machine-bridge-mcp 0.4.2 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.5.0 - 2026-07-10
+
+### Changed
+
+- Replace routine per-tool success chatter with explicit log levels. Foreground mode defaults to `info`, autostart uses `warn`, fast successful calls are debug-only, and successful calls over 30 seconds remain visible as slow-call events. `--verbose` maps to `debug`; `--quiet` maps to `error`; `--log-level` accepts `error`, `warn`, `info`, or `debug`.
+- Record policy origin and revision in state and daemon metadata. The exact legacy implicit-default policy shape is migrated once to the current maximum-permission `full` profile, while explicit named profiles and identified custom policies are preserved.
+- Redact JSON connection credentials and standalone secret-rotation output by default. Printing the client connection password now requires the explicit reconnect flag; the daemon secret is never printed in full.
+- Centralize server name, MCP protocol versions, and instructions in shared metadata consumed by both Worker and local transports.
+- Reject obsolete removed-local-API flags instead of silently accepting them.
+
+### Security and privacy
+
+- Upgrade and pin `ws` to 8.21.0 to address current memory-disclosure and denial-of-service advisories; pin the reviewed Wrangler runtime version.
+- Bind text, image, and search reads to an opened file handle, enforce limits against that handle, and avoid `stat`/read growth races.
+- Bound state, configuration, marker, lock, service-command, log-message, and structured-log sizes. Reject symbolic-link state files, use no-follow reads where supported, and make service-log tail trimming UTF-8 and line safe.
+- Remove stale temporary Worker secret files when their owner process is gone, not only after an age threshold.
+- Document and expose that Machine Bridge has no sensitive-filename blacklist. Local `full` permits any OS-readable UTF-8 regular file, but cannot override operating-system or independent MCP-host/platform policy.
+
+### Tests and operations
+
+- Add regression coverage for legacy policy migration, sensitive-looking files outside the workspace, inherited full-profile environment, default daemon/stdio log suppression, log bounding, state write bounds, service warning-level configuration, and shared metadata drift.
+- Audit both complete and production-only dependency graphs in GitHub Actions.
+- Document npm's scoped install-script approval for Wrangler native dependencies and add a dedicated logging/observability reference.
+
 ## 0.4.2 - 2026-07-10
 
 ### Fixed

package/README.md

@@ -32,7 +32,7 @@ A newly selected workspace starts with the maximum-permission `full` profile for
 - tool results may return absolute paths;
 - child processes inherit the complete parent environment.
 
-Existing workspace state keeps its saved policy during upgrade. Use `--profile full` to explicitly move an older workspace to the new maximum-permission behavior.
+Policy state records whether it came from the default, an explicit named profile, or custom overrides. Version 0.5 migrates the exact pre-0.4 implicit-default shape to `full` once; explicit restrictive profiles and identified custom policies remain unchanged.
 
 | Profile | File edits | Direct argv processes | Shell commands | Filesystem scope | Process environment |
 |---|---:|---:|---:|---|---|
@@ -48,10 +48,12 @@ This default prioritizes usability, not least privilege. `run_process` and proce
 Node.js 22 or newer is required.
 
 ```sh
-npm install -g machine-bridge-mcp@latest
+npm install -g --allow-scripts=esbuild,workerd,sharp machine-bridge-mcp@latest
 ```
 
-From a source checkout:
+Recent npm releases may otherwise warn that Wrangler's native dependencies (`esbuild`, `workerd`, and `sharp`) have install scripts awaiting approval. The scoped command above approves only those packages for this installation; it does not change the user's global npm policy. A plain install can still work when compatible prebuilt artifacts are already available, but `machine-mcp doctor` is the authoritative runtime check.
+
+From a source checkout, the checked-in exact-version `allowScripts` policy approves the reviewed native dependencies:
 
 ```sh
 npm install
@@ -118,6 +120,9 @@ The default is `full`. Narrow or customize it with explicit flags:
 --full-env
 --unrestricted-paths
 --absolute-paths
+--log-level error|warn|info|debug
+--verbose
+--quiet
 ```
 
 Important distinctions:
@@ -126,7 +131,8 @@ Important distinctions:
 - `--unrestricted-paths=false`, `--absolute-paths=false`, and `--full-env=false` can narrow those individual settings.
