machine-bridge-mcp 0.17.0 → 0.18.0

package/docs/TESTING.md

@@ -21,7 +21,7 @@ The suite includes:
 - shared tool-catalog schema, annotation, and profile-inventory checks;
 - default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, `.agents/skills` and `.codex/skills` compatibility discovery, live project/skill rescanning and fingerprints, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, runtime-keyed routing-telemetry privacy, and execution-profile denial;
 - concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, and bounded startup-lock waiting;
-- foreground takeover of active and orphaned background daemons, legacy lock identification from canonicalized process arguments, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
+- foreground takeover of active and orphaned background daemons with current service-lock metadata, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
 - fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results;
 - machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, installed-application discovery caching, and name-based task matching;
 - relay environment-proxy direct/bypass/agent selection, unsupported proxy rejection, fail-fast invalid configuration, and route observability without endpoint or credential disclosure;
@@ -41,11 +41,11 @@ The suite includes:
 - real-machine canonical-full sandbox acceptance for outside-workspace I/O, direct/shell execution, full environment inheritance, SSH prerequisites, temporary authorized-key writing, and detached cleanup without external state changes;
 - deterministic injected atomic-replace failures, sustained transient Windows sharing contention beyond the old retry budget, bounded exponential delay selection, and repeated Windows full-sandbox runs;
 - canonical named-profile repair and full-only tool exposure parity between local and Worker policy filters;
-- managed-job staging/local approval/cancel-before-start, detachment, job-scoped temporary files, resource hash verification/redaction, discard capture, finally execution, descendant-tree escalation, token/snapshot-safe transition locks, runner process identity, plan scrubbing, PID-reuse-safe dead-runner recovery, and legacy PID-file compatibility;
+- managed-job staging/local approval/cancel-before-start, detachment, job-scoped temporary files, resource hash verification/redaction, discard capture, finally execution, descendant-tree escalation, token/snapshot-safe transition locks, runner process identity, plan scrubbing, PID-reuse-safe dead-runner recovery, and rejection of numeric-only runner records;
 - daemon/startup locking, successfully-read corrupt-JSON recovery, and explicit propagation/preservation of oversized, symbolic-link, permission, and I/O failures;
-- guarded state-root removal, unsafe state-root/workspace overlap rejection before creation, all-profile lock/daemon scanning, schema migration, policy-origin persistence, and legacy implicit-default migration;
+- guarded state-root removal, unsafe state-root/workspace overlap rejection before creation, all-profile lock/daemon scanning, strict current-schema validation, corrupt-JSON isolation, and policy-origin persistence;
 - no filename-based sensitive-file denial under unrestricted policy;
-- log redaction, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, service warning-level configuration, and idempotent bounded migration of legacy log formats;
+- log redaction, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, service warning-level configuration, current-schema reset, and bounded tail trimming;
 - deterministic relay connection lifecycle coverage for transport construction/error/deadline, pre-handshake `welcome` validation, authenticated `hello_ack` readiness, identity/version mismatch, retryable Worker handshake errors, fatal protocol errors, autonomous outage-reminder backoff, handshake and heartbeat timeout, brief-outage suppression, sustained-outage escalation, recovery summaries, and supersession;
 - shared no-follow bounded-file reads for normal files, over-limit data, directories, and symbolic links;
 - CLI parsing, policy profiles, and client configuration boundaries;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -98,7 +98,8 @@
     "commit-message:check": "node scripts/commit-message-check.mjs",
     "commit-message:test": "node tests/commit-message-test.mjs",
     "tool-docs:generate": "node scripts/generate-tool-reference.mjs",
-    "tool-docs:check": "node scripts/generate-tool-reference.mjs --check"
+    "tool-docs:check": "node scripts/generate-tool-reference.mjs --check",
+    "account:test": "node tests/account-admin-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",

