@stage-labs/metro 0.1.0-beta.51 → 0.1.0-beta.53

package/dist/cli.js

@@ -31,7 +31,7 @@ const USAGE = `metro — run your agent on this machine
   metro bedrock [args...]
                   the same, with inference on Amazon Bedrock through a local proxy so the
                   channel still works (needs AWS_BEARER_TOKEN_BEDROCK and AWS_REGION)
-  metro update    update to the newest published version
+  metro update    update to the newest published version (--check only reports)
   metro version   print this CLI's version
 
 Start Claude Code with every connector, writing nothing to disk:
@@ -73,7 +73,7 @@ const COMMANDS = {
     plugin: installPlugin,
     claude: () => launchClaude(process.argv.slice(3)),
     bedrock: () => bedrock(process.argv.slice(3)),
-    update,
+    update: () => update(process.argv.slice(3)),
     version: async () => {
         process.stdout.write(`${currentVersion()}\n`);
         return Promise.resolve(0);

package/dist/local.js

@@ -29,6 +29,32 @@ export function localAgents(dir = agentsDir()) {
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
 }
+export function localStations(dir = agentsDir()) {
+    if (!existsSync(dir))
+        return [];
+    const out = new Set();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const path = join(dir, entry.name, 'agent.json');
+        if (!existsSync(path))
+            continue;
+        try {
+            const file = JSON.parse(readFileSync(path, 'utf8'));
+            if (!Array.isArray(file.stations))
+                continue;
+            for (const s of file.stations) {
+                const station = s.station;
+                if (typeof station === 'string')
+                    out.add(station);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return [...out].sort();
+}
 export function pickLocalAgent(agents, wanted) {
     if (wanted !== undefined && wanted !== '') {
         const found = agents.find((a) => a.name === wanted || a.id === wanted);

package/dist/runtime-install.js

@@ -0,0 +1,84 @@
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { localStations } from './local.js';
+import { SERVER_ENTRY, findBun, runtimeDir } from './runtime.js';
+export const MANIFEST_FILE = 'stations.json';
+const METRO_SOURCES = join('node_modules', '@metro-labs');
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+export function runtimeStore() {
+    const env = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+    return env === '' ? join(homedir(), '.metro', 'runtime') : env;
+}
+const isRecord = (v) => typeof v === 'object' && v !== null;
+const ranges = (raw) => isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e) => typeof e[1] === 'string'))
+    : {};
+export function readManifest(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!isRecord(raw))
+        throw new Error(`${path} is not a runtime manifest`);
+    const stations = isRecord(raw.stations) ? raw.stations : {};
+    return {
+        core: ranges(raw.core),
+        stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+    };
+}
+export function dependenciesFor(manifest, stations) {
+    const out = { ...manifest.core };
+    for (const station of new Set(stations))
+        Object.assign(out, manifest.stations[station] ?? {});
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+const packageText = (deps) => `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+function readOrNull(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function syncSources(sources, store) {
+    const stamp = readOrNull(join(sources, 'runtime.json'));
+    if (stamp !== null && readOrNull(join(store, 'runtime.json')) === stamp)
+        return false;
+    rmSync(join(store, METRO_SOURCES), { recursive: true, force: true });
+    cpSync(join(sources, METRO_SOURCES), join(store, METRO_SOURCES), { recursive: true });
+    if (stamp !== null)
+        writeFileSync(join(store, 'runtime.json'), stamp);
+    return true;
+}
+export function installDependencies(store, deps, bun, log) {
+    const wanted = packageText(deps);
+    const marker = join(store, 'node_modules', '.metro-installed');
+    if (existsSync(marker) && readOrNull(join(store, 'package.json')) === wanted)
+        return false;
+    writeFileSync(join(store, 'package.json'), wanted);
+    log(`Installing the channel SDKs this machine needs into ${store}`);
+    const run = spawnSync(bun, ['install', '--no-summary', '--no-progress'], {
+        cwd: store,
+        stdio: ['ignore', 'inherit', 'inherit'],
+        timeout: INSTALL_TIMEOUT_MS,
+    });
+    if (run.error !== undefined || run.status !== 0)
+        throw new Error(`bun install failed in ${store}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+    writeFileSync(marker, `${new Date().toISOString()}\n`);
+    return true;
+}
+export function prepareRuntime(opts = {}) {
+    const sources = opts.sources ?? runtimeDir();
+    const manifestPath = join(sources, MANIFEST_FILE);
+    if (!existsSync(manifestPath))
+        return { dir: sources, entry: join(sources, SERVER_ENTRY), trains: join(sources, 'trains'), manifest: null };
+    const store = opts.store ?? runtimeStore();
+    const log = opts.log ??
+        ((line) => {
+            process.stderr.write(`${line}\n`);
+        });
+    mkdirSync(join(store, 'trains'), { recursive: true });
+    syncSources(sources, store);
+    installDependencies(store, dependenciesFor(readManifest(manifestPath), localStations(opts.agents)), opts.bun ?? findBun(), log);
+    return { dir: store, entry: join(store, SERVER_ENTRY), trains: join(store, 'trains'), manifest: manifestPath };
+}

