@stage-labs/metro 0.1.0-beta.201 → 0.1.0-beta.202

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -34,14 +34,14 @@ export interface Route {
 
 export class ModelConfigError extends Error {}
 
-export const MODEL_FILE = 'model.json';
+const MODEL_FILE = 'model.json';
 const MAX_FIELD = 512;
 const MAX_LABEL = 60;
 const MAX_CONNECTIONS = 20;
 const PREFIX_RE = /^(anthropic|bedrock|openrouter|codex|gemini):(.+)$/;
 const SMALL_RE = /haiku/i;
 
-export const LABELS: Record<Provider, string> = {
+const LABELS: Record<Provider, string> = {
   anthropic: 'Anthropic',
   bedrock: 'Amazon Bedrock',
   openrouter: 'OpenRouter',
@@ -56,7 +56,7 @@ const maybe = (value: unknown): string | null => (typeof value === 'string' && v
 
 export const empty = (): ModelConfig => ({ version: 2, route: '', connections: [] });
 
-export const newConnection = (provider: Provider, label: string): Connection => ({
+const newConnection = (provider: Provider, label: string): Connection => ({
   id: newId(),
   provider,
   label,
@@ -102,36 +102,15 @@ function connectionFromDisk(raw: unknown): Connection | null {
   };
 }
 
-function fromVersionOne(raw: Record<string, unknown>): ModelConfig {
-  const block = (name: Provider): Record<string, unknown> => (isRecord(raw[name]) ? raw[name] : {});
-  const made: Connection[] = [];
-  const keep = (provider: Provider, fill: (c: Connection) => Connection, has: boolean): void => {
-    if (has) made.push(fill(newConnection(provider, LABELS[provider])));
-  };
-  const anthropic = block('anthropic');
-  const bedrock = block('bedrock');
-  const openrouter = block('openrouter');
-  const codex = block('codex');
-  const gemini = block('gemini');
-  keep('anthropic', (c) => ({ ...c, apiKey: text(anthropic.apiKey), model: text(anthropic.model) }), text(anthropic.apiKey) !== '' || text(anthropic.model) !== '');
-  keep('bedrock', (c) => ({ ...c, apiKey: text(bedrock.apiKey), region: text(bedrock.region), model: text(bedrock.model) }), text(bedrock.apiKey) !== '');
-  keep('openrouter', (c) => ({ ...c, apiKey: text(openrouter.apiKey), model: text(openrouter.model), zdr: openrouter.zdr === true }), text(openrouter.apiKey) !== '');
-  keep('codex', (c) => ({ ...c, model: text(codex.model), codex: codexFromDisk(codex.auth) }), codexFromDisk(codex.auth) !== null);
-  keep('gemini', (c) => ({ ...c, model: text(gemini.model), gemini: geminiTokensFromDisk(gemini.auth) }), geminiTokensFromDisk(gemini.auth) !== null);
-  const wanted = isProvider(raw.provider) ? raw.provider : 'anthropic';
-  return { version: 2, route: made.find((c) => c.provider === wanted)?.id ?? '', connections: made };
-}
-
 export function parseModelConfig(raw: unknown): ModelConfig {
-  if (!isRecord(raw)) return empty();
-  if (!Array.isArray(raw.connections)) return fromVersionOne(raw);
+  if (!isRecord(raw) || !Array.isArray(raw.connections)) return empty();
   const connections = raw.connections.flatMap((c: unknown) => connectionFromDisk(c) ?? []).slice(0, MAX_CONNECTIONS);
   const route = text(raw.route);
   return { version: 2, route: connections.some((c) => c.id === route) ? route : (connections[0]?.id ?? ''), connections };
 }
 
 const needsIds = (raw: unknown): boolean =>
-  isRecord(raw) && (!Array.isArray(raw.connections) || raw.connections.some((c: unknown) => isRecord(c) && text(c.id) === ''));
+  isRecord(raw) && Array.isArray(raw.connections) && raw.connections.some((c: unknown) => isRecord(c) && text(c.id) === '');
 
 export function readModelConfig(dir = agentsDir()): ModelConfig {
   const raw = readJson<unknown>(join(dir, MODEL_FILE), null, { warn: 'model-config: model.json is unreadable, so every request goes to Anthropic until it is fixed' });
@@ -148,7 +127,7 @@ export const connectionOf = (cfg: ModelConfig, id: string): Connection | null =>
 
 export const routedConnection = (cfg: ModelConfig): Connection | null => connectionOf(cfg, cfg.route);
 
