@stage-labs/metro 0.1.0-beta.189 → 0.1.0-beta.190

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.189",
+  "version": "0.1.0-beta.190",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.189",
+  "version": "0.1.0-beta.190",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/api.ts

@@ -7,10 +7,12 @@ import { log } from '@metro-labs/core/log';
 import { writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { agentUser, CONFIG_FILE, forgetAgentUser, wantedAgentUser } from './user.js';
-import { listWorkspace, startMove } from './workspace.js';
+import { listWorkspace, modeOf, startMove } from './workspace.js';
+import { changeSchedule, listSchedules } from './schedules.js';
 
 const PATH = '/api/agent-user';
 const WORKSPACE = '/api/agent-user/workspace';
+const SCHEDULES = '/api/schedules';
 const EXIT_DELAY_MS = 500;
 const NAMES_BODY_MAX = 128 * 1024;
 
@@ -59,26 +61,38 @@ async function workspaceAnswer(req: IncomingMessage, dir: string): Promise<unkno
   const user = agentUser(dir);
   if (user === null) throw new ApiError('switch Claude Code to its own user first', 409);
   if (req.method === 'GET') return { user: user.name, home: user.home, entries: listWorkspace(user) };
-  const started = startMove(bodyField(await readJsonBody(req, NAMES_BODY_MAX), 'names'), user);
+  const body = await readJsonBody(req, NAMES_BODY_MAX);
+  const started = startMove(bodyField(body, 'names'), user, modeOf(bodyField(body, 'mode')));
   return { started, entries: listWorkspace(user) };
 }
 
+async function schedulesAnswer(req: IncomingMessage, dir: string): Promise<unknown> {
+  const user = agentUser(dir);
+  if (req.method === 'GET') return { agentUser: user?.name ?? null, jobs: listSchedules(user) };
+  const body = await readJsonBody(req);
+  const id = bodyField(body, 'id');
+  if (typeof id !== 'string' || id === '') throw new ApiError('id is required', 400);
+  return { agentUser: user?.name ?? null, jobs: changeSchedule(id, bodyField(body, 'action'), user) };
+}
+
+async function switchAnswer(req: IncomingMessage, deps: AgentUserApiDeps, subject: string): Promise<unknown> {
+  const enabled = bodyField(await readJsonBody(req), 'enabled');
+  if (typeof enabled !== 'boolean') throw new ApiError('enabled must be true or false', 400);
+  const reason = unsupported((deps.host ?? realHost)());
+  if (enabled && reason !== null) throw new ApiError(reason, 400);
+  setWanted((deps.agents ?? agentsDir)(), enabled);
+  log.info({ enabled, subject }, 'agent-user-api: switched from the page; restarting');
+  setTimeout(deps.restart, EXIT_DELAY_MS).unref();
+  return { ...agentUserStatus(deps), restarting: true };
+}
+
 export function handleAgentUserRequest(req: IncomingMessage, res: ServerResponse, deps: AgentUserApiDeps): boolean {
-  const methods = { [PATH]: ['GET', 'POST'], [WORKSPACE]: ['GET', 'POST'] };
+  const methods = { [PATH]: ['GET', 'POST'], [WORKSPACE]: ['GET', 'POST'], [SCHEDULES]: ['GET', 'POST'] };
   return sessionRoute(req, res, { methods, admin: ['POST'], label: 'agent-user-api' }, async (session, path) => {
-    if (path === WORKSPACE) {
-      requireAdmin(session);
-      return workspaceAnswer(req, (deps.agents ?? agentsDir)());
-    }
-    if (req.method === 'GET') return agentUserStatus(deps);
-    const enabled = bodyField(await readJsonBody(req), 'enabled');
-    if (typeof enabled !== 'boolean') throw new ApiError('enabled must be true or false', 400);
-    const reason = unsupported((deps.host ?? realHost)());
-    if (enabled && reason !== null) throw new ApiError(reason, 400);
     const dir = (deps.agents ?? agentsDir)();
-    setWanted(dir, enabled);
-    log.info({ enabled, subject: session.subject }, 'agent-user-api: switched from the page; restarting');
-    setTimeout(deps.restart, EXIT_DELAY_MS).unref();
-    return { ...agentUserStatus(deps), restarting: true };
+    if (path !== PATH) requireAdmin(session);
+    if (path === WORKSPACE) return workspaceAnswer(req, dir);
+    if (path === SCHEDULES) return schedulesAnswer(req, dir);
+    return req.method === 'GET' ? agentUserStatus(deps) : switchAnswer(req, deps, session.subject);
   });
 }

