@stage-labs/metro 0.1.0-beta.246 → 0.1.0-beta.247

package/dist/background.js

@@ -7,7 +7,7 @@ const STOP_MS = 30_000;
 const SETTLE_MS = 5_000;
 const POLL_MS = 250;
 const given = (value) => value !== undefined && value.trim() !== '' ? value.trim() : undefined;
-const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+export const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 export const keepInSession = (env) => given(env[AGENT_VIEW_OFF]) === undefined ? { ...env, [AGENT_VIEW_OFF]: '1' } : env;
 export const claudeDir = (env = process.env) => given(env.CLAUDE_CONFIG_DIR) ?? join(given(env.HOME) ?? homedir(), '.claude');
 export const projectDir = (dir, cwd) => join(dir, 'projects', cwd.replace(/[^A-Za-z0-9]/g, '-'));

package/dist/root-release-io.js

@@ -0,0 +1,161 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { X509Certificate } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isRecord } from './background.js';
+import { ISSUER, isVersion, PUBLISHER, RELEASE_DIR } from './root-release.js';
+import { PACKAGE_NAME } from './version.js';
+const REGISTRY = 'https://registry.npmjs.org';
+const ENCODED = PACKAGE_NAME.replace('/', '%2F');
+const ROOT_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const SETUP = join('runtime', 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts');
+const MAX_TARBALL = 64 * 1024 * 1024;
+const TIMEOUT_MS = 60_000;
+const isSigstore = (mod) => isRecord(mod) && typeof mod.verify === 'function';
+export function rootOwned(path) {
+    let at = realpathSync(path);
+    for (;;) {
+        const st = statSync(at);
+        if (st.uid !== 0 || (st.mode & 0o022) !== 0)
+            return false;
+        if (at === dirname(at))
+            return true;
+        at = dirname(at);
+    }
+}
+function mustBeRootOwned(path, what) {
+    if (!existsSync(path) || !rootOwned(path))
+        throw new Error(`${what} at ${path} is missing or not owned by root alone; refused`);
+    return path;
+}
+async function getJson(url) {
+    const res = await fetch(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    return res.json();
+}
+async function published(version) {
+    const body = await getJson(`${REGISTRY}/${ENCODED}`);
+    const tags = isRecord(body) && isRecord(body['dist-tags']) ? body['dist-tags'] : {};
+    const entry = isRecord(body) && isRecord(body.versions) ? body.versions[version] : undefined;
+    const dist = isRecord(entry) && isRecord(entry.dist) ? entry.dist : {};
+    if (typeof dist.tarball !== 'string' || typeof dist.integrity !== 'string')
+        throw new Error(`npm has no ${PACKAGE_NAME}@${version}`);
+    return { tags, tarball: dist.tarball, integrity: dist.integrity };
+}
+async function download(url) {
+    const res = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    if (Number(res.headers.get('content-length') ?? 0) > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    const bytes = Buffer.from(await res.arrayBuffer());
+    if (bytes.length > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    return bytes;
+}
+function loadSigstore() {
+    const npm = mustBeRootOwned(join(dirname(dirname(process.execPath)), 'lib', 'node_modules', 'npm'), "npm's sigstore");
+    const mod = createRequire(join(npm, 'package.json'))('sigstore');
+    if (!isSigstore(mod))
+        throw new Error(`no sigstore verifier in ${npm}; refused`);
+    return mod;
+}
+function leafCertificate(bundle) {
+    const material = isRecord(bundle) && isRecord(bundle.verificationMaterial) ? bundle.verificationMaterial : {};
+    const chain = isRecord(material.x509CertificateChain) && Array.isArray(material.x509CertificateChain.certificates) ? material.x509CertificateChain.certificates : [];
