@stage-labs/metro 0.1.0-beta.20 → 0.1.0-beta.201

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -0,0 +1,208 @@
+import { ApiError } from '@metro-labs/http/api-error';
+import { errMsg, log } from '@metro-labs/core/log';
+import { AttachSessions } from '../stations/attach-session.js';
+import { recentSenders } from '../agents/senders.js';
+import { forwardTrainCall } from '../stations/train-call.js';
+import { syncPluginServers } from '../connectors/plugin-sync.js';
+import type { AgentApiDeps } from '../agents/api.js';
+import { ATTACHABLE, type AccountApiDeps } from '../agents/accounts-api.js';
+import type { SessionApis } from './session-apis.js';
+import type { ModeInfo } from '@metro-labs/http/mode-api';
+import { loadedAgentOf, type AgentBundle, type BundleApiDeps } from '../agents/bundle.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import type { ConnectorApiDeps } from '../connectors/api.js';
+import { authenticate } from '../mcp/request-identity.js';
+import type { RelayApiDeps } from '../connectors/relay.js';
+import {
+  readLocalConnectors,
+  localImportConnectors,
+  localCreateConnector,
+  localCreatePendingConnector,
+  localDeleteConnector,
+  localDisconnectConnector,
+  localGetConnector,
+  localListConnectors,
+  localReconnectConnector,
+  localRelayTarget,
+  localRenameConnector,
+  localVerifyConnector,
+  localMarkSignedOut,
+  localConnectorTools,
+  localSetConnectorPolicy,
+} from '../connectors/store.js';
+import { blockedReason } from '../connectors/gates.js';
+import {
+  setLocalOwner,
+  localAttachAccount,
+  localDetachAccount,
+  localSetAllowlist,
+  localSetPolicy,
+  localSetAccountEnabled,
+  localImportAgent,
+  localListAgents,
+  localOwner,
+  readLocalAgentFile,
+} from '../agents/file-admin.js';
+import { readModelConfig } from '../gateway/model-config.js';
+import type { StationName } from '@metro-labs/core/station-names';
+
+export interface LocalModeDeps {
+  syncStations: (station: StationName) => Promise<void>;
+  reloadAgents: () => Promise<void>;
+  restart: () => void;
+  stop: () => void;
+  gatherAccounts: AgentApiDeps['gatherAccounts'];
+  capabilities: AgentApiDeps['capabilities'];
+  toolGroups?: AgentApiDeps['toolGroups'];
+  prepareAccount: AccountApiDeps['prepareAccount'];
+}
+
+function attachSessions(deps: LocalModeDeps): AttachSessions {
+  return new AttachSessions({
+    authorize: (owner) => {
+      readLocalAgentFile(owner.agentId);
+      return Promise.resolve();
+    },
+    complete: async (owner, station, config) => {
+      const ref = await localAttachAccount(owner.agentId, station, config);
+      const activated = await deps.syncStations(station).then(
+        () => true,
+        (err: unknown) => {
+          log.warn(
+            { station, err: errMsg(err) },
+            'attach-session: station reload failed, the change lands at the next boot',
+          );
+          return false;
+        },
+      );
+      return { accountId: ref.accountId, activated };
+    },
+  });
+}
+
+function agentApi(deps: LocalModeDeps): AgentApiDeps {
+  return {
+    attachSessions: attachSessions(deps),
+    listAgents: localListAgents,
+    gatherAccounts: deps.gatherAccounts,
+    capabilities: deps.capabilities,
+    ...(deps.toolGroups === undefined ? {} : { toolGroups: deps.toolGroups }),
+    attachable: ATTACHABLE.filter((s) => s !== 'webhook'),
+    connectorIds: connectorIdsOfLocalAgents,
+    prepareAccount: deps.prepareAccount,
+    attachAccount: localAttachAccount,
+    detachAccount: localDetachAccount,
+    syncStations: deps.syncStations,
+    setAllowlist: localSetAllowlist,
+    setPolicy: localSetPolicy,
+    setAccountEnabled: localSetAccountEnabled,
+    recentSenders,
