machine-bridge-mcp 0.2.0 → 0.2.1

package/README.md

@@ -28,15 +28,18 @@ Source checkout:
 3. Generates a stable MCP connection password and daemon secret.
 4. Checks `wrangler whoami`; if needed, opens `wrangler login`.
 5. Deploys the hosted Worker relay with `wrangler deploy --secrets-file`.
-6. Installs login autostart for the local daemon.
-7. Starts the local daemon and prints:
+6. Installs login autostart for the local daemon and default local API provider.
+7. Starts the local daemon and local OpenAI-compatible API provider.
+8. Prints MCP connection details on first run, plus local API settings:
 
 ```text
 MCP Server URL: https://<worker>.<account>.workers.dev/mcp
 MCP connection password: mcp_password_...
+API Base URL: http://127.0.0.1:8765/v1
+API key: local_api_key_...
 ```
 
-Keep the foreground process running for the current session. The installed autostart entry keeps the daemon available after future logins.
+Keep the foreground process running for the current session. The installed autostart entry keeps the daemon and local API available after future logins.
 
 The command is safe to run repeatedly:
 
@@ -44,22 +47,30 @@ The command is safe to run repeatedly:
 npm install -g machine-bridge-mcp@latest && machine-mcp
 ```
 
-On repeat runs, the CLI reuses existing state and secrets unless you request rotation, skips Worker redeploys when the deployed Worker is healthy and unchanged, refreshes the autostart entry, stops any currently loaded autostart daemon before starting the foreground daemon, and refuses to start a second daemon for the same workspace if another foreground instance is already running.
+On repeat runs, the CLI reuses existing state and secrets unless you request rotation, skips Worker redeploys when the deployed Worker is healthy and Worker source/config/secrets are unchanged, refreshes the autostart entry, stops any currently loaded autostart daemon before starting the foreground daemon, and refuses to start a second daemon for the same workspace if another foreground instance is already running. Local-only package, CLI, logging, and API-provider changes do not by themselves force a Worker redeploy.
+
+MCP connection details are printed on first run, after secret rotation, when the MCP URL changes, or when you explicitly pass `--print-mcp-credentials`. Routine runs print that MCP details are unchanged.
 
 ## Local OpenAI-compatible API provider
 
-`machine-bridge-mcp` can also expose a local OpenAI-compatible API provider for desktop AI clients such as Cherry Studio, Chatbox, Continue, or other apps that accept an OpenAI-style base URL and API key.
+`machine-bridge-mcp` exposes a local OpenAI-compatible API provider by default for desktop AI clients such as Cherry Studio, Chatbox, Continue, or other apps that accept an OpenAI-style base URL and API key. No extra command is needed; the recommended `machine-mcp` command starts both the Remote MCP daemon and the local API provider.
+
+Start the normal daemon and API provider:
+
+```zsh
+machine-mcp
+```
 
-Start only the local API service:
+Start only the local API service, without the Remote MCP daemon:
 
 ```zsh
 machine-mcp api
 ```
 
-Or run it together with the Remote MCP daemon:
+Disable the default local API provider for a daemon run:
 
 ```zsh
-machine-mcp start --api
+machine-mcp --no-api
 ```
 
 The CLI prints client settings like:
@@ -79,8 +90,8 @@ Use these values in the local AI client:
 If port `8765` conflicts with another local app, choose a different port explicitly:
 
 ```zsh
+machine-mcp --api-port 8766
 machine-mcp api --api-port 8766
-machine-mcp start --api --api-port 8766
 ```
 
 `--port` is also accepted on the `api` command:
@@ -89,7 +100,7 @@ machine-mcp start --api --api-port 8766
 machine-mcp api --port 8766
 ```
 
-By default, the local API binds to `127.0.0.1` and does not start unless you run `machine-mcp api` or pass `--api`. It stores a per-workspace local API key in the same owner-only state profile used by the MCP credentials. Rotate it with:
+By default, the local API binds to `127.0.0.1`, starts with `machine-mcp`, and stores a per-workspace local API key in the same owner-only state profile used by the MCP credentials. Explicit `--api-host`, `--api-port`, `--api-model`, and `--api-upstream-url` values are persisted for the workspace so autostart uses the same non-secret API settings; upstream API keys are not written to state. Rotate the local API key with:
 
 ```zsh
 machine-mcp api --rotate-api-key
@@ -237,7 +248,7 @@ Default state roots:
 - Linux with `XDG_STATE_HOME`: `$XDG_STATE_HOME/machine-bridge-mcp`
 - Windows: `%APPDATA%\machine-bridge-mcp`
 
-State contains the MCP password, daemon secret, and local API key when the API provider has been started. Status/doctor output redacts secrets. The normal foreground `start` command prints the MCP password because users need to paste it into their MCP client; `api` prints the local API key for the same reason. Use `--no-print-credentials` to redact console credentials. State files, temporary Worker secret files, lock files, and log directories are created under the user state root with owner-only permissions where the platform supports POSIX modes.