package/dist/runtime.js

@@ -31,7 +31,8 @@ export function findBun() {
 }
 export const localPort = () => Number(process.env.METRO_WEBHOOK_PORT) || 8420;
 export const localUrl = () => `http://127.0.0.1:${String(localPort())}`;
-export function spawnPlan(plan) {
+export const RESTART_CODE = 75;
+function spawnOnce(plan) {
     const child = spawn(plan.command, plan.args, {
         cwd: plan.cwd,
         env: plan.env,
@@ -40,11 +41,23 @@ export function spawnPlan(plan) {
     const relay = (sig) => () => {
         child.kill(sig);
     };
-    process.on('SIGINT', relay('SIGINT'));
-    process.on('SIGTERM', relay('SIGTERM'));
+    const onInt = relay('SIGINT');
+    const onTerm = relay('SIGTERM');
+    process.on('SIGINT', onInt);
+    process.on('SIGTERM', onTerm);
     return new Promise((resolve) => {
         child.on('exit', (code) => {
+            process.off('SIGINT', onInt);
+            process.off('SIGTERM', onTerm);
             resolve(code ?? 0);
         });
     });
 }
+export async function spawnPlan(plan) {
+    for (;;) {
+        const code = await spawnOnce(plan());
+        if (code !== RESTART_CODE)
+            return code;
+        process.stderr.write('metro was updated; restarting the daemon on the new version\n');
+    }
+}

package/dist/serve.js

@@ -4,7 +4,8 @@ import { join } from 'node:path';
 import { agentsDir } from './local.js';
 import { currentVersion } from './version.js';
 import { serveLockedBy, serveStateDir } from './control.js';
-import { findBun, localPort, runtimeDir, SERVER_ENTRY, spawnPlan, } from './runtime.js';
+import { findBun, localPort, SERVER_ENTRY, spawnPlan } from './runtime.js';
+import { prepareRuntime } from './runtime-install.js';
 const SCRUBBED = new Set(['METRO_RUN_TOKEN', 'METRO_AGENT', 'DATABASE_URL']);
 const PORT_FLAG = /^--port=(.*)$/;
 const OWNER_FLAG = /^--owner=(.*)$/;
@@ -80,14 +81,18 @@ export function servePlan(opts) {
     return {
         command: findBun(),
         args: [SERVER_ENTRY],
-        cwd: opts.dir,
+        cwd: opts.runtime.dir,
         env: {
             ...env,
             METRO_MODE: 'local',
             METRO_VERSION: currentVersion(),
+            METRO_CLI_BIN: process.argv[1] ?? '',
             METRO_WEBHOOK_PORT: String(opts.port),
             METRO_HTTP_HOST: process.env.METRO_HTTP_HOST ?? '127.0.0.1',
-            METRO_TRAINS_DIR: join(opts.dir, 'trains'),
+            METRO_TRAINS_DIR: opts.runtime.trains,
+            ...(opts.runtime.manifest === null
+                ? {}
+                : { METRO_RUNTIME_STORE: opts.runtime.dir, METRO_RUNTIME_MANIFEST: opts.runtime.manifest }),
             METRO_STATE_DIR: process.env.METRO_STATE_DIR ?? serveStateDir(),
             ...(opts.tunnel ? { METRO_TUNNEL: 'quick' } : {}),
             ...(opts.owner === null ? {} : { METRO_OWNER: opts.owner }),
@@ -103,7 +108,6 @@ export function serve(argv) {
     requireOwner(owner);
     if (tunnel)
         findCloudflared();
-    const plan = servePlan({ dir: runtimeDir(), port, tunnel, owner });
     process.stderr.write(`Starting a metro daemon of your own on http://127.0.0.1:${String(port)}\n`);
-    return spawnPlan(plan);
+    return spawnPlan(() => servePlan({ runtime: prepareRuntime(), port, tunnel, owner }));
 }

