@stage-labs/metro 0.1.0-beta.3 → 0.1.0-beta.300

package/runtime/node_modules/@metro-labs/daemon/src/claude/github-skills.ts

@@ -0,0 +1,259 @@
+import { existsSync, readFileSync as readLocal, statSync as statLocal } from 'node:fs';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { log } from '@metro-labs/core/log';
+import { isRecord } from '@metro-labs/core/is-record';
+import { writeSecure } from '@metro-labs/core/secure-fs';
+import { SKILL_HASH, SKILL_MANIFEST_MAX, skillGeneration, skillRelease, skillSourceRoot, type SkillGeneration } from '@metro-labs/core/skill-source';
+import { ApiError } from '@metro-labs/http/api-error';
+import { readFileSync, statSync } from '../agent-user/agent-fs.js';
+import { receiveHomeFile, writeHomeText } from '../agent-user/home-fs.js';
+import { agentsDir } from '../agents/files.js';
+import { claudeDir } from './files.js';
+import { readSetupState } from './setup-state.js';
+import { GitHubFailure, GitHubReader } from './github-fetch.js';
+import { githubSource, validatedGeneration } from './github-validate.js';
+import type { ClaudeSkill } from './skills.js';
+
+type Configuration = ReturnType<typeof githubSource>;
+interface Stored {
+  source: Configuration | null;
+  prepared: SkillGeneration | null;
+  etag: string | null;
+  checkedAt: string | null;
+  retryAt: number;
+  problem: string | null;
+  rateLimit: number;
+  repositoryId: number | null;
+}
+export interface GitHubSkillsDeps {
+  agents: string;
+  claude: string;
+  sdk(): boolean;
+  request?: (url: string, init: RequestInit) => Promise<Response>;
+}
+const EMPTY: Stored = { source: null, prepared: null, etag: null, checkedAt: null, retryAt: 0, problem: null, rateLimit: 0, repositoryId: null };
+const savedString = (value: unknown): string | null => typeof value === 'string' ? value : null;
+const savedNumber = (value: unknown): number => typeof value === 'number' && Number.isFinite(value) ? value : 0;
+
+function readStored(path: string): Stored {
+  if (!existsSync(path)) return { ...EMPTY };
+  try {
+    if (statLocal(path).size > SKILL_MANIFEST_MAX * 2) throw new Error('size');
+    const raw: unknown = JSON.parse(readLocal(path, 'utf8'));
+    if (!isRecord(raw)) throw new Error('shape');
+    return {
+      source: raw.source === null ? null : githubSource(raw.source),
+      prepared: raw.prepared === null ? null : skillGeneration(raw.prepared),
+      etag: savedString(raw.etag), checkedAt: savedString(raw.checkedAt),
+      retryAt: savedNumber(raw.retryAt), rateLimit: savedNumber(raw.rateLimit), problem: savedString(raw.problem),
+      repositoryId: typeof raw.repositoryId === 'number' ? raw.repositoryId : null,
+    };
+  } catch { throw new Error('The saved GitHub skills source is unreadable. Restore it before changing the source.'); }
+}
+
+function agentJson(path: string): unknown {
+  try {
+    if (statSync(path).size > SKILL_MANIFEST_MAX) return null;
+    return JSON.parse(readFileSync(path, 'utf8')) as unknown;
+  } catch { return null; }
+}
+
+export class GitHubSkills {
+  private readonly path: string;
+  readonly root: string;
+  private stored: Stored = { ...EMPTY };
+  private unreadable = false;
+  private busy = false;
+  private epoch = 0;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+
+  constructor(private readonly deps: GitHubSkillsDeps) {
+    this.path = join(deps.agents, 'github-skills.json');
+    this.root = skillSourceRoot(deps.claude);
+    try { this.stored = readStored(this.path); }
+    catch { this.unreadable = true; }
+  }
+
+  private readable(): void {
+    if (!this.unreadable) return;
+    this.stored = readStored(this.path);
+    this.unreadable = false;
+  }
+
+  private save(): void {
+    this.readable();
+    writeSecure(this.path, JSON.stringify(this.stored));
+  }
+
+  private activation(): { generation: string | null; appliedAt: string | null; problem: string | null; shadowed: string[] } {
+    const raw = agentJson(join(this.root, 'status.json'));
+    if (!isRecord(raw)) return { generation: null, appliedAt: null, problem: null, shadowed: [] };
+    return {
