@stage-labs/metro 0.1.0-beta.28 → 0.1.0-beta.281

package/dist/provider-flags.js

@@ -0,0 +1,9 @@
+export const PROVIDER_FLAGS = [
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_MANTLE',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_USE_FOUNDRY',
+    'CLAUDE_CODE_USE_ANTHROPIC_AWS',
+    'CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD',
+    'CLAUDE_CODE_USE_GATEWAY',
+];

package/dist/root-release-io.js

@@ -0,0 +1,161 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { X509Certificate } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isRecord } from './background.js';
+import { ISSUER, isVersion, PUBLISHER, RELEASE_DIR } from './root-release.js';
+import { PACKAGE_NAME } from './version.js';
+const REGISTRY = 'https://registry.npmjs.org';
+const ENCODED = PACKAGE_NAME.replace('/', '%2F');
+const ROOT_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const SETUP = join('runtime', 'node_modules', '@metro-labs', 'daemon', 'src', 'metro-user', 'install.ts');
+const MAX_TARBALL = 64 * 1024 * 1024;
+const TIMEOUT_MS = 60_000;
+const isSigstore = (mod) => isRecord(mod) && typeof mod.verify === 'function';
+export function rootOwned(path) {
+    let at = realpathSync(path);
+    for (;;) {
+        const st = statSync(at);
+        if (st.uid !== 0 || (st.mode & 0o022) !== 0)
+            return false;
+        if (at === dirname(at))
+            return true;
+        at = dirname(at);
+    }
+}
+function mustBeRootOwned(path, what) {
+    if (!existsSync(path) || !rootOwned(path))
+        throw new Error(`${what} at ${path} is missing or not owned by root alone; refused`);
+    return path;
+}
+async function getJson(url) {
+    const res = await fetch(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    return res.json();
+}
+async function published(version) {
+    const body = await getJson(`${REGISTRY}/${ENCODED}`);
+    const tags = isRecord(body) && isRecord(body['dist-tags']) ? body['dist-tags'] : {};
+    const entry = isRecord(body) && isRecord(body.versions) ? body.versions[version] : undefined;
+    const dist = isRecord(entry) && isRecord(entry.dist) ? entry.dist : {};
+    if (typeof dist.tarball !== 'string' || typeof dist.integrity !== 'string')
+        throw new Error(`npm has no ${PACKAGE_NAME}@${version}`);
+    return { tags, tarball: dist.tarball, integrity: dist.integrity };
+}
+async function download(url) {
+    const res = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok)
+        throw new Error(`${url} answered ${String(res.status)}`);
+    if (Number(res.headers.get('content-length') ?? 0) > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    const bytes = Buffer.from(await res.arrayBuffer());
+    if (bytes.length > MAX_TARBALL)
+        throw new Error(`${url} is too large`);
+    return bytes;
+}
+function loadSigstore() {
+    const npm = mustBeRootOwned(join(dirname(dirname(process.execPath)), 'lib', 'node_modules', 'npm'), "npm's sigstore");
+    const mod = createRequire(join(npm, 'package.json'))('sigstore');
+    if (!isSigstore(mod))
+        throw new Error(`no sigstore verifier in ${npm}; refused`);
+    return mod;
+}
+function leafCertificate(bundle) {
+    const material = isRecord(bundle) && isRecord(bundle.verificationMaterial) ? bundle.verificationMaterial : {};
+    const chain = isRecord(material.x509CertificateChain) && Array.isArray(material.x509CertificateChain.certificates) ? material.x509CertificateChain.certificates : [];
+    const leaf = isRecord(material.certificate) ? material.certificate : chain[0];
+    return isRecord(leaf) && typeof leaf.rawBytes === 'string' ? leaf.rawBytes : null;
+}
+export function signedByPublisher(bundle) {
+    const raw = leafCertificate(bundle);
+    if (raw === null)
+        return false;
+    const names = new X509Certificate(Buffer.from(raw, 'base64')).subjectAltName?.split(', ') ?? [];