-export function requireConnection(cfg: ModelConfig, id: string): Connection {
+function requireConnection(cfg: ModelConfig, id: string): Connection {
   const found = connectionOf(cfg, id);
   if (found === null) throw new ModelConfigError('no such connection');
   return found;
@@ -181,7 +160,7 @@ export function notReady(cfg: ModelConfig, conn = routedConnection(cfg)): string
   return CHECKS[conn.provider].find(([missing]) => missing(conn))?.[1] ?? null;
 }
 
-export const isSmallModel = (requested: string): boolean => SMALL_RE.test(requested);
+const isSmallModel = (requested: string): boolean => SMALL_RE.test(requested);
 
 const DEFAULTS: Record<Provider, (requested: string, c: Connection) => string> = {
   openrouter: (requested, c) => (requested.includes('/') ? requested : c.model),
@@ -210,7 +189,7 @@ export function resolveRoute(requested: string, cfg: ModelConfig): Route | null
 export const routeLabel = (route: Route): string =>
   route.connection.provider === 'anthropic' ? route.model : `${route.connection.provider}:${route.model}`;
 
-export function publicConnection(c: Connection): Record<string, unknown> {
+function publicConnection(c: Connection): Record<string, unknown> {
   return {
     id: c.id,
     provider: c.provider,
@@ -256,7 +235,7 @@ function flag(patch: Record<string, unknown>, key: string, current: boolean, wha
   return value;
 }
 
-export function labelFor(cfg: ModelConfig, provider: Provider, given: string): string {
+function labelFor(cfg: ModelConfig, provider: Provider, given: string): string {
   if (given !== '') return given.slice(0, MAX_LABEL);
   const taken = cfg.connections.filter((c) => c.provider === provider).length;
   return taken === 0 ? LABELS[provider] : `${LABELS[provider]} ${String(taken + 1)}`;
@@ -270,7 +249,7 @@ export function addConnection(cfg: ModelConfig, patch: unknown): ModelConfig {
   return { ...cfg, route: cfg.route === '' ? filled.id : cfg.route, connections: [...cfg.connections, filled] };
 }
 
-export function applyToConnection(c: Connection, patch: Record<string, unknown>): Connection {
+function applyToConnection(c: Connection, patch: Record<string, unknown>): Connection {
   return {
     ...c,
     label: field(patch, 'label', c.label, 'label', MAX_LABEL),

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -104,7 +104,7 @@ export const CODEX_ROUTES: Record<string, Route> = {
   },
 };
 
-export const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
+const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
   base: deps.geminiBase,
   tokenBase: deps.geminiTokenBase,
   fetchImpl: deps.fetchImpl,

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -31,7 +31,7 @@ export interface Store {
   write: (cfg: ModelConfig) => void;
 }
 
-export type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
+type Handler = (req: IncomingMessage, deps: ModelApiDeps, store: Store) => Promise<unknown>;
 
 export interface Route {
   method: 'GET' | 'POST';

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -1,6 +1,6 @@
 import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
-import { stringOf } from './text.js';
+import { stringOf } from '@metro-labs/http/api-http';
 
 export const OPENROUTER_BASE = 'https://openrouter.ai/api';
 const MODELS_MAX = 2000;
@@ -37,7 +37,7 @@ function modelOf(entry: unknown): OpenRouterModel | null {
   };
 }
 
-export function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
+function newestFirst(a: OpenRouterModel, b: OpenRouterModel): number {
   const when = (b.created ?? 0) - (a.created ?? 0);
   return when !== 0 ? when : a.id.localeCompare(b.id);
 }

package/runtime/node_modules/@metro-labs/daemon/src/gateway/provider-models.ts

@@ -1,9 +1,9 @@
 import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
 import type { Connection } from './model-config.js';
-import { stringOf } from './text.js';
+import { stringOf } from '@metro-labs/http/api-http';
 
-export const ANTHROPIC_API = 'https://api.anthropic.com';
+const ANTHROPIC_API = 'https://api.anthropic.com';
 const ANTHROPIC_VERSION = '2023-06-01';
 const LIST_MAX = 1000;
 
