machine-bridge-mcp 0.1.0 → 0.1.1

package/README.md

@@ -38,6 +38,14 @@ MCP connection password: mcp_password_...
 
 Keep the foreground process running for the current session. The installed autostart entry keeps the daemon available after future logins.
 
+The command is safe to run repeatedly:
+
+```zsh
+npm install -g machine-bridge-mcp@latest && machine-mcp
+```
+
+On repeat runs, the CLI reuses existing state and secrets unless you request rotation, skips Worker redeploys when the deployed Worker is healthy and unchanged, refreshes the autostart entry, stops any currently loaded autostart daemon before starting the foreground daemon, and refuses to start a second daemon for the same workspace if another foreground instance is already running.
+
 ## Re-select workspace
 
 ```zsh
@@ -80,7 +88,7 @@ machine-mcp service uninstall
 machine-mcp --no-autostart
 ```
 
-Autostart runs the daemon with `--daemon-only --no-print-credentials`, so service logs do not contain the MCP connection password. If you start with `--no-write`, `--no-exec`, or `--full-env`, those policy flags are preserved in the autostart entry.
+Autostart runs the daemon with `--daemon-only --no-print-credentials`, so service logs do not contain the MCP connection password. If you start with `--no-write`, `--no-exec`, or `--full-env`, those policy flags are preserved in the autostart entry. macOS/Linux service definitions restart only on process failure; a normal duplicate-instance exit is not treated as a crash loop.
 
 ## Secrets rotation
 
@@ -157,7 +165,9 @@ Default state roots:
 - Linux with `XDG_STATE_HOME`: `$XDG_STATE_HOME/machine-bridge-mcp`
 - Windows: `%APPDATA%\machine-bridge-mcp`
 
-State contains the MCP password and daemon secret. Status/doctor output redacts secrets. The normal foreground `start` command prints the MCP password because users need to paste it into their MCP client.
+State contains the MCP password and daemon secret. Status/doctor output redacts secrets. The normal foreground `start` command prints the MCP password because users need to paste it into their MCP client. State files, temporary Worker secret files, lock files, and log directories are created under the user state root with owner-only permissions where the platform supports POSIX modes.
+
+The Worker rejects browser requests with an `Origin` header unless the origin is the Worker itself or a loopback HTTP origin. To allow additional browser-based MCP clients, set `MBM_ALLOWED_ORIGINS` to a comma-separated list of exact origins in `wrangler.jsonc` or Cloudflare Worker settings.
 
 Override state root:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "One-command hosted Remote MCP bridge to a local machine daemon.",
   "type": "module",
   "license": "MIT",
@@ -18,6 +18,7 @@
     "bin",
     "src/local",
     "src/worker/index.ts",
+    "scripts",
     "wrangler.jsonc",
     "tsconfig.json",
     "README.md",
@@ -27,6 +28,11 @@
     "start": "node bin/machine-mcp.mjs start",
     "doctor": "node bin/machine-mcp.mjs doctor",
     "self-test": "node src/local/self-test.mjs",
+    "version:sync": "node scripts/sync-worker-version.mjs",
+    "version:check": "node scripts/sync-worker-version.mjs --check",
+    "version": "node scripts/sync-worker-version.mjs && git add package.json package-lock.json src/worker/index.ts",
+    "prepack": "npm run version:check",
+    "prepublishOnly": "npm run check && npm run version:check",
     "worker:types": "wrangler types src/worker/worker-configuration.d.ts",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "sh -n mbm && node --check bin/machine-mcp.mjs && node --check src/local/cli.mjs && node --check src/local/daemon.mjs && node --check src/local/state.mjs && node --check src/local/shell.mjs && node --check src/local/service.mjs && node --check src/local/self-test.mjs",