+    resolveSender: (station, accountId, query) => accountCall(station, 'resolve_sender', { account: accountId, query }),
+    accountCall,
+    reloadAgents: deps.reloadAgents,
+  };
+}
+
+const allConnectorIds = (): string[] => readLocalConnectors().map((c) => c.id);
+
+function connectorIdsOfLocalAgents(ids: string[]): Promise<Map<string, string[]>> {
+  const all = allConnectorIds();
+  return Promise.resolve(new Map(ids.map((id) => [id, all] as const)));
+}
+
+const connectorApi: ConnectorApiDeps = {
+  listConnectors: async () => {
+    const rows = await localListConnectors();
+    syncPluginServers(readLocalConnectors());
+    return rows;
+  },
+  createConnector: localCreateConnector,
+  verifyConnector: localVerifyConnector,
+  connectorTools: localConnectorTools,
+  disconnectConnector: localDisconnectConnector,
+  renameConnector: localRenameConnector,
+  deleteConnector: localDeleteConnector,
+  setConnectorPolicy: (id, policy) => localSetConnectorPolicy(id, policy),
+  createPendingConnector: localCreatePendingConnector,
+  reconnectConnector: localReconnectConnector,
+  getConnector: localGetConnector,
+};
+
+const relayApi: RelayApiDeps = {
+  target: (connectorId, force) => localRelayTarget(connectorId, force),
+  identify: (req) => {
+    const who = authenticate(req);
+    return who?.kind === 'agent' ? { subject: 'agent-key', agentId: who.agentId } : null;
+  },
+  signedOut: (id) => {
+    localMarkSignedOut(id);
+  },
+  blocked: blockedReason,
+};
+
+
+function bundleApi(deps: LocalModeDeps): BundleApiDeps {
+  return {
+    bundle: (agentId) => {
+      const file = readLocalAgentFile(agentId);
+      const bundle: AgentBundle = {
+        version: 1,
+        agent: { id: file.id, name: file.name ?? '', stations: file.stations },
+        connectors: readLocalConnectors().map((c) => ({ id: c.id, name: c.name, url: c.url, config: { ...c.config } })),
+      };
+      return Promise.resolve(bundle);
+    },
+    restore: async (bundle, mode) => {
+      const made = await localImportAgent(loadedAgentOf(bundle), undefined, mode);
+      const connectors = localImportConnectors(bundle.connectors, undefined, mode);
+      for (const station of new Set(bundle.agent.stations.map((a) => a.station)))
+        await deps.syncStations(station).catch((err: unknown) => {
+          log.warn({ station, err: errMsg(err) }, 'restore: station reload failed, the change lands at the next boot');
+        });
+      return { id: made.id, name: made.name, stations: made.stations, connectors };
+    },
+  };
+}
+
+function localModeInfo(): ModeInfo {
+  return { mode: 'local', owner: localOwner(), project: 'localdaemon', version: METRO_VERSION };
+}
+
+async function accountCall(
+  station: StationName,
+  action: string,
+  args: Record<string, unknown>,
+): Promise<unknown> {
+  let response;
+  try {
+    response = await forwardTrainCall(station, action, args);
+  } catch (err) {
+    throw new ApiError(
+      `metro could not reach the ${station} train: ${errMsg(err)}`,
+      503,
+    );
+  }
+  if (response.error !== undefined) throw new ApiError(response.error, 400);
+  return response.result;
+}
+
+export function localSessionApis(deps: LocalModeDeps): SessionApis {
+  return {
+    agentApi: agentApi(deps),
+    bundleApi: bundleApi(deps),
+    connectorApi,
+    relayApi,
+    claudeApi: {},
+    updateApi: { restart: deps.restart },
+    controlApi: { restart: deps.restart, stop: deps.stop },
+    schedulesApi: true,
+    filesApi: true,
+    vaultApi: true,
+    ownerApi: { setOwner: (owner) => setLocalOwner(owner) },
+    machineApi: {},
+    modelApi: {},
+    gateway: { config: readModelConfig },
+    terminalApi: {},
+    mode: localModeInfo,
+  };
+}