@@ -12,7 +12,7 @@ export interface ProviderModel {
   name: string;
 }
 
-export const KNOWN_CLAUDE: ProviderModel[] = [
+const KNOWN_CLAUDE: ProviderModel[] = [
   { id: 'claude-fable-5-1', name: 'Claude Fable 5.1' },
   { id: 'claude-opus-5-5', name: 'Claude Opus 5.5' },
   { id: 'claude-opus-5', name: 'Claude Opus 5' },

package/runtime/node_modules/@metro-labs/daemon/src/gateway/text.ts

@@ -1,9 +1,8 @@
 import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
 
 const IMAGE_NOTE = '[an image was attached here; this model cannot see it]';
 
-export const stringOf = (value: unknown): string => (typeof value === 'string' ? value : '');
-
 export const nonEmpty = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
 
 const partText = (part: Record<string, unknown>): string => (part.type === 'text' ? stringOf(part.text) : part.type === 'image' ? IMAGE_NOTE : '');

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -1,13 +1,13 @@
 type Key = string;
 
-export interface UsageWindow {
+interface UsageWindow {
   label: string;
   used: number | null;
   resetAt: string | null;
   detail: string | null;
 }
 
-export interface Tally {
+interface Tally {
   requests: number;
   input: number;
   output: number;

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-gate.ts

@@ -3,14 +3,13 @@ import type { ToolResult } from '@metro-labs/core/stations/types';
 import { accountFromLine, knownAccounts } from '../agents/map.js';
 import { policyFor, storedPolicy, strictest, type Access, type PolicyTarget } from '../policy/policy.js';
 import { errResult } from './ctx.js';
-import { takeGrant } from '../approvals/pending.js';
-import { NEEDS_APPROVAL } from '../approvals/needs.js';
+import { NEEDS_APPROVAL, takeGrant } from '../approvals/pending.js';
 import { connectorToolOf } from '../connectors/gates.js';
 import { profileScopeLine } from './profile-lookup.js';
 import { stationOfAccount } from './read-tool.js';
 import { stationForTool, toolGroupOf } from './tool-catalog.js';
 
-export type ChannelTarget = Extract<PolicyTarget, { kind: 'channel' }>;
+type ChannelTarget = Extract<PolicyTarget, { kind: 'channel' }>;
 
 export const UNGATED = new Set<string>(['list_accounts', 'create_upload']);
 
@@ -19,7 +18,7 @@ function fromLine(line: string, override: string | undefined): ChannelTarget[] {
   return acct === undefined ? [] : [{ kind: 'channel', station: acct.station, account: override ?? acct.accountId }];
 }
 
-export function channelTargets(name: string, a: Record<string, unknown>): ChannelTarget[] {
+function channelTargets(name: string, a: Record<string, unknown>): ChannelTarget[] {
   if (UNGATED.has(name)) return [];
   if (name === 'get_profile') {
     const line = profileScopeLine(a);
@@ -60,13 +59,13 @@ export function policyGate(name: string, a: Record<string, unknown>): ToolResult
   return takeGrant(isChannelTool(name), a) ? undefined : errResult(NEEDS_APPROVAL(target.station, name));
 }
 
-export interface EffectivePolicy {
+interface EffectivePolicy {
   read: Access;
   write: Access;
   tools: Record<string, Access>;
 }
 
-export function effectivePolicy(target: ChannelTarget): EffectivePolicy {
+function effectivePolicy(target: ChannelTarget): EffectivePolicy {
   const stored = storedPolicy(target);
   return { read: stored?.read ?? 'allow', write: stored?.write ?? 'allow', tools: { ...stored?.tools } };
 }

package/runtime/node_modules/@metro-labs/daemon/src/mcp/policy-snapshot.ts

@@ -10,7 +10,7 @@ import { UNGATED } from './policy-gate.js';
 import { connectorGates } from '../connectors/gates.js';
 import { stationToolOwners, TOOL_DEFS, toolGroupOf } from './tool-catalog.js';
 
-export interface PolicySnapshot {
+interface PolicySnapshot {
   version: 1;
   tools: Record<string, ToolGroup>;
   owners: Record<string, string>;
@@ -31,7 +31,7 @@ const FILE = 'policy.json';
 
 export const policySnapshotPath = (dir = agentsDir()): string => join(dir, FILE);
 
