@stage-labs/metro 0.1.0-beta.243 → 0.1.0-beta.245

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.243",
+  "version": "0.1.0-beta.245",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.243",
+  "version": "0.1.0-beta.245",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/agent-fs.ts

@@ -1,8 +1,9 @@
 import { spawn, spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import { resolve, sep } from 'node:path';
 import type { Readable } from 'node:stream';
 import { runningAsMetro } from '../metro-user/privilege.js';
-import { agentUser, asUser } from './user.js';
+import { agentUser, asUser, type AgentUser } from './user.js';
 
 export interface AgentStat {
   size: number;
@@ -23,11 +24,72 @@ export interface AgentDirent {
 
 const MAX_OUTPUT = 256 * 1024 * 1024;
 
+const codeOf = (err: unknown): unknown => (err as { code?: unknown } | null)?.code;
+
 const refused = (err: unknown): boolean => {
-  const code = (err as { code?: unknown } | null)?.code;
+  const code = codeOf(err);
   return (code === 'EACCES' || code === 'EPERM') && runningAsMetro();
 };
 
+const realHome = new Map<string, string>();
+
+function homeOf(user: AgentUser): string {
+  let real = realHome.get(user.home);
+  if (real === undefined) {
+    try {
+      real = fs.realpathSync(user.home);
+    } catch {
+      real = resolve(user.home);
+    }
+    realHome.set(user.home, real);
+  }
+  return real;
+}
+
+const within = (home: string, path: string): boolean => path === home || path.startsWith(`${home}${sep}`);
+
+function realOf(path: string, fd: number | undefined): string | null {
+  if (fd !== undefined) return fs.readlinkSync(`/proc/self/fd/${String(fd)}`);
+  try {
+    return fs.realpathSync(path);
+  } catch (err) {
+    if (codeOf(err) === 'ENOENT' || codeOf(err) === 'ENOTDIR') return null;
+    throw err;
+  }
+}
+
+export function escapesHome(path: string, user: AgentUser, fd?: number): boolean {
+  const home = homeOf(user);
+  const asked = resolve(path);
+  if (!within(resolve(user.home), asked) && !within(home, asked)) return false;
+  const real = realOf(path, fd);
+  return real !== null && !within(home, real);
+}
+
+const confinedUser = (): AgentUser | null => (runningAsMetro() ? agentUser() : null);
+
+function outside(path: string): Error {
+  const err = new Error(`${path} leads out of the agent's home, so metro reads it as the agent`) as Error & { code: string };
+  err.code = 'EACCES';
+  return err;
+}
+
+function guardPath(path: string, fd?: number): void {
+  const user = confinedUser();
+  if (user !== null && escapesHome(path, user, fd)) throw outside(path);
+}
+
+function openGuarded(path: string): number {
+  const fd = fs.openSync(path, 'r');
+  try {
+    guardPath(path, fd);
+    return fd;
+  } catch (err) {
+    fs.closeSync(fd);
+    throw err;
+  }
+}
+
 function asAgentSh(script: string, args: string[]): Buffer {
   const [file, argv] = asUser(agentUser(), 'sh', ['-c', script, 'metro', ...args]);
   const run = spawnSync(file, argv, { maxBuffer: MAX_OUTPUT, stdio: ['ignore', 'pipe', 'pipe'] });
@@ -51,6 +113,7 @@ function viaAgent<T>(native: () => T, fallback: () => T): T {
 
 export function existsSync(path: string): boolean {
   try {
+    guardPath(path);
     fs.accessSync(path, fs.constants.F_OK);
     return true;
   } catch (err) {
@@ -78,19 +141,42 @@ function agentStat(path: string, follow: boolean): AgentStat {
   return { size: Number(size), mtime: new Date(ms), mtimeMs: ms, mode: parseInt(mode, 16), ...kindTests(kind) };
 }
 
-export const statSync = (path: string): AgentStat => viaAgent(() => fs.statSync(path), () => agentStat(path, true));
+export const statSync = (path: string): AgentStat =>
+  viaAgent(
+    () => {
+      guardPath(path);
+      return fs.statSync(path);
+    },
+    () => agentStat(path, true),
+  );
 
 export const realpathSync = (path: string): string =>
-  viaAgent(() => fs.realpathSync(path), () => asAgentSh('realpath -e -- "$1"', [path]).toString('utf8').trim());
+  viaAgent(
+    () => {
+      guardPath(path);
+      return fs.realpathSync(path);
+    },
+    () => asAgentSh('realpath -e -- "$1"', [path]).toString('utf8').trim(),
+  );
 