 - `--absolute-paths` changes returned path metadata; it does not independently grant additional access.
 - In isolated-environment profiles, commands receive private HOME, temp, and cache directories plus a small set of platform variables.
-- Files with sensitive-looking names are not automatically blocked inside the workspace. A workspace `.env` remains readable when read tools are enabled.
+- The server has no filename blacklist. Under `full`, direct read tools may read any UTF-8 regular file that the local OS user can access, including files outside the workspace and names such as `.env`, `passwords.txt`, or private-key files.
+- Maximum local policy does not override operating-system permissions, macOS TCC/SIP, Windows ACLs, container boundaries, or independent safety rules imposed by the MCP host/platform. A host-generated “sensitive file” denial is outside this server's enforcement layer.
 
 ## Tools
 
@@ -188,6 +194,7 @@ machine-mcp service status|install|start|stop|uninstall
 machine-mcp status
 machine-mcp doctor
 machine-mcp rotate-secrets
+machine-mcp --print-mcp-credentials
 machine-mcp uninstall [--keep-worker] [--yes]
 ```
 
@@ -201,16 +208,16 @@ Remote mode supports:
 - Linux `systemd --user`, with best-effort lingering;
 - Windows Scheduled Task at logon.
 
-The service definition contains neither credentials nor a duplicate policy. It loads the selected policy from owner-only local state and uses the documented `full` default if policy state is absent. Service logs are owner-only where supported and trimmed before daemon startup.
+The service definition contains neither credentials nor a duplicate policy. It loads the selected policy from owner-only local state and uses the documented `full` default if policy state is absent. Background services run at log level `warn`: failures and connection problems are retained, while routine successful tool calls are omitted. Logs are owner-only where supported and bounded by tail trimming.
 
 ## Secret rotation
 
 ```sh
-machine-mcp rotate-secrets --no-print-credentials
-machine-mcp
+machine-mcp rotate-secrets
+machine-mcp --print-mcp-credentials
 ```
 
-Rotation stops the installed service, refuses to proceed while another foreground daemon owns the workspace lock, rotates the MCP password, daemon secret, and OAuth token version, and requires redeployment. Previously issued access tokens then fail validation.
+Rotation stops the installed service, refuses to proceed while another foreground daemon owns the workspace lock, rotates the MCP password, daemon secret, and OAuth token version, and requires redeployment. Rotated values are redacted by default; only the client connection password can be printed through the explicit reconnect flag. Previously issued access tokens then fail validation.
 
 ## State and observability
 
@@ -222,7 +229,7 @@ Default state roots:
 
 State/config writes use owner-only temporary files, flushes, and atomic rename. Malformed state is retained as a bounded corrupt backup before reconstruction. Uninstall validates markers, canonical paths, active locks, workspace/source exclusions, and known contents before recursive deletion.
 
-Operational logs record bounded metadata such as component, tool name, shortened call ID, duration, outcome, and error class. They do not intentionally log file contents, patch bodies, command strings, stdin, OAuth passwords, access tokens, or daemon secrets. See [docs/OPERATIONS.md](docs/OPERATIONS.md).
+Default foreground logs show startup/deployment transitions, relay connectivity, warnings/errors, and successful calls that exceed 30 seconds. Routine successful tool calls and correlation IDs appear only at `--log-level debug` or `--verbose`. Background services use `warn`. Log messages and structured fields are bounded, secret-like keys and known token formats are redacted, and tool arguments/results are not written. See [docs/LOGGING.md](docs/LOGGING.md) and [docs/OPERATIONS.md](docs/OPERATIONS.md).
 
 ## Development and verification
 
@@ -230,6 +237,7 @@ Operational logs record bounded metadata such as component, tool name, shortened
 npm ci
 npm run check
 npm run worker:dry-run
+npm audit --audit-level=high
 npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 ```

package/SECURITY.md

@@ -51,7 +51,9 @@ Direct filesystem scope is profile-dependent. The default `full` profile is unre
 
 The default `full` profile returns absolute paths. Narrower profiles return workspace-relative paths to reduce username and directory-layout disclosure. Path display and access scope remain separate controls.