-export function policySnapshot(): PolicySnapshot {
+function policySnapshot(): PolicySnapshot {
   const accounts: Record<string, ToolPolicy> = {};
   for (const { target, policy } of storedPolicies())
     if (target.kind === 'channel') accounts[`${target.station}/${target.account}`] = policy;
@@ -60,7 +60,7 @@ function current(path: string): string | undefined {
   }
 }
 
-export function writePolicySnapshot(path = policySnapshotPath()): void {
+function writePolicySnapshot(path = policySnapshotPath()): void {
   const text = `${JSON.stringify(policySnapshot(), null, 2)}\n`;
   if (current(path) === text) return;
   try {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/profile-lookup.ts

@@ -36,11 +36,11 @@ export function profileTarget(a: Record<string, unknown>): ProfileTarget | { ref
   if (!from) return { refused: 'get_profile requires `from`' };
   const parsed = Line.parse(from);
   const at = parsed?.path.indexOf('user') ?? -1;
-  if (parsed === null || at < 0 || at + 1 >= parsed.path.length) return { refused: `${from} is not a person: expected metro://<station>/<account>/user/<id>` };
+  if (parsed === null || at < 1 || at + 1 >= parsed.path.length) return { refused: `${from} is not a person: expected metro://<station>/<account>/user/<id>` };
   const station = stationByName(parsed.station);
   if (!station) return { refused: `no station named ${parsed.station}` };
   if (station.readsProfiles !== true) return { refused: `${station.name} has no profile metro can read` };
-  return { station, account: at === 0 ? 'default' : parsed.path.slice(0, at).join('/'), user: parsed.path.slice(at + 1).join('/') };
+  return { station, account: parsed.path.slice(0, at).join('/'), user: parsed.path.slice(at + 1).join('/') };
 }
 
 export const profileScopeLine = (a: Record<string, unknown>): string | undefined => {

package/runtime/node_modules/@metro-labs/daemon/src/mcp/read-tool.ts

@@ -22,7 +22,7 @@ export function stationOfAccount(account: string): string | undefined {
   return hits.length === 1 ? hits[0]?.station : undefined;
 }
 
-export function readArgs(a: Record<string, unknown>): Record<string, unknown> {
+function readArgs(a: Record<string, unknown>): Record<string, unknown> {
   const args: Record<string, unknown> = {};
   if (str(a.line)) args.line = str(a.line);
   if (str(a.account)) args.account = str(a.account);
@@ -34,7 +34,7 @@ export function readArgs(a: Record<string, unknown>): Record<string, unknown> {
   return args;
 }
 
-export function ignoredFilters(station: Station, a: Record<string, unknown>): string[] {
+function ignoredFilters(station: Station, a: Record<string, unknown>): string[] {
   const supported = station.readFilters ?? new Set<ReadFilter>();
   return FILTERS.filter(([snake, filter]) => given(a[snake]) && !supported.has(filter)).map(([snake]) => snake);
 }

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -1,8 +1,8 @@
 export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
-export const HELPER_VERSION = 1;
+const HELPER_VERSION = 1;
 export const SUDOERS_PATH = '/etc/sudoers.d/metro';
 export const METRO_USER = 'metro';
-export const METRO_HOME = '/var/lib/metro';
+const METRO_HOME = '/var/lib/metro';
 
 export const sudoersText = (agent: string): string =>
   [

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -0,0 +1,37 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { HELPER_PATH, helperScript, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import { AGENT_NAME } from '../agent-user/user.js';
+
+interface InstallPaths {
+  helper: string;
+  sudoers: string;
+}
+
+function checked(file: string, args: string[]): void {
+  const run = spawnSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  if (run.error !== undefined) throw run.error;
+  if (run.status !== 0) throw new Error(`${file} ${args.join(' ')}: ${`${run.stdout}${run.stderr}`.trim() || `exit ${String(run.status)}`}`);
+}
+
+export function installRootHelper(paths: InstallPaths = { helper: HELPER_PATH, sudoers: SUDOERS_PATH }): void {
+  mkdirSync(dirname(paths.helper), { recursive: true, mode: 0o755 });
+  writeFileSync(paths.helper, helperScript(), { mode: 0o755 });
+  chmodSync(paths.helper, 0o755);
+  const work = mkdtempSync(join(tmpdir(), 'metro-sudoers-'));
+  try {
+    const draft = join(work, 'metro');
+    writeFileSync(draft, sudoersText(AGENT_NAME), { mode: 0o440 });
+    checked('visudo', ['-cf', draft]);
+    checked('install', ['-m', '440', draft, paths.sudoers]);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  installRootHelper();
+  process.stdout.write(`metro: wrote ${HELPER_PATH} and ${SUDOERS_PATH}\n`);
+}

package/runtime/node_modules/@metro-labs/daemon/src/net/tunnel.ts

@@ -83,7 +83,7 @@ function modeThrough(ip: string, host: string): Promise<{ mode?: unknown; owner?
   });
 }
 