 export function readFileSync(path: string, encoding: 'utf8'): string {
-  return viaAgent(() => fs.readFileSync(path, encoding), () => asAgentSh('cat -- "$1"', [path]).toString('utf8'));
+  return viaAgent(
+    () => {
+      const fd = openGuarded(path);
+      try {
+        return fs.readFileSync(fd, encoding);
+      } finally {
+        fs.closeSync(fd);
+      }
+    },
+    () => asAgentSh('cat -- "$1"', [path]).toString('utf8'),
+  );
 }
 
 export function readRange(path: string, start: number, length: number): Buffer {
   return viaAgent(
     () => {
-      const fd = fs.openSync(path, 'r');
+      const fd = openGuarded(path);
       try {
         const buffer = Buffer.alloc(length);
         return buffer.subarray(0, fs.readSync(fd, buffer, 0, length, start));
@@ -108,7 +194,10 @@ export function readdirNames(path: string): string[] {
 
 export function readdirEntries(path: string): AgentDirent[] {
   return viaAgent(
-    () => fs.readdirSync(path, { withFileTypes: true }),
+    () => {
+      guardPath(path);
+      return fs.readdirSync(path, { withFileTypes: true });
+    },
     () =>
       asAgentSh('find -H "$1" -mindepth 1 -maxdepth 1 -printf "%y\\t%f\\0"', [path])
         .toString('utf8')
@@ -123,8 +212,7 @@ export function readdirEntries(path: string): AgentDirent[] {
 
 export function createReadStream(path: string): Readable {
   try {
-    fs.accessSync(path, fs.constants.R_OK);
-    return fs.createReadStream(path);
+    return fs.createReadStream(path, { fd: openGuarded(path) });
   } catch (err) {
     if (!refused(err)) return fs.createReadStream(path);
     const [file, argv] = asUser(agentUser(), 'cat', ['--', path]);
@@ -132,3 +220,27 @@ export function createReadStream(path: string): Readable {
     return child.stdout;
   }
 }
+
+export function readAsAgent(path: string, maxBytes: number): Buffer | null {
+  if (!runningAsMetro() || agentUser() === null) {
+    try {
+      const st = fs.statSync(path);
+      if (!st.isFile()) return null;
+      const start = Math.max(0, st.size - maxBytes);
+      const fd = fs.openSync(path, 'r');
+      try {
+        const buffer = Buffer.alloc(st.size - start);
+        return buffer.subarray(0, fs.readSync(fd, buffer, 0, buffer.length, start));
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch {
+      return null;
+    }
+  }
+  try {
+    return asAgentSh('[ -f "$1" ] && tail -c "$2" -- "$1"', [path, String(maxBytes)]);
+  } catch {
+    return null;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/metro-home.ts

@@ -0,0 +1,42 @@
+import { chmodSync, lstatSync, readdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+
+const CLI_PREFIX = '.npm-global';
+const OPEN_BITS = 0o077;
+
+function entryHolding(home: string, path: string): string | null {
+  const rel = relative(home, path);
+  if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) return null;
+  return rel.split(sep)[0] ?? null;
+}
+
+function sharedEntries(home: string, env: NodeJS.ProcessEnv = process.env): Set<string> {
+  const cli = env.METRO_CLI_BIN?.trim() ?? '';
+  const holding = cli === '' ? null : entryHolding(home, cli);
+  return new Set(holding === null ? [CLI_PREFIX] : [CLI_PREFIX, holding]);
+}
+
+function closeEntry(path: string): boolean {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (stat.mode & OPEN_BITS) === 0) return false;
+  chmodSync(path, stat.mode & 0o700);
+  return true;
+}
+
+export function closeMetroHome(home = homedir(), env: NodeJS.ProcessEnv = process.env): string[] {
+  chmodSync(home, 0o711);
+  const shared = sharedEntries(home, env);
+  const closed: string[] = [];
+  for (const name of readdirSync(home)) {
+    if (shared.has(name)) continue;
+    try {
+      if (closeEntry(join(home, name))) closed.push(name);
+    } catch (err) {
+      log.warn({ entry: name, err: errMsg(err) }, 'agent-user: could not close an entry of the metro home');
+    }
+  }
+  if (closed.length > 0) log.info({ closed }, 'agent-user: closed entries of the metro home so the agent user cannot read them');
+  return closed;
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/provision.ts

@@ -7,6 +7,7 @@ import { errMsg, log } from '@metro-labs/core/log';
 import { copyIntoHome } from './home-fs.js';
 import { AGENT_NAME, agentMarketplaceDir, agentUser, agentUserExpected, asUser, claudeBin, forgetAgentUser, type AgentUser } from './user.js';
 import { watchAgentView } from './view.js';
+import { closeMetroHome } from './metro-home.js';
 import { mustHelper } from '../metro-user/privilege.js';
 import { stagedPluginVersion } from '../claude/plugin-install.js';
 
