@stage-labs/metro 0.1.0-beta.201 → 0.1.0-beta.203

package/dist/claude.js

@@ -21,11 +21,6 @@ export const claudeArgs = (extra, mcpConfig, mode = 'auto', prompt = null) => [
     ...extra,
 ];
 const set = (env, name) => (env[name] ?? '').trim() !== '';
-export function bypassSandboxEnv(env, mode, uid) {
-    if (mode !== 'bypass' || uid !== 0 || env.IS_SANDBOX !== undefined)
-        return env;
-    return { ...env, IS_SANDBOX: '1' };
-}
 export function pinnedBy(env) {
     if (set(env, 'ANTHROPIC_BASE_URL'))
         return 'ANTHROPIC_BASE_URL';
@@ -49,7 +44,7 @@ export function credentialEnv(env, agentKey, signedIn) {
         return env;
     return { ...env, ANTHROPIC_AUTH_TOKEN: agentKey };
 }
-export function claudeSignedIn() {
+function claudeSignedIn() {
     const run = spawnSync('claude', ['auth', 'status', '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
     if (run.error !== undefined || typeof run.stdout !== 'string')
         return false;
@@ -93,7 +88,7 @@ async function verdict() {
         return picked;
     return { skip: 'the daemon is not serving here (stopped, or not running), so Claude Code talks to Anthropic directly' };
 }
-export function runClaude(args, env) {
+function runClaude(args, env) {
     return new Promise((resolve, reject) => {
         const leaveToChild = () => undefined;
         process.on('SIGINT', leaveToChild);
@@ -144,18 +139,12 @@ export async function launchClaude(extra) {
     const prompt = systemPrompt();
     if (prompt !== null)
         process.stderr.write('metro claude: the system prompt from the Harness page is appended to this session\n');
-    const sandbox = (env) => {
-        const out = bypassSandboxEnv(env, mode, process.getuid?.());
-        if (out !== env)
-            process.stderr.write('metro claude: bypass permission mode under root, so IS_SANDBOX=1 is set for Claude Code (it refuses to skip permissions as root otherwise); this box is a dedicated single-tenant machine\n');
-        return out;
-    };
     try {
         if ('skip' in decision) {
             process.stderr.write(`metro claude: ${decision.skip}\n`);
-            return await runClaude(claudeArgs(extra, mcp?.path, mode, prompt), sandbox(process.env));
+            return await runClaude(claudeArgs(extra, mcp?.path, mode, prompt), process.env);
         }
-        return await runClaude(claudeArgs(extra, mcp?.path, mode, prompt), sandbox(gatewayLaunchEnv(decision.key, port)));
+        return await runClaude(claudeArgs(extra, mcp?.path, mode, prompt), gatewayLaunchEnv(decision.key, port));
     }
     finally {
         mcp?.cleanup();

package/dist/cli.js

@@ -7,7 +7,7 @@ import { update } from './update.js';
 import { serve } from './serve.js';
 import { service, serviceStopHint } from './service.js';
 import { currentVersion } from './version.js';
-const USAGE = `metro — run your agent on this machine
+const USAGE = `metro: run your agent on this machine
 
   metro serve [--port <n>] [--owner <organization id>]
                   run the daemon: the agent, its channels and its connectors live in
@@ -17,10 +17,12 @@ const USAGE = `metro — run your agent on this machine
                   link it prints; --owner names the organization whose members may sign
                   in, needed on the first start only; Stop on the page parks the daemon and keeps the
                   address, so Start works from the page too
-  metro service install [--port <n>] [--owner <organization id>]
+  metro service install [--port <n>] [--owner <organization id>] [--user metro]
                   run metro serve as a service (systemd on Linux, launchd on macOS): it
                   starts at boot and after a crash, so the page can stop, start and
-                  restart it with no shell; metro service uninstall and status as well
+                  restart it with no shell; on Linux, root passes --user metro so Metro
+                  runs as its own user and Claude Code as the user agent;
+                  metro service uninstall and status as well
   metro stop      stop metro on this machine, metro serve included
   metro tail [agent-id]
                   follow this machine's inbound events, one JSON line each

package/dist/hold.js

@@ -26,7 +26,7 @@ function sendJson(req, res, status, body) {
     });
     res.end(JSON.stringify(body));
 }
-export function holdRequest(req, res, info, onStart) {
+function holdRequest(req, res, info, onStart) {
     const path = (req.url ?? '').split('?')[0] ?? '';
     if (req.method === 'OPTIONS') {
         res.writeHead(204, corsHeaders(req)).end();
@@ -36,7 +36,6 @@ export function holdRequest(req, res, info, onStart) {
         sendJson(req, res, 200, {
             mode: 'local',
             owner: info.owner,
-            project: 'localdaemon',
             version: info.version,
             stopped: true,
         });

