machine-bridge-mcp 0.17.0 → 0.18.0

package/src/local/cli.mjs

@@ -10,6 +10,8 @@ import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./to
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { generateAccountPassword } from "./account-admin.mjs";
+import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
 export { resolvePolicy } from "./cli-policy.mjs";
 export { parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { classifyOperationalError, createLogger, normalizeLogLevel, sanitizeLogText } from "./log.mjs";
@@ -32,7 +34,6 @@ import {
   loadState,
   ownerOnlyFile,
   packageRoot,
-  previewSecret,
   readDaemonLockOwner,
   redactState,
   removeStateRoot,
@@ -45,6 +46,7 @@ import {
 } from "./state.mjs";
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
+const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
 
 const COMMAND_HANDLERS = Object.freeze({
   start: startCommand,
@@ -58,6 +60,7 @@ const COMMAND_HANDLERS = Object.freeze({
   autostart: serviceCommand,
   "rotate-secrets": rotateSecretsCommand,
   resource: localAdminCommands.resourceCommand,
+  account: accountCommand,
   browser: localAdminCommands.browserCommand,
   job: localAdminCommands.jobCommand,
   uninstall: uninstallCommand,
@@ -68,7 +71,6 @@ export async function main(argv = process.argv.slice(2)) {
   const args = parseArgs(rest);
   if (args.help || command === "help") return usage();
   if (args.version || command === "version") return version();
-  if (command === "api") throw removedLocalApiError();
   validateCommandOptions(command, args);
   validatePositionals(command, args);
   validateLoggingOptions(args);
@@ -192,7 +194,7 @@ async function prepareStartMode(args, state, logger) {
   }
   // A normal foreground start first asks the platform service manager to
   // unload the job, then independently reclaims a verified daemon-only
-  // process. The second step handles legacy/orphan daemons that launchd or
+  // process. The second step handles orphaned service daemons that launchd or
   // another service manager no longer tracks.
   return stopAutostartBestEffort(logger);
 }
@@ -208,11 +210,7 @@ function reportExistingDaemon(args, state, owner, logger) {
   const notice = `${mode} daemon already running for this workspace (${pid}${version}); it was not restarted and requested changes were not applied`;
   logger.warn(notice);
   if (args.json) {
-    printStartJson(state, {
-      showCredentials: Boolean((args.printMcpCredentials || args.printCredentials) && !args.noPrintCredentials),
-      requestedChangesApplied: false,
-      notice,
-    });
+    printStartJson(state, { requestedChangesApplied: false, notice });
     return;
   }
   if (owner?.mode === "foreground") {
@@ -236,8 +234,6 @@ function isIdempotentDaemonOnlyStart(args) {
     || args.fullEnv
     || args.unrestrictedPaths
     || args.absolutePaths
-    || args.printMcpCredentials
-    || args.printCredentials
   );
 }
 
@@ -257,27 +253,33 @@ async function startRemoteRuntime({ args, workspace, state, daemonLock, logger }
 }
 
 async function prepareRemoteState({ args, workspace, state, logger }) {
-  const previousMcpServerUrl = state.worker?.mcpServerUrl || "";
-  const firstMcpConnection = !previousMcpServerUrl || !state.worker?.oauthPassword;
   const workerName = validateWorkerName(args.workerName);
   ensureWorkerSecrets(state, { rotateSecrets: Boolean(args.rotateSecrets), workerName });
-  const previousPolicyOrigin = state.policy?.origin;
   state.policy = resolvePolicy(args, state.policy);
-  const policyMigrated = !previousPolicyOrigin && state.policy.origin === "migrated";
   state.policy.updatedAt = new Date().toISOString();
   saveState(state);
 
