machine-bridge-mcp 0.17.1 → 0.18.0

package/src/local/runtime.mjs

@@ -28,6 +28,7 @@ import { CapabilityObserver } from "./capability-observer.mjs";
 import { readBoundedRegularFileSync } from "./secure-file.mjs";
 import { clampInteger } from "./numbers.mjs";
 import { isPlainRecord } from "./records.mjs";
+import { AccountAccessGate, normalizeAccountRole } from "./account-access.mjs";
 
 const MAX_WS_MESSAGE_BYTES = 8 * 1024 * 1024;
 const MAX_CONCURRENT_TOOL_CALLS = 16;
@@ -100,6 +101,7 @@ export class LocalRuntime {
     this.workspaceCanonicalPromise = null;
     this.policy = normalizePolicy(policy);
     this.policyGate = new PolicyGate(this.policy);
+    this.accountAccessGate = new AccountAccessGate();
     this.logger = logger;
     this.onSuperseded = typeof onSuperseded === "function" ? onSuperseded : null;
     this.resourceStatePath = resourceStatePath ? resolve(resourceStatePath) : "";
@@ -210,6 +212,7 @@ export class LocalRuntime {
         (args, context) => handler(this, args, context),
       ])),
       policyGate: this.policyGate,
+      accountAccessGate: this.accountAccessGate,
       callRegistry: this.callRegistry,
       observability: this.observability,
       logger: this.logger,
@@ -372,6 +375,7 @@ export class LocalRuntime {
         callId: envelope.id,
         origin: "relay",
         timeoutMs: envelope.timeoutMs,
+        authorization: envelope.authorization,
       });
       this.send({ type: "tool_result", id: envelope.id, ok: true, result });
     } catch (error) {
@@ -388,12 +392,21 @@ export class LocalRuntime {
     return this.callRegistry.cancel(callId, reason);
   }
 
+  handleRelayDisconnect() {
+    const cancelled = this.callRegistry.cancelOrigin("relay", "remote relay disconnected");
+    this.terminateActiveProcesses("SIGTERM", true);
+    if (cancelled > 0) {
+      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled });
+    }
+  }
+
   async executeTool(tool, args, context = {}) {
     this.lifecycle.assertOperational();
     return this.toolExecutor.execute(tool, args, {
       callId: context.callId,
       origin: context.origin || "local",
       timeoutMs: context.timeoutMs,
+      authorization: context.authorization,
       context,
     });
   }
@@ -778,7 +791,7 @@ function createRelayConnection(runtime, { workerUrl, secret, expectedVersion, on
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
     }),
     onMessage: (data) => handleRelayData(runtime, data),
-    onDisconnect: () => runtime.terminateActiveProcesses("SIGTERM", true),
+    onDisconnect: () => runtime.handleRelayDisconnect(),
     onSuperseded: () => {
       runtime.terminateActiveProcesses("SIGKILL");
       runtime.processSessionManager.clear();
@@ -805,16 +818,28 @@ function normalizeRelayToolCall(message) {
   const id = typeof message.id === "string" && message.id.length <= 256 ? message.id : "";
   const tool = typeof message.tool === "string" && message.tool.length <= 128 ? message.tool : "";
   const argumentsValue = message.arguments === undefined ? {} : message.arguments;
-  if (!id || !tool || !isPlainRecord(argumentsValue)) return { ok: false, id };
+  const authorization = normalizeRelayAuthorization(message.authorization);
+  if (!id || !tool || !isPlainRecord(argumentsValue) || !authorization) return { ok: false, id };
   return {
     ok: true,
     id,
     tool,
     arguments: argumentsValue,
+    authorization,
     timeoutMs: clampInteger(message.timeout_ms, 60_000, 1000, 610_000),
   };
 }
 
