@stage-labs/metro 0.1.0-beta.317 → 0.1.0-beta.319

package/dist/claude-env.js

@@ -9,6 +9,8 @@ const PROBE_MS = 3_000;
 const AUTH_STATUS_MS = 20_000;
 const RM_PROMPT_OFF = 'CLAUDE_CODE_DISABLE_INLINE_SHELL_RM_PROMPT';
 const OWN_CREDENTIALS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+const CACHE_TTLS = ['CLAUDE_CODE_PROMPT_CACHE_TTL', 'CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL'];
+const LONG_CACHE = '1h';
 export const AGENT_VIEW_OFF = 'CLAUDE_CODE_DISABLE_AGENT_VIEW';
 export const NO_UPDATES = { DISABLE_AUTOUPDATER: '1' };
 const set = (env, name) => (env[name] ?? '').trim() !== '';
@@ -30,6 +32,10 @@ export function gatewayEnv(base, agentKey, port) {
     };
 }
 export const toolSearchEnv = (env) => set(env, 'ENABLE_TOOL_SEARCH') ? env : { ...env, ENABLE_TOOL_SEARCH: 'true' };
+export function cacheTtlEnv(env) {
+    const missing = CACHE_TTLS.filter((name) => !set(env, name));
+    return missing.length === 0 ? env : { ...env, ...Object.fromEntries(missing.map((name) => [name, LONG_CACHE])) };
+}
 export const rmPromptEnv = (env) => set(env, RM_PROMPT_OFF) ? env : { ...env, [RM_PROMPT_OFF]: '1' };
 export const keepInSession = (env) => set(env, AGENT_VIEW_OFF) ? env : { ...env, [AGENT_VIEW_OFF]: '1' };
 export function credentialEnv(env, agentKey, signedIn) {
@@ -84,9 +90,10 @@ async function verdict() {
 function gatewayLaunchEnv(key, port, claude, say) {
     say(`inference goes through the daemon at http://127.0.0.1:${String(port)}/gateway (the Model page decides where)`);
     const pointed = routeModelEnv(gatewayEnv(process.env, key, port), currentRoute());
-    const routed = toolSearchEnv(pointed);
-    if (routed !== pointed)
+    const searched = toolSearchEnv(pointed);
+    if (searched !== pointed)
         say('MCP tool search is on, so connector tools load when Claude needs them instead of all at start');
+    const routed = cacheTtlEnv(searched);
     const env = credentialEnv(routed, key, claudeSignedIn(claude));
     if (env !== routed)
         say("Claude Code has no login of its own here, so metro's key stands in as its credential; the organization's Models page decides where requests go");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.317",
+  "version": "0.1.0-beta.319",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/crontab.ts

@@ -14,11 +14,10 @@ function outsideBlock(lines: string[], begin: string, end: string): string[] {
   return [...lines.slice(0, start), ...lines.slice(stop + 1)];
 }
 
-export function withBlock(lines: string[], begin: string, end: string, block: string[], at: 'top' | 'end', owned: (line: string) => boolean = () => false): string[] {
+export function withBlock(lines: string[], begin: string, end: string, block: string[], owned: (line: string) => boolean): string[] {
   const kept = outsideBlock(lines, begin, end).filter((l) => l !== '' && l !== begin && l !== end && !owned(l));
   if (block.length === 0) return kept;
-  const wrapped = [begin, ...block, end];
-  return at === 'top' ? [...wrapped, ...kept] : [...kept, ...wrapped];
+  return [...kept, begin, ...block, end];
 }
 
 const failure = (what: string, user: AgentUser, out: { status: number | null; stderr?: string }): Error =>
@@ -37,8 +36,3 @@ export function writeCrontab(user: AgentUser, runner: Runner, lines: string[], n
   if (out.status !== 0) throw failure('write', user, out);
   return true;
 }
-
-export function editCrontab(user: AgentUser, runner: Runner, change: (lines: string[]) => string[]): boolean {
-  const lines = readCrontab(user, runner);
-  return writeCrontab(user, runner, lines, change(lines));
-}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/unit-files.ts

@@ -1,27 +1,13 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { mustHelper, rootHelper } from '../metro-user/privilege.js';
+import { rootHelper } from '../metro-user/privilege.js';
 import { agentUser, asUser } from './user.js';
 
-const UNIT_DIR = '/etc/systemd/system';
-
 export interface RunResult {
   status: number | null;
   stdout: string;
   stderr?: string;
 }
 
-export function writeDropIn(service: string, name: string, text: string): void {
-  mustHelper(['dropin-write', service, name], text);
-}
-
-export function removeDropIn(service: string, name: string): boolean {
-  if (!existsSync(join(UNIT_DIR, `${service}.d`, name))) return false;
-  mustHelper(['dropin-remove', service, name]);
-  return true;
-}
-
 function agentCrontab(args: string[], input?: string): RunResult {
   const at = args.indexOf('-u');
   const rest = at < 0 ? args : args.filter((_, i) => i !== at && i !== at + 1);

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/user.ts

@@ -44,14 +44,6 @@ export function forgetAgentUser(): void {
   cached = null;
 }
 
-let extraEnv: Record<string, string> = {};
-
-export function setAgentExtraEnv(env: Record<string, string>): void {
-  extraEnv = { ...env };
-}
-
-export const agentExtraEnv = (): Record<string, string> => ({ ...extraEnv });
-
 export const agentPath = (user: AgentUser): string => AGENT_PATH.map((p) => (p.startsWith('/') ? p : join(user.home, p))).join(':');
 
 function agentEnv(user: AgentUser, extra: Record<string, string> = {}): Record<string, string> {
@@ -63,7 +55,6 @@ function agentEnv(user: AgentUser, extra: Record<string, string> = {}): Record<s
     LANG: process.env.LANG ?? 'C.UTF-8',
     TERM: process.env.TERM ?? 'xterm-256color',
     PATH: agentPath(user),
-    ...extraEnv,
     ...extra,
   };
 }

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -28,7 +28,6 @@ import { holdServerApproval } from '../mcp/server-approvals.js';
 import { removeConnectorLeftovers } from '../connectors/leftovers.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
 import { prepareAgentRunner, provisionAgentUser } from '../agent-user/provision.js';
-import { applyVault } from '../vault/index.js';
 import { blockImds } from '../metro-user/imds.js';
 import { followRelease } from '../metro-user/root-follow.js';
 import { unwatchSession, watchSession } from '../claude/session.js';
@@ -205,8 +204,6 @@ async function startClaude(): Promise<void> {
   if (agentUser === 'ready') {
     blockImds();
     followRelease();
-    const vault = (await applyVault()).status;
-    if (vault.enabled) log.info({ running: vault.running, problem: vault.problem }, 'vault: the agent reaches the internet through the vault');
   }
   tryClaudeSetup();
   try { githubSkills().watch(); } catch { log.warn('github-skills: saved source could not be loaded'); }

package/runtime/node_modules/@metro-labs/daemon/src/claude/memory-routine.ts

@@ -107,7 +107,7 @@ export function ensureMemoryJob(on: boolean, deps: MemoryJobDeps = {}): MemoryJo
   const launcher = launcherPath(user);
   if (scheduled) placeLauncher(launcher, launcherText(user, cli, port));
   const kept = marked(user, lines, on, scheduled);
-  const next = withBlock(kept, BEGIN, END, scheduled ? [cronLine(user)] : [], 'end', (l) => l.includes(launcher));
+  const next = withBlock(kept, BEGIN, END, scheduled ? [cronLine(user)] : [], (l) => l.includes(launcher));
   const changed = writeCrontab(user, runner, lines, next);
   last = { state: stateOf(scheduled, own), job: own };
   if (changed) log.info({ ...last, rewritten: kept.filter((l, i) => l !== lines[i]) }, 'memory-routine: updated the memory job');

package/runtime/node_modules/@metro-labs/daemon/src/claude/session.ts

@@ -15,13 +15,13 @@ import { notReady, primaryRoute, type ModelSetup } from '../gateway/model-config
 import { effectiveSetup } from '../gateway/effective.js';
 import { inSessionScope } from './memory.js';
 import { runningAsRoot } from '../metro-user/privilege.js';
-import { agentExtraEnv, agentUser, agentUserExpected, agentViewDir, asAgent, claudeHome } from '../agent-user/user.js';
+import { agentUser, agentUserExpected, agentViewDir, asAgent, claudeHome } from '../agent-user/user.js';
 