-  if (!args.daemonOnly) await ensureWorker(state, args);
-  else if (!state.worker.url) throw new Error("--daemon-only requires an existing worker URL in state; run start once without --daemon-only");
+  let initialOwner = null;
+  if (!args.daemonOnly) {
+    await ensureWorker(state, args);
+    initialOwner = await ensureInitialOwnerAccount(state);
+  } else if (!state.worker.url) {
+    throw new Error("--daemon-only requires an existing Worker URL; run start once without --daemon-only");
+  }
 
   if (!args.daemonOnly && !args.noAutostart) {
     await installAutostartBestEffort({ workspace, stateRoot: state.paths.stateRoot, entryScript: process.argv[1], logger });
   }
-  const mcpConnectionChanged = Boolean(previousMcpServerUrl && previousMcpServerUrl !== state.worker.mcpServerUrl);
-  return {
-    policyMigrated,
-    shouldPrintMcpCredentials: Boolean(args.printMcpCredentials || args.printCredentials || firstMcpConnection || args.rotateSecrets || mcpConnectionChanged),
-  };
+  return { initialOwner };
+}
+
+async function ensureInitialOwnerAccount(state) {
+  const client = accountAdminClient(state);
+  const existing = await client.list();
+  if (existing.accounts.length > 0) return null;
+  const password = generateAccountPassword();
+  const created = await client.create({ name: "owner", role: "owner", password, displayName: "Bridge Owner" });
+  return { ...created.account, password };
 }
 
 function createRemoteRuntime({ args, workspace, state, daemonLock, logger }) {
@@ -305,18 +307,13 @@ function createRemoteRuntime({ args, workspace, state, daemonLock, logger }) {
 
 function reportRemoteReady(args, state, readiness) {
   if (args.json) {
-    printStartJson(state, {
-      showCredentials: Boolean((args.printMcpCredentials || args.printCredentials) && !args.noPrintCredentials),
-      notice: readiness.policyMigrated ? "legacy implicit policy migrated to full access" : "",
-    });
+    printStartJson(state, { initialOwner: readiness.initialOwner });
     return;
   }
   printMcpConnection(state, {
-    noPrintCredentials: Boolean(args.noPrintCredentials),
-    includeCredentials: readiness.shouldPrintMcpCredentials,
     quiet: Boolean(args.quiet),
     verbose: Boolean(args.verbose),
-    policyMigrated: readiness.policyMigrated,
+    initialOwner: readiness.initialOwner,
   });
 }
 
@@ -363,16 +360,11 @@ async function clientConfigCommand(args) {
   }
 }
 
-function removedLocalApiError() {
-  return new Error("Local /v1 API support has been removed. Use the printed Remote MCP Server URL/password with an MCP client instead.");
-}
-
-
 async function ensureWorker(state, args) {
   const logger = createLogger({ level: args.json ? "error" : effectiveLogLevel(args), format: effectiveLogFormat(args), component: "worker" });
   const desiredHash = workerDeployHash(state);
   const expectedVersion = currentPackageVersion();
-  const complete = state.worker.url && state.worker.mcpServerUrl && state.worker.oauthPassword && state.worker.daemonSecret && state.worker.oauthTokenVersion && state.worker.name;
+  const complete = state.worker.url && state.worker.mcpServerUrl && state.worker.accountAdminSecret && state.worker.daemonSecret && state.worker.oauthTokenVersion && state.worker.name;
   if (!args.forceWorker && !args.rotateSecrets && complete && state.worker.deployHash === desiredHash) {
     const health = await workerHealth(state.worker.url, expectedVersion);
     if (health.ok) {
@@ -423,7 +415,7 @@ async function withSecretsFile(state, callback) {
   cleanupStaleSecretFiles(dir);
   const tempPath = resolve(dir, `worker-secrets-${process.pid}-${Date.now()}-${randomBytes(6).toString("hex")}.json`);
   const payload = {
-    MCP_OAUTH_PASSWORD: state.worker.oauthPassword,
+    ACCOUNT_ADMIN_SECRET: state.worker.accountAdminSecret,
     DAEMON_SHARED_SECRET: state.worker.daemonSecret,
     OAUTH_TOKEN_VERSION: state.worker.oauthTokenVersion,
   };
@@ -453,9 +445,9 @@ export function cleanupStaleSecretFiles(dir) {
 