@@ -22,7 +23,7 @@ function run(file: string, args: string[]): void {
 }
 
 function openMetroHome(): void {
-  chmodSync(homedir(), 0o711);
+  closeMetroHome();
   chmodSync(join(homedir(), '.metro'), 0o700);
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/schedule-detail.ts

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, readRange, statSync } from './agent-fs.js';
+import { readAsAgent } from './agent-fs.js';
 import { ApiError } from '@metro-labs/http/api-error';
 import { log } from '@metro-labs/core/log';
 import { listSchedules, realRunner, showProps, type Runner, type ScheduledJob } from './schedules.js';
@@ -18,14 +18,10 @@ export interface JobDetail extends ScheduledJob {
 const SCRIPT_MAX = 64 * 1024;
 
 function textFile(path: string): string | null {
-  try {
-    const st = statSync(path);
-    if (!st.isFile() || st.size > SCRIPT_MAX) return null;
-    const text = readFileSync(path, 'utf8');
-    return text.includes('\u0000') ? null : text;
-  } catch {
-    return null;
-  }
+  const bytes = readAsAgent(path, SCRIPT_MAX + 1);
+  if (bytes === null || bytes.length > SCRIPT_MAX) return null;
+  const text = bytes.toString('utf8');
+  return text.includes('\u0000') ? null : text;
 }
 
 export function scriptOf(command: string): { path: string; text: string } | null {
@@ -50,10 +46,9 @@ export function logFileOf(command: string): string | null {
   return m?.[1] ?? null;
 }
 
-function tail(path: string): string {
-  const size = statSync(path).size;
-  const start = Math.max(0, size - TAIL_BYTES);
-  return readRange(path, start, size - start).toString('utf8').split('\n').slice(-LOG_LINES).join('\n');
+function tail(path: string | null): string {
+  const bytes = path === null ? null : readAsAgent(path, TAIL_BYTES);
+  return bytes === null ? '' : bytes.toString('utf8').split('\n').slice(-LOG_LINES).join('\n');
 }
 
 function timerDetail(job: ScheduledJob, runner: Runner): JobDetail {
@@ -70,11 +65,10 @@ function timerDetail(job: ScheduledJob, runner: Runner): JobDetail {
 
 function cronDetail(job: ScheduledJob): JobDetail {
   const file = logFileOf(job.command);
-  const readable = file !== null && existsSync(file) && statSync(file).isFile();
   return {
     ...job,
     definition: `${job.schedule} ${job.command}`,
-    logs: readable ? tail(file) : '',
+    logs: tail(file),
     logSource: file,
     script: scriptOf(job.command),
   };

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/view.ts

@@ -4,6 +4,7 @@ import { errMsg, log } from '@metro-labs/core/log';
 import { isRecord } from '@metro-labs/core/is-record';
 import { agentsDir } from '../agents/files.js';
 import { removeHome, writeHomeText } from './home-fs.js';
+import { closeMetroHome } from './metro-home.js';
 import { agentUser, agentViewDir, type AgentUser } from './user.js';
 
 const COPIED = ['policy.json', 'claude-setup.json', 'system-prompt.md'] as const;
@@ -80,6 +81,11 @@ export function watchAgentView(everyMs = SYNC_MS): void {
     } catch (err) {
       log.warn({ err: errMsg(err) }, 'agent-user: could not refresh the Metro files the agent may read');
     }
+    try {
+      closeMetroHome();
+    } catch (err) {
+      log.warn({ err: errMsg(err) }, 'agent-user: could not close the metro home');
+    }
   };
   tick();
   timer = setInterval(tick, everyMs);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
+import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
 import {
   assertBedrockReady,
@@ -301,7 +302,8 @@ export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse,
     res.writeHead(200).end();
     return true;
   }
-  if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  if (cameThroughProxy(req)) sendError(res, 401, 'authentication_error', 'metro gateway: the agent key works only on this machine, not through its public address');
+  else if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
   else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
   return true;
 }

package/runtime/node_modules/@metro-labs/daemon/src/mcp/accounts.ts

@@ -138,11 +138,20 @@ async function loadStations(): Promise<ScopedAccounts> {
   return { accounts, unavailable };
 }
 
