@stage-labs/metro 0.1.0-beta.197 → 0.1.0-beta.199

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.197",
+  "version": "0.1.0-beta.199",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.197",
+  "version": "0.1.0-beta.199",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/files.ts

@@ -1,6 +1,5 @@
 import { spawnSync } from 'node:child_process';
 import { closeSync, openSync, readdirSync, readSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { asUser, type AgentUser } from './user.js';
@@ -113,5 +112,8 @@ function readLocal(root: string, path: string): FilesAnswer {
   return folderAnswer(root, path, entries);
 }
 
-export const readAgentPath = (user: AgentUser | null, path: string, localRoot = homedir()): FilesAnswer =>
-  user === null ? readLocal(localRoot, path) : readAsAgent(user, path);
+export function readAgentPath(user: AgentUser | null, path: string, localRoot?: string): FilesAnswer {
+  if (user !== null) return readAsAgent(user, path);
+  if (localRoot === undefined) throw new ApiError('Claude Code does not run as its own user on this machine, so there is no agent folder to show', 409);
+  return readLocal(localRoot, path);
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/job-env.ts

@@ -1,11 +1,10 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { log } from '@metro-labs/core/log';
 import { writeHomeText } from './home-fs.js';
 import { listSchedules, realRunner, showProps, type Runner } from './schedules.js';
 import type { AgentUser } from './user.js';
+import { removeDropIn, writeDropIn } from './unit-files.js';
 
-const UNIT_DIR = '/etc/systemd/system';
 const DROP_IN = '11-metro-vault.conf';
 const BEGIN = '# metro vault: begin';
 const END = '# metro vault: end';
@@ -35,15 +34,10 @@ function setTimerEnv(user: AgentUser, on: boolean, runner: Runner): void {
     if (job.kind !== 'timer' || job.runsAs !== user.name) continue;
     const unit = job.id.slice('timer:'.length);
     const service = showProps(runner, unit, ['Unit']).Unit ?? unit.replace(/\.timer$/, '.service');
-    const file = join(UNIT_DIR, `${service}.d`, DROP_IN);
     if (on) {
-      mkdirSync(join(UNIT_DIR, `${service}.d`), { recursive: true });
-      writeFileSync(file, `[Service]\nEnvironmentFile=-${jobEnvFile(user)}\n`, { mode: 0o644 });
+      writeDropIn(service, DROP_IN, `[Service]\nEnvironmentFile=-${jobEnvFile(user)}\n`);
       changed = true;
-    } else if (existsSync(file)) {
-      rmSync(file, { force: true });
-      changed = true;
-    }
+    } else if (removeDropIn(service, DROP_IN)) changed = true;
   }
   if (changed) runner.run('systemctl', ['daemon-reload']);
 }

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/provision.ts

@@ -6,6 +6,7 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { copyIntoHome } from './home-fs.js';
 import { AGENT_NAME, agentMarketplaceDir, agentUser, agentUserExpected, asUser, claudeBin, forgetAgentUser, type AgentUser } from './user.js';
 import { watchAgentView } from './view.js';
+import { mustHelper, runningAsMetro } from '../metro-user/privilege.js';
 
 const INSTALL_MS = 10 * 60_000;
 const INSTALLER = 'curl -fsSL https://claude.ai/install.sh | bash';
@@ -19,6 +20,11 @@ function run(file: string, args: string[]): void {
 }
 
 function ensureUser(): AgentUser | null {
+  if (runningAsMetro()) {
+    mustHelper(['ensure-agent']);
+    forgetAgentUser();
+    return agentUser();
+  }
   if (agentUser() === null) {
     run('useradd', ['--create-home', '--shell', '/bin/bash', AGENT_NAME]);
     log.info({ user: AGENT_NAME }, 'agent-user: created the user Claude Code runs as');

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/schedules.ts

@@ -6,7 +6,8 @@ import { join } from 'node:path';
 import { ApiError } from '@metro-labs/http/api-error';
 import { isRecord } from '@metro-labs/core/is-record';
 import { errMsg, log } from '@metro-labs/core/log';
-import type { AgentUser } from './user.js';
+import { asUser, type AgentUser } from './user.js';
+import { metroRun, writeDropIn } from './unit-files.js';
 
 const UNIT_DIR = '/etc/systemd/system';
 const defaultBackups = (): string => join(homedir(), '.metro', 'agents');
@@ -36,6 +37,8 @@ export interface Runner {
 
 export const realRunner: Runner = {
   run: (file, args, input) => {
+    const viaHelper = metroRun(file, args, input);
+    if (viaHelper !== null) return viaHelper;
     const done = spawnSync(file, args, { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'ignore'], timeout: 20_000 });
     return { status: done.error === undefined ? done.status : null, stdout: done.stdout ?? '' };
   },
@@ -173,17 +176,21 @@ export function dropInText(user: AgentUser, argv: string[], environment: string)
   ].join('\n');
 }
 