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/git-links.ts

@@ -0,0 +1,34 @@
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { errMsg, log } from '@metro-labs/core/log';
+import { asUser, type AgentUser } from './user.js';
+
+const REPAIR = [
+  'from="$1"; to="$2"',
+  'find "$to" -maxdepth 8 -name node_modules -prune -o -name .git -type f -print 2>/dev/null | while read -r f; do',
+  '  grep -q "^gitdir: $from/" "$f" && sed -i "s#^gitdir: $from/#gitdir: $to/#" "$f" && echo "$f"',
+  'done',
+  'find "$to" -maxdepth 10 -name node_modules -prune -o -path "*/.git/worktrees/*/gitdir" -type f -print 2>/dev/null | while read -r g; do',
+  '  grep -q "^$from/" "$g" && sed -i "s#^$from/#$to/#" "$g" && echo "$g"',
+  'done',
+].join('\n');
+
+export function repairGitLinks(user: AgentUser, from = homedir()): Promise<number> {
+  const [file, args] = asUser(user, 'sh', ['-c', REPAIR, 'metro', from, user.home]);
+  return new Promise((resolve) => {
+    const child = spawn(file, args, { stdio: ['ignore', 'pipe', 'ignore'] });
+    let out = '';
+    child.stdout.on('data', (chunk: Buffer) => {
+      out += chunk.toString('utf8');
+    });
+    child.on('error', (err) => {
+      log.warn({ err: errMsg(err) }, 'agent-user: could not repair git links');
+      resolve(0);
+    });
+    child.on('close', () => {
+      const fixed = out.split('\n').filter((line) => line !== '').length;
+      if (fixed > 0) log.info({ fixed }, "agent-user: repaired git links that still pointed into root's home");
+      resolve(fixed);
+    });
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/provision.ts

@@ -8,6 +8,7 @@ import { agentsDir } from '../agents/files.js';
 import { copyIntoHome } from './home-fs.js';
 import { agentMarketplaceDir, agentUser, asUser, claudeBin, forgetAgentUser, lookupUser, wantedAgentUser, type AgentUser } from './user.js';
 import { watchAgentView } from './view.js';
+import { repairGitLinks } from './git-links.js';
 
 const INSTALL_MS = 10 * 60_000;
 const INSTALLER = 'curl -fsSL https://claude.ai/install.sh | bash';
@@ -185,6 +186,9 @@ export async function provisionAgentUser(dir = agentsDir(), env: NodeJS.ProcessE
     await installClaude(user);
     copyMarketplace(user, env);
     watchAgentView();
+    repairGitLinks(user).catch((err: unknown) => {
+      log.warn({ err: errMsg(err) }, 'agent-user: could not repair git links');
+    });
     return 'ready';
   } catch (err) {
     log.error({ user: name, err: errMsg(err) }, 'agent-user: could not prepare the agent user; the Claude session stays stopped');

