYTES - kept));
+        kept += chunk.length;
+      }
+      done(null, chunk);
+    },
   });
-  return Buffer.concat(head).toString('utf8');
+  return body.pipe(check);
 }
 
 export async function receiveSessionFile(project: string, session: string, body: Readable, dir = claudeDir()): Promise<SessionFile> {
   const path = transcriptPath(project, session, dir);
-  mkdirSync(join(path, '..'), { recursive: true });
-  const tmp = `${path}.metro-${String(process.pid)}`;
-  const head = await spool(body, tmp);
-  if (!firstLineIsJson(head)) {
-    rmSync(tmp, { force: true });
+  const tmp = `${path}.metro-upload`;
+  const head: Buffer[] = [];
+  try {
+    await receiveHomeFile(tmp, watched(body, head), FILE_MODE);
+  } catch (err) {
+    removeHome(tmp);
+    throw err;
+  }
+  if (!firstLineIsJson(Buffer.concat(head).toString('utf8'))) {
+    removeHome(tmp);
     throw new ApiError('a session file is JSON lines, one Claude Code entry per line', 400);
   }
-  renameSync(tmp, path);
+  moveHome(tmp, path);
   return { id: safeName(session, SESSION_RE, 'session id'), bytes: statSync(path).size };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -11,6 +11,14 @@ import { notReady, readModelConfig, routedConnection } from '../gateway/model-co
 import { claudeDir, listClaudeProjects } from './files.js';
 import { claudeAccount, claudeInstalled } from './login.js';
 import { trustFolder } from './onboarding.js';
+import { agentUser, agentViewDir, asAgent, claudeHome, wantedAgentUser } from '../agent-user/user.js';
+
+function sessionEnv(): Record<string, string> {
+  const user = agentUser();
+  if (user === null) return {};
+  const port = process.env.METRO_WEBHOOK_PORT?.trim() ?? '';
+  return { METRO_AGENTS_DIR: agentViewDir(user), ...(port === '' ? {} : { METRO_WEBHOOK_PORT: port }) };
+}
 
 export const SESSION_NAME = 'metro';
 const STATE_FILE = 'claude-session.json';
@@ -74,7 +82,7 @@ export function startedVersion(agents = agentsDir()): string | null {
 }
 
 function tmuxOk(tmux: string, args: string[]): boolean {
-  const run = spawnSync(tmux, args, { stdio: 'ignore' });
+  const run = spawnSync(...asAgent(tmux, args), { stdio: 'ignore' });
   return run.error === undefined && run.status === 0;
 }
 
@@ -95,9 +103,12 @@ export function hasConversation(home: string, dir = claudeDir()): boolean {
 
 function metroCommand(deps: SessionDeps, home: string): string[] {
   const bin = process.env.METRO_CLI_BIN?.trim() ?? '';
-  const base = deps.metro ?? (bin === '' ? ['metro', 'claude'] : [process.execPath, bin, 'claude']);
+  const runtime = agentUser() === null ? process.execPath : 'node';
+  const base = deps.metro ?? (bin === '' ? ['metro', 'claude'] : [runtime, bin, 'claude']);
   const continues = (deps.continues ?? hasConversation)(home);
-  return continues ? [...base, '-c'] : base;
+  const env = Object.entries(sessionEnv()).map(([k, v]) => `${k}=${v}`);
+  const command = env.length === 0 || deps.metro !== undefined ? base : ['env', ...env, ...base];
+  return continues ? [...command, '-c'] : command;
 }
 
 function credentialReady(deps: SessionDeps): string | null {
@@ -113,16 +124,21 @@ function credentialReady(deps: SessionDeps): string | null {
   return 'Claude Code is not signed in and the Model page routes nowhere yet';
 }
 