+function agentSees(user: AgentUser, path: string): boolean {
+  if (existsSync(path)) return true;
+  const [file, args] = asUser(user, 'test', ['-e', path]);
+  return spawnSync(file, args, { stdio: 'ignore' }).status === 0;
+}
+
 function convertTimer(job: ScheduledJob, user: AgentUser, runner: Runner): void {
   const unit = job.id.slice('timer:'.length);
   const service = showProps(runner, unit, ['Unit']).Unit ?? unit.replace(/\.timer$/, '.service');
   const svc = showProps(runner, service, ['ExecStart', 'Environment']);
   const argv = execArgv(svc.ExecStart ?? '');
   if (argv.length === 0) throw new ApiError('that timer runs no command metro can read', 400);
-  const missing = argv.map((a) => rehome(a, user.home)).find((a) => a.startsWith(`${user.home}/`) && !existsSync(a));
+  const missing = argv.map((a) => rehome(a, user.home)).find((a) => a.startsWith(`${user.home}/`) && !agentSees(user, a));
   if (missing !== undefined) throw new ApiError(`${missing} does not exist; move it to the agent first`, 409);
-  const dir = join(UNIT_DIR, `${service}.d`);
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, DROP_IN), dropInText(user, argv, svc.Environment ?? ''), { mode: 0o644 });
+  writeDropIn(service, DROP_IN, dropInText(user, argv, svc.Environment ?? ''));
   runner.run('systemctl', ['daemon-reload']);
   log.info({ unit, service, user: user.name }, 'schedules: a timer now runs as the agent user');
 }

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/unit-files.ts

@@ -0,0 +1,61 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { mustHelper, rootHelper, runningAsMetro } from '../metro-user/privilege.js';
+import { agentUser, asUser } from './user.js';
+
+const UNIT_DIR = '/etc/systemd/system';
+
+export function writeDropIn(service: string, name: string, text: string): void {
+  if (runningAsMetro()) {
+    mustHelper(['dropin-write', service, name], text);
+    return;
+  }
+  mkdirSync(join(UNIT_DIR, `${service}.d`), { recursive: true });
+  writeFileSync(join(UNIT_DIR, `${service}.d`, name), text, { mode: 0o644 });
+}
+
+export function removeDropIn(service: string, name: string): boolean {
+  const file = join(UNIT_DIR, `${service}.d`, name);
+  if (!existsSync(file)) return false;
+  if (runningAsMetro()) mustHelper(['dropin-remove', service, name]);
+  else rmSync(file, { force: true });
+  return true;
+}
+
+const lineHash = (line: string): string => createHash('sha256').update(line.trim()).digest('hex').slice(0, 16);
+
+function asAgentRun(args: string[], input?: string): { status: number | null; stdout: string } {
+  const [file, argv] = asUser(agentUser(), 'crontab', args);
+  const run = spawnSync(file, argv, { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'ignore'], timeout: 20_000 });
+  return { status: run.error === undefined ? run.status : null, stdout: run.stdout ?? '' };
+}
+
+function rootCrontabWrite(input: string): { status: number | null; stdout: string } {
+  const wanted = new Set(input.split('\n').filter((l) => l.trim() !== '').map(lineHash));
+  const current = rootHelper(['root-crontab']).stdout.split('\n').filter((l) => l.trim() !== '');
+  for (const line of current) if (!wanted.has(lineHash(line))) mustHelper(['root-crontab-drop', lineHash(line)]);
+  return { status: 0, stdout: '' };
+}
+
+function crontab(args: string[], input?: string): { status: number | null; stdout: string } {
+  const at = args.indexOf('-u');
+  const who = at >= 0 ? args[at + 1] : undefined;
+  const rest = args.filter((_, i) => i !== at && i !== at + 1);
+  if (who === 'root') return rest[0] === '-l' ? { status: 0, stdout: rootHelper(['root-crontab']).stdout } : rootCrontabWrite(input ?? '');
+  return asAgentRun(rest, input);
+}
+
+function systemctl(args: string[]): { status: number | null; stdout: string } | null {
+  if (args[0] === 'daemon-reload') return { status: rootHelper(['daemon-reload']).status, stdout: '' };
+  if (args[0] === 'start') return { status: rootHelper(['start-job', args[args.length - 1] ?? '']).status, stdout: '' };
+  return null;
+}
+
+export function metroRun(file: string, args: string[], input?: string): { status: number | null; stdout: string } | null {
+  if (!runningAsMetro()) return null;
+  if (file === 'crontab') return crontab(args, input);
+  if (file === 'systemctl') return systemctl(args);
+  return null;
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/user.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from 'node:child_process';
 import { join } from 'node:path';
+import { runningAsMetro } from '../metro-user/privilege.js';
 
 export const AGENT_NAME = 'agent';
 const AGENT_PATH = ['.local/bin', '/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin'];
@@ -28,7 +29,7 @@ export function lookupUser(name: string): AgentUser | null {
 
 const realHost: UserHost = { platform: process.platform, uid: process.getuid?.(), lookup: lookupUser };
 
