@stage-labs/metro 0.1.0-beta.22 → 0.1.0-beta.221

package/dist/runtime-install.js

@@ -0,0 +1,96 @@
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { localStations } from './local.js';
+import { STORE_ENTRY, daemonEntry, findBun, runtimeDir } from './runtime.js';
+const MANIFEST_FILE = 'stations.json';
+const MARKETPLACE = 'marketplace';
+const METRO_SOURCES = join('node_modules', '@metro-labs');
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+export function runtimeStore() {
+    const env = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+    return env === '' ? join(homedir(), '.metro', 'runtime') : env;
+}
+const isRecord = (v) => typeof v === 'object' && v !== null;
+const ranges = (raw) => isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === 'string'))
+    : {};
+export function readManifest(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!isRecord(raw))
+        throw new Error(`${path} is not a runtime manifest`);
+    const stations = isRecord(raw.stations) ? raw.stations : {};
+    return {
+        core: ranges(raw.core),
+        stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+    };
+}
+export function dependenciesFor(manifest, stations) {
+    const out = { ...manifest.core };
+    for (const station of new Set(stations))
+        Object.assign(out, manifest.stations[station] ?? {});
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+const packageText = (deps) => `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+function readOrNull(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function copyMarketplace(sources, store) {
+    const staged = join(sources, MARKETPLACE);
+    if (!existsSync(staged))
+        return false;
+    cpSync(staged, join(store, MARKETPLACE), { recursive: true });
+    return true;
+}
+function syncSources(sources, store) {
+    const shim = join(sources, STORE_ENTRY);
+    if (existsSync(shim))
+        copyFileSync(shim, join(store, STORE_ENTRY));
+    const stamp = readOrNull(join(sources, 'runtime.json'));
+    if (stamp !== null && readOrNull(join(store, 'runtime.json')) === stamp)
+        return existsSync(join(store, MARKETPLACE)) ? false : copyMarketplace(sources, store);
+    rmSync(join(store, METRO_SOURCES), { recursive: true, force: true });
+    cpSync(join(sources, METRO_SOURCES), join(store, METRO_SOURCES), { recursive: true });
+    rmSync(join(store, MARKETPLACE), { recursive: true, force: true });
+    copyMarketplace(sources, store);
+    if (stamp !== null)
+        writeFileSync(join(store, 'runtime.json'), stamp);
+    return true;
+}
+export function installDependencies(store, deps, bun, log) {
+    const wanted = packageText(deps);
+    const marker = join(store, 'node_modules', '.metro-installed');
+    if (existsSync(marker) && readOrNull(join(store, 'package.json')) === wanted)
+        return false;
+    writeFileSync(join(store, 'package.json'), wanted);
+    log(`Installing the channel SDKs this machine needs into ${store}`);
+    const run = spawnSync(bun, ['install', '--no-summary', '--no-progress'], {
+        cwd: store,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        timeout: INSTALL_TIMEOUT_MS,
+    });
+    if (run.error !== undefined || run.status !== 0)
+        throw new Error(`bun install failed in ${store}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+    writeFileSync(marker, `${new Date().toISOString()}\n`);
+    return true;
+}
+export function prepareRuntime(opts = {}) {
+    const sources = opts.sources ?? runtimeDir();
+    const manifestPath = join(sources, MANIFEST_FILE);
+    const manifest = readManifest(manifestPath);
+    const store = opts.store ?? runtimeStore();
+    const log = opts.log ??