+function normalizeRelayAuthorization(value) {
+  if (!isPlainRecord(value)) return null;
+  const accountId = typeof value.account_id === "string" && /^acct_[A-Za-z0-9_-]{20,96}$/.test(value.account_id) ? value.account_id : "";
+  const accountVersion = Number(value.account_version);
+  let role;
+  try { role = normalizeAccountRole(value.role); } catch { return null; }
+  if (!accountId || !Number.isInteger(accountVersion) || accountVersion < 1) return null;
+  return Object.freeze({ account_id: accountId, account_version: accountVersion, role });
+}
+
 
 
 function collectToolPathCandidates(error, toolArgs, workspace) {

package/src/local/service.mjs

@@ -72,13 +72,10 @@ export function trimAutostartLogs(stateRoot, options = {}) {
   const root = expandHome(stateRoot);
   const maxBytes = Number.isFinite(Number(options.maxBytes)) ? Math.max(1024, Number(options.maxBytes)) : 2 * 1024 * 1024;
   const keepBytes = Math.min(maxBytes, Number.isFinite(Number(options.keepBytes)) ? Math.max(1024, Number(options.keepBytes)) : 1024 * 1024);
-  const schemaVersion = String(Number.isInteger(Number(options.schemaVersion)) && Number(options.schemaVersion) > 0
-    ? Number(options.schemaVersion)
-    : AUTOSTART_LOG_SCHEMA_VERSION);
+  const schemaVersion = String(AUTOSTART_LOG_SCHEMA_VERSION);
   const logs = path.join(root, "logs");
   const schemaFile = path.join(logs, ".log-schema");
-  const migrate = readLogSchema(schemaFile) !== schemaVersion;
-  let migrationComplete = true;
+  const reset = readLogSchema(schemaFile) !== schemaVersion;
 
   for (const name of ["daemon.out.log", "daemon.err.log"]) {
     const file = path.join(logs, name);
@@ -86,20 +83,12 @@ export function trimAutostartLogs(stateRoot, options = {}) {
     try {
       if (!existsSync(file)) continue;
       const before = lstatSync(file);
-      if (before.isSymbolicLink() || !before.isFile()) {
-        if (migrate) migrationComplete = false;
-        continue;
-      }
+      if (before.isSymbolicLink() || !before.isFile()) continue;
       const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
       fd = openSync(file, Number(fsConstants.O_RDWR) | noFollow);
       const info = fstatSync(fd);
-      if (!info.isFile()) {
-        if (migrate) migrationComplete = false;
-        continue;
-      }
-      if (migrate && info.size > 0) {
-        const legacy = readLogTail(fd, info.size, maxBytes);
-        if (legacy.length) writePrivateServiceFile(path.join(logs, legacyLogName(name)), legacy);
+      if (!info.isFile()) continue;
+      if (reset) {
         ftruncateSync(fd, 0);
       } else if (info.size > maxBytes) {
         const tail = readLogTail(fd, info.size, keepBytes);
@@ -108,16 +97,13 @@ export function trimAutostartLogs(stateRoot, options = {}) {
       }
       try { chmodSync(file, 0o600); } catch {}
     } catch {
-      if (migrate) migrationComplete = false;
-      // Operational log maintenance is best effort and must not stop startup.
+      // Log maintenance is best effort and must not stop daemon startup.
     } finally {
       if (fd !== undefined) try { closeSync(fd); } catch {}
     }
   }
 
-  if (migrate && migrationComplete) {
-    try { writePrivateServiceFile(schemaFile, `${schemaVersion}\n`); } catch {}
-  }
+  try { writePrivateServiceFile(schemaFile, `${schemaVersion}\n`); } catch {}
 }
 
 function readLogSchema(file) {
@@ -131,10 +117,6 @@ function readLogTail(fd, size, limit) {
   return lineSafeTail(buffer);
 }
 
-function legacyLogName(name) {
-  return name.endsWith(".log") ? `${name.slice(0, -4)}.legacy.log` : `${name}.legacy`;
-}
-
 function lineSafeTail(buffer) {
   if (!Buffer.isBuffer(buffer) || buffer.length === 0) return Buffer.alloc(0);
   let text = buffer.toString("utf8");
@@ -224,7 +206,6 @@ export function daemonArgs(spec) {
     "--daemon-only",
     "--workspace", spec.workspace,
     "--state-dir", spec.stateRoot,
-    "--no-print-credentials",
     "--log-level", "warn",
     "--log-format", "json",
   ];

package/src/local/shell.mjs

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { packageRoot } from "./state.mjs";
+import { BoundedOutput } from "./bounded-output.mjs";
 