+    const leaf = isRecord(material.certificate) ? material.certificate : chain[0];
+    return isRecord(leaf) && typeof leaf.rawBytes === 'string' ? leaf.rawBytes : null;
+}
+export function signedByPublisher(bundle) {
+    const raw = leafCertificate(bundle);
+    if (raw === null)
+        return false;
+    const names = new X509Certificate(Buffer.from(raw, 'base64')).subjectAltName?.split(', ') ?? [];
+    return names.includes(`URI:${PUBLISHER}`);
+}
+async function verifySignature(bundle) {
+    if (!signedByPublisher(bundle))
+        throw new Error(`the provenance was not signed for ${PUBLISHER}; refused`);
+    const sigstore = loadSigstore();
+    const tuf = mkdtempSync(join(tmpdir(), 'metro-tuf-'));
+    try {
+        await sigstore.verify(bundle, { certificateIdentityURI: PUBLISHER, certificateIssuer: ISSUER, tufCachePath: tuf });
+    }
+    catch (err) {
+        throw new Error(`the provenance signature does not check out: ${err instanceof Error ? err.message : String(err)}; refused`);
+    }
+    finally {
+        rmSync(tuf, { recursive: true, force: true });
+    }
+}
+function checked(file, args, cwd = '/') {
+    const run = spawnSync(file, args, { cwd, env: { PATH: ROOT_PATH }, stdio: ['ignore', 'inherit', 'inherit'] });
+    if (run.error !== undefined)
+        throw run.error;
+    if (run.status !== 0)
+        throw new Error(`${file} ${args.join(' ')} failed (exit ${String(run.status)})`);
+}
+function manifestVersion(dir) {
+    const file = join(dir, 'package.json');
+    if (!existsSync(file))
+        return null;
+    const raw = JSON.parse(readFileSync(file, 'utf8'));
+    return isRecord(raw) && raw.name === PACKAGE_NAME && typeof raw.version === 'string' && isVersion(raw.version) ? raw.version : null;
+}
+function unpack(tarball, version) {
+    const work = mkdtempSync(join(tmpdir(), 'metro-release-'));
+    const staged = `${RELEASE_DIR}.new`;
+    try {
+        const file = join(work, 'metro.tgz');
+        writeFileSync(file, tarball, { mode: 0o600 });
+        rmSync(staged, { recursive: true, force: true });
+        mkdirSync(staged, { recursive: true, mode: 0o755 });
+        checked('tar', ['-xzf', file, '-C', staged, '--strip-components=1', '--no-same-owner', '--no-same-permissions']);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+    if (manifestVersion(staged) !== version)
+        throw new Error(`the unpacked package is not ${PACKAGE_NAME}@${version}; refused`);
+    return staged;
+}
+function findBun() {
+    const found = ROOT_PATH.split(':')
+        .map((dir) => join(dir, 'bun'))
+        .find((path) => existsSync(path));
+    if (found === undefined)
+        throw new Error(`no bun on ${ROOT_PATH}`);
+    return mustBeRootOwned(found, 'bun');
+}
+function setup(dir) {
+    const node = mustBeRootOwned(process.execPath, 'node');
+    checked(findBun(), ['--no-install', join(dir, SETUP), '--node', node]);
+}
+function swap(staged) {
+    const old = `${RELEASE_DIR}.old`;
+    rmSync(old, { recursive: true, force: true });
+    if (existsSync(RELEASE_DIR))
+        renameSync(RELEASE_DIR, old);
+    renameSync(staged, RELEASE_DIR);
+    rmSync(old, { recursive: true, force: true });
+}
+export function realReleaseDeps() {
+    process.umask(0o022);
+    mkdirSync(dirname(RELEASE_DIR), { recursive: true, mode: 0o755 });
+    return {
+        installed: () => manifestVersion(RELEASE_DIR),
+        published,
+        download,
+        attestations: (version) => getJson(`${REGISTRY}/-/npm/v1/attestations/${ENCODED}@${version}`),
+        verifySignature,
+        unpack,
+        setup,
+        swap,
+        out: (line) => {
+            process.stderr.write(`metro root: ${line}\n`);
+        },
+    };
+}