+        ((line) => {
+            process.stderr.write(`${line}\n`);
+        });
+    mkdirSync(join(store, 'trains'), { recursive: true });
+    syncSources(sources, store);
+    installDependencies(store, dependenciesFor(manifest, localStations(opts.agents)), opts.bun ?? findBun(), log);
+    return { dir: store, entry: daemonEntry(store), trains: join(store, 'trains'), manifest: manifestPath };
+}

package/dist/runtime.js

@@ -1,12 +1,10 @@
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { metroUrl } from './store.js';
 const AGENT_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
-const SERVER_ENTRY = join('node_modules', '@metro-labs', 'mcp', 'src', 'server.ts');
+export const STORE_ENTRY = 'server.ts';
+export const daemonEntry = (dir) => join(dir, STORE_ENTRY);
 export class MissingRuntime extends Error {
 }
 export function runtimeDir() {
@@ -14,11 +12,11 @@ export function runtimeDir() {
     const dir = explicit !== undefined && explicit !== ''
         ? explicit
         : join(dirname(dirname(fileURLToPath(import.meta.url))), 'runtime');
-    if (!existsSync(join(dir, SERVER_ENTRY)))
+    if (!existsSync(daemonEntry(dir)))
         throw new MissingRuntime(`no metro daemon at ${dir}. Reinstall with: npm i -g @stage-labs/metro@beta`);
     return dir;
 }
-export class MissingBun extends Error {
+class MissingBun extends Error {
 }
 export function assertAgentId(id) {
     if (id === undefined || !AGENT_RE.test(id))
@@ -28,54 +26,15 @@ export function assertAgentId(id) {
 export function findBun() {
     const found = spawnSync('bun', ['--version'], { stdio: 'ignore' });
     if (found.error !== undefined || found.status !== 0)
-        throw new MissingBun('metro start needs Bun, which is not on PATH.\n' +
+        throw new MissingBun('metro serve needs Bun, which is not on PATH.\n' +
             'Install it with:  curl -fsSL https://bun.sh/install | bash');
     return 'bun';
 }
-function tokenPath(agentId) {
-    const xdg = process.env.XDG_CONFIG_HOME?.trim();
-    const base = xdg === undefined || xdg === '' ? join(homedir(), '.config') : xdg;
-    return join(base, 'metro', `runtime-${agentId}.json`);
-}
-export function readRunToken(agentId) {
-    const fromEnv = process.env.METRO_RUN_TOKEN?.trim();
-    if (fromEnv !== undefined && fromEnv !== '')
-        return fromEnv;
-    try {
-        const parsed = JSON.parse(readFileSync(tokenPath(agentId), 'utf8'));
-        if (typeof parsed.token !== 'string' || parsed.token === '')
-            return null;
-        return parsed.url === metroUrl() ? parsed.token : null;
-    }
-    catch {
-        return null;
-    }
-}
-export function writeRunToken(agentId, token) {
-    const path = tokenPath(agentId);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, JSON.stringify({ token, url: metroUrl() }, null, 2));
-    chmodSync(path, 0o600);
-}
 export const localPort = () => Number(process.env.METRO_WEBHOOK_PORT) || 8420;
 export const localUrl = () => `http://127.0.0.1:${String(localPort())}`;
-export function daemonPlan(opts) {
-    return {
-        command: findBun(),
-        args: [SERVER_ENTRY],
-        cwd: opts.dir,
-        env: {
-            ...process.env,
-            METRO_RUN_TOKEN: opts.token,
-            METRO_AGENT: opts.agentId,
-            METRO_URL: metroUrl(),
-            METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
-            METRO_TRAINS_DIR: join(opts.dir, 'trains'),
-        },
-    };
-}
-export function runDaemon(agentId, plan) {
-    process.stderr.write(`Starting metro for ${agentId}\n`);
+export const RESTART_CODE = 75;
+export const HOLD_CODE = 76;
+function spawnOnce(plan) {
     const child = spawn(plan.command, plan.args, {
         cwd: plan.cwd,
         env: plan.env,
@@ -84,11 +43,29 @@ export function runDaemon(agentId, plan) {
     const relay = (sig) => () => {
         child.kill(sig);
     };
-    process.on('SIGINT', relay('SIGINT'));
-    process.on('SIGTERM', relay('SIGTERM'));
+    const onInt = relay('SIGINT');
+    const onTerm = relay('SIGTERM');
+    process.on('SIGINT', onInt);