+State contains the MCP password, daemon secret, and local API key. Status/doctor output redacts secrets. The normal foreground `start` command prints the MCP password only when a ChatGPT app is likely to need reconnection: first run, secret rotation, MCP URL changes, or `--print-mcp-credentials`. The local API base URL and API key print on normal foreground starts because desktop AI clients need them. Use `--no-print-credentials` to redact console credentials. State files, temporary Worker secret files, lock files, and log directories are created under the user state root with owner-only permissions where the platform supports POSIX modes.
 
 The Worker rejects browser requests with an `Origin` header unless the origin is the Worker itself or a loopback HTTP origin. To allow additional browser-based MCP clients, set `MBM_ALLOWED_ORIGINS` to a comma-separated list of exact origins in `wrangler.jsonc` or Cloudflare Worker settings.
 
@@ -255,7 +266,7 @@ flowchart LR
   W --> DO["Durable Object broker"]
   D["Local daemon"] -- "outbound WebSocket" --> W
   D --> M["Local filesystem and shell"]
-  API["Optional local /v1 API"] -- "OpenAI-compatible HTTP" --> U["Configured upstream provider"]
+  API["Default local /v1 API"] -- "OpenAI-compatible HTTP" --> U["Configured upstream provider"]
   CLI["machine-mcp CLI"] --> API
   CLI["machine-mcp CLI"] --> W
   CLI --> D
@@ -269,8 +280,8 @@ Why this architecture:
 - The public MCP URL is stable after deployment.
 - The Worker stores OAuth client/code/token metadata and relays tool calls.
 - The local daemon is the only process touching files or executing commands.
-- The optional local `/v1` API binds to loopback by default and starts only when requested.
-- Autostart keeps the daemon alive across logins without requiring MCP clients to change URLs.
+- The local `/v1` API binds to loopback by default, starts automatically with the daemon, and can be disabled with `--no-api`.
+- Autostart keeps the daemon and local API alive across logins without requiring MCP clients to change URLs.
 
 ## Development
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "One-command hosted Remote MCP bridge to a local machine daemon.",
   "type": "module",
   "license": "MIT",

package/src/local/api-server.mjs

@@ -1,5 +1,5 @@
 import http from "node:http";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createLogger } from "./log.mjs";
@@ -53,7 +53,7 @@ export function normalizeBaseUrl(value, fallback = DEFAULT_UPSTREAM_URL) {
   try {
     parsed = new URL(raw);
   } catch {
-    throw new Error(`Invalid upstream API URL: ${raw}`);
+    throw new Error("Invalid upstream API URL.");
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid upstream API URL protocol: ${parsed.protocol}`);
   if (parsed.username || parsed.password) throw new Error("Upstream API URL must not contain credentials; pass keys with --api-upstream-key or environment variables.");
@@ -121,7 +121,7 @@ async function handleRequest(req, res, context) {
 
   try {
     if (req.method === "OPTIONS") return sendEmpty(res, 204);
-    if (req.method === "GET" && url.pathname === "/health") return sendJson(res, 200, { ok: true, service: "machine-bridge-mcp-local-api" });
+    if (req.method === "GET" && url.pathname === "/health") return sendJson(res, 200, { ok: true, service: "machine-bridge-mcp-local-api", api_key_sha256: sha256String(context.apiKey) });
 
     if (!isAuthorized(req, context.apiKey)) return sendOpenAiError(res, 401, "invalid_api_key", "Missing or invalid local API key.");
 
@@ -203,6 +203,10 @@ function readBody(req, maxBytes) {
   });
 }
 
+function sha256String(value) {
+  return createHash("sha256").update(String(value)).digest("hex");
+}
+
 function isAuthorized(req, expectedKey) {
   const auth = String(req.headers.authorization || "");
   if (auth.startsWith("Bearer ") && auth.slice(7) === expectedKey) return true;