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/schedules.ts

@@ -0,0 +1,230 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+import type { AgentUser } from './user.js';
+
+const UNIT_DIR = '/etc/systemd/system';
+const DROP_IN = '10-metro-agent.conf';
+const OWN_UNITS = /^metro(-claude-\d+)?\.(service|scope)$/;
+
+export type JobKind = 'timer' | 'cron-root' | 'cron-agent';
+
+export interface ScheduledJob {
+  id: string;
+  kind: JobKind;
+  name: string;
+  schedule: string;
+  command: string;
+  runsAs: string;
+  next: string | null;
+  last: string | null;
+  lastResult: string | null;
+  usesRoot: boolean;
+  converted: boolean;
+}
+
+export interface Runner {
+  run: (file: string, args: string[], input?: string) => { status: number | null; stdout: string };
+}
+
+const realRunner: Runner = {
+  run: (file, args, input) => {
+    const done = spawnSync(file, args, { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'ignore'], timeout: 20_000 });
+    return { status: done.error === undefined ? done.status : null, stdout: done.stdout ?? '' };
+  },
+};
+
+const ROOT_RE = /(^|[\s="'=:])\/root(?=\/|$|[\s"';:])/;
+export const usesRootHome = (text: string): boolean => ROOT_RE.test(text);
+export const rehome = (text: string, home: string): string => text.replace(/(^|[\s="'=:])\/root(?=\/|$|[\s"';:])/g, `$1${home}`);
+
+const stamp = (micros: unknown): string | null =>
+  typeof micros === 'number' && micros > 0 ? new Date(micros / 1000).toISOString() : null;
+
+function showProps(runner: Runner, unit: string, props: string[]): Record<string, string> {
+  const out = runner.run('systemctl', ['show', unit, '--no-pager', ...props.map((p) => `-p${p}`)]).stdout;
+  const found: Record<string, string> = {};
+  for (const line of out.split('\n')) {
+    const at = line.indexOf('=');
+    if (at > 0) found[line.slice(0, at)] = line.slice(at + 1);
+  }
+  return found;
+}
+
+export function execArgv(execStart: string): string[] {
+  const m = /argv\[\]=(.*?) ;/.exec(execStart);
+  return m?.[1] === undefined ? [] : m[1].split(' ').filter((a) => a !== '');
+}
+
+export const calendarOf = (timers: string): string =>
+  /OnCalendar=([^;]*?) ;/.exec(timers)?.[1]?.trim() ?? /(OnUnitActiveUSec|OnBootUSec|OnActiveUSec)=([^;]*?) ;/.exec(timers)?.[0]?.replace(/ ;$/, '') ?? '';
+
+function listTimers(runner: Runner): Record<string, unknown>[] {
+  try {
+    const raw: unknown = JSON.parse(runner.run('systemctl', ['list-timers', '--all', '--output=json', '--no-pager']).stdout);
+    return Array.isArray(raw) ? raw.filter(isRecord) : [];
+  } catch {
+    return [];
+  }
+}
+
+const text = (v: unknown): string => (typeof v === 'string' ? v : '');
+const orRoot = (user: string | undefined): string => (user === undefined || user === '' ? 'root' : user);
+
+function timerJob(runner: Runner, t: Record<string, unknown>): ScheduledJob | null {
+  const unit = text(t.unit);
+  const service = text(t.activates);
+  if (unit === '' || service === '' || OWN_UNITS.test(service)) return null;
+  const timer = showProps(runner, unit, ['FragmentPath', 'TimersCalendar', 'TimersMonotonic']);
+  if (!text(timer.FragmentPath).startsWith(`${UNIT_DIR}/`)) return null;
+  const svc = showProps(runner, service, ['ExecStart', 'User', 'Result', 'DropInPaths', 'Environment', 'WorkingDirectory']);
+  const command = execArgv(text(svc.ExecStart)).join(' ');
+  return {
+    id: `timer:${unit}`,
