@stage-labs/metro 0.1.0-beta.24 → 0.1.0-beta.241

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/mcp/tool-schemas.ts

@@ -1,3 +1,6 @@
+import type { ToolDef } from './tool-def.js';
+import { attachmentItem, CREATE_UPLOAD_TOOL } from './attachment-schema.js';
+
 const lineProp = {
   type: 'string',
   description:
@@ -8,98 +11,10 @@ const msgIdProp = {
   description: 'The target message_id.',
 } as const;
 
-const attachmentItem = {
-  type: 'object',
-  description:
-    'A file to attach. Provide EXACTLY ONE source; naming two is an error and so is naming ' +
-    'none. Which one to use: `upload` for any real file on your own machine, including a ' +
-    'confidential one (call `create_upload` first, push the bytes over HTTP, then name the ' +
-    'id here); `data` ONLY for a tiny file, a few KB at most, because the base64 has to be ' +
-    'written out verbatim in this tool call and long base64 gets corrupted in the writing; ' +
-    '`url` when the file is ALREADY published somewhere the daemon can fetch it; `path` ONLY ' +
-    'for a file that is already sitting on the daemon host, which is almost never your ' +
-    'machine.',
-  properties: {
-    upload: {
-      type: 'string',
-      description:
-        'The `upload_id` of a file already pushed to metro over HTTP (`create_upload` mints ' +
-        'the slot and the one-line command; the bytes never pass through this conversation). ' +
-        'THIS IS THE ROUTE FOR ANYTHING REAL: it takes files up to 64 MiB, works for a file on ' +
-        'your own machine, and publishes nothing. The upload belongs to your agent, expires ' +
-        '30 minutes after it is created, and no other agent can name it.',
-    },
-    data: {
-      type: 'string',
-      description:
-        'Base64-encoded file bytes, inline in this call. ONLY FOR TINY FILES. The hard cap is ' +
-        '8 MiB decoded, but the real ceiling is far lower and is not enforced by the daemon: ' +
-        'this base64 has to be emitted verbatim as part of the tool call, and past roughly ' +
-        '10 KB (~13 KB of base64) it comes out corrupted, so the file arrives silently ' +
-        'damaged or fails to decode. Use `upload` instead for anything bigger. A ' +
-        '`data:<mime>;base64,` prefix is accepted and supplies the mime when `mime` is ' +
-        'omitted. Stations impose their own, lower limits (xmtp refuses non-image files over ' +
-        '~190 KiB).',
-    },
-    url: {
-      type: 'string',
-      description:
-        'http(s) URL fetched BY THE DAEMON, so it must already be publicly reachable from the ' +
-        'daemon host. Right when the file is already published; never for anything ' +
-        'confidential, because it has to be public for this to work at all. Use `upload` for ' +
-        'a confidential file.',
-    },
-    path: {
-      type: 'string',
-      description:
-        'Absolute path resolved ON THE DAEMON HOST, which is a different machine from yours. ' +
-        'A path on your own disk does NOT resolve here and is refused, however local it ' +
-        'looks. Use `upload` for a file on your machine.',
-    },
-    mime: {
-      type: 'string',
-      description: 'MIME type (guessed from the name/extension if omitted).',
-    },
-    name: {
-      type: 'string',
-      description:
-        'Filename to present (defaults to the basename, or to the name given at upload time).',
-    },
-  },
-} as const;
-
-const CREATE_UPLOAD_TOOL = {
-  name: 'create_upload',
-  description:
-    'Reserve a slot to push a file to metro over HTTP so you can attach it with `send`. Use ' +
-    'this for any file that actually matters: it is the only attachment route that carries a ' +
-    'file from YOUR machine without publishing it and without the bytes passing through this ' +
-    'conversation. Args: name? (the filename to present), mime?. Returns `upload_id`, a ' +
-    'single-use `upload_url` and a ready-to-run `curl` line. ONE STEP NEEDS A SHELL: run that ' +
-    'command (or any HTTP client) to push the bytes; there is no way to move a local file to ' +
-    'the daemon over MCP alone, because anything in an MCP call has to be written out by the ' +
-    'model first. If you have no shell, hand the single command to a subagent that does and ' +
-    'keep the `upload_id` -- the slot belongs to this metro agent, not to whoever runs the ' +
-    'command. Then: send({line, attachments:[{upload:"<upload_id>"}]}). Up to 64 MiB, expires ' +
-    '30 minutes after it is created, and no other agent can reference it.',
-  inputSchema: {
-    type: 'object',
-    properties: {
-      name: {
-        type: 'string',
-        description: 'Filename to present to the recipient (e.g. `report.pdf`).',
-      },
-      mime: {
-        type: 'string',
-        description: 'MIME type (guessed from the name/extension if omitted).',
-      },
-    },
-  },
-};
-
-export const COMMON_TOOLS = [
+export const COMMON_TOOLS: ToolDef[] = [
   {
     name: 'reply',