package/scripts/sync-worker-version.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const packagePath = path.join(repoRoot, "package.json");
+const workerPath = path.join(repoRoot, "src", "worker", "index.ts");
+const args = new Set(process.argv.slice(2));
+const checkOnly = args.has("--check");
+
+const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
+const expected = String(pkg.version || "").trim();
+if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(expected)) {
+  fail(`package.json version is not a valid release version: ${JSON.stringify(expected)}`);
+}
+
+const source = readFileSync(workerPath, "utf8");
+const pattern = /const SERVER_VERSION = "([^"]+)";/;
+const match = source.match(pattern);
+if (!match) fail("Could not find `const SERVER_VERSION = \"...\";` in src/worker/index.ts");
+
+const current = match[1];
+if (current === expected) {
+  console.log(`Worker version is in sync: ${expected}`);
+  process.exit(0);
+}
+
+if (checkOnly) {
+  fail(`Worker version mismatch: package.json=${expected}, src/worker/index.ts=${current}. Run npm run version:sync.`);
+}
+
+const updated = source.replace(pattern, `const SERVER_VERSION = "${expected}";`);
+writeFileSync(workerPath, updated);
+console.log(`Updated Worker version: ${current} -> ${expected}`);
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}

package/src/local/cli.mjs

@@ -6,6 +6,7 @@ import readline from "node:readline/promises";
 import { LocalDaemon } from "./daemon.mjs";
 import { runWrangler } from "./shell.mjs";
 import {
+  acquireDaemonLock,
   appName,
   defaultStateRoot,
   ensureOwnerOnlyDir,
@@ -172,18 +173,35 @@ async function startCommand(args) {
     await installAutostartBestEffort({ workspace, stateRoot: state.paths.stateRoot, entryScript: process.argv[1], policy: state.policy });
   }
 
-  const daemon = new LocalDaemon({
-    workerUrl: state.worker.url,
-    secret: state.worker.daemonSecret,
-    workspace,
-    policy: state.policy,
-    logger: structuredLogger(args.quiet),
-  });
+  if (!args.daemonOnly) await stopAutostartBestEffort(Boolean(args.quiet));
 
-  const waitForConnect = daemon.start();
-  await waitForConnectWithNotice(waitForConnect, 20_000);
-  printConnection(state, { json: Boolean(args.json), noPrintCredentials: Boolean(args.noPrintCredentials) });
-  keepProcessAlive(daemon);
+  const lock = acquireDaemonLock(state);
+  if (!lock.acquired) {
+    if (!args.quiet) {
+      const pid = lock.owner?.pid ? `pid ${lock.owner.pid}` : "unknown pid";
+      console.warn(`Local daemon is already running for this workspace (${pid}). Not starting a duplicate.`);
+      printConnection(state, { json: Boolean(args.json), noPrintCredentials: Boolean(args.noPrintCredentials) });
+    }
+    return;
+  }
+
+  try {
+    const daemon = new LocalDaemon({
+      workerUrl: state.worker.url,
+      secret: state.worker.daemonSecret,
+      workspace,
+      policy: state.policy,
+      logger: structuredLogger(args.quiet),
+    });
+
+    const waitForConnect = daemon.start();
+    await waitForConnectWithNotice(waitForConnect, 20_000);
+    printConnection(state, { json: Boolean(args.json), noPrintCredentials: Boolean(args.noPrintCredentials) });
+    keepProcessAlive(daemon, lock);
+  } catch (error) {
+    lock.release();
+    throw error;
+  }
 }
 
 async function ensureWorker(state, args) {
@@ -357,14 +375,16 @@ function printConnection(state, { json = false, noPrintCredentials = false } = {
   console.log(`State: ${payload.state_path}\n`);
 }
 
-function keepProcessAlive(daemon) {
+function keepProcessAlive(daemon, lock) {
   const stop = () => {
     console.log("Stopping daemon...");
     daemon.stop();
+    lock?.release?.();
     process.exit(0);
   };
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
+  process.once("exit", () => lock?.release?.());
   setInterval(() => {}, 2 ** 31 - 1);
 }
 
@@ -449,6 +469,15 @@ async function installAutostartBestEffort({ workspace, stateRoot, entryScript, p
   }
 }
 