 function sessionEnv(): Record<string, string> {
   const user = agentUser();
   if (user === null) return {};
   const port = process.env.METRO_WEBHOOK_PORT?.trim() ?? '';
-  return { ...agentExtraEnv(), METRO_AGENTS_DIR: agentViewDir(user), ...(port === '' ? {} : { METRO_WEBHOOK_PORT: port }) };
+  return { METRO_AGENTS_DIR: agentViewDir(user), ...(port === '' ? {} : { METRO_WEBHOOK_PORT: port }) };
 }
 
 const SESSION_NAME = 'metro';

package/runtime/node_modules/@metro-labs/daemon/src/claude/setup.ts

@@ -141,6 +141,7 @@ const PRIOR_METRO: ReadonlySet<string> = new Set([
   '587a1334f91a8b61541573cef16eaf44fbe63049a8d8b461fa9f5cc55bacbcb8',
   '256c711a6175266c216e32c88b7190d0f98f5e6b702abe03220b422aba426574',
   '9e164a956437d60d30ea1984115a17d303940d191f5efed04954f244fc89d48f',
+  '8b6d7c5a9bc8d02d5e3ae5e5931b36aba9f3d0eb7fd38b371294c2abaa0c94ee',
 ]);
 const PRIOR_STAGE: ReadonlySet<string> = new Set([
   'dd7d30474765de3865ddc87c1cf3220161ded09502027cdff18597e5df0aab43',

package/runtime/node_modules/@metro-labs/daemon/src/gateway/bedrock.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { log } from '@metro-labs/core/log';
+import { withoutCacheTtl, withoutTtlBeta } from './cache-ttl.js';
 import { EventStreamDecoder, type EventStreamMessage } from './eventstream.js';
 import { errorFrame, providerStatus, relayFrames, sendError, upstreamMessage, type Watch } from './forward.js';
 import type { Connection } from './model-config.js';
@@ -7,15 +8,23 @@ import { estimateTokens } from './subscription.js';
 import { UsageScanner } from './usage.js';
 
 const ANTHROPIC_VERSION = 'bedrock-2023-05-31';
-const EXTRA_INPUT_RE = /^([A-Za-z0-9_]+)(?:\.[^:]*)?: Extra inputs are not permitted/;
+const EXTRA_INPUT_RE = /^([A-Za-z0-9_.]+): Extra inputs are not permitted/;
+const CACHE_TTL_PATH = '.cache_control.ttl';
 const MAX_REPAIRS = 4;
 
 export interface Adaptations {
   fields: Set<string>;
   dropBetas: boolean;
+  dropCacheTtl: boolean;
 }
 
-export const freshAdaptations = (): Adaptations => ({ fields: new Set(), dropBetas: false });
+export const freshAdaptations = (): Adaptations => ({ fields: new Set(), dropBetas: false, dropCacheTtl: false });
+
+export function forgetAdaptations(learned: Adaptations): void {
+  learned.fields.clear();
+  learned.dropBetas = false;
+  learned.dropCacheTtl = false;
+}
 
 export interface BedrockUpstream {
   settings: Connection;
@@ -106,15 +115,28 @@ function callBedrock(up: BedrockUpstream, url: string, body: unknown, accept: st
 const without = (body: Record<string, unknown>, keys: Set<string>): Record<string, unknown> =>
   Object.fromEntries(Object.entries(body).filter(([key]) => !keys.has(key)));
 
+function withBetas(body: Record<string, unknown>, betas: string[]): Attempt {
+  const rest = without(body, new Set(['anthropic_beta']));
+  return { body: betas.length > 0 ? { ...rest, anthropic_beta: betas } : rest, betas };
+}
+
+const withoutTtl = (attempt: Attempt): Attempt => withBetas(withoutCacheTtl(attempt.body), withoutTtlBeta(attempt.betas));
+
 function applyLearned(req: Rewritten, learned: Adaptations): Attempt {
   const dropped = new Set(learned.fields);
   if (learned.dropBetas) dropped.add('anthropic_beta');
-  return { body: without(req.body, dropped), betas: learned.dropBetas ? [] : req.betas };
+  const attempt = { body: without(req.body, dropped), betas: learned.dropBetas ? [] : req.betas };
+  return learned.dropCacheTtl ? withoutTtl(attempt) : attempt;
 }
 
 function repair(attempt: Attempt, learned: Adaptations, message: string): Attempt | null {
   const named = EXTRA_INPUT_RE.exec(message)?.[1];
-  if (named !== undefined && named in attempt.body) {
+  if (named !== undefined && named.endsWith(CACHE_TTL_PATH) && !learned.dropCacheTtl) {
+    learned.dropCacheTtl = true;
+    log.warn('gateway: Bedrock refused the one-hour cache; using the five-minute cache from now on');
+    return withoutTtl(attempt);
+  }
+  if (named !== undefined && !named.includes('.') && named in attempt.body) {
     learned.fields.add(named);
     log.warn({ field: named }, 'gateway: Bedrock refused an extra input; dropping it from every request');
     return { body: without(attempt.body, new Set([named])), betas: attempt.betas };

package/runtime/node_modules/@metro-labs/daemon/src/gateway/cache-ttl.ts

@@ -0,0 +1,43 @@
+import { isRecord } from '@metro-labs/core/is-record';
+
+const TTL_BETA = 'extended-cache-ttl-';
+
+export const withoutTtlBeta = (betas: string[]): string[] => betas.filter((beta) => !beta.startsWith(TTL_BETA));
+
+function plainControl(block: unknown): unknown {
+  if (!isRecord(block) || !isRecord(block.cache_control) || !Object.hasOwn(block.cache_control, 'ttl')) return block;
+  const control = Object.fromEntries(Object.entries(block.cache_control).filter(([key]) => key !== 'ttl'));
+  return { ...block, cache_control: control };
+}
+
+function plainList(value: unknown): unknown {
+  if (!Array.isArray(value)) return value;
+  const out: unknown[] = value.map(plainControl);
+  return out.some((block, at) => block !== value[at]) ? out : value;
+}
+
+function plainMessage(message: unknown): unknown {
+  if (!isRecord(message)) return message;
+  const content = plainList(message.content);
+  return content === message.content ? message : { ...message, content };
+}
+
+export function withoutCacheTtl(body: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...body };
+  let changed = false;
+  for (const key of ['tools', 'system']) {
+    const plain = plainList(body[key]);
+    if (plain === body[key]) continue;
+    out[key] = plain;
+    changed = true;
+  }
+  if (Array.isArray(body.messages)) {
+    const listed: unknown[] = body.messages;
+    const messages = listed.map(plainMessage);
+    if (messages.some((message, at) => message !== listed[at])) {
+      out.messages = messages;
+      changed = true;
+    }
+  }
+  return changed ? out : body;
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -6,6 +6,7 @@ import {
   bedrockBase,
   bedrockCount,
   bedrockMessages,
+  forgetAdaptations,
   freshAdaptations,
   type Adaptations,
 } from './bedrock.js';
@@ -44,7 +45,7 @@ import { helperSetup, notReady, pinnedRoute, resolveRoute, routeLabel, type Conn
 import { codexMessages, type CodexDeps } from './codex.js';
 import { countTokens } from './subscription.js';
 import { OPENROUTER_BASE } from './openrouter.js';
-import { noteRoutewayRefusal, refusedWithPage, ROUTEWAY_BASE, routewayHeaders, routewayTools } from './routeway.js';
+import { noteRoutewayRefusal, refusedWithPage, ROUTEWAY_BASE, routewayBody, routewayHeaders } from './routeway.js';
 import { isRecord } from '@metro-labs/core/is-record';
 import { forgetServed, noteServed } from './served.js';
 import { forgetUsage, noteUsageHeaders, UsageScanner } from './usage.js';
@@ -75,8 +76,7 @@ export function resetGatewayState(): void {
   forgetServed();
   forgetFallbackState();
   forgetUsage();
-  learned.fields.clear();
-  learned.dropBetas = false;
+  forgetAdaptations(learned);
   forgetLearnedThinking();
 }
 