+    process.on('SIGTERM', onTerm);
     return new Promise((resolve) => {
         child.on('exit', (code) => {
+            process.off('SIGINT', onInt);
+            process.off('SIGTERM', onTerm);
             resolve(code ?? 0);
         });
     });
 }
+export async function spawnPlan(plan, hold) {
+    for (;;) {
+        const code = await spawnOnce(plan());
+        if (code === RESTART_CODE) {
+            process.stderr.write('metro was updated; restarting the daemon on the new version\n');
+            continue;
+        }
+        if (code !== HOLD_CODE || hold === undefined)
+            return code;
+        if ((await hold()) === 'exit')
+            return 0;
+        process.stderr.write('starting the daemon again\n');
+    }
+}

package/dist/serve.js

@@ -0,0 +1,157 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentsDir } from './local.js';
+import { currentVersion } from './version.js';
+import { serveLockedBy, serveStateDir } from './control.js';
+import { findBun, localPort, spawnPlan } from './runtime.js';
+import { prepareRuntime } from './runtime-install.js';
+import { ensureNodeName } from './node-name.js';
+import { holdUntilStart } from './hold.js';
+const SCRUBBED = new Set(['DATABASE_URL']);
+const PORT_FLAG = /^--port=(.*)$/;
+const OWNER_FLAG = /^--owner=(.*)$/;
+const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
+const USAGE = 'usage: metro serve [--port <n>] [--owner <organization id>]';
+const TUNNEL_FLAG = /^--(no-)?tunnel(=.*)?$/;
+const TAILSCALE_APP = '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
+function portOf(raw) {
+    const n = Number(raw);
+    if (raw === undefined || raw === '' || !Number.isInteger(n) || n < 1 || n > 65535)
+        throw new Error(`'${raw ?? ''}' is not a port — ${USAGE}`);
+    return n;
+}
+const ORGANIZATION = /^org_[A-Za-z0-9]{10,64}$/;
+function ownerOf(raw) {
+    if (raw !== undefined && ORGANIZATION.test(raw))
+        return { owner: raw };
+    if (raw !== undefined && ADDRESS.test(raw))
+        return { owner: null, ignoredOwner: raw };
+    throw new Error(`'${raw ?? ''}' is not an organization id (org_…) — ${USAGE}`);
+}
+export function parseServeArgs(argv) {
+    let port = localPort();
+    let owner = { owner: null };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i] ?? '';
+        if (TUNNEL_FLAG.test(arg))
+            throw new Error('--tunnel is gone: metro serve always publishes through Tailscale Funnel — ' + USAGE);
+        const inlineOwner = OWNER_FLAG.exec(arg);
+        if (inlineOwner) {
+            owner = ownerOf(inlineOwner[1]);
+            continue;
+        }
+        if (arg === '--owner') {
+            owner = ownerOf(argv[i + 1]);
+            i += 1;
+            continue;
+        }
+        const inline = PORT_FLAG.exec(arg);
+        if (inline) {
+            port = portOf(inline[1]);
+            continue;
+        }
+        if (arg === '--port' || arg === '-p') {
+            port = portOf(argv[i + 1]);
+            i += 1;
+            continue;
+        }
+        throw new Error(`unknown argument '${arg}' — ${USAGE}`);
+    }
+    return { port, ...owner };
+}
+export function requireOwner(args, dir = agentsDir()) {
+    if (args.ignoredOwner !== undefined) {
+        process.stderr.write(`--owner ${args.ignoredOwner} is a wallet address, which metro ignores: the organization id in ${join(dir, '.owner')} decides who signs in\n`);
+        return;
+    }
+    if (args.owner !== null || existsSync(join(dir, '.owner')))
+        return;
+    throw new Error('no owner is set for this machine, so nobody could sign in.\n' +
+        'Pass the organization that owns it once; it is remembered in ' +
+        join(dir, '.owner') +
+        ':\n  metro serve --owner <org_…>');
+}
+function readOwner(dir = agentsDir()) {
+    try {
+        const raw = readFileSync(join(dir, '.owner'), 'utf8').trim();
+        return ORGANIZATION.test(raw) ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+function holdInfo(port, owner, tailscaleBin) {
+    return {
+        port,
+        host: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