package/src/local/account-access.mjs

@@ -0,0 +1,37 @@
+import accessContract from "../shared/access-contract.json" with { type: "json" };
+import { BridgeError } from "./errors.mjs";
+import { policyProfile, toolNamesForPolicy, assertToolAllowed } from "./policy.mjs";
+
+export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
+export const ACCOUNT_ROLES = Object.freeze(Object.fromEntries(
+  Object.entries(accessContract.roles).map(([name, value]) => [name, Object.freeze({ ...value })]),
+));
+export const DEFAULT_ACCOUNT_ROLE = String(accessContract.defaultRole);
+export const OWNER_ACCOUNT_ROLE = String(accessContract.ownerRole);
+
+export function normalizeAccountRole(value) {
+  const role = String(value || "").trim().toLowerCase();
+  if (!ACCOUNT_ROLES[role]) throw new BridgeError("invalid_request", `unknown account role: ${role}`);
+  return role;
+}
+
+export function accountRolePolicy(role) {
+  const normalized = normalizeAccountRole(role);
+  return policyProfile(ACCOUNT_ROLES[normalized].profile, "explicit");
+}
+
+export function accountRoleToolNames(role) {
+  return toolNamesForPolicy(accountRolePolicy(role));
+}
+
+export class AccountAccessGate {
+  assert(role, tool) {
+    const normalized = normalizeAccountRole(role);
+    assertToolAllowed(accountRolePolicy(normalized), tool);
+    return normalized;
+  }
+
+  names(role) {
+    return accountRoleToolNames(role);
+  }
+}

package/src/local/account-admin.mjs

@@ -0,0 +1,105 @@
+import { randomBytes } from "node:crypto";
+import { ACCOUNT_ROLES, normalizeAccountRole } from "./account-access.mjs";
+import { BridgeError } from "./errors.mjs";
+
+const REQUEST_TIMEOUT_MS = 15_000;
+
+export function generateAccountPassword() {
+  return `account_password_${randomBytes(32).toString("base64url")}`;
+}
+
+export class AccountAdminClient {
+  constructor({ workerUrl, adminSecret, fetchImpl = fetch }) {
+    this.workerUrl = normalizeWorkerUrl(workerUrl);
+    if (typeof adminSecret !== "string" || adminSecret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
+    this.adminSecret = adminSecret;
+    this.fetchImpl = fetchImpl;
+  }
+
+  list() {
+    return this.request("GET", "/admin/accounts");
+  }
+
+  create({ name, role, password, displayName = "" }) {
+    return this.request("POST", "/admin/accounts", {
+      name: normalizeAccountName(name),
+      role: normalizeAccountRole(role),
+      password: String(password || ""),
+      ...(displayName ? { display_name: String(displayName) } : {}),
+    });
+  }
+
+  update({ accountId, role, active, displayName }) {
+    return this.request("PATCH", "/admin/accounts", {
+      account_id: requiredAccountId(accountId),
+      ...(role === undefined ? {} : { role: normalizeAccountRole(role) }),
+      ...(active === undefined ? {} : { active: Boolean(active) }),
+      ...(displayName === undefined ? {} : { display_name: String(displayName) }),
+    });
+  }
+
+  rotatePassword({ accountId, password }) {
+    return this.request("POST", "/admin/accounts/rotate-password", {
+      account_id: requiredAccountId(accountId),
+      password: String(password || ""),
+    });
+  }
+
+  remove({ accountId }) {
+    return this.request("DELETE", "/admin/accounts", { account_id: requiredAccountId(accountId) });
+  }
+
+  async find(target) {
+    const result = await this.list();
+    const value = String(target || "").trim().toLowerCase();
+    const matches = result.accounts.filter((account) => account.account_id === target || account.name === value);
+    if (matches.length !== 1) throw new BridgeError(matches.length ? "conflict" : "not_found", matches.length ? "account target is ambiguous" : "account was not found");
+    return matches[0];
+  }
+
+  async request(method, pathname, body) {
+    const response = await this.fetchImpl(`${this.workerUrl}${pathname}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${this.adminSecret}`,
+        ...(body === undefined ? {} : { "content-type": "application/json" }),
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      cache: "no-store",
+    }).catch((error) => {
+      throw new BridgeError("network_error", "account administration request failed", { cause: error, retryable: true });
+    });
+    if (response.status === 204) return { removed: true };
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const message = typeof payload.message === "string" ? payload.message : typeof payload.error === "string" ? payload.error : `account administration failed (${response.status})`;
+      throw new BridgeError(response.status === 404 ? "not_found" : response.status === 409 ? "conflict" : response.status === 401 ? "authentication_failed" : "invalid_request", message);
+    }
+    return payload;
+  }
+}
+
+export function accountRoleNames() {
+  return Object.keys(ACCOUNT_ROLES);
+}
+
+function normalizeWorkerUrl(value) {
+  const url = new URL(String(value || ""));
+  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new BridgeError("invalid_request", "Worker URL must be a credential-free HTTPS origin");
+  }
+  return url.origin;
+}
+
+function normalizeAccountName(value) {
+  const name = String(value || "").trim().toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9._-]{1,62}[a-z0-9])?$/.test(name)) throw new BridgeError("invalid_request", "account name must contain 3-64 lowercase letters, digits, dots, underscores, or hyphens");
+  return name;
+}
+
+function requiredAccountId(value) {
+  const id = String(value || "");
+  if (!/^acct_[A-Za-z0-9_-]{20,96}$/.test(id)) throw new BridgeError("invalid_request", "account id is invalid");
+  return id;
+}