@@ -247,10 +251,10 @@ function setCorsHeaders(res) {
 
 function withPortHint(error, port) {
   if (error?.code === "EADDRINUSE") {
-    error.message = `Local API port ${port} is already in use. Re-run with \`machine-mcp api --api-port <free_port>\` or \`machine-mcp start --api --api-port <free_port>\`.`;
+    error.message = `Local API port ${port} is already in use. Re-run with \`machine-mcp --api-port <free_port>\` or \`machine-mcp api --api-port <free_port>\`.`;
   }
   if (error?.code === "EACCES") {
-    error.message = `Local API port ${port} is not permitted. Re-run with \`machine-mcp api --api-port <free_port>\`.`;
+    error.message = `Local API port ${port} is not permitted. Re-run with \`machine-mcp --api-port <free_port>\` or \`machine-mcp api --api-port <free_port>\`.`;
   }
   return error;
 }

package/src/local/cli.mjs

@@ -159,16 +159,21 @@ async function confirm(prompt, assumeYes = false) {
 
 async function startCommand(args) {
   assertNodeVersion();
-  const logger = createLogger({ quiet: Boolean(args.quiet), verbose: Boolean(args.verbose), component: "cli" });
+  const logger = createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "cli" });
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: true, save: true, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
+  const previousMcpServerUrl = state.worker?.mcpServerUrl || "";
+  const firstMcpConnection = !previousMcpServerUrl || !state.worker?.oauthPassword;
+  const apiEnabled = args.noApi ? false : true;
+
   ensureWorkerSecrets(state, { rotateSecrets: Boolean(args.rotateSecrets), workerName: args.workerName && String(args.workerName) });
-  if (args.api) ensureLocalApiKey(state, { apiKey: valueFromArgsEnv(args.apiKey, "MBM_API_KEY"), rotateApiKey: Boolean(args.rotateApiKey) });
+  if (apiEnabled) configureLocalApiState(state, args);
   state.policy = {
     allowWrite: args.noWrite ? false : true,
     allowExec: args.noExec ? false : true,
     unrestrictedPaths: true,
     minimalEnv: args.fullEnv ? false : true,
+    apiEnabled,
     updatedAt: new Date().toISOString(),
   };
   saveState(state);
@@ -176,6 +181,9 @@ async function startCommand(args) {
   if (!args.daemonOnly) await ensureWorker(state, args);
   else if (!state.worker.url) throw new Error("--daemon-only requires an existing worker URL in state; run start once without --daemon-only");
 
+  const mcpConnectionChanged = previousMcpServerUrl && previousMcpServerUrl !== state.worker.mcpServerUrl;
+  const shouldPrintMcpCredentials = Boolean(args.json || args.printMcpCredentials || args.printCredentials || firstMcpConnection || args.rotateSecrets || mcpConnectionChanged);
+
   if (!args.daemonOnly && !args.noAutostart) {
     await installAutostartBestEffort({ workspace, stateRoot: state.paths.stateRoot, entryScript: process.argv[1], policy: state.policy });
   }
@@ -183,38 +191,55 @@ async function startCommand(args) {
   if (!args.daemonOnly) await stopAutostartBestEffort(Boolean(args.quiet));
 
   const lock = acquireDaemonLock(state);
+  let daemon = null;
   let apiServer = null;
   if (!lock.acquired) {
     if (!args.quiet) {
       const pid = lock.owner?.pid ? `pid ${lock.owner.pid}` : "unknown pid";
       logger.warn(`local daemon already running for this workspace (${pid}); not starting a duplicate`);
-      printConnection(state, { json: Boolean(args.json), noPrintCredentials: Boolean(args.noPrintCredentials) });
+      if (!args.json) printMcpConnection(state, {
+        noPrintCredentials: Boolean(args.noPrintCredentials),
+        includeCredentials: shouldPrintMcpCredentials,
+        quiet: Boolean(args.quiet),
+      });
+    }
+    if (!apiEnabled) {
+      if (args.json) printStartJson(state, null, { noPrintCredentials: Boolean(args.noPrintCredentials) });
+      return;
     }
-    if (!args.api) return;
