machine-bridge-mcp 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.4.2 - 2026-07-10
+
+### Fixed
+
+- Canonicalize the configured workspace and requested targets through the same asynchronous `realpath` path on Windows, while retaining a native synchronous initial value. This prevents Windows short-path/long-path aliases for the same temporary directory from being misclassified as a workspace escape.
+- Keep workspace confinement unchanged: only the representation comparison changed, and targets outside the canonical workspace remain rejected in restricted profiles.
+
+### Verification
+
+- Preserve the existing cross-platform path-boundary regression, which exposed the issue on the Windows GitHub Actions runner while Linux and macOS passed.
+- Make the minimal-environment shell regression use a cross-platform Node command instead of POSIX parameter-expansion syntax under PowerShell.
+- Convert test entry-point file URLs with `fileURLToPath()` so Windows does not interpret `/D:/...` URL paths as `C:\D:\...` filesystem paths.
+- Launch Wrangler's JavaScript entry point through the active Node executable in integration tests instead of directly spawning the Windows `.cmd` shim.
+
+## 0.4.1 - 2026-07-10
+
+### Changed
+
+- Make `full` the default policy for newly selected workspaces and generated client configurations, prioritizing immediate usability. The default now enables all tools, unrestricted direct filesystem paths, absolute path output, shell execution, process sessions, and the complete parent environment; existing saved workspace policies remain unchanged.
+- Reframe stdio as an optional local transport rather than a model provider or a replacement for native Claude, Cursor, Codex, or ChatGPT Desktop tooling. Expand client documentation to distinguish the MCP host/model from the Machine Bridge tool server and explain when stdio is redundant or useful.
+- Activate cross-platform GitHub Actions checks on Linux, macOS, and Windows, update official actions to the current major releases, disable checkout credential persistence, and retain production dependency/package auditing.
+
+### Tests and documentation
+
+- Add regression coverage for the maximum-permission default and for `client-config` emitting `full` when no profile is supplied.
+- Update architecture, operations, security, and client guidance for profile-dependent path display, filesystem scope, and environment inheritance.
+
 ## 0.4.0 - 2026-07-10
 
 ### Architecture and compatibility

package/README.md

@@ -23,27 +23,25 @@ Local clients such as Claude Desktop, Cursor, and Codex CLI
 
 The remote Worker authenticates and relays calls. It cannot directly read local files or start local processes. File, Git, image, patch, and process operations execute in the local runtime.
 
-## Security posture first
+## Default behavior and policy profiles
 
-A new workspace starts with the `review` profile:
+A newly selected workspace starts with the maximum-permission `full` profile for low-friction operation:
 
-- read-only filesystem and Git tools;
-- no file mutation;
-- no process execution;
-- workspace-confined filesystem access;
-- relative paths in tool results;
-- no parent shell environment inherited by commands.
+- all read, write, edit, patch, image, Git, direct-process, process-session, and shell tools are available;
+- direct filesystem tools may use paths outside the selected workspace;
+- tool results may return absolute paths;
+- child processes inherit the complete parent environment.
 
-Existing pre-0.4 workspace profiles keep their saved permissions during upgrade. Select a profile explicitly to change them.
+Existing workspace state keeps its saved policy during upgrade. Use `--profile full` to explicitly move an older workspace to the new maximum-permission behavior.
 
-| Profile | File edits | Direct argv processes | Shell commands | Intended use |
-|---|---:|---:|---:|---|
-| `review` | No | No | No | Inspection and review |
-| `edit` | Yes | No | No | Controlled file changes |
-| `agent` | Yes | Yes | No | Coding agents and test commands |
-| `full` | Yes | Yes | Yes | Deliberate full local automation |
+| Profile | File edits | Direct argv processes | Shell commands | Filesystem scope | Process environment |
+|---|---:|---:|---:|---|---|
+| `full` | Yes | Yes | Yes | Unrestricted | Full parent environment |
+| `agent` | Yes | Yes | No | Selected workspace | Isolated environment |
+| `edit` | Yes | No | No | Selected workspace | Isolated environment |
+| `review` | No | No | No | Selected workspace | Isolated environment |
 