package/dist/runtime-install.js

@@ -4,8 +4,8 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { localStations } from './local.js';
 import { STORE_ENTRY, daemonEntry, findBun, runtimeDir } from './runtime.js';
-export const MANIFEST_FILE = 'stations.json';
-export const MARKETPLACE = 'marketplace';
+const MANIFEST_FILE = 'stations.json';
+const MARKETPLACE = 'marketplace';
 const METRO_SOURCES = join('node_modules', '@metro-labs');
 const INSTALL_TIMEOUT_MS = 15 * 60_000;
 export function runtimeStore() {
@@ -83,8 +83,7 @@ export function installDependencies(store, deps, bun, log) {
 export function prepareRuntime(opts = {}) {
     const sources = opts.sources ?? runtimeDir();
     const manifestPath = join(sources, MANIFEST_FILE);
-    if (!existsSync(manifestPath))
-        return { dir: sources, entry: daemonEntry(sources), trains: join(sources, 'trains'), manifest: null };
+    const manifest = readManifest(manifestPath);
     const store = opts.store ?? runtimeStore();
     const log = opts.log ??
         ((line) => {
@@ -92,6 +91,6 @@ export function prepareRuntime(opts = {}) {
         });
     mkdirSync(join(store, 'trains'), { recursive: true });
     syncSources(sources, store);
-    installDependencies(store, dependenciesFor(readManifest(manifestPath), localStations(opts.agents)), opts.bun ?? findBun(), log);
+    installDependencies(store, dependenciesFor(manifest, localStations(opts.agents)), opts.bun ?? findBun(), log);
     return { dir: store, entry: daemonEntry(store), trains: join(store, 'trains'), manifest: manifestPath };
 }

package/dist/runtime.js

@@ -4,10 +4,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const AGENT_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
 export const STORE_ENTRY = 'server.ts';
-export const PACKAGE_ENTRY = join('node_modules', '@metro-labs', 'daemon', 'src', 'server.ts');
-export const daemonEntry = (dir) => existsSync(join(dir, STORE_ENTRY))
-    ? join(dir, STORE_ENTRY)
-    : join(dir, PACKAGE_ENTRY);
+export const daemonEntry = (dir) => join(dir, STORE_ENTRY);
 export class MissingRuntime extends Error {
 }
 export function runtimeDir() {

package/dist/serve.js

@@ -72,7 +72,7 @@ export function requireOwner(args, dir = agentsDir()) {
         join(dir, '.owner') +
         ':\n  metro serve --owner <org_…>');
 }
-export function readOwner(dir = agentsDir()) {
+function readOwner(dir = agentsDir()) {
     try {
         const raw = readFileSync(join(dir, '.owner'), 'utf8').trim();
         return ORGANIZATION.test(raw) ? raw : null;
@@ -81,7 +81,7 @@ export function readOwner(dir = agentsDir()) {
         return null;
     }
 }
-export function holdInfo(port, owner, tailscaleBin) {
+function holdInfo(port, owner, tailscaleBin) {
     return {
         port,
         host: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
@@ -133,9 +133,8 @@ export function servePlan(opts) {
             METRO_WEBHOOK_PORT: String(opts.port),
             METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
             METRO_TRAINS_DIR: opts.runtime.trains,
-            ...(opts.runtime.manifest === null
-                ? {}
-                : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
+            METRO_RUNTIME_STORE: opts.runtime.dir,
+            METRO_RUNTIME_MANIFEST: opts.runtime.manifest,
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
             METRO_TUNNEL: 'tailscale',
             METRO_TAILSCALE_BIN: opts.tailscaleBin,