+async function stopAutostartBestEffort(quiet = false) {
+  try {
+    const { stopAutostart } = await import("./service.mjs");
+    await stopAutostart({ logger: structuredLogger(true) });
+  } catch (error) {
+    if (!quiet) console.warn(`Autostart stop skipped: ${error.message}`);
+  }
+}
+
 async function uninstallCommand(args) {
   const stateRoot = stateRootFromArgs(args);
   const deleteRemote = !args.keepWorker;
@@ -568,6 +597,7 @@ Start options:
   --rotate-secrets      Rotate secrets before deploying
   --daemon-only         Skip deploy and only connect daemon from existing state
   --no-autostart        Do not install login autostart during start
+  --no-print-credentials Redact the MCP password in console output
   --no-write            Disable write_file (default: write enabled)
   --no-exec             Disable exec_command (default: exec enabled)
   --full-env            Pass full parent environment to exec_command (default: minimal env)

package/src/local/self-test.mjs

@@ -2,7 +2,7 @@ import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { daemonSelfTest } from "./daemon.mjs";
-import { ensureWorkerSecrets, loadState, previewSecret, redactState, selectedWorkspace, setSelectedWorkspace } from "./state.mjs";
+import { acquireDaemonLock, ensureWorkerSecrets, loadState, previewSecret, redactState, selectedWorkspace, setSelectedWorkspace } from "./state.mjs";
 
 await daemonSelfTest();
 await stateSelfTest();
@@ -16,6 +16,19 @@ async function stateSelfTest() {
     if (selectedWorkspace(stateRoot) !== workspace) throw new Error("selected workspace was not persisted");
     const state = loadState(workspace, { stateDir: stateRoot });
     ensureWorkerSecrets(state, { rotateSecrets: true });
+    const lock = acquireDaemonLock(state);
+    if (!lock.acquired) throw new Error("first daemon lock acquisition failed");
+    try {
+      const duplicate = acquireDaemonLock(state);
+      if (duplicate.acquired) throw new Error("duplicate daemon lock acquisition should fail");
+      if (duplicate.owner?.pid !== process.pid) throw new Error("duplicate daemon lock owner was not reported");
+    } finally {
+      lock.release();
+    }
+    const relock = acquireDaemonLock(state);
+    if (!relock.acquired) throw new Error("daemon lock was not released");
+    relock.release();
+
     const redacted = redactState(state);
     if (redacted.worker.oauthPassword === state.worker.oauthPassword) throw new Error("oauthPassword was not redacted");
     if (redacted.worker.daemonSecret === state.worker.daemonSecret) throw new Error("daemonSecret was not redacted");

package/src/local/service.mjs

@@ -132,7 +132,10 @@ function launchdPlist({ args, stdout, stderr }) {
 ${args.map(arg => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
   <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key><false/>
+  </dict>
   <key>StandardOutPath</key><string>${escapeXml(stdout)}</string>
   <key>StandardErrorPath</key><string>${escapeXml(stderr)}</string>
 </dict>
@@ -179,7 +182,7 @@ After=network-online.target
 [Service]
 Type=simple
 ExecStart=${execArgs}
-Restart=always
+Restart=on-failure
 RestartSec=5
 StandardOutput=append:${spec.stdout}
 StandardError=append:${spec.stderr}

package/src/local/state.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, realpathSync, rmSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -89,7 +89,7 @@ export function loadState(workspace, options = {}) {
   ensureOwnerOnlyDir(profileDir);
   let state = {};
   if (existsSync(statePath)) {
-    state = JSON.parse(readFileSync(statePath, "utf8"));
+    state = readJsonObjectOrBackup(statePath);
   }
   state.schemaVersion = 1;
   state.workspace = {
@@ -112,6 +112,93 @@ export function saveState(state) {
   ownerOnlyFile(statePath);
 }
 