+    return names.includes(`URI:${PUBLISHER}`);
+}
+async function verifySignature(bundle) {
+    if (!signedByPublisher(bundle))
+        throw new Error(`the provenance was not signed for ${PUBLISHER}; refused`);
+    const sigstore = loadSigstore();
+    const tuf = mkdtempSync(join(tmpdir(), 'metro-tuf-'));
+    try {
+        await sigstore.verify(bundle, { certificateIdentityURI: PUBLISHER, certificateIssuer: ISSUER, tufCachePath: tuf });
+    }
+    catch (err) {
+        throw new Error(`the provenance signature does not check out: ${err instanceof Error ? err.message : String(err)}; refused`);
+    }
+    finally {
+        rmSync(tuf, { recursive: true, force: true });
+    }
+}
+function checked(file, args, cwd = '/') {
+    const run = spawnSync(file, args, { cwd, env: { PATH: ROOT_PATH }, stdio: ['ignore', 'inherit', 'inherit'] });
+    if (run.error !== undefined)
+        throw run.error;
+    if (run.status !== 0)
+        throw new Error(`${file} ${args.join(' ')} failed (exit ${String(run.status)})`);
+}
+function manifestVersion(dir) {
+    const file = join(dir, 'package.json');
+    if (!existsSync(file))
+        return null;
+    const raw = JSON.parse(readFileSync(file, 'utf8'));
+    return isRecord(raw) && raw.name === PACKAGE_NAME && typeof raw.version === 'string' && isVersion(raw.version) ? raw.version : null;
+}
+function unpack(tarball, version) {
+    const work = mkdtempSync(join(tmpdir(), 'metro-release-'));
+    const staged = `${RELEASE_DIR}.new`;
+    try {
+        const file = join(work, 'metro.tgz');
+        writeFileSync(file, tarball, { mode: 0o600 });
+        rmSync(staged, { recursive: true, force: true });
+        mkdirSync(staged, { recursive: true, mode: 0o755 });
+        checked('tar', ['-xzf', file, '-C', staged, '--strip-components=1', '--no-same-owner', '--no-same-permissions']);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+    if (manifestVersion(staged) !== version)
+        throw new Error(`the unpacked package is not ${PACKAGE_NAME}@${version}; refused`);
+    return staged;
+}
+function findBun() {
+    const found = ROOT_PATH.split(':')
+        .map((dir) => join(dir, 'bun'))
+        .find((path) => existsSync(path));
+    if (found === undefined)
+        throw new Error(`no bun on ${ROOT_PATH}`);
+    return mustBeRootOwned(found, 'bun');
+}
+function setup(dir) {
+    const node = mustBeRootOwned(process.execPath, 'node');
+    checked(findBun(), ['--no-install', join(dir, SETUP), '--node', node]);
+}
+function swap(staged) {
+    const old = `${RELEASE_DIR}.old`;
+    rmSync(old, { recursive: true, force: true });
+    if (existsSync(RELEASE_DIR))
+        renameSync(RELEASE_DIR, old);
+    renameSync(staged, RELEASE_DIR);
+    rmSync(old, { recursive: true, force: true });
+}
+export function realReleaseDeps() {
+    process.umask(0o022);
+    mkdirSync(dirname(RELEASE_DIR), { recursive: true, mode: 0o755 });
+    return {
+        installed: () => manifestVersion(RELEASE_DIR),
+        published,
+        download,
+        attestations: (version) => getJson(`${REGISTRY}/-/npm/v1/attestations/${ENCODED}@${version}`),
+        verifySignature,
+        unpack,
+        setup,
+        swap,
+        out: (line) => {
+            process.stderr.write(`metro root: ${line}\n`);
+        },
+    };
+}

package/dist/root-release.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { isRecord } from './background.js';
+import { compareVersions, PACKAGE_NAME } from './version.js';
+export const RELEASE_DIR = '/usr/local/lib/metro/release';
+export const PUBLISHER = 'https://github.com/bonustrack/metro/.github/workflows/publish-cli.yml@refs/heads/main';
+export const ISSUER = 'https://token.actions.githubusercontent.com';
+const REGISTRY = 'https://registry.npmjs.org';
+const PROVENANCE = 'https://slsa.dev/provenance/v1';
+const IN_TOTO = 'application/vnd.in-toto+json';