-`run_process` and process sessions avoid command-shell parsing, but they are **not an operating-system sandbox**. An allowed executable can still access anything available to the local user. `exec_command` is more exposed because it additionally permits shell syntax and expansion. Use a container, VM, or dedicated low-privilege OS account for hostile repositories or untrusted instructions.
+This default prioritizes usability, not least privilege. `run_process` and process sessions avoid command-shell parsing, but they are **not an operating-system sandbox**. `exec_command` additionally permits shell syntax and expansion. Use `--profile review`, `edit`, or `agent`, or use a container, VM, or dedicated low-privilege OS account when the client, repository, or instructions are not fully trusted.
 
 ## Install
 
@@ -66,7 +64,7 @@ npm install
 Start the bridge from the project directory or select a workspace explicitly:
 
 ```sh
-machine-mcp --workspace /path/to/project --profile review
+machine-mcp --workspace /path/to/project
 ```
 
 On first remote start, the CLI:
@@ -88,30 +86,32 @@ MCP connection password: mcp_password_...
 
 The remote authorization flow uses an authorization code, PKCE S256, exact redirect/resource binding, expiring access tokens stored as hashes, and a token-version value for bulk revocation.
 
-## Local stdio MCP for Claude, Cursor, Codex, and compatible clients
+## Optional local stdio MCP
+
+stdio is a local transport, not a model provider. Claude Desktop, Cursor, Codex CLI, ChatGPT Desktop, or another MCP host supplies its own model/session and launches `machine-bridge-mcp` as a subprocess. The MCP server only exposes tools and returns their results; it does not borrow the model running in ChatGPT web.
+
+Many coding clients already have strong native filesystem and terminal tools, so configuring this stdio server is optional. It is useful when you want the same Machine Bridge tool schemas, patch behavior, process sessions, policy profiles, and logs across several clients, or when you want local access without deploying Cloudflare. If the client's built-in tools already meet your needs, there is no reason to add this server.
 
 Generate ready-to-paste configuration:
 
 ```sh
-machine-mcp client-config --client all --workspace /path/to/project --profile agent
+machine-mcp client-config --client all --workspace /path/to/project
 ```
 
 Or run stdio directly:
 
 ```sh
-machine-mcp stdio --workspace /path/to/project --profile agent
+machine-mcp stdio --workspace /path/to/project
 ```
 
-The stdio server writes only JSON-RPC messages to stdout. Operational logs go to stderr. It supports MCP initialization/version negotiation, tool discovery, calls, cancellation, structured tool output, native image content, and process sessions.
-
-See [docs/CLIENTS.md](docs/CLIENTS.md) for client-specific configuration and remote/local trade-offs.
+The stdio server writes only JSON-RPC messages to stdout and operational logs to stderr. See [docs/CLIENTS.md](docs/CLIENTS.md) for the host/model distinction and transport trade-offs.
 