+const agentUserMissing = (deps: SessionDeps, agents: string): boolean =>
+  deps.metro === undefined && wantedAgentUser(agents) !== null && agentUser(agents) === null;
+
 export function sessionBlocked(deps: SessionDeps = {}): string | null {
   const agents = deps.agents ?? agentsDir();
   if (listAgentFiles(agents).length === 0) return 'no agent on this machine yet';
+  if (agentUserMissing(deps, agents))
+    return 'Claude Code is set to run as its own user, and that user is not ready (Linux and a daemon running as root are needed; see the log)';
   if (deps.metro === undefined && !claudeInstalled()) return 'Claude Code is not installed on this machine';
   if (!tmuxOk(deps.tmux ?? 'tmux', ['-V'])) return 'tmux is not installed on this machine';
   return credentialReady(deps);
 }
 
 function capturePane(tmux: string): string {
-  const run = spawnSync(tmux, ['capture-pane', '-p', '-t', SESSION_NAME], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const run = spawnSync(...asAgent(tmux, ['capture-pane', '-p', '-t', SESSION_NAME]), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   return run.error === undefined && run.status === 0 ? run.stdout : '';
 }
 
@@ -130,7 +146,7 @@ function confirmChannels(tmux: string, until: number): void {
   const tick = (): void => {
     const pane = capturePane(tmux);
     if (pane.includes(WARNING) && pane.includes('server:metro')) {
-      spawnSync(tmux, ['send-keys', '-t', SESSION_NAME, 'Enter'], { stdio: 'ignore' });
+      spawnSync(...asAgent(tmux, ['send-keys', '-t', SESSION_NAME, 'Enter']), { stdio: 'ignore' });
       log.info('claude-session: confirmed the development channels dialog for server:metro');
       return;
     }
@@ -153,18 +169,19 @@ function recordStart(deps: SessionDeps, tmux: string, now: number, run: { error?
 
 export function startSession(deps: SessionDeps = {}): SessionStatus {
   const tmux = deps.tmux ?? 'tmux';
-  const home = deps.home ?? homedir();
+  const home = deps.home ?? claudeHome() ?? homedir();
   const now = (deps.now ?? Date.now)();
   const trusted = trustFolder(home);
   const [command = 'metro', ...args] = metroCommand(deps, home);
-  const run = spawnSync(tmux, ['new-session', '-d', '-s', SESSION_NAME, '-c', home, '-x', '200', '-y', '50', command, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], cwd: home });
+  const tmuxArgs = ['new-session', '-d', '-s', SESSION_NAME, '-c', home, '-x', '200', '-y', '50', command, ...args];
+  const run = spawnSync(...asAgent(tmux, tmuxArgs), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], cwd: home });
   recordStart(deps, tmux, now, run);
   if (memory.lastError === null) log.info({ home, trusted, command: [command, ...args].join(' ') }, 'claude-session: started Claude Code in tmux');
   return sessionStatus(deps);
 }
 
 export function stopSession(deps: SessionDeps = {}): SessionStatus {
-  spawnSync(deps.tmux ?? 'tmux', ['kill-session', '-t', SESSION_NAME], { stdio: 'ignore' });
+  spawnSync(...asAgent(deps.tmux ?? 'tmux', ['kill-session', '-t', SESSION_NAME]), { stdio: 'ignore' });
   return sessionStatus(deps);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/settings.ts

@@ -4,7 +4,7 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { claudeDir, listClaudeProjects } from './files.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg } from '@metro-labs/core/log';
-import { writeAtomic } from '@metro-labs/core/secure-fs';
+import { writeHomeText } from '../agent-user/home-fs.js';
 
 export const SETTINGS_MAX = 256 * 1024;
 const USER_ID = 'user';
@@ -104,6 +104,6 @@ export function writeClaudeSettings(
   assertSettingsJson(text);
   if (seenAt !== undefined && seenAt !== target.modifiedAt)
     throw new ApiError('that file changed on disk since you opened it; reload it before saving', 409);
-  writeAtomic(target.path, text);
+  writeHomeText(target.path, text, existsSync(target.path) ? statSync(target.path).mode & 0o777 : 0o644);
   return entryOf(target.id, target.scope, target.label, target.path);
 }