package/dist/service.js

@@ -3,12 +3,15 @@ import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, platform, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { serveLockedBy } from './control.js';
-import { findBun } from './runtime.js';
+import { findBun, runtimeDir } from './runtime.js';
 import { findTailscale, parseServeArgs, requireOwner } from './serve.js';
-const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] | uninstall | status';
+const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status';
 const SERVICE = 'metro';
 const LABEL = 'box.metro.serve';
 const CARRIED = /^(METRO_.*|XDG_CACHE_HOME|PATH|HOME)$/;
+const OWN_PATHS = new Set(['METRO_AGENTS_DIR', 'METRO_RUNTIME_STORE']);
+const METRO_USER = 'metro';
+const USER_FLAG = /^--user=(.*)$/;
 const PLAIN_WORD = /^[A-Za-z0-9_/.:=+@,-]+$/;
 const carriedEnv = (env) => Object.entries(env)
     .filter((entry) => CARRIED.test(entry[0]) && typeof entry[1] === 'string' && entry[1] !== '')
@@ -23,8 +26,7 @@ function unitWord(arg) {
         return escaped;
     return `"${escaped.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
 }
-export function systemdUnit(host, exec, target) {
-    const env = carriedEnv(host.env).map(([key, value]) => `Environment=${unitWord(`${key}=${value}`)}`);
+function unitText(service, target) {
     return [
         '[Unit]',
         'Description=Metro daemon (metro serve)',
@@ -32,25 +34,44 @@ export function systemdUnit(host, exec, target) {
         'Wants=network-online.target',
         '',
         '[Service]',
-        `ExecStart=${exec.map(unitWord).join(' ')}`,
-        'Restart=always',
-        'RestartSec=2',
-        'OOMPolicy=continue',
-        `WorkingDirectory=${unitWord(host.home)}`,
-        ...env,
+        ...service,
         '',
         '[Install]',
         `WantedBy=${target}`,
         '',
     ].join('\n');
 }
+const RESTART = ['Restart=always', 'RestartSec=2', 'OOMPolicy=continue'];
+function systemdUnit(host, exec, target) {
+    const env = carriedEnv(host.env).map(([key, value]) => `Environment=${unitWord(`${key}=${value}`)}`);
+    return unitText([`ExecStart=${exec.map(unitWord).join(' ')}`, ...RESTART, `WorkingDirectory=${unitWord(host.home)}`, ...env], target);
+}
+const npmPrefix = (home) => join(home, '.npm-global');
+function runAsUnit(host, runAs, serveArgs) {
+    const prefix = npmPrefix(runAs.home);
+    const exec = [host.node, join(prefix, 'lib', 'node_modules', '@stage-labs', 'metro', 'dist', 'cli.js'), 'serve', ...serveArgs];
+    const env = carriedEnv(host.env)
+        .filter(([key]) => key.startsWith('METRO_') && !OWN_PATHS.has(key))
+        .map(([key, value]) => `Environment=${unitWord(`${key}=${value}`)}`);
+    return unitText([
+        `User=${runAs.name}`,
+        `Group=${runAs.name}`,
+        `ExecStart=${exec.map(unitWord).join(' ')}`,
+        ...RESTART,
+        'WorkingDirectory=/',
+        `Environment=HOME=${unitWord(runAs.home)}`,
+        `Environment=${unitWord(`PATH=${prefix}/bin:/usr/local/bin:/usr/bin:/bin`)}`,
+        `Environment=${unitWord(`NPM_CONFIG_PREFIX=${prefix}`)}`,
+        ...env,
+    ], 'multi-user.target');
+}
 const xml = (text) => text
     .replaceAll('&', '&amp;')
     .replaceAll('<', '&lt;')
     .replaceAll('>', '&gt;')
     .replaceAll('"', '&quot;')
     .replaceAll("'", '&apos;');
-export function launchdPlist(host, exec, logFile) {
+function launchdPlist(host, exec, logFile) {
     const env = carriedEnv(host.env).map(([key, value]) => `    <key>${xml(key)}</key><string>${xml(value)}</string>`);
     return [
         '<?xml version="1.0" encoding="UTF-8"?>',
@@ -76,7 +97,9 @@ export function launchdPlist(host, exec, logFile) {
         '',
     ].join('\n');
 }
-function systemdPlan(host, exec) {
+const ROOT_HINT = `Metro running as root never starts Claude Code; install it as its own user:  metro service install --user ${METRO_USER}`;
+function systemdPlan(host, serveArgs, runAs) {
+    const exec = [host.node, host.cli, 'serve', ...serveArgs];
     const system = host.uid === 0;
     const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
     const file = system
@@ -85,14 +108,15 @@ function systemdPlan(host, exec) {
     return {
         kind: 'systemd',
         file,
-        content: systemdUnit(host, exec, system ? 'multi-user.target' : 'default.target'),
+        content: runAs === undefined ? systemdUnit(host, exec, system ? 'multi-user.target' : 'default.target') : runAsUnit(host, runAs, serveArgs),
         dirs: [],
-        install: [{ args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