package/dist/update.js

@@ -9,7 +9,19 @@ export function installArgs(manager, version) {
         ? ['add', '--global', spec]
         : ['install', '--global', spec];
 }
-export async function update() {
+export const checkReport = (current, latest) => ({
+    current,
+    latest,
+    newer: latest !== '' && isNewer(latest, current),
+});
+export async function updateCheck() {
+    return checkReport(currentVersion(), await publishedVersion());
+}
+export async function update(argv = []) {
+    if (argv.includes('--check')) {
+        process.stdout.write(`${JSON.stringify(await updateCheck())}\n`);
+        return 0;
+    }
     const current = currentVersion();
     const newest = await publishedVersion();
     if (newest === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.51",
+  "version": "0.1.0-beta.53",
   "description": "The metro command line. Sign in once per machine, then hand your MCP connector list to Claude Code without the credentials touching disk, argv or shell history.",
   "license": "MIT",
   "repository": {
@@ -35,26 +35,5 @@
     "knip": "^6.15.0",
     "madge": "^8.0.0",
     "typescript": "^5"
-  },
-  "dependencies": {
-    "@discordjs/voice": "^0.19.2",
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@mtcute/bun": "0.30.1",
-    "@xmtp/content-type-primitives": "^3.0.1",
-    "@xmtp/content-type-reaction": "^2.0.2",
-    "@xmtp/content-type-remote-attachment": "^2.0.4",
-    "@xmtp/content-type-reply": "^2.0.3",
-    "@xmtp/content-type-wallet-send-calls": "^2.0.0",
-    "@xmtp/node-bindings": "1.9.1",
-    "@xmtp/node-sdk": "^6.0.0",
-    "baileys": "7.0.0-rc14",
-    "discord.js": "^14.26.4",
-    "drizzle-orm": "^0.44.0",
-    "pino": "^9.5.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "prism-media": "^1.3.5",
-    "viem": "^2.52.2",
-    "zod": "^3.23.8"
   }
 }

package/runtime/node_modules/@metro-labs/mcp/src/daemon/account-api.ts

@@ -13,7 +13,7 @@ import {
   parseAccountId,
   type AccountRef,
 } from '../db/account-attach.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 import {
   ATTACHABLE_STATIONS,
   isAttachStation,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/attach-session.ts

@@ -1,7 +1,8 @@
 import { randomBytes } from 'node:crypto';
 import { ApiError } from './api-error.js';
 import { errMsg, log } from './log.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
+import { ensureStationDeps } from './runtime-deps.js';
 import {
   startInteractiveAttach,
   type AttachDriver,
@@ -216,6 +217,7 @@ export class AttachSessions {
     };
     this.sessions.set(attachId, session);
     try {
+      ensureStationDeps(station);
       const started = await (this.deps.start ?? startInteractiveAttach)(
         station,
         input,

package/runtime/node_modules/@metro-labs/mcp/src/daemon/boot.ts

@@ -23,6 +23,7 @@ import { fileSource } from '../db/file-source.js';
 import { ensureLocalSessionSecret } from './local-secret.js';
 import { applyLocalOwner } from './local-owner.js';
 import { localOwner } from '../db/file-admin.js';
+import { ensureStationDeps } from './runtime-deps.js';
 import { localSessionApis } from './local-mode.js';
 import type { ModeInfo } from './mode-api.js';
 import type { SessionApis } from './session-apis.js';
@@ -39,13 +40,7 @@ import {
 } from '../stations/registry.js';
 import { prepareAccount } from '../stations/attach.js';
 import { materializeFrom, reloadFrom } from '../db/materialize.js';
-import {
-  deleteVaultForOwner,
-  getVaultForOwner,
-  listVaultForOwner,
-  putVaultForOwner,
-} from '../db/vault.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 import { startUploadReaper } from './upload-store.js';
 
 installCrashGuard();
@@ -96,7 +91,10 @@ async function syncStations(station: StationName): Promise<void> {
   const { removed } = await reloadFrom(fileSource);
   if (stationByName(station)?.hasTrain === false) return;
   if (removed.includes(station)) await supervisor.stopTrain(station);
-  else supervisor.requestReload(station);
+  else {
+    ensureStationDeps(station);
+    supervisor.requestReload(station);
+  }
 }
 
 const hostedMode = (): ModeInfo => ({
@@ -106,23 +104,30 @@ const hostedMode = (): ModeInfo => ({
   version: METRO_VERSION,
 });
 
-function sessionApis(): SessionApis {
+async function sessionApis(): Promise<SessionApis> {
   if (isLocalMode())
     return localSessionApis({
       syncStations,
+      restart: () => {
+        exitCode = RESTART_EXIT;
+        onShutdown();
+      },
       closeAgentSession,
       gatherAccounts: gatherAccountsForAgents,
       capabilities: accountStationCapabilities,
       liveness: agentLiveness,
       prepareAccount,
     });
+  const vault = await import('../db/vault.js');
+  const users = await import('../db/users.js');
   return {
     vaultApi: {
-      list: listVaultForOwner,
-      put: putVaultForOwner,
-      get: getVaultForOwner,
-      remove: deleteVaultForOwner,
+      list: vault.listVaultForOwner,
+      put: vault.putVaultForOwner,
+      get: vault.getVaultForOwner,
+      remove: vault.deleteVaultForOwner,
     },
+    siwe: { ensureUser: users.ensureUserByAddress },
     mode: hostedMode,
   };
 }
@@ -137,7 +142,7 @@ async function main(): Promise<void> {
   const metroMcp = await createMetroMcp();
   webhookServer = await startWebhookServer(
     emit,
-    sessionApis(),
+    await sessionApis(),
     metroMcp.httpHandler,
     metroCall,
   );
@@ -153,6 +158,8 @@ async function main(): Promise<void> {
 }
 