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -1,11 +1,12 @@
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { readJson, writeAtomic, writeJson } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
+import { writeHomeText } from '../agent-user/home-fs.js';
 import { claudeDir } from './files.js';
 import { stagedMarketplaceDir } from './plugin-install.js';
 import { readModelConfig, routedConnection, type ModelConfig } from '../gateway/model-config.js';
@@ -137,13 +138,12 @@ const digest = (text: string): string => createHash('sha256').update(text).diges
 
 export function placeFile(path: string, text: string, prior: ReadonlySet<string> = new Set()): Placed {
   if (!existsSync(path)) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, text, { mode: 0o644 });
+    writeHomeText(path, text, 0o644);
     return 'written';
   }
   const current = readFileSync(path, 'utf8');
   if (current === text || !prior.has(digest(current))) return 'present';
-  writeFileSync(path, text, { mode: 0o644 });
+  writeHomeText(path, text, 0o644);
   return 'updated';
 }
 
@@ -172,7 +172,7 @@ function mergeSettings(dir: string, change: (settings: Record<string, unknown>)
   if (current === null) return 'unreadable';
   const next = change(current);
   if (existsSync(path) && JSON.stringify(next) === JSON.stringify(current)) return 'unchanged';
-  writeAtomic(path, `${JSON.stringify(next, null, 2)}\n`);
+  writeHomeText(path, `${JSON.stringify(next, null, 2)}\n`, existsSync(path) ? statSync(path).mode & 0o777 : 0o644);
   return 'written';
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/skills.ts

@@ -1,8 +1,8 @@
-import { existsSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { claudeDir } from './files.js';
-import { writeAtomic } from '@metro-labs/core/secure-fs';
+import { removeHome, writeHomeText } from '../agent-user/home-fs.js';
 
 export const SKILL_MAX = 256 * 1024;
 export const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -87,7 +87,7 @@ export function writeClaudeSkill(
   assertText(text);
   if (seenAt !== undefined && seenAt !== skill.updatedAt)
     throw new ApiError('that skill changed on disk since you opened it; reload it before saving', 409);
-  writeAtomic(skill.path, text, DEFAULT_MODE);
+  writeHomeText(skill.path, text, DEFAULT_MODE);
   return entryOf(skill.name, skill.path);
 }
 
@@ -101,7 +101,7 @@ export function createClaudeSkill(name: string, text: string | undefined, dir =
   if (existsSync(path)) throw new ApiError('a skill by that name already lives there', 409);
   const body = text === undefined || text.trim() === '' ? skillTemplate(name) : text;
   assertText(body);
-  writeAtomic(path, body, DEFAULT_MODE);
+  writeHomeText(path, body, DEFAULT_MODE);
   return entryOf(name, path);
 }
 
@@ -109,6 +109,6 @@ export function deleteClaudeSkill(id: string, dir = claudeDir()): string {
   const skill = found(id, dir);
   const folder = dirname(skill.path);
   if (basename(folder) !== skill.name) throw new ApiError('that skill does not live in its own folder', 409);
-  rmSync(folder, { recursive: true, force: true });
+  removeHome(folder, true);
   return id;
 }

package/runtime/node_modules/@metro-labs/daemon/src/claude/version.ts

@@ -5,6 +5,7 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { sessionRunning, stopSession, type SessionDeps } from './session.js';
+import { agentUser, asAgent, claudeBin } from '../agent-user/user.js';
 
 const LATEST_URL = 'https://registry.npmjs.org/@anthropic-ai/claude-code/latest';
 const VERSION_RE = /(\d+)\.(\d+)\.(\d+)/;
@@ -27,7 +28,10 @@ export interface ClaudeVersion {
 
 let cached: { latest: string | null; at: number } | null = null;
 