package/src/local/bounded-output.mjs

@@ -0,0 +1,50 @@
+export class BoundedOutput {
+  constructor(maximumBytes, options = {}) {
+    const maximum = Number(maximumBytes);
+    if (!Number.isFinite(maximum) || maximum < 1) throw new Error("maximum output bytes must be positive");
+    this.maximum = Math.floor(maximum);
+    this.headLimit = Math.max(1, Math.min(this.maximum, Math.floor(Number(options.headBytes) || this.maximum / 3)));
+    this.tailLimit = Math.max(0, this.maximum - this.headLimit);
+    this.totalBytes = 0;
+    this.full = Buffer.alloc(0);
+    this.head = Buffer.alloc(0);
+    this.tail = Buffer.alloc(0);
+  }
+
+  append(chunk) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ""));
+    if (!bytes.length) return;
+    this.totalBytes += bytes.length;
+
+    if (this.full) {
+      const combined = Buffer.concat([this.full, bytes]);
+      if (combined.length <= this.maximum) {
+        this.full = combined;
+        return;
+      }
+      this.full = null;
+      this.head = combined.subarray(0, this.headLimit);
+      this.tail = this.tailLimit ? combined.subarray(Math.max(this.headLimit, combined.length - this.tailLimit)) : Buffer.alloc(0);
+      return;
+    }
+
+    if (this.head.length < this.headLimit) {
+      const missing = this.headLimit - this.head.length;
+      this.head = Buffer.concat([this.head, bytes.subarray(0, missing)]);
+    }
+    if (this.tailLimit) {
+      const combinedTail = Buffer.concat([this.tail, bytes]);
+      this.tail = combinedTail.subarray(Math.max(0, combinedTail.length - this.tailLimit));
+    }
+  }
+
+  get truncatedBytes() {
+    return Math.max(0, this.totalBytes - this.maximum);
+  }
+
+  text() {
+    if (this.full) return this.full.toString("utf8");
+    const marker = `\n\n[truncated ${this.truncatedBytes} bytes; preserved beginning and end]\n\n`;
+    return `${this.head.toString("utf8")}${marker}${this.tail.toString("utf8")}`;
+  }
+}

package/src/local/call-registry.mjs

@@ -62,6 +62,16 @@ export class CallRegistry {
     return true;
   }
 
+  cancelOrigin(origin, reason = "transport disconnected") {
+    const expected = String(origin || "");
+    let cancelled = 0;
+    for (const [id, record] of this.calls) {
+      if (record.origin !== expected) continue;
+      if (this.cancel(id, reason)) cancelled += 1;
+    }
+    return cancelled;
+  }
+
   cancelAll(reason = "runtime stopped") {
     for (const id of [...this.calls.keys()]) {
       this.cancel(id, reason);