 ## Policy controls
 
-Profiles can be narrowed with explicit flags:
+The default is `full`. Narrow or customize it with explicit flags:
 
 ```text
---profile review|edit|agent|full
+--profile full|agent|edit|review
 --exec-mode off|direct|shell
 --no-write
 --no-exec
@@ -122,9 +122,10 @@ Profiles can be narrowed with explicit flags:
 
 Important distinctions:
 
-- `--unrestricted-paths` expands direct filesystem tools beyond the selected workspace.
-- `--absolute-paths` changes returned path metadata; it does not grant additional access.
-- `--full-env` passes the complete parent environment to processes. Without it, commands receive an isolated HOME, temp directory, and cache directories plus a small set of platform variables.
+- The default `full` profile already enables unrestricted paths, absolute path output, and the complete parent environment.
+- `--unrestricted-paths=false`, `--absolute-paths=false`, and `--full-env=false` can narrow those individual settings.
+- `--absolute-paths` changes returned path metadata; it does not independently grant additional access.
+- In isolated-environment profiles, commands receive private HOME, temp, and cache directories plus a small set of platform variables.
 - Files with sensitive-looking names are not automatically blocked inside the workspace. A workspace `.env` remains readable when read tools are enabled.
 
 ## Tools
@@ -170,11 +171,11 @@ Process sessions retain bounded stdout/stderr, support offsets and short waits,
 
 ## Path and write behavior
 
-By default, existing paths are resolved with `realpath` and must remain inside the canonical workspace. New write paths validate the nearest existing ancestor, preventing missing-path writes through escaping symbolic-link directories.
+When workspace confinement is enabled (`agent`, `edit`, `review`, or an explicit override), existing paths are resolved with `realpath` and must remain inside the canonical workspace. New write paths validate the nearest existing ancestor, preventing missing-path writes through escaping symbolic-link directories. The default `full` profile permits direct filesystem paths outside the workspace.
 
 Writes use same-directory temporary files and atomic commit. Create-only writes use an atomic hard-link commit so a concurrent file cannot be silently overwritten. Patch operations are prevalidated, serialized, staged, rechecked, committed with backups, and rolled back on failure.
 
-Returned paths are workspace-relative by default. This reduces unnecessary disclosure of usernames and local directory layouts. Enable `--absolute-paths` only when a client genuinely needs absolute paths.
+The default `full` profile returns absolute paths. The `agent`, `edit`, and `review` profiles return workspace-relative paths to reduce unnecessary disclosure of usernames and local directory layouts.
 
 ## Commands
 
@@ -200,7 +201,7 @@ Remote mode supports:
 - Linux `systemd --user`, with best-effort lingering;
 - Windows Scheduled Task at logon.
 
-The service definition contains neither credentials nor a duplicate policy. It loads the selected policy from owner-only local state and fails closed to the `review` profile if policy state is absent. Service logs are owner-only where supported and trimmed before daemon startup.
+The service definition contains neither credentials nor a duplicate policy. It loads the selected policy from owner-only local state and uses the documented `full` default if policy state is absent. Service logs are owner-only where supported and trimmed before daemon startup.
 
 ## Secret rotation
 
@@ -233,7 +234,7 @@ npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 ```
 
-`npm run check` covers generated Worker types, TypeScript, JavaScript syntax, the shared tool catalog, local path/write/process/state/log/service invariants, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. A ready-to-enable GitHub Actions template is included at `docs/examples/github-actions-ci.yml` for Linux, macOS, and Windows with supported Node versions. Activating it requires a GitHub credential authorized to modify workflow files.
+`npm run check` covers generated Worker types, TypeScript, JavaScript syntax, the shared tool catalog, local path/write/process/state/log/service invariants, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. GitHub Actions runs the suite on Linux, macOS, and Windows with supported Node versions.
 
 See [docs/TESTING.md](docs/TESTING.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), and [SECURITY.md](SECURITY.md).
 

package/SECURITY.md

@@ -32,10 +32,12 @@ The Worker is a remote authentication and relay boundary. The local runtime is t
 
 ## Profiles are capability sets, not sandboxes
 
+The default for newly selected workspaces is `full`, which prioritizes ease of use over least privilege.
+
+- `full` exposes all tools, unrestricted direct filesystem paths, absolute path output, and the complete parent process environment.