-const candidates = (deps: VersionDeps): string[] => (deps.claude === undefined ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [deps.claude]);
+function candidates(deps: VersionDeps): string[] {
+  if (deps.claude !== undefined) return [deps.claude];
+  return agentUser() === null ? ['claude', join(homedir(), '.local', 'bin', 'claude')] : [claudeBin()];
+}
 
 const parse = (text: string): string | null => {
   const m = VERSION_RE.exec(text);
@@ -35,7 +39,7 @@ const parse = (text: string): string | null => {
 };
 
 function probe(bin: string): string | null {
-  const run = spawnSync(bin, ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const run = spawnSync(...asAgent(bin, ['--version']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   return run.error === undefined && run.status === 0 && typeof run.stdout === 'string' ? parse(run.stdout) : null;
 }
 
@@ -84,7 +88,7 @@ export async function claudeVersion(deps: VersionDeps = {}): Promise<ClaudeVersi
 }
 
 function install(bin: string): void {
-  const run = spawnSync(bin, ['install', 'latest'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: INSTALL_TIMEOUT_MS });
+  const run = spawnSync(...asAgent(bin, ['install', 'latest']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: INSTALL_TIMEOUT_MS });
   if (run.error !== undefined) throw new ApiError(`claude install latest failed: ${errMsg(run.error)}`, 502);
   if (run.status === 0) return;
   const said = `${run.stderr ?? ''}${run.stdout ?? ''}`.trim().slice(-TAIL);

package/runtime/node_modules/@metro-labs/daemon/src/connectors/gates.ts

@@ -1,6 +1,8 @@
 import type { ToolGroup } from '@metro-labs/core/stations/types';
 import { policyFor, setPolicies, type PolicyTarget, type ToolPolicy } from '../policy/policy.js';
 import { serverKeysOf } from './plugin-sync.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
 
 interface GateRow {
   id: string;
@@ -39,11 +41,18 @@ export const connectorGates = (): readonly ConnectorGate[] => gates;
 
 export const toolGroupOf = (gate: ConnectorGate, tool: string): ToolGroup => (gate.tools[tool] === 'read' ? 'read' : 'write');
 
-export function blockedReason(connectorId: string, tool: string): string | null {
+const promptFor = (connectorId: string, tool: string) => (asked: string): boolean => {
+  const found = connectorToolOf(asked);
+  return found?.gate.id === connectorId && found.tool === tool;
+};
+
+export function blockedReason(connectorId: string, tool: string, args: Record<string, unknown> = {}): string | null {
   const gate = gates.find((g) => g.id === connectorId);
   if (gate === undefined) return null;
   const access = policyFor({ kind: 'connector', id: connectorId }, { name: tool, group: toolGroupOf(gate, tool) });
-  return access === 'deny' ? `Blocked by the owner's policy for ${gate.name} (${tool}).` : null;
+  if (access === 'deny') return `Blocked by the owner's policy for ${gate.name} (${tool}).`;
+  if (access === 'allow' || takeGrant(promptFor(connectorId, tool), args)) return null;
+  return NEEDS_APPROVAL(gate.name, tool);
 }
 
 function prefixesOf(gate: ConnectorGate): string[] {

package/runtime/node_modules/@metro-labs/daemon/src/connectors/plugin-sync.ts

@@ -1,4 +1,5 @@
-import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { writeHomeInPlace } from '../agent-user/home-fs.js';
 import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
 import { claudeDir } from '../claude/files.js';
@@ -90,7 +91,7 @@ const readOrNull = (path: string): string | null => {
 
 function writeIfChanged(path: string, text: string): boolean {
   if (readOrNull(path) === text) return false;
-  writeFileSync(path, text, { mode: 0o644 });
+  writeHomeInPlace(path, text, 0o644);
   return true;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/connectors/relay-policy.ts

@@ -2,7 +2,7 @@ import type { ServerResponse } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
 