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -0,0 +1,71 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { handleSessionApiRequest } from './session.js';
+import { handleApprovalsRequest } from '../approvals/api.js';
+import { handleAgentApiRequest, type AgentApiDeps } from '../agents/api.js';
+import {
+  handleConnectorApiRequest,
+  type ConnectorApiDeps,
+} from '../connectors/api.js';
+import type { RelayApiDeps } from '../connectors/relay.js';
+import { handleClaudeRequest, type ClaudeApiDeps } from '../claude/api.js';
+import type { ModeInfo } from '@metro-labs/http/mode-api';
+import { handleBundleRequest, type BundleApiDeps } from '../agents/bundle.js';
+import { handleUpdateRequest, type UpdateApiDeps } from '../server/update.js';
+import { handleControlRequest, type ControlApiDeps } from '../server/control.js';
+import { handleOwnerRequest, type OwnerApiDeps } from '../server/owner.js';
+import { handleMachineRequest, type MachineApiDeps } from '../server/machine.js';
+import { handleModelRequest, type ModelApiDeps } from '../gateway/model-api.js';
+import type { GatewayDeps } from '../gateway/gateway.js';
+import { handleTerminalRequest, type TerminalApiDeps } from '../terminal/api.js';
+import { handleSchedulesRequest } from '../agent-user/schedules-api.js';
+import { handleFilesRequest } from '../agent-user/files-api.js';
+import { handleVaultRequest } from '../vault/api.js';
+import { handleMetroUserRequest } from '../metro-user/api.js';
+
+export interface SessionApis {
+  agentApi?: AgentApiDeps;
+  bundleApi?: BundleApiDeps;
+  updateApi?: UpdateApiDeps;
+  controlApi?: ControlApiDeps;
+  schedulesApi?: true;
+  filesApi?: true;
+  vaultApi?: true;
+  ownerApi?: OwnerApiDeps;
+  machineApi?: MachineApiDeps;
+  modelApi?: ModelApiDeps;
+  gateway?: GatewayDeps;
+  terminalApi?: TerminalApiDeps;
+  claudeApi?: ClaudeApiDeps;
+  connectorApi?: ConnectorApiDeps;
+  relayApi?: RelayApiDeps;
+  mode?: () => ModeInfo;
+}
+
+const when = <T>(dep: T | undefined, run: (dep: T) => boolean): (() => boolean)[] =>
+  dep === undefined ? [] : [() => run(dep)];
+
+export function handleSessionApis(
+  req: IncomingMessage,
+  res: ServerResponse,
+  apis: SessionApis,
+): boolean {
+  const routes: (() => boolean)[] = [
+    () => handleSessionApiRequest(req, res),
+    () => handleApprovalsRequest(req, res),
+    ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
+    ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
+    ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
+    ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
+    ...when(apis.schedulesApi, () => handleSchedulesRequest(req, res)),
+    ...when(apis.filesApi, () => handleFilesRequest(req, res)),
+    ...when(apis.vaultApi, () => handleVaultRequest(req, res)),
+    ...when(apis.vaultApi, () => handleMetroUserRequest(req, res)),
+    ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
+    ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
+    ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),
+    ...when(apis.terminalApi, (d) => handleTerminalRequest(req, res, d)),
+    ...when(apis.claudeApi, (d) => handleClaudeRequest(req, res, d)),
+    ...when(apis.agentApi, (d) => handleAgentApiRequest(req, res, d)),
+  ];
+  return routes.some((run) => run());
+}