 function workerDeployHash(state) {
   const hash = createHash("sha256");
-  hash.update("mbm-worker-deploy-v1");
+  hash.update("mbm-worker-deploy-v2");
   hash.update(String(state.worker.name || ""));
-  hash.update(String(state.worker.oauthPassword || ""));
+  hash.update(String(state.worker.accountAdminSecret || ""));
   hash.update(String(state.worker.daemonSecret || ""));
   hash.update(String(state.worker.oauthTokenVersion || ""));
   for (const file of workerDeployHashFiles()) {
@@ -542,14 +534,14 @@ function extractWorkerUrl(text = "") {
   return anyHttps.find(match => /workers\.dev|\/healthz|\/mcp/.test(match[0]))?.[0]?.replace(/[),.]+$/, "") || "";
 }
 
-function printStartJson(state, { showCredentials = false, requestedChangesApplied = true, notice = "" } = {}) {
+function printStartJson(state, { requestedChangesApplied = true, notice = "", initialOwner = null } = {}) {
   createLogger({ component: "ready" }).json({
     mcp: {
       server_url: state.worker.mcpServerUrl,
-      connection_password: showCredentials ? state.worker.oauthPassword : previewSecret(state.worker.oauthPassword),
       worker_url: state.worker.url,
       worker_name: state.worker.name,
     },
+    ...(initialOwner ? { initial_owner: initialOwner } : {}),
     workspace: state.workspace.path,
     state_path: state.paths.statePath,
     policy: state.policy,
@@ -558,36 +550,20 @@ function printStartJson(state, { showCredentials = false, requestedChangesApplie
   });
 }
 
-function printMcpConnection(state, {
-  noPrintCredentials = false,
-  includeCredentials = false,
-  quiet = false,
-  verbose = false,
-  policyMigrated = false,
-} = {}) {
+function printMcpConnection(state, { quiet = false, verbose = false, initialOwner = null } = {}) {
   const logger = createLogger({ component: "ready", quiet, level: quiet ? "error" : verbose ? "debug" : "info" });
-  const payload = {
-    mcp_server_url: state.worker.mcpServerUrl,
-    mcp_connection_password: state.worker.oauthPassword,
-    workspace: state.workspace.path,
-    state_path: state.paths.statePath,
-    policy: state.policy,
-  };
-  if (includeCredentials) {
-    logger.success("Remote MCP bridge is ready; save these connection details if your ChatGPT app needs to reconnect");
-    logger.plain(`  MCP Server URL: ${payload.mcp_server_url}`);
-    if (!noPrintCredentials) logger.plain(`  MCP connection password: ${payload.mcp_connection_password}`);
-    else logger.plain(`  MCP connection password: ${previewSecret(payload.mcp_connection_password)} (redacted)`);
+  logger.success("Remote MCP bridge is ready");
+  logger.plain(`  MCP Server URL: ${state.worker.mcpServerUrl}`);
+  if (initialOwner) {
+    logger.warn("Initial owner account created; save the password now because it is not stored locally or shown again.");
+    logger.plain(`  Account: ${initialOwner.name}`);
+    logger.plain(`  Password: ${initialOwner.password}`);
   } else {
-    logger.success("Remote MCP bridge is ready");
-    logger.safePlain("  Connection credentials unchanged; use --print-mcp-credentials only when reconnecting a client.");
+    logger.safePlain("  Use `machine-mcp account` to manage account access.");
   }
-  if (policyMigrated) {
-    logger.warn("Legacy implicit policy migrated to full access; use --profile agent, edit, or review to narrow it.");
-  }
-  logger.plain(`  Workspace: ${payload.workspace}`);
-  logger.safePlain(`  Policy: ${formatPolicySummary(payload.policy)}`);
-  if (verbose) logger.plain(`  State: ${payload.state_path}`);
+  logger.plain(`  Workspace: ${state.workspace.path}`);
+  logger.safePlain(`  Policy: ${formatPolicySummary(state.policy)}`);
+  if (verbose) logger.plain(`  State: ${state.paths.statePath}`);
 }
 