 const SHUTDOWN_TIMEOUT_MS = 3_000;
+const RESTART_EXIT = 75;
+let exitCode = 0;
 let shuttingDown = false;
 async function shutdown(): Promise<void> {
   if (shuttingDown) return;
@@ -173,7 +180,7 @@ async function shutdown(): Promise<void> {
     ]);
   }
   await supervisor.stop();
-  process.exit(0);
+  process.exit(exitCode);
 }
 const onShutdown = (): void => {
   shutdown().catch((err: unknown) => {

package/runtime/node_modules/@metro-labs/mcp/src/daemon/bundle-api.ts

@@ -5,7 +5,7 @@ import { ApiError } from './api-error.js';
 import { isRecord } from './is-record.js';
 import { parseId } from '../db/ids.js';
 import type { LoadedAccount, LoadedAgent, LoadedConnector } from '../db/materialize.js';
-import { STATIONS } from '../db/schema.js';
+import { STATIONS } from '../db/stations.js';
 
 const AGENTS = '/api/agents';
 const RESTORE_PATH = `${AGENTS}/restore`;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/http.ts

@@ -328,7 +328,7 @@ function handleSignInRoutes(
   res: ServerResponse,
   apis: SessionApis,
 ): boolean {
-  if (handleSiweAuthRequest(req, res, apis.siwe)) return true;
+  if (apis.siwe !== undefined && handleSiweAuthRequest(req, res, apis.siwe)) return true;
   return apis.mode !== undefined && handleModeRequest(req, res, apis.mode);
 }
 

package/runtime/node_modules/@metro-labs/mcp/src/daemon/local-mode.ts

@@ -48,10 +48,11 @@ import {
   readLocalAgentFile,
 } from '../db/file-admin.js';
 import { listAgentFiles, readAgentFile } from '../db/file-source.js';
-import type { StationName } from '../db/schema.js';
+import type { StationName } from '../db/stations.js';
 
 export interface LocalModeDeps {
   syncStations: (station: StationName) => Promise<void>;
+  restart: () => void;
   closeAgentSession: (id: string) => Promise<boolean>;
   gatherAccounts: AgentApiDeps['gatherAccounts'];
   capabilities: AgentApiDeps['capabilities'];
@@ -189,6 +190,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     relayApi,
     localCli,
     claudeApi: { authorize: (subject) => { assertLocalOwner(subject); } },
+    updateApi: { authorize: (subject) => { assertLocalOwner(subject); }, restart: deps.restart },
     siwe: { ensureUser: ownerSignIn },
     mode: localModeInfo,
   };