+const VERSION_RE = /^\d{1,9}\.\d{1,9}\.\d{1,9}(?:-[0-9A-Za-z]{1,20}(?:\.[0-9A-Za-z]{1,20}){0,4})?$/;
+export const isVersion = (raw) => VERSION_RE.test(raw);
+export const tarballUrl = (version) => `${REGISTRY}/${PACKAGE_NAME}/-/metro-${version}.tgz`;
+const subjectName = (version) => `pkg:npm/${PACKAGE_NAME.replace('@', '%40')}@${version}`;
+function provenanceBundle(body, version) {
+    const list = isRecord(body) && Array.isArray(body.attestations) ? body.attestations : [];
+    const entry = list.find((a) => isRecord(a) && a.predicateType === PROVENANCE);
+    if (!isRecord(entry) || !isRecord(entry.bundle))
+        throw new Error(`${PACKAGE_NAME}@${version} has no build provenance on npm; refused`);
+    return entry.bundle;
+}
+function statementOf(bundle) {
+    const envelope = bundle.dsseEnvelope;
+    if (!isRecord(envelope) || envelope.payloadType !== IN_TOTO || typeof envelope.payload !== 'string')
+        throw new Error('the provenance is not a signed in-toto statement; refused');
+    const statement = JSON.parse(Buffer.from(envelope.payload, 'base64').toString('utf8'));
+    if (!isRecord(statement))
+        throw new Error('the provenance statement is unreadable; refused');
+    return statement;
+}
+export function provenanceNames(statement, version, sha512) {
+    const subjects = Array.isArray(statement.subject) ? statement.subject : [];
+    return (statement.predicateType === PROVENANCE &&
+        subjects.some((s) => isRecord(s) && s.name === subjectName(version) && isRecord(s.digest) && s.digest.sha512 === sha512));
+}
+async function checkProvenance(version, tarball, deps) {
+    const bundle = provenanceBundle(await deps.attestations(version), version);
+    await deps.verifySignature(bundle);
+    const sha512 = createHash('sha512').update(tarball).digest('hex');
+    if (!provenanceNames(statementOf(bundle), version, sha512))
+        throw new Error(`the signed provenance does not name this tarball of ${PACKAGE_NAME}@${version}; refused`);
+}
+async function fetchChecked(version, trigger, deps) {
+    const published = await deps.published(version);
+    if (trigger === 'metro' && published.tags.beta !== version && published.tags.latest !== version)
+        throw new Error(`${version} is not what the beta or latest tag of ${PACKAGE_NAME} points to now; refused`);
+    if (published.tarball !== tarballUrl(version))
+        throw new Error(`npm names an unexpected tarball for ${version}: ${published.tarball}; refused`);
+    const tarball = await deps.download(published.tarball);
+    if (`sha512-${createHash('sha512').update(tarball).digest('base64')}` !== published.integrity)
+        throw new Error(`the tarball of ${version} does not match the sha512 npm publishes for it; refused`);
+    await checkProvenance(version, tarball, deps);
+    return tarball;
+}
+export async function installRelease(version, trigger, deps) {
+    if (!isVersion(version))
+        throw new Error(`'${version}' is not a ${PACKAGE_NAME} version`);
+    const have = deps.installed();
+    if (have !== null && compareVersions(version, have) <= 0) {
+        if (trigger === 'metro') {
+            deps.out(`the root side is at ${have}, and ${version} is not newer: nothing to do`);
+            return 'current';
+        }
+        deps.setup(RELEASE_DIR);
+        deps.out(`the root side stays at ${have} (it never goes back) and its root setup ran again`);
+        return 'refreshed';
+    }
+    deps.out(`checking ${PACKAGE_NAME}@${version} (npm sha512 and the GitHub provenance of ${PUBLISHER})`);
+    const tarball = await fetchChecked(version, trigger, deps);
+    const staged = deps.unpack(tarball, version);
+    deps.setup(staged);
+    deps.swap(staged);
+    deps.out(`the root side is now ${PACKAGE_NAME}@${version}, verified, in ${RELEASE_DIR}`);
+    return 'installed';
+}

package/dist/route.js