package/src/local/cli-account-admin.mjs

@@ -0,0 +1,79 @@
+import { AccountAdminClient, accountRoleNames, generateAccountPassword } from "./account-admin.mjs";
+import { loadState } from "./state.mjs";
+
+export function createAccountCommand({ chooseWorkspace, confirm }) {
+  if (typeof chooseWorkspace !== "function" || typeof confirm !== "function") {
+    throw new TypeError("account command requires chooseWorkspace and confirm dependencies");
+  }
+  return async function accountCommand(args) {
+    const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
+    const state = loadState(workspace, { stateDir: args.stateDir });
+    const client = accountAdminClient(state);
+    const action = String(args._[0] || "list").toLowerCase();
+    const result = await performAccountAction({ action, args, client, confirm });
+    if (result === null) return;
+    if (args.json) console.log(JSON.stringify(result, null, 2));
+    else printAccountResult(action, result);
+  };
+}
+
+export function accountAdminClient(state) {
+  if (!state.worker?.url || !state.worker?.accountAdminSecret) {
+    throw new Error("account administration requires a deployed Worker; run machine-mcp first");
+  }
+  return new AccountAdminClient({ workerUrl: state.worker.url, adminSecret: state.worker.accountAdminSecret });
+}
+
+async function performAccountAction({ action, args, client, confirm }) {
+  if (action === "list") return client.list();
+  if (action === "add") {
+    const name = args._[1];
+    const role = args._[2];
+    if (!name || !role) throw new Error(`account add requires NAME and ROLE (${accountRoleNames().join(", ")})`);
+    const password = generateAccountPassword();
+    return { ...(await client.create({ name, role, password })), password };
+  }
+  if (action === "role") {
+    const account = await client.find(args._[1]);
+    const role = args._[2];
+    if (!role) throw new Error(`account role requires NAME_OR_ID and ROLE (${accountRoleNames().join(", ")})`);
+    return client.update({ accountId: account.account_id, role });
+  }
+  if (action === "enable" || action === "disable") {
+    const account = await client.find(args._[1]);
+    return client.update({ accountId: account.account_id, active: action === "enable" });
+  }
+  if (action === "rotate-password") {
+    const account = await client.find(args._[1]);
+    const password = generateAccountPassword();
+    return { ...(await client.rotatePassword({ accountId: account.account_id, password })), password };
+  }
+  if (action === "remove") {
+    const account = await client.find(args._[1]);
+    if (!args.yes && !(await confirm(`Remove account ${account.name}?`, false))) {
+      console.log("Account removal cancelled.");
+      return null;
+    }
+    return client.remove({ accountId: account.account_id });
+  }
+  throw new Error("Unknown account action. Use list, add, role, enable, disable, rotate-password, or remove.");
+}
+
+function printAccountResult(action, result) {
+  if (action === "list") {
+    if (!result.accounts.length) {
+      console.log("No accounts configured.");
+      return;
+    }
+    for (const account of result.accounts) {
+      console.log(`${account.name}\t${account.role}\t${account.active ? "active" : "disabled"}\t${account.account_id}`);
+    }
+    return;
+  }
+  if (result.account) console.log(`${result.account.name}: ${result.account.role}; ${result.account.active ? "active" : "disabled"}`);
+  if (result.password) {
+    process.stdout.write(`Password: ${result.password}\n`);
+    console.log("Save this password now; it is not stored locally or shown again.");
+  }
+  if (result.removed) console.log("Account removed.");
+}

package/src/local/cli-options.mjs

@@ -2,8 +2,7 @@ import { normalizeLogLevel } from "./log.mjs";
 
 const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
-  "daemonOnly", "noAutostart", "noPrintCredentials", "printMcpCredentials",
-  "printCredentials", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
+  "daemonOnly", "noAutostart", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
   "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
 ]);
 const VALUE_OPTIONS = new Set([
@@ -15,7 +14,7 @@ const LOG_FORMATS = new Set(["text", "json"]);
 const COMMAND_OPTIONS = {
   start: new Set([
     "workspace", "stateDir", "workerName", "quiet", "json", "verbose", "logLevel", "logFormat", "rotateSecrets", "forceWorker",
-    "daemonOnly", "noAutostart", "noPrintCredentials", "printMcpCredentials", "printCredentials",
+    "daemonOnly", "noAutostart",
     "profile", "execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
   ]),
   stdio: new Set(["workspace", "stateDir", "profile", "execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths", "verbose", "quiet", "logLevel", "logFormat"]),
@@ -23,11 +22,12 @@ const COMMAND_OPTIONS = {
   status: new Set(["workspace", "stateDir"]),
   doctor: new Set(["workspace", "stateDir"]),
   "full-test": new Set(["workspace", "stateDir", "json"]),
-  "rotate-secrets": new Set(["workspace", "stateDir", "workerName", "noPrintCredentials", "printMcpCredentials", "printCredentials", "quiet"]),
+  "rotate-secrets": new Set(["workspace", "stateDir", "workerName", "quiet"]),
   workspace: new Set(["workspace", "stateDir"]),
   service: new Set(["workspace", "stateDir", "quiet"]),
   autostart: new Set(["workspace", "stateDir", "quiet"]),
   resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
+  account: new Set(["workspace", "stateDir", "json", "yes"]),
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
@@ -40,6 +40,7 @@ const STATIC_POSITIONAL_RULES = Object.freeze({
 });
 const RESOURCE_POSITIONAL_LIMITS = Object.freeze({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 });
 const JOB_POSITIONAL_LIMITS = Object.freeze({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 });
+const ACCOUNT_POSITIONAL_LIMITS = Object.freeze({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 });
 const ACTION_POSITIONAL_RULES = Object.freeze({
   workspace(args) {
     const action = String(args._[0] || "show");
@@ -54,6 +55,10 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
     const action = String(args._[0] || "list");
     return { max: RESOURCE_POSITIONAL_LIMITS[action] ?? 1, tooMany: `resource ${action} received too many positional arguments` };
   },
+  account(args) {
+    const action = String(args._[0] || "list");
+    return { max: ACCOUNT_POSITIONAL_LIMITS[action] ?? 1, tooMany: `account ${action} received too many positional arguments` };
+  },
   browser(args) {
     const action = String(args._[0] || "status");
     return { max: 1, tooMany: `browser ${action} received too many positional arguments` };