+    group: 'write',
     description:
       'Reply to a specific message in a Metro conversation (text quotes the target). Args: ' +
       "line, message_id, text. The station is derived from the line. Returns the daemon's " +
@@ -116,15 +31,19 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'send',
+    group: 'write',
     description:
       'Send a message (and/or media) to a Metro conversation. Args: line, text?, reply_to?, ' +
-      'attachments?. The station is derived from the line. Each attachment names EXACTLY ONE ' +
+      'subject?, attachments?, frame?. The station is derived from the line. Outlook and Gmail: send to ' +
+      'metro://<outlook|gmail>/<account>/<email address> to start a new email (subject defaults to the ' +
+      'first line of text); the result names the new thread line. Each attachment names EXACTLY ONE ' +
       'source, and the choice matters: `upload` (an `upload_id` from `create_upload`, the ' +
       'route for any real file on your own machine, confidential or not, up to 64 MiB); ' +
       '`data` (base64 inline -- TINY FILES ONLY, a few KB, because the base64 has to be ' +
       'written out verbatim in the call and longer than that it corrupts); `url` (the daemon ' +
       'fetches it, so the file must already be public); `path` (resolved on the DAEMON host, ' +
-      'which is not your machine). At least one of text/attachments is required. ' +
+      'which is not your machine). Stage (XMTP) only: `frame` posts an interactive view. At least one ' +
+      'of text/attachments/frame is required. ' +
       'The success line names each attachment the station actually delivered; a station that ' +
       'cannot carry a file errors instead of reporting success.',
     inputSchema: {
@@ -139,17 +58,53 @@ export const COMMON_TOOLS = [
           type: 'string',
           description: 'Optional message_id to quote/reply to.',
         },
+        subject: {
+          type: 'string',
+          description: 'Outlook and Gmail only: the subject of a new email.',
+        },
         attachments: {
           type: 'array',
           description: 'Optional files to attach.',
           items: attachmentItem,
         },
+        frame: {
+          type: 'object',
+          description:
+            'Stage (XMTP) only: a frame, a small interactive view that Stage shows as a card (title and ' +
+            'description) and opens full screen. `widget` is OpenAI ChatKit widget JSON (a Card, ListView ' +
+            'or Basic root, 64K characters at most); a missing `title` or `description` is taken from the ' +
+            'widget. Or give `screens` instead of `widget` for several screens in one frame. A tap comes back ' +
+            'to you as a reply to the frame: "Frame action: <type> <payload ' +
+            "JSON>\". It is sent after the text, and the message_id returned is the frame's. The stage " +
+            'skill lists the widget nodes, with an example.',
+          properties: {
+            widget: {
+              type: 'object',
+              description:
+                'ChatKit widget JSON, e.g. {"type":"Card","children":[{"type":"Title","value":"Deploy?"},' +
+                '{"type":"Button","label":"Ship it","onClickAction":{"type":"deploy","payload":{"env":"prod"}}}]}.',
+              additionalProperties: true,
+            },
+            screens: {
+              type: 'object',
+              description:
+                'Instead of `widget`: up to 50 screens by id, each a widget or {"title", "widget"}, 64K ' +
+                'characters in all. An action {"type":"frame.open","payload":{"screen":"<id>"}} opens a ' +
+                'screen and {"type":"frame.back"} goes back, in Stage, with no message to you.',
+              additionalProperties: true,
+            },
+            start: { type: 'string', description: 'Required with `screens`: the id of the first screen.' },
+            title: { type: 'string', description: 'Card title in the chat (200 characters at most).' },
+            description: { type: 'string', description: 'Card description in the chat (1000 characters at most).' },
+          },
+        },
       },
       required: ['line'],
     },
   },
   {
     name: 'react',
+    group: 'write',
     description:
       'Add an emoji reaction to a message. Args: line, message_id, emoji. The station is derived from the line.',
     inputSchema: {
@@ -162,8 +117,22 @@ export const COMMON_TOOLS = [
       required: ['line', 'message_id', 'emoji'],
     },
   },
+  {
+    name: 'typing',
+    group: 'write',
+    description:
+      'Show "typing…" once in a chat while you prepare an answer. The network clears it by itself after its own time (about 5 s on the Telegram bot, 10 s on Discord, 25 s on WhatsApp) or when you send. Call it again to show it again. Args: line.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        line: lineProp,
+      },
+      required: ['line'],
+    },
+  },
   {
     name: 'unreact',