+- `agent` exposes file mutation, direct argv execution, and process sessions while keeping direct filesystem tools workspace-confined and the process environment isolated.
+- `edit` exposes read and mutation tools without process execution.
 - `review` exposes read-only workspace/Git/image tools.
-- `edit` additionally exposes write, exact edit, and patch tools.
-- `agent` additionally exposes direct argv execution and process sessions.
-- `full` additionally exposes arbitrary shell commands.
 
 `run_process` avoids shell parsing, which removes one injection class, but an executable such as `node`, `python`, a package manager, compiler, test runner, or repository script can execute arbitrary code. Direct mode therefore has effectively broad local-user authority once an attacker controls argv or executed code.
 
@@ -45,9 +47,9 @@ For untrusted repositories or instructions, run the bridge inside a disposable V
 
 ## Filesystem exposure
 
-Direct filesystem tools are confined to the canonical selected workspace by default, including symbolic-link resolution. `--unrestricted-paths` expands this boundary and should be used only deliberately.
+Direct filesystem scope is profile-dependent. The default `full` profile is unrestricted. The `agent`, `edit`, and `review` profiles confine direct filesystem tools to the canonical selected workspace, including symbolic-link resolution.
 
-Returned paths are relative by default to reduce username and directory-layout disclosure. `--absolute-paths` changes metadata exposure without increasing direct access authority.
+The default `full` profile returns absolute paths. Narrower profiles return workspace-relative paths to reduce username and directory-layout disclosure. Path display and access scope remain separate controls.
 
 Sensitive-looking names are not blocked inside the workspace. Files such as `.env`, private keys, credentials, database dumps, and production configuration remain readable when they are in the selected workspace. Choose the narrowest practical workspace.
 
@@ -67,7 +69,7 @@ Local state contains the MCP connection password and daemon secret. State, lock,
 
 First-run or explicit credential output can intentionally display the MCP password. Avoid shared terminal logs, shell recordings, screenshots, CI output, or support tickets. Use `--no-print-credentials` for recorded sessions.
 
-Minimal process environment replaces HOME, temp, and common cache paths and does not pass arbitrary parent variables. It reduces accidental environment-secret leakage; it does not prevent code from explicitly accessing known resources. `--full-env` materially increases exposure.
+The default `full` profile passes the complete parent environment. Narrower profiles replace HOME, temp, and common cache paths and do not pass arbitrary parent variables. The isolated mode reduces accidental environment-secret leakage; it does not prevent code from explicitly accessing known resources.
 
 ## OAuth and public endpoints
 

package/docs/ARCHITECTURE.md

@@ -104,7 +104,7 @@ Duplicate in-flight JSON-RPC IDs for the same access token are rejected so cance
 
 The workspace is canonicalized once. Existing targets use `realpath`; the result must remain inside the workspace unless unrestricted mode is explicit. New targets walk to the nearest existing ancestor and validate its canonical path.
 
-Results use workspace-relative paths by default. Error strings redact canonical and common platform-alias forms of workspace, runtime, and home paths. Absolute paths are available only through an explicit display policy or unrestricted mode.
+Path behavior is profile-dependent. The default `full` profile permits unrestricted direct filesystem paths and returns absolute paths. The `agent`, `edit`, and `review` profiles enforce canonical workspace containment and return workspace-relative paths. Error strings redact canonical and common platform-alias forms of workspace, runtime, and home paths whenever absolute path display is disabled.
 
 Symbolic-link destinations and non-regular write targets are rejected. Recursive walkers do not follow symbolic-link directories.
 
@@ -132,7 +132,7 @@ This is a process-level transaction, not a filesystem-wide atomic transaction ac
 
 `run_process` and process sessions use argv arrays and do not invoke a shell. `exec_command` invokes the platform shell and is available only in `shell` mode. Both inherit local-user OS authority.
 
-Minimal environment mode creates private runtime HOME, temporary, and cache directories and passes only a small set of path/locale/platform variables. It reduces accidental credential inheritance but cannot prevent explicit access to known filesystem paths, credential stores, network services, or other user resources.