-export type BlockedReason = (connectorId: string, tool: string) => string | null;
+export type BlockedReason = (connectorId: string, tool: string, args: Record<string, unknown>) => string | null;
 
 export interface Screened {
   forward: Uint8Array<ArrayBuffer> | null;
@@ -31,9 +31,14 @@ function blockedAnswer(message: Record<string, unknown>, reason: string): Record
   return { jsonrpc: '2.0', id: message.id, result: { isError: true, content: [{ type: 'text', text: reason }] } };
 }
 
+function argsOf(message: unknown): Record<string, unknown> {
+  if (!isRecord(message) || !isRecord(message.params)) return {};
+  return isRecord(message.params.arguments) ? message.params.arguments : {};
+}
+
 function reasonFor(message: unknown, connectorId: string, blocked: BlockedReason): string | null {
   const tool = toolOf(message);
-  return tool === null ? null : blocked(connectorId, tool);
+  return tool === null ? null : blocked(connectorId, tool, argsOf(message));
 }
 
 export function screenCalls(body: Uint8Array<ArrayBuffer>, connectorId: string, blocked: BlockedReason): Screened | null {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-gate.ts

@@ -3,6 +3,9 @@ import type { ToolResult } from '@metro-labs/core/stations/types';
 import { accountFromLine, knownAccounts } from '../agents/map.js';
 import { policyFor, storedPolicy, strictest, type Access, type PolicyTarget } from '../policy/policy.js';
 import { errResult } from './ctx.js';
+import { takeGrant } from '../approvals/pending.js';
+import { NEEDS_APPROVAL } from '../approvals/needs.js';
+import { connectorToolOf } from '../connectors/gates.js';
 import { profileScopeLine } from './profile-lookup.js';
 import { stationOfAccount } from './read-tool.js';
 import { stationForTool, toolGroupOf } from './tool-catalog.js';
@@ -48,10 +51,13 @@ export function channelDecision(name: string, a: Record<string, unknown>): Polic
   return verdict;
 }
 
+const isChannelTool = (name: string) => (tool: string): boolean => tool.endsWith(`__${name}`) && connectorToolOf(tool) === undefined;
+
 export function policyGate(name: string, a: Record<string, unknown>): ToolResult | undefined {
   const { access, target } = channelDecision(name, a);
-  if (access !== 'deny' || target === undefined) return undefined;
-  return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  if (access === 'allow' || target === undefined) return undefined;
+  if (access === 'deny') return errResult(`Blocked by the owner's policy for ${target.station} (${name}).`);
+  return takeGrant(isChannelTool(name), a) ? undefined : errResult(NEEDS_APPROVAL(target.station, name));
 }
 
 export interface EffectivePolicy {

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-resolve.ts

@@ -12,6 +12,7 @@ import {
   writeInlineTemp,
 } from './attach-inline.js';
 import { realpathSync } from 'node:fs';
+import { agentCommand, agentUser, type AgentUser } from '../agent-user/user.js';
 import { log } from '@metro-labs/core/log';
 import { readUpload, UPLOAD_TTL_MS } from '../files/upload-store.js';
 import type { CanonicalAttachment } from '@metro-labs/core/stations/types';
@@ -56,11 +57,32 @@ function assertReadablePath(path: string): void {
     );
 }
 