+        owner: owner ?? readOwner(),
+        version: currentVersion(),
+        funnel: tailscaleBin,
+        lockFile: join(process.env.METRO_STATE_DIR ?? serveStateDir(), '.tail-lock'),
+    };
+}
+function tailscaleStatus(bin) {
+    const run = spawnSync(bin, ['status', '--json'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    if (run.error !== undefined || run.status !== 0)
+        return { ok: false, state: 'not running' };
+    try {
+        const parsed = JSON.parse(run.stdout);
+        if (parsed.BackendState !== 'Running')
+            return { ok: false, state: String(parsed.BackendState) };
+        if (parsed.Self?.Online === false)
+            return { ok: false, state: 'Running, but not connected to the tailnet: the machine may have been removed from it' };
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, state: 'unreadable' };
+    }
+}
+export function findTailscale(candidates = ['tailscale', TAILSCALE_APP]) {
+    const bin = candidates.find((c) => spawnSync(c, ['version'], { stdio: 'ignore' }).status === 0);
+    if (bin === undefined)
+        throw new Error('metro serve needs Tailscale on this machine: the daemon is published through Tailscale Funnel.\n' +
+            'macOS:  brew install --cask tailscale   (or the App Store app)\n' +
+            'Linux:  curl -fsSL https://tailscale.com/install.sh | sh\n' +
+            'Then sign the machine in:  tailscale up');
+    const status = tailscaleStatus(bin);
+    if (!status.ok)
+        throw new Error(`Tailscale is installed but this machine is not connected (${status.state}). Sign it in first:  tailscale up\n` +
+            'Funnel also has to be enabled once on your tailnet: https://tailscale.com/kb/1223/funnel');
+    return bin;
+}
+export function servePlan(opts) {
+    const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !SCRUBBED.has(key)));
+    return {
+        command: findBun(),
+        args: [opts.runtime.entry],
+        cwd: opts.runtime.dir,
+        env: {
+            ...env,
+            METRO_VERSION: currentVersion(),
+            METRO_CLI_BIN: process.argv[1] ?? '',
+            METRO_WEBHOOK_PORT: String(opts.port),
+            METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
+            METRO_TRAINS_DIR: opts.runtime.trains,
+            METRO_RUNTIME_STORE: opts.runtime.dir,
+            METRO_RUNTIME_MANIFEST: opts.runtime.manifest,
+            METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
+            METRO_TUNNEL: 'tailscale',
+            METRO_TAILSCALE_BIN: opts.tailscaleBin,
+            ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
+        },
+    };
+}
+export function serve(argv) {
+    const args = parseServeArgs(argv);
+    const { port, owner } = args;
+    const running = serveLockedBy();
+    if (running !== null)
+        throw new Error(`a metro serve daemon is already running on this machine (pid ${String(running)}). ` +
+            'Stop it first: metro stop');
+    requireOwner(args);
+    const tailscaleBin = findTailscale();
+    const node = ensureNodeName(tailscaleBin);
+    process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}, published as ${node} on your tailnet\n`);
+    return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, owner, tailscaleBin }), () => holdUntilStart(holdInfo(port, owner, tailscaleBin)));
+}

package/dist/service.js

@@ -0,0 +1,304 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir, platform, userInfo } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { serveLockedBy } from './control.js';
+import { findBun, runtimeDir } from './runtime.js';
+import { findTailscale, parseServeArgs, requireOwner } from './serve.js';
+const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status';
+const SERVICE = 'metro';
+const LABEL = 'box.metro.serve';
+const CARRIED = /^(METRO_.*|XDG_CACHE_HOME|PATH|HOME)$/;
+const OWN_PATHS = new Set(['METRO_AGENTS_DIR', 'METRO_RUNTIME_STORE']);
+const METRO_USER = 'metro';
+const USER_FLAG = /^--user=(.*)$/;
+const PLAIN_WORD = /^[A-Za-z0-9_/.:=+@,-]+$/;