-export const agentUserExpected = (host: UserHost = realHost): boolean => host.platform === 'linux' && host.uid === 0;
+export const agentUserExpected = (host: UserHost = realHost): boolean => host.platform === 'linux' && (host.uid === 0 || runningAsMetro());
 
 let cached: AgentUser | null = null;
 
@@ -67,6 +68,7 @@ export function agentEnv(user: AgentUser, extra: Record<string, string> = {}): R
 export function asUser(user: AgentUser | null, file: string, args: readonly string[], extra: Record<string, string> = {}): [string, string[]] {
   if (user === null) return [file, [...args]];
   const env = Object.entries(agentEnv(user, extra)).map(([k, v]) => `${k}=${v}`);
+  if (runningAsMetro()) return ['sudo', ['-n', '-u', user.name, '--', 'env', '-i', ...env, file, ...args]];
   return ['setpriv', [`--reuid=${String(user.uid)}`, `--regid=${String(user.gid)}`, '--init-groups', 'env', '-i', ...env, file, ...args]];
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/claude/memory.ts

@@ -3,6 +3,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { totalmem } from 'node:os';
 import { dirname } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
+import { helperArgv, runningAsMetro } from '../metro-user/privilege.js';
 
 const UNIT = '/etc/systemd/system/metro.service';
 const DROP_IN = '/etc/systemd/system/metro.service.d/10-metro-memory.conf';
@@ -32,7 +33,16 @@ export function sessionMemoryLimit(total: number): number {
 
 const usesScopes = (host: ScopeHost): boolean => host.platform === 'linux' && host.uid === 0 && host.systemd;
 
+function metroScope(command: [string, string[]], total: number): [string, string[]] {
+  const [file, args] = command;
+  const asAgent = file === 'sudo' && args[0] === '-n' && args[1] === '-u' && args[3] === '--';
+  if (!asAgent) return command;
+  const limit = sessionMemoryLimit(total);
+  return helperArgv(['as-agent-scope', String(limit), String(Math.floor(limit * 0.9)), ...args.slice(4)]);
+}
+
 export function inSessionScope(command: [string, string[]], host: ScopeHost = realHost(), now = Date.now()): [string, string[]] {
+  if (host.systemd && runningAsMetro()) return metroScope(command, host.total);
   if (!usesScopes(host)) return command;
   const limit = sessionMemoryLimit(host.total);
   const [file, args] = command;