-    apiServer = await startConfiguredApiServer(state, args);
-    printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials) });
-    keepProcessAlive({ apiServer, logger });
+    apiServer = await startOptionalApiServer(state, args, logger);
+    if (args.json) printStartJson(state, apiServer, { noPrintCredentials: Boolean(args.noPrintCredentials) });
+    else if (apiServer) printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials), quiet: Boolean(args.quiet) });
+    if (apiServer && !apiServer.alreadyRunning) keepProcessAlive({ apiServer, logger });
     return;
   }
 
   try {
-    const daemon = new LocalDaemon({
+    daemon = new LocalDaemon({
       workerUrl: state.worker.url,
       secret: state.worker.daemonSecret,
       workspace,
       policy: state.policy,
-      logger: createLogger({ quiet: Boolean(args.quiet), verbose: Boolean(args.verbose), component: "daemon" }),
+      logger: createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "daemon" }),
     });
 
     const waitForConnect = daemon.start();
-    await waitForConnectWithNotice(waitForConnect, 20_000);
-    if (args.api) apiServer = await startConfiguredApiServer(state, args);
-    printConnection(state, { json: Boolean(args.json), noPrintCredentials: Boolean(args.noPrintCredentials) });
-    if (apiServer) printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials) });
-    keepProcessAlive({ daemon, lock, apiServer, logger });
+    await waitForConnectWithNotice(waitForConnect, 20_000, Boolean(args.quiet || args.json));
+    if (apiEnabled) apiServer = await startOptionalApiServer(state, args, logger);
+    if (args.json) printStartJson(state, apiServer, { noPrintCredentials: Boolean(args.noPrintCredentials) });
+    else {
+      printMcpConnection(state, {
+        noPrintCredentials: Boolean(args.noPrintCredentials),
+        includeCredentials: shouldPrintMcpCredentials,
+        quiet: Boolean(args.quiet),
+      });
+      if (apiServer) printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials), quiet: Boolean(args.quiet) });
+    }
+    keepProcessAlive({ daemon, lock, apiServer: apiServer?.alreadyRunning ? null : apiServer, logger });
   } catch (error) {
+    try { daemon?.stop?.(); } catch {}
     lock.release();
-    if (apiServer) await apiServer.close().catch(() => {});
+    if (apiServer && !apiServer.alreadyRunning) await apiServer.close().catch(() => {});
     throw error;
   }
 }
@@ -223,33 +248,97 @@ async function apiCommand(args) {
   assertNodeVersion();
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: true, save: true, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
-  ensureLocalApiKey(state, { apiKey: valueFromArgsEnv(args.apiKey, "MBM_API_KEY"), rotateApiKey: Boolean(args.rotateApiKey) });
+  configureLocalApiState(state, args);
   saveState(state);
-  const logger = createLogger({ quiet: Boolean(args.quiet), verbose: Boolean(args.verbose), component: "api" });
+  const logger = createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "api" });
   const apiServer = await startConfiguredApiServer(state, args, logger);
-  printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials) });
+  if (args.json) printApiJson(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials) });
+  else printApiConnection(apiServer, state, { noPrintCredentials: Boolean(args.noPrintCredentials), quiet: Boolean(args.quiet) });
   keepProcessAlive({ apiServer, logger });
 }
 
-async function startConfiguredApiServer(state, args, logger = createLogger({ quiet: Boolean(args.quiet), verbose: Boolean(args.verbose), component: "api" })) {
+async function startConfiguredApiServer(state, args, logger = createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "api" })) {
   const apiOptions = apiOptionsFromArgs(state, args);
   return startLocalApiServer({ ...apiOptions, logger });
 }
 