+      generation: typeof raw.generation === 'string' && SKILL_HASH.test(raw.generation) ? raw.generation : null,
+      appliedAt: typeof raw.appliedAt === 'string' ? raw.appliedAt : null,
+      problem: typeof raw.problem === 'string' ? raw.problem.slice(0, 300) : null,
+      shadowed: Array.isArray(raw.shadowed) ? raw.shadowed.filter((name): name is string => typeof name === 'string').slice(0, 64) : [],
+    };
+  }
+
+  private loaded(activation = this.activation()): SkillGeneration | null {
+    const id = activation.generation;
+    if (id === null) return null;
+    try { return skillGeneration(agentJson(join(skillRelease(this.root, id), 'manifest.json'))); }
+    catch { return null; }
+  }
+
+  view(activation = this.activation(), loaded = this.loaded(activation)): object {
+    const { source, prepared, checkedAt, problem } = this.stored;
+    return {
+      supported: this.deps.sdk(),
+      source: source === null ? null : { repository: source.repository, ref: source.ref, folder: source.folder, hasToken: true },
+      checking: this.busy, checkedAt, problem: this.unreadable ? 'The saved GitHub source is unreadable. Restore its configuration before changing it. Local skills are still available.' : problem,
+      prepared: prepared === null ? null : { generation: prepared.id, source: prepared.source, skillCount: prepared.skills.length },
+      loaded: loaded?.source ?? null, activation,
+      pending: prepared !== null && prepared.id !== activation.generation,
+    };
+  }
+
+  listing(): { rows: ClaudeSkill[]; skillSource: object } {
+    const activation = this.activation();
+    const loaded = this.loaded(activation);
+    return { rows: this.rows(activation, loaded), skillSource: this.view(activation, loaded) };
+  }
+
+  rows(activation = this.activation(), loaded = this.loaded(activation)): ClaudeSkill[] {
+    if (loaded === null) return [];
+    const origin = loaded.source;
+    const shadowed = activation.shadowed;
+    return loaded.skills.map((skill) => ({
+      id: `github:${skill.name}`, name: skill.name, title: skill.name, description: skill.description,
+      path: join(skillRelease(this.root, loaded.id), 'skills', skill.name, 'SKILL.md'), editable: false,
+      updatedAt: loaded.createdAt, managed: true, shadowed: shadowed.includes(skill.name),
+      ...(origin === null ? {} : { github: { repository: origin.repository, commit: origin.commit, folder: origin.folder } }),
+    }));
+  }
+
+  read(id: string): ClaudeSkill & { text: string } {
+    const row = this.rows().find((skill) => skill.id === id);
+    if (row === undefined) throw new ApiError('no such skill', 404);
+    if (statSync(row.path).size > 256 * 1024) throw new ApiError('The managed skill changed on disk. Sync it again.', 409);
+    return { ...row, text: readFileSync(row.path, 'utf8') };
+  }
+
+  async configure(raw: unknown): Promise<object> {
+    if (!this.deps.sdk()) throw new ApiError('GitHub skills require the Agent SDK runner. Local skills are unchanged.', 409);
+    if (this.busy) throw new ApiError('A skills sync is already running. Try again when it finishes.', 409);
+    const source = githubSource(raw);
+    this.readable();
+    const loaded = this.loaded();
+    this.epoch += 1;
+    this.stored = { ...this.stored, source, prepared: loaded, etag: null, retryAt: 0, problem: null, repositoryId: null };
+    if (loaded === null) await this.publish(validatedGeneration(null, null), new Map(), this.epoch);
+    else { this.save(); this.offer(); }
+    await this.sync(true);
+    return this.view();
+  }
+
+  async remove(): Promise<object> {
+    this.readable();
+    this.epoch += 1;
+    this.stored = { ...EMPTY };
+    this.save();
+    await this.publish(validatedGeneration(null, null), new Map(), this.epoch);
+    return this.view();
+  }
+
+  private waiting(force: boolean): boolean {
+    if (Date.now() < this.stored.rateLimit) return true;
+    if (force) return false;
+    return Date.now() < this.stored.retryAt || (this.stored.prepared !== null && this.stored.prepared.id !== this.activation().generation);
+  }
+
+  private reader(source: Configuration, known: SkillGeneration['source'], force: boolean): ReturnType<GitHubReader['snapshot']> {