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/api.ts

@@ -0,0 +1,43 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { readFileSync } from 'node:fs';
+import { sessionRoute } from '@metro-labs/http/api-http';
+import { MOVE_LOG, moveState, startMove } from './move.js';
+import { rootHelper, runningAsMetro, runningAsRoot } from './privilege.js';
+import { HELPER_VERSION } from './helper-script.js';
+
+const PATH = '/api/server/metro-user';
+const LOG_TAIL = 40;
+
+function logTail(): string {
+  try {
+    return readFileSync(MOVE_LOG, 'utf8').split('\n').slice(-LOG_TAIL).join('\n');
+  } catch {
+    return '';
+  }
+}
+
+function helperVersion(): number | null {
+  if (!runningAsMetro()) return null;
+  const v = Number(rootHelper(['version']).stdout.trim());
+  return Number.isInteger(v) ? v : null;
+}
+
+function view(): unknown {
+  const runningAs = runningAsRoot() ? 'root' : runningAsMetro() ? 'metro' : 'other';
+  const helper = helperVersion();
+  return {
+    runningAs,
+    canMove: runningAs === 'root',
+    move: moveState(),
+    log: logTail(),
+    helper,
+    helperCurrent: runningAs !== 'metro' || helper === HELPER_VERSION,
+  };
+}
+
+export function handleMetroUserRequest(req: IncomingMessage, res: ServerResponse): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET', 'POST'] }, admin: true, label: 'metro-user-api' }, () => {
+    if (req.method === 'POST') startMove();
+    return Promise.resolve(view());
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -0,0 +1,126 @@
+export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
+export const HELPER_VERSION = 1;
+export const SUDOERS_PATH = '/etc/sudoers.d/metro';
+export const METRO_USER = 'metro';
+export const METRO_HOME = '/var/lib/metro';
+
+export const sudoersText = (agent: string): string =>
+  [
+    `${METRO_USER} ALL=(${agent}) NOPASSWD: ALL`,
+    `${METRO_USER} ALL=(root) NOPASSWD: ${HELPER_PATH} *`,
+    `Defaults:${METRO_USER} !requiretty`,
+    '',
+  ].join('\n');
+
+const lines = (...parts: string[]): string => parts.join('\n');
+
+const CHECKS = lines(
+  'AGENT=agent',
+  'UNITS=/etc/systemd/system',
+  'die() { echo "root-helper: $*" >&2; exit 2; }',
+  'agent_uid() { id -u "$AGENT" 2>/dev/null || die "no agent user"; }',
+  'service_ok() {',
+  '  printf %s "$1" | grep -Eq "^[A-Za-z0-9@_.-]+\\.service$" || die "bad service name"',
+  '  case "$1" in metro*) die "not a metro unit";; esac',
+  '  frag=$(systemctl show "$1" -p FragmentPath --value)',
+  '  case "$frag" in "$UNITS"/*) ;; *) die "not a unit under $UNITS";; esac',
+  '  systemctl show "$1" -p TriggeredBy --value | grep -q "\\.timer" || die "not started by a timer"',
+  '}',
+  'dropin_ok() {',
+  '  case "$1" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '  home=$(getent passwd "$AGENT" | cut -d: -f6)',
+  '  saw_user=0',
+  '  while IFS= read -r line; do',
+  '    case "$line" in',
+  '      "[Service]"|"") ;;',
+  '      "User=$AGENT") saw_user=1 ;;',
+  '      Group=*) printf %s "${line#Group=}" | grep -Eq "^[0-9]+$" || die "bad group" ;;',
+  '      "WorkingDirectory=$home"|"WorkingDirectory=$home"/*) ;;',
+  '      Environment=*) ;;',
+  '      "EnvironmentFile=-$home/.metro/vault.env") ;;',
+  '      "ExecStart=") ;;',
+  '      ExecStart=[+!@]*) die "privileged ExecStart refused" ;;',
+  '      ExecStart=*) ;;',
+  '      *) die "line not allowed: $line" ;;',
+  '    esac',
+  '  done < "$2"',
+  '  if [ "$1" = 10-metro-agent.conf ] && [ "$saw_user" != 1 ]; then die "the drop-in must set User=$AGENT"; fi',
+  '}',
+);
+
+const FIREWALL = lines(
+  'firewall_on() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    $t -w -N METRO_AGENT 2>/dev/null || true',
+  '    $t -w -F METRO_AGENT',
+  '    $t -w -A METRO_AGENT -o lo -j ACCEPT',
+  '    $t -w -A METRO_AGENT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p udp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp -j REJECT --reject-with tcp-reset',
+  '    $t -w -A METRO_AGENT -j REJECT',
+  '    $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null || $t -w -I OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT',
+  '  done',
+  '}',
+  'firewall_off() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    while $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null; do $t -w -D OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT; done',
+  '    $t -w -F METRO_AGENT 2>/dev/null || true',
+  '    $t -w -X METRO_AGENT 2>/dev/null || true',
+  '  done',
+  '}',
+);
+
+const ACTIONS = lines(
+  'action="${1:-}"; [ "$#" -gt 0 ] && shift',
+  'case "$action" in',
+  `  version) echo ${String(HELPER_VERSION)} ;;`,
+  '  ensure-agent)',
+  '    getent passwd "$AGENT" >/dev/null || useradd --create-home --shell /bin/bash "$AGENT"',
+  '    chmod 700 "$(getent passwd "$AGENT" | cut -d: -f6)" ;;',
+  '  as-agent-scope)',
+  '    [ "$#" -ge 3 ] || die "usage: as-agent-scope <max> <high> <command...>"',
+  '    printf %s "$1$2" | grep -Eq "^[0-9]+$" || die "bad memory limits"',
+  '    max="$1"; high="$2"; shift 2',
+  '    uid=$(agent_uid); gid=$(id -g "$AGENT")',
+  '    exec systemd-run --scope --quiet --collect --unit="metro-claude-$(date +%s%N)" -p MemoryMax="$max" -p MemoryHigh="$high" -p OOMPolicy=continue -- setpriv --reuid="$uid" --regid="$gid" --init-groups -- "$@" ;;',
+  '  dropin-write)',
+  '    service_ok "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; cat > "$tmp"; dropin_ok "$2" "$tmp"',
+  '    mkdir -p "$UNITS/$1.d"; install -m 644 "$tmp" "$UNITS/$1.d/$2" ;;',
+  '  dropin-remove)',
+  '    service_ok "$1"; case "$2" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '    rm -f "$UNITS/$1.d/$2" ;;',
+  '  daemon-reload) systemctl daemon-reload ;;',
+  '  start-job)',
+  '    service_ok "$1"; [ "$(systemctl show "$1" -p User --value)" = "$AGENT" ] || die "that job does not run as $AGENT"',
+  '    systemctl start --no-block "$1" ;;',
+  '  root-crontab) crontab -l -u root 2>/dev/null || true ;;',
+  '  root-crontab-drop)',
+  '    printf %s "$1" | grep -Eq "^[0-9a-f]{16}$" || die "bad line id"',
+  `    backups="${METRO_HOME}/.metro/agents"`,
+  '    cur=$(mktemp); crontab -l -u root > "$cur" 2>/dev/null || true',
+  '    kept=$(mktemp); found=0',
+  '    while IFS= read -r line; do',
+  '      id=$(printf %s "$line" | sed "s/^[[:space:]]*//;s/[[:space:]]*$//" | tr -d "\\n" | sha256sum | cut -c1-16)',
+  '      if [ "$id" = "$1" ] && [ "$found" = 0 ]; then found=1; elif [ -n "$line" ]; then printf "%s\\n" "$line" >> "$kept"; fi',
+  '    done < "$cur"',
+  '    [ "$found" = 1 ] || die "that cron line is gone"',
+  '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
+  '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
+  '  firewall-on) firewall_on ;;',
+  '  firewall-off) firewall_off ;;',
+  '  trust-ca)',
+  `    src="${METRO_HOME}/.metro/agents/vault/ca/ca.crt"`,
+  '    head -n1 "$src" | grep -q "BEGIN CERTIFICATE" || die "not a certificate"',
+  '    if grep -q "PRIVATE KEY" "$src"; then die "a key is not a certificate"; fi',
+  '    install -m 644 "$src" /usr/local/share/ca-certificates/metro-vault.crt && update-ca-certificates >/dev/null ;;',
+  '  untrust-ca) rm -f /usr/local/share/ca-certificates/metro-vault.crt; update-ca-certificates --fresh >/dev/null ;;',
+  '  install-nss-tools) DEBIAN_FRONTEND=noninteractive apt-get install -y -q libnss3-tools >/dev/null ;;',
+  '  *) die "unknown action: $action" ;;',
+  'esac',
+);
+
+export const helperScript = (): string =>
+  ['#!/bin/sh', 'set -eu', 'export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', CHECKS, FIREWALL, ACTIONS, ''].join('\n');