package/dist/root-release.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { isRecord } from './background.js';
+import { compareVersions, PACKAGE_NAME } from './version.js';
+export const RELEASE_DIR = '/usr/local/lib/metro/release';
+export const PUBLISHER = 'https://github.com/bonustrack/metro/.github/workflows/publish-cli.yml@refs/heads/main';
+export const ISSUER = 'https://token.actions.githubusercontent.com';
+const REGISTRY = 'https://registry.npmjs.org';
+const PROVENANCE = 'https://slsa.dev/provenance/v1';
+const IN_TOTO = 'application/vnd.in-toto+json';
+const VERSION_RE = /^\d{1,9}\.\d{1,9}\.\d{1,9}(?:-[0-9A-Za-z]{1,20}(?:\.[0-9A-Za-z]{1,20}){0,4})?$/;
+export const isVersion = (raw) => VERSION_RE.test(raw);
+export const tarballUrl = (version) => `${REGISTRY}/${PACKAGE_NAME}/-/metro-${version}.tgz`;
+const subjectName = (version) => `pkg:npm/${PACKAGE_NAME.replace('@', '%40')}@${version}`;
+function provenanceBundle(body, version) {
+    const list = isRecord(body) && Array.isArray(body.attestations) ? body.attestations : [];
+    const entry = list.find((a) => isRecord(a) && a.predicateType === PROVENANCE);
+    if (!isRecord(entry) || !isRecord(entry.bundle))
+        throw new Error(`${PACKAGE_NAME}@${version} has no build provenance on npm; refused`);
+    return entry.bundle;
+}
+function statementOf(bundle) {
+    const envelope = bundle.dsseEnvelope;
+    if (!isRecord(envelope) || envelope.payloadType !== IN_TOTO || typeof envelope.payload !== 'string')
+        throw new Error('the provenance is not a signed in-toto statement; refused');
+    const statement = JSON.parse(Buffer.from(envelope.payload, 'base64').toString('utf8'));
+    if (!isRecord(statement))
+        throw new Error('the provenance statement is unreadable; refused');
+    return statement;
+}
+export function provenanceNames(statement, version, sha512) {
+    const subjects = Array.isArray(statement.subject) ? statement.subject : [];
+    return (statement.predicateType === PROVENANCE &&
+        subjects.some((s) => isRecord(s) && s.name === subjectName(version) && isRecord(s.digest) && s.digest.sha512 === sha512));
+}
+async function checkProvenance(version, tarball, deps) {
+    const bundle = provenanceBundle(await deps.attestations(version), version);
+    await deps.verifySignature(bundle);
+    const sha512 = createHash('sha512').update(tarball).digest('hex');
+    if (!provenanceNames(statementOf(bundle), version, sha512))
+        throw new Error(`the signed provenance does not name this tarball of ${PACKAGE_NAME}@${version}; refused`);
+}
+async function fetchChecked(version, trigger, deps) {
+    const published = await deps.published(version);
+    if (trigger === 'metro' && published.tags.beta !== version && published.tags.latest !== version)
+        throw new Error(`${version} is not what the beta or latest tag of ${PACKAGE_NAME} points to now; refused`);
+    if (published.tarball !== tarballUrl(version))
+        throw new Error(`npm names an unexpected tarball for ${version}: ${published.tarball}; refused`);
+    const tarball = await deps.download(published.tarball);
+    if (`sha512-${createHash('sha512').update(tarball).digest('base64')}` !== published.integrity)
+        throw new Error(`the tarball of ${version} does not match the sha512 npm publishes for it; refused`);
+    await checkProvenance(version, tarball, deps);
+    return tarball;
+}
+export async function installRelease(version, trigger, deps) {
+    if (!isVersion(version))
+        throw new Error(`'${version}' is not a ${PACKAGE_NAME} version`);
+    const have = deps.installed();
+    if (have !== null && compareVersions(version, have) <= 0) {
+        if (trigger === 'metro') {
+            deps.out(`the root side is at ${have}, and ${version} is not newer: nothing to do`);
+            return 'current';
+        }
+        deps.setup(RELEASE_DIR);
+        deps.out(`the root side stays at ${have} (it never goes back) and its root setup ran again`);
+        return 'refreshed';
+    }
+    deps.out(`checking ${PACKAGE_NAME}@${version} (npm sha512 and the GitHub provenance of ${PUBLISHER})`);
+    const tarball = await fetchChecked(version, trigger, deps);
+    const staged = deps.unpack(tarball, version);
+    deps.setup(staged);
+    deps.swap(staged);
+    deps.out(`the root side is now ${PACKAGE_NAME}@${version}, verified, in ${RELEASE_DIR}`);
+    return 'installed';
+}