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/session-api.ts → daemon/src/routes/session.ts}

@@ -1,5 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { apiSession, cors, sendJson } from './api-http.js';
+import { apiFailure, apiSession, cors, sendJson } from '@metro-labs/http/api-http';
 
 const PATH = '/api/session';
 
@@ -17,11 +17,13 @@ export function handleSessionApiRequest(
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  sendJson(req, res, 200, { email: session.email });
+  apiSession(req)
+    .then((session) => {
+      if (!session) sendJson(req, res, 401, { error: 'unauthorized' });
+      else sendJson(req, res, 200, { subject: session.subject, role: session.role });
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, 'session');
+    });
   return true;
 }

package/runtime/node_modules/@metro-labs/daemon/src/routes/threema-callback.ts

@@ -0,0 +1,103 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from '@metro-labs/core/log';
+import { tokenMatches } from '../stations/webhook-endpoints.js';
+import {
+  findThreemaCallback,
+  type ThreemaCallback,
+} from '../stations/threema-callbacks.js';
+import { forwardTrainCall, type TrainCallBackend } from '../stations/train-call.js';
+import { BodyTooLargeError, readBody } from './body.js';
+
+const PREFIX = '/api/threema/';
+const CALLBACK_PATH = /^\/api\/threema\/([0-9]{17,20})\/([A-Za-z0-9_-]{32,128})$/;
+const BODY_MAX = 64 * 1024;
+const REQUIRED = ['from', 'to', 'messageId', 'date', 'nonce', 'box', 'mac'] as const;
+
+function callbackTarget(path: string): ThreemaCallback | null {
+  const m = CALLBACK_PATH.exec(path);
+  const callbackId = m?.[1];
+  const token = m?.[2];
+  if (callbackId === undefined || token === undefined) return null;
+  const row = findThreemaCallback(callbackId);
+  return row !== undefined && tokenMatches(row.callbackToken, token) ? row : null;
+}
+
+function parseFields(raw: Buffer): Record<string, string> | null {
+  const params = new URLSearchParams(raw.toString('utf8'));
+  const out: Record<string, string> = {};
+  for (const key of REQUIRED) {
+    const value = params.get(key)?.trim() ?? '';
+    if (value === '') return null;
+    out[key] = value;
+  }
+  const nickname = params.get('nickname')?.trim() ?? '';
+  if (nickname !== '') out.nickname = nickname;
+  return out;
+}
+
+async function deliver(
+  res: ServerResponse,
+  target: ThreemaCallback,
+  fields: Record<string, string>,
+  forward: TrainCallBackend,
+): Promise<void> {
+  let response;
+  try {
+    response = await forward('threema', 'callback', { account: target.id, ...fields });
+  } catch (err) {
+    log.warn(
+      { account: target.id, err: errMsg(err) },
+      'threema: the callback could not reach the train, so Threema is asked to retry',
+    );
+    res.writeHead(503).end('threema train unavailable');
+    return;
+  }
+  if (response.error !== undefined) {
+    log.warn({ account: target.id, err: response.error }, 'threema: callback refused');
+    res.writeHead(400).end('refused');
+    return;
+  }
+  res.writeHead(200).end('ok');
+}
+
+async function readFields(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<Record<string, string> | null> {
+  let raw: Buffer;
+  try {
+    raw = await readBody(req, BODY_MAX);
+  } catch (err) {
+    if (!(err instanceof BodyTooLargeError)) throw err;
+    res.writeHead(413).end('payload too large');
+    return null;
+  }
+  const fields = parseFields(raw);
+  if (fields === null) res.writeHead(400).end('missing callback fields');
+  return fields;
+}
+
+export async function handleThreemaCallback(
+  req: IncomingMessage,
+  res: ServerResponse,
+  forward: TrainCallBackend = forwardTrainCall,
+): Promise<boolean> {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (!path.startsWith(PREFIX)) return false;
+  const target = callbackTarget(path);
+  if (target === null) {
+    res.writeHead(404).end();
+    return true;
+  }
+  if (req.method === 'GET') {
+    res.writeHead(200).end(`metro threema callback ${target.callbackId} ready\n`);
+    return true;
+  }
+  if (req.method !== 'POST') {
+    res.writeHead(405).end();
+    return true;
+  }
+  const fields = await readFields(req, res);
+  if (fields !== null) await deliver(res, target, fields, forward);
+  return true;
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/control.ts

@@ -0,0 +1,39 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { sessionRoute } from '@metro-labs/http/api-http';
+import { log } from '@metro-labs/core/log';
+
+const STOP = '/api/stop';
+const RESTART = '/api/restart';
+const EXIT_DELAY_MS = 500;
+
+export interface ControlApiDeps {
+  restart: () => void;
+  stop: () => void;
+  served?: () => boolean;
+}
+
+interface Action {
+  run: () => void;
+  body: Record<string, boolean>;
+}
+
+const servedByCli = (): boolean => (process.env.METRO_CLI_BIN?.trim() ?? '') !== '';
+
+function actionFor(path: string, deps: ControlApiDeps): Action {
+  return path === STOP ? { run: deps.stop, body: { stopping: true } } : { run: deps.restart, body: { restarting: true } };
+}
+
+export function handleControlRequest(req: IncomingMessage, res: ServerResponse, deps: ControlApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [STOP]: ['POST'], [RESTART]: ['POST'] }, admin: true, label: 'control-api' }, async (session, path) => {
+    const action = actionFor(path, deps);
+    if (!(deps.served ?? servedByCli)())
+      throw new ApiError(
+        'this daemon was not started by metro serve, so nothing on the machine would bring it back: use the shell instead',
+        400,
+      );
+    log.info({ path, subject: session.subject }, 'control-api: requested from the page');
+    setTimeout(action.run, EXIT_DELAY_MS).unref();
+    return Promise.resolve(action.body);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/machine.ts