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/move.ts

@@ -0,0 +1,155 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { ApiError } from '@metro-labs/http/api-error';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { AGENT_NAME } from '../agent-user/user.js';
+import { HELPER_PATH, helperScript, METRO_HOME, METRO_USER, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import { runningAsRoot } from './privilege.js';
+
+export const UNIT_FILE = '/etc/systemd/system/metro.service';
+export const MOVE_DIR = '/var/lib/metro-move';
+export const MOVE_LOG = '/var/log/metro-move.log';
+const PREFIX = `${METRO_HOME}/.npm-global`;
+const CLI = `${PREFIX}/lib/node_modules/@stage-labs/metro/dist/cli.js`;
+
+const which = (bin: string): string | null => {
+  const run = spawnSync('sh', ['-c', `command -v ${bin}`], { encoding: 'utf8' });
+  const path = run.status === 0 ? run.stdout.trim() : '';
+  if (path === '') return null;
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+};
+
+export interface UnitFacts {
+  serveArgs: string[];
+  env: string[];
+  port: string;
+}
+
+export function unitFacts(unit: string): UnitFacts {
+  const exec = /^ExecStart=(.*)$/m.exec(unit)?.[1] ?? '';
+  const words = [...exec.matchAll(/"((?:[^"\\]|\\.)*)"|(\S+)/g)].map((m) => (m[1] ?? m[2] ?? '').replace(/\\(.)/g, '$1'));
+  const at = words.indexOf('serve');
+  if (at < 0) throw new ApiError('the metro service does not run `metro serve`; move it by hand', 409);
+  const env = [...unit.matchAll(/^Environment=(.*)$/gm)].map((m) => m[1] ?? '').filter((e) => /^"?METRO_/.test(e) && !/^"?METRO_(AGENTS_DIR|RUNTIME_STORE)=/.test(e));
+  const portArg = words[words.indexOf('--port') + 1];
+  const envPort = /METRO_WEBHOOK_PORT=(\d+)/.exec(env.join(' '))?.[1];
+  return { serveArgs: words.slice(at + 1), env, port: (words.includes('--port') ? portArg : envPort) ?? '8420' };
+}
+
+const ESCAPED_QUOTE = '\'\\\'\'';
+const shellWord = (w: string): string => `'${w.replace(/'/g, ESCAPED_QUOTE)}'`;
+const unitWord = (w: string): string => (/^[A-Za-z0-9_/.:=+@,-]+$/.test(w) ? w : `"${w.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`);
+
+export function metroUnit(node: string, facts: UnitFacts): string {
+  return [
+    '[Unit]',
+    'Description=Metro daemon (metro serve)',
+    'After=network-online.target tailscaled.service',
+    'Wants=network-online.target',
+    '',
+    '[Service]',
+    `User=${METRO_USER}`,
+    `Group=${METRO_USER}`,
+    `ExecStart=${[node, CLI, 'serve', ...facts.serveArgs].map(unitWord).join(' ')}`,
+    'Restart=always',
+    'RestartSec=2',
+    'OOMPolicy=continue',
+    'WorkingDirectory=/',
+    `Environment=HOME=${METRO_HOME}`,
+    `Environment=PATH=${PREFIX}/bin:/usr/local/bin:/usr/bin:/bin`,
+    `Environment=NPM_CONFIG_PREFIX=${PREFIX}`,
+    ...facts.env.map((e) => `Environment=${e}`),
+    '',
+    '[Install]',
+    'WantedBy=multi-user.target',
+    '',
+  ].join('\n');
+}
+
+export function moveScript(port: string, spec: string): string {
+  return [
+    '#!/bin/sh',
+    'set -u',
+    `exec >> ${MOVE_LOG} 2>&1`,
+    'echo "--- metro move $(date -Is)"',
+    `OLD=/root/.metro; NEW=${METRO_HOME}/.metro; DIR=${MOVE_DIR}`,
+    'fail() { echo "FAILED: $*"; echo failed > "$DIR/state"; exit 1; }',
+    'healthy() {',
+    '  i=0; while [ $i -lt 60 ]; do',
+    `    if curl -fsS -m 3 http://127.0.0.1:${port}/health >/dev/null 2>&1 && [ "$(ps -o user= -p "$(systemctl show metro -p MainPID --value)")" = "$1" ]; then return 0; fi`,
+    '    i=$((i+1)); sleep 2; done; return 1; }',
+    'echo moving > "$DIR/state"',
+    `id ${METRO_USER} >/dev/null 2>&1 || useradd --system --create-home --home-dir ${METRO_HOME} --shell /usr/sbin/nologin ${METRO_USER} || fail "useradd"`,
+    `usermod -aG systemd-journal ${METRO_USER} || true`,
+    `mkdir -p ${METRO_HOME} && chown ${METRO_USER}:${METRO_USER} ${METRO_HOME} && chmod 700 ${METRO_HOME}`,