package/dist/service.js

@@ -3,9 +3,12 @@ import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, platform, userInfo } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { serveLockedBy } from './control.js';
-import { findBun, runtimeDir } from './runtime.js';
+import { installRelease } from './root-release.js';
+import { realReleaseDeps } from './root-release-io.js';
+import { findBun } from './runtime.js';
 import { findTailscale, parseServeArgs, requireOwner } from './serve.js';
-const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status';
+import { currentVersion } from './version.js';
+const USAGE = 'usage: metro service install [--port <n>] [--owner <organization id>] [--user metro] | uninstall | status | root-upgrade <version> (root only)';
 const SERVICE = 'metro';
 const LABEL = 'box.metro.serve';
 const CARRIED = /^(METRO_.*|XDG_CACHE_HOME|PATH|HOME)$/;
@@ -110,7 +113,7 @@ function systemdPlan(host, serveArgs, runAs) {
         file,
         content: runAs === undefined ? systemdUnit(host, exec, system ? 'multi-user.target' : 'default.target') : runAsUnit(host, runAs, serveArgs),
         dirs: [],
-        install: [...(runAs === undefined ? [] : [{ args: ['bun', runAs.helper] }]), { args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
+        install: [{ args: [...ctl, 'daemon-reload'] }, { args: [...ctl, 'enable', '--now', SERVICE] }],
         uninstall: [{ args: [...ctl, 'disable', '--now', SERVICE], mayFail: true }],
         reload: [{ args: [...ctl, 'daemon-reload'], mayFail: true }],
         status: { args: [...ctl, 'is-active', SERVICE], mayFail: true },
@@ -176,18 +179,31 @@ function runAsOf(name, deps) {
     const account = deps.account(name);
     if (account === null)
         throw new Error(`there is no user ${name} on this machine; create it first (useradd --system --create-home --home-dir /var/lib/${name} ${name})`);
-    return { ...account, helper: deps.helperEntry() };
+    return account;
+}
+async function refreshRoot(plan, deps) {
+    await deps.release(deps.version, 'root');
+    deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}); its root side is current and follows every update by itself from now on, and the service keeps running`);
+    return 0;
+}
+function writeService(plan, deps) {
+    for (const dir of plan.dirs)
+        deps.mkdir(dir);
+    deps.write(plan.file, plan.content);
+    for (const command of plan.install)
+        deps.run(command);
+    deps.out(`Installed ${plan.file}: metro serve now starts at boot and after a crash, and the Server page on metro.box can stop, start and restart it.`);
+    for (const hint of plan.hints)
+        deps.out(hint);
+    return 0;
 }
 function install(argv, deps) {
     const { user, rest: serveArgs } = splitUser(argv);
     const args = parseServeArgs(serveArgs);
     const runAs = runAsOf(user, deps);
     const plan = servicePlan(deps.host, serveArgs, runAs);
-    if (deps.exists(plan.file) && runAs !== undefined) {
-        deps.run({ args: ['bun', runAs.helper] });
-        deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}); its root helper, sudo rules and metadata guard are now current, and the service keeps running`);
-        return 0;
-    }
+    if (deps.exists(plan.file) && runAs !== undefined)
+        return refreshRoot(plan, deps);