 function formatPolicySummary(policy = {}) {
@@ -616,12 +592,10 @@ function keepProcessAlive({ daemon = null, lock = null, logger = createLogger({
 async function statusCommand(args) {
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
-  const storedPolicyOrigin = state.policy?.origin;
   state.policy = resolvePolicy({}, state.policy);
   const health = state.worker?.url ? await workerHealth(state.worker.url) : { ok: false, error: "no worker url" };
   const payload = {
     ...redactState(state),
-    policyMigrationPending: !storedPolicyOrigin && state.policy.origin === "migrated",
     workerHealth: health,
   };
   console.log(JSON.stringify(payload, null, 2));
@@ -640,7 +614,6 @@ async function doctorCommand(args) {
   const whoami = await runWrangler(["whoami"], { capture: true, allowFailure: true });
   checks.push({ name: "cloudflare-login", ok: whoami.code === 0, detail: whoami.code === 0 ? "authenticated" : sanitizeLines(whoami.stderr || whoami.stdout) });
   const state = loadState(workspace, { stateDir: args.stateDir });
-  const storedPolicyOrigin = state.policy?.origin;
   state.policy = resolvePolicy({}, state.policy);
   checks.push({ name: "policy", ok: true, detail: formatPolicySummary(state.policy) });
   if (state.policy.profile === "full") {
@@ -679,7 +652,6 @@ async function doctorCommand(args) {
     ok: checks.every(check => check.ok),
     checks,
     runtimeDiagnostics,
-    policyMigrationPending: !storedPolicyOrigin && state.policy.origin === "migrated",
     state: redactState(state),
   }, null, 2));
 }
@@ -713,10 +685,8 @@ async function rotateSecretsCommand(args) {
     }
     ensureWorkerSecrets(state, { rotateSecrets: true, workerName: validateWorkerName(args.workerName) });
     saveState(state);
-    const showMcpPassword = Boolean((args.printMcpCredentials || args.printCredentials) && !args.noPrintCredentials);
-    console.log(`Rotated MCP connection password: ${showMcpPassword ? state.worker.oauthPassword : previewSecret(state.worker.oauthPassword)}`);
-    console.log(`Rotated daemon secret: ${previewSecret(state.worker.daemonSecret)}`);
-    console.log("Run `machine-mcp --print-mcp-credentials` to redeploy and display the new client connection credentials when needed.");
+    console.log("Rotated account administration, daemon, and global token-version secrets.");
+    console.log("All account access tokens are invalid. Run machine-mcp to redeploy, then reconnect clients.");
   } finally {
     startupLock.release();
   }
@@ -1008,7 +978,9 @@ Commands:
   status            Print redacted local profile state and Worker health
   doctor            Check Node, Wrangler, Cloudflare login, Worker health
   full-test         Run real local full-profile capability tests in a temporary sandbox
-  rotate-secrets    Rotate MCP password and daemon secret in local state
+  rotate-secrets    Rotate account-admin, daemon, and global token-version secrets
+  account list|add|role|enable|disable|rotate-password|remove
+                    Manage isolated remote accounts and targeted revocation
   resource generate-ssh-key NAME [PATH]
                     Generate/reuse an Ed25519 key locally and register its private file by alias
   browser status    Show browser-extension bridge and connection status
@@ -1023,8 +995,6 @@ Start options:
   --rotate-secrets      Rotate secrets before deploying
   --daemon-only         Skip deploy and only connect daemon from existing state
   --no-autostart        Do not install login autostart during start
-  --no-print-credentials Redact credentials in console output
-  --print-mcp-credentials Print MCP URL/password again for reconnecting ChatGPT apps
   --profile NAME        Policy profile: full (default), agent, edit, or review
   --exec-mode MODE      Command mode: off, direct argv, or full shell
   --no-write            Disable write_file, edit_file, and apply_patch
@@ -1033,7 +1003,7 @@ Start options:
   --unrestricted-paths  Allow filesystem tools outside the workspace
   --absolute-paths      Return absolute local paths (enabled by the full profile)
   --state-dir DIR       Override state root
-  --json                Print connection details as JSON; credentials stay redacted unless explicitly requested
+  --json                Print machine-readable output; secrets are never included
   --log-level LEVEL     error, warn, info (default), or debug
   --log-format FORMAT   text (default) or newline-delimited json
   --verbose             Alias for --log-level debug; includes per-tool success/correlation logs