+    'B=$(readlink -f "$(command -v bun)"); case "$B" in /root/*) install -m 755 "$B" /usr/local/bin/bun || fail "bun";; esac',
+    `su -s /bin/sh ${METRO_USER} -c ${shellWord(`cd / && npm install --global --prefix ${PREFIX} ${spec}`)} || fail "npm install for ${METRO_USER}"`,
+    `tailscale set --operator=${METRO_USER} || fail "tailscale operator"`,
+    `cp ${UNIT_FILE} "$DIR/metro.service.root" || fail "unit backup"`,
+    'systemctl stop metro',
+    'if [ -e "$NEW" ]; then mv "$NEW" "$NEW.old-$(date +%s)"; fi',
+    'mv "$OLD" "$NEW" || { systemctl start metro; fail "move"; }',
+    'rm -f "$NEW/runtime/runtime.json"',
+    `chown -R ${METRO_USER}:${METRO_USER} ${METRO_HOME}`,
+    `install -m 644 "$DIR/metro.service.new" ${UNIT_FILE}`,
+    'systemctl daemon-reload && systemctl start metro',
+    `if healthy ${METRO_USER}; then echo done > "$DIR/state"; echo "metro runs as ${METRO_USER}"; exit 0; fi`,
+    'echo "not healthy as metro, putting everything back"',
+    'systemctl stop metro',
+    'mv "$NEW" "$OLD" && chown -R root:root "$OLD"',
+    `install -m 644 "$DIR/metro.service.root" ${UNIT_FILE}`,
+    'systemctl daemon-reload && systemctl start metro',
+    'healthy root && fail "Metro did not start as metro; it runs as root again" || fail "Metro did not start as metro, and the way back did not answer either"',
+    '',
+  ].join('\n');
+}
+
+function preflight(): { node: string; unit: string } {
+  if (!runningAsRoot()) throw new ApiError('only a Metro running as root can move itself', 409);
+  if (!existsSync(UNIT_FILE)) throw new ApiError('this box does not run Metro as the systemd service `metro`', 409);
+  if (process.env.METRO_AGENTS_DIR !== undefined && process.env.METRO_AGENTS_DIR !== '') throw new ApiError('METRO_AGENTS_DIR is set; move this box by hand', 409);
+  if (homedir() !== '/root') throw new ApiError(`Metro keeps its files in ${homedir()}, not /root; move this box by hand`, 409);
+  const node = which('node');
+  if (node === null || node.startsWith('/root/')) throw new ApiError('Node must be installed for every user (not under /root) before the move', 409);
+  for (const bin of ['sudo', 'visudo', 'tailscale', 'curl', 'npm', 'bun'])
+    if (which(bin) === null) throw new ApiError(`${bin} is missing on this box`, 409);
+  return { node, unit: readFileSync(UNIT_FILE, 'utf8') };
+}
+
+function installHelper(): void {
+  mkdirSync('/usr/local/lib/metro', { recursive: true, mode: 0o755 });
+  writeFileSync(HELPER_PATH, helperScript(), { mode: 0o755 });
+  chmodSync(HELPER_PATH, 0o755);
+  const draft = join(MOVE_DIR, 'sudoers');
+  writeFileSync(draft, sudoersText(AGENT_NAME), { mode: 0o440 });
+  const check = spawnSync('visudo', ['-cf', draft], { encoding: 'utf8' });
+  if (check.status !== 0) throw new ApiError(`the sudo rules did not validate: ${check.stdout}${check.stderr}`, 500);
+  spawnSync('install', ['-m', '440', draft, SUDOERS_PATH]);
+}
+
+export function startMove(spec = `@stage-labs/metro@${METRO_VERSION}`): { log: string } {
+  const { node, unit } = preflight();
+  const facts = unitFacts(unit);
+  mkdirSync(MOVE_DIR, { recursive: true, mode: 0o700 });
+  installHelper();
+  writeFileSync(join(MOVE_DIR, 'metro.service.new'), metroUnit(node, facts), { mode: 0o600 });
+  writeFileSync(join(MOVE_DIR, 'move.sh'), moveScript(facts.port, spec), { mode: 0o700 });
+  writeFileSync(join(MOVE_DIR, 'state'), 'starting\n');
+  const run = spawnSync('systemd-run', ['--unit=metro-move', '--collect', '--quiet', 'sh', join(MOVE_DIR, 'move.sh')], { encoding: 'utf8' });
+  if (run.status !== 0) throw new ApiError(`could not start the move: ${run.stderr.trim()}`, 500);
+  return { log: MOVE_LOG };
+}
+
+export function moveState(): string | null {
+  try {
+    return readFileSync(join(MOVE_DIR, 'state'), 'utf8').trim();
+  } catch {
+    return null;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/privilege.ts