@@ -0,0 +1,66 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentsDir } from './local.js';
+const PROVIDERS = new Set(['bedrock', 'openrouter', 'codex', 'gemini']);
+const ANTHROPIC = 'anthropic';
+const text = (value) => (typeof value === 'string' ? value : '');
+function routedIn(cfg) {
+    if (typeof cfg !== 'object' || cfg === null)
+        return null;
+    const { route, connections } = cfg;
+    if (!Array.isArray(connections))
+        return null;
+    const conn = connections.find((c) => typeof c === 'object' && c !== null && c.id === route);
+    if (typeof conn !== 'object' || conn === null)
+        return null;
+    const model = text(conn.model);
+    return model === '' ? null : { provider: text(conn.provider), model };
+}
+function routed(dir) {
+    const path = join(dir, 'model.json');
+    if (!existsSync(path))
+        return null;
+    try {
+        return routedIn(JSON.parse(readFileSync(path, 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+const prefixed = (found) => (found !== null && PROVIDERS.has(found.provider) ? `${found.provider}:${found.model}` : null);
+export const currentRoute = (dir = agentsDir()) => prefixed(routed(dir));
+export function currentModel(dir = agentsDir()) {
+    const found = routed(dir);
+    return found?.provider === ANTHROPIC ? found.model : prefixed(found);
+}
+export function routeModelEnv(env, route) {
+    if (route === null || (env.ANTHROPIC_MODEL ?? '').trim() !== '')
+        return env;
+    return { ...env, ANTHROPIC_MODEL: route };
+}
+export const permissionMode = (dir = agentsDir()) => (setupField(dir, 'permissionMode') === 'bypass' ? 'bypass' : 'auto');
+function setupField(dir, field) {
+    const path = join(dir, 'claude-setup.json');
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const state = JSON.parse(readFileSync(path, 'utf8'));
+        return state[field];
+    }
+    catch {
+        return undefined;
+    }
+}
+export const harnessRunner = (dir = agentsDir()) => (setupField(dir, 'runner') === 'sdk' ? 'sdk' : 'cli');
+export function systemPrompt(dir = agentsDir()) {
+    const path = join(dir, 'system-prompt.md');
+    if (!existsSync(path))
+        return null;
+    try {
+        const text = readFileSync(path, 'utf8').trim();
+        return text === '' ? null : text;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/runtime-install.js

@@ -0,0 +1,114 @@
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { localStations } from './local.js';
+import { STORE_ENTRY, daemonEntry, findBun, runtimeDir } from './runtime.js';
+const MANIFEST_FILE = 'stations.json';
+const MARKETPLACE = 'marketplace';
+const METRO_SOURCES = join('node_modules', '@metro-labs');
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+export function runtimeStore() {
+    const env = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+    return env === '' ? join(homedir(), '.metro', 'runtime') : env;
+}
+const isRecord = (v) => typeof v === 'object' && v !== null;
+export const ranges = (raw) => isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === 'string'))
+    : {};
+export function readManifest(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!isRecord(raw))
+        throw new Error(`${path} is not a runtime manifest`);
+    const stations = isRecord(raw.stations) ? raw.stations : {};
+    return {
+        core: ranges(raw.core),
+        stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+        ...(raw.patchedDependencies === undefined ? {} : { patchedDependencies: ranges(raw.patchedDependencies) }),
+    };
+}
+export function dependenciesFor(manifest, stations) {
+    const out = { ...manifest.core };
+    for (const station of new Set(stations))
+        Object.assign(out, manifest.stations[station] ?? {});
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+function packageText(deps, patches) {
+    const patchedDependencies = Object.fromEntries(Object.entries(deps).flatMap(([name, version]) => {