package/src/local/daemon-process.mjs

@@ -153,10 +153,11 @@ function inspectWorkspaceDaemonOwner(state, owner) {
   if (!processIdentity.current) return { verified_service_daemon: false, reason: processIdentity.reason };
   if (!sameCanonicalPath(owner.workspace, state.workspace.path)) return { verified_service_daemon: false, reason: "workspace_mismatch" };
   if (owner.mode === "foreground") return { verified_service_daemon: false, reason: "foreground_daemon" };
+  if (owner.mode !== "service") return { verified_service_daemon: false, reason: "invalid_daemon_mode" };
 
   const command = processCommandLine(pid);
   if (!command) {
-    return { verified_service_daemon: false, reason: owner.mode === "service" ? "service_identity_unavailable" : "legacy_identity_unavailable" };
+    return { verified_service_daemon: false, reason: "service_identity_unavailable" };
   }
   const argv = splitProcessCommandLine(command);
   const entryName = path.basename(String(owner.entryScript || "machine-mcp"));
@@ -198,7 +199,7 @@ function publicDaemonOwner(owner) {
 }
 
 function publicDaemonMode(owner) {
-  return owner?.mode === "service" || owner?.mode === "foreground" ? owner.mode : "legacy";
+  return owner?.mode === "service" || owner?.mode === "foreground" ? owner.mode : "invalid";
 }
 
 function boundedPositiveInt(value, fallback) {

package/src/local/errors.mjs

@@ -49,20 +49,6 @@ export function errorCode(error, fallback = "execution_failed") {
   if (["ECONNRESET", "ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ENOTFOUND", "EAI_AGAIN"].includes(nodeCode)) return "network_error";
   if (["EEXIST", "ENOTEMPTY", "EBUSY"].includes(nodeCode)) return "conflict";
 
-  // Legacy errors are classified once at the boundary. New code should throw BridgeError directly.
-  const message = error instanceof Error ? error.message : String(error ?? "");
-  if (/cancel/i.test(message)) return "cancelled";
-  if (/timed out/i.test(message)) return "timeout";
-  if (/unauthorized|authentication|\b401\b/i.test(message)) return "authentication_failed";
-  if (/forbidden|authorization|\b403\b/i.test(message)) return "authorization_denied";
-  if (/outside the configured workspace/i.test(message)) return "path_boundary";
-  if (/disabled|requires .* mode|requires the canonical .* profile/i.test(message)) return "policy_denied";
-  if (/not found|ENOENT/i.test(message)) return "not_found";
-  if (/permission|EACCES|EPERM/i.test(message)) return "permission_denied";
-  if (/maximum|exceeds|max_bytes|too many|limit reached/i.test(message)) return "limit_exceeded";
-  if (/integrity|hash mismatch|changed during/i.test(message)) return "integrity_error";
-  if (/protocol|unexpected .* message|invalid .* envelope/i.test(message)) return "protocol_error";
-  if (/invalid|must|requires|ambiguous|mismatch/i.test(message)) return "invalid_request";
   return normalizeErrorCode(fallback);
 }
 