 
-Sensitive-looking names are not blocked inside the workspace. Files such as `.env`, private keys, credentials, database dumps, and production configuration remain readable when they are in the selected workspace. Choose the narrowest practical workspace.
+The server does not maintain a sensitive-filename blacklist. Under `full`, direct read tools may access any UTF-8 regular file available to the local OS user, including files outside the selected workspace and names such as `.env`, password stores, private keys, credentials, database dumps, and production configuration. Narrower profiles confine direct filesystem tools but do not classify names inside that boundary.
+
+Maximum local policy does not bypass Unix permissions, Windows ACLs, macOS TCC/SIP, container/VM boundaries, or security decisions made by the MCP host/platform. A host-side “sensitive file” refusal is independent of Machine Bridge and cannot be disabled by local policy configuration.
 
 Processes are not confined by the filesystem-tool resolver. They can access paths, networks, processes, credential stores, and devices available to the local user.
 
@@ -67,7 +69,7 @@ These controls do not defend against a malicious process running under the same
 
 Local state contains the MCP connection password and daemon secret. State, lock, temporary secret, runtime, and service-log files use owner-only permissions where supported. State writes are atomic. Logs recursively redact known credential fields and token formats and neutralize control characters.
 
-First-run or explicit credential output can intentionally display the MCP password. Avoid shared terminal logs, shell recordings, screenshots, CI output, or support tickets. Use `--no-print-credentials` for recorded sessions.
+First-run or explicit reconnect output can intentionally display the MCP connection password. JSON output and standalone secret rotation redact credentials by default; printing requires the explicit reconnect flag. The daemon secret is never printed in full. Avoid shared terminal logs, shell recordings, screenshots, CI output, or support tickets.
 
 The default `full` profile passes the complete parent environment. Narrower profiles replace HOME, temp, and common cache paths and do not pass arbitrary parent variables. The isolated mode reduces accidental environment-secret leakage; it does not prevent code from explicitly accessing known resources.
 
@@ -101,7 +103,7 @@ Sessions use pipes, not a PTY. Do not assume terminal-oriented programs will beh
 
 ## Logs and privacy
 
-Operational logs record coarse metadata and error classes, not tool arguments, command text, stdin, file/patch contents, or outputs. Unexpected Worker exceptions are reduced to error classes. Git author email is omitted from `git_log` unless explicitly requested.
+Default operational logs record startup/connection transitions, failed calls, slow-call duration, and coarse error classes. Routine successful calls and shortened correlation IDs are debug-only. Tool arguments, command text, stdin, file/patch contents, and outputs are omitted. Messages and fields are bounded; unexpected daemon and Worker exceptions are reduced to error classes. Git author email is omitted from `git_log` unless explicitly requested.
 
 No logging policy can prevent data from being returned to a client that explicitly invokes an enabled tool. The Worker necessarily relays remote tool arguments and results; this is not end-to-end encryption against the user's Cloudflare execution environment.
 
@@ -124,7 +126,7 @@ Also:
 - patch the OS and use supported Node.js releases;
 - enable MFA on Cloudflare, GitHub, and npm accounts;
 - do not configure broad CORS origins;
-- avoid `--full-env`, `--unrestricted-paths`, and `--absolute-paths` unless required;
+- select `agent`, `edit`, or `review` instead of the default `full` when broad authority is unnecessary;
 - inspect client names and OAuth redirect URIs;
 - rotate secrets after suspected disclosure;
 - inspect `status`, `doctor`, and service status;

package/docs/ARCHITECTURE.md

@@ -12,15 +12,15 @@ No transport is treated as a sandbox. Both transports invoke the same local runt
 
 ## Components
 
-### Shared tool catalog
+### Shared protocol metadata and tool catalog
 
-`src/shared/tool-catalog.json` is the single source of truth for tool names, descriptions, input schemas, annotations, and policy availability. The Worker and stdio runtime import it directly. A catalog test rejects duplicate names, unknown availability classes, open schemas, missing annotations, profile drift, and a second hand-maintained Worker catalog.