+    group: 'write',
     description:
       'Remove an emoji reaction from a message. Args: line, message_id, emoji. The station is derived from the line.',
     inputSchema: {
@@ -181,6 +150,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'edit',
+    group: 'write',
     description:
       'Edit the text of a message you sent. Args: line, message_id, text. The station is ' +
       "derived from the line. Returns the daemon's reason if the station does not support edits.",
@@ -196,6 +166,8 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'delete',
+    group: 'write',
+    destructive: true,
     description:
       'Delete a message you sent. Args: line, message_id. The station is derived from the line. ' +
       "Returns the daemon's reason if the station does not support deletes.",
@@ -207,14 +179,28 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'read',
+    group: 'read',
     description:
-      'Read recent message history for a conversation. Args: line, limit?, before?, since?. The ' +
-      'station is derived from the line. Returns the raw history JSON (shapes differ per ' +
-      "station), or the daemon's reason if the station does not support reads.",
+      'Read message history. Args: line?, account?, limit?, before?, since?, until?, query?, ' +
+      'from?, unread_only?, message_id?. Give a line to read one conversation, or an account ' +
+      '(from list_accounts) instead of a line to read across that whole account, where the ' +
+      'station allows it. `message_id` returns that one message in full, with its files saved ' +
+      'like inbound media (url and local_path). Each station applies the filters it supports; ' +
+      'the answer lists any it did not apply in `ignored`, so check it. Returns the raw JSON ' +
+      "(shapes differ per station), or the daemon's reason if the station does not support " +
+      'reads. Outlook: `query` is a Microsoft search over all mail (with `from` folded into it; ' +
+      'line, since, until and unread_only then narrow what the search found), and without ' +
+      '`query` every filter is applied by Outlook itself, newest first. Gmail: `query` uses ' +
+      'Gmail search syntax (from:, subject:, has:attachment, newer_than:7d...), and the other ' +
+      'filters are added to it.',
     inputSchema: {
       type: 'object',
       properties: {
         line: lineProp,
+        account: {
+          type: 'string',
+          description: 'An account id from list_accounts, to read the whole account when you give no line.',
+        },
         limit: { type: 'number', description: 'Max messages to return.' },
         before: {
           type: 'string',
@@ -224,12 +210,20 @@ export const COMMON_TOOLS = [
           type: 'string',
           description: 'Return messages since this timestamp.',
         },
+        until: {
+          type: 'string',
+          description: 'Return messages before this timestamp.',
+        },
+        query: { type: 'string', description: 'Free text to search for.' },
+        from: { type: 'string', description: 'Only messages from this sender (an id or an address).' },
+        unread_only: { type: 'boolean', description: 'Only messages not read yet.' },
+        message_id: { type: 'string', description: 'Return this one message in full.' },
       },
-      required: ['line'],
     },
   },
   {
     name: 'list_members',
+    group: 'read',
     description:
       'List the members of a Metro group/channel in a station-agnostic shape. Args: line, ' +
       'limit?. The station is derived from the line. Returns {line, station, memberCount, ' +
@@ -253,6 +247,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'create_group',
+    group: 'write',
     description:
       'Create a new group/channel on a station and add members, in a station-agnostic shape. ' +
       'Args: station (required, xmtp|telegram|discord-bot|telegram-bot), name (required), members? ' +
@@ -292,6 +287,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'add_members',
+    group: 'write',
     description:
       'Add members to an existing Metro group, in a station-agnostic shape. Args: line ' +
       '(required), members? (string[]; station-specific identifiers). xmtp also accepts ' +
@@ -324,6 +320,8 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'remove_members',
+    group: 'write',
+    destructive: true,
     description:
       'Remove members from an existing Metro group, in a station-agnostic shape. Args: line ' +
       '(required), members? (string[]). xmtp also accepts addresses?/inboxIds? for backward ' +
@@ -354,6 +352,7 @@ export const COMMON_TOOLS = [
   },
   {
     name: 'export_invite',
+    group: 'write',
     description:
       'Get a join/invite link for a Metro group, for platforms where direct-add is not always ' +
       'permitted. Args: line (required). The station is derived from the line. Returns {op, ' +
@@ -368,8 +367,9 @@ export const COMMON_TOOLS = [
   CREATE_UPLOAD_TOOL,
 ];
 