package/runtime/node_modules/@metro-labs/mcp/src/daemon/runtime-deps.ts

@@ -0,0 +1,82 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { log } from './log.js';
+import { isRecord } from './is-record.js';
+import type { StationName } from '../db/stations.js';
+import { knownAccounts } from '../db/agent-map.js';
+
+const INSTALL_TIMEOUT_MS = 15 * 60_000;
+
+export interface RuntimeManifest {
+  core: Record<string, string>;
+  stations: Record<string, Record<string, string>>;
+}
+
+export interface RuntimeStore {
+  dir: string;
+  manifest: RuntimeManifest;
+}
+
+const ranges = (raw: unknown): Record<string, string> =>
+  isRecord(raw)
+    ? Object.fromEntries(Object.entries(raw).filter((e): e is [string, string] => typeof e[1] === 'string'))
+    : {};
+
+export function readManifest(path: string): RuntimeManifest {
+  const raw: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  if (!isRecord(raw)) throw new Error(`${path} is not a runtime manifest`);
+  const stations = isRecord(raw.stations) ? raw.stations : {};
+  return {
+    core: ranges(raw.core),
+    stations: Object.fromEntries(Object.entries(stations).map(([name, deps]) => [name, ranges(deps)])),
+  };
+}
+
+export function runtimeStore(): RuntimeStore | null {
+  const dir = process.env.METRO_RUNTIME_STORE?.trim() ?? '';
+  const manifest = process.env.METRO_RUNTIME_MANIFEST?.trim() ?? '';
+  if (dir === '' || manifest === '') return null;
+  return { dir, manifest: readManifest(manifest) };
+}
+
+export function dependenciesFor(manifest: RuntimeManifest, stations: Iterable<string>): Record<string, string> {
+  const out: Record<string, string> = { ...manifest.core };
+  for (const station of new Set(stations)) Object.assign(out, manifest.stations[station] ?? {});
+  return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+const packageText = (deps: Record<string, string>): string =>
+  `${JSON.stringify({ name: 'metro-runtime', private: true, dependencies: deps }, null, 2)}\n`;
+
+function current(dir: string): string | null {
+  try {
+    return readFileSync(join(dir, 'package.json'), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function installRuntime(store: RuntimeStore, stations: Iterable<string>): boolean {
+  const wanted = packageText(dependenciesFor(store.manifest, stations));
+  const installed = existsSync(join(store.dir, 'node_modules', '.metro-installed'));
+  if (installed && current(store.dir) === wanted) return false;
+  mkdirSync(store.dir, { recursive: true });
+  writeFileSync(join(store.dir, 'package.json'), wanted);
+  log.info({ dir: store.dir }, 'runtime: installing the channel SDKs this machine needs');
+  const run = spawnSync('bun', ['install', '--no-summary', '--no-progress'], {
+    cwd: store.dir,
+    stdio: ['ignore', 'inherit', 'inherit'],
+    timeout: INSTALL_TIMEOUT_MS,
+  });
+  if (run.error !== undefined || run.status !== 0)
+    throw new Error(`bun install failed in ${store.dir}: ${run.error?.message ?? `exit ${String(run.status)}`}`);
+  writeFileSync(join(store.dir, 'node_modules', '.metro-installed'), `${new Date().toISOString()}\n`);
+  return true;
+}
+
+export function ensureStationDeps(station: StationName): void {
+  const store = runtimeStore();
+  if (store === null) return;
+  installRuntime(store, [...knownAccounts().map((a) => a.station), station]);
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/session-apis.ts

@@ -16,12 +16,14 @@ import { handleClaudeRequest, type ClaudeApiDeps } from './claude-api.js';
 import type { ModeInfo } from './mode-api.js';
 import { handleVaultApiRequest, type VaultApiDeps } from './vault-api.js';
 import { handleBundleRequest, type BundleApiDeps } from './bundle-api.js';
+import { handleUpdateRequest, type UpdateApiDeps } from './update-api.js';
 
 export interface SessionApis {
   agentApi?: AgentApiDeps;
   agentConnectorApi?: AgentConnectorApiDeps;
   bundleApi?: BundleApiDeps;
   vaultApi?: VaultApiDeps;
+  updateApi?: UpdateApiDeps;
   localCli?: LocalCliDeps;
   claudeApi?: ClaudeApiDeps;
   connectorApi?: ConnectorApiDeps;
@@ -44,6 +46,7 @@ export function handleSessionApis(
     ...when(apis.connectorApi, (d) => handleConnectorApiRequest(req, res, d)),
     ...when(apis.bundleApi, (d) => handleBundleRequest(req, res, d)),
     ...when(apis.vaultApi, (d) => handleVaultApiRequest(req, res, d)),
+    ...when(apis.updateApi, (d) => handleUpdateRequest(req, res, d)),
     ...when(apis.claudeApi, (d) => handleClaudeRequest(req, res, d)),
     ...when(apis.agentConnectorApi, (d) => handleAgentConnectorRequest(req, res, d)),
     ...when(apis.agentApi, (d) => handleAgentApiRequest(req, res, d)),

package/runtime/node_modules/@metro-labs/mcp/src/daemon/siwe-routes.ts

@@ -11,7 +11,6 @@ import { mintNonce, takeNonce } from './siwe-nonces.js';
 import { verifySiweLogin } from './siwe-auth.js';
 import { signSession } from './session.js';
 import { SESSION_TTL_SEC } from './session-config.js';
-import { ensureUserByAddress } from '../db/users.js';
 
 const NONCE_PATH = '/auth/siwe/nonce';
 const VERIFY_PATH = '/auth/siwe/verify';
@@ -20,8 +19,6 @@ export interface SiweRouteDeps {
   ensureUser: (address: string) => Promise<string>;
 }
 
-const defaultDeps: SiweRouteDeps = { ensureUser: ensureUserByAddress };
-
 async function handleVerify(
   req: IncomingMessage,
   res: ServerResponse,
@@ -68,7 +65,7 @@ function refused(
 export function handleSiweAuthRequest(
   req: IncomingMessage,
   res: ServerResponse,
-  deps: SiweRouteDeps = defaultDeps,
+  deps: SiweRouteDeps,
 ): boolean {
   const path = (req.url ?? '').split('?')[0] ?? '';
   if (ROUTES[path] === undefined) return false;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/update-api.ts