@@ -190,8 +190,8 @@ async function toRouteway(req: IncomingMessage, res: ServerResponse, body: Shape
   const conn = route.connection;
   const watch = watchUpstream(res);
   const send = sender(`${deps.routewayBase ?? ROUTEWAY_BASE}${upstreamPath(req)}`, watch);
-  const sent = routewayTools(body.sent);
-  const fitted: Shaped = { raw: sent === body.sent ? body.raw : Buffer.from(JSON.stringify(sent)), sent, shaped: routewayTools(body.shaped), bind: false };
+  const sent = routewayBody(body.sent);
+  const fitted: Shaped = { raw: sent === body.sent ? body.raw : Buffer.from(JSON.stringify(sent)), sent, shaped: routewayBody(body.shaped), bind: false };
   const upstream = await shapedAttempt(send, routewayHeaders(req, conn.apiKey), fitted, route);
   noteRefusal(conn.label, route.model, upstream);
   await noteRoutewayRefusal(upstream);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/routeway.ts

@@ -1,6 +1,7 @@
 import type { IncomingMessage } from 'node:http';
 import { isRecord } from '@metro-labs/core/is-record';
 import { log } from '@metro-labs/core/log';
+import { withoutCacheTtl, withoutTtlBeta } from './cache-ttl.js';
 import { anthropicHeaders, GatewayError, type Watch } from './forward.js';
 
 export const ROUTEWAY_BASE = 'https://api.routeway.ai';
@@ -10,6 +11,9 @@ const HANDED_OVER = new Set([402, 429]);
 export function routewayHeaders(req: IncomingMessage, apiKey: string): Record<string, string> {
   const headers = anthropicHeaders(req, apiKey);
   headers['user-agent'] ??= USER_AGENT;
+  const betas = withoutTtlBeta((headers['anthropic-beta'] ?? '').split(',').filter((beta) => beta !== ''));
+  if (betas.length > 0) headers['anthropic-beta'] = betas.join(',');
+  else delete headers['anthropic-beta'];
   return headers;
 }
 
@@ -65,13 +69,15 @@ function withProperties(tool: unknown): unknown {
   return full === tool.input_schema ? tool : { ...tool, input_schema: full };
 }
 
-export function routewayTools(body: Record<string, unknown>): Record<string, unknown> {
+function routewayTools(body: Record<string, unknown>): Record<string, unknown> {
   const listed: unknown = body.tools;
   if (!Array.isArray(listed)) return body;
   const tools: unknown[] = listed.map(withProperties);
   return tools.some((tool, at) => tool !== listed[at]) ? { ...body, tools } : body;
 }
 
+export const routewayBody = (body: Record<string, unknown>): Record<string, unknown> => withoutCacheTtl(routewayTools(body));
+
 export async function noteRoutewayRefusal(upstream: Response): Promise<void> {
   if (upstream.ok || !(upstream.headers.get('content-type') ?? '').includes('application/json')) return;
   const body: unknown = await upstream.clone().json().catch(() => null);

package/runtime/node_modules/@metro-labs/daemon/src/mcp/raw-get-stream.ts

@@ -9,7 +9,7 @@ import type { BoundedEventStore } from './event-store.js';
 
 const STANDALONE_STREAM_ID = '_GET_stream';
 const KEEPALIVE_MS = 15_000;
-const RECONNECT_RETRY_MS = 15_000;
+const RECONNECT_RETRY_MS = 1_000;
 const COMMENT = ':\n\n';
 const RETRY_DIRECTIVE = `retry: ${RECONNECT_RETRY_MS}\n\n`;
 

package/runtime/node_modules/@metro-labs/daemon/src/mcp/server-approvals.ts

@@ -46,10 +46,16 @@ const noticeText = (tool: string, id: string, behavior: Behavior): string =>
 
 const requestedAt = (at: number, now = Date.now()): number => (Number.isFinite(at) && at > 0 ? Math.min(at, now) : now);
 
+const askedBy = (approval: McpApproval): string => {
+  if (approval.origin !== 'key') return '';
+  return approval.keyLabel === undefined ? ' (from an access key)' : ` (from an access key: ${approval.keyLabel})`;
+};
+
 interface Held {
   id: string;
   tool: string;
   line: string | undefined;
+  tellAgent: boolean;
   answer: (decision: McpDecision) => Promise<AnswerOutcome>;
   publish: (event: MetroEvent) => void;
 }
@@ -60,6 +66,10 @@ async function deliver(held: Held, behavior: Behavior): Promise<void> {
     log.info({ id: held.id, outcome }, 'mcp-server: the answer was not taken, so the agent is not told');
     return;
   }
+  if (!held.tellAgent) {
+    log.info({ id: held.id }, 'mcp-server: the call came with an access key, not from this agent\'s session, so the agent is not told');
+    return;
+  }
   const line = noticeLineFor(held.line);
   if (line === undefined) {
     log.warn({ id: held.id }, 'mcp-server: no chat is known to tell the agent the answer');
@@ -91,15 +101,15 @@ export function holdServerApproval(approval: McpApproval, answer: Held['answer']
   const tool = `${approval.connector}.${approval.tool}`;
   const announced = announcedLine(approval.id);
   const line = announced ?? promptLineFor(approval.id);
-  const held: Held = { id: approval.id, tool, line, answer, publish };
+  const held: Held = { id: approval.id, tool, line, tellAgent: approval.origin !== 'key', answer, publish };
   holdPrompt(
     { requestId: approval.id, tool, description: approval.connector, preview: approval.preview, line, at: requestedAt(approval.requestedAt), origin: 'mcp-server' },
     owner,
     sender(held),
     line === undefined ? undefined : async (text) => metroSend(line, text),
   );
-  log.info({ id: approval.id, tool, inChat: line !== undefined, announced: announced !== undefined }, 'mcp-server: an approval is waiting for the owner');
-  if (line !== undefined && announced === undefined) announce(approval.id, line, serverPromptBody({ requestId: approval.id, tool, preview: approval.preview }));
+  log.info({ id: approval.id, tool, origin: approval.origin ?? null, inChat: line !== undefined, announced: announced !== undefined }, 'mcp-server: an approval is waiting for the owner');
+  if (line !== undefined && announced === undefined) announce(approval.id, line, serverPromptBody({ requestId: approval.id, tool: `${tool}${askedBy(approval)}`, preview: approval.preview }));
   return true;
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/routes/session-apis.ts

@@ -15,7 +15,6 @@ import type { GatewayDeps } from '../gateway/gateway.js';
 import { handleTerminalRequest, type TerminalApiDeps } from '../terminal/api.js';
 import { handleSchedulesRequest } from '../agent-user/schedules-api.js';
 import { handleFilesRequest } from '../agent-user/files-api.js';
-import { handleVaultRequest } from '../vault/api.js';
 import { handleVoiceRequest } from '../voice/api.js';
 import { handleRunEventsRequest } from '../monitor/run-events.js';
 
@@ -52,7 +51,6 @@ export function handleSessionApis(
     ...when(apis.controlApi, (d) => handleControlRequest(req, res, d)),
     () => handleSchedulesRequest(req, res),
     () => handleFilesRequest(req, res),
-    () => handleVaultRequest(req, res),
     () => handleVoiceRequest(req, res),
     ...when(apis.ownerApi, (d) => handleOwnerRequest(req, res, d)),
     ...when(apis.machineApi, (d) => handleMachineRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/http/src/mcp-server-protocol.ts

@@ -27,12 +27,18 @@ export interface McpCall {
   approval?: string;
 }
 
+type McpApprovalOrigin = 'box' | 'key';
+
+const KEY_LABEL_MAX = 64;
+
 export interface McpApproval {
   id: string;
   connector: string;
   tool: string;
   preview: string;
   requestedAt: number;
+  origin?: McpApprovalOrigin;
+  keyLabel?: string;
 }
 
 export type McpDecision = 'allow' | 'deny';
@@ -70,9 +76,16 @@ export function mcpTokenHashOf(raw: unknown): string {
   return raw.tokenHash;
 }
 