+async function startOptionalApiServer(state, args, parentLogger) {
+  const logger = createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "api" });
+  const apiOptions = apiOptionsFromArgs(state, args);
+  try {
+    return await startLocalApiServer({ ...apiOptions, logger });
+  } catch (error) {
+    if (error?.code === "EADDRINUSE") {
+      const baseUrl = apiBaseUrl(apiOptions.host, apiOptions.port);
+      const health = await probeLocalApiHealth(baseUrl, state.localApi?.apiKey);
+      if (health.ok) {
+        logger.success("local OpenAI-compatible API already running", { baseUrl });
+        return { ...health, baseUrl, host: apiOptions.host, port: Number(apiOptions.port), alreadyRunning: true, close() { return Promise.resolve(); } };
+      }
+      parentLogger.warn(error.message);
+      return null;
+    }
+    parentLogger.warn(`Local API provider skipped: ${error.message}`);
+    return null;
+  }
+}
+
+function apiBaseUrl(host, port) {
+  const textHost = String(host || DEFAULT_API_HOST);
+  const urlHost = textHost.includes(":") && !textHost.startsWith("[") ? `[${textHost}]` : textHost;
+  return `http://${urlHost}:${port || DEFAULT_API_PORT}/v1`;
+}
+
+async function probeLocalApiHealth(baseUrl, expectedApiKey = "") {
+  try {
+    const healthUrl = `${String(baseUrl).replace(/\/v1$/, "")}/health`;
+    const response = await fetch(healthUrl, { signal: AbortSignal.timeout(750) });
+    if (!response.ok) return { ok: false };
+    const body = await response.json().catch(() => null);
+    if (body?.service !== "machine-bridge-mcp-local-api") return { ok: false };
+    if (body.api_key_sha256 && expectedApiKey && body.api_key_sha256 !== sha256String(expectedApiKey)) return { ok: false, reason: "api_key_mismatch" };
+    return { ok: true };
+  } catch {
+    return { ok: false };
+  }
+}
+
 function apiOptionsFromArgs(state, args = {}) {
   const upstreamKey = valueFromArgsEnv(args.apiUpstreamKey, "MBM_API_UPSTREAM_KEY", "OPENAI_API_KEY");
-  const explicitPort = args.apiPort !== undefined && args.apiPort !== true ? args.apiPort : (args.port !== undefined && args.port !== true ? args.port : undefined);
+  const explicitPort = explicitArg(args.apiPort) ?? explicitArg(args.port);
   const envPort = valueFromArgsEnv(undefined, "MBM_API_PORT", "PORT");
   return {
-    host: valueFromArgsEnv(args.apiHost, "MBM_API_HOST") || DEFAULT_API_HOST,
-    port: explicitPort ?? envPort ?? DEFAULT_API_PORT,
+    host: valueFromArgsEnv(args.apiHost, "MBM_API_HOST") || state.localApi?.host || DEFAULT_API_HOST,
+    port: explicitPort ?? envPort ?? state.localApi?.port ?? DEFAULT_API_PORT,
     apiKey: valueFromArgsEnv(args.apiKey, "MBM_API_KEY") || state.localApi?.apiKey || ensureLocalApiKey(state, { rotateApiKey: Boolean(args.rotateApiKey) }),
-    upstreamUrl: valueFromArgsEnv(args.apiUpstreamUrl, "MBM_API_UPSTREAM_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE") || DEFAULT_UPSTREAM_URL,
+    upstreamUrl: valueFromArgsEnv(args.apiUpstreamUrl, "MBM_API_UPSTREAM_URL", "OPENAI_BASE_URL", "OPENAI_API_BASE") || state.localApi?.upstreamUrl || DEFAULT_UPSTREAM_URL,
     upstreamKey: upstreamKey || "",
-    model: valueFromArgsEnv(args.apiModel, "MBM_API_MODEL", "OPENAI_MODEL") || DEFAULT_API_MODEL,
+    model: valueFromArgsEnv(args.apiModel, "MBM_API_MODEL", "OPENAI_MODEL") || state.localApi?.model || DEFAULT_API_MODEL,
   };
 }
 
+function configureLocalApiState(state, args = {}) {
+  state.localApi ||= {};
+  ensureLocalApiKey(state, { apiKey: valueFromArgsEnv(args.apiKey, "MBM_API_KEY"), rotateApiKey: Boolean(args.rotateApiKey) });
+  const port = explicitArg(args.apiPort) ?? explicitArg(args.port);
+  if (port !== undefined && String(port) !== "0") state.localApi.port = String(port);
+  const host = explicitArg(args.apiHost);
+  if (host !== undefined) state.localApi.host = String(host);