-export const LIST_ACCOUNTS_TOOL = {
+export const LIST_ACCOUNTS_TOOL: ToolDef = {
   name: 'list_accounts',
+  group: 'read',
   description:
     'List the configured messaging accounts across all stations (PUBLIC identity only: ' +
     'addresses, bot ids/usernames). No args. Never returns tokens, private keys, or the ' +
@@ -378,20 +378,3 @@ export const LIST_ACCOUNTS_TOOL = {
     'verb need not be discovered by trial and error.',
   inputSchema: { type: 'object', properties: {} },
 };
-
-export const MCP_INSTRUCTIONS =
-  'Messages from Metro chat arrive as <channel source="metro" line="..." from="..." ' +
-  'station="..." message_id="...">. To respond, use the messaging tools, always passing the ' +
-  '`line` attribute verbatim (the station is derived from it): `send` (text and/or media via ' +
-  '`attachments`, optional `reply_to`), `reply` (quote a `message_id` with `text`), `react`/' +
-  '`unreact` (emoji on a `message_id`), `edit`/`delete` (a `message_id`), and `read` (recent ' +
-  "history). Station support varies - the tool returns the daemon's reason if a verb is " +
-  'unsupported on that line. An inbound attachment is surfaced as a note carrying the ' +
-  "sender's own text alongside a `Public URL` - fetch that url to read the file; the note's " +
-  '`local_path` resolves on the DAEMON host, not on yours, so the Read tool works on it only ' +
-  'for an agent running there. To send a file OUT, call `create_upload`, ' +
-  'run the one curl line it hands back (that step needs a shell; the bytes go from your disk ' +
-  'straight to metro and never through this conversation), then `send` with ' +
-  'attachments:[{upload:"<upload_id>"}]. Inline `data` is for tiny files only, `url` only for ' +
-  'an already-public file, and `path` is read on the DAEMON host, not yours. Tool-approval ' +
-  'prompts are relayed to the same chat - answer "yes <id>"/"no <id>".';