+    kind: 'timer',
+    name: unit.replace(/\.timer$/, ''),
+    schedule: calendarOf(`${text(timer.TimersCalendar)} ${text(timer.TimersMonotonic)}`),
+    command,
+    runsAs: orRoot(svc.User),
+    next: stamp(t.next),
+    last: stamp(t.last),
+    lastResult: svc.Result ?? null,
+    usesRoot: usesRootHome(`${command} ${text(svc.Environment)} ${text(svc.WorkingDirectory)}`),
+    converted: text(svc.DropInPaths).includes(DROP_IN),
+  };
+}
+
+const timerJobs = (runner: Runner): ScheduledJob[] =>
+  listTimers(runner).flatMap((t) => {
+    const job = timerJob(runner, t);
+    return job === null ? [] : [job];
+  });
+
+export interface CronLine {
+  schedule: string;
+  command: string;
+}
+
+export function parseCronLine(line: string): CronLine | null {
+  const text = line.trim();
+  if (text === '' || text.startsWith('#') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(text)) return null;
+  if (text.startsWith('@')) {
+    const [at = '', ...rest] = text.split(/\s+/);
+    return rest.length === 0 ? null : { schedule: at, command: rest.join(' ') };
+  }
+  const parts = text.split(/\s+/);
+  if (parts.length < 6) return null;
+  return { schedule: parts.slice(0, 5).join(' '), command: parts.slice(5).join(' ') };
+}
+
+const lineId = (kind: JobKind, line: string): string => `${kind}:${createHash('sha256').update(line.trim()).digest('hex').slice(0, 16)}`;
+
+function crontabOf(runner: Runner, user: string): string[] {
+  const out = runner.run('crontab', ['-l', '-u', user]);
+  return out.status === 0 ? out.stdout.split('\n') : [];
+}
+
+function cronJobs(runner: Runner, user: string, kind: JobKind): ScheduledJob[] {
+  return crontabOf(runner, user).flatMap((line): ScheduledJob[] => {
+    const parsed = parseCronLine(line);
+    if (parsed === null) return [];
+    return [{
+      id: lineId(kind, line),
+      kind,
+      name: parsed.command.split(/\s+/)[0]?.split('/').pop() ?? 'cron',
+      schedule: parsed.schedule,
+      command: parsed.command,
+      runsAs: user,
+      next: null,
+      last: null,
+      lastResult: null,
+      usesRoot: usesRootHome(parsed.command),
+      converted: false,
+    }];
+  });
+}
+
+export function listSchedules(user: AgentUser | null, runner: Runner = realRunner): ScheduledJob[] {
+  return [...timerJobs(runner), ...cronJobs(runner, 'root', 'cron-root'), ...(user === null ? [] : cronJobs(runner, user.name, 'cron-agent'))];
+}
+
+const quote = (arg: string): string => `"${arg.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+
+export function dropInText(user: AgentUser, argv: string[], environment: string): string {
+  const env = environment.split(' ').filter((pair) => pair.includes('=') && !pair.startsWith('HOME=') && !pair.startsWith('PATH='));
+  return [
+    '[Service]',
+    `User=${user.name}`,
+    `Group=${String(user.gid)}`,
+    `WorkingDirectory=${user.home}`,
+    `Environment=HOME=${user.home}`,
+    `Environment=PATH=${user.home}/.local/bin:/usr/local/bin:/usr/bin:/bin`,
+    ...env.map((pair) => `Environment=${quote(rehome(pair, user.home))}`),
+    'ExecStart=',
+    `ExecStart=${argv.map((a) => quote(rehome(a, user.home))).join(' ')}`,
+    '',
+  ].join('\n');
+}
+
+function convertTimer(job: ScheduledJob, user: AgentUser, runner: Runner): void {
+  const unit = job.id.slice('timer:'.length);
+  const service = showProps(runner, unit, ['Unit']).Unit ?? unit.replace(/\.timer$/, '.service');