+  const upstreamUrl = explicitArg(args.apiUpstreamUrl);
+  if (upstreamUrl !== undefined) state.localApi.upstreamUrl = String(upstreamUrl);
+  const model = explicitArg(args.apiModel);
+  if (model !== undefined) state.localApi.model = String(model);
+  state.localApi.updatedAt = new Date().toISOString();
+}
+
+function explicitArg(value) {
+  return value !== undefined && value !== null && value !== true ? String(value) : undefined;
+}
+
+function sha256String(value) {
+  return createHash("sha256").update(String(value)).digest("hex");
+}
+
 function valueFromArgsEnv(argValue, ...envNames) {
   if (argValue !== undefined && argValue !== null && argValue !== true) return String(argValue);
   for (const name of envNames) {
@@ -259,7 +348,7 @@ function valueFromArgsEnv(argValue, ...envNames) {
 }
 
 async function ensureWorker(state, args) {
-  const logger = createLogger({ quiet: Boolean(args.quiet), verbose: Boolean(args.verbose), component: "worker" });
+  const logger = createLogger({ quiet: Boolean(args.quiet || args.json), verbose: Boolean(args.verbose), component: "worker" });
   const desiredHash = workerDeployHash(state);
   const complete = state.worker.url && state.worker.mcpServerUrl && state.worker.oauthPassword && state.worker.daemonSecret && state.worker.oauthTokenVersion && state.worker.name;
   if (!args.forceWorker && !args.rotateSecrets && complete && state.worker.deployHash === desiredHash) {
@@ -339,14 +428,22 @@ function workerDeployHash(state) {
   hash.update(String(state.worker.oauthTokenVersion || ""));
   for (const file of workerDeployHashFiles()) {
     hash.update(path.relative(packageRoot, file));
-    hash.update(readFileSync(file));
+    hash.update(workerHashContent(file));
   }
   return hash.digest("hex");
 }
 
+function workerHashContent(file) {
+  const content = readFileSync(file, "utf8");
+  if (path.relative(packageRoot, file).replaceAll("\\", "/") === "src/worker/index.ts") {
+    return content.replace(/const SERVER_VERSION = "[^"]+";/, 'const SERVER_VERSION = "<ignored-for-deploy-hash>";');
+  }
+  return content;
+}
+
 function workerDeployHashFiles() {
   const files = [];
-  for (const item of ["src/worker", "wrangler.jsonc", "tsconfig.json", "package.json", "package-lock.json"]) {
+  for (const item of ["src/worker", "wrangler.jsonc", "tsconfig.json"]) {
     collectHashFiles(resolve(packageRoot, item), files);
   }
   return files.sort();
@@ -396,18 +493,53 @@ function extractWorkerUrl(text = "") {
   return anyHttps.find(match => /workers\.dev|\/healthz|\/mcp/.test(match[0]))?.[0]?.replace(/[),.]+$/, "") || "";
 }
 
-async function waitForConnectWithNotice(promise, timeoutMs) {
+async function waitForConnectWithNotice(promise, timeoutMs, quiet = false) {
   let timeout;
   const timed = new Promise(resolvePromise => {
     timeout = setTimeout(() => resolvePromise("timeout"), timeoutMs);
   });
   const result = await Promise.race([promise.then(() => "connected"), timed]);
   clearTimeout(timeout);
-  if (result === "timeout") createLogger({ component: "daemon" }).warn("Still connecting; credentials are printed now and the process will keep retrying");
+  if (result === "timeout") createLogger({ component: "daemon", quiet }).warn("Still connecting; the process will keep retrying");
+}
+
+
+function printStartJson(state, apiServer, { noPrintCredentials = false } = {}) {
+  const mcpPassword = noPrintCredentials ? previewSecret(state.worker.oauthPassword) : state.worker.oauthPassword;
+  const apiKey = state.localApi?.apiKey ? (noPrintCredentials ? previewSecret(state.localApi.apiKey) : state.localApi.apiKey) : null;
+  createLogger({ component: "ready" }).json({
+    mcp: {
+      server_url: state.worker.mcpServerUrl,
+      connection_password: mcpPassword,
+      worker_url: state.worker.url,
+      worker_name: state.worker.name,
+    },
+    local_api: apiServer ? {