+The default `full` profile passes the complete parent environment. Isolated environment mode, used by the narrower named profiles unless overridden, creates private runtime HOME, temporary, and cache directories and passes only a small set of path/locale/platform variables. It reduces accidental credential inheritance but cannot prevent explicit access to known filesystem paths, credential stores, network services, or other user resources.
 
 One-shot calls have bounded output and timeouts. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
 

package/docs/CLIENTS.md

@@ -1,24 +1,73 @@
-# Client configuration
+# Client configuration and model ownership
+
+## The central distinction
+
+An MCP server is not a model provider. It exposes tools, resources, or prompts. The MCP host is the AI application that owns the conversation, chooses or supplies the model, decides when a tool should be called, sends the tool request, and adds the result back to the model context.
+
+For this project:
+
+```text
+Claude Desktop / Cursor / Codex / ChatGPT Desktop / another MCP host
+        owns the model, account, conversation, approvals, and tool-selection loop
+                              |
+                              | stdio or Streamable HTTP
+                              v
+machine-bridge-mcp
+        exposes local file, Git, image, patch, and process tools
+```
+
+A local stdio connection does **not** use the model running in a separate ChatGPT web conversation. It uses whatever model/session the local host is configured to use:
+
+- Claude Desktop uses the Claude account/model available to that application.
+- Cursor uses the model/provider configured in Cursor.
+- Codex CLI and the Codex IDE integration use their own authenticated Codex/OpenAI configuration.
+- ChatGPT Desktop can use its signed-in ChatGPT/Codex host session and can launch local stdio servers on supported hosts.
+
+The MCP protocol itself intentionally does not dictate how the host obtains an LLM. The optional MCP sampling primitive can let a server ask a capable host for a completion, but `machine-bridge-mcp` does not depend on sampling and does not bundle a model SDK.
+
+## Why keep stdio when coding clients already have tools?
+
+For many users, the client's native filesystem, patch, terminal, and approval system is sufficient. In that case, adding Machine Bridge over stdio is redundant and should be skipped.
+
+The stdio mode exists for narrower cases:
+
+1. **One tool contract across several clients.** The same tool names, schemas, patch behavior, Git handling, process sessions, result formats, and logging work in Claude Desktop, Cursor, Codex, ChatGPT Desktop, and other MCP hosts.
+2. **Transport parity.** The local client can use essentially the same Machine Bridge runtime that remote ChatGPT access uses, without maintaining a second implementation.
+3. **No remote relay for same-machine use.** The host launches the server directly, so no Cloudflare Worker, public URL, OAuth flow, or network round trip is needed.
+4. **Capabilities missing from a particular host.** Exact edit semantics, transactional multi-file patches, retained process sessions, image results, or the project's policy profiles may be useful even when the host has basic shell tools.
+5. **Testing and interoperability.** stdio is a standard MCP transport and provides a direct way to validate the runtime independently of the Worker.
+
+It is therefore an optional compatibility and reuse surface, not a replacement for the native agent tooling in Claude Desktop, Cursor, or Codex.
 
 ## Choosing a transport
 
-Use remote HTTPS/OAuth when the client cannot launch a local stdio process or must reach the machine from another device. Use stdio when the client runs on the same machine and supports local MCP processes.
+| Situation | Recommended path |
+|---|---|
+| ChatGPT web or another service must reach this computer remotely | Remote Worker with HTTPS/OAuth |
+| A local MCP host needs Machine Bridge-specific tools | stdio |
+| The local coding client already provides everything needed | Use the client's native tools; do not configure Machine Bridge stdio |
+| Several local clients should share identical tool semantics | stdio |
+| Access is required from another device or hosted agent | Remote Worker |
+
+The MCP specification defines stdio and Streamable HTTP as standard transports. In stdio, the host launches the server as a subprocess and exchanges newline-delimited JSON-RPC through stdin/stdout. Streamable HTTP runs the server independently behind an HTTP endpoint.
 
-| Client class | Recommended transport | Reason |
-|---|---|---|
-| ChatGPT remote connector / Developer Mode | Remote Worker | Public HTTPS endpoint and OAuth authorization |
-| Claude Desktop | stdio | Local process transport; no cloud relay required |
-| Cursor | stdio | Local process transport and direct workspace lifecycle |
-| Codex CLI | stdio | Local MCP server configuration |
-| Other MCP clients | stdio when local; remote when necessary | Minimize the trust and network boundary |
+## Generate local configuration
 
-## Generate configuration
+The default profile is `full`:
 