 export function run(command, args = [], options = {}) {
   return new Promise((resolve, reject) => {
@@ -15,10 +16,8 @@ export function run(command, args = [], options = {}) {
       detached: process.platform !== "win32",
       windowsHide: true,
     });
-    let stdout = "";
-    let stderr = "";
-    let stdoutTruncated = 0;
-    let stderrTruncated = 0;
+    const stdout = new BoundedOutput(maxOutputBytes);
+    const stderr = new BoundedOutput(maxOutputBytes);
     let settled = false;
     let timedOut = false;
     let timer = null;
@@ -40,28 +39,18 @@ export function run(command, args = [], options = {}) {
       callback();
     };
     if (capture) {
-      child.stdout?.on("data", chunk => {
-        const next = appendLimited(stdout, chunk, maxOutputBytes);
-        stdout = next.value;
-        stdoutTruncated += next.truncated;
-      });
-      child.stderr?.on("data", chunk => {
-        const next = appendLimited(stderr, chunk, maxOutputBytes);
-        stderr = next.value;
-        stderrTruncated += next.truncated;
-      });
+      child.stdout?.on("data", chunk => stdout.append(chunk));
+      child.stderr?.on("data", chunk => stderr.append(chunk));
     }
     child.on("error", error => finish(() => {
-      const result = { code: 127, stdout: finalizeOutput(stdout, stdoutTruncated), stderr: finalizeOutput(error.message || stderr, stderrTruncated) };
+      const result = capturedResult(127, stdout, stderr, error.message);
       if (options.allowFailure) resolve(result);
       else reject(error);
     }));
     child.on("close", code => finish(() => {
       const timeoutMessage = timedOut ? `command timed out after ${timeoutMs}ms` : "";
       const result = {
-        code: timedOut ? 124 : code,
-        stdout: finalizeOutput(stdout, stdoutTruncated),
-        stderr: finalizeOutput([stderr, timeoutMessage].filter(Boolean).join("\n"), stderrTruncated),
+        ...capturedResult(timedOut ? 124 : code, stdout, stderr, timeoutMessage),
       };
       if ((!timedOut && code === 0) || options.allowFailure) resolve(result);
       else {
@@ -92,16 +81,15 @@ function terminateCommandTree(child, force) {
   }
 }
 
-function appendLimited(current, chunk, max) {
-  const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ""));
-  const budget = Math.max(0, max - Buffer.byteLength(current));
-  if (buffer.length <= budget) return { value: current + buffer.toString("utf8"), truncated: 0 };
-  const slice = buffer.subarray(0, budget).toString("utf8");
-  return { value: current + slice, truncated: buffer.length - Buffer.byteLength(slice) };
-}
-
-function finalizeOutput(value, truncated) {
-  return truncated > 0 ? `${value}\n\n[truncated ${truncated} bytes]` : value;
+function capturedResult(code, stdout, stderr, extraStderr = "") {
+  const stderrText = [stderr.text(), extraStderr].filter(Boolean).join("\n");
+  return {
+    code,
+    stdout: stdout.text(),
+    stderr: stderrText,
+    stdout_truncated_bytes: stdout.truncatedBytes,
+    stderr_truncated_bytes: stderr.truncatedBytes,
+  };
 }
 
 function findWranglerCommand() {
@@ -122,7 +110,7 @@ export function workspaceShellCommand(command) {
   if (process.platform === "win32") {
     return { cmd: "powershell.exe", args: ["-NoProfile", "-NonInteractive", "-Command", command] };
   }
-  const shell = process.env.MBM_EXEC_SHELL || (existsSync("/bin/zsh") ? "/bin/zsh" : existsSync("/bin/bash") ? "/bin/bash" : "/bin/sh");
+  const shell = existsSync("/bin/zsh") ? "/bin/zsh" : existsSync("/bin/bash") ? "/bin/bash" : "/bin/sh";
   const base = path.basename(shell);
   if (base === "zsh") return { cmd: shell, args: ["-f", "-c", command] };
   if (base === "bash") return { cmd: shell, args: ["--noprofile", "--norc", "-c", command] };

package/src/local/state-inventory.mjs

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import { activeManagedJobs } from "./managed-jobs.mjs";
 import { inspectProcessInstance } from "./process-identity.mjs";
 import { readBoundedRegularFileSync } from "./secure-file.mjs";
-import { expandHome, readDaemonLockOwner, resolveWorkspace } from "./state.mjs";
+import { STATE_SCHEMA_VERSION, expandHome, readDaemonLockOwner, resolveWorkspace } from "./state.mjs";
 
