@stage-labs/metro 0.1.0-beta.244 → 0.1.0-beta.245

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.244",
+  "version": "0.1.0-beta.245",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.244",
+  "version": "0.1.0-beta.245",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/agent-fs.ts

@@ -1,8 +1,9 @@
 import { spawn, spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
+import { resolve, sep } from 'node:path';
 import type { Readable } from 'node:stream';
 import { runningAsMetro } from '../metro-user/privilege.js';
-import { agentUser, asUser } from './user.js';
+import { agentUser, asUser, type AgentUser } from './user.js';
 
 export interface AgentStat {
   size: number;
@@ -23,11 +24,72 @@ export interface AgentDirent {
 
 const MAX_OUTPUT = 256 * 1024 * 1024;
 
+const codeOf = (err: unknown): unknown => (err as { code?: unknown } | null)?.code;
+
 const refused = (err: unknown): boolean => {
-  const code = (err as { code?: unknown } | null)?.code;
+  const code = codeOf(err);
   return (code === 'EACCES' || code === 'EPERM') && runningAsMetro();
 };
 
+const realHome = new Map<string, string>();
+
+function homeOf(user: AgentUser): string {
+  let real = realHome.get(user.home);
+  if (real === undefined) {
+    try {
+      real = fs.realpathSync(user.home);
+    } catch {
+      real = resolve(user.home);
+    }
+    realHome.set(user.home, real);
+  }
+  return real;
+}
+
+const within = (home: string, path: string): boolean => path === home || path.startsWith(`${home}${sep}`);
+
+function realOf(path: string, fd: number | undefined): string | null {
+  if (fd !== undefined) return fs.readlinkSync(`/proc/self/fd/${String(fd)}`);
+  try {
+    return fs.realpathSync(path);
+  } catch (err) {
+    if (codeOf(err) === 'ENOENT' || codeOf(err) === 'ENOTDIR') return null;
+    throw err;
+  }
+}
+
+export function escapesHome(path: string, user: AgentUser, fd?: number): boolean {
+  const home = homeOf(user);
+  const asked = resolve(path);
+  if (!within(resolve(user.home), asked) && !within(home, asked)) return false;
+  const real = realOf(path, fd);
+  return real !== null && !within(home, real);
+}
+
+const confinedUser = (): AgentUser | null => (runningAsMetro() ? agentUser() : null);
+
+function outside(path: string): Error {
+  const err = new Error(`${path} leads out of the agent's home, so metro reads it as the agent`) as Error & { code: string };
+  err.code = 'EACCES';
+  return err;
+}
+
+function guardPath(path: string, fd?: number): void {
+  const user = confinedUser();
+  if (user !== null && escapesHome(path, user, fd)) throw outside(path);
+}
+
+function openGuarded(path: string): number {
+  const fd = fs.openSync(path, 'r');
+  try {
+    guardPath(path, fd);
+    return fd;
+  } catch (err) {
+    fs.closeSync(fd);
+    throw err;
+  }
+}
+
 function asAgentSh(script: string, args: string[]): Buffer {
   const [file, argv] = asUser(agentUser(), 'sh', ['-c', script, 'metro', ...args]);
   const run = spawnSync(file, argv, { maxBuffer: MAX_OUTPUT, stdio: ['ignore', 'pipe', 'pipe'] });
@@ -51,6 +113,7 @@ function viaAgent<T>(native: () => T, fallback: () => T): T {
 
 export function existsSync(path: string): boolean {
   try {
+    guardPath(path);
     fs.accessSync(path, fs.constants.F_OK);
     return true;
   } catch (err) {
@@ -78,19 +141,42 @@ function agentStat(path: string, follow: boolean): AgentStat {
   return { size: Number(size), mtime: new Date(ms), mtimeMs: ms, mode: parseInt(mode, 16), ...kindTests(kind) };
 }
 
-export const statSync = (path: string): AgentStat => viaAgent(() => fs.statSync(path), () => agentStat(path, true));
+export const statSync = (path: string): AgentStat =>
+  viaAgent(
+    () => {
+      guardPath(path);
+      return fs.statSync(path);
+    },
+    () => agentStat(path, true),
+  );
 
 export const realpathSync = (path: string): string =>
-  viaAgent(() => fs.realpathSync(path), () => asAgentSh('realpath -e -- "$1"', [path]).toString('utf8').trim());
+  viaAgent(
+    () => {
+      guardPath(path);
+      return fs.realpathSync(path);
+    },
+    () => asAgentSh('realpath -e -- "$1"', [path]).toString('utf8').trim(),
+  );
 
 export function readFileSync(path: string, encoding: 'utf8'): string {
-  return viaAgent(() => fs.readFileSync(path, encoding), () => asAgentSh('cat -- "$1"', [path]).toString('utf8'));
+  return viaAgent(
+    () => {
+      const fd = openGuarded(path);
+      try {
+        return fs.readFileSync(fd, encoding);
+      } finally {
+        fs.closeSync(fd);
+      }
+    },
+    () => asAgentSh('cat -- "$1"', [path]).toString('utf8'),
+  );
 }
 