+        const key = `${name}@${version}`;
+        const path = patches[key];
+        return path === undefined ? [] : [[key, path]];
+    }));
+    return `${JSON.stringify({
+        name: 'metro-runtime',
+        private: true,
+        dependencies: deps,
+        ...(Object.keys(patchedDependencies).length === 0 ? {} : { patchedDependencies }),
+    }, null, 2)}\n`;
+}
+export function readOrNull(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function copyMarketplace(sources, store) {
+    const staged = join(sources, MARKETPLACE);
+    if (!existsSync(staged))
+        return false;
+    cpSync(staged, join(store, MARKETPLACE), { recursive: true });
+    return true;
+}
+function syncSources(sources, store) {
+    const shim = join(sources, STORE_ENTRY);
+    if (existsSync(shim))
+        copyFileSync(shim, join(store, STORE_ENTRY));
+    const stamp = readOrNull(join(sources, 'runtime.json'));
+    if (stamp !== null && readOrNull(join(store, 'runtime.json')) === stamp)
+        return existsSync(join(store, MARKETPLACE)) ? false : copyMarketplace(sources, store);
+    rmSync(join(store, METRO_SOURCES), { recursive: true, force: true });
+    cpSync(join(sources, METRO_SOURCES), join(store, METRO_SOURCES), { recursive: true });
+    rmSync(join(store, MARKETPLACE), { recursive: true, force: true });
+    copyMarketplace(sources, store);
+    if (stamp !== null)
+        writeFileSync(join(store, 'runtime.json'), stamp);
+    return true;
+}
+export function installDependencies(store, deps, bun, log, patches = {}) {
+    const wanted = packageText(deps, patches);
+    const marker = join(store, 'node_modules', '.metro-installed');
+    if (existsSync(marker) && readOrNull(join(store, 'package.json')) === wanted)
+        return false;
+    rmSync(marker, { force: true });
+    writeFileSync(join(store, 'package.json'), wanted);
+    log(`Installing the channel SDKs this machine needs into ${store}`);
+    const run = spawnSync(bun, ['install', '--no-summary', '--no-progress'], {
+        cwd: store,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        timeout: INSTALL_TIMEOUT_MS,
+    });
+    if (run.error !== undefined || run.status !== 0)
+        throw new Error(`bun install failed in ${store}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+    writeFileSync(marker, `${new Date().toISOString()}\n`);
+    return true;
+}
+export function prepareRuntime(opts = {}) {
+    const sources = opts.sources ?? runtimeDir();
+    const manifestPath = join(sources, MANIFEST_FILE);
+    const manifest = readManifest(manifestPath);
+    const store = opts.store ?? runtimeStore();
+    const log = opts.log ??
+        ((line) => {
+            process.stderr.write(`${line}\n`);
+        });
+    mkdirSync(join(store, 'trains'), { recursive: true });
+    syncSources(sources, store);
+    for (const path of Object.values(manifest.patchedDependencies ?? {})) {
+        mkdirSync(dirname(join(store, path)), { recursive: true });
+        copyFileSync(join(sources, path), join(store, path));
+    }
+    installDependencies(store, dependenciesFor(manifest, localStations(opts.agents)), opts.bun ?? findBun(), log, manifest.patchedDependencies);
+    return { dir: store, entry: daemonEntry(store), trains: join(store, 'trains'), manifest: manifestPath };
+}

package/dist/runtime.js

@@ -1,12 +1,10 @@
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { metroUrl } from './store.js';
 const AGENT_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
-const SERVER_ENTRY = join('node_modules', '@metro-labs', 'mcp', 'src', 'server.ts');
+export const STORE_ENTRY = 'server.ts';
+export const daemonEntry = (dir) => join(dir, STORE_ENTRY);
 export class MissingRuntime extends Error {
 }
 export function runtimeDir() {
@@ -14,11 +12,11 @@ export function runtimeDir() {
     const dir = explicit !== undefined && explicit !== ''