 ```sh
-machine-mcp client-config --client all --workspace /path/to/project --profile agent
+machine-mcp client-config --client all --workspace /path/to/project
 ```
 
-The generated command uses the current Node executable and installed entry script as absolute paths so it does not depend on GUI application PATH configuration.
+The generated command uses the current Node executable and installed entry script as absolute paths so it does not depend on a GUI application's `PATH`.
+
+To reduce authority:
+
+```sh
+machine-mcp client-config --client all --workspace /path/to/project --profile agent
+machine-mcp client-config --client all --workspace /path/to/project --profile edit
+machine-mcp client-config --client all --workspace /path/to/project --profile review
+```
 
 ## JSON stdio configuration
 
@@ -35,38 +84,42 @@ Claude Desktop, Cursor, and many generic clients use a shape similar to:
         "--workspace",
         "/path/to/project",
         "--profile",
-        "agent"
+        "full"
       ]
     }
   }
 }
 ```
 
-Use the exact output of `client-config`; application-specific configuration locations change over time.
+Use the exact output of `client-config`; application-specific configuration locations and UI flows can change.
 
-## Codex CLI TOML
+## Codex configuration
+
+Codex supports both local stdio servers and Streamable HTTP servers. A local configuration is:
 
 ```toml
 [mcp_servers.machine_bridge]
 command = "/absolute/path/to/node"
-args = ["/absolute/path/to/machine-mcp.mjs", "stdio", "--workspace", "/path/to/project", "--profile", "agent"]
+args = ["/absolute/path/to/machine-mcp.mjs", "stdio", "--workspace", "/path/to/project", "--profile", "full"]
 ```
 
-## ChatGPT remote connection
+Codex CLI, the Codex IDE extension, and supported ChatGPT Desktop Codex hosts can share MCP configuration on the same Codex host. ChatGPT web does not read local Codex configuration files; web use requires a hosted plugin/connector or a reachable remote MCP endpoint.
+
+## Remote ChatGPT connection
 
 Run:
 
 ```sh
-machine-mcp --workspace /path/to/project --profile review
+machine-mcp --workspace /path/to/project
 ```
 
 Enter the printed `/mcp` URL in the remote MCP connector. During OAuth authorization, verify the displayed client name and redirect URI before entering the connection password.
 
 ## Profile guidance
 
-- Begin with `review` for an unfamiliar client or repository.
-- Use `edit` when the client needs deterministic file mutation but no process execution.
-- Use `agent` for normal coding work. It permits direct executables and process sessions, which remain powerful.
-- Use `full` only when shell syntax is required and the client/instructions are trusted.
+- `full` is the default and prioritizes immediate usability. It exposes shell execution, unrestricted direct filesystem paths, absolute path output, and the full parent environment.
+- `agent` retains file mutation and direct process execution but removes shell parsing, confines direct filesystem tools to the workspace, and isolates the process environment.
+- `edit` permits deterministic file mutation without process execution.
+- `review` is read-only and workspace-confined.
 