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process';
+import { HELPER_PATH, METRO_USER } from './helper-script.js';
+
+export interface PrivilegeHost {
+  platform: string;
+  uid: number | undefined;
+  user: string;
+}
+
+let metroUid: number | null | undefined;
+
+function uidOfMetro(): number | null {
+  if (metroUid !== undefined) return metroUid;
+  const run = spawnSync('getent', ['passwd', METRO_USER], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const uid = Number(run.status === 0 ? run.stdout.split(':')[2] : NaN);
+  metroUid = Number.isInteger(uid) && uid > 0 ? uid : null;
+  return metroUid;
+}
+
+const realHost = (): PrivilegeHost => {
+  const uid = process.getuid?.();
+  const linux = process.platform === 'linux';
+  return { platform: process.platform, uid, user: linux && uid !== 0 && uid !== undefined && uid === uidOfMetro() ? METRO_USER : '' };
+};
+
+export const runningAsRoot = (host: PrivilegeHost = realHost()): boolean => host.platform === 'linux' && host.uid === 0;
+
+export const runningAsMetro = (host: PrivilegeHost = realHost()): boolean =>
+  host.platform === 'linux' && host.uid !== 0 && host.user === METRO_USER;
+
+export interface HelperResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+}
+
+export function rootHelper(args: string[], input?: string): HelperResult {
+  const run = spawnSync('sudo', ['-n', HELPER_PATH, ...args], { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'pipe'], timeout: 180_000 });
+  return { status: run.error === undefined ? run.status : null, stdout: run.stdout ?? '', stderr: run.stderr ?? run.error?.message ?? '' };
+}
+
+export function mustHelper(args: string[], input?: string): string {
+  const run = rootHelper(args, input);
+  if (run.status !== 0) throw new Error(run.stderr.trim() || `root-helper ${args[0] ?? ''} failed`);
+  return run.stdout;
+}
+
+export const helperArgv = (args: string[]): [string, string[]] => ['sudo', ['-n', HELPER_PATH, ...args]];