+      base_url: apiServer.baseUrl,
+      api_key: apiKey,
+      already_running: Boolean(apiServer.alreadyRunning),
+      client_type: "OpenAI-compatible",
+    } : null,
+    workspace: state.workspace.path,
+    state_path: state.paths.statePath,
+    policy: state.policy,
+  });
+}
+
+function printApiJson(apiServer, state, { noPrintCredentials = false } = {}) {
+  createLogger({ component: "ready" }).json({
+    local_api: {
+      base_url: apiServer.baseUrl,
+      api_key: noPrintCredentials ? previewSecret(state.localApi.apiKey) : state.localApi.apiKey,
+      client_type: "OpenAI-compatible",
+    },
+    workspace: state.workspace.path,
+    state_path: state.paths.statePath,
+  });
 }
 
-function printConnection(state, { json = false, noPrintCredentials = false } = {}) {
-  const logger = createLogger({ component: "ready" });
+function printMcpConnection(state, { json = false, noPrintCredentials = false, includeCredentials = false, quiet = false } = {}) {
+  const logger = createLogger({ component: "ready", quiet });
   const payload = {
     mcp_server_url: state.worker.mcpServerUrl,
     mcp_connection_password: state.worker.oauthPassword,
@@ -422,17 +554,22 @@ function printConnection(state, { json = false, noPrintCredentials = false } = {
     logger.json(safePayload);
     return;
   }
-  logger.success("Remote MCP bridge is ready; keep this process running");
-  logger.plain(`  MCP Server URL: ${payload.mcp_server_url}`);
-  if (!noPrintCredentials) logger.plain(`  MCP connection password: ${payload.mcp_connection_password}`);
-  else logger.plain(`  MCP connection password: ${previewSecret(payload.mcp_connection_password)} (redacted)`);
+  if (includeCredentials) {
+    logger.success("Remote MCP bridge is ready; save these connection details if your ChatGPT app needs to reconnect");
+    logger.plain(`  MCP Server URL: ${payload.mcp_server_url}`);
+    if (!noPrintCredentials) logger.plain(`  MCP connection password: ${payload.mcp_connection_password}`);
+    else logger.plain(`  MCP connection password: ${previewSecret(payload.mcp_connection_password)} (redacted)`);
+  } else {
+    logger.success("Remote MCP bridge is ready; MCP connection details unchanged");
+    logger.plain("  Use --print-mcp-credentials only when a ChatGPT app needs to reconnect.");
+  }
   logger.plain(`  Workspace cwd: ${payload.workspace}`);
-  logger.plain(`  Policy: write=${payload.policy.allowWrite ? "on" : "off"}, exec=${payload.policy.allowExec ? "on" : "off"}, unrestricted_paths=${payload.policy.unrestrictedPaths ? "on" : "off"}`);
+  logger.plain(`  Policy: write=${payload.policy.allowWrite ? "on" : "off"}, exec=${payload.policy.allowExec ? "on" : "off"}, local_api=${payload.policy.apiEnabled === false ? "off" : "on"}, unrestricted_paths=${payload.policy.unrestrictedPaths ? "on" : "off"}`);
   logger.plain(`  State: ${payload.state_path}`);
 }
 
-function printApiConnection(apiServer, state, { noPrintCredentials = false } = {}) {
-  const logger = createLogger({ component: "ready" });
+function printApiConnection(apiServer, state, { noPrintCredentials = false, quiet = false } = {}) {
+  const logger = createLogger({ component: "ready", quiet });
   logger.success("Local model API provider is ready");
   logger.plain(`  API Base URL: ${apiServer.baseUrl}`);
   logger.plain(`  API key: ${noPrintCredentials ? `${redactSecret(state.localApi.apiKey)} (redacted)` : state.localApi.apiKey}`);
@@ -640,7 +777,7 @@ Usage:
   .\\mbm.cmd                                      # from source checkout on Windows cmd
 
 Commands:
-  start             Deploy/update Worker, install autostart, start local daemon
+  start             Deploy/update Worker, install autostart, start daemon and local API
   api               Start local OpenAI-compatible API provider only
   workspace show    Show remembered workspace