+        install: [...(runAs === undefined ? [] : [{ args: ['bun', runAs.helper] }]), { args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
         uninstall: [{ args: [...ctl, 'disable', '--now', SERVICE], mayFail: true }],
         reload: [{ args: [...ctl, 'daemon-reload'], mayFail: true }],
         status: { args: [...ctl, 'is-active', SERVICE], mayFail: true },
         hints: [
             `Logs:  journalctl ${system ? '' : '--user '}-u ${SERVICE} -f`,
+            ...(system && runAs === undefined ? [ROOT_HINT] : []),
             ...(system
                 ? []
                 : [`A user service stops with your login session; keep it up without one:  loginctl enable-linger ${host.user}`]),
@@ -118,22 +142,52 @@ function launchdPlan(host, exec) {
         hints: [`Logs:  tail -f ${logFile}`],
     };
 }
-export function servicePlan(host, serveArgs) {
+export function servicePlan(host, serveArgs, runAs) {
     const exec = [host.node, host.cli, 'serve', ...serveArgs];
+    if (runAs !== undefined && (host.platform !== 'linux' || host.uid !== 0))
+        throw new Error('--user installs a system service for another user: run it as root on Linux');
     if (host.platform === 'linux')
-        return systemdPlan(host, exec);
+        return systemdPlan(host, serveArgs, runAs);
     if (host.platform === 'darwin')
         return launchdPlan(host, exec);
     throw new Error(`metro service supports Linux (systemd) and macOS (launchd), not ${host.platform}`);
 }
-function install(serveArgs, deps) {
+function splitUser(argv) {
+    const rest = [];
+    let user = null;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i] ?? '';
+        const inline = USER_FLAG.exec(arg);
+        if (inline === null && arg !== '--user') {
+            rest.push(arg);
+            continue;
+        }
+        user = inline?.[1] ?? argv[i + 1] ?? '';
+        if (inline === null)
+            i += 1;
+    }
+    return { user, rest };
+}
+function runAsOf(name, deps) {
+    if (name === null)
+        return undefined;
+    if (name !== METRO_USER)
+        throw new Error(`the root helper and its sudo rules are written for the user ${METRO_USER}; pass --user ${METRO_USER}, not '${name}'`);
+    const account = deps.account(name);
+    if (account === null)
+        throw new Error(`there is no user ${name} on this machine; create it first (useradd --system --create-home --home-dir /var/lib/${name} ${name})`);
+    return { ...account, helper: deps.helperEntry() };
+}
+function install(argv, deps) {
+    const { user, rest: serveArgs } = splitUser(argv);
     const args = parseServeArgs(serveArgs);
-    const plan = servicePlan(deps.host, serveArgs);
+    const runAs = runAsOf(user, deps);
+    const plan = servicePlan(deps.host, serveArgs, runAs);
     if (deps.exists(plan.file)) {
         deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}) and restarts on its own; metro service status says whether it is running. To change its arguments: metro service uninstall, then install again`);
         return 0;
     }
-    deps.preflight(args);
+    deps.preflight(args, runAs === undefined ? undefined : join(runAs.home, '.metro', 'agents'));
     const pid = deps.running();
     if (pid !== null)
         throw new Error(`a metro serve is running on this machine (pid ${String(pid)}). Stop it first (metro stop), then install: the service takes over from there`);
@@ -196,6 +250,11 @@ export function serviceStopHint(host = realHost(), exists = existsSync) {
         : `launchctl bootout gui/${String(host.uid)}/${LABEL}`;
     return `metro runs as a ${plan.kind} service here (${plan.file}), so it starts again on its own in a moment. To keep it stopped:  ${keep}`;
 }
+function lookupAccount(name) {
+    const run = spawnSync('getent', ['passwd', name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const home = run.status === 0 ? (run.stdout.trim().split(':')[5] ?? '') : '';
+    return home.startsWith('/') ? { name, home } : null;
+}
 function realDeps() {
     return {
         host: realHost(),
@@ -210,8 +269,10 @@ function realDeps() {
             return { status: code, output: `${result.stdout}${result.stderr}` };
         },
         running: serveLockedBy,
-        preflight: (args) => {
-            requireOwner(args);
+        account: lookupAccount,
+        helperEntry: () => join(runtimeDir(), 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts'),
+        preflight: (args, agents) => {
+            requireOwner(args, agents);
             findBun();
             findTailscale();
         },