-export async function daemonAnswersAt(url: string, owner: string | null): Promise<boolean> {
+async function daemonAnswersAt(url: string, owner: string | null): Promise<boolean> {
   const host = new URL(url).host;
   const addresses = await publicAddresses(host);
   if (addresses.length === 0) return false;
@@ -162,7 +162,7 @@ export type Resolves = (host: string) => Promise<boolean>;
 const RESOLVE_EVERY_MS = 3_000;
 const RESOLVE_GIVE_UP_MS = 180_000;
 
-export async function resolvesPublicly(host: string): Promise<boolean> {
+async function resolvesPublicly(host: string): Promise<boolean> {
   return (await publicAddresses(host)).length > 0;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/policy/policy.ts

@@ -5,7 +5,7 @@ import type { ToolGroup } from '@metro-labs/core/stations/types';
 
 export type Access = 'allow' | 'ask' | 'deny';
 
-export const ACCESS: readonly Access[] = ['allow', 'ask', 'deny'];
+const ACCESS: readonly Access[] = ['allow', 'ask', 'deny'];
 
 export interface ToolPolicy {
   read?: Access;

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -165,7 +165,7 @@ function bundleApi(deps: LocalModeDeps): BundleApiDeps {
 }
 
 function localModeInfo(): ModeInfo {
-  return { mode: 'local', owner: localOwner(), project: 'localdaemon', version: METRO_VERSION };
+  return { mode: 'local', owner: localOwner(), version: METRO_VERSION };
 }
 
 async function accountCall(
@@ -195,9 +195,6 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     claudeApi: {},
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
-    schedulesApi: true,
-    filesApi: true,
-    vaultApi: true,
     ownerApi: { setOwner: (owner) => setLocalOwner(owner) },
     machineApi: {},
     modelApi: {},

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -20,16 +20,12 @@ import { handleTerminalRequest, type TerminalApiDeps } from '../terminal/api.js'
 import { handleSchedulesRequest } from '../agent-user/schedules-api.js';
 import { handleFilesRequest } from '../agent-user/files-api.js';
 import { handleVaultRequest } from '../vault/api.js';
-import { handleMetroUserRequest } from '../metro-user/api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
   bundleApi?: BundleApiDeps;
   updateApi?: UpdateApiDeps;
   controlApi?: ControlApiDeps;
-  schedulesApi?: true;
-  filesApi?: true;
-  vaultApi?: true;
   ownerApi?: OwnerApiDeps;
   machineApi?: MachineApiDeps;
   modelApi?: ModelApiDeps;
@@ -56,10 +52,9 @@ export function handleSessionApis(
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
-    ...when(apis.schedulesApi, () => handleSchedulesRequest(req, res)),
-    ...when(apis.filesApi, () => handleFilesRequest(req, res)),
-    ...when(apis.vaultApi, () => handleVaultRequest(req, res)),
-    ...when(apis.vaultApi, () => handleMetroUserRequest(req, res)),
+    () => handleSchedulesRequest(req, res),
+    () => handleFilesRequest(req, res),
+    () => handleVaultRequest(req, res),
     ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
     ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),
     ...when(apis.modelApi, (d) => handleModelRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/daemon/src/server/machine.ts

@@ -17,13 +17,13 @@ export interface MachineApiDeps {
 
 const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
 
-export interface Disk {
+interface Disk {
   path: string;
   totalBytes: number;
   freeBytes: number;
 }
 