package/src/local/log.mjs

@@ -18,7 +18,7 @@ const MAX_LOG_OBJECT_KEYS = 48;
 const LEVEL_RANK = Object.freeze({ debug: 10, info: 20, success: 20, warn: 30, error: 40 });
 const SENSITIVE_KEY = /(authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)/i;
 const LOCAL_PATH_KEY = /(path|paths|cwd|workspace|directory|(?:^|[_-])dir(?:$|[_-])|root|home)/i;
-const SECRET_VALUE = /\b(?:mcp_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
+const SECRET_VALUE = /\b(?:account_admin|account_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
 const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
 const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
 const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;

package/src/local/managed-jobs.mjs

@@ -674,9 +674,7 @@ function launchRunner(dir, recover = false, recoveryToken = "") {
 
 function readRunnerOwner(dir, fallback = {}) {
   try {
-    const text = readBoundedFile(join(dir, "runner.pid"), 1024).toString("utf8").trim();
-    if (/^\d+$/.test(text)) return { pid: Number(text), ...fallback };
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(readBoundedFile(join(dir, "runner.pid"), 1024).toString("utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { ...fallback };
     return { ...fallback, ...parsed };
   } catch {

package/src/local/process-execution.mjs

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { stat } from "node:fs/promises";
+import { BoundedOutput } from "./bounded-output.mjs";
 import { executionEnv, workspaceShellCommand } from "./shell.mjs";
 import { MAX_COMMAND_BYTES, terminateProcessTreeWithEscalation, validateArgv } from "./process-sessions.mjs";
 import { BridgeError } from "./errors.mjs";
@@ -9,7 +10,7 @@ const MAX_STDIN_BYTES = 1024 * 1024;
 const DEFAULT_OUTPUT_BYTES = 512 * 1024;
 
 export class ProcessExecutionService {
-  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled }) {
+  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled, spawnProcess = spawn, terminateProcess = terminateProcessTreeWithEscalation }) {
     this.workspace = workspace;
     this.policy = policy;
     this.policyGate = policyGate;
@@ -19,6 +20,8 @@ export class ProcessExecutionService {
     this.resolveLocalCommand = resolveLocalCommand;
     this.displayPath = displayPath;
     this.throwIfCancelled = throwIfCancelled;
+    this.spawnProcess = spawnProcess;
+    this.terminateProcess = terminateProcess;
   }
 