+`src/shared/server-metadata.json` is the single source of truth for server identity, MCP protocol versions, and host instructions. `src/shared/tool-catalog.json` is the single source of truth for tool names, descriptions, input schemas, annotations, and policy availability. The Worker and local runtime import both directly. Catalog tests reject metadata drift, duplicate names, unknown availability classes, open schemas, missing annotations, profile drift, and second hand-maintained Worker definitions.
 
 ### CLI and state layer
 
 The CLI canonicalizes workspaces, resolves policy profiles, maintains per-workspace state and credentials, serializes startup/deploy/rotation with locks, deploys the Worker, installs optional platform-native autostart, and starts either remote daemon or stdio mode.
 
-A canonical workspace receives an independent profile, Worker name, secret set, daemon/startup locks, and state file. State schema version 3 removes obsolete local API state and records the expanded policy model.
+A canonical workspace receives an independent profile, Worker name, secret set, daemon/startup locks, and state file. State schema version 4 records policy origin/revision in addition to the capability fields and retains removal of obsolete local API state.
 
 ### Local runtime
 
@@ -38,7 +38,7 @@ Remote mode attaches WebSocket connection/reconnect behavior. Stdio mode invokes
 
 ### Stdio MCP server
 
-The stdio server implements newline-delimited JSON-RPC over stdin/stdout. It negotiates supported MCP versions, advertises policy-filtered tools, returns text plus structured content, supports native image content, maps cancellation notifications to runtime call IDs, and sends logs only to stderr.
+The stdio server implements newline-delimited JSON-RPC over stdin/stdout. It negotiates supported MCP versions, advertises policy-filtered tools, returns text plus structured content, supports native image content, maps cancellation notifications to runtime call IDs, and sends level-filtered logs only to stderr.
 
 ### Cloudflare Worker and Durable Object
 
@@ -55,7 +55,7 @@ The daemon attachment deliberately omits workspace path/name/hash and process ID
 
 ### Autostart layer
 
-The service layer emits launchd, systemd-user, or Windows Scheduled Task definitions. Credentials are not embedded in service definitions; the daemon loads owner-only state. The exact policy is stored in owner-only state; platform service definitions contain only the workspace and state-root selectors.
+The service layer emits launchd, systemd-user, or Windows Scheduled Task definitions. Credentials are not embedded in service definitions; the daemon loads owner-only state. The exact policy is stored in owner-only state; platform service definitions contain only the workspace/state-root selectors and a `warn` log-level setting.
 
 ## Trust boundaries
 
@@ -102,7 +102,7 @@ Duplicate in-flight JSON-RPC IDs for the same access token are rejected so cance
 
 ## Filesystem resolution and privacy
 
-The workspace is canonicalized once. Existing targets use `realpath`; the result must remain inside the workspace unless unrestricted mode is explicit. New targets walk to the nearest existing ancestor and validate its canonical path.
+The workspace is canonicalized and compared with targets through consistent platform-native/async `realpath` representations. Existing targets must remain inside the workspace unless the active policy is unrestricted. New targets walk to the nearest existing ancestor, validate its canonical path, and reconstruct the destination below that canonical ancestor.
 
 Path behavior is profile-dependent. The default `full` profile permits unrestricted direct filesystem paths and returns absolute paths. The `agent`, `edit`, and `review` profiles enforce canonical workspace containment and return workspace-relative paths. Error strings redact canonical and common platform-alias forms of workspace, runtime, and home paths whenever absolute path display is disabled.
 
@@ -146,7 +146,7 @@ Pending calls retain their originating socket reference. A stale socket cannot c
 
 ## Persistence
 
-Local state and global config are owner-only, versioned, and written through temporary files, flushes, and atomic rename. Malformed state becomes a bounded `.corrupt-*` backup. Custom roots are adopted only when empty or recognizable as legacy Machine Bridge state.
+Local state and global config are owner-only, versioned, size-bounded, and written through temporary files, flushes, and atomic rename. Reads reject symbolic links and use no-follow descriptors where supported. Malformed or oversized state becomes a bounded-count `.corrupt-*` backup. Custom roots are adopted only when empty or recognizable as legacy Machine Bridge state.
 
 Removal validates the state marker, canonical target, known contents, active locks, filesystem root/home/current/package/workspace/source exclusions, and Worker deletion outcome before recursive deletion.