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -20,6 +20,7 @@ import { handleTerminalRequest, type TerminalApiDeps } from '../terminal/api.js'
 import { handleSchedulesRequest } from '../agent-user/schedules-api.js';
 import { handleFilesRequest } from '../agent-user/files-api.js';
 import { handleVaultRequest } from '../vault/api.js';
+import { handleMetroUserRequest } from '../metro-user/api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
@@ -58,6 +59,7 @@ export function handleSessionApis(
     ...when(apis.schedulesApi, () => handleSchedulesRequest(req, res)),
     ...when(apis.filesApi, () => handleFilesRequest(req, res)),
     ...when(apis.vaultApi, () => handleVaultRequest(req, res)),
+    ...when(apis.vaultApi, () => handleMetroUserRequest(req, res)),
     ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
     ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
     ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/daemon/src/vault/firewall.ts

@@ -1,4 +1,5 @@
 import { spawnSync } from 'node:child_process';
+import { mustHelper, runningAsMetro } from '../metro-user/privilege.js';
 
 const CHAIN = 'METRO_AGENT';
 const TOOLS = ['iptables', 'ip6tables'] as const;
@@ -21,6 +22,10 @@ export const chainRules = (): string[][] => [
 const jump = (uid: number): string[] => ['OUTPUT', '-m', 'owner', '--uid-owner', String(uid), '-j', CHAIN];
 
 export function applyFirewall(uid: number, runner: FirewallRunner = realRunner): void {
+  if (runner === realRunner && runningAsMetro()) {
+    mustHelper(['firewall-on']);
+    return;
+  }
   for (const tool of TOOLS) {
     runner.run(tool, ['-N', CHAIN]);
     if (runner.run(tool, ['-F', CHAIN]) !== 0) throw new Error(`${tool} refused to prepare the ${CHAIN} chain`);
@@ -31,6 +36,10 @@ export function applyFirewall(uid: number, runner: FirewallRunner = realRunner):
 }
 
 export function removeFirewall(uid: number, runner: FirewallRunner = realRunner): void {
+  if (runner === realRunner && runningAsMetro()) {
+    mustHelper(['firewall-off']);
+    return;
+  }
   for (const tool of TOOLS) {
     for (let i = 0; i < 10 && runner.run(tool, ['-C', ...jump(uid)]) === 0; i += 1) runner.run(tool, ['-D', ...jump(uid)]);
     runner.run(tool, ['-F', CHAIN]);

package/runtime/node_modules/@metro-labs/daemon/src/vault/trust.ts

@@ -3,12 +3,17 @@ import { copyFileSync, chmodSync, existsSync, readFileSync, rmSync } from 'node:
 import { errMsg, log } from '@metro-labs/core/log';
 import { asUser, type AgentUser } from '../agent-user/user.js';
 import { TRUSTED_CA } from './paths.js';
+import { mustHelper, rootHelper, runningAsMetro } from '../metro-user/privilege.js';
 
 const has = (bin: string): boolean => spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0;
 
 export function trustSystem(caFile: string): void {
   const same = existsSync(TRUSTED_CA) && readFileSync(TRUSTED_CA, 'utf8') === readFileSync(caFile, 'utf8');
   if (same) return;
+  if (runningAsMetro()) {
+    mustHelper(['trust-ca']);
+    return;
+  }
   copyFileSync(caFile, TRUSTED_CA);
   chmodSync(TRUSTED_CA, 0o644);
   const run = spawnSync('update-ca-certificates', [], { encoding: 'utf8' });
@@ -17,6 +22,10 @@ export function trustSystem(caFile: string): void {
 
 export function untrustSystem(): void {
   if (!existsSync(TRUSTED_CA)) return;
+  if (runningAsMetro()) {
+    mustHelper(['untrust-ca']);
+    return;
+  }
   rmSync(TRUSTED_CA, { force: true });
   spawnSync('update-ca-certificates', ['--fresh'], { stdio: 'ignore' });
 }
@@ -32,6 +41,7 @@ const NSS_SCRIPT = [
 
 function ensureCertutil(): boolean {
   if (has('certutil')) return true;
+  if (runningAsMetro()) return rootHelper(['install-nss-tools']).status === 0 && has('certutil');
   if (!has('apt-get')) return false;
   const run = spawnSync('apt-get', ['install', '-y', '-q', 'libnss3-tools'], { stdio: 'ignore', timeout: 180_000, env: { ...process.env, DEBIAN_FRONTEND: 'noninteractive' } });
   return run.status === 0 && has('certutil');

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.197"
+  "version": "0.1.0-beta.199"
 }