   async runDirect(args, context = {}) {
@@ -66,83 +69,110 @@ export class ProcessExecutionService {
     if (stdin !== null && Buffer.byteLength(String(stdin)) > MAX_STDIN_BYTES) {
       throw new BridgeError("limit_exceeded", "process stdin exceeds 1 MiB");
     }
+
     return new Promise((resolvePromise, rejectPromise) => {
-      const child = spawn(cmd, args, {
-        cwd,
-        env: executionEnv(this.workspace, { fullEnv: this.policy.minimalEnv === false, runtimeDir: this.runtimeDir }),
-        detached: process.platform !== "win32",
-        windowsHide: true,
-      });
+      const stdout = new BoundedOutput(maxOutputBytes);
+      const stderr = new BoundedOutput(maxOutputBytes);
+      let child;
+      try {
+        child = this.spawnProcess(cmd, args, {
+          cwd,
+          env: executionEnv(this.workspace, { fullEnv: this.policy.minimalEnv === false, runtimeDir: this.runtimeDir }),
+          detached: process.platform !== "win32",
+          windowsHide: true,
+        });
+      } catch (error) {
+        rejectPromise(error);
+        return;
+      }
+
       this.processTracker.track(child, context.callId);
       if (stdin !== null) {
-        child.stdin.on("error", () => {});
-        child.stdin.end(String(stdin));
+        child.stdin?.on?.("error", () => {});
+        child.stdin?.end?.(String(stdin));
       }
-      let stdout = "";
-      let stderr = "";
-      let stdoutTruncated = 0;
-      let stderrTruncated = 0;
-      let timedOut = false;
+
       let settled = false;
-      let killTimer = null;
-      const timer = setTimeout(() => {
-        timedOut = true;
-        killTimer = terminateProcessTreeWithEscalation(child);
-      }, timeoutMs);
-      timer.unref?.();
-      const cleanup = () => {
-        clearTimeout(timer);
-        if (killTimer && !timedOut) clearTimeout(killTimer);
+      let processClosed = false;
+      let terminationTimer = null;
+      let timeoutTimer = null;
+      const signal = context.signal;
+
+      const cleanupAfterClose = () => {
+        if (processClosed) return;
+        processClosed = true;
+        clearTimeout(timeoutTimer);
+        signal?.removeEventListener?.("abort", onAbort);
         this.processTracker.untrack(child);
       };
-      const finish = (callback) => {
-        if (settled) return;
+
+      const settle = (callback) => {
+        if (settled) return false;
         settled = true;
-        cleanup();
         callback();
+        return true;
       };
-      child.stdout.on("data", (chunk) => {
-        const next = appendLimited(stdout, chunk, maxOutputBytes);
-        stdout = next.value;
-        stdoutTruncated += next.truncated;
-      });
-      child.stderr.on("data", (chunk) => {
-        const next = appendLimited(stderr, chunk, maxOutputBytes);
-        stderr = next.value;
-        stderrTruncated += next.truncated;
+
+      const terminate = () => {
+        if (terminationTimer || processClosed) return;
+        terminationTimer = this.terminateProcess(child);
+      };
+
+      const rejectCancelled = () => {
+        terminate();
+        const reason = signal?.reason;
+        settle(() => rejectPromise(reason instanceof Error ? reason : new BridgeError("cancelled", "tool call cancelled")));
+      };
+
+      const onAbort = () => rejectCancelled();
+      signal?.addEventListener?.("abort", onAbort, { once: true });
+
+      timeoutTimer = setTimeout(() => {
+        terminate();
+        settle(() => rejectPromise(new BridgeError("timeout", `command timed out after ${timeoutMs}ms`, { retryable: true })));
+      }, timeoutMs);
+      timeoutTimer.unref?.();
+
+      child.stdout?.on?.("data", (chunk) => stdout.append(chunk));
+      child.stderr?.on?.("data", (chunk) => stderr.append(chunk));
+
+      child.on("error", (error) => {
+        cleanupAfterClose();
+        settle(() => {
+          if (allowFailure) resolvePromise(processResult(127, stdout, error.message || stderr.text()));
+          else rejectPromise(error);
+        });
       });
-      child.on("error", (error) => finish(() => {
-        if (allowFailure) resolvePromise({ code: 127, stdout: finalizeOutput(stdout, stdoutTruncated), stderr: boundedErrorMessage(error) });
-        else rejectPromise(error);
-      }));
-      child.on("close", (code) => finish(() => {
-        const result = { code, stdout: finalizeOutput(stdout, stdoutTruncated), stderr: finalizeOutput(stderr, stderrTruncated) };
-        try { this.throwIfCancelled(context); } catch (error) { rejectPromise(error); return; }
-        if (timedOut) {
-          rejectPromise(new BridgeError("timeout", `command timed out after ${timeoutMs}ms`, { retryable: true }));
+
+      child.on("close", (code) => {
+        cleanupAfterClose();
+        if (settled) return;
+        try { this.throwIfCancelled(context); } catch (error) {
+          settle(() => rejectPromise(error));
           return;
         }
-        if (code === 0 || allowFailure) resolvePromise(result);
-        else rejectPromise(new BridgeError("execution_failed", stderr.trim() || stdout.trim() || `${cmd} exited ${code}`));
-      }));
+        const result = processResult(code, stdout, stderr);
+        if (code === 0 || allowFailure) settle(() => resolvePromise(result));
+        else settle(() => rejectPromise(new BridgeError("execution_failed", result.stderr.trim() || result.stdout.trim() || `${cmd} exited ${code}`)));
+      });
+
+      if (signal?.aborted) rejectCancelled();
     });
   }
 }
 