@@ -0,0 +1,119 @@
+import { execFile } from 'node:child_process';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { errMsg, log } from './log.js';
+import { ApiError } from './api-error.js';
+import { apiFailure, apiSession, cors, sendJson } from './api-http.js';
+import { isRecord } from './is-record.js';
+import { METRO_VERSION } from './version.js';
+
+const PATH = '/api/update';
+const CHECK_TTL_MS = 10 * 60_000;
+const CHECK_TIMEOUT_MS = 30_000;
+const UPDATE_TIMEOUT_MS = 5 * 60_000;
+const RESTART_DELAY_MS = 500;
+const OUTPUT_TAIL = 800;
+
+export interface UpdateCheck {
+  current: string;
+  latest: string;
+  newer: boolean;
+}
+
+export interface UpdateResult {
+  updated: boolean;
+  version: string;
+  restarting: boolean;
+}
+
+export interface UpdateApiDeps {
+  authorize: (subject: string) => void;
+  restart: () => void;
+  cliBin?: () => string;
+}
+
+const cliBinFromEnv = (): string => process.env.METRO_CLI_BIN?.trim() ?? '';
+
+function runCli(bin: string, args: string[], timeout: number): Promise<{ stdout: string; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    execFile(process.execPath, [bin, ...args], { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err === null) resolve({ stdout, stderr });
+      else reject(new ApiError(`metro update failed: ${(stderr || err.message).trim().slice(-OUTPUT_TAIL)}`, 502));
+    });
+  });
+}
+
+let cached: { at: number; check: UpdateCheck } | null = null;
+
+function parseCheck(raw: string): UpdateCheck {
+  let body: unknown;
+  try {
+    body = JSON.parse(raw.trim().split('\n').at(-1) ?? '');
+  } catch {
+    throw new ApiError('metro update --check returned no report', 502);
+  }
+  if (!isRecord(body) || typeof body.current !== 'string' || typeof body.latest !== 'string')
+    throw new ApiError('metro update --check returned an unexpected report', 502);
+  return { current: body.current, latest: body.latest, newer: body.newer === true };
+}
+
+async function check(bin: string, now = Date.now()): Promise<UpdateCheck> {
+  if (cached !== null && now - cached.at < CHECK_TTL_MS) return cached.check;
+  const out = await runCli(bin, ['update', '--check'], CHECK_TIMEOUT_MS);
+  cached = { at: now, check: parseCheck(out.stdout) };
+  return cached.check;
+}
+
+async function apply(bin: string, deps: UpdateApiDeps): Promise<UpdateResult> {
+  const before = await check(bin);
+  if (!before.newer) return { updated: false, version: before.current, restarting: false };
+  const out = await runCli(bin, ['update'], UPDATE_TIMEOUT_MS);
+  cached = null;
+  log.info({ from: before.current, to: before.latest, output: out.stderr.trim().slice(-OUTPUT_TAIL) }, 'update-api: metro updated, restarting');
+  setTimeout(() => {
+    deps.restart();
+  }, RESTART_DELAY_MS).unref();
+  return { updated: true, version: before.latest, restarting: true };
+}
+
+function binOrThrow(deps: UpdateApiDeps): string {
+  const bin = (deps.cliBin ?? cliBinFromEnv)();
+  if (bin === '')
+    throw new ApiError('this daemon was not started by metro serve, so it cannot update itself: run metro update on the machine', 400);
+  return bin;
+}
+
+export function handleUpdateRequest(req: IncomingMessage, res: ServerResponse, deps: UpdateApiDeps): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  if (path !== PATH) return false;
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (req.method !== 'GET' && req.method !== 'POST') {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  const session = apiSession(req);
+  if (!session) {
+    sendJson(req, res, 401, { error: 'unauthorized' });
+    return true;
+  }
+  Promise.resolve()
+    .then(async (): Promise<unknown> => {
+      deps.authorize(session.subject);
+      const bin = binOrThrow(deps);
+      if (req.method === 'GET') return { ...(await check(bin)), running: METRO_VERSION };
+      return apply(bin, deps);
+    })
+    .then((body) => {
+      sendJson(req, res, 200, body);
+    })
+    .catch((err: unknown) => {
+      if (err instanceof ApiError) apiFailure(req, res, err, 'update-api');
+      else {
+        log.warn({ err: errMsg(err) }, 'update-api: request failed');
+        if (!res.headersSent) sendJson(req, res, 500, { error: 'update api failed' });
+      }
+    });
+  return true;
+}