 const PROFILE_NAME = /^[a-f0-9]{24}$/;
 const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -66,7 +66,7 @@ export function knownProfileStates(stateRoot) {
         const workspace = resolveWorkspace(candidate);
         if (seen.has(workspace)) break;
         states.push({
-          schemaVersion: 5,
+          schemaVersion: STATE_SCHEMA_VERSION,
           workspace: { path: workspace, hash: entry.name },
           paths: { stateRoot: canonicalStateRoot, profileDir, statePath },
         });

package/src/local/state.mjs

@@ -11,6 +11,10 @@ import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-ide
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 export const appName = String(serverMetadata.name);
 const STATE_MARKER = ".machine-bridge-mcp-state";
+const STATE_MARKER_SCHEMA = 2;
+export const STATE_SCHEMA_VERSION = 6;
+const GLOBAL_CONFIG_SCHEMA = 1;
+const CORRUPT_RECOVERY = Symbol("corrupt-recovery");
 const MAX_STATE_JSON_BYTES = 2 * 1024 * 1024;
 const MAX_LOCK_BYTES = 64 * 1024;
 const MAX_MARKER_BYTES = 4096;
@@ -47,9 +51,14 @@ export function loadGlobalConfig(stateRoot = defaultStateRoot()) {
   const root = path.resolve(expandHome(stateRoot));
   assertNoForeignMaintenance(root);
   const file = configPath(root);
-  if (!existsSync(file)) return {};
+  if (!existsSync(file)) return { schemaVersion: GLOBAL_CONFIG_SCHEMA };
   ownerOnlyFile(file);
-  return readJsonObjectOrBackup(file);
+  const config = readJsonObjectOrBackup(file);
+  if (config[CORRUPT_RECOVERY]) return { schemaVersion: GLOBAL_CONFIG_SCHEMA };
+  if (config.schemaVersion !== GLOBAL_CONFIG_SCHEMA) {
+    throw new Error("global configuration schema is obsolete; remove the state root and initialize the current version");
+  }
+  return config;
 }
 
 export function saveGlobalConfig(config, stateRoot = defaultStateRoot()) {
@@ -58,7 +67,7 @@ export function saveGlobalConfig(config, stateRoot = defaultStateRoot()) {
   const root = ensureStateRoot(requestedRoot);
   assertNoForeignMaintenance(root);
   const file = configPath(root);
-  atomicWriteJson(file, { ...config, updatedAt: new Date().toISOString() });
+  atomicWriteJson(file, { ...config, schemaVersion: GLOBAL_CONFIG_SCHEMA, updatedAt: new Date().toISOString() });
 }
 
 export function setSelectedWorkspace(workspace, stateRoot = defaultStateRoot()) {
@@ -127,26 +136,6 @@ function assertStateRootSeparatedFromWorkspace(stateRoot, workspace) {
   }
 }
 
-function matchingLegacyProfileDir(canonicalWorkspace, stateRoot) {
-  const profilesRoot = path.join(stateRoot, "profiles");
-  if (!existsSync(profilesRoot)) return "";
-  const matches = [];
-  for (const entry of readdirSync(profilesRoot, { withFileTypes: true })) {
-    if (!entry.isDirectory() || !/^[a-f0-9]{24}$/.test(entry.name)) continue;
-    const profileDir = path.join(profilesRoot, entry.name);
-    const stateFile = path.join(profileDir, "state.json");
-    if (!existsSync(stateFile)) continue;
-    try {
-      const value = JSON.parse(readBoundedUtf8(stateFile, MAX_STATE_JSON_BYTES, "state JSON"));
-      const storedWorkspace = value?.workspace?.path;
-      if (typeof storedWorkspace !== "string") continue;
-      if (sameWorkspaceIdentity(storedWorkspace, canonicalWorkspace)) matches.push(profileDir);
-    } catch {}
-  }
-  if (matches.length > 1) throw new Error("multiple Machine Bridge profiles refer to the same canonical workspace; remove or merge the duplicate state profiles");
-  return matches[0] || "";
-}
-
 function sameWorkspaceIdentity(left, right) {
   try {
     const a = resolveWorkspace(left);
@@ -164,18 +153,18 @@ export function loadState(workspace, options = {}) {
   assertNoForeignMaintenance(requestedStateRoot);
   const stateRoot = ensureStateRoot(requestedStateRoot);
   assertNoForeignMaintenance(stateRoot);
-  const canonicalProfileDir = profileDirForWorkspace(canonicalWorkspace, stateRoot);
-  const profileDir = existsSync(canonicalProfileDir)
-    ? canonicalProfileDir
-    : matchingLegacyProfileDir(canonicalWorkspace, stateRoot) || canonicalProfileDir;
+  const profileDir = profileDirForWorkspace(canonicalWorkspace, stateRoot);
   const statePath = path.join(profileDir, "state.json");
   ensureOwnerOnlyDir(profileDir);
   let state = {};
   if (existsSync(statePath)) {
     ownerOnlyFile(statePath);
     state = readJsonObjectOrBackup(statePath);
+    if (!state[CORRUPT_RECOVERY] && state.schemaVersion !== STATE_SCHEMA_VERSION) {
+      throw new Error("workspace state schema is obsolete; remove the state root and initialize the current version");
+    }
   }
-  state.schemaVersion = 5;
+  state.schemaVersion = STATE_SCHEMA_VERSION;
   state.workspace = {
     path: canonicalWorkspace,
     hash: path.basename(profileDir),
@@ -185,7 +174,6 @@ export function loadState(workspace, options = {}) {
   state.worker ||= {};
   state.policy ||= {};
   state.resources ||= {};
-  delete state.localApi;
   return state;
 }
 