+function processResult(code, stdout, stderr) {
+  const stderrBuffer = stderr instanceof BoundedOutput ? stderr : null;
+  return {
+    code,
+    stdout: stdout instanceof BoundedOutput ? stdout.text() : String(stdout || ""),
+    stderr: stderrBuffer ? stderrBuffer.text() : boundedErrorMessage(stderr),
+    stdout_truncated_bytes: stdout instanceof BoundedOutput ? stdout.truncatedBytes : 0,
+    stderr_truncated_bytes: stderrBuffer ? stderrBuffer.truncatedBytes : 0,
+  };
+}
+
 export function boundedErrorMessage(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.replace(/[\r\n]+/g, " ").slice(0, 4096) || "tool call failed";
 }
-
-function appendLimited(current, chunk, maximum) {
-  const text = String(chunk || "");
-  const budget = Math.max(0, maximum - Buffer.byteLength(current));
-  const textBytes = Buffer.byteLength(text);
-  if (textBytes <= budget) return { value: current + text, truncated: 0 };
-  const slice = Buffer.from(text).subarray(0, budget).toString();
-  return { value: current + slice, truncated: textBytes - Buffer.byteLength(slice) };
-}
-
-function finalizeOutput(value, truncated) {
-  return truncated > 0 ? `${value}\n\n[truncated ${truncated} bytes]` : value;
-}

package/src/local/relay-connection.mjs

@@ -209,7 +209,7 @@ export class RelayConnection {
         this.failPermanently("relay_proxy_configuration");
         return;
       }
-      this.lastTransportErrorClass = classifyOperationalError(error);
+      this.lastTransportErrorClass = classifyRelayTransportError(error);
       this.logger.debug?.("remote relay connection could not be created", { error_class: this.lastTransportErrorClass });
       this.scheduleReconnect("connection_interrupted");
       return;
@@ -306,7 +306,7 @@ export class RelayConnection {
 
     socket.on("error", (error) => {
       if (this.socket !== socket || this.closed) return;
-      this.lastTransportErrorClass = classifyOperationalError(error);
+      this.lastTransportErrorClass = classifyRelayTransportError(error);
       this.logger.debug?.("remote relay transport error", { error_class: this.lastTransportErrorClass });
       if (this.lastTransportErrorClass === "authentication_failed") {
         this.failPermanently("relay_authentication_failed");
@@ -373,7 +373,7 @@ export class RelayConnection {
       socket.send(JSON.stringify(value));
       return true;
     } catch (error) {
-      this.lastTransportErrorClass = classifyOperationalError(error);
+      this.lastTransportErrorClass = classifyRelayTransportError(error);
       this.pendingCloseCategory = "relay_transport_error";
       this.logger.debug?.("remote relay send failed", { error_class: this.lastTransportErrorClass });
       terminateSocket(socket);
@@ -585,6 +585,14 @@ function redactUrl(value) {
   }
 }
 
+function classifyRelayTransportError(error) {
+  const directStatus = Number(error?.statusCode ?? error?.response?.statusCode);
+  if (directStatus === 401 || directStatus === 403) return "authentication_failed";
+  const match = /^Unexpected server response: (\d{3})$/.exec(String(error?.message || ""));
+  if (match && [401, 403].includes(Number(match[1]))) return "authentication_failed";
+  return classifyOperationalError(error);
+}
+
 function boundedPositiveInteger(value, fallback) {
   const number = Number(value);
   return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;