package/runtime/node_modules/@metro-labs/{mcp → daemon}/src/mcp/upload-tool.ts

@@ -1,34 +1,29 @@
-import { publicBaseOrDefault } from '../daemon/attach-serve.js';
+import { publicBaseOrDefault } from '../files/attach-serve.js';
 import { safeFileName } from '../stations/attach-inline.js';
-import { guessMime } from '../stations/attachments.js';
+import { guessMime } from '@metro-labs/core/stations/attachments';
 import {
   createUploadSlot,
   issueUploadTicket,
   MAX_UPLOAD_BYTES,
   removeUpload,
   UPLOAD_TTL_MS,
-} from '../daemon/upload-store.js';
-import type { ToolResult } from '../stations/types.js';
+} from '../files/upload-store.js';
+import type { ToolResult } from '@metro-labs/core/stations/types';
 import { errResult, okJson } from './ctx.js';
 import { allowedAgents, currentIdentity } from './request-identity.js';
-import { str } from './str.js';
+import { str } from '@metro-labs/core/str';
 
 const ttlMinutes = (): number => Math.round(UPLOAD_TTL_MS / 60_000);
 
 const NO_AGENT =
   'create_upload needs an agent credential; this session is not scoped to one agent';
 
-const manyAgents = (n: number): string =>
-  `create_upload is scoped to one agent, but this session covers ${String(n)}` +
-  ' (a multi-agent sign-in); use `POST /api/uploads?agent=<id>` directly instead';
-
 type OwnerAgent = { agentId: string } | { error: string };
 
 function ownerAgent(): OwnerAgent {
   const allowed = allowedAgents(currentIdentity());
   const [only] = [...allowed];
-  if (allowed.size === 1 && only !== undefined) return { agentId: only };
-  return { error: allowed.size === 0 ? NO_AGENT : manyAgents(allowed.size) };
+  return allowed.size === 1 && only !== undefined ? { agentId: only } : { error: NO_AGENT };
 }
 