+    return new GitHubReader(source, source.token, this.deps.request).snapshot(this.stored.repositoryId, force ? null : known?.commit ?? null, force ? null : this.stored.etag);
+  }
+
+  private async fetch(source: Configuration, epoch: number, force: boolean): Promise<void> {
+    const previous = this.stored.prepared?.source;
+    const same = previous?.repository === source.repository && previous.ref === source.ref && previous.folder === source.folder;
+    const known = same ? previous : null;
+    const snapshot = await this.reader(source, known, force);
+    if (epoch !== this.epoch) return;
+    if (snapshot !== null) {
+      const generation = validatedGeneration(source, snapshot);
+      this.stored.etag = snapshot.etag;
+      this.stored.repositoryId = snapshot.repositoryId;
+      await this.publish(generation, snapshot.files, epoch);
+      if (epoch !== this.epoch) return;
+    }
+    this.stored.checkedAt = new Date().toISOString();
+    this.stored.problem = null;
+    this.stored.retryAt = Date.now() + 60_000;
+  }
+
+  async sync(force = false): Promise<void> {
+    if (force && !this.deps.sdk()) throw new ApiError('GitHub skills require the Agent SDK runner. Local skills are unchanged.', 409);
+    this.readable();
+    this.offer();
+    const source = this.stored.source;
+    if (source === null || this.busy || !this.deps.sdk() || this.waiting(force)) return;
+    const epoch = this.epoch;
+    this.busy = true;
+    try { await this.fetch(source, epoch, force); }
+    catch (err) {
+      if (epoch !== this.epoch) return;
+      this.failure(err);
+    } finally {
+      this.busy = false;
+      this.save();
+    }
+  }
+
+  private failure(err: unknown): void {
+    this.stored.problem = err instanceof GitHubFailure ? err.message : 'The repository failed skill validation or staging. Keep one folder per skill, safe metadata and regular files. The loaded skills are kept.';
+    this.stored.retryAt = err instanceof GitHubFailure ? err.retryAt : Date.now() + 5 * 60_000;
+    if (err instanceof GitHubFailure && err.rateLimited) this.stored.rateLimit = err.retryAt;
+    this.stored.checkedAt = new Date().toISOString();
+  }
+
+  private offer(): void {
+    const generation = this.stored.prepared;
+    if (generation === null) return;
+    const pending = agentJson(join(this.root, 'pending.json'));
+    if (isRecord(pending) && pending.id === generation.id) return;
+    writeHomeText(join(this.root, 'pending.json'), JSON.stringify(generation), 0o600);
+  }
+
+  private async publish(generation: SkillGeneration, files: Map<string, Buffer>, epoch: number): Promise<void> {
+    const release = skillRelease(this.root, generation.id);
+    const deadline = Date.now() + 120_000;
+    for (const [path, bytes] of files) {
+      if (epoch !== this.epoch) return;
+      if (Date.now() > deadline) throw new Error('Staging skills timed out.');
+      const mode = generation.files.find((file) => file.path === path)?.executable === true ? 0o700 : 0o600;
+      await receiveHomeFile(join(release, 'skills', path), Readable.from(bytes), mode);
+    }
+    if (epoch !== this.epoch) return;
+    writeHomeText(join(release, 'manifest.json'), JSON.stringify(generation), 0o600);
+    this.stored.prepared = generation;
+    this.save();
+    this.offer();
+  }
+
+  watch(): void {
+    if (this.timer !== null) return;
+    const tick = (): void => {
+      this.sync().catch(() => { log.warn('github-skills: could not save sync state'); });
+      this.timer = setTimeout(tick, 60_000 + Math.floor(Math.random() * 5_000));
+      this.timer.unref();
+    };
+    tick();
+  }
+}
+
+let current: GitHubSkills | null = null;
+export function githubSkills(): GitHubSkills {
+  current ??= new GitHubSkills({ agents: agentsDir(), claude: claudeDir(), sdk: () => readSetupState(agentsDir()).runner === 'sdk' });
+  return current;
+}

package/runtime/node_modules/@metro-labs/daemon/src/claude/github-validate.ts

@@ -0,0 +1,53 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { isRecord } from '@metro-labs/core/is-record';