     if (deps.exists(plan.file)) {
         deps.out(`metro is already installed as a ${plan.kind} service (${plan.file}) and restarts on its own; metro service status says whether it is running. To change its arguments: metro service uninstall, then install again`);
         return 0;
@@ -196,14 +212,14 @@ function install(argv, deps) {
     const pid = deps.running();
     if (pid !== null)
         throw new Error(`a metro serve is running on this machine (pid ${String(pid)}). Stop it first (metro stop), then install: the service takes over from there`);
-    for (const dir of plan.dirs)
-        deps.mkdir(dir);
-    deps.write(plan.file, plan.content);
-    for (const command of plan.install)
-        deps.run(command);
-    deps.out(`Installed ${plan.file}: metro serve now starts at boot and after a crash, and the Server page on metro.box can stop, start and restart it.`);
-    for (const hint of plan.hints)
-        deps.out(hint);
+    if (runAs === undefined)
+        return writeService(plan, deps);
+    return deps.release(deps.version, 'root').then(() => writeService(plan, deps));
+}
+async function rootUpgrade(version, deps) {
+    if (deps.host.platform !== 'linux' || deps.host.uid !== 0)
+        throw new Error('metro service root-upgrade is for root on Linux; the metro-root-upgrade unit runs it');
+    await deps.release(version, 'metro');
     return 0;
 }
 function uninstall(deps) {
@@ -275,7 +291,8 @@ function realDeps() {
         },
         running: serveLockedBy,
         account: lookupAccount,
-        helperEntry: () => join(runtimeDir(), 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts'),
+        version: currentVersion(),
+        release: (version, trigger) => installRelease(version, trigger, realReleaseDeps()),
         preflight: (args, agents) => {
             requireOwner(args, agents);
             findBun();
@@ -305,5 +322,7 @@ export function service(argv, deps = realDeps()) {
         return Promise.resolve(uninstall(deps));
     if (verb === 'status' && rest.length === 0)
         return Promise.resolve(status(deps));
+    if (verb === 'root-upgrade' && rest.length === 1)
+        return rootUpgrade(rest[0] ?? '', deps);
     throw new Error(USAGE);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.246",
+  "version": "0.1.0-beta.247",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.246",
+  "version": "0.1.0-beta.247",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -27,6 +27,7 @@ import { runningAsRoot } from '../metro-user/privilege.js';
 import { provisionAgentUser } from '../agent-user/provision.js';
 import { applyVault } from '../vault/index.js';
 import { blockImds } from '../metro-user/imds.js';
+import { followRelease } from '../metro-user/root-follow.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
 import { liveEvents, memoryRoutine, tryClaudeSetup } from '../claude/setup.js';
 import { tryMemoryJob } from '../claude/memory-routine.js';
@@ -174,6 +175,7 @@ async function startClaude(): Promise<void> {
   if (agentUser === 'failed') return;
   if (agentUser === 'ready') {
     blockImds();
+    followRelease();
     const vault = (await applyVault()).status;
     if (vault.enabled) log.info({ running: vault.running, problem: vault.problem }, 'vault: the agent reaches the internet through the vault');
   }