package/dist/update.js

@@ -14,7 +14,7 @@ export const checkReport = (current, latest) => ({
     latest,
     newer: latest !== '' && isNewer(latest, current),
 });
-export async function updateCheck() {
+async function updateCheck() {
     return checkReport(currentVersion(), await publishedVersion());
 }
 export async function update(argv = []) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.201",
-  "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
+  "version": "0.1.0-beta.203",
+  "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {
     "type": "git",

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.201",
+  "version": "0.1.0-beta.203",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/marketplace/plugin/orchestrator.md

@@ -5,7 +5,7 @@ description: How this box's agent works on metro. Acknowledge, delegate, relay,
 
 You are the main thread of a Claude Code session that is connected to chat through metro, on a machine nobody watches. The main thread is an orchestrator: it may only delegate and talk. A guard in the metro plugin denies every other tool on this thread, so this is the shape of the work, not a preference.
 
-**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim.
+**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim. When the answer will take more than a few seconds, call `typing` on that `line` right after the 👀: metro keeps "typing…" showing until you send or reply there (or 2 minutes pass). Only WhatsApp and the Telegram bot support it; elsewhere skip it.
 
 **Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing, and every connector tool: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
 

package/runtime/node_modules/@metro-labs/core/src/events.ts

@@ -1,6 +1,8 @@
 import { Line } from './lines.js';
+import { errMsg, log } from './log.js';
 
-export { userSelf, daemonSelf } from './identity.js';
+export const userSelf = (): Line =>
+  (process.env.METRO_FROM ?? 'metro://user') as Line;
 
 export type StructuredEvent =
   | { type: 'msg' }
@@ -98,7 +100,7 @@ export function publishEvent(event: MetroEvent): void {
     try {
       fn(event, seq);
     } catch (err) {
-      console.error('[metro-bus] listener threw for busSeq', seq, err);
+      log.error({ busSeq: seq, err: errMsg(err) }, 'bus: a listener threw');
     }
   }
 }

package/runtime/node_modules/@metro-labs/core/src/lines.ts

@@ -11,15 +11,9 @@ function parseAccountScoped(
   validate?: (resource: string) => boolean,
 ): { accountId: string; resource: string } | null {
   const p = Line.parse(line);
-  if (p?.station !== station) return null;
-  let accountId: string, resource: string;
-  if (p.path.length === 2 && p.path[0] !== undefined && p.path[1] !== undefined) {
-    accountId = p.path[0];
-    resource = p.path[1];
-  } else if (p.path.length === 1 && p.path[0] !== undefined) {
-    accountId = 'default';
-    resource = p.path[0];
-  } else return null;
+  if (p?.station !== station || p.path.length !== 2) return null;
+  const [accountId, resource] = p.path;
+  if (accountId === undefined || resource === undefined) return null;
   if (validate && !validate(resource)) return null;
   return { accountId, resource };
 }
@@ -30,28 +24,21 @@ const isThreemaResource = (s: string): boolean =>
 const isOutlookResource = (s: string): boolean => /^[A-Za-z0-9=_%.@+-]+$/.test(s);
 const isSignedInt = (s: string): boolean => /^-?\d+$/.test(s);
 
-function splitTelegramAccount(path: string[]): { accountId: string; rest: string[] } {
-  const first = path[0];
-  if (path.length >= 2 && first !== undefined && !isSignedInt(first))
-    return { accountId: first, rest: path.slice(1) };
-  return { accountId: 'default', rest: path };
-}
+const topicPart = (topicId: string | undefined): { topicId?: number } | null => {
+  if (topicId === undefined) return {};
+  return isSnowflake(topicId) ? { topicId: Number(topicId) } : null;
+};
 
 function parseTelegramLine(
   line: Line | string,
 ): { accountId: string; chatId: number; topicId?: number } | null {
   const p = Line.parse(line);
   if (p?.station !== 'telegram-bot') return null;
-  const { accountId, rest } = splitTelegramAccount(p.path);
-  const [chatId, topicId] = rest;
-  if (rest.length < 1 || rest.length > 2 || chatId === undefined || !isSignedInt(chatId))
-    return null;
-  if (topicId !== undefined && !isSnowflake(topicId)) return null;
-  return {
-    accountId,
-    chatId: Number(chatId),
-    ...(topicId !== undefined ? { topicId: Number(topicId) } : {}),
-  };
+  const [accountId, chatId, topicId, ...extra] = p.path;
+  if (accountId === undefined || chatId === undefined || extra.length > 0) return null;
+  if (!isSignedInt(chatId)) return null;
+  const topic = topicPart(topicId);
+  return topic === null ? null : { accountId, chatId: Number(chatId), ...topic };
 }
 
 export const Line = {

package/runtime/node_modules/@metro-labs/core/src/stations/account-store.ts

@@ -1,13 +1,14 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { errMsg } from '../log.js';
 import { chmodIfExists } from '../secure-fs.js';
 
 export type Die = (msg: string) => never;
 