+function originOf(raw: Record<string, unknown>): Pick<McpApproval, 'origin' | 'keyLabel'> {
+  if (raw.origin === 'box') return { origin: 'box' };
+  if (raw.origin !== 'key') return {};
+  const label = typeof raw.keyLabel === 'string' ? raw.keyLabel.replace(/\p{Cc}/gu, '').trim() : '';
+  return label === '' || label.length > KEY_LABEL_MAX ? { origin: 'key' } : { origin: 'key', keyLabel: label };
+}
+
 function approvalOf(raw: unknown): McpApproval | null {
   if (!isRecord(raw) || typeof raw.id !== 'string' || !MCP_APPROVAL_ID_RE.test(raw.id) || typeof raw.connector !== 'string' || typeof raw.tool !== 'string' || typeof raw.preview !== 'string' || typeof raw.requestedAt !== 'number') return null;
-  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt };
+  return { id: raw.id, connector: raw.connector, tool: raw.tool, preview: raw.preview, requestedAt: raw.requestedAt, ...originOf(raw) };
 }
 
 export function mcpApprovalsOf(raw: unknown): McpApproval[] {

package/runtime/node_modules/@metro-labs/http/src/mcp-server-tools.ts

@@ -61,19 +61,30 @@ export const toolSearchDescription = (keys: string[] | null): string =>
     'Results are full definitions (name, description and the JSON schema of the arguments) in a <functions> block. Each name is <connector>.<tool>: pass it exactly as "tool" to tool_call. Tools the owner blocked are never returned.',
   ].join('\n');
 
-export const TOOL_CALL_DESCRIPTION = [
-  'Run connector tools that tool_search found. Always find a tool with tool_search first: its exact name and argument schema come from there.',
-  `Shape: ${TOOL_CALL_EXAMPLE}`,
-  `Up to ${String(MCP_CALLS_MAX)} independent calls run in parallel in one tool_call and are answered in order. Each result starts with "[n] <connector>.<tool>", then the tool's own content, or one line saying why it did not run:`,
-  '- not_found: no such connector or tool here. Run tool_search, then use a name it returned.',
-  '- needs_approval: the owner was asked in chat and on metro.box. Tell the person what is waiting, wait for the channel message "Approved: <tool> (<id>)", then call again with the same tool and arguments plus "approval": "<id>". An approval works once.',
-  '- denied or blocked: the owner refused or blocked this call. Do not retry it.',
-  '- signin: the connector must be signed in again. Tell the owner to do it on the organization\'s Connectors page on metro.box.',
-  '- unavailable: the connector or Metro could not be reached. Try again later.',
-  '- vendor_error: the connector answered with its own error, shown as it came.',
-].join('\n');
+export type ApprovalPlace = 'session' | 'page' | 'owner';
 
-export function mcpServerTools(keys: string[] | null): McpServerTool[] {
+const NEEDS_APPROVAL: Record<ApprovalPlace, string> = {
+  session: '- needs_approval: the owner was asked in chat and on metro.box. Tell the person what is waiting, wait for the channel message "Approved: <tool> (<id>)", then call again with the same tool and arguments plus "approval": "<id>". An approval works once.',
+  page: '- needs_approval: the owner must approve it on this agent\'s page on metro.box. Tell the person what is waiting and ask them to approve it there, then call again with the same tool and arguments plus "approval": "<id>". An approval works once, within 10 minutes of the answer.',
+  owner: '- needs_approval: the agent\'s owner was asked in chat and on its page on metro.box. Tell the person what is waiting; once it is approved, call again with the same tool and arguments plus "approval": "<id>". An approval works once, within 10 minutes of the answer.',
+};
+
+const toolCallDescription = (place: ApprovalPlace): string =>
+  [
+    'Run connector tools that tool_search found. Always find a tool with tool_search first: its exact name and argument schema come from there.',
+    `Shape: ${TOOL_CALL_EXAMPLE}`,
+    `Up to ${String(MCP_CALLS_MAX)} independent calls run in parallel in one tool_call and are answered in order. Each result starts with "[n] <connector>.<tool>", then the tool's own content, or one line saying why it did not run:`,
+    '- not_found: no such connector or tool here. Run tool_search, then use a name it returned.',
+    NEEDS_APPROVAL[place],
+    '- denied or blocked: the owner refused or blocked this call. Do not retry it.',
+    '- signin: the connector must be signed in again. Tell the owner to do it on the organization\'s Connectors page on metro.box.',
+    '- unavailable: the connector or Metro could not be reached. Try again later.',
+    '- vendor_error: the connector answered with its own error, shown as it came.',
+  ].join('\n');
+
+export const TOOL_CALL_DESCRIPTION = toolCallDescription('session');
+
+export function mcpServerTools(keys: string[] | null, place: ApprovalPlace = 'session'): McpServerTool[] {
   return [
     {
       name: TOOL_SEARCH,
@@ -85,7 +96,7 @@ export function mcpServerTools(keys: string[] | null): McpServerTool[] {
     {
       name: TOOL_CALL,
       title: 'Call connector tools',
-      description: TOOL_CALL_DESCRIPTION,
+      description: toolCallDescription(place),
       inputSchema: callSchema,
       annotations: { title: 'Call connector tools', readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     },

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.317"
+  "version": "0.1.0-beta.319"
 }

package/runtime/sdk-runner/runner.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-beta.317",
+  "version": "0.1.0-beta.319",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.287",
     "@modelcontextprotocol/sdk": "^1.29.0",

package/runtime/sdk-runner/src/link.ts

@@ -12,7 +12,7 @@ const ANSWER = 'notifications/claude/channel/permission';
 const TOOLS_CHANGED = 'notifications/tools/list_changed';
 const MODEL = 'notifications/metro/model';
 const TOOL_TIMEOUT_MS = 30 * 60_000;
-const RECONNECT = { initialReconnectionDelay: 500, maxReconnectionDelay: 5_000, reconnectionDelayGrowFactor: 1.5, maxRetries: 60 };
+const RECONNECT = { initialReconnectionDelay: 500, maxReconnectionDelay: 5_000, reconnectionDelayGrowFactor: 1.5, maxRetries: 900 };
 const GAVE_UP = 'Maximum reconnection attempts';
 
 export type Behavior = 'allow' | 'deny';

package/runtime/sdk-runner/src/rules.ts

@@ -1,7 +1,7 @@
 import type { CallRoute, CallSource } from '@metro-labs/core/call';
 
 export const FRONT_RULES = `You are the orchestrator of this agent's persistent Agent SDK session. Typed chat, live call words (<call> blocks), and background worker reports share this conversation.
-- Be fast. When you can answer a chat message at once, make the reaction and the answer one response of parallel tool calls (react, then send), with no typing signal. Use typing only when the answer will take a while.
+- Be fast. When you can answer a chat message at once, make the reaction and the answer one response of parallel tool calls (react and send together), with no typing signal. Use typing only when the answer will take a while.
 - Stay light: talk, decide and delegate. Real work goes to background workers (Agent tool, subagent_type "worker", run_in_background: true); keep answering while they run, and relay what they report.
 - Keep one implementation owner per task. Reuse that owner through the permitted coordination path; avoid chains of relay-only workers and duplicate implementers. Use focused checks while iterating, then the required full gate on the final changes. Reuse verified results only while their inputs are unchanged. A refused lock or an interrupted check is not a pass.
 - At the next safe tool boundary, answer pending live-call inputs before starting unrelated delegation or processing worker reports. Give a short, direct answer when possible; do not generate a long task prompt before replying to the caller. Never interrupt active writes or approvals, invent filler, or promise work is done before it is.

package/skills/METRO.md

@@ -5,9 +5,11 @@ description: How this box's agent works on metro. Acknowledge, delegate, relay,
 
 You are the main thread of a Claude Code session that is connected to chat through metro, on a machine nobody watches. The main thread is an orchestrator: it may only delegate and talk. A guard metro installs denies every other tool on this thread, so this is the shape of the work, not a preference.
 