 export function readRange(path: string, start: number, length: number): Buffer {
   return viaAgent(
     () => {
-      const fd = fs.openSync(path, 'r');
+      const fd = openGuarded(path);
       try {
         const buffer = Buffer.alloc(length);
         return buffer.subarray(0, fs.readSync(fd, buffer, 0, length, start));
@@ -108,7 +194,10 @@ export function readdirNames(path: string): string[] {
 
 export function readdirEntries(path: string): AgentDirent[] {
   return viaAgent(
-    () => fs.readdirSync(path, { withFileTypes: true }),
+    () => {
+      guardPath(path);
+      return fs.readdirSync(path, { withFileTypes: true });
+    },
     () =>
       asAgentSh('find -H "$1" -mindepth 1 -maxdepth 1 -printf "%y\\t%f\\0"', [path])
         .toString('utf8')
@@ -123,8 +212,7 @@ export function readdirEntries(path: string): AgentDirent[] {
 
 export function createReadStream(path: string): Readable {
   try {
-    fs.accessSync(path, fs.constants.R_OK);
-    return fs.createReadStream(path);
+    return fs.createReadStream(path, { fd: openGuarded(path) });
   } catch (err) {
     if (!refused(err)) return fs.createReadStream(path);
     const [file, argv] = asUser(agentUser(), 'cat', ['--', path]);
@@ -132,3 +220,27 @@ export function createReadStream(path: string): Readable {
     return child.stdout;
   }
 }
+
+export function readAsAgent(path: string, maxBytes: number): Buffer | null {
+  if (!runningAsMetro() || agentUser() === null) {
+    try {
+      const st = fs.statSync(path);
+      if (!st.isFile()) return null;
+      const start = Math.max(0, st.size - maxBytes);
+      const fd = fs.openSync(path, 'r');
+      try {
+        const buffer = Buffer.alloc(st.size - start);
+        return buffer.subarray(0, fs.readSync(fd, buffer, 0, buffer.length, start));
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch {
+      return null;
+    }
+  }
+  try {
+    return asAgentSh('[ -f "$1" ] && tail -c "$2" -- "$1"', [path, String(maxBytes)]);
+  } catch {
+    return null;
+  }
+}

package/runtime/node_modules/@metro-labs/daemon/src/agent-user/schedule-detail.ts

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync, readRange, statSync } from './agent-fs.js';
+import { readAsAgent } from './agent-fs.js';
 import { ApiError } from '@metro-labs/http/api-error';
 import { log } from '@metro-labs/core/log';
 import { listSchedules, realRunner, showProps, type Runner, type ScheduledJob } from './schedules.js';
@@ -18,14 +18,10 @@ export interface JobDetail extends ScheduledJob {
 const SCRIPT_MAX = 64 * 1024;
 
 function textFile(path: string): string | null {
-  try {
-    const st = statSync(path);
-    if (!st.isFile() || st.size > SCRIPT_MAX) return null;
-    const text = readFileSync(path, 'utf8');
-    return text.includes('\u0000') ? null : text;
-  } catch {
-    return null;
-  }
+  const bytes = readAsAgent(path, SCRIPT_MAX + 1);
+  if (bytes === null || bytes.length > SCRIPT_MAX) return null;
+  const text = bytes.toString('utf8');
+  return text.includes('\u0000') ? null : text;
 }
 
 export function scriptOf(command: string): { path: string; text: string } | null {
@@ -50,10 +46,9 @@ export function logFileOf(command: string): string | null {
   return m?.[1] ?? null;
 }
 
-function tail(path: string): string {
-  const size = statSync(path).size;
-  const start = Math.max(0, size - TAIL_BYTES);
-  return readRange(path, start, size - start).toString('utf8').split('\n').slice(-LOG_LINES).join('\n');
+function tail(path: string | null): string {
+  const bytes = path === null ? null : readAsAgent(path, TAIL_BYTES);
+  return bytes === null ? '' : bytes.toString('utf8').split('\n').slice(-LOG_LINES).join('\n');
 }
 
 function timerDetail(job: ScheduledJob, runner: Runner): JobDetail {
@@ -70,11 +65,10 @@ function timerDetail(job: ScheduledJob, runner: Runner): JobDetail {
 
 function cronDetail(job: ScheduledJob): JobDetail {
   const file = logFileOf(job.command);
-  const readable = file !== null && existsSync(file) && statSync(file).isFile();
   return {
     ...job,
     definition: `${job.schedule} ${job.command}`,
-    logs: readable ? tail(file) : '',
+    logs: tail(file),
     logSource: file,
     script: scriptOf(job.command),
   };