 
@@ -154,15 +154,17 @@ OAuth metadata is pruned on access. Expired codes/tokens, old throttling records
 
 ## Observability
 
-Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status. Local operational logs record tool identity, shortened random call ID, duration, outcome, and coarse error class, but not arguments or outputs. Worker unexpected-error logs contain endpoint and error class, not raw exception text.
+Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status and policy origin/revision.
 
-Cloudflare sampling is size control rather than an audit log. The project intentionally does not claim complete forensic logging.
+Foreground logging defaults to `info`; autostart uses `warn`. Routine successful calls and shortened random correlation IDs are debug-only. `info` retains deployment/connection transitions and successful calls slower than 30 seconds. Failures log tool name, duration, and coarse error class without arguments or outputs. Unexpected local and Worker errors are reduced to classes in normal logs. Messages, strings, arrays, object depth/key counts, and serialized fields are bounded.
+
+Cloudflare sampling is size control rather than an audit log. The project intentionally does not claim complete forensic logging. See [LOGGING.md](LOGGING.md).
 
 ## Explicit non-goals
 
 - operating-system sandboxing of arbitrary executables;
 - preventing an authorized client from requesting data available to enabled tools;
-- automatically deciding which workspace files are sensitive;
+- automatically deciding which local files are sensitive or overriding MCP-host/platform safety policy;
 - surviving daemon restart with process sessions;
 - PTY/terminal emulation;
 - model-level prompt-injection prevention;

package/docs/CLIENTS.md

@@ -123,3 +123,9 @@ Enter the printed `/mcp` URL in the remote MCP connector. During OAuth authoriza
 - `review` is read-only and workspace-confined.
 
 A client configuration is an authorization decision. Anyone who controls an authorized host can invoke every tool exposed by the selected profile.
+
+## Host-side safety rules
+
+The local `full` profile controls Machine Bridge's own tool catalog, path resolver, path display, process environment, and shell availability. It does not control the MCP host's model policy, approval UI, connector gateway, or platform execution filters.
+
+Machine Bridge itself does not block files because their names look sensitive. If `server_info` reports `full` and a direct `read_file` request is still rejected as a “sensitive file” by the execution layer, that refusal comes from the host/platform rather than this server. Changing `--profile`, `--unrestricted-paths`, or `--absolute-paths` cannot override it. Use a trusted local client or an operator-controlled local command only where doing so is consistent with the host's terms and the user's security intent.

package/docs/LOGGING.md

@@ -0,0 +1,80 @@
+# Logging and observability
+
+## Goals
+
+Operational logs should answer four questions without becoming a transcript of user activity:
+
+1. Did deployment and relay connection succeed?
+2. Is the daemon reconnecting, superseded, or unhealthy?
+3. Did a tool call fail, time out, or become unusually slow?
+4. Which component and coarse error class should be investigated?
+
+Logs are not a command history, content audit trail, or substitute for MCP client approvals.
+
+## Levels
+
+The CLI accepts:
+
+```text
+--log-level error|warn|info|debug
+--quiet      # alias for error
+--verbose    # alias for debug
+```
+
+The default foreground level is `info`. Platform autostart services use `warn`.
+
+| Level | Intended events |
+|---|---|
+| `error` | Broken request handlers, relay transport errors, unrecoverable local failures |
+| `warn` | Failed tool calls, disconnections, malformed/oversized relay messages, superseded daemons |
+| `info` | Deployment/startup transitions, successful relay connection, successful calls slower than 30 seconds |
+| `debug` | Routine successful calls, shortened correlation IDs, reconnect timing, cancellation correlation |
+
+Routine successful calls are deliberately absent from `info`. A normal sequence of hundreds of tool invocations should not fill the user's terminal or service logs.
+
+## Event fields
+
+Default warning/error and slow-call events may include:
+
+- component;
+- tool name;
+- duration in milliseconds;
+- coarse error class;
+- relay close code;
+- bounded reconnect delay.
+
+Shortened random call identifiers are debug-only. They are useful only for correlating adjacent local events and are not stable audit identifiers.