-**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, the first tool call is `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim. Exception: when the person asks you to close something ("mark as done"), skip the reaction and the acknowledgement: close it directly and confirm once when it is finished.
+**Inbound.** A message arrives as a `<channel source="metro" …>` block. Read `addressed` first: `direct`, `mention` or `reply` means it is for you; without it the message merely happened in a room you watch, so treat it as context and stay silent unless the person plainly wants you. For a message that is for you, `react` on it (👀, then 👍 or ✅ once done) so the person knows you saw it, and any reply goes on the same `line`, passed verbatim. Exception: when the person asks you to close something ("mark as done"), skip the reaction and the acknowledgement: close it directly and confirm once when it is finished.
 
-**Typing.** Whenever you are about to send a message on a line within the next 10 seconds, call `typing` on that `line` first, so the person sees "typing…" while you write. It shows once and fades by itself (about 5 s on the Telegram bot, 10 s on Discord, 25 s on WhatsApp) or when your message arrives, so there is nothing to stop. Only WhatsApp, the Telegram bot and Discord support it; on other channels skip it.
+**Be fast: one response, parallel tool calls.** Every response you make is a full model turn, so never spend one on a reaction or a typing signal alone. When you can answer at once, put `react` and `send` in the same response. When the work goes to a worker, put `react` and the `Agent` call in the same response. When you relay a finished result, put the `send` and the ✅ reaction in the same response.
+
+**Typing.** Skip it when you answer at once: your message is the signal. Call `typing` on the `line` only when the answer will take a while, and only together with your other calls in the same response. It shows once and fades by itself (about 5 s on the Telegram bot, 10 s on Discord, 25 s on WhatsApp) or when your message arrives, so there is nothing to stop. Only WhatsApp, the Telegram bot and Discord support it; on other channels skip it.
 
 **Delegate everything that is work.** Reading files, running commands, searching, fetching pages, editing, and every connector tool: hand it to a subagent with the `Agent` tool, `subagent_type: "worker"`, always `run_in_background: true`, then keep answering chat while it runs and relay the result when the task notification arrives. A foreground subagent blinds you to chat and the guard refuses it. You may read image files yourself, so a screenshot someone sends is yours to look at.
 

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/job-env.ts

@@ -1,39 +0,0 @@
-import { join } from 'node:path';
-import { log } from '@metro-labs/core/log';
-import { editCrontab, withBlock } from './crontab.js';
-import { writeHomeText } from './home-fs.js';
-import { listSchedules, realRunner, showProps, type Runner } from './schedules.js';
-import type { AgentUser } from './user.js';
-import { removeDropIn, writeDropIn } from './unit-files.js';
-
-const DROP_IN = '11-metro-vault.conf';
-const BEGIN = '# metro vault: begin';
-const END = '# metro vault: end';
-
-const jobEnvFile = (user: AgentUser): string => join(user.home, '.metro', 'vault.env');
-
-export function withCronEnv(lines: string[], env: Record<string, string>): string[] {
-  return withBlock(lines, BEGIN, END, Object.entries(env).map(([k, v]) => `${k}=${v}`), 'top');
-}
-
-function setTimerEnv(user: AgentUser, on: boolean, runner: Runner): void {
-  let changed = false;
-  for (const job of listSchedules(user, runner)) {
-    if (job.kind !== 'timer' || job.runsAs !== user.name) continue;
-    const unit = job.id.slice('timer:'.length);
-    const service = showProps(runner, unit, ['Unit']).Unit ?? unit.replace(/\.timer$/, '.service');
-    if (on) {
-      writeDropIn(service, DROP_IN, `[Service]\nEnvironmentFile=-${jobEnvFile(user)}\n`);
-      changed = true;
-    } else if (removeDropIn(service, DROP_IN)) changed = true;
-  }
-  if (changed) runner.run('systemctl', ['daemon-reload']);
-}
-
-export function exportJobEnv(user: AgentUser, env: Record<string, string>, runner: Runner = realRunner): void {
-  const on = Object.keys(env).length > 0;
-  writeHomeText(jobEnvFile(user), Object.entries(env).map(([k, v]) => `${k}=${v}\n`).join(''), 0o644);
-  editCrontab(user, runner, (lines) => withCronEnv(lines, env));
-  setTimerEnv(user, on, runner);
-  log.info({ on, keys: Object.keys(env).length }, "vault: the agent's scheduled jobs use the vault settings");
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/api.ts

@@ -1,45 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { ApiError } from '@metro-labs/http/api-error';
-import { bodyField, readJsonBody, sessionRoute } from '@metro-labs/http/api-http';
-import { isRecord } from '@metro-labs/core/is-record';
-import { log } from '@metro-labs/core/log';
-import { sessionRunning, stopSession } from '../claude/session.js';
-import { agentUser } from '../agent-user/user.js';
-import { applyVault, vaultStatus } from './index.js';
-import { recentRequests } from './proxy.js';
-import { addSecret, readVault, removeSecret, setVaultEnabled, updateSecret, type SecretInput } from './store.js';
-
-const PATH = '/api/vault';
-
-function view(): unknown {
-  return { ...vaultStatus(), secrets: readVault().secrets, recent: recentRequests().slice(0, 100) };
-}
-
-const inputOf = (body: unknown): SecretInput => (isRecord(body) ? { name: body.name, env: body.env, hosts: body.hosts, value: body.value } : {});
-
-function change(body: unknown): void {
-  const action = bodyField(body, 'action');
-  const id = bodyField(body, 'id');
-  if (action === 'enable' || action === 'disable') {
-    if (agentUser() === null) throw new ApiError('the vault needs Claude Code running as its own user (a Linux box)', 409);
-    setVaultEnabled(action === 'enable');
-  } else if (action === 'add') addSecret(inputOf(body));
-  else if (action === 'update' && typeof id === 'string') updateSecret(id, inputOf(body));
-  else if (action === 'remove' && typeof id === 'string') removeSecret(id);
-  else throw new ApiError('action must be enable, disable, add, update or remove', 400);
-}
-
-async function answer(req: IncomingMessage): Promise<unknown> {
-  if (req.method === 'GET') return view();
-  change(await readJsonBody(req));
-  const { envChanged } = await applyVault();
-  if (envChanged && sessionRunning()) {
-    stopSession();
-    log.info('vault: the Claude session restarts to pick up the new environment');
-  }
-  return view();
-}
-
-export function handleVaultRequest(req: IncomingMessage, res: ServerResponse): boolean {
-  return sessionRoute(req, res, { methods: { [PATH]: ['GET', 'POST'] }, admin: true, label: 'vault-api' }, () => answer(req));
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/config.ts

@@ -1,51 +0,0 @@
-import { caDir, ports, valueFile, vaultDir } from './paths.js';
-import type { VaultSecret } from './store.js';
-import { join } from 'node:path';
-
-export const MANAGEMENT_KEY_ENV = 'IRON_MANAGEMENT_API_KEY';
-
-function secretEntry(secret: VaultSecret, dir: string): Record<string, unknown> {
-  return {
-    source: { type: 'file', path: valueFile(secret.id, dir) },
-    replace: { proxy_value: secret.env, match_headers: [], match_query: true },
-    rules: secret.hosts.map((host) => ({ host })),
-  };
-}
-
-export function proxyConfig(secrets: VaultSecret[], dir = vaultDir()): Record<string, unknown> {
-  const p = ports();
-  const local = (port: number): string => `127.0.0.1:${String(port)}`;
-  return {
-    dns: { enabled: false },
-    proxy: {
-      tunnel_listen: local(p.tunnel),
-      http_listen: local(p.http),
-      https_listen: local(p.https),
-      upstream_response_header_timeout: '10m',
-    },
-    tls: { mode: 'mitm', ca_cert: join(caDir(dir), 'ca.crt'), ca_key: join(caDir(dir), 'ca.key') },
-    transforms: secrets.length === 0 ? [] : [{ name: 'secrets', config: { secrets: secrets.map((s) => secretEntry(s, dir)) } }],
-    metrics: { listen: local(p.metrics) },
-    management: { listen: local(p.management), api_key_env: MANAGEMENT_KEY_ENV },
-    log: { level: 'info' },
-  };
-}
-
-export function proxyEnvFor(caFile: string, bundle: string, secrets: VaultSecret[]): Record<string, string> {
-  const url = `http://127.0.0.1:${String(ports().tunnel)}`;
-  const skip = 'localhost,127.0.0.1,::1';
-  return {
-    HTTP_PROXY: url,
-    HTTPS_PROXY: url,
-    http_proxy: url,
-    https_proxy: url,
-    NO_PROXY: skip,
-    no_proxy: skip,
-    NODE_EXTRA_CA_CERTS: caFile,
-    SSL_CERT_FILE: bundle,
-    REQUESTS_CA_BUNDLE: bundle,
-    CURL_CA_BUNDLE: bundle,
-    GIT_SSL_CAINFO: bundle,
-    ...Object.fromEntries(secrets.map((s) => [s.env, s.env])),
-  };
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/firewall.ts