+  const svc = showProps(runner, service, ['ExecStart', 'Environment']);
+  const argv = execArgv(svc.ExecStart ?? '');
+  if (argv.length === 0) throw new ApiError('that timer runs no command metro can read', 400);
+  const missing = argv.map((a) => rehome(a, user.home)).find((a) => a.startsWith(`${user.home}/`) && !existsSync(a));
+  if (missing !== undefined) throw new ApiError(`${missing} does not exist; move it to the agent first`, 409);
+  const dir = join(UNIT_DIR, `${service}.d`);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, DROP_IN), dropInText(user, argv, svc.Environment ?? ''), { mode: 0o644 });
+  runner.run('systemctl', ['daemon-reload']);
+  log.info({ unit, service, user: user.name }, 'schedules: a timer now runs as the agent user');
+}
+
+function restoreTimer(job: ScheduledJob, runner: Runner): void {
+  const unit = job.id.slice('timer:'.length);
+  const service = showProps(runner, unit, ['Unit']).Unit ?? unit.replace(/\.timer$/, '.service');
+  rmSync(join(UNIT_DIR, `${service}.d`, DROP_IN), { force: true });
+  runner.run('systemctl', ['daemon-reload']);
+  log.info({ unit, service }, 'schedules: a timer runs as root again');
+}
+
+function convertCron(job: ScheduledJob, user: AgentUser, backups: string, runner: Runner): void {
+  const lines = crontabOf(runner, 'root');
+  const line = lines.find((l) => lineId('cron-root', l) === job.id);
+  if (line === undefined) throw new ApiError('that cron line is gone', 404);
+  mkdirSync(backups, { recursive: true });
+  writeFileSync(join(backups, `crontab-root.${new Date().toISOString().replace(/[:.]/g, '-')}.bak`), lines.join('\n'), { mode: 0o600 });
+  const agentLines = crontabOf(runner, user.name).filter((l) => l !== '');
+  const moved = runner.run('crontab', ['-u', user.name, '-'], `${[...agentLines, rehome(line, user.home)].join('\n')}\n`);
+  if (moved.status !== 0) throw new ApiError("the agent's crontab refused the line", 500);
+  const kept = lines.filter((l) => l !== line && l !== '');
+  runner.run('crontab', ['-u', 'root', '-'], `${kept.join('\n')}\n`);
+  log.info({ user: user.name }, "schedules: a root cron line moved to the agent's crontab");
+}
+
+function toRoot(job: ScheduledJob, runner: Runner): void {
+  if (job.kind !== 'timer' || !job.converted) throw new ApiError('only a timer metro switched can go back to root', 400);
+  restoreTimer(job, runner);
+}
+
+function toAgent(job: ScheduledJob, user: AgentUser | null, backups: string, runner: Runner): void {
+  if (user === null) throw new ApiError('switch Claude Code to its own user first', 409);
+  if (job.kind === 'timer') convertTimer(job, user, runner);
+  else if (job.kind === 'cron-root') convertCron(job, user, backups, runner);
+  else throw new ApiError('that job already runs as the agent', 400);
+}
+
+export function changeSchedule(id: string, action: unknown, user: AgentUser | null, backups = join(homedir(), '.metro', 'agents'), runner: Runner = realRunner): ScheduledJob[] {
+  if (action !== 'agent' && action !== 'root') throw new ApiError('action must be agent or root', 400);
+  const job = listSchedules(user, runner).find((j) => j.id === id);
+  if (job === undefined) throw new ApiError('no such scheduled job', 404);
+  if (action === 'root') toRoot(job, runner);
+  else toAgent(job, user, backups, runner);
+  return listSchedules(user, runner);
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/workspace.ts