+const carriedEnv = (env) => Object.entries(env)
+    .filter((entry) => CARRIED.test(entry[0]) && typeof entry[1] === 'string' && entry[1] !== '')
+    .sort(([a], [b]) => a.localeCompare(b));
+const cacheDir = (host) => {
+    const xdg = host.env.XDG_CACHE_HOME?.trim();
+    return xdg === undefined || xdg === '' ? join(host.home, '.cache') : xdg;
+};
+function unitWord(arg) {
+    const escaped = arg.replaceAll('%', '%%');
+    if (PLAIN_WORD.test(arg))
+        return escaped;
+    return `"${escaped.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+}
+function unitText(service, target) {
+    return [
+        '[Unit]',
+        'Description=Metro daemon (metro serve)',
+        'After=network-online.target tailscaled.service',
+        'Wants=network-online.target',
+        '',
+        '[Service]',
+        ...service,
+        '',
+        '[Install]',
+        `WantedBy=${target}`,
+        '',
+    ].join('\n');
+}
+const RESTART = ['Restart=always', 'RestartSec=2', 'OOMPolicy=continue'];
+function systemdUnit(host, exec, target) {
+    const env = carriedEnv(host.env).map(([key, value]) => `Environment=${unitWord(`${key}=${value}`)}`);
+    return unitText([`ExecStart=${exec.map(unitWord).join(' ')}`, ...RESTART, `WorkingDirectory=${unitWord(host.home)}`, ...env], target);
+}
+const npmPrefix = (home) => join(home, '.npm-global');
+function runAsUnit(host, runAs, serveArgs) {
+    const prefix = npmPrefix(runAs.home);
+    const exec = [host.node, join(prefix, 'lib', 'node_modules', '@stage-labs', 'metro', 'dist', 'cli.js'), 'serve', ...serveArgs];
+    const env = carriedEnv(host.env)
+        .filter(([key]) => key.startsWith('METRO_') && !OWN_PATHS.has(key))
+        .map(([key, value]) => `Environment=${unitWord(`${key}=${value}`)}`);
+    return unitText([
+        `User=${runAs.name}`,
+        `Group=${runAs.name}`,
+        `ExecStart=${exec.map(unitWord).join(' ')}`,
+        ...RESTART,
+        'WorkingDirectory=/',
+        `Environment=HOME=${unitWord(runAs.home)}`,
+        `Environment=${unitWord(`PATH=${prefix}/bin:/usr/local/bin:/usr/bin:/bin`)}`,
+        `Environment=${unitWord(`NPM_CONFIG_PREFIX=${prefix}`)}`,
+        ...env,
+    ], 'multi-user.target');
+}
+const xml = (text) => text
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&apos;');
+function launchdPlist(host, exec, logFile) {
+    const env = carriedEnv(host.env).map(([key, value]) => `    <key>${xml(key)}</key><string>${xml(value)}</string>`);
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        '<dict>',
+        `  <key>Label</key><string>${LABEL}</string>`,
+        '  <key>ProgramArguments</key>',
+        '  <array>',
+        ...exec.map((arg) => `    <string>${xml(arg)}</string>`),
+        '  </array>',
+        '  <key>EnvironmentVariables</key>',
+        '  <dict>',
+        ...env,
+        '  </dict>',
+        `  <key>WorkingDirectory</key><string>${xml(host.home)}</string>`,
+        '  <key>RunAtLoad</key><true/>',
+        '  <key>KeepAlive</key><true/>',
+        `  <key>StandardOutPath</key><string>${xml(logFile)}</string>`,
+        `  <key>StandardErrorPath</key><string>${xml(logFile)}</string>`,
+        '</dict>',
+        '</plist>',
+        '',
+    ].join('\n');
+}
+const ROOT_HINT = `Metro running as root never starts Claude Code; install it as its own user:  metro service install --user ${METRO_USER}`;
+function systemdPlan(host, serveArgs, runAs) {
+    const exec = [host.node, host.cli, 'serve', ...serveArgs];
+    const system = host.uid === 0;
+    const ctl = system ? ['systemctl'] : ['systemctl', '--user'];
+    const file = system
+        ? `/etc/systemd/system/${SERVICE}.service`
+        : join(host.home, '.config', 'systemd', 'user', `${SERVICE}.service`);
+    return {
+        kind: 'systemd',
+        file,
+        content: runAs === undefined ? systemdUnit(host, exec, system ? 'multi-user.target' : 'default.target') : runAsUnit(host, runAs, serveArgs),
+        dirs: [],
+        install: [...(runAs === undefined ? [] : [{ args: ['bun', runAs.helper] }]), { args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