package/src/local/cli-policy.mjs

@@ -1,6 +1,7 @@
 import {
   DEFAULT_POLICY_PROFILE,
   DEFAULT_POLICY_REVISION,
+  POLICY_ORIGINS,
   POLICY_PROFILES,
   normalizePolicy,
   policyProfile,
@@ -9,9 +10,7 @@ import {
 const POLICY_OVERRIDE_KEYS = Object.freeze(["execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths"]);
 
 export function resolvePolicy(args = {}, stored = {}) {
-  const hasStored = stored && typeof stored === "object" && (
-    typeof stored.allowWrite === "boolean" || typeof stored.allowExec === "boolean" || typeof stored.execMode === "string"
-  );
+  const hasStored = stored && typeof stored === "object" && typeof stored.profile === "string";
   const explicitKeys = ["profile", ...POLICY_OVERRIDE_KEYS];
   const hasExplicit = explicitKeys.some((key) => Object.prototype.hasOwnProperty.call(args, key));
   const base = { ...selectPolicyBase(args, stored, hasStored) };
@@ -26,8 +25,6 @@ export function resolvePolicy(args = {}, stored = {}) {
 }
 
 function policyState(policy) {
-  // Capability fields retain the canonical immutable contract. The CLI owns a
-  // sealed persistence record with exactly one writable metadata field.
   const normalized = normalizePolicy(policy);
   const state = {};
   for (const [key, value] of Object.entries(normalized)) {
@@ -43,8 +40,11 @@ function selectPolicyBase(args, stored, hasStored) {
     if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
     return policyProfile(profile, "explicit");
   }
-  if (hasStored) return migrateLegacyPolicy(stored);
-  return policyProfile(DEFAULT_POLICY_PROFILE, "default");
+  if (!hasStored) return policyProfile(DEFAULT_POLICY_PROFILE, "default");
+  if (stored.revision !== DEFAULT_POLICY_REVISION || !POLICY_ORIGINS.has(stored.origin)) {
+    throw new Error("stored policy schema is obsolete; remove the state root and initialize the current version");
+  }
+  return normalizePolicy(stored);
 }
 
 function applyPolicyOverrides(policy, args) {
@@ -66,24 +66,3 @@ function applyPolicyOverrides(policy, args) {
 function applyBooleanOverride(args, key, apply) {
   if (typeof args[key] === "boolean") apply(args[key]);
 }
-
-function migrateLegacyPolicy(stored = {}) {
-  if (stored.origin === "default" && Number(stored.revision || 0) < DEFAULT_POLICY_REVISION) {
-    return policyProfile(DEFAULT_POLICY_PROFILE, "default");
-  }
-  if (stored.origin === "migrated" && Number(stored.revision || 0) < DEFAULT_POLICY_REVISION) {
-    return policyProfile(DEFAULT_POLICY_PROFILE, "migrated");
-  }
-  if (stored.origin) return normalizePolicy(stored);
-  const normalized = normalizePolicy(stored);
-  const looksLikeLegacyImplicitDefault = (
-    normalized.profile === "custom"
-    && normalized.allowWrite === true
-    && normalized.execMode === "shell"
-    && normalized.unrestrictedPaths === false
-    && normalized.minimalEnv === true
-    && normalized.exposeAbsolutePaths === false
-  );
-  if (looksLikeLegacyImplicitDefault) return policyProfile("full", "migrated");
-  return normalizePolicy({ ...normalized, origin: "legacy-preserved", revision: DEFAULT_POLICY_REVISION });
-}