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/helper-script.ts

@@ -1,10 +1,16 @@
-export const HELPER_PATH = '/usr/local/lib/metro/root-helper';
-const HELPER_VERSION = 2;
+const ROOT_DIR = '/usr/local/lib/metro';
+export const HELPER_PATH = `${ROOT_DIR}/root-helper`;
+const HELPER_VERSION = 3;
 export const SUDOERS_PATH = '/etc/sudoers.d/metro';
 export const IMDS_UNIT = 'metro-imds.service';
 export const IMDS_UNIT_PATH = `/etc/systemd/system/${IMDS_UNIT}`;
+export const UPGRADE_UNIT = 'metro-root-upgrade@.service';
+export const UPGRADE_UNIT_PATH = `/etc/systemd/system/${UPGRADE_UNIT}`;
+const RELEASE_DIR = `${ROOT_DIR}/release`;
 export const METRO_USER = 'metro';
 const METRO_HOME = '/var/lib/metro';
+const VAULT_DROP_IN = '11-metro-vault.conf';
+const PRIVILEGED_EXEC = ['ExecConditionEx', 'ExecStartPreEx', 'ExecStartEx', 'ExecStartPostEx', 'ExecReloadEx', 'ExecStopEx', 'ExecStopPostEx'];
 
 export const sudoersText = (agent: string): string =>
   [
@@ -22,31 +28,23 @@ const CHECKS = lines(
   'die() { echo "root-helper: $*" >&2; exit 2; }',
   'agent_uid() { id -u "$AGENT" 2>/dev/null || die "no agent user"; }',
   'service_ok() {',
-  '  printf %s "$1" | grep -Eq "^[A-Za-z0-9@_.-]+\\.service$" || die "bad service name"',
+  '  case "$1" in [!A-Za-z0-9]*|*[!A-Za-z0-9@_.-]*|"") die "bad service name";; esac',
+  '  case "$1" in *.service) ;; *) die "bad service name";; esac',
   '  case "$1" in metro*) die "not a metro unit";; esac',
   '  frag=$(systemctl show "$1" -p FragmentPath --value)',
   '  case "$frag" in "$UNITS"/*) ;; *) die "not a unit under $UNITS";; esac',
   '  systemctl show "$1" -p TriggeredBy --value | grep -q "\\.timer" || die "not started by a timer"',
   '}',
+  'agent_only() {',
+  '  [ "$(systemctl show "$1" -p User --value)" = "$AGENT" ] || die "that job does not run as $AGENT"',
+  '  [ "$(systemctl show "$1" -p PermissionsStartOnly --value)" != yes ] || die "that job runs commands as root"',
+  '  [ -n "$(systemctl show "$1" -p ExecStartEx --value)" ] || die "cannot read the commands of that job"',
+  `  if systemctl show "$1" ${PRIVILEGED_EXEC.map((p) => `-p ${p}`).join(' ')} --value | grep -Eq "flags=[^;]*(privileged|no-setuid|ambient)"; then die "that job runs commands as root"; fi`,
+  '}',
   'dropin_ok() {',
-  '  case "$1" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  `  [ "$1" = ${VAULT_DROP_IN} ] || die "bad drop-in name"`,
   '  home=$(getent passwd "$AGENT" | cut -d: -f6)',
-  '  saw_user=0',
-  '  while IFS= read -r line; do',
-  '    case "$line" in',
-  '      "[Service]"|"") ;;',
-  '      "User=$AGENT") saw_user=1 ;;',
-  '      Group=*) printf %s "${line#Group=}" | grep -Eq "^[0-9]+$" || die "bad group" ;;',
-  '      "WorkingDirectory=$home"|"WorkingDirectory=$home"/*) ;;',
-  '      Environment=*) ;;',
-  '      "EnvironmentFile=-$home/.metro/vault.env") ;;',
-  '      "ExecStart=") ;;',
-  '      ExecStart=[+!@]*) die "privileged ExecStart refused" ;;',
-  '      ExecStart=*) ;;',
-  '      *) die "line not allowed: $line" ;;',
-  '    esac',
-  '  done < "$2"',
-  '  if [ "$1" = 10-metro-agent.conf ] && [ "$saw_user" != 1 ]; then die "the drop-in must set User=$AGENT"; fi',
+  '  printf \'[Service]\\nEnvironmentFile=-%s/.metro/vault.env\\n\' "$home" | cmp -s - "$2" || die "only the vault environment file may be added"',
   '}',
 );
 
