@stage-labs/metro 0.1.0-beta.242 → 0.1.0-beta.243

package/dist/service.js

@@ -183,6 +183,11 @@ function install(argv, deps) {
     const args = parseServeArgs(serveArgs);
     const runAs = runAsOf(user, deps);
     const plan = servicePlan(deps.host, serveArgs, runAs);
+    if (deps.exists(plan.file) && runAs !== undefined) {
+        deps.run({ args: ['bun', runAs.helper] });
+        deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}); its root helper, sudo rules and metadata guard are now current, and the service keeps running`);
+        return 0;
+    }
     if (deps.exists(plan.file)) {
         deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}) and restarts on its own; metro service status says whether it is running. To change its arguments: metro service uninstall, then install again`);
         return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.242",
+  "version": "0.1.0-beta.243",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.242",
+  "version": "0.1.0-beta.243",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -26,6 +26,7 @@ import { ensureMetroPlugin } from '../claude/plugin-install.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
 import { applyVault } from '../vault/index.js';
+import { blockImds } from '../metro-user/imds.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
 import { liveEvents, memoryRoutine, tryClaudeSetup } from '../claude/setup.js';
 import { tryMemoryJob } from '../claude/memory-routine.js';
@@ -172,6 +173,7 @@ async function startClaude(): Promise<void> {
   if (agentUser !== 'off') log.info({ agentUser }, 'agent-user: Claude Code runs as its own user');
   if (agentUser === 'failed') return;
   if (agentUser === 'ready') {
+    blockImds();
     const vault = (await applyVault()).status;
     if (vault.enabled) log.info({ running: vault.running, problem: vault.problem }, 'vault: the agent reaches the internet through the vault');
   }

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -1,6 +1,8 @@
 export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
-const HELPER_VERSION = 1;
+const HELPER_VERSION = 2;
 export const SUDOERS_PATH = '/etc/sudoers.d/metro';
+export const IMDS_UNIT = 'metro-imds.service';
+export const IMDS_UNIT_PATH = `/etc/systemd/system/${IMDS_UNIT}`;
 export const METRO_USER = 'metro';
 const METRO_HOME = '/var/lib/metro';
 
@@ -73,6 +75,43 @@ const FIREWALL = lines(
   '}',
 );
 
+const IMDS = lines(
+  'imds_block() {',
+  `  metro_uid=$(id -u ${METRO_USER} 2>/dev/null) || die "no ${METRO_USER} user"`,
+  '  for t in iptables ip6tables; do',
+  '    if [ "$t" = iptables ]; then dst=169.254.169.254; else dst=fd00:ec2::254; fi',
+  '    if ! $t -w -L OUTPUT -n >/dev/null 2>&1; then [ "$t" = ip6tables ] && continue; die "$t is not usable"; fi',
+  '    $t -w -N METRO_IMDS 2>/dev/null || true',
+  '    $t -w -F METRO_IMDS',
+  '    $t -w -A METRO_IMDS -m owner --uid-owner 0 -j RETURN',
+  '    $t -w -A METRO_IMDS -m owner --uid-owner "$metro_uid" -j RETURN',
+  '    $t -w -A METRO_IMDS -p tcp -j REJECT --reject-with tcp-reset',
+  '    $t -w -A METRO_IMDS -j REJECT',
+  '    $t -w -C OUTPUT -d "$dst" -j METRO_IMDS 2>/dev/null || $t -w -I OUTPUT -d "$dst" -j METRO_IMDS',
+  '  done',
+  '}',
+);
+
+export const imdsUnitText = (): string =>
+  lines(
+    '[Unit]',
+    `Description=Metro: only root and ${METRO_USER} reach the instance metadata service`,
+    'DefaultDependencies=no',
+    'After=local-fs.target',
+    'Before=network-pre.target shutdown.target',
+    'Wants=network-pre.target',
+    'Conflicts=shutdown.target',
+    '',
+    '[Service]',
+    'Type=oneshot',
+    'RemainAfterExit=yes',
+    `ExecStart=${HELPER_PATH} imds-block`,
+    '',
+    '[Install]',
+    'WantedBy=multi-user.target',
+    '',
+  );
+
 const ACTIONS = lines(
   'action="${1:-}"; [ "$#" -gt 0 ] && shift',
   'case "$action" in',
@@ -109,6 +148,7 @@ const ACTIONS = lines(
   '    [ "$found" = 1 ] || die "that cron line is gone"',
   '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
   '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
+  '  imds-block) imds_block ;;',
   '  firewall-on) firewall_on ;;',
   '  firewall-off) firewall_off ;;',
   '  trust-ca)',
@@ -123,4 +163,4 @@ const ACTIONS = lines(
 );
 
 export const helperScript = (): string =>
-  ['#!/bin/sh', 'set -eu', 'export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', CHECKS, FIREWALL, ACTIONS, ''].join('\n');
+  ['#!/bin/sh', 'set -eu', 'export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', CHECKS, FIREWALL, IMDS, ACTIONS, ''].join('\n');

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/imds.ts

@@ -0,0 +1,17 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { log } from '@metro-labs/core/log';
+import { rootHelper, type HelperResult } from './privilege.js';
+
+export function blockImds(run: (args: string[]) => HelperResult = rootHelper): boolean {
+  const result = run(['imds-block']);
+  if (result.status === 0) {
+    log.info('imds: only root and metro reach the instance metadata service');
+    return true;
+  }
+  log.warn(
+    { err: result.stderr.trim(), fix: `as root: ${join(homedir(), '.npm-global', 'bin', 'metro')} service install --user metro` },
+    'imds: the agent can still read the instance metadata (setup data, instance role), since the root helper on this box predates the guard',
+  );
+  return false;
+}

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -2,7 +2,7 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { HELPER_PATH, helperScript, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import { HELPER_PATH, helperScript, IMDS_UNIT, IMDS_UNIT_PATH, imdsUnitText, SUDOERS_PATH, sudoersText } from './helper-script.js';
 import { AGENT_NAME } from '../agent-user/user.js';
 
 interface InstallPaths {
@@ -10,6 +10,8 @@ interface InstallPaths {
   sudoers: string;
 }
 
+type Run = (file: string, args: string[]) => void;
+
 function checked(file: string, args: string[]): void {
   const run = spawnSync(file, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
   if (run.error !== undefined) throw run.error;
@@ -31,7 +33,16 @@ export function installRootHelper(paths: InstallPaths = { helper: HELPER_PATH, s
   }
 }
 
+export function installImdsGuard(unit: string = IMDS_UNIT_PATH, run: Run = checked): void {
+  writeFileSync(unit, imdsUnitText(), { mode: 0o644 });
+  chmodSync(unit, 0o644);
+  run('systemctl', ['daemon-reload']);
+  run('systemctl', ['enable', IMDS_UNIT]);
+  run('systemctl', ['restart', IMDS_UNIT]);
+}
+
 if (import.meta.main) {
   installRootHelper();
-  process.stdout.write(`metro: wrote ${HELPER_PATH} and ${SUDOERS_PATH}\n`);
+  installImdsGuard();
+  process.stdout.write(`metro: wrote ${HELPER_PATH}, ${SUDOERS_PATH} and ${IMDS_UNIT_PATH}; only root and metro reach the instance metadata service\n`);
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.242"
+  "version": "0.1.0-beta.243"
 }