@@ -1,9 +0,0 @@
-import { mustHelper } from '../metro-user/privilege.js';
-
-export function applyFirewall(): void {
-  mustHelper(['firewall-on']);
-}
-
-export function removeFirewall(): void {
-  mustHelper(['firewall-off']);
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/index.ts

@@ -1,96 +0,0 @@
-import { writeFileSync } from 'node:fs';
-import { errMsg, log } from '@metro-labs/core/log';
-import { ensureSecureDir } from '@metro-labs/core/secure-fs';
-import { agentExtraEnv, agentUser, asAgent, setAgentExtraEnv, type AgentUser } from '../agent-user/user.js';
-import { spawnSync } from 'node:child_process';
-import { exportJobEnv } from '../agent-user/job-env.js';
-import { proxyConfig, proxyEnvFor } from './config.js';
-import { applyFirewall, removeFirewall } from './firewall.js';
-import { ensureAuthority, ensureProxyBinary } from './install.js';
-import { configFile, PROXY_VERSION, SYSTEM_BUNDLE, TRUSTED_CA, vaultDir } from './paths.js';
-import { proxyError, proxyRunning, runProxy, stopProxy } from './proxy.js';
-import { hasValue, readVault } from './store.js';
-import { trustBrowsers, trustSystem, untrustSystem } from './trust.js';
-
-export interface VaultStatus {
-  available: boolean;
-  enabled: boolean;
-  running: boolean;
-  version: string;
-  problem: string | null;
-  browsers: string | null;
-}
-
-const memory: { problem: string | null; browsers: string | null } = { problem: null, browsers: null };
-
-function pushTmuxEnv(before: Record<string, string>, after: Record<string, string>): void {
-  const has = spawnSync(...asAgent('tmux', ['list-sessions']), { stdio: 'ignore' }).status === 0;
-  if (!has) return;
-  for (const key of Object.keys(before)) if (!(key in after)) spawnSync(...asAgent('tmux', ['set-environment', '-gu', key]), { stdio: 'ignore' });
-  for (const [key, value] of Object.entries(after)) spawnSync(...asAgent('tmux', ['set-environment', '-g', key, value]), { stdio: 'ignore' });
-}
-
-const sameEnv = (a: Record<string, string>, b: Record<string, string>): boolean =>
-  JSON.stringify(Object.entries(a).sort()) === JSON.stringify(Object.entries(b).sort());
-
-function setEnv(next: Record<string, string>): boolean {
-  const before = agentExtraEnv();
-  if (sameEnv(before, next)) return false;
-  setAgentExtraEnv(next);
-  pushTmuxEnv(before, next);
-  return true;
-}
-
-function exportForJobs(user: AgentUser, env: Record<string, string>): void {
-  try {
-    exportJobEnv(user, env);
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'vault: could not give the scheduled jobs the vault settings');
-  }
-}
-
-async function turnOn(user: AgentUser, dir: string): Promise<Record<string, string>> {
-  const bin = await ensureProxyBinary(dir);
-  const ca = ensureAuthority(bin, dir);
-  const secrets = readVault(dir).secrets.filter((s) => hasValue(s.id, dir));
-  ensureSecureDir(dir);
-  writeFileSync(configFile(dir), JSON.stringify(proxyConfig(secrets, dir), null, 2), { mode: 0o600 });
-  trustSystem(ca);
-  memory.browsers = trustBrowsers(user);
-  await runProxy(bin, configFile(dir));
-  applyFirewall();
-  return proxyEnvFor(TRUSTED_CA, SYSTEM_BUNDLE, secrets);
-}
-
-function turnOff(): void {
-  removeFirewall();
-  stopProxy();
-  untrustSystem();
-}
-
-export async function applyVault(user: AgentUser | null = agentUser(), dir = vaultDir()): Promise<{ status: VaultStatus; envChanged: boolean }> {
-  if (user === null) return { status: vaultStatus(null, dir), envChanged: false };
-  const enabled = readVault(dir).enabled;
-  try {
-    const env = enabled ? await turnOn(user, dir) : (turnOff(), {});
-    memory.problem = null;
-    const envChanged = setEnv(env);
-    if (envChanged || enabled) exportForJobs(user, env);
-    return { status: vaultStatus(user, dir), envChanged };
-  } catch (err) {
-    memory.problem = errMsg(err);
-    log.warn({ err: memory.problem }, 'vault: could not apply the vault');
-    return { status: vaultStatus(user, dir), envChanged: false };
-  }
-}
-
-export function vaultStatus(user: AgentUser | null = agentUser(), dir = vaultDir()): VaultStatus {
-  return {
-    available: user !== null,
-    enabled: user !== null && readVault(dir).enabled,
-    running: proxyRunning(),
-    version: PROXY_VERSION,
-    problem: memory.problem ?? (readVault(dir).enabled ? proxyError() : null),
-    browsers: memory.browsers,
-  };
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/install.ts

@@ -1,56 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { chmodSync, copyFileSync, existsSync, mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { ensureSecureDir } from '@metro-labs/core/secure-fs';
-import { binDir, caDir, PROXY_VERSION, proxyBin, vaultDir } from './paths.js';
-
-const RELEASES = `https://github.com/ironsh/iron-proxy/releases/download/v${PROXY_VERSION}`;
-
-export const archiveName = (arch = process.arch): string => `iron-proxy_${PROXY_VERSION}_linux_${arch === 'arm64' ? 'arm64' : 'amd64'}.tar.gz`;
-
-export function expectedSum(checksums: string, file: string): string | null {
-  const line = checksums.split('\n').find((l) => l.trim().endsWith(` ${file}`));
-  const sum = line?.trim().split(/\s+/)[0];
-  return sum !== undefined && /^[0-9a-f]{64}$/.test(sum) ? sum : null;
-}
-
-async function download(url: string): Promise<Buffer> {
-  const res = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });
-  if (!res.ok) throw new Error(`${url} answered ${String(res.status)}`);
-  return Buffer.from(await res.arrayBuffer());
-}
-
-export async function ensureProxyBinary(dir = vaultDir()): Promise<string> {
-  const bin = proxyBin(dir);
-  if (existsSync(bin)) return bin;
-  const file = archiveName();
-  const [archive, checksums] = await Promise.all([download(`${RELEASES}/${file}`), download(`${RELEASES}/checksums.txt`)]);
-  const want = expectedSum(checksums.toString('utf8'), file);
-  const got = createHash('sha256').update(archive).digest('hex');
-  if (want === null || want !== got) throw new Error(`the iron-proxy download does not match its checksum (${file})`);
-  const work = mkdtempSync(join(tmpdir(), 'metro-iron-'));
-  try {
-    writeFileSync(join(work, file), archive);
-    const untar = spawnSync('tar', ['-xzf', file, 'iron-proxy'], { cwd: work, encoding: 'utf8' });
-    if (untar.status !== 0) throw new Error(`could not unpack iron-proxy: ${untar.stderr.trim()}`);
-    ensureSecureDir(binDir(dir));
-    copyFileSync(join(work, 'iron-proxy'), `${bin}.part`);
-    chmodSync(`${bin}.part`, 0o755);
-    renameSync(`${bin}.part`, bin);
-  } finally {
-    rmSync(work, { recursive: true, force: true });
-  }
-  return bin;
-}
-
-export function ensureAuthority(bin: string, dir = vaultDir()): string {
-  const cert = join(caDir(dir), 'ca.crt');
-  if (existsSync(cert) && existsSync(join(caDir(dir), 'ca.key'))) return cert;
-  ensureSecureDir(caDir(dir));
-  const made = spawnSync(bin, ['generate-ca', '-outdir', caDir(dir), '-name', 'Metro vault', '-expiry-hours', '87600', '-alg', 'rsa4096'], { encoding: 'utf8' });
-  if (made.status !== 0) throw new Error(`could not create the vault certificate: ${made.stderr.trim()}`);
-  chmodSync(join(caDir(dir), 'ca.key'), 0o600);
-  return cert;
-}