+import { SKILL_NAME, skillGeneration, type SkillGeneration, type SkillSource } from '@metro-labs/core/skill-source';
+import { ApiError } from '@metro-labs/http/api-error';
+import type { GitHubSnapshot } from './github-fetch.js';
+
+const FIELDS = new Set(['name', 'description', 'argument-hint', 'disable-model-invocation', 'user-invocable']);
+export const skillDigest = (bytes: string | Uint8Array): string => createHash('sha256').update(bytes).digest('hex');
+
+function validRef(value: unknown): value is string {
+  return typeof value === 'string' && value.length <= 200 && /^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(value) && !value.includes('..') && !value.includes('//');
+}
+
+function validFolder(value: unknown): value is string {
+  if (typeof value !== 'string' || value.length > 240) return false;
+  if (value === '') return true;
+  const parts = value.split('/');
+  return parts.length <= 6 && parts.every((part) => /^[A-Za-z0-9._-]{1,80}$/.test(part) && part !== '.' && part !== '..');
+}
+
+export function githubSource(raw: unknown): SkillSource & { token: string } {
+  if (!isRecord(raw) || typeof raw.repository !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(raw.repository)) throw new ApiError('Use a GitHub repository in owner/repository form.', 400);
+  if (!validRef(raw.ref)) throw new ApiError('Use a branch, tag or full commit SHA.', 400);
+  if (!validFolder(raw.folder)) throw new ApiError('Use a relative skills folder, or leave it empty for the repository root.', 400);
+  if (typeof raw.token !== 'string' || !/^github_pat_[A-Za-z0-9_]{20,240}$/.test(raw.token)) throw new ApiError('Use a fine-grained GitHub token with Contents read access to this repository only.', 400);
+  return { repository: raw.repository, ref: raw.ref, folder: raw.folder, token: raw.token };
+}
+
+function passiveMetadata(meta: Record<string, unknown>): void {
+  if (Object.keys(meta).some((key) => !FIELDS.has(key))) throw new Error('Unsupported skill metadata. Only name, description, argument-hint, disable-model-invocation and user-invocable are allowed. Hooks, tool grants, model changes and agents are not imported.');
+  if (['disable-model-invocation', 'user-invocable'].some((key) => key in meta && typeof meta[key] !== 'boolean') || ('argument-hint' in meta && typeof meta['argument-hint'] !== 'string')) throw new Error('Invalid skill metadata types.');
+}
+
+function skillMetadata(name: string, bytes: Buffer): { name: string; description: string } {
+  const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+  const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+  if (match === null || /!`|\0/.test(text)) throw new Error('A skill needs YAML frontmatter. Shell substitutions are not supported.');
+  const meta: unknown = Bun.YAML.parse(match[1] ?? '');
+  if (!isRecord(meta) || meta.name !== name || !SKILL_NAME.test(name) || typeof meta.description !== 'string' || meta.description.trim() === '' || meta.description.length > 1024) throw new Error('A skill needs a name matching its folder and a description of up to 1024 characters.');
+  passiveMetadata(meta);
+  return { name, description: meta.description };
+}
+
+export function validatedGeneration(source: SkillSource | null, snapshot: GitHubSnapshot | null): SkillGeneration {
+  const files = snapshot?.files ?? new Map<string, Buffer>();
+  const skills = [...files].filter(([path]) => path.endsWith('/SKILL.md')).map(([path, bytes]) => skillMetadata(path.split('/')[0] ?? '', bytes));
+  const manifest = {
+    source: source === null || snapshot === null ? null : { repository: source.repository, ref: source.ref, folder: source.folder, repositoryId: snapshot.repositoryId, commit: snapshot.commit },
+    skills,
+    files: [...files].map(([path, bytes]) => ({ path, size: bytes.byteLength, sha256: skillDigest(bytes), ...(snapshot?.executables?.includes(path) === true ? { executable: true } : {}) })),
+  };
+  return skillGeneration({ ...manifest, id: skillDigest(randomUUID()), createdAt: new Date().toISOString() });
+}

package/runtime/node_modules/@metro-labs/daemon/src/claude/login.ts

@@ -0,0 +1,242 @@