 export function dispatchCreateUpload(

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -0,0 +1,126 @@
+export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
+const HELPER_VERSION = 1;
+export const SUDOERS_PATH = '/etc/sudoers.d/metro';
+export const METRO_USER = 'metro';
+const METRO_HOME = '/var/lib/metro';
+
+export const sudoersText = (agent: string): string =>
+  [
+    `${METRO_USER} ALL=(${agent}) NOPASSWD: ALL`,
+    `${METRO_USER} ALL=(root) NOPASSWD: ${HELPER_PATH} *`,
+    `Defaults:${METRO_USER} !requiretty`,
+    '',
+  ].join('\n');
+
+const lines = (...parts: string[]): string => parts.join('\n');
+
+const CHECKS = lines(
+  'AGENT=agent',
+  'UNITS=/etc/systemd/system',
+  'die() { echo "root-helper: $*" >&2; exit 2; }',
+  'agent_uid() { id -u "$AGENT" 2>/dev/null || die "no agent user"; }',
+  'service_ok() {',
+  '  printf %s "$1" | grep -Eq "^[A-Za-z0-9@_.-]+\\.service$" || die "bad service name"',
+  '  case "$1" in metro*) die "not a metro unit";; esac',
+  '  frag=$(systemctl show "$1" -p FragmentPath --value)',
+  '  case "$frag" in "$UNITS"/*) ;; *) die "not a unit under $UNITS";; esac',
+  '  systemctl show "$1" -p TriggeredBy --value | grep -q "\\.timer" || die "not started by a timer"',
+  '}',
+  'dropin_ok() {',
+  '  case "$1" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '  home=$(getent passwd "$AGENT" | cut -d: -f6)',
+  '  saw_user=0',
+  '  while IFS= read -r line; do',
+  '    case "$line" in',
+  '      "[Service]"|"") ;;',
+  '      "User=$AGENT") saw_user=1 ;;',
+  '      Group=*) printf %s "${line#Group=}" | grep -Eq "^[0-9]+$" || die "bad group" ;;',
+  '      "WorkingDirectory=$home"|"WorkingDirectory=$home"/*) ;;',
+  '      Environment=*) ;;',
+  '      "EnvironmentFile=-$home/.metro/vault.env") ;;',
+  '      "ExecStart=") ;;',
+  '      ExecStart=[+!@]*) die "privileged ExecStart refused" ;;',
+  '      ExecStart=*) ;;',
+  '      *) die "line not allowed: $line" ;;',
+  '    esac',
+  '  done < "$2"',
+  '  if [ "$1" = 10-metro-agent.conf ] && [ "$saw_user" != 1 ]; then die "the drop-in must set User=$AGENT"; fi',
+  '}',
+);
+
+const FIREWALL = lines(
+  'firewall_on() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    $t -w -N METRO_AGENT 2>/dev/null || true',
+  '    $t -w -F METRO_AGENT',
+  '    $t -w -A METRO_AGENT -o lo -j ACCEPT',
+  '    $t -w -A METRO_AGENT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p udp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp --dport 53 -j ACCEPT',
+  '    $t -w -A METRO_AGENT -p tcp -j REJECT --reject-with tcp-reset',
+  '    $t -w -A METRO_AGENT -j REJECT',
+  '    $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null || $t -w -I OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT',
+  '  done',
+  '}',
+  'firewall_off() {',
+  '  uid=$(agent_uid)',
+  '  for t in iptables ip6tables; do',
+  '    while $t -w -C OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT 2>/dev/null; do $t -w -D OUTPUT -m owner --uid-owner "$uid" -j METRO_AGENT; done',
+  '    $t -w -F METRO_AGENT 2>/dev/null || true',
+  '    $t -w -X METRO_AGENT 2>/dev/null || true',
+  '  done',
+  '}',
+);
+
+const ACTIONS = lines(
+  'action="${1:-}"; [ "$#" -gt 0 ] && shift',
+  'case "$action" in',
+  `  version) echo ${String(HELPER_VERSION)} ;;`,
+  '  ensure-agent)',
+  '    getent passwd "$AGENT" >/dev/null || useradd --create-home --shell /bin/bash "$AGENT"',
+  '    chmod 700 "$(getent passwd "$AGENT" | cut -d: -f6)" ;;',
+  '  as-agent-scope)',
+  '    [ "$#" -ge 3 ] || die "usage: as-agent-scope <max> <high> <command...>"',
+  '    printf %s "$1$2" | grep -Eq "^[0-9]+$" || die "bad memory limits"',
+  '    max="$1"; high="$2"; shift 2',
+  '    uid=$(agent_uid); gid=$(id -g "$AGENT")',
+  '    exec systemd-run --scope --quiet --collect --unit="metro-claude-$(date +%s%N)" -p MemoryMax="$max" -p MemoryHigh="$high" -p OOMPolicy=continue -- setpriv --reuid="$uid" --regid="$gid" --init-groups -- "$@" ;;',
+  '  dropin-write)',
+  '    service_ok "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; cat > "$tmp"; dropin_ok "$2" "$tmp"',
+  '    mkdir -p "$UNITS/$1.d"; install -m 644 "$tmp" "$UNITS/$1.d/$2" ;;',
+  '  dropin-remove)',
+  '    service_ok "$1"; case "$2" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  '    rm -f "$UNITS/$1.d/$2" ;;',
+  '  daemon-reload) systemctl daemon-reload ;;',
+  '  start-job)',
+  '    service_ok "$1"; [ "$(systemctl show "$1" -p User --value)" = "$AGENT" ] || die "that job does not run as $AGENT"',
+  '    systemctl start --no-block "$1" ;;',
+  '  root-crontab) crontab -l -u root 2>/dev/null || true ;;',
+  '  root-crontab-drop)',
+  '    printf %s "$1" | grep -Eq "^[0-9a-f]{16}$" || die "bad line id"',
+  `    backups="${METRO_HOME}/.metro/agents"`,
+  '    cur=$(mktemp); crontab -l -u root > "$cur" 2>/dev/null || true',
+  '    kept=$(mktemp); found=0',
+  '    while IFS= read -r line; do',
+  '      id=$(printf %s "$line" | sed "s/^[[:space:]]*//;s/[[:space:]]*$//" | tr -d "\\n" | sha256sum | cut -c1-16)',
+  '      if [ "$id" = "$1" ] && [ "$found" = 0 ]; then found=1; elif [ -n "$line" ]; then printf "%s\\n" "$line" >> "$kept"; fi',
+  '    done < "$cur"',
+  '    [ "$found" = 1 ] || die "that cron line is gone"',
+  '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
+  '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
+  '  firewall-on) firewall_on ;;',
+  '  firewall-off) firewall_off ;;',
+  '  trust-ca)',
+  `    src="${METRO_HOME}/.metro/agents/vault/ca/ca.crt"`,
+  '    head -n1 "$src" | grep -q "BEGIN CERTIFICATE" || die "not a certificate"',
+  '    if grep -q "PRIVATE KEY" "$src"; then die "a key is not a certificate"; fi',
+  '    install -m 644 "$src" /usr/local/share/ca-certificates/metro-vault.crt && update-ca-certificates >/dev/null ;;',
+  '  untrust-ca) rm -f /usr/local/share/ca-certificates/metro-vault.crt; update-ca-certificates --fresh >/dev/null ;;',
+  '  install-nss-tools) DEBIAN_FRONTEND=noninteractive apt-get install -y -q libnss3-tools >/dev/null ;;',
+  '  *) die "unknown action: $action" ;;',
+  'esac',
+);
+
+export const helperScript = (): string =>
+  ['#!/bin/sh', 'set -eu', 'export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', CHECKS, FIREWALL, ACTIONS, ''].join('\n');