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-api.ts

@@ -2,9 +2,9 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from './log.js';
 import { verifyMessage } from 'viem';
 import { apiFailure, cors, readJsonBody, sendJson } from './api-http.js';
-import { normalizeAddress } from '../db/users.js';
+import { normalizeAddress } from '../db/address.js';
 import { parseId } from '../db/ids.js';
-import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from '../db/vault.js';
+import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from './vault-types.js';
 
 const PREFIX = '/api/vault';
 const BODY_MAX = ENVELOPE_MAX + 64 * 1024;

package/runtime/node_modules/@metro-labs/mcp/src/daemon/vault-types.ts

@@ -0,0 +1,12 @@
+export interface VaultEntry {
+  id: string;
+  name: string;
+  stations: string[];
+  syncedAt: string;
+}
+
+export interface VaultBundle extends VaultEntry {
+  envelope: Record<string, unknown>;
+}
+
+export const ENVELOPE_MAX = 2 * 1024 * 1024;

package/runtime/node_modules/@metro-labs/mcp/src/db/account-attach.ts

@@ -1,4 +1,4 @@
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 
 const ACCOUNT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 

package/runtime/node_modules/@metro-labs/mcp/src/db/address.ts

@@ -0,0 +1,6 @@
+const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
+
+export function normalizeAddress(raw: string): string | null {
+  const address = raw.trim().toLowerCase();
+  return ADDRESS_RE.test(address) ? address : null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/agent-scope.ts

@@ -3,7 +3,7 @@ import {
   agentIdForAccount,
   stationAgentIds,
 } from './agent-map.js';
-import { STATIONS } from './schema.js';
+import { STATIONS } from './stations.js';
 
 const ACCOUNT_STATIONS = new Set<string>(STATIONS);
 

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -1,6 +1,6 @@
 import type { ConnectorAuth, VerifiedRecord } from '../daemon/connector-verify.js';
 import { readConfig, signInState, type ConnectorSignIn } from './connector-config.js';
-import type { ConnectorTransport } from './schema.js';
+import type { ConnectorTransport } from './stations.js';
 
 export interface Connector {
   id: string;

package/runtime/node_modules/@metro-labs/mcp/src/db/file-admin.ts

@@ -25,8 +25,8 @@ import {
 import { newId } from './ids.js';
 import { registerKey, rotateAgentKey, unregisterAgentKey } from './key-map.js';
 import { MOVABLE_STATIONS, type LoadedAgent } from './materialize.js';
-import type { StationName } from './schema.js';
-import { normalizeAddress } from './users.js';
+import type { StationName } from './stations.js';
+import { normalizeAddress } from './address.js';
 
 export const LOCAL_PROJECT_ID = 'localdaemon';
 const OWNER_FILE = '.owner';

package/runtime/node_modules/@metro-labs/mcp/src/db/file-source.ts

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { AGENT_NAME_RE, ID_RE } from './ids.js';
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 import type { LoadedAccount, LoadedAgent, StationSource } from './materialize.js';
 import { isRecord } from '../daemon/is-record.js';
 

package/runtime/node_modules/@metro-labs/mcp/src/db/materialize.ts

@@ -18,7 +18,7 @@ import {
   type AllowlistMap,
 } from './agent-map.js';
 import { setKeyMap } from './key-map.js';
-import { STATIONS, type StationName } from './schema.js';
+import { STATIONS, type StationName } from './stations.js';
 
 interface StationTarget {
   file: string;

package/runtime/node_modules/@metro-labs/mcp/src/db/schema.ts

@@ -1,15 +1,8 @@
 import { index, jsonb, pgTable, text } from 'drizzle-orm/pg-core';
 
-export const STATIONS = [
-  'xmtp',
-  'telegram-bot',
-  'telegram',
-  'discord-bot',
-  'whatsapp',
-  'webhook',
-] as const;
+import { STATIONS, type ConnectorTransport, type StationName } from './stations.js';
 
-export type StationName = (typeof STATIONS)[number];
+export { STATIONS, type ConnectorTransport, type StationName };
 
 export const users = pgTable('users', {
   id: text('id').primaryKey(),
@@ -19,7 +12,6 @@ export const users = pgTable('users', {
 
 export type ProjectRole = 'admin' | 'member';
 
-export type ConnectorTransport = 'http' | 'sse';
 
 export const vault = pgTable(
   'vault',

package/runtime/node_modules/@metro-labs/mcp/src/db/stations.ts

@@ -0,0 +1,12 @@
+export const STATIONS = [
+  'xmtp',
+  'telegram-bot',
+  'telegram',
+  'discord-bot',
+  'whatsapp',
+  'webhook',
+] as const;
+
+export type StationName = (typeof STATIONS)[number];
+
+export type ConnectorTransport = 'http' | 'sse';

package/runtime/node_modules/@metro-labs/mcp/src/db/users.ts

@@ -3,9 +3,9 @@ import { ApiError } from '../daemon/api-error.js';
 import { getDb } from './client.js';
 import { newId } from './ids.js';
 import { users } from './schema.js';
+import { normalizeAddress } from './address.js';
 
 const UNIQUE_VIOLATION = '23505';
-const ADDRESS_RE = /^0x[0-9a-f]{40}$/;
 
 export class UserError extends ApiError {}
 
@@ -22,10 +22,6 @@ export function isUniqueViolation(err: unknown): boolean {
   return false;
 }
 