package/runtime/node_modules/@metro-labs/daemon/src/vault/paths.ts

@@ -1,26 +0,0 @@
-import { join } from 'node:path';
-import { agentsDir } from '../agents/files.js';
-
-export const PROXY_VERSION = '0.50.0';
-
-const basePort = (): number => {
-  const raw = Number(process.env.METRO_VAULT_PORT);
-  return Number.isInteger(raw) && raw > 1024 && raw < 65000 ? raw : 8421;
-};
-
-export const ports = (): { tunnel: number; http: number; https: number; management: number; metrics: number } => {
-  const base = basePort();
-  return { tunnel: base, http: base + 1, https: base + 2, management: base + 3, metrics: base + 4 };
-};
-
-export const vaultDir = (dir = agentsDir()): string => join(dir, 'vault');
-export const stateFile = (dir = vaultDir()): string => join(dir, 'vault.json');
-export const valuesDir = (dir = vaultDir()): string => join(dir, 'values');
-export const valueFile = (id: string, dir = vaultDir()): string => join(valuesDir(dir), id);
-export const caDir = (dir = vaultDir()): string => join(dir, 'ca');
-export const binDir = (dir = vaultDir()): string => join(dir, 'bin');
-export const proxyBin = (dir = vaultDir()): string => join(binDir(dir), `iron-proxy-${PROXY_VERSION}`);
-export const configFile = (dir = vaultDir()): string => join(dir, 'iron-proxy.json');
-
-export const TRUSTED_CA = '/usr/local/share/ca-certificates/metro-vault.crt';
-export const SYSTEM_BUNDLE = '/etc/ssl/certs/ca-certificates.crt';

package/runtime/node_modules/@metro-labs/daemon/src/vault/proxy.ts

@@ -1,147 +0,0 @@
-import { spawn, type ChildProcess } from 'node:child_process';
-import { stringOf } from '@metro-labs/http/api-http';
-import { randomBytes } from 'node:crypto';
-import { basename } from 'node:path';
-import { createInterface } from 'node:readline';
-import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
-import { MANAGEMENT_KEY_ENV } from './config.js';
-import { ports } from './paths.js';
-
-export interface ProxyRequest {
-  at: string;
-  method: string;
-  host: string;
-  path: string;
-  status: number | null;
-  action: string;
-  swapped: string[];
-}
-
-const RECENT_MAX = 200;
-const BACKOFF_MAX_MS = 30_000;
-
-const recent: ProxyRequest[] = [];
-const state: { child: ChildProcess | null; wanted: { bin: string; config: string } | null; key: string; backoff: number; lastError: string | null; startedAt: number } = {
-  child: null,
-  wanted: null,
-  key: randomBytes(24).toString('hex'),
-  backoff: 1000,
-  lastError: null,
-  startedAt: 0,
-};
-
-function swappedIds(transforms: unknown): string[] {
-  if (!Array.isArray(transforms)) return [];
-  return transforms.flatMap((t) => {
-    const swapped = isRecord(t) && isRecord(t.annotations) && Array.isArray(t.annotations.swapped) ? t.annotations.swapped : [];
-    return swapped.flatMap((s) => (isRecord(s) && typeof s.secret === 'string' ? [basename(s.secret)] : []));
-  });
-}
-
-export function requestOf(line: string): ProxyRequest | null {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (!isRecord(parsed) || parsed.msg !== 'request' || !isRecord(parsed.audit)) return null;
-  const audit = parsed.audit;
-  if (audit.method === 'CONNECT') return null;
-  return {
-    at: stringOf(parsed.time),
-    method: stringOf(audit.method),
-    host: stringOf(audit.host),
-    path: stringOf(audit.path),
-    status: typeof audit.status_code === 'number' ? audit.status_code : null,
-    action: stringOf(audit.action),
-    swapped: swappedIds(parsed.request_transforms),
-  };
-}
-
-function noteLine(line: string): void {
-  const request = requestOf(line);
-  if (request !== null) {
-    recent.push(request);
-    if (recent.length > RECENT_MAX) recent.shift();
-    return;
-  }
-  if (/"level":"(WARN|ERROR)"/.test(line)) log.warn({ line: line.slice(0, 500) }, 'vault: iron-proxy');
-}
-
-function launch(): void {
-  const wanted = state.wanted;
-  if (wanted === null || state.child !== null) return;
-  const child = spawn(wanted.bin, ['-config', wanted.config], { stdio: ['ignore', 'pipe', 'pipe'], env: { PATH: process.env.PATH ?? '/usr/bin:/bin', [MANAGEMENT_KEY_ENV]: state.key } });
-  state.child = child;
-  state.startedAt = Date.now();
-  for (const stream of [child.stdout, child.stderr]) if (stream !== null) createInterface({ input: stream }).on('line', noteLine);
-  child.on('error', (err) => {
-    state.lastError = errMsg(err);
-  });
-  child.on('exit', (code) => {
-    state.child = null;
-    if (state.wanted === null) return;
-    state.lastError = `iron-proxy stopped (exit ${String(code)})`;
-    log.warn({ code, retryInMs: state.backoff }, 'vault: iron-proxy stopped, starting it again');
-    const wait = state.backoff;
-    state.backoff = Date.now() - state.startedAt > 60_000 ? 1000 : Math.min(state.backoff * 2, BACKOFF_MAX_MS);
-    setTimeout(launch, wait).unref();
-  });
-}
-
-async function reload(): Promise<boolean> {
-  try {
-    const res = await fetch(`http://127.0.0.1:${String(ports().management)}/v1/reload`, {
-      method: 'POST',
-      headers: { authorization: `Bearer ${state.key}` },
-      signal: AbortSignal.timeout(10_000),
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-
-async function listening(): Promise<boolean> {
-  try {
-    await fetch(`http://127.0.0.1:${String(ports().management)}/v1/reload`, { method: 'GET', signal: AbortSignal.timeout(2_000) });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function waitListening(ms = 10_000): Promise<boolean> {
-  const until = Date.now() + ms;
-  while (Date.now() < until) {
-    if (await listening()) return true;
-    await new Promise((r) => setTimeout(r, 200));
-  }
-  return false;
-}
-
-export async function runProxy(bin: string, config: string): Promise<void> {
-  const fresh = state.child === null;
-  state.wanted = { bin, config };
-  if (fresh) launch();
-  else if (await reload()) {
-    state.lastError = null;
-    return;
-  } else {
-    state.child?.kill('SIGTERM');
-    await new Promise((r) => setTimeout(r, state.backoff + 500));
-  }
-  if (!(await waitListening())) throw new Error(state.lastError ?? 'iron-proxy did not start');
-  state.lastError = null;
-}
-
-export function stopProxy(): void {
-  state.wanted = null;
-  state.child?.kill('SIGTERM');
-}
-
-export const proxyRunning = (): boolean => state.child !== null;
-export const proxyError = (): string | null => state.lastError;
-export const recentRequests = (): ProxyRequest[] => [...recent].reverse();