@@ -1,21 +1,39 @@
 import { spawn, spawnSync } from 'node:child_process';
-import { lstatSync, mkdtempSync, readdirSync, rmSync } from 'node:fs';
+import { existsSync, lstatSync, mkdtempSync, readdirSync, rmSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { errMsg, log } from '@metro-labs/core/log';
-import type { AgentUser } from './user.js';
+import { repairGitLinks } from './git-links.js';
+import { asUser, type AgentUser } from './user.js';
 
 const SKIPPED = new Set(['snap', 'lost+found']);
+const SAFE_HIDDEN = [
+  '.cache/huggingface/hub',
+  '.cache/whisper',
+  '.cache/torch',
+  '.cache/ms-playwright',
+  '.venv',
+  '.venvs',
+  '.virtualenvs',
+  '.pyenv',
+  '.bun',
+  '.nvm',
+  '.cargo',
+  '.rustup',
+  '.deno',
+];
 const SIZE_MS = 2_000;
 const SIZES_BUDGET_MS = 6_000;
 const NAMES_MAX = 1_000;
 
 export type EntryState = 'here' | 'waiting' | 'copying' | 'moved' | 'failed';
+export type MoveMode = 'copy' | 'move';
 
 export interface WorkspaceEntry {
   name: string;
   kind: 'folder' | 'file' | 'link';
+  hidden: boolean;
   bytes: number | null;
   state: EntryState;
   error: string | null;
@@ -29,8 +47,6 @@ interface Job {
 const jobs = new Map<string, Job>();
 let queue: Promise<void> = Promise.resolve();
 
-const offered = (name: string): boolean => !name.startsWith('.') && !SKIPPED.has(name) && !name.includes('/');
-
 function kindOf(path: string): WorkspaceEntry['kind'] | null {
   try {
     const stat = lstatSync(path);
@@ -42,13 +58,19 @@ function kindOf(path: string): WorkspaceEntry['kind'] | null {
   }
 }
 
+const present = (path: string): boolean => kindOf(path) !== null;
+
 function sizeOf(path: string): number | null {
   const run = spawnSync('du', ['-sk', path], { encoding: 'utf8', timeout: SIZE_MS, stdio: ['ignore', 'pipe', 'ignore'] });
   const kb = Number(run.stdout.split('\t')[0]);
   return run.status === 0 && Number.isFinite(kb) ? kb * 1024 : null;
 }
 
-const present = (path: string): boolean => kindOf(path) !== null;
+export function candidates(from = homedir()): string[] {
+  const visible = readdirSync(from).filter((name) => !name.startsWith('.') && !SKIPPED.has(name));
+  const hidden = SAFE_HIDDEN.filter((name) => kindOf(join(from, name)) === 'folder');
+  return [...visible.sort((a, b) => a.localeCompare(b)), ...hidden];
+}
 
 function stateOf(name: string, user: AgentUser): Pick<WorkspaceEntry, 'state' | 'error'> {
   const job = jobs.get(name);
@@ -58,16 +80,13 @@ function stateOf(name: string, user: AgentUser): Pick<WorkspaceEntry, 'state' |
 
 export function listWorkspace(user: AgentUser, from = homedir(), now = Date.now): WorkspaceEntry[] {
   const until = now() + SIZES_BUDGET_MS;
-  return readdirSync(from)
-    .filter(offered)
-    .sort((a, b) => a.localeCompare(b))
-    .flatMap((name): WorkspaceEntry[] => {
-      const path = join(from, name);
-      const kind = kindOf(path);
-      if (kind === null) return [];
-      const bytes = kind === 'file' ? lstatSync(path).size : kind === 'folder' && now() < until ? sizeOf(path) : null;
-      return [{ name, kind, bytes, ...stateOf(name, user) }];
-    });
+  return candidates(from).flatMap((name): WorkspaceEntry[] => {
+    const path = join(from, name);
+    const kind = kindOf(path);
+    if (kind === null) return [];
+    const bytes = kind === 'file' ? lstatSync(path).size : kind === 'folder' && now() < until ? sizeOf(path) : null;
+    return [{ name, kind, hidden: name.startsWith('.'), bytes, ...stateOf(name, user) }];
+  });
 }
 
 function run(file: string, args: string[]): Promise<void> {
@@ -85,28 +104,58 @@ function run(file: string, args: string[]): Promise<void> {
   });
 }
 