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { markOnboardingDone } from './onboarding.js';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, asAgent, claudeBin } from '../agent-user/user.js';
+
+const LOGIN_ARGS = ['auth', 'login', '--claudeai'];
+const STATUS_COMMAND = ['auth', 'status', '--json'];
+const TTL_MS = 10 * 60_000;
+const OUTPUT_MAX = 8_000;
+const COLS = 100;
+const ROWS = 40;
+const ESC = String.fromCharCode(27);
+const CSI = /^\[[0-9;?]*[a-zA-Z]/;
+const URL_RE = /https:\/\/[^\s"'`]+/g;
+
+type LoginState = 'pending' | 'done' | 'failed';
+
+export interface LoginView {
+  id: string;
+  state: LoginState;
+  url: string | null;
+  output: string;
+  error: string | null;
+}
+
+export interface LoginTarget {
+  key: string;
+  env: Record<string, string>;
+  settle: (ok: boolean) => Promise<string | null>;
+}
+
+interface Live {
+  id: string;
+  startedAt: number;
+  state: LoginState;
+  output: string;
+  error: string | null;
+  target: LoginTarget | null;
+  write: (text: string) => void;
+  kill: () => void;
+}
+
+export interface LoginDeps {
+  command?: string[];
+}
+
+let live: Live | null = null;
+
+export function plainText(raw: string): string {
+  return raw
+    .split(ESC)
+    .map((part, index) => (index === 0 ? part : part.replace(CSI, '')))
+    .join('');
+}
+
+export function loginUrlIn(output: string): string | null {
+  const found = output.match(URL_RE) ?? [];
+  const trimmed = found.map((url) => url.replace(/[.,)]+$/, ''));
+  return trimmed.find((url) => url.includes('claude.ai') || url.includes('anthropic.com')) ?? trimmed[0] ?? null;
+}
+
+const view = (session: Live): LoginView => ({
+  id: session.id,
+  state: session.state,
+  url: loginUrlIn(session.output),
+  output: session.output,
+  error: session.error,
+});
+
+function sweep(now: number): void {
+  if (live !== null && live.state !== 'pending') return;
+  if (live !== null && now - live.startedAt > TTL_MS) {
+    live.kill();
+    live = null;
+  }
+}
+
+const CHECK_MS = 30_000;
+
+interface Checked<T> {
+  at: number;
+  value: T;
+}
+
+const checks: { installed?: Checked<boolean>; account?: Checked<ClaudeAccount> } = {};
+
+function remembered<T>(slot: Checked<T> | undefined, read: () => T, keep: (c: Checked<T>) => void): T {
+  const now = Date.now();
+  if (slot !== undefined && now - slot.at < CHECK_MS) return slot.value;
+  const value = read();
+  keep({ at: now, value });
+  return value;
+}
+
+function forgetClaudeChecks(): void {
+  delete checks.installed;
+  delete checks.account;
+}
+
+export function claudeInstalled(): boolean {
+  return remembered(checks.installed, () => {
+    const run = spawnSync(...asAgent(claudeBin(), ['--version']), { stdio: 'ignore' });
+    return run.error === undefined && run.status === 0;
+  }, (c) => {
+    checks.installed = c;
+  });
+}
+
+export interface ClaudeAccount {
+  signedIn: boolean;
+  account: string | null;
+  plan: string | null;
+}
+
+const SIGNED_OUT: ClaudeAccount = { signedIn: false, account: null, plan: null };
+
+export function claudeAccount(): ClaudeAccount {
+  return remembered(checks.account, () => claudeAccountIn({}), (c) => {
+    checks.account = c;
+  });
+}
+
+const textOf = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+export function claudeAccountIn(env: Record<string, string>): ClaudeAccount {
+  const run = spawnSync(...asAgent(claudeBin(), STATUS_COMMAND, env), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, ...env } });
+  if (run.error !== undefined || typeof run.stdout !== 'string') return SIGNED_OUT;
+  try {
+    const parsed: unknown = JSON.parse(run.stdout);
+    if (!isRecord(parsed)) return SIGNED_OUT;
+    const account = textOf(parsed.email) ?? textOf(parsed.organization) ?? textOf(parsed.orgName);
+    return { signedIn: parsed.authenticated === true || parsed.loggedIn === true || account !== null, account, plan: textOf(parsed.subscriptionType) };
+  } catch {
+    return SIGNED_OUT;
+  }
+}
+
+function note(session: Live, chunk: string): void {
+  const next = session.output + plainText(chunk);
+  session.output = next.length > OUTPUT_MAX ? next.slice(next.length - OUTPUT_MAX) : next;
+}
+
+async function verdict(session: Live, code: number): Promise<string | null> {