@@ -0,0 +1,58 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { hostname, homedir } from 'node:os';
+import { statfs } from 'node:fs/promises';
+import { errMsg, log } from '@metro-labs/core/log';
+import { sessionRoute } from '@metro-labs/http/api-http';
+import { publicBaseUrl, webhookPort } from '../files/attach-serve.js';
+import { claudeDir } from '../claude/files.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { agentsDir } from '../agents/files.js';
+import { localOwner } from '../agents/file-admin.js';
+
+const PATH = '/api/server';
+
+export interface MachineApiDeps {
+  startedAt?: string;
+}
+
+const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
+
+export interface Disk {
+  path: string;
+  totalBytes: number;
+  freeBytes: number;
+}
+
+export async function diskInfo(path = homedir()): Promise<Disk | null> {
+  try {
+    const s = await statfs(path);
+    return { path, totalBytes: s.bsize * s.blocks, freeBytes: s.bsize * s.bavail };
+  } catch (err) {
+    log.warn({ err: errMsg(err), path }, 'machine: could not read the disk');
+    return null;
+  }
+}
+
+export async function machineInfo(startedAt = bootedAt): Promise<Record<string, unknown>> {
+  const store = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  return {
+    disk: await diskInfo(),
+    version: METRO_VERSION,
+    owner: localOwner(),
+    hostname: hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    port: webhookPort(),
+    publicUrl: publicBaseUrl(),
+    uptimeSeconds: Math.round(process.uptime()),
+    startedAt,
+    bun: process.versions.bun ?? null,
+    agentsDir: agentsDir(),
+    claudeDir: claudeDir(),
+    runtimeStore: store === '' ? null : store,
+  };
+}
+
+export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: false, label: 'machine-api' }, () => machineInfo(deps.startedAt));
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/owner.ts

@@ -0,0 +1,26 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readJsonBody, sessionRoute, type ApiSession } from '@metro-labs/http/api-http';
+import { isOrganizationId } from '@metro-labs/http/workos-token';
+import { isRecord } from '@metro-labs/core/is-record';
+import { log } from '@metro-labs/core/log';
+
+const PATH = '/api/owner';
+
+export interface OwnerApiDeps {
+  setOwner: (owner: string) => string;
+}
+
+async function move(req: IncomingMessage, session: ApiSession, deps: OwnerApiDeps): Promise<{ owner: string }> {
+  const body = await readJsonBody(req);
+  const owner = isRecord(body) && typeof body.owner === 'string' ? body.owner.trim() : '';
+  if (!isOrganizationId(owner)) throw new ApiError('owner must be an organization id', 400);
+  if (owner === session.subject) throw new ApiError('this machine already belongs to that organization', 409);
+  const saved = deps.setOwner(owner);
+  log.info({ from: session.subject, to: saved }, 'owner: this machine moved to another organization');
+  return { owner: saved };
+}
+
+export function handleOwnerRequest(req: IncomingMessage, res: ServerResponse, deps: OwnerApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['POST'] }, admin: true, label: 'owner-api' }, (session) => move(req, session, deps));
+}