@@ -450,7 +438,9 @@ function readJsonObjectOrBackup(filePath) {
     replaceFileSync(filePath, backupPath);
     ownerOnlyFile(backupPath);
     pruneBackups(filePath, 3);
-    return {};
+    const recovered = {};
+    Object.defineProperty(recovered, CORRUPT_RECOVERY, { value: true });
+    return recovered;
   }
 }
 
@@ -466,23 +456,10 @@ function ensureStateRoot(inputRoot) {
   const marker = path.join(root, STATE_MARKER);
   if (!existsSync(marker)) {
     const entries = readdirSync(root);
-    if (entries.length) {
-      if (!hasOnlyStateEntries(entries)) {
-        throw new Error(`state root must be a dedicated directory; unexpected entries found in ${root}`);
-      }
-      if (!isRecognizableLegacyStateRoot(root)) {
-        throw new Error(`state root is non-empty but does not contain recognizable Machine Bridge state: ${root}`);
-      }
-    }
-    try {
-      createExclusiveFileSync(marker, `${JSON.stringify({ app: appName, schema: 1 })}\n`, { mode: 0o600 });
-    } catch (error) {
-      if (error?.code !== "EEXIST") throw error;
-      assertValidStateMarker(marker, { migrateLegacy: true });
-    }
-  } else {
-    assertValidStateMarker(marker, { migrateLegacy: true });
+    if (entries.length) throw new Error(`state root must be empty before initializing the current schema: ${root}`);
+    createExclusiveFileSync(marker, `${JSON.stringify({ app: appName, schema: STATE_MARKER_SCHEMA })}\n`, { mode: 0o600 });
   }
+  assertValidStateMarker(marker);
   ensureOwnerOnlyDir(root);
   ownerOnlyFile(marker);
   cleanupStaleAtomicTemps(root);
@@ -512,21 +489,16 @@ function assertSafeStateRootForRemoval(root) {
     assertValidStateMarker(marker);
     return canonical;
   }
-  if (isRecognizableLegacyStateRoot(canonical)) return canonical;
   throw new Error(`refusing to remove unrecognized state root without ${STATE_MARKER}: ${canonical}`);
 }
 
-function assertValidStateMarker(marker, options = {}) {
+function assertValidStateMarker(marker) {
   const content = readBoundedUtf8(marker, MAX_MARKER_BYTES, "state marker");
-  try {
-    const value = JSON.parse(content);
-    if (value?.app === appName && value?.schema === 1) return;
-  } catch {}
-  if (content.trim() === `${appName} state root`) {
-    if (options.migrateLegacy) atomicWriteJson(marker, { app: appName, schema: 1 });
-    return;
+  let value;
+  try { value = JSON.parse(content); } catch { throw new Error(`invalid state root marker: ${marker}`); }
+  if (value?.app !== appName || value?.schema !== STATE_MARKER_SCHEMA) {
+    throw new Error("state root schema is obsolete; remove it and initialize the current version");
   }
-  throw new Error(`invalid state root marker: ${marker}`);
 }
 
 function hasOnlyStateEntries(entries) {
@@ -566,33 +538,6 @@ function stateRootMatchesRecordedWorkspace(root) {
   return false;
 }
 
