@stage-labs/metro 0.1.0-beta.200 → 0.1.0-beta.201

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.200",
+  "version": "0.1.0-beta.201",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.200",
+  "version": "0.1.0-beta.201",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/provision.ts

@@ -1,6 +1,8 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from './agent-fs.js';
 import { join } from 'node:path';
+import { chmodSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { copyIntoHome } from './home-fs.js';
@@ -19,9 +21,15 @@ function run(file: string, args: string[]): void {
   if (done.status !== 0) throw new Error(`${file} ${args.join(' ')}: ${done.stderr.trim() || `exit ${String(done.status)}`}`);
 }
 
+function openMetroHome(): void {
+  chmodSync(homedir(), 0o711);
+  chmodSync(join(homedir(), '.metro'), 0o700);
+}
+
 function ensureUser(): AgentUser | null {
   if (runningAsMetro()) {
     mustHelper(['ensure-agent']);
+    openMetroHome();
     forgetAgentUser();
     const user = agentUser();
     if (user !== null) run(...asUser(user, 'chmod', ['711', user.home]));

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/move.ts

@@ -87,7 +87,7 @@ export function moveScript(port: string, spec: string, bun: string): string {
     'echo moving > "$DIR/state"',
     `id ${METRO_USER} >/dev/null 2>&1 || useradd --system --create-home --home-dir ${METRO_HOME} --shell /usr/sbin/nologin ${METRO_USER} || fail "useradd"`,
     `usermod -aG systemd-journal ${METRO_USER} || true`,
-    `mkdir -p ${METRO_HOME} && chown ${METRO_USER}:${METRO_USER} ${METRO_HOME} && chmod 700 ${METRO_HOME}`,
+    `mkdir -p ${METRO_HOME} && chown ${METRO_USER}:${METRO_USER} ${METRO_HOME} && chmod 711 ${METRO_HOME}`,
     `B=${shellWord(bun)}; case "$B" in /root/*) install -m 755 "$B" /usr/local/bin/bun || fail "bun";; esac`,
     `su -s /bin/sh ${METRO_USER} -c ${shellWord(`cd / && npm install --global --prefix ${PREFIX} ${spec}`)} || fail "npm install for ${METRO_USER}"`,
     `for bin in node bun tailscale npm; do su -s /bin/sh ${METRO_USER} -c ${shellWord(`PATH=${PREFIX}/bin:/usr/local/bin:/usr/bin:/bin command -v "$1" >/dev/null`)} sh "$bin" || fail "${METRO_USER} cannot find $bin"; done`,
@@ -97,7 +97,7 @@ export function moveScript(port: string, spec: string, bun: string): string {
     'if [ -e "$NEW" ]; then mv "$NEW" "$NEW.old-$(date +%s)"; fi',
     'mv "$OLD" "$NEW" || { systemctl start metro; fail "move"; }',
     'rm -f "$NEW/runtime/runtime.json"',
-    `chown -R ${METRO_USER}:${METRO_USER} ${METRO_HOME}`,
+    `chown -R ${METRO_USER}:${METRO_USER} ${METRO_HOME} && chmod 711 ${METRO_HOME} && chmod 700 "$NEW"`,
     `install -m 644 "$DIR/metro.service.new" ${UNIT_FILE}`,
     'systemctl daemon-reload && systemctl start metro',
     `if healthy ${METRO_USER}; then echo done > "$DIR/state"; echo "metro runs as ${METRO_USER}"; exit 0; fi`,

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.200"
+  "version": "0.1.0-beta.201"
 }