-export async function diskInfo(path = homedir()): Promise<Disk | null> {
+async function diskInfo(path = homedir()): Promise<Disk | null> {
   try {
     const s = await statfs(path);
     return { path, totalBytes: s.bsize * s.blocks, freeBytes: s.bsize * s.bavail };

package/runtime/node_modules/@metro-labs/daemon/src/server/update.ts

@@ -13,13 +13,13 @@ const UPDATE_TIMEOUT_MS = 5 * 60_000;
 const RESTART_DELAY_MS = 500;
 const OUTPUT_TAIL = 800;
 
-export interface UpdateCheck {
+interface UpdateCheck {
   current: string;
   latest: string;
   newer: boolean;
 }
 
-export interface UpdateResult {
+interface UpdateResult {
   updated: boolean;
   version: string;
   restarting: boolean;

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-session.ts

@@ -50,13 +50,13 @@ export interface AttachView {
   expiresAt: number;
 }
 
-export type CompleteAttach = (
+type CompleteAttach = (
   owner: AttachOwner,
   station: StationName,
   config: Record<string, unknown>,
 ) => Promise<{ accountId: string; activated: boolean }>;
 
-export type AuthorizeAttach = (owner: AttachOwner) => Promise<void>;
+type AuthorizeAttach = (owner: AttachOwner) => Promise<void>;
 
 export interface AttachSessionDeps {
   authorize: AuthorizeAttach;

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-xmtp.ts

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { stringOf } from '@metro-labs/http/api-http';
 import { rmSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { errMsg, log } from '@metro-labs/core/log';
@@ -43,8 +44,6 @@ interface VerifyReply {
   error?: unknown;
 }
 
-const str = (value: unknown): string => (typeof value === 'string' ? value : '');
-
 function readReply(raw: string): VerifyReply {
   const line = raw.trim().split('\n').at(-1) ?? '';
   try {
@@ -97,13 +96,13 @@ export async function verifyXmtpKeyOutOfProcess(
   const reply = readReply(raw);
   if (reply.ok !== true)
     throw new XmtpAttachError(
-      withoutKey(str(reply.error) || UNREACHABLE, privateKey),
+      withoutKey(stringOf(reply.error) || UNREACHABLE, privateKey),
     );
   const identity = {
-    inboxId: str(reply.inboxId),
-    address: str(reply.address),
-    installationId: str(reply.installationId),
-    dbPath: str(reply.dbPath),
+    inboxId: stringOf(reply.inboxId),
+    address: stringOf(reply.address),
+    installationId: stringOf(reply.installationId),
+    dbPath: stringOf(reply.dbPath),
   };
   if (identity.inboxId === '' || identity.address === '')
     throw new XmtpAttachError(UNREACHABLE);

package/runtime/node_modules/@metro-labs/daemon/src/stations/supervisor-io.ts

@@ -6,7 +6,7 @@ import type { Pending } from '@metro-labs/core/trains/protocol';
 export const RESTART_BACKOFFS_MS = [1_000, 5_000, 30_000] as const;
 export const MAX_CONSECUTIVE_FAILS = 5;
 export const HOT_RELOAD_DEBOUNCE_MS = 300;
-export const TRAIN_EXT = /\.(ts|js|mjs)$/;
+const TRAIN_EXT = /\.(ts|js|mjs)$/;
 
 export interface TrainState {
   name: string;

package/runtime/node_modules/@metro-labs/daemon/src/stations/supervisor.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, statSync, type FSWatcher } from 'node:fs';
 import { join } from 'node:path';
 import { errMsg, log } from '@metro-labs/core/log';
-import { daemonSelf } from '@metro-labs/core/events';
+import { userSelf } from '@metro-labs/core/events';
 import {
   drainLines,
   failAllPending,
@@ -209,7 +209,7 @@ export class TrainSupervisor {
           ...process.env,
           ...DYLD_FALLBACK_ENV,
           METRO_TRAIN_NAME: state.name,
-          METRO_SELF_URI: daemonSelf(),
+          METRO_SELF_URI: userSelf(),
         },
       });
       state.proc = proc;

package/runtime/node_modules/@metro-labs/daemon/src/terminal/api.ts

@@ -56,7 +56,7 @@ function tmuxAvailable(deps: TerminalApiDeps): boolean {
   return run.error === undefined && run.status === 0;
 }
 
-export function tmuxSessions(): string[] {
+function tmuxSessions(): string[] {
   const run = spawnSync(...asAgent('tmux', ['list-sessions', '-F', '#{session_name}']), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   if (run.error !== undefined || run.status !== 0) return [];
   return run.stdout
@@ -65,7 +65,7 @@ export function tmuxSessions(): string[] {
     .filter((l) => SESSION_RE.test(l));
 }
 