+
+The implementation intentionally omits:
+
+- tool arguments;
+- command text or argv;
+- stdin, stdout, and stderr;
+- file, patch, or image content;
+- OAuth request bodies;
+- connection passwords, daemon secrets, authorization codes, and access tokens.
+
+Unexpected daemon and Worker failures are reduced to coarse error classes in normal logs. Client-facing tool errors may contain more detail according to the active path-display policy, but those details are not copied into normal operational logs.
+
+## Bounding and redaction
+
+Messages, strings, object depth, object key counts, array item counts, and serialized field payloads are bounded. Control characters are neutralized. Fields with secret-like names and known token formats are recursively redacted.
+
+This is defense in depth, not content classification. A previously unknown secret format embedded in an ordinary non-secret-named field may evade pattern redaction. For that reason, tool arguments and outputs are omitted rather than merely filtered.
+
+## Files
+
+Autostart logs are stored below the state root:
+
+```text
+logs/daemon.out.log
+logs/daemon.err.log
+```
+
+They are owner-only where the platform supports Unix-style permissions. Existing files are tail-trimmed on UTF-8/line boundaries before daemon startup. Because background services use `warn`, normal successful tool traffic should not cause sustained log growth.
+
+## MCP host boundary
+
+Machine Bridge does not classify filenames as sensitive and does not block `.env`, password, key, or credential-looking names. The active local policy and operating-system permissions determine what the server itself can read.
+
+An MCP host, model provider, desktop application, or platform execution layer may independently deny a request involving credentials or sensitive files. Such a denial occurs before or outside Machine Bridge's file resolver and cannot be disabled by selecting the local `full` profile. Use `server_info`, `machine-mcp status`, and `machine-mcp doctor` to distinguish the active local policy from host-side enforcement.

package/docs/OPERATIONS.md

@@ -14,24 +14,20 @@ machine-mcp service status
 
 Remote autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Files are owner-only where supported and tail-trimmed before daemon startup.
 
-Structured operational events may include:
+Logging is level-based:
 
-- component and severity;
-- tool name;
-- shortened random call identifier;
-- duration and success/failure;
-- coarse error class;
-- connection/reconnect status.
+```text
+error  unrecoverable local/transport failures
+warn   failed calls, disconnects, malformed relay events
+info   startup/deploy/connect transitions and calls slower than 30 seconds
+debug  routine successful calls, shortened correlation IDs, cancellation/reconnect details
+```
 
-They intentionally omit:
+Foreground mode defaults to `info`; autostart uses `warn`. Use `--verbose` or `--log-level debug` only for diagnosis. `--quiet` is an alias for `--log-level error`.
 
-- file contents and image data;
-- write, edit, or patch payloads;
-- command argv, shell text, stdin, stdout, and stderr;
-- MCP connection passwords, daemon secrets, authorization codes, and access tokens;
-- full request bodies.
+Normal logs intentionally omit tool arguments, file/patch/image content, command text and argv, stdin/stdout/stderr, OAuth request bodies, connection credentials, authorization codes, and tokens. Unexpected daemon and Worker failures use coarse error classes rather than raw exception messages. Messages and structured fields are bounded and secret-like fields/token formats are redacted.
 
-Unexpected Worker failures log endpoint path and error class rather than raw exception messages. Cloudflare observability is sampled and is not a complete audit log.
+See [LOGGING.md](LOGGING.md) for the event contract and MCP-host boundary. Cloudflare observability is sampled and is not a complete audit log.
 
 ## Reconnect and replacement
 
@@ -62,22 +58,32 @@ Defense-in-depth limits include:
 
 ## Upgrade behavior
 
-Version 0.4.1 changes the default for newly selected workspaces to the maximum-permission `full` profile. Existing state retains its saved policy. To intentionally migrate an older workspace to the new default:
+Version 0.5 records policy origin and revision. A state entry matching the exact legacy implicit-default shape—write enabled, shell enabled, workspace-confined paths, isolated environment, and relative output—is migrated once to the current `full` default. Explicit named profiles and identified custom policies are preserved.
+
+`full` enables writes, direct processes, process sessions, shell execution, unrestricted direct filesystem paths, absolute path output, and the complete parent environment. It does not override operating-system access controls or independent MCP-host/platform policy.