package/runtime/node_modules/@metro-labs/daemon/src/vault/store.ts

@@ -1,129 +0,0 @@
-import { existsSync, rmSync } from 'node:fs';
-import { stringOf } from '@metro-labs/http/api-http';
-import { ApiError } from '@metro-labs/http/api-error';
-import { isRecord } from '@metro-labs/core/is-record';
-import { newId } from '@metro-labs/core/ids';
-import { ensureSecureDir, readJson, writeSecure } from '@metro-labs/core/secure-fs';
-import { stateFile, valueFile, valuesDir, vaultDir } from './paths.js';
-
-export interface VaultSecret {
-  id: string;
-  name: string;
-  env: string;
-  hosts: string[];
-  createdAt: string;
-  updatedAt: string;
-}
-
-export interface VaultState {
-  version: 1;
-  enabled: boolean;
-  secrets: VaultSecret[];
-}
-
-export interface SecretInput {
-  name?: unknown;
-  env?: unknown;
-  hosts?: unknown;
-  value?: unknown;
-}
-
-const ENV_RE = /^[A-Z][A-Z0-9_]{2,63}$/;
-const HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
-const RESERVED_ENV = new Set(['HOME', 'PATH', 'USER', 'SHELL', 'LANG', 'TERM', 'LOGNAME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY']);
-const MAX_SECRETS = 100;
-const MAX_HOSTS = 20;
-const MAX_VALUE = 16 * 1024;
-
-function secretOf(raw: unknown): VaultSecret | null {
-  if (!isRecord(raw) || typeof raw.id !== 'string' || !ENV_RE.test(stringOf(raw.env))) return null;
-  const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((h): h is string => typeof h === 'string' && HOST_RE.test(h)) : [];
-  return { id: raw.id, name: stringOf(raw.name) || stringOf(raw.env), env: stringOf(raw.env), hosts, createdAt: stringOf(raw.createdAt), updatedAt: stringOf(raw.updatedAt) };
-}
-
-export function readVault(dir = vaultDir()): VaultState {
-  const raw = readJson<unknown>(stateFile(dir), null);
-  if (!isRecord(raw)) return { version: 1, enabled: false, secrets: [] };
-  const secrets = Array.isArray(raw.secrets) ? raw.secrets.map(secretOf).filter((s): s is VaultSecret => s !== null) : [];
-  return { version: 1, enabled: raw.enabled === true, secrets };
-}
-
-function writeVault(state: VaultState, dir = vaultDir()): void {
-  ensureSecureDir(dir);
-  writeSecure(stateFile(dir), `${JSON.stringify(state, null, 2)}\n`);
-}
-
-function normalizeName(raw: unknown): string {
-  const name = stringOf(raw).trim();
-  if (name === '' || name.length > 80) throw new ApiError('a name of 1 to 80 characters is required', 400);
-  return name;
-}
-
-function normalizeEnv(raw: unknown): string {
-  const env = stringOf(raw).trim();
-  if (!ENV_RE.test(env) || RESERVED_ENV.has(env))
-    throw new ApiError('the variable name must be capital letters, digits and _, 3 to 64 long, like OPENAI_API_KEY', 400);
-  return env;
-}
-
-function normalizeHosts(raw: unknown): string[] {
-  if (!Array.isArray(raw)) throw new ApiError('hosts must be a list of websites, like api.openai.com', 400);
-  const hosts = [...new Set(raw.map((h) => stringOf(h).trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '')).filter((h) => h !== ''))];
-  if (hosts.length === 0 || hosts.length > MAX_HOSTS) throw new ApiError(`a secret needs 1 to ${String(MAX_HOSTS)} websites`, 400);
-  const bad = hosts.find((h) => !HOST_RE.test(h));
-  if (bad !== undefined) throw new ApiError(`'${bad}' is not a website name; write it as api.example.com or *.example.com`, 400);
-  return hosts;
-}
-
-function normalizeValue(raw: unknown): string {
-  const value = stringOf(raw).trim();
-  if (value === '' || value.length > MAX_VALUE) throw new ApiError('a value of 1 to 16384 characters is required', 400);
-  return value;
-}
-
-function saveValue(id: string, value: string, dir: string): void {
-  ensureSecureDir(valuesDir(dir));
-  writeSecure(valueFile(id, dir), value);
-}
-
-export function addSecret(input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
-  const state = readVault(dir);
-  if (state.secrets.length >= MAX_SECRETS) throw new ApiError(`at most ${String(MAX_SECRETS)} secrets`, 400);
-  const env = normalizeEnv(input.env);
-  if (state.secrets.some((s) => s.env === env)) throw new ApiError(`${env} is already a secret`, 409);
-  const at = now.toISOString();
-  const secret: VaultSecret = { id: newId(), name: normalizeName(input.name ?? env), env, hosts: normalizeHosts(input.hosts), createdAt: at, updatedAt: at };
-  saveValue(secret.id, normalizeValue(input.value), dir);
-  writeVault({ ...state, secrets: [...state.secrets, secret] }, dir);
-  return secret;
-}
-
-export function updateSecret(id: string, input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
-  const state = readVault(dir);
-  const found = state.secrets.find((s) => s.id === id);
-  if (found === undefined) throw new ApiError('no such secret', 404);
-  const next: VaultSecret = {
-    ...found,
-    ...(input.name === undefined ? {} : { name: normalizeName(input.name) }),
-    ...(input.hosts === undefined ? {} : { hosts: normalizeHosts(input.hosts) }),
-    updatedAt: now.toISOString(),
-  };
-  if (input.value !== undefined) saveValue(id, normalizeValue(input.value), dir);
-  writeVault({ ...state, secrets: state.secrets.map((s) => (s.id === id ? next : s)) }, dir);
-  return next;
-}
-
-export function removeSecret(id: string, dir = vaultDir()): void {
-  const state = readVault(dir);
-  if (!state.secrets.some((s) => s.id === id)) throw new ApiError('no such secret', 404);
-  writeVault({ ...state, secrets: state.secrets.filter((s) => s.id !== id) }, dir);
-  rmSync(valueFile(id, dir), { force: true });
-}
-
-export function setVaultEnabled(enabled: boolean, dir = vaultDir()): VaultState {
-  const next = { ...readVault(dir), enabled };
-  writeVault(next, dir);
-  return next;
-}
-
-export const hasValue = (id: string, dir = vaultDir()): boolean => existsSync(valueFile(id, dir));

package/runtime/node_modules/@metro-labs/daemon/src/vault/trust.ts

@@ -1,44 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { errMsg, log } from '@metro-labs/core/log';
-import { asUser, type AgentUser } from '../agent-user/user.js';
-import { TRUSTED_CA } from './paths.js';
-import { mustHelper, rootHelper } from '../metro-user/privilege.js';
-
-const has = (bin: string): boolean => spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0;
-
-export function trustSystem(caFile: string): void {
-  const same = existsSync(TRUSTED_CA) && readFileSync(TRUSTED_CA, 'utf8') === readFileSync(caFile, 'utf8');
-  if (!same) mustHelper(['trust-ca']);
-}
-
-export function untrustSystem(): void {
-  if (existsSync(TRUSTED_CA)) mustHelper(['untrust-ca']);
-}
-
-const NSS_SCRIPT = [
-  'set -e',
-  'db="$HOME/.pki/nssdb"',
-  'mkdir -p "$db"',
-  '[ -f "$db/cert9.db" ] || certutil -d "sql:$db" -N --empty-password',
-  'certutil -d "sql:$db" -D -n "Metro vault" >/dev/null 2>&1 || true',
-  'certutil -d "sql:$db" -A -t "C,," -n "Metro vault" -i "$1"',
-].join('\n');
-
-function ensureCertutil(): boolean {
-  if (has('certutil')) return true;
-  return rootHelper(['install-nss-tools']).status === 0 && has('certutil');
-}
-
-export function trustBrowsers(user: AgentUser): string | null {
-  try {
-    if (!ensureCertutil()) return 'certutil is missing, so browsers the agent starts will not trust the vault (apt-get install libnss3-tools)';
-    const [file, argv] = asUser(user, 'sh', ['-c', NSS_SCRIPT, 'metro', TRUSTED_CA]);
-    const run = spawnSync(file, argv, { encoding: 'utf8', timeout: 30_000 });
-    if (run.status !== 0) return `browsers will not trust the vault: ${run.stderr.trim()}`;
-    return null;
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'vault: could not add the certificate for browsers');
-    return errMsg(err);
-  }
-}