-A client configuration is an authorization decision. Anyone who controls an authorized client can invoke every tool exposed by its selected profile.
+A client configuration is an authorization decision. Anyone who controls an authorized host can invoke every tool exposed by the selected profile.

package/docs/OPERATIONS.md

@@ -62,12 +62,14 @@ Defense-in-depth limits include:
 
 ## Upgrade behavior
 
-Version 0.4 changes the default for newly selected workspaces to `review`. Existing state retains its previous write and execution settings. To intentionally migrate an old profile:
+Version 0.4.1 changes the default for newly selected workspaces to the maximum-permission `full` profile. Existing state retains its saved policy. To intentionally migrate an older workspace to the new default:
 
 ```sh
-machine-mcp --workspace /path/to/project --profile agent
+machine-mcp --workspace /path/to/project --profile full
 ```
 
+`full` enables writes, direct processes, process sessions, shell execution, unrestricted direct filesystem paths, absolute path output, and the complete parent environment. Use `agent`, `edit`, or `review` when that authority is unnecessary.
+
 A remote policy change is saved locally, propagated in the daemon handshake, and persisted in the autostart definition.
 
 ## Incident response

package/docs/TESTING.md

@@ -39,7 +39,7 @@ npm pack --dry-run
 npm run version:check
 ```
 
-The repository includes `docs/examples/github-actions-ci.yml`, a ready-to-enable matrix for Linux, macOS, and Windows. Node 22 and 24 are covered on Linux; Node 22 is covered on macOS and Windows. It must be copied to `.github/workflows/ci.yml` with a GitHub credential authorized to modify workflow files. Dependency and GitHub Actions updates are monitored by Dependabot after activation.
+GitHub Actions executes the main suite on Linux, macOS, and Windows. Node 22 and 24 are covered on Linux; Node 22 is covered on macOS and Windows. A separate package-audit job runs production dependency auditing and a dry-run package build. Dependency and GitHub Actions updates are monitored by Dependabot.
 
 ## Test design rules
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Cross-client MCP bridge for policy-controlled local files, Git, images, patches, and processes over stdio or OAuth-protected remote relay.",
   "type": "module",
   "license": "MIT",

package/src/local/cli.mjs

@@ -351,7 +351,7 @@ const POLICY_PROFILES = Object.freeze({
   review: Object.freeze({ profile: "review", allowWrite: false, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
   edit: Object.freeze({ profile: "edit", allowWrite: true, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
   agent: Object.freeze({ profile: "agent", allowWrite: true, execMode: "direct", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
-  full: Object.freeze({ profile: "full", allowWrite: true, execMode: "shell", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
+  full: Object.freeze({ profile: "full", allowWrite: true, execMode: "shell", unrestrictedPaths: true, minimalEnv: false, exposeAbsolutePaths: true }),
 });
 
 export function resolvePolicy(args = {}, stored = {}) {
@@ -368,7 +368,7 @@ export function resolvePolicy(args = {}, stored = {}) {
   } else if (hasStored) {
     base = normalizePolicy(stored);
   } else {
-    base = { ...POLICY_PROFILES.review };
+    base = { ...POLICY_PROFILES.full };
   }
 
   if (!hasExplicit) return normalizePolicy(base);
@@ -404,7 +404,7 @@ async function clientConfigCommand(args) {
   const workspaceArgs = { ...args, _: [] };
   const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: false, save: false, allowPositional: false });
   const requested = String(args.client || args._[0] || "all").trim().toLowerCase();
-  const profile = String(args.profile || "agent").trim().toLowerCase();
+  const profile = String(args.profile || "full").trim().toLowerCase();
   if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
   if (!["all", "claude", "cursor", "codex", "generic"].includes(requested)) throw new Error("client must be all, claude, cursor, codex, or generic");
   const command = process.execPath;
@@ -940,7 +940,7 @@ Start options:
   --no-autostart        Do not install login autostart during start
   --no-print-credentials Redact credentials in console output
   --print-mcp-credentials Print MCP URL/password again for reconnecting ChatGPT apps