-function isRecognizableLegacyStateRoot(root) {
-  const config = path.join(root, "config.json");
-  try {
-    if (existsSync(config)) {
-      const value = JSON.parse(readBoundedUtf8(config, MAX_STATE_JSON_BYTES, "config JSON"));
-      if (
-        value &&
-        typeof value.selectedWorkspace === "string" &&
-        typeof value.selectedWorkspaceHash === "string" &&
-        workspaceHash(value.selectedWorkspace) === value.selectedWorkspaceHash
-      ) return true;
-    }
-  } catch {}
-  const profiles = path.join(root, "profiles");
-  if (!existsSync(profiles)) return false;
-  try {
-    for (const entry of readdirSync(profiles, { withFileTypes: true })) {
-      if (!entry.isDirectory() || !/^[a-f0-9]{24}$/.test(entry.name)) continue;
-      const stateFile = path.join(profiles, entry.name, "state.json");
-      if (!existsSync(stateFile)) continue;
-      const value = JSON.parse(readBoundedUtf8(stateFile, MAX_STATE_JSON_BYTES, "state JSON"));
-      if (value?.workspace?.hash === entry.name && typeof value?.workspace?.path === "string") return true;
-    }
-  } catch {}
-  return false;
-}
-
 function atomicWriteJson(filePath, value) {
   const dir = path.dirname(filePath);
   ensureOwnerOnlyDir(dir);
@@ -636,7 +581,7 @@ function pruneBackups(filePath, keep) {
 
 export function ensureWorkerSecrets(state, options = {}) {
   state.worker ||= {};
-  if (!state.worker.oauthPassword || options.rotateSecrets) state.worker.oauthPassword = randomToken("mcp_password");
+  if (!state.worker.accountAdminSecret || options.rotateSecrets) state.worker.accountAdminSecret = randomToken("account_admin");
   if (!state.worker.daemonSecret || options.rotateSecrets) state.worker.daemonSecret = randomToken("daemon_secret");
   if (!state.worker.oauthTokenVersion || options.rotateSecrets) state.worker.oauthTokenVersion = randomToken("token_version");
   if (!state.worker.name || options.workerName) state.worker.name = options.workerName || defaultWorkerName(state.workspace.hash);
@@ -669,7 +614,7 @@ export function ownerOnlyFile(filePath) {
 
 export function redactState(state) {
   const clone = redactHomeInValue(JSON.parse(JSON.stringify(state)));
-  if (clone.worker?.oauthPassword) clone.worker.oauthPassword = "<redacted>";
+  if (clone.worker?.accountAdminSecret) clone.worker.accountAdminSecret = "<redacted>";
   if (clone.worker?.daemonSecret) clone.worker.daemonSecret = "<redacted>";
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
   if (clone.resources && typeof clone.resources === "object") {

package/src/local/tool-executor.mjs

@@ -5,6 +5,7 @@ export class ToolExecutor {
     this.handlers = options.handlers || {};
     this.policyGate = options.policyGate;
     this.callRegistry = options.callRegistry;
+    this.accountAccessGate = options.accountAccessGate;
     this.observability = options.observability;
     this.logger = options.logger || console;
     this.safeMessage = typeof options.safeMessage === "function" ? options.safeMessage : (error) => String(error?.message || error || "operation failed");
@@ -12,7 +13,7 @@ export class ToolExecutor {
     this.pipeline = composeMiddleware([
       lifecycleMiddleware(this.callRegistry),
       observabilityMiddleware(this.observability, this.logger, this.safeMessage, this.slowMs),
-      authorizeMiddleware(this.policyGate),
+      authorizeMiddleware(this.policyGate, this.accountAccessGate),
     ], invokeHandler(this.handlers));
   }
 
@@ -25,9 +26,14 @@ export function composeMiddleware(middleware, terminal) {
   return middleware.reduceRight((next, current) => (operation) => current(operation, next), terminal);
 }
 