-async function moveOne(name: string, user: AgentUser, from: string): Promise<void> {
+function makeParents(user: AgentUser, target: string): void {
+  const parent = dirname(target);
+  if (parent === user.home || existsSync(parent)) return;
+  const [file, args] = asUser(user, 'mkdir', ['-p', '--', parent]);
+  spawnSync(file, args, { stdio: 'ignore' });
+}
+
+const sameDisk = (a: string, b: string): boolean => statSync(a).dev === statSync(b).dev;
+
+async function putBack(staged: string, source: string): Promise<void> {
+  if (present(staged) && !present(source)) await run('mv', ['-T', '--', staged, source]);
+}
+
+async function place(name: string, user: AgentUser, from: string, mode: MoveMode): Promise<void> {
+  const source = join(from, name);
+  const target = join(user.home, name);
   const staging = mkdtempSync(join(user.home, '..', '.metro-move-'));
+  const staged = join(staging, 'entry');
   try {
-    const staged = join(staging, name);
-    await run('cp', ['-a', '--', join(from, name), staged]);
+    if (mode === 'move') await run('mv', ['-T', '--', source, staged]);
+    else await run('cp', ['-a', '--', source, staged]);
     await run('chown', ['-hR', `${String(user.uid)}:${String(user.gid)}`, staged]);
-    const target = join(user.home, name);
+    makeParents(user, target);
     if (present(target)) throw new Error(`${target} already exists; move or remove it first`);
     await run('mv', ['-T', '--', staged, target]);
-    jobs.delete(name);
-    log.info({ name, user: user.name }, 'agent-user: moved a folder from root\'s home to the agent user');
+  } catch (err) {
+    if (mode === 'move') await putBack(staged, source);
+    throw err;
   } finally {
     rmSync(staging, { recursive: true, force: true });
   }
 }
 
+async function moveOne(name: string, user: AgentUser, from: string, mode: MoveMode): Promise<void> {
+  await place(name, user, from, mode);
+  jobs.delete(name);
+  await repairGitLinks(user, from);
+  log.info({ name, mode, user: user.name }, "agent-user: an entry from root's home now belongs to the agent user");
+}
+
 function wantedNames(names: unknown): string[] {
   if (!Array.isArray(names) || names.length === 0 || names.length > NAMES_MAX || !names.every((n) => typeof n === 'string'))
     throw new ApiError('names must be a list of entries from the list', 400);
   return [...new Set(names)];
 }
 
+export function modeOf(raw: unknown): MoveMode {
+  if (raw === undefined || raw === 'copy') return 'copy';
+  if (raw === 'move') return 'move';
+  throw new ApiError('mode must be copy or move', 400);
+}
+
 function assertMovable(name: string, listed: ReadonlySet<string>, user: AgentUser): void {
   if (!listed.has(name)) throw new ApiError(`${name} is not an entry metro offers to move`, 400);
   const job = jobs.get(name)?.state;
@@ -114,17 +163,18 @@ function assertMovable(name: string, listed: ReadonlySet<string>, user: AgentUse
   if (present(join(user.home, name))) throw new ApiError(`${name} already exists in ${user.home}`, 409);
 }
 
-export function startMove(names: unknown, user: AgentUser, from = homedir()): string[] {
+export function startMove(names: unknown, user: AgentUser, mode: MoveMode = 'copy', from = homedir()): string[] {
   const wanted = wantedNames(names);
-  const listed = new Set(readdirSync(from).filter(offered));
+  const listed = new Set(candidates(from));
   for (const name of wanted) assertMovable(name, listed, user);
+  if (mode === 'move' && !sameDisk(from, dirname(user.home))) throw new ApiError(`${from} is on another disk than ${user.home}; copy instead`, 400);
   for (const name of wanted) {
     jobs.set(name, { state: 'waiting', error: null });
     queue = queue.then(async () => {
       jobs.set(name, { state: 'copying', error: null });
-      await moveOne(name, user, from).catch((err: unknown) => {
+      await moveOne(name, user, from, mode).catch((err: unknown) => {
         jobs.set(name, { state: 'failed', error: errMsg(err) });
-        log.warn({ name, err: errMsg(err) }, 'agent-user: could not move a folder to the agent user');
+        log.warn({ name, err: errMsg(err) }, 'agent-user: could not move an entry to the agent user');
       });
     });
   }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.189"
+  "version": "0.1.0-beta.190"
 }