   workspace set     Re-select workspace; prompts with current/default path
@@ -661,13 +798,15 @@ Start options:
   --rotate-secrets      Rotate secrets before deploying
   --daemon-only         Skip deploy and only connect daemon from existing state
   --no-autostart        Do not install login autostart during start
-  --no-print-credentials Redact the MCP password in console output
+  --no-print-credentials Redact credentials in console output
+  --print-mcp-credentials Print MCP URL/password again for reconnecting ChatGPT apps
   --no-write            Disable write_file (default: write enabled)
   --no-exec             Disable exec_command (default: exec enabled)
   --full-env            Pass full parent environment to exec_command (default: minimal env)
   --state-dir DIR       Override state root
-  --json                Print connection details as JSON
-  --api                 Also start local OpenAI-compatible API provider
+  --json                Print MCP and local API connection details as JSON
+  --no-api              Do not start the local OpenAI-compatible API provider
+  --api                 Deprecated no-op; local API starts by default
   --api-port PORT       Local API port (default: 8765)
   --port PORT           Alias for --api-port on the api command
   --api-host HOST       Local API host (default: 127.0.0.1)
@@ -687,9 +826,10 @@ function apiUsage() {
   console.log(`machine-bridge-mcp local API provider
 
 Usage:
-  machine-mcp api
+  machine-mcp
+  machine-mcp --api-port 8766
+  machine-mcp api                    # API provider only
   machine-mcp api --api-port 8766
-  machine-mcp start --api --api-port 8766
 
 Client settings:
   API Base URL: http://127.0.0.1:<port>/v1
@@ -707,6 +847,7 @@ Options:
   --api-upstream-key KEY  Upstream provider key; env OPENAI_API_KEY also works
   --api-model MODEL       Model id advertised by /v1/models
   --no-print-credentials  Redact the local API key in console output
+  --no-api                Only valid for start; disables the default local API provider
   --state-dir DIR         Override state root
 
 Environment:

package/src/local/self-test.mjs

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -74,6 +75,9 @@ async function apiSelfTest() {
   try {
     const health = await fetch(`${base}/health`);
     if (health.status !== 200) throw new Error(`health returned ${health.status}`);
+    const healthPayload = await health.json();
+    const expectedHash = createHash("sha256").update("local-test-key").digest("hex");
+    if (healthPayload.api_key_sha256 !== expectedHash) throw new Error("health did not expose expected API key hash");
     const unauth = await fetch(`${base}/v1/models`);
     if (unauth.status !== 401) throw new Error(`unauthorized models returned ${unauth.status}`);
     const models = await fetch(`${base}/v1/models`, { headers: { authorization: "Bearer local-test-key" } });

package/src/local/service.mjs

@@ -54,6 +54,7 @@ function serviceSpec({ workspace, stateRoot, entryScript, policy = {} }) {
       allowWrite: policy.allowWrite !== false,
       allowExec: policy.allowExec !== false,
       minimalEnv: policy.minimalEnv !== false,
+      apiEnabled: policy.apiEnabled !== false,
     },
   };
 }
@@ -71,6 +72,7 @@ function daemonArgs(spec) {
   if (spec.policy.allowWrite === false) args.push("--no-write");
   if (spec.policy.allowExec === false) args.push("--no-exec");
   if (spec.policy.minimalEnv === false) args.push("--full-env");
+  if (spec.policy.apiEnabled === false) args.push("--no-api");
   return args;
 }
 

package/src/worker/index.ts

@@ -1,7 +1,7 @@
 import { DurableObject } from "cloudflare:workers";
 
 const SERVER_NAME = "machine-bridge-mcp";
-const SERVER_VERSION = "0.2.0";
+const SERVER_VERSION = "0.2.1";
 const MCP_PROTOCOL_VERSION = "2025-06-18";
 const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 32 * 1024 * 1024;