+  const problem = code === 0 ? null : `the login ended with status ${String(code)}`;
+  if (session.target === null) return problem;
+  try {
+    return (await session.target.settle(problem === null)) ?? problem;
+  } catch (err) {
+    return errMsg(err);
+  }
+}
+
+function runningFor(target: LoginTarget | null): Live | null {
+  if (live === null || live.state !== 'pending') return null;
+  if (live.target?.key === target?.key) return live;
+  live.kill();
+  live = null;
+  return null;
+}
+
+export function startClaudeLogin(deps: LoginDeps = {}, now = Date.now(), target: LoginTarget | null = null): LoginView {
+  sweep(now);
+  const running = runningFor(target);
+  if (running !== null) return view(running);
+  const env = { TERM: 'xterm-256color', ...target?.env };
+  const command = deps.command ?? agentCommand([claudeBin(), ...LOGIN_ARGS], env);
+  const session: Live = {
+    id: randomBytes(9).toString('base64url'),
+    startedAt: now,
+    state: 'pending',
+    output: '',
+    error: null,
+    target,
+    write: () => undefined,
+    kill: () => undefined,
+  };
+  const terminal = new Bun.Terminal({
+    cols: COLS,
+    rows: ROWS,
+    data: (_term, chunk: Uint8Array) => {
+      note(session, Buffer.from(chunk).toString('utf8'));
+    },
+  });
+  const proc = Bun.spawn(command, { terminal, env: { ...process.env, ...env } });
+  session.write = (text: string) => {
+    terminal.write(Buffer.from(`${text}\r`, 'utf8'));
+  };
+  session.kill = () => {
+    proc.kill();
+    terminal.close();
+  };
+  proc.exited
+    .then(async (code) => {
+      session.write = () => undefined;
+      terminal.close();
+      forgetClaudeChecks();
+      session.error = await verdict(session, code);
+      session.state = session.error === null ? 'done' : 'failed';
+      const onboarding = session.error === null ? markOnboardingDone() : 'skipped';
+      log.info({ state: session.state, onboarding, own: session.target !== null }, 'claude-login: the official login finished');
+    })
+    .catch((err: unknown) => {
+      session.state = 'failed';
+      session.error = errMsg(err);
+    });
+  live = session;
+  log.info({ command: command[0] }, 'claude-login: started');
+  return view(session);
+}
+
+function current(id: string): Live {
+  const session = live;
+  if (session?.id !== id) throw new ApiError('that sign-in is over; start another one', 404);
+  return session;
+}
+
+export function claudeLoginView(id: string, now = Date.now()): LoginView {
+  sweep(now);
+  return view(current(id));
+}
+
+export function answerClaudeLogin(id: string, text: string): LoginView {
+  const session = current(id);
+  if (session.state !== 'pending') throw new ApiError('that sign-in has already finished', 409);
+  session.write(text);
+  return view(session);
+}
+
+export function endClaudeLogin(id: string): { ended: true } {
+  const session = current(id);
+  session.kill();
+  live = null;
+  return { ended: true };
+}
+
+export const forgetClaudeLogin = (): void => {
+  live?.kill();
+  live = null;
+};

package/runtime/node_modules/@metro-labs/daemon/src/claude/memory-routine.ts

@@ -0,0 +1,123 @@
+import { join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { existsSync, readFileSync } from '../agent-user/agent-fs.js';
+import { readCrontab, withBlock, writeCrontab } from '../agent-user/crontab.js';
+import { writeHomeText } from '../agent-user/home-fs.js';
+import { listSchedules, parseCronLine, realRunner, type Runner } from '../agent-user/schedules.js';
+import { agentPath, agentUser, type AgentUser } from '../agent-user/user.js';
+
+const BEGIN = '# metro memory routine: begin';
+const END = '# metro memory routine: end';
+const REPLACED = '# replaced by memory-routine: ';
+const OWN_JOB = /memory/i;
+const SCHEDULE = '0 0,12 * * *';
+
+export type MemoryJobState = 'scheduled' | 'own' | 'off' | 'unavailable';
+
+export interface MemoryJob {
+  state: MemoryJobState;
+  job: string | null;
+}
+
+export interface MemoryJobDeps {
+  user?: AgentUser | null;
+  runner?: Runner;
+  cli?: string;
+  port?: string;
+}
+