         ? explicit
         : join(dirname(dirname(fileURLToPath(import.meta.url))), 'runtime');
-    if (!existsSync(join(dir, SERVER_ENTRY)))
+    if (!existsSync(daemonEntry(dir)))
         throw new MissingRuntime(`no metro daemon at ${dir}. Reinstall with: npm i -g @stage-labs/metro@beta`);
     return dir;
 }
-export class MissingBun extends Error {
+class MissingBun extends Error {
 }
 export function assertAgentId(id) {
     if (id === undefined || !AGENT_RE.test(id))
@@ -28,54 +26,15 @@ export function assertAgentId(id) {
 export function findBun() {
     const found = spawnSync('bun', ['--version'], { stdio: 'ignore' });
     if (found.error !== undefined || found.status !== 0)
-        throw new MissingBun('metro start needs Bun, which is not on PATH.\n' +
+        throw new MissingBun('metro serve needs Bun, which is not on PATH.\n' +
             'Install it with:  curl -fsSL https://bun.sh/install | bash');
     return 'bun';
 }
-function tokenPath(agentId) {
-    const xdg = process.env.XDG_CONFIG_HOME?.trim();
-    const base = xdg === undefined || xdg === '' ? join(homedir(), '.config') : xdg;
-    return join(base, 'metro', `runtime-${agentId}.json`);
-}
-export function readRunToken(agentId) {
-    const fromEnv = process.env.METRO_RUN_TOKEN?.trim();
-    if (fromEnv !== undefined && fromEnv !== '')
-        return fromEnv;
-    try {
-        const parsed = JSON.parse(readFileSync(tokenPath(agentId), 'utf8'));
-        if (typeof parsed.token !== 'string' || parsed.token === '')
-            return null;
-        return parsed.url === metroUrl() ? parsed.token : null;
-    }
-    catch {
-        return null;
-    }
-}
-export function writeRunToken(agentId, token) {
-    const path = tokenPath(agentId);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, JSON.stringify({ token, url: metroUrl() }, null, 2));
-    chmodSync(path, 0o600);
-}
 export const localPort = () => Number(process.env.METRO_WEBHOOK_PORT) || 8420;
 export const localUrl = () => `http://127.0.0.1:${String(localPort())}`;
-export function daemonPlan(opts) {
-    return {
-        command: findBun(),
-        args: [SERVER_ENTRY],
-        cwd: opts.dir,
-        env: {
-            ...process.env,
-            METRO_RUN_TOKEN: opts.token,
-            METRO_AGENT: opts.agentId,
-            METRO_URL: metroUrl(),
-            METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
-            METRO_TRAINS_DIR: join(opts.dir, 'trains'),
-        },
-    };
-}
-export function runDaemon(agentId, plan) {
-    process.stderr.write(`Starting metro for ${agentId}\n`);
+export const RESTART_CODE = 75;
+export const HOLD_CODE = 76;
+function spawnOnce(plan) {
     const child = spawn(plan.command, plan.args, {
         cwd: plan.cwd,
         env: plan.env,
@@ -84,11 +43,29 @@ export function runDaemon(agentId, plan) {
     const relay = (sig) => () => {
         child.kill(sig);
     };
-    process.on('SIGINT', relay('SIGINT'));
-    process.on('SIGTERM', relay('SIGTERM'));
+    const onInt = relay('SIGINT');
+    const onTerm = relay('SIGTERM');
+    process.on('SIGINT', onInt);
+    process.on('SIGTERM', onTerm);
     return new Promise((resolve) => {
         child.on('exit', (code) => {
+            process.off('SIGINT', onInt);
+            process.off('SIGTERM', onTerm);
             resolve(code ?? 0);
         });
     });
 }
+export async function spawnPlan(plan, hold) {
+    for (;;) {
+        const code = await spawnOnce(plan());
+        if (code === RESTART_CODE) {
+            process.stderr.write('metro was updated; restarting the daemon on the new version\n');
+            continue;
+        }
+        if (code !== HOLD_CODE || hold === undefined)
+            return code;
+        if ((await hold()) === 'exit')
+            return 0;
+        process.stderr.write('starting the daemon again\n');
+    }
+}