+        uninstall: [{ args: [...ctl, 'disable', '--now', SERVICE], mayFail: true }],
+        reload: [{ args: [...ctl, 'daemon-reload'], mayFail: true }],
+        status: { args: [...ctl, 'is-active', SERVICE], mayFail: true },
+        hints: [
+            `Logs:  journalctl ${system ? '' : '--user '}-u ${SERVICE} -f`,
+            ...(system && runAs === undefined ? [ROOT_HINT] : []),
+            ...(system
+                ? []
+                : [`A user service stops with your login session; keep it up without one:  loginctl enable-linger ${host.user}`]),
+        ],
+    };
+}
+function launchdPlan(host, exec) {
+    const file = join(host.home, 'Library', 'LaunchAgents', `${LABEL}.plist`);
+    const domain = `gui/${String(host.uid)}`;
+    const logFile = join(cacheDir(host), 'metro', 'serve', 'service.log');
+    return {
+        kind: 'launchd',
+        file,
+        content: launchdPlist(host, exec, logFile),
+        dirs: [dirname(logFile)],
+        install: [
+            { args: ['launchctl', 'bootout', `${domain}/${LABEL}`], mayFail: true },
+            { args: ['launchctl', 'bootstrap', domain, file] },
+        ],
+        uninstall: [{ args: ['launchctl', 'bootout', `${domain}/${LABEL}`], mayFail: true }],
+        reload: [],
+        status: { args: ['launchctl', 'print', `${domain}/${LABEL}`], mayFail: true },
+        hints: [`Logs:  tail -f ${logFile}`],
+    };
+}
+export function servicePlan(host, serveArgs, runAs) {
+    const exec = [host.node, host.cli, 'serve', ...serveArgs];
+    if (runAs !== undefined && (host.platform !== 'linux' || host.uid !== 0))
+        throw new Error('--user installs a system service for another user: run it as root on Linux');
+    if (host.platform === 'linux')
+        return systemdPlan(host, serveArgs, runAs);
+    if (host.platform === 'darwin')
+        return launchdPlan(host, exec);
+    throw new Error(`metro service supports Linux (systemd) and macOS (launchd), not ${host.platform}`);
+}
+function splitUser(argv) {
+    const rest = [];
+    let user = null;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i] ?? '';
+        const inline = USER_FLAG.exec(arg);
+        if (inline === null && arg !== '--user') {
+            rest.push(arg);
+            continue;
+        }
+        user = inline?.[1] ?? argv[i + 1] ?? '';
+        if (inline === null)
+            i += 1;
+    }
+    return { user, rest };
+}
+function runAsOf(name, deps) {
+    if (name === null)
+        return undefined;
+    if (name !== METRO_USER)
+        throw new Error(`the root helper and its sudo rules are written for the user ${METRO_USER}; pass --user ${METRO_USER}, not '${name}'`);
+    const account = deps.account(name);
+    if (account === null)
+        throw new Error(`there is no user ${name} on this machine; create it first (useradd --system --create-home --home-dir /var/lib/${name} ${name})`);
+    return { ...account, helper: deps.helperEntry() };
+}
+function install(argv, deps) {
+    const { user, rest: serveArgs } = splitUser(argv);
+    const args = parseServeArgs(serveArgs);
+    const runAs = runAsOf(user, deps);
+    const plan = servicePlan(deps.host, serveArgs, runAs);
+    if (deps.exists(plan.file)) {
+        deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}) and restarts on its own; metro service status says whether it is running. To change its arguments: metro service uninstall, then install again`);
+        return 0;
+    }
+    deps.preflight(args, runAs === undefined ? undefined : join(runAs.home, '.metro', 'agents'));
+    const pid = deps.running();
+    if (pid !== null)
+        throw new Error(`a metro serve is running on this machine (pid ${String(pid)}). Stop it first (metro stop), then install: the service takes over from there`);
+    for (const dir of plan.dirs)
+        deps.mkdir(dir);
+    deps.write(plan.file, plan.content);
+    for (const command of plan.install)
+        deps.run(command);
+    deps.out(`Installed ${plan.file}: metro serve now starts at boot and after a crash, and the Server page on metro.box can stop, start and restart it.`);