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -0,0 +1,37 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { HELPER_PATH, helperScript, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import { AGENT_NAME } from '../agent-user/user.js';
+
+interface InstallPaths {
+  helper: string;
+  sudoers: string;
+}
+
+function checked(file: string, args: string[]): void {
+  const run = spawnSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  if (run.error !== undefined) throw run.error;
+  if (run.status !== 0) throw new Error(`${file} ${args.join(' ')}: ${`${run.stdout}${run.stderr}`.trim() || `exit ${String(run.status)}`}`);
+}
+
+export function installRootHelper(paths: InstallPaths = { helper: HELPER_PATH, sudoers: SUDOERS_PATH }): void {
+  mkdirSync(dirname(paths.helper), { recursive: true, mode: 0o755 });
+  writeFileSync(paths.helper, helperScript(), { mode: 0o755 });
+  chmodSync(paths.helper, 0o755);
+  const work = mkdtempSync(join(tmpdir(), 'metro-sudoers-'));
+  try {
+    const draft = join(work, 'metro');
+    writeFileSync(draft, sudoersText(AGENT_NAME), { mode: 0o440 });
+    checked('visudo', ['-cf', draft]);
+    checked('install', ['-m', '440', draft, paths.sudoers]);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  installRootHelper();
+  process.stdout.write(`metro: wrote ${HELPER_PATH} and ${SUDOERS_PATH}\n`);
+}

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/privilege.ts

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process';
+import { HELPER_PATH, METRO_USER } from './helper-script.js';
+
+export interface PrivilegeHost {
+  platform: string;
+  uid: number | undefined;
+  user: string;
+}
+
+let metroUid: number | null | undefined;
+
+function uidOfMetro(): number | null {
+  if (metroUid !== undefined) return metroUid;
+  const run = spawnSync('getent', ['passwd', METRO_USER], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  const uid = Number(run.status === 0 ? run.stdout.split(':')[2] : NaN);
+  metroUid = Number.isInteger(uid) && uid > 0 ? uid : null;
+  return metroUid;
+}
+
+const realHost = (): PrivilegeHost => {
+  const uid = process.getuid?.();
+  const linux = process.platform === 'linux';
+  return { platform: process.platform, uid, user: linux && uid !== 0 && uid !== undefined && uid === uidOfMetro() ? METRO_USER : '' };
+};
+
+export const runningAsRoot = (host: PrivilegeHost = realHost()): boolean => host.platform === 'linux' && host.uid === 0;
+
+export const runningAsMetro = (host: PrivilegeHost = realHost()): boolean =>
+  host.platform === 'linux' && host.uid !== 0 && host.user === METRO_USER;
+
+export interface HelperResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+}
+
+export function rootHelper(args: string[], input?: string): HelperResult {
+  const run = spawnSync('sudo', ['-n', HELPER_PATH, ...args], { encoding: 'utf8', input, stdio: ['pipe', 'pipe', 'pipe'], timeout: 180_000 });
+  return { status: run.error === undefined ? run.status : null, stdout: run.stdout ?? '', stderr: run.stderr ?? run.error?.message ?? '' };
+}
+
+export function mustHelper(args: string[], input?: string): string {
+  const run = rootHelper(args, input);
+  if (run.status !== 0) throw new Error(run.stderr.trim() || `root-helper ${args[0] ?? ''} failed`);
+  return run.stdout;
+}
+
+export const helperArgv = (args: string[]): [string, string[]] => ['sudo', ['-n', HELPER_PATH, ...args]];