package/runtime/node_modules/@metro-labs/daemon/src/server/update.ts

@@ -0,0 +1,90 @@
+import { execFile } from 'node:child_process';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { sessionRoute } from '@metro-labs/http/api-http';
+import { isRecord } from '@metro-labs/core/is-record';
+import { METRO_VERSION } from '@metro-labs/core/version';
+
+const PATH = '/api/update';
+const CHECK_TTL_MS = 10 * 60_000;
+const CHECK_TIMEOUT_MS = 30_000;
+const UPDATE_TIMEOUT_MS = 5 * 60_000;
+const RESTART_DELAY_MS = 500;
+const OUTPUT_TAIL = 800;
+
+export interface UpdateCheck {
+  current: string;
+  latest: string;
+  newer: boolean;
+}
+
+export interface UpdateResult {
+  updated: boolean;
+  version: string;
+  restarting: boolean;
+}
+
+export interface UpdateApiDeps {
+  restart: () => void;
+  cliBin?: () => string;
+}
+
+const cliBinFromEnv = (): string => process.env.METRO_CLI_BIN?.trim() ?? '';
+
+function runCli(bin: string, args: string[], timeout: number): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(process.execPath, [bin, ...args], { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err === null) resolve({ stdout, stderr });
+      else reject(new ApiError(`metro update failed: ${(stderr || err.message).trim().slice(-OUTPUT_TAIL)}`, 502));
+    });
+  });
+}
+
+let cached: { at: number; check: UpdateCheck } | null = null;
+
+function parseCheck(raw: string): UpdateCheck {
+  let body: unknown;
+  try {
+    body = JSON.parse(raw.trim().split('\n').at(-1) ?? '');
+  } catch {
+    throw new ApiError('metro update --check returned no report', 502);
+  }
+  if (!isRecord(body) || typeof body.current !== 'string' || typeof body.latest !== 'string')
+    throw new ApiError('metro update --check returned an unexpected report', 502);
+  return { current: body.current, latest: body.latest, newer: body.newer === true };
+}
+
+async function check(bin: string, now = Date.now()): Promise<UpdateCheck> {
+  if (cached !== null && now - cached.at < CHECK_TTL_MS) return cached.check;
+  const out = await runCli(bin, ['update', '--check'], CHECK_TIMEOUT_MS);
+  cached = { at: now, check: parseCheck(out.stdout) };
+  return cached.check;
+}
+
+async function apply(bin: string, deps: UpdateApiDeps): Promise<UpdateResult> {
+  const before = await check(bin);
+  if (!before.newer) return { updated: false, version: before.current, restarting: false };
+  const out = await runCli(bin, ['update'], UPDATE_TIMEOUT_MS);
+  cached = null;
+  log.info({ from: before.current, to: before.latest, output: out.stderr.trim().slice(-OUTPUT_TAIL) }, 'update-api: metro updated, restarting');
+  setTimeout(() => {
+    deps.restart();
+  }, RESTART_DELAY_MS).unref();
+  return { updated: true, version: before.latest, restarting: true };
+}
+
+function binOrThrow(deps: UpdateApiDeps): string {
+  const bin = (deps.cliBin ?? cliBinFromEnv)();
+  if (bin === '')
+    throw new ApiError('this daemon was not started by metro serve, so it cannot update itself: run metro update on the machine', 400);
+  return bin;
+}
+
+export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, deps: UpdateApiDeps): boolean {
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET', 'POST'] }, admin: ['POST'], label: 'update-api' }, async () => {
+    const bin = binOrThrow(deps);
+    if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };
+    return apply(bin, deps);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/server.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+import './boot/boot.js';

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-driver.ts

@@ -0,0 +1,42 @@
+export type AttachStep = 'code' | 'password' | 'scan' | 'pair' | 'device' | 'browser';
+
+export interface AttachPrompt {
+  step: AttachStep;
+  prompt: string;
+  qr?: string;
+  pairingCode?: string;
+  userCode?: string;
+  verificationUri?: string;
+  authorizeUrl?: string;
+}
+
+export interface AttachOutcome {
+  config: Record<string, unknown>;
+  identity: Record<string, string>;
+}
+
+export interface DriverHooks {
+  prompt: (p: AttachPrompt) => void;
+  done: (o: AttachOutcome) => void;
+  fail: (message: string) => void;
+}
+
+export interface StepInput {
+  code?: unknown;
+  password?: unknown;
+  state?: unknown;
+  mode?: unknown;
+  error?: unknown;
+  errorDescription?: unknown;
+}
+
+export interface AttachDriver {
+  submit: (input: StepInput) => Promise<void>;
+  cancel: () => Promise<void>;
+}
+
+export interface StartedAttach {
+  driver: AttachDriver;
+  prompt: AttachPrompt;
+  expiresAt?: number;
+}