-export function normalizeAddress(raw: string): string | null {
-  const address = raw.trim().toLowerCase();
-  return ADDRESS_RE.test(address) ? address : null;
-}
 
 export async function ensureUserByAddress(raw: string): Promise<string> {
   const address = normalizeAddress(raw);

package/runtime/node_modules/@metro-labs/mcp/src/db/vault.ts

@@ -3,29 +3,19 @@ import { ApiError } from '../daemon/api-error.js';
 import { isRecord } from '../daemon/is-record.js';
 import { getDb } from './client.js';
 import { AGENT_NAME_RE, parseId } from './ids.js';
-import { STATIONS, vault } from './schema.js';
-import { normalizeAddress } from './users.js';
+import { vault } from './schema.js';
+import { STATIONS } from './stations.js';
+import { normalizeAddress } from './address.js';
 
 export class VaultError extends ApiError {}
 
-export interface VaultEntry {
-  id: string;
-  name: string;
-  stations: string[];
-  syncedAt: string;
-}
-
-export interface VaultBundle extends VaultEntry {
-  envelope: Record<string, unknown>;
-}
+import { ENVELOPE_MAX, type VaultBundle, type VaultEntry } from '../daemon/vault-types.js';
 
 export interface VaultInput {
   name: string;
   stations: string[];
   envelope: Record<string, unknown>;
 }
-
-export const ENVELOPE_MAX = 2 * 1024 * 1024;
 const STATION_NAMES = new Set<string>(STATIONS);
 
 const missing = (): VaultError => new VaultError('no such bundle', 404);

package/runtime/node_modules/@metro-labs/mcp/src/mcp/accounts.ts

@@ -7,7 +7,7 @@ import { listEndpoints } from '../daemon/tunnel.js';
 import { hookUrl } from '../stations/attach.js';
 import { agentIdForAccount, knownAccounts, type KnownAccount } from '../db/agent-map.js';
 import { stationRunsHere } from '../db/materialize.js';
-import { type StationName } from '../db/schema.js';
+import { type StationName } from '../db/stations.js';
 
 const accountId = (acc: unknown): string | undefined => {
   const id = (acc as { id?: unknown }).id;

package/runtime/node_modules/@metro-labs/mcp/src/stations/attach.ts

@@ -8,6 +8,7 @@ import {
   verifyTelegramBotToken,
 } from '@metro-labs/telegram-bot/verify';
 import { ApiError } from '../daemon/api-error.js';
+import { ensureStationDeps } from '../daemon/runtime-deps.js';
 import { publicBaseOrDefault } from '../daemon/attach-serve.js';
 import {
   discardXmtpDb,
@@ -175,6 +176,7 @@ export async function prepareAccount(
   input: AttachInput,
   verify: VerifyXmtpKey = verifyXmtpKeyOutOfProcess,
 ): Promise<PreparedAccount> {
+  ensureStationDeps(input.station);
   if (input.station === 'discord-bot') return prepareDiscord(input.token);
   if (input.station === 'telegram-bot') return prepareTelegram(input.token);
   if (input.station === 'webhook') return prepareWebhook();

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.51"
+  "version": "0.1.0-beta.53"
 }

package/runtime/stations.json

@@ -0,0 +1,34 @@
+{
+  "core": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "pino": "^9.5.0",
+    "pino-pretty": "^13.1.3",
+    "viem": "2.52.2",
+    "zod": "^3.23.8"
+  },
+  "stations": {
+    "xmtp": {
+      "@xmtp/content-type-primitives": "^3.0.1",
+      "@xmtp/content-type-reaction": "^2.0.2",
+      "@xmtp/content-type-remote-attachment": "^2.0.4",
+      "@xmtp/content-type-reply": "^2.0.3",
+      "@xmtp/content-type-wallet-send-calls": "^2.0.0",
+      "@xmtp/node-bindings": "1.9.1",
+      "@xmtp/node-sdk": "^6.0.0",
+      "viem": "^2.52.2"
+    },
+    "telegram-bot": {},
+    "telegram": {
+      "@mtcute/bun": "0.30.1"
+    },
+    "discord-bot": {
+      "@discordjs/voice": "^0.19.2",
+      "discord.js": "^14.26.4",
+      "prism-media": "^1.3.5"
+    },
+    "whatsapp": {
+      "baileys": "7.0.0-rc14"
+    },
+    "webhook": {}
+  }
+}