@@ -112,6 +110,20 @@ export const imdsUnitText = (): string =>
     '',
   );
 
+export const upgradeUnitText = (node: string): string =>
+  lines(
+    '[Unit]',
+    'Description=Metro: bring the root side to Metro %i, checked against npm and its GitHub provenance',
+    'After=network-online.target',
+    'Wants=network-online.target',
+    '',
+    '[Service]',
+    'Type=oneshot',
+    `ExecStart=/usr/bin/flock ${ROOT_DIR} ${node} ${RELEASE_DIR}/dist/cli.js service root-upgrade %i`,
+    'TimeoutStartSec=900',
+    '',
+  );
+
 const ACTIONS = lines(
   'action="${1:-}"; [ "$#" -gt 0 ] && shift',
   'case "$action" in',
@@ -126,10 +138,10 @@ const ACTIONS = lines(
   '    uid=$(agent_uid); gid=$(id -g "$AGENT")',
   '    exec systemd-run --scope --quiet --collect --unit="metro-claude-$(date +%s%N)" -p MemoryMax="$max" -p MemoryHigh="$high" -p OOMPolicy=continue -- setpriv --reuid="$uid" --regid="$gid" --init-groups -- "$@" ;;',
   '  dropin-write)',
-  '    service_ok "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; cat > "$tmp"; dropin_ok "$2" "$tmp"',
+  '    service_ok "$1"; agent_only "$1"; tmp=$(mktemp); trap \'rm -f "$tmp"\' EXIT; head -c 4096 > "$tmp"; dropin_ok "$2" "$tmp"',
   '    mkdir -p "$UNITS/$1.d"; install -m 644 "$tmp" "$UNITS/$1.d/$2" ;;',
   '  dropin-remove)',
-  '    service_ok "$1"; case "$2" in 10-metro-agent.conf|11-metro-vault.conf) ;; *) die "bad drop-in name";; esac',
+  `    service_ok "$1"; [ "$2" = ${VAULT_DROP_IN} ] || die "bad drop-in name"`,
   '    rm -f "$UNITS/$1.d/$2" ;;',
   '  daemon-reload) systemctl daemon-reload ;;',
   '  start-job)',
@@ -149,6 +161,11 @@ const ACTIONS = lines(
   '    install -m 600 "$cur" "$backups/crontab-root.$(date +%Y-%m-%dT%H-%M-%S).bak"',
   '    crontab -u root "$kept"; rm -f "$cur" "$kept" ;;',
   '  imds-block) imds_block ;;',
+  '  upgrade)',
+  '    [ "$#" -eq 1 ] || die "usage: upgrade <version>"',
+  '    case "$1" in *[!0-9A-Za-z.-]*|"") die "bad version";; esac',
+  '    printf %s "$1" | grep -Eqx "[0-9]{1,9}\\.[0-9]{1,9}\\.[0-9]{1,9}(-[0-9A-Za-z]{1,20}(\\.[0-9A-Za-z]{1,20}){0,4})?" || die "bad version"',
+  `    systemctl start --no-block "${UPGRADE_UNIT.replace('@.', '@$1.')}" ;;`,
   '  firewall-on) firewall_on ;;',
   '  firewall-off) firewall_off ;;',
   '  trust-ca)',

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/imds.ts

@@ -1,7 +1,6 @@
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import { log } from '@metro-labs/core/log';
-import { rootHelper, type HelperResult } from './privilege.js';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { rootHelper, rootStepHint, type HelperResult } from './privilege.js';
 
 export function blockImds(run: (args: string[]) => HelperResult = rootHelper): boolean {
   const result = run(['imds-block']);
@@ -10,7 +9,7 @@ export function blockImds(run: (args: string[]) => HelperResult = rootHelper): b
     return true;
   }
   log.warn(
-    { err: result.stderr.trim(), fix: `as root: ${join(homedir(), '.npm-global', 'bin', 'metro')} service install --user metro` },
+    { err: result.stderr.trim(), fix: rootStepHint(METRO_VERSION) },
     'imds: the agent can still read the instance metadata (setup data, instance role), since the root helper on this box predates the guard',
   );
   return false;