+const URL_SECRETS = new Set(['endpoint', 'callback']);
+
+function withoutUrlSecrets(acc: unknown): unknown {
+  const rec = asRecord(acc);
+  if (rec === undefined) return acc;
+  return Object.fromEntries(Object.entries(rec).filter(([key]) => !URL_SECRETS.has(key)));
+}
+
 export async function gatherAccounts(
   allowedAgents?: Set<string>,
 ): Promise<Record<string, unknown[]>> {
   const { accounts } = await loadStations();
-  return allowedAgents ? scopeAccountsByAgent(accounts, allowedAgents) : accounts;
+  const scoped = allowedAgents ? scopeAccountsByAgent(accounts, allowedAgents) : accounts;
+  return Object.fromEntries(Object.entries(scoped).map(([station, rows]) => [station, rows.map(withoutUrlSecrets)]));
 }
 
 export async function gatherAccountsForAgents(

package/runtime/node_modules/@metro-labs/daemon/src/mcp/request-identity.ts

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import type { IncomingMessage } from 'node:http';
+import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
 
 export interface RequestIdentity {
@@ -33,6 +34,7 @@ export function extractToken(req: IncomingMessage): string | undefined {
 }
 
 export function authenticate(req: IncomingMessage): RequestIdentity | null {
+  if (cameThroughProxy(req)) return null;
   const token = extractToken(req);
   if (!token) return null;
   const agentId = agentIdForKey(token);

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-resolve.ts

@@ -2,6 +2,7 @@ import {
   assertAttachmentSize,
   assertContentLength,
   guessMime,
+  MAX_ATTACHMENT_BYTES,
 } from '@metro-labs/core/stations/attachments';
 import {
   assertInlineTotal,
@@ -105,6 +106,49 @@ async function fromPath(
   };
 }
 
+export const curlArgs = (url: string): string[] => [
+  'curl', '-sS', '-f', '-L', '--max-redirs', '5', '--proto', '=http,https', '--proto-redir', '=http,https',
+  '--max-time', String(FETCH_TIMEOUT_MS / 1000), '--max-filesize', String(MAX_ATTACHMENT_BYTES),
+  '-w', '%{stderr}\n%{content_type}', '--', url,
+];
+
+interface CurlSaid {
+  type: string;
+  why: string;
+}
+
+function curlSaid(text: string): CurlSaid {
+  const lines = text.trimEnd().split('\n');
+  const type = lines.pop()?.split(';')[0]?.trim() ?? '';
+  return { type, why: lines.join(' ').replace(/^curl: \(\d+\)\s*/, '').trim() };
+}
+
+async function fromUrlAs(
+  user: AgentUser,
+  a: CanonicalAttachment,
+  url: string,
+): Promise<ResolvedAttachment> {
+  const proc = Bun.spawn(agentCommand(curlArgs(url)), { stdout: 'pipe', stderr: 'pipe' });
+  const name = a.name ?? basenameOf(url) ?? 'attachment';
+  const said = new Response(proc.stderr).text().catch((err: unknown) => {
+    log.debug({ err: String(err) }, 'send: could not read what curl said');
+    return '';
+  });
+  let saved: Awaited<ReturnType<typeof streamToTemp>>;
+  try {
+    saved = await streamToTemp(proc.stdout, name);
+  } catch (err) {
+    proc.kill();
+    throw err;
+  }
+  const { type, why } = curlSaid(await said);
+  if ((await proc.exited) !== 0) {
+    await removeInlineTemp(saved.dir);
+    throw new Error(`attachment fetch failed for '${url}' (fetched as the ${user.name} user): ${why || 'no answer'}`);
+  }
+  return { path: saved.path, mime: a.mime ?? (type || guessMime(url)), name, bytes: saved.bytes, temp: saved.dir };
+}
+
 async function fromUrl(
   a: CanonicalAttachment,
   url: string,
@@ -113,6 +157,8 @@ async function fromUrl(
     throw new Error(
       `attachment url '${url}' is not an http(s) url; use \`path\` for a local file`,
     );
+  const user = agentUser();
+  if (user !== null) return fromUrlAs(user, a, url);
   const res = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
   });

package/runtime/node_modules/@metro-labs/http/src/api-http.ts

@@ -19,6 +19,11 @@ export function setBearerSessions(fn: BearerSessions | null): void {
   bearerSessions = fn;
 }
 
+const PROXY_HEADERS = ['x-forwarded-for', 'x-forwarded-host', 'tailscale-funnel-request'] as const;
+
+export const cameThroughProxy = (req: IncomingMessage): boolean =>
+  PROXY_HEADERS.some((name) => req.headers[name] !== undefined);
+
 export function requireAdmin(session: ApiSession): void {
   if (session.role !== 'admin') throw new ApiError('this needs the admin role in your organization', 403);
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.243"
+  "version": "0.1.0-beta.245"
 }