+async function fromPathAs(
+  user: AgentUser,
+  a: CanonicalAttachment,
+  path: string,
+): Promise<ResolvedAttachment> {
+  const proc = Bun.spawn(agentCommand(['cat', '--', path]), { stdout: 'pipe', stderr: 'pipe' });
+  const name = a.name ?? basenameOf(path) ?? 'attachment';
+  const saved = await streamToTemp(proc.stdout, name);
+  if ((await proc.exited) !== 0) {
+    await removeInlineTemp(saved.dir);
+    throw new Error(
+      `attachment path '${path}' cannot be read by the ${user.name} user Claude Code runs as. ` +
+        '`path` is read on the daemon machine with the agent\'s own rights; pass `upload` instead.',
+    );
+  }
+  assertAttachmentSize(saved.bytes);
+  return { path: saved.path, mime: a.mime ?? guessMime(path), name, bytes: saved.bytes, temp: saved.dir };
+}
+
 async function fromPath(
   a: CanonicalAttachment,
   path: string,
 ): Promise<ResolvedAttachment> {
   assertReadablePath(path);
+  const user = agentUser();
+  if (user !== null) return fromPathAs(user, a, path);
   const file = Bun.file(path);
   if (!(await file.exists()))
     throw new Error(

package/runtime/node_modules/@metro-labs/daemon/src/terminal/api.ts

@@ -5,12 +5,13 @@ import { ApiError } from '@metro-labs/http/api-error';
 import { bodyField, readJsonBody, sessionRoute } from '@metro-labs/http/api-http';
 import { log } from '@metro-labs/core/log';
 import { mintTerminalTicket } from './tickets.js';
+import { agentCommand, asAgent, claudeHome } from '../agent-user/user.js';
 
 const PREFIX = '/api/terminal';
 const TICKETS = `${PREFIX}/tickets`;
 const SESSION_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,31}$/;
 
-export const tmuxCommand = (session: string, home = homedir()): string[] => [
+export const tmuxCommand = (session: string, home = claudeHome() ?? homedir()): string[] => agentCommand([
   'tmux',
   'new-session',
   '-A',
@@ -34,7 +35,7 @@ export const tmuxCommand = (session: string, home = homedir()): string[] => [
   '-as',
   'terminal-features',
   ',xterm-256color:clipboard',
-];
+], { TERM: 'xterm-256color', COLORTERM: 'truecolor' });
 
 export interface TerminalApiDeps {
   command?: (session: string) => string[];
@@ -42,12 +43,12 @@ export interface TerminalApiDeps {
 
 function tmuxAvailable(deps: TerminalApiDeps): boolean {
   if (deps.command !== undefined) return true;
-  const run = spawnSync('tmux', ['-V'], { stdio: 'ignore' });
+  const run = spawnSync(...asAgent('tmux', ['-V']), { stdio: 'ignore' });
   return run.error === undefined && run.status === 0;
 }
 
 export function tmuxSessions(): string[] {
-  const run = spawnSync('tmux', ['list-sessions', '-F', '#{session_name}'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const run = spawnSync(...asAgent('tmux', ['list-sessions', '-F', '#{session_name}']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   if (run.error !== undefined || run.status !== 0) return [];
   return run.stdout
     .split('\n')

package/runtime/node_modules/@metro-labs/daemon/src/terminal/socket.ts

@@ -5,6 +5,7 @@ import { WebSocketServer, type RawData, type WebSocket } from 'ws';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { takeTerminalTicket, type TerminalGrant } from './tickets.js';
+import { asAgent } from '../agent-user/user.js';
 
 const TICKET_PATH = /^\/api\/terminal\/([A-Za-z0-9_-]{43})$/;
 const MAX_MESSAGE = 1024 * 1024;
@@ -31,8 +32,8 @@ export const resizeWindowArgs = (session: string, cols: number, rows: number): s
 ];
 
 function sizeTmuxWindow(command: string[], session: string, cols: number, rows: number): void {
-  if (command[0] !== 'tmux') return;
-  const child = spawn('tmux', resizeWindowArgs(session, cols, rows), { stdio: 'ignore' });
+  if (!command.includes('tmux')) return;
+  const child = spawn(...asAgent('tmux', resizeWindowArgs(session, cols, rows)), { stdio: 'ignore' });
   child.on('error', (err) => {
     log.warn({ err: errMsg(err) }, 'terminal: resize-window could not run');
   });

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.181"
+  "version": "0.1.0-beta.183"
 }