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { errMsg, log } from '@metro-labs/core/log';
+import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
 import {
   assertBedrockReady,
@@ -301,7 +302,8 @@ export function handleGatewayRequest(req: IncomingMessage, res: ServerResponse,
     res.writeHead(200).end();
     return true;
   }
-  if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
+  if (cameThroughProxy(req)) sendError(res, 401, 'authentication_error', 'metro gateway: the agent key works only on this machine, not through its public address');
+  else if ((deps.identify ?? defaultIdentify)(keyOf(req))) answer(req, res, path, deps);
   else sendError(res, 401, 'authentication_error', 'metro gateway: no agent key (x-metro-key); start Claude Code with metro claude');
   return true;
 }

package/runtime/node_modules/@metro-labs/daemon/src/mcp/request-identity.ts

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import type { IncomingMessage } from 'node:http';
+import { cameThroughProxy } from '@metro-labs/http/api-http';
 import { agentIdForKey } from '../agents/keys.js';
 
 export interface RequestIdentity {
@@ -33,6 +34,7 @@ export function extractToken(req: IncomingMessage): string | undefined {
 }
 
 export function authenticate(req: IncomingMessage): RequestIdentity | null {
+  if (cameThroughProxy(req)) return null;
   const token = extractToken(req);
   if (!token) return null;
   const agentId = agentIdForKey(token);

package/runtime/node_modules/@metro-labs/daemon/src/stations/attach-resolve.ts

@@ -2,6 +2,7 @@ import {
   assertAttachmentSize,
   assertContentLength,
   guessMime,
+  MAX_ATTACHMENT_BYTES,
 } from '@metro-labs/core/stations/attachments';
 import {
   assertInlineTotal,
@@ -105,6 +106,49 @@ async function fromPath(
   };
 }
 
+export const curlArgs = (url: string): string[] => [
+  'curl', '-sS', '-f', '-L', '--max-redirs', '5', '--proto', '=http,https', '--proto-redir', '=http,https',
+  '--max-time', String(FETCH_TIMEOUT_MS / 1000), '--max-filesize', String(MAX_ATTACHMENT_BYTES),
+  '-w', '%{stderr}\n%{content_type}', '--', url,
+];
+
+interface CurlSaid {
+  type: string;
+  why: string;
+}
+
+function curlSaid(text: string): CurlSaid {
+  const lines = text.trimEnd().split('\n');
+  const type = lines.pop()?.split(';')[0]?.trim() ?? '';
+  return { type, why: lines.join(' ').replace(/^curl: \(\d+\)\s*/, '').trim() };
+}
+
+async function fromUrlAs(
+  user: AgentUser,
+  a: CanonicalAttachment,
+  url: string,
+): Promise<ResolvedAttachment> {
+  const proc = Bun.spawn(agentCommand(curlArgs(url)), { stdout: 'pipe', stderr: 'pipe' });
+  const name = a.name ?? basenameOf(url) ?? 'attachment';
+  const said = new Response(proc.stderr).text().catch((err: unknown) => {
+    log.debug({ err: String(err) }, 'send: could not read what curl said');
+    return '';
+  });
+  let saved: Awaited<ReturnType<typeof streamToTemp>>;
+  try {
+    saved = await streamToTemp(proc.stdout, name);
+  } catch (err) {
+    proc.kill();
+    throw err;
+  }
+  const { type, why } = curlSaid(await said);
+  if ((await proc.exited) !== 0) {
+    await removeInlineTemp(saved.dir);
+    throw new Error(`attachment fetch failed for '${url}' (fetched as the ${user.name} user): ${why || 'no answer'}`);
+  }
+  return { path: saved.path, mime: a.mime ?? (type || guessMime(url)), name, bytes: saved.bytes, temp: saved.dir };
+}
+
 async function fromUrl(
   a: CanonicalAttachment,
   url: string,
@@ -113,6 +157,8 @@ async function fromUrl(
     throw new Error(
       `attachment url '${url}' is not an http(s) url; use \`path\` for a local file`,
     );
+  const user = agentUser();
+  if (user !== null) return fromUrlAs(user, a, url);
   const res = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
   });

package/runtime/node_modules/@metro-labs/http/src/api-http.ts

@@ -19,6 +19,11 @@ export function setBearerSessions(fn: BearerSessions | null): void {
   bearerSessions = fn;
 }
 
+const PROXY_HEADERS = ['x-forwarded-for', 'x-forwarded-host', 'tailscale-funnel-request'] as const;
+
+export const cameThroughProxy = (req: IncomingMessage): boolean =>
+  PROXY_HEADERS.some((name) => req.headers[name] !== undefined);
+
 export function requireAdmin(session: ApiSession): void {
   if (session.role !== 'admin') throw new ApiError('this needs the admin role in your organization', 403);
 }

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.244"
+  "version": "0.1.0-beta.245"
 }