-function authorizeMiddleware(policyGate) {
+function authorizeMiddleware(policyGate, accountAccessGate) {
   return async (operation, next) => {
     policyGate.assert(operation.tool);
+    if (operation.context.origin === "relay") {
+      const role = operation.request.authorization?.role;
+      if (!role) throw new Error("relay tool call is missing an account role");
+      accountAccessGate.assert(role, operation.tool);
+    }
     return next(operation);
   };
 }

package/src/shared/access-contract.json

@@ -0,0 +1,23 @@
+{
+  "revision": 1,
+  "defaultRole": "reviewer",
+  "ownerRole": "owner",
+  "roles": {
+    "reviewer": {
+      "profile": "review",
+      "description": "Read-only access to the selected workspace."
+    },
+    "editor": {
+      "profile": "edit",
+      "description": "Read and deterministic file mutation without process execution."
+    },
+    "operator": {
+      "profile": "agent",
+      "description": "Workspace-confined file mutation and direct process execution."
+    },
+    "owner": {
+      "profile": "full",
+      "description": "Complete bridge authority, including shell, browser, applications, unrestricted paths, and account administration."
+    }
+  }
+}

package/src/shared/policy-contract.json

@@ -1,7 +1,11 @@
 {
-  "revision": 4,
+  "revision": 5,
   "defaultProfile": "full",
-  "origins": ["default", "explicit", "custom", "migrated", "legacy-preserved"],
+  "origins": [
+    "default",
+    "explicit",
+    "custom"
+  ],
   "profiles": {
     "review": {
       "profile": "review",
@@ -38,14 +42,33 @@
   },
   "availability": {
     "always": {},
-    "write": { "allowWrite": true },
-    "direct-exec": { "execModes": ["direct", "shell"] },
-    "write+direct-exec": { "allowWrite": true, "execModes": ["direct", "shell"] },
-    "shell-exec": { "execModes": ["shell"] },
+    "write": {
+      "allowWrite": true
+    },
+    "direct-exec": {
+      "execModes": [
+        "direct",
+        "shell"
+      ]
+    },
+    "write+direct-exec": {
+      "allowWrite": true,
+      "execModes": [
+        "direct",
+        "shell"
+      ]
+    },
+    "shell-exec": {
+      "execModes": [
+        "shell"
+      ]
+    },
     "full": {
       "profile": "full",
       "allowWrite": true,
-      "execModes": ["shell"],
+      "execModes": [
+        "shell"
+      ],
       "unrestrictedPaths": true,
       "minimalEnv": false,
       "exposeAbsolutePaths": true

package/src/worker/access.ts

@@ -0,0 +1,46 @@
+import accessContract from "../shared/access-contract.json";
+import policyContract from "../shared/policy-contract.json";
+import toolCatalog from "../shared/tool-catalog.json";
+import { policyAllowsAvailability, type DaemonPolicy } from "./policy";
+
+export type AccountRole = keyof typeof accessContract.roles;
+
+const roles = accessContract.roles as Record<string, { profile: string }>;
+const profiles = policyContract.profiles as unknown as Record<string, DaemonPolicy>;
+const toolAvailability = new Map((toolCatalog as Array<{ name: string; availability: string }>).map((tool) => [tool.name, tool.availability]));
+
+export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
+export const ACCOUNT_ROLES = Object.freeze(Object.keys(roles));
+export const OWNER_ACCOUNT_ROLE = String(accessContract.ownerRole) as AccountRole;
+
+export function normalizeAccountRole(value: unknown): AccountRole | null {
+  const role = String(value ?? "").trim().toLowerCase();
+  return role in roles ? role as AccountRole : null;
+}
+
+export function accountRolePolicy(role: AccountRole): DaemonPolicy {
+  const profileName = roles[role]?.profile;
+  const profile = profiles[profileName];
+  if (!profile) throw new Error(`account role references an unknown policy profile: ${role}`);
+  return {
+    profile: String(profile.profile),
+    origin: "explicit",
+    revision: Number(policyContract.revision),
+    allowWrite: profile.allowWrite === true,
+    allowExec: String(profile.execMode) !== "off",
+    execMode: String(profile.execMode) as DaemonPolicy["execMode"],
+    unrestrictedPaths: profile.unrestrictedPaths === true,
+    minimalEnv: profile.minimalEnv !== false,
+    exposeAbsolutePaths: profile.exposeAbsolutePaths === true,
+  };
+}
+
+export function accountRoleAllowsTool(role: AccountRole, toolName: string): boolean {
+  if (toolName === "server_info") return true;
+  const availability = toolAvailability.get(toolName);
+  return Boolean(availability && policyAllowsAvailability(accountRolePolicy(role), availability));
+}
+
+export function accountRoleToolNames(role: AccountRole, daemonTools: Iterable<string>): Set<string> {
+  return new Set([...daemonTools].filter((name) => accountRoleAllowsTool(role, name)));
+}