+
+Inspect effective policy with:
 
 ```sh
-machine-mcp --workspace /path/to/project --profile full
+machine-mcp status
+machine-mcp doctor
 ```
 
-`full` enables writes, direct processes, process sessions, shell execution, unrestricted direct filesystem paths, absolute path output, and the complete parent environment. Use `agent`, `edit`, or `review` when that authority is unnecessary.
+Select a policy explicitly with:
+
+```sh
+machine-mcp --workspace /path/to/project --profile full
+machine-mcp --workspace /path/to/project --profile agent
+```
 
-A remote policy change is saved locally, propagated in the daemon handshake, and persisted in the autostart definition.
+A remote policy change is saved locally, propagated in the daemon handshake, and loaded by autostart from owner-only state.
 
 ## Incident response
 
 After suspected credential or client compromise:
 
 1. stop foreground and autostart daemons;
-2. run `machine-mcp rotate-secrets --no-print-credentials`;
+2. run `machine-mcp rotate-secrets`;
 3. restart without broad flags and redeploy;
 4. inspect Cloudflare account access, Worker configuration, local state permissions, and service logs;
 5. remove the Worker and local state if continued remote access is unnecessary.

package/docs/TESTING.md

@@ -24,8 +24,9 @@ The suite includes:
 - isolated command HOME/temp/cache behavior;
 - one-shot timeout, descendant termination, cancellation, and process-session interaction;
 - daemon/startup locking and state corruption recovery;
-- guarded state-root removal and legacy-state migration;
-- log redaction, control-character handling, and service-log trimming;
+- guarded state-root removal, schema migration, policy-origin persistence, and legacy implicit-default migration;
+- no filename-based sensitive-file denial under unrestricted policy;
+- log redaction, control-character handling, message/field bounds, default success-log suppression, and service warning-level configuration;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization, discovery, calls, rich content, sessions, cancellation, and continued responsiveness;
 - live local Worker OAuth registration, consent, PKCE, token replay rejection, throttling, CORS, protocol negotiation, dynamic tool advertisement, rich content, daemon replacement, and cancellation.
@@ -34,12 +35,13 @@ The suite includes:
 
 ```sh
 npm run worker:dry-run
+npm audit --audit-level=high
 npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 npm run version:check
 ```
 
-GitHub Actions executes the main suite on Linux, macOS, and Windows. Node 22 and 24 are covered on Linux; Node 22 is covered on macOS and Windows. A separate package-audit job runs production dependency auditing and a dry-run package build. Dependency and GitHub Actions updates are monitored by Dependabot.
+GitHub Actions executes the main suite on Linux, macOS, and Windows. Node 22 and 24 are covered on Linux; Node 22 is covered on macOS and Windows. A separate package-audit job audits both the complete dependency graph and the production-only graph, then performs a dry-run package build. Dependency and GitHub Actions updates are monitored by Dependabot.
 
 ## Test design rules
 
@@ -48,4 +50,5 @@ GitHub Actions executes the main suite on Linux, macOS, and Windows. Node 22 and
 - Every bounded resource needs an over-limit test.
 - Every multi-stage mutation needs a no-partial-commit test.
 - Every remote call correlation change needs daemon replacement and cancellation coverage.
-- Logs and public metadata should be tested for absence of sensitive fields, not only presence of expected fields.
+- Logs and public metadata should be tested for absence of sensitive fields, arguments, outputs, and routine success noise—not only presence of expected fields.
+- Cross-platform tests must avoid shell syntax, URL-path conversion, and executable-shim assumptions specific to one operating system.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Cross-client MCP bridge for policy-controlled local files, Git, images, patches, and processes over stdio or OAuth-protected remote relay.",
   "type": "module",
   "license": "MIT",
@@ -50,12 +50,12 @@
     "catalog:test": "node tests/catalog-test.mjs"
   },
   "dependencies": {
-    "wrangler": "^4.110.0",
-    "ws": "^8.18.3"
+    "wrangler": "4.110.0",
+    "ws": "8.21.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "typescript": "^5.9.3"
+    "typescript": "^7.0.2"
   },
   "keywords": [
     "mcp",