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/install.ts

@@ -2,7 +2,17 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { HELPER_PATH, helperScript, IMDS_UNIT, IMDS_UNIT_PATH, imdsUnitText, SUDOERS_PATH, sudoersText } from './helper-script.js';
+import {
+  HELPER_PATH,
+  helperScript,
+  IMDS_UNIT,
+  IMDS_UNIT_PATH,
+  imdsUnitText,
+  SUDOERS_PATH,
+  sudoersText,
+  UPGRADE_UNIT_PATH,
+  upgradeUnitText,
+} from './helper-script.js';
 import { AGENT_NAME } from '../agent-user/user.js';
 
 interface InstallPaths {
@@ -41,8 +51,28 @@ export function installImdsGuard(unit: string = IMDS_UNIT_PATH, run: Run = check
   run('systemctl', ['restart', IMDS_UNIT]);
 }
 
+const PLAIN_PATH = /^\/[A-Za-z0-9_./+-]+$/;
+
+export function installUpgradeUnit(node: string, unit: string = UPGRADE_UNIT_PATH, run: Run = checked): void {
+  if (!PLAIN_PATH.test(node)) throw new Error(`the root upgrade needs node by a plain absolute path, not '${node}'`);
+  writeFileSync(unit, upgradeUnitText(node), { mode: 0o644 });
+  chmodSync(unit, 0o644);
+  run('systemctl', ['daemon-reload']);
+}
+
+export function nodeArg(argv: string[]): string {
+  const at = argv.indexOf('--node');
+  const node = at < 0 ? undefined : argv[at + 1];
+  if (node === undefined) throw new Error('usage: install.ts --node <absolute path of the node that runs the root upgrade>');
+  return node;
+}
+
 if (import.meta.main) {
+  const node = nodeArg(process.argv.slice(2));
   installRootHelper();
   installImdsGuard();
-  process.stdout.write(`metro: wrote ${HELPER_PATH}, ${SUDOERS_PATH} and ${IMDS_UNIT_PATH}; only root and metro reach the instance metadata service\n`);
+  installUpgradeUnit(node);
+  process.stdout.write(
+    `metro: wrote ${HELPER_PATH}, ${SUDOERS_PATH}, ${IMDS_UNIT_PATH} and ${UPGRADE_UNIT_PATH}; only root and metro reach the instance metadata service, and the root side follows every update\n`,
+  );
 }

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/privilege.ts

@@ -46,3 +46,5 @@ export function mustHelper(args: string[], input?: string): string {
 }
 
 export const helperArgv = (args: string[]): [string, string[]] => ['sudo', ['-n', HELPER_PATH, ...args]];
+
+export const rootStepHint = (version: string): string => `as root, once: npx -y @stage-labs/metro@${version} service install --user metro`;

package/runtime/node_modules/@metro-labs/daemon/src/metro-user/root-follow.ts

@@ -0,0 +1,16 @@
+import { log } from '@metro-labs/core/log';
+import { METRO_VERSION } from '@metro-labs/core/version';
+import { rootHelper, rootStepHint, type HelperResult } from './privilege.js';
+
+export function followRelease(run: (args: string[]) => HelperResult = rootHelper, version: string = METRO_VERSION): boolean {
+  const result = run(['upgrade', version]);
+  if (result.status === 0) {
+    log.info({ version, journal: `journalctl -u metro-root-upgrade@${version}` }, 'root: asked the root side to follow this version');
+    return true;
+  }
+  log.warn(
+    { err: result.stderr.trim(), fix: rootStepHint(version) },
+    'root: the root side cannot follow updates by itself yet, since the root helper on this box predates it',
+  );
+  return false;
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.246"
+  "version": "0.1.0-beta.247"
 }