-export function sessionOf(raw: unknown): string {
+function sessionOf(raw: unknown): string {
   if (raw === undefined || raw === null || raw === '')
     throw new ApiError('name the tmux session to open; GET /api/terminal lists the ones that exist', 400);
   if (typeof raw !== 'string' || !SESSION_RE.test(raw))

package/runtime/node_modules/@metro-labs/daemon/src/terminal/socket.ts

@@ -45,7 +45,7 @@ function sizeTmuxWindow(command: string[], session: string, cols: number, rows:
 const dimension = (raw: unknown): number | null =>
   typeof raw === 'number' && Number.isInteger(raw) && raw > 1 && raw <= MAX_DIMENSION ? raw : null;
 
-export function sizeFrom(control: unknown): { cols: number; rows: number } | null {
+function sizeFrom(control: unknown): { cols: number; rows: number } | null {
   if (!isRecord(control)) return null;
   const cols = dimension(control.cols);
   const rows = dimension(control.rows);

package/runtime/node_modules/@metro-labs/daemon/src/vault/firewall.ts

@@ -1,48 +1,9 @@
-import { spawnSync } from 'node:child_process';
-import { mustHelper, runningAsMetro } from '../metro-user/privilege.js';
+import { mustHelper } from '../metro-user/privilege.js';
 
-const CHAIN = 'METRO_AGENT';
-const TOOLS = ['iptables', 'ip6tables'] as const;
-
-export interface FirewallRunner {
-  run: (file: string, args: string[]) => number | null;
-}
-
-const realRunner: FirewallRunner = { run: (file, args) => spawnSync(file, ['-w', ...args], { stdio: 'ignore' }).status };
-
-export const chainRules = (): string[][] => [
-  ['-A', CHAIN, '-o', 'lo', '-j', 'ACCEPT'],
-  ['-A', CHAIN, '-m', 'conntrack', '--ctstate', 'ESTABLISHED,RELATED', '-j', 'ACCEPT'],
-  ['-A', CHAIN, '-p', 'udp', '--dport', '53', '-j', 'ACCEPT'],
-  ['-A', CHAIN, '-p', 'tcp', '--dport', '53', '-j', 'ACCEPT'],
-  ['-A', CHAIN, '-p', 'tcp', '-j', 'REJECT', '--reject-with', 'tcp-reset'],
-  ['-A', CHAIN, '-j', 'REJECT'],
-];
-
-const jump = (uid: number): string[] => ['OUTPUT', '-m', 'owner', '--uid-owner', String(uid), '-j', CHAIN];
-
-export function applyFirewall(uid: number, runner: FirewallRunner = realRunner): void {
-  if (runner === realRunner && runningAsMetro()) {
-    mustHelper(['firewall-on']);
-    return;
-  }
-  for (const tool of TOOLS) {
-    runner.run(tool, ['-N', CHAIN]);
-    if (runner.run(tool, ['-F', CHAIN]) !== 0) throw new Error(`${tool} refused to prepare the ${CHAIN} chain`);
-    for (const rule of chainRules()) if (runner.run(tool, rule) !== 0) throw new Error(`${tool} refused a rule: ${rule.join(' ')}`);
-    if (runner.run(tool, ['-C', ...jump(uid)]) !== 0 && runner.run(tool, ['-I', ...jump(uid)]) !== 0)
-      throw new Error(`${tool} refused to send the agent's traffic to ${CHAIN}`);
-  }
+export function applyFirewall(): void {
+  mustHelper(['firewall-on']);
 }
 
-export function removeFirewall(uid: number, runner: FirewallRunner = realRunner): void {
-  if (runner === realRunner && runningAsMetro()) {
-    mustHelper(['firewall-off']);
-    return;
-  }
-  for (const tool of TOOLS) {
-    for (let i = 0; i < 10 && runner.run(tool, ['-C', ...jump(uid)]) === 0; i += 1) runner.run(tool, ['-D', ...jump(uid)]);
-    runner.run(tool, ['-F', CHAIN]);
-    runner.run(tool, ['-X', CHAIN]);
-  }
+export function removeFirewall(): void {
+  mustHelper(['firewall-off']);
 }