+export function daemonLockPathForState(state) {
+  const profileDir = state?.paths?.profileDir;
+  if (!profileDir) throw new Error("state profile dir is missing");
+  return path.join(profileDir, "daemon.lock");
+}
+
+export function acquireDaemonLock(state) {
+  const lockPath = daemonLockPathForState(state);
+  ensureOwnerOnlyDir(path.dirname(lockPath));
+  const token = randomBytes(16).toString("hex");
+  const payload = {
+    pid: process.pid,
+    token,
+    workspace: state?.workspace?.path || "",
+    startedAt: new Date().toISOString(),
+    entryScript: process.argv[1] || "",
+  };
+
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    let fd;
+    try {
+      fd = openSync(lockPath, "wx", 0o600);
+      writeFileSync(fd, JSON.stringify(payload, null, 2) + "\n");
+      closeSync(fd);
+      ownerOnlyFile(lockPath);
+      return {
+        acquired: true,
+        path: lockPath,
+        owner: payload,
+        release() {
+          releaseDaemonLock(lockPath, token);
+        },
+      };
+    } catch (error) {
+      if (fd !== undefined) {
+        try { closeSync(fd); } catch {}
+      }
+      if (error?.code !== "EEXIST") throw error;
+      const owner = readDaemonLockOwner(lockPath);
+      if (owner?.pid && isPidAlive(owner.pid)) {
+        return { acquired: false, path: lockPath, owner, release() {} };
+      }
+      try { unlinkSync(lockPath); } catch {}
+    }
+  }
+  const owner = readDaemonLockOwner(lockPath);
+  return { acquired: false, path: lockPath, owner, release() {} };
+}
+
+function releaseDaemonLock(lockPath, token) {
+  const owner = readDaemonLockOwner(lockPath);
+  if (owner?.token !== token) return;
+  try { unlinkSync(lockPath); } catch {}
+}
+
+export function readDaemonLockOwner(lockPath) {
+  try {
+    const parsed = JSON.parse(readFileSync(lockPath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function isPidAlive(pid) {
+  const parsed = Number(pid);
+  if (!Number.isInteger(parsed) || parsed <= 0) return false;
+  try {
+    process.kill(parsed, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+
+function readJsonObjectOrBackup(filePath) {
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    const backupPath = `${filePath}.corrupt-${Date.now()}`;
+    try { renameSync(filePath, backupPath); } catch {}
+    return {};
+  }
+}
+
+
 export function ensureWorkerSecrets(state, options = {}) {
   state.worker ||= {};
   if (!state.worker.oauthPassword || options.rotateSecrets) state.worker.oauthPassword = randomToken("mcp_password");

package/src/worker/index.ts

@@ -1,7 +1,7 @@
 import { DurableObject } from "cloudflare:workers";
 
 const SERVER_NAME = "machine-bridge-mcp";
-const SERVER_VERSION = "0.1.0";
+const SERVER_VERSION = "0.1.1";
 const MCP_PROTOCOL_VERSION = "2025-06-18";
 const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 32 * 1024 * 1024;
@@ -353,7 +353,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         tools: this.allTools().map((tool) => tool.name),
       };
     }
-    if (workspaceTools.some((tool) => tool.name === name)) return this.callDaemonTool(name, args);
+    if (workspaceTools.some((tool) => tool.name === name)) {
+      if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
+      return this.callDaemonTool(name, args);
+    }
     throw new Error(`unknown tool: ${name}`);
   }
 
@@ -399,7 +402,23 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   private allTools(): Array<Record<string, unknown>> {
-    return [serverInfoTool, ...workspaceTools].map((tool) => ({ ...tool }));
+    const advertised = this.daemonAdvertisedTools();
+    const localTools = advertised
+      ? workspaceTools.filter((tool) => advertised.has(tool.name))
+      : workspaceTools;
+    return [serverInfoTool, ...localTools].map((tool) => ({ ...tool }));
+  }
+
+  private daemonToolEnabled(name: string): boolean {
+    const advertised = this.daemonAdvertisedTools();
+    return !advertised || advertised.has(name);
+  }
+
+  private daemonAdvertisedTools(): Set<string> | null {
+    const socket = this.daemonSockets()[0];
+    const attachment = socket ? this.daemonAttachment(socket) : undefined;
+    if (!attachment?.tools?.length) return null;
+    return new Set(attachment.tools);
   }
 
   private daemonSockets(): WebSocket[] {
@@ -847,7 +866,6 @@ function validateOrigin(request: Request, base: string, configured = ""): boolea
   try {
     const parsed = new URL(origin);
     if (origin === base) return true;
-    if (parsed.protocol === "https:") return true;
     return parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
   } catch {
     return false;