+let last: MemoryJob = { state: 'unavailable', job: null };
+
+export const memoryJobStatus = (): MemoryJob => ({ ...last });
+
+export const launcherPath = (user: AgentUser): string => join(user.home, '.metro', 'bin', 'memory-routine');
+export const skillPath = (user: AgentUser): string => join(user.home, '.claude', 'skills', 'memory', 'SKILL.md');
+const logPath = (user: AgentUser): string => join(user.home, '.metro', 'memory-routine.log');
+const quoted = (text: string): string => `'${text.replace(/'/g, '\'\\\'\'')}'`;
+
+export function launcherText(user: AgentUser, cli: string, port: string): string {
+  return [
+    '#!/bin/sh',
+    `PATH=${quoted(agentPath(user))}`,
+    'export PATH',
+    ...(port === '' ? [] : [`METRO_WEBHOOK_PORT=${quoted(port)}`, 'export METRO_WEBHOOK_PORT']),
+    'cd "$HOME" || exit 1',
+    `exec node ${quoted(cli)} memory "$@"`,
+    '',
+  ].join('\n');
+}
+
+export const cronLine = (user: AgentUser): string => `${SCHEDULE} ${launcherPath(user)} ${skillPath(user)} >> ${logPath(user)} 2>&1`;
+
+const commandName = (command: string): string => command.split(/\s+/)[0]?.split('/').pop() ?? 'cron';
+
+const ownCommand = (user: AgentUser, line: string): string | null => {
+  const parsed = parseCronLine(line);
+  return parsed === null || parsed.command.includes(launcherPath(user)) || !OWN_JOB.test(parsed.command) ? null : parsed.command;
+};
+
+const replaces = (user: AgentUser, line: string): boolean => OWN_JOB.test(commandName(ownCommand(user, line) ?? ''));
+
+function ownJob(user: AgentUser, runner: Runner, lines: string[]): string | null {
+  const cron = lines.flatMap((line) => {
+    const command = ownCommand(user, line);
+    return command === null || replaces(user, line) ? [] : [commandName(command)];
+  });
+  const timers = listSchedules(null, runner).filter((job) => job.runsAs === user.name && OWN_JOB.test(`${job.name} ${job.command}`));
+  return cron[0] ?? timers[0]?.name ?? null;
+}
+
+const restored = (line: string): string => (line.startsWith(REPLACED) ? line.slice(REPLACED.length) : line);
+
+function marked(user: AgentUser, lines: string[], on: boolean, scheduled: boolean): string[] {
+  if (!on) return lines.map(restored);
+  return lines.map((l) => (scheduled && replaces(user, l) ? `${REPLACED}${l}` : l));
+}
+
+function placeLauncher(path: string, text: string): void {
+  if (existsSync(path) && readFileSync(path, 'utf8') === text) return;
+  writeHomeText(path, text, 0o755);
+}
+
+const envText = (name: string): string => process.env[name]?.trim() ?? '';
+
+function resolved(deps: MemoryJobDeps): Required<MemoryJobDeps> {
+  return {
+    user: deps.user === undefined ? agentUser() : deps.user,
+    runner: deps.runner ?? realRunner,
+    cli: deps.cli ?? envText('METRO_CLI_BIN'),
+    port: deps.port ?? envText('METRO_WEBHOOK_PORT'),
+  };
+}
+
+const stateOf = (scheduled: boolean, own: string | null): MemoryJobState => {
+  if (scheduled) return 'scheduled';
+  return own === null ? 'off' : 'own';
+};
+
+export function ensureMemoryJob(on: boolean, deps: MemoryJobDeps = {}): MemoryJob {
+  const { user, runner, cli, port } = resolved(deps);
+  if (user === null || cli === '') {
+    last = { state: 'unavailable', job: null };
+    return memoryJobStatus();
+  }
+  const lines = readCrontab(user, runner);
+  const own = on ? ownJob(user, runner, lines) : null;
+  const scheduled = on && own === null;
+  const launcher = launcherPath(user);
+  if (scheduled) placeLauncher(launcher, launcherText(user, cli, port));
+  const kept = marked(user, lines, on, scheduled);
+  const next = withBlock(kept, BEGIN, END, scheduled ? [cronLine(user)] : [], 'end', (l) => l.includes(launcher));
+  const changed = writeCrontab(user, runner, lines, next);
+  last = { state: stateOf(scheduled, own), job: own };
+  if (changed) log.info({ ...last, rewritten: kept.filter((l, i) => l !== lines[i]) }, 'memory-routine: updated the memory job');
+  return memoryJobStatus();
+}
+
+export function tryMemoryJob(on: boolean): void {
+  try {
+    ensureMemoryJob(on);
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'memory-routine: could not set up the daily memory job');
+  }
+}