+    for (const hint of plan.hints)
+        deps.out(hint);
+    return 0;
+}
+function uninstall(deps) {
+    const plan = servicePlan(deps.host, []);
+    if (!deps.exists(plan.file)) {
+        deps.out('metro is not installed as a service on this machine');
+        return 1;
+    }
+    for (const command of plan.uninstall)
+        deps.run(command);
+    deps.remove(plan.file);
+    for (const command of plan.reload)
+        deps.run(command);
+    deps.out(`Removed ${plan.file}; a running daemon was stopped, and metro serve no longer starts on its own`);
+    return 0;
+}
+function status(deps) {
+    const plan = servicePlan(deps.host, []);
+    if (!deps.exists(plan.file)) {
+        deps.out(`not installed (metro service install writes ${plan.file})`);
+        return 1;
+    }
+    const active = deps.run(plan.status).status === 0;
+    deps.out(active
+        ? `running as a ${plan.kind} service (${plan.file})`
+        : `installed as a ${plan.kind} service (${plan.file}), not running`);
+    return active ? 0 : 1;
+}
+function realHost() {
+    const who = userInfo();
+    return {
+        platform: platform(),
+        uid: who.uid,
+        user: who.username,
+        home: homedir(),
+        node: process.execPath,
+        cli: resolve(process.argv[1] ?? ''),
+        env: process.env,
+    };
+}
+export function serviceStopHint(host = realHost(), exists = existsSync) {
+    if (host.platform !== 'linux' && host.platform !== 'darwin')
+        return null;
+    const plan = servicePlan(host, []);
+    if (!exists(plan.file))
+        return null;
+    const keep = plan.kind === 'systemd'
+        ? `systemctl ${host.uid === 0 ? '' : '--user '}stop ${SERVICE}`
+        : `launchctl bootout gui/${String(host.uid)}/${LABEL}`;
+    return `metro runs as a ${plan.kind} service here (${plan.file}), so it starts again on its own in a moment. To keep it stopped:  ${keep}`;
+}
+function lookupAccount(name) {
+    const run = spawnSync('getent', ['passwd', name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const home = run.status === 0 ? (run.stdout.trim().split(':')[5] ?? '') : '';
+    return home.startsWith('/') ? { name, home } : null;
+}
+function realDeps() {
+    return {
+        host: realHost(),
+        run: (command) => {
+            const [bin = '', ...args] = command.args;
+            const result = spawnSync(bin, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+            const code = result.status ?? 1;
+            if (code !== 0 && command.mayFail !== true) {
+                const said = [result.stderr, result.stdout, result.error?.message].find((t) => typeof t === 'string' && t.trim() !== '') ?? '';
+                throw new Error(`${command.args.join(' ')} failed (exit ${String(code)}): ${said.trim()}`);
+            }
+            return { status: code, output: `${result.stdout}${result.stderr}` };
+        },
+        running: serveLockedBy,
+        account: lookupAccount,
+        helperEntry: () => join(runtimeDir(), 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts'),
+        preflight: (args, agents) => {
+            requireOwner(args, agents);
+            findBun();
+            findTailscale();
+        },
+        mkdir: (dir) => {
+            mkdirSync(dir, { recursive: true });
+        },
+        write: (file, content) => {
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(file, content, { mode: 0o644 });
+        },
+        remove: (file) => {
+            rmSync(file, { force: true });
+        },
+        exists: existsSync,
+        out: (line) => {
+            process.stderr.write(`${line}\n`);
+        },
+    };
+}
+export function service(argv, deps = realDeps()) {
+    const [verb, ...rest] = argv;
+    if (verb === 'install')
+        return Promise.resolve(install(rest, deps));
+    if (verb === 'uninstall' && rest.length === 0)
+        return Promise.resolve(uninstall(deps));
+    if (verb === 'status' && rest.length === 0)
+        return Promise.resolve(status(deps));
+    throw new Error(USAGE);
+}