-export interface MakeLoaderOpts<T> {
+export interface AccountStoreOpts<T> {
   prefix: string;
-  file: string;
-  validate: (raw: T[], die: Die) => void;
+  validate?: (raw: T[], die: Die) => void;
 }
 
 export interface Loader<T> {
@@ -15,8 +16,40 @@ export interface Loader<T> {
   loadAccounts: () => T[];
 }
 
+const envName = (prefix: string): string =>
+  `${prefix.toUpperCase().replace(/-/g, '_')}_ACCOUNTS_FILE`;
+
+const accountsFile = (prefix: string): string =>
+  process.env[envName(prefix)] ?? join(homedir(), '.metro', `${prefix}-accounts.json`);
+
+function checkIds(raw: { id: string }[], die: Die): void {
+  const seen = new Set<string>();
+  for (const a of raw) {
+    if (!a.id) die('account missing id');
+    if (seen.has(a.id)) die(`duplicate account id '${a.id}'`);
+    seen.add(a.id);
+  }
+}
+
+function readList<T>(file: string, die: Die): T[] {
+  if (!existsSync(file))
+    return die(
+      `no accounts file ${file} — the daemon writes it from ~/.metro/agents/agent.json at boot; attach an account to this station from the page first`,
+    );
+  chmodIfExists(file);
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(file, 'utf8'));
+  } catch (e) {
+    return die(`bad ${file}: ${errMsg(e)}`);
+  }
+  if (!Array.isArray(raw) || raw.length === 0)
+    return die(`${file} must be a non-empty array`);
+  return raw as T[];
+}
+
 export function makeAccountStore<T extends { id: string }>(
-  opts: MakeLoaderOpts<T>,
+  opts: AccountStoreOpts<T>,
 ): Loader<T> {
   const die: Die = (msg) => {
     process.stderr.write(`${opts.prefix}: ${msg}\n`);
@@ -24,20 +57,9 @@ export function makeAccountStore<T extends { id: string }>(
   };
 
   function loadAccounts(): T[] {
-    if (!existsSync(opts.file))
-      return die(
-        `no accounts file ${opts.file} — the daemon writes it from ~/.metro/agents/agent.json at boot; attach an account to this station from the page first`,
-      );
-    chmodIfExists(opts.file);
-    let raw: T[];
-    try {
-      raw = JSON.parse(readFileSync(opts.file, 'utf8')) as T[];
-    } catch (e) {
-      return die(`bad ${opts.file}: ${errMsg(e)}`);
-    }
-    if (!Array.isArray(raw) || raw.length === 0)
-      die(`${opts.file} must be a non-empty array`);
-    opts.validate(raw, die);
+    const raw = readList<T>(accountsFile(opts.prefix), die);
+    checkIds(raw, die);
+    opts.validate?.(raw, die);
     return raw;
   }
 
@@ -49,12 +71,13 @@ export function resolveAccountId(
   args: { account?: string; line?: string },
   parseAccountId: (line: string) => string | undefined,
 ): string {
+  const have = [...accounts.keys()];
   let id = args.account;
   id ??= args.line ? parseAccountId(args.line) : undefined;
-  id ??= (accounts.size === 1 ? [...accounts.keys()][0] : 'default') ?? 'default';
+  id ??= have.length === 1 ? have[0] : undefined;
+  if (id === undefined)
+    throw new Error(`name an account (have: ${have.join(', ')})`);
   if (!accounts.has(id))
-    throw new Error(
-      `unknown account '${id}' (have: ${[...accounts.keys()].join(', ')})`,
-    );
+    throw new Error(`unknown account '${id}' (have: ${have.join(', ')})`);
   return id;
 }

package/runtime/node_modules/@metro-labs/core/src/stations/attachments.ts

@@ -190,7 +190,6 @@ export const toCanonical = (a: {
 }): Record<string, unknown> => ({
   kind: kindOf(a.mime, a.path),
   path: a.path,
-  url: a.path,
   name: a.name,
   mime: a.mime,
 });