-  --profile NAME        Policy profile: review (default for new workspaces), edit, agent, or full
+  --profile NAME        Policy profile: full (default), agent, edit, or review
   --exec-mode MODE      Command mode: off, direct argv, or full shell
   --no-write            Disable write_file, edit_file, and apply_patch
   --no-exec             Disable run_process and exec_command

package/src/local/daemon.mjs

@@ -25,7 +25,8 @@ export class LocalDaemon {
     if (this.workerUrl && (typeof secret !== "string" || secret.length < 16)) throw new Error("daemon secret is missing or too short");
     this.secret = secret || "";
     this.workspaceInput = resolve(workspace || process.cwd());
-    this.workspace = realpathSync(this.workspaceInput);
+    this.workspace = realpathSync.native ? realpathSync.native(this.workspaceInput) : realpathSync(this.workspaceInput);
+    this.workspaceCanonicalPromise = null;
     this.policy = normalizePolicy(policy);
     this.logger = logger;
     this.onSuperseded = typeof onSuperseded === "function" ? onSuperseded : null;
@@ -751,28 +752,45 @@ export class LocalDaemon {
   resolvePath(inputPath = ".") {
     const raw = String(inputPath || ".");
     if (raw.includes("\0")) throw new Error("path contains a NUL byte");
-    return isAbsolute(raw) ? resolve(raw) : resolve(this.workspace, raw);
+    return isAbsolute(raw) ? resolve(raw) : resolve(this.workspaceInput, raw);
+  }
+
+  async canonicalWorkspace() {
+    if (!this.workspaceCanonicalPromise) {
+      this.workspaceCanonicalPromise = realpath(this.workspaceInput).then((canonical) => {
+        this.workspace = canonical;
+        this.processSessionManager.workspace = canonical;
+        return canonical;
+      }).catch((error) => {
+        this.workspaceCanonicalPromise = null;
+        throw error;
+      });
+    }
+    return this.workspaceCanonicalPromise;
   }
 
   async resolveExistingPath(inputPath = ".") {
     const candidate = this.resolvePath(inputPath);
-    const canonical = await realpath(candidate);
-    if (!this.policy.unrestrictedPaths) assertContainedPath(this.workspace, canonical);
+    const [workspace, canonical] = await Promise.all([this.canonicalWorkspace(), realpath(candidate)]);
+    if (!this.policy.unrestrictedPaths) assertContainedPath(workspace, canonical);
     return canonical;
   }
 
   async resolveWritePath(inputPath = ".") {
     const candidate = this.resolvePath(inputPath);
     if (this.policy.unrestrictedPaths) return candidate;
+    const candidateInfo = await lstat(candidate).catch(() => null);
     let ancestor = candidate;
     while (!(await lstat(ancestor).catch(() => null))) {
       const parent = dirname(ancestor);
       if (parent === ancestor) break;
       ancestor = parent;
     }
-    const canonicalAncestor = await realpath(ancestor);
-    assertContainedPath(this.workspace, canonicalAncestor);
-    return candidate;
+    const [workspace, canonicalAncestor] = await Promise.all([this.canonicalWorkspace(), realpath(ancestor)]);
+    assertContainedPath(workspace, canonicalAncestor);
+    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
+    const suffix = relative(ancestor, candidate);
+    return suffix ? resolve(canonicalAncestor, suffix) : canonicalAncestor;
   }
 
   displayPath(fullPath) {

package/src/worker/index.ts

@@ -2,7 +2,7 @@ import { DurableObject } from "cloudflare:workers";
 import toolCatalog from "../shared/tool-catalog.json";
 
 const SERVER_NAME = "machine-bridge-mcp";
-const SERVER_VERSION = "0.4.0";
+const SERVER_VERSION = "0.4.2";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"] as const;
 const JSONRPC_VERSION = "2.0";

package/docs/examples/github-actions-ci.yml

@@ -1,53 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check:
-    name: ${{ matrix.os }} / Node ${{ matrix.node }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            node: 22
-          - os: ubuntu-latest
-            node: 24
-          - os: macos-latest
-            node: 22
-          - os: windows-latest
-            node: 22
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node }}
-          cache: npm
-      - run: npm ci
-      - run: npm run check
-
-  package-audit:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm audit --omit=dev --audit-level=high
-      - run: npm pack --dry-run