machine-bridge-mcp 0.4.2 → 0.5.0

package/src/local/state.mjs

@@ -1,12 +1,16 @@
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
 
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
-export const appName = "machine-bridge-mcp";
+export const appName = String(serverMetadata.name);
 const STATE_MARKER = ".machine-bridge-mcp-state";
+const MAX_STATE_JSON_BYTES = 2 * 1024 * 1024;
+const MAX_LOCK_BYTES = 64 * 1024;
+const MAX_MARKER_BYTES = 4096;
 
 export function expandHome(input = "") {
   if (!input || input === "~") return os.homedir();
@@ -29,7 +33,7 @@ export function defaultStateRoot() {
 }
 
 
-export function configPath(stateRoot = defaultStateRoot()) {
+function configPath(stateRoot = defaultStateRoot()) {
   return path.join(expandHome(stateRoot), "config.json");
 }
 
@@ -78,13 +82,10 @@ export function workspaceHash(workspace) {
   return createHash("sha256").update(String(workspace)).digest("hex").slice(0, 24);
 }
 
-export function profileDirForWorkspace(workspace, stateRoot = defaultStateRoot()) {
+function profileDirForWorkspace(workspace, stateRoot = defaultStateRoot()) {
   return path.join(expandHome(stateRoot), "profiles", workspaceHash(workspace));
 }
 
-export function statePathForWorkspace(workspace, stateRoot = defaultStateRoot()) {
-  return path.join(profileDirForWorkspace(workspace, stateRoot), "state.json");
-}
 
 export function loadState(workspace, options = {}) {
   const stateRoot = ensureStateRoot(options.stateDir ? expandHome(options.stateDir) : defaultStateRoot());
@@ -96,7 +97,7 @@ export function loadState(workspace, options = {}) {
     ownerOnlyFile(statePath);
     state = readJsonObjectOrBackup(statePath);
   }
-  state.schemaVersion = 3;
+  state.schemaVersion = 4;
   state.workspace = {
     path: workspace,
     hash: workspaceHash(workspace),
@@ -189,7 +190,7 @@ function releaseProcessLock(lockPath, token) {
 
 export function readDaemonLockOwner(lockPath) {
   try {
-    const parsed = JSON.parse(readFileSync(lockPath, "utf8"));
+    const parsed = JSON.parse(readBoundedUtf8(lockPath, MAX_LOCK_BYTES, "lock file"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -207,9 +208,31 @@ function isPidAlive(pid) {
   }
 }
 
+function readBoundedUtf8(filePath, maxBytes, label) {
+  const pathInfo = lstatSync(filePath);
+  if (pathInfo.isSymbolicLink()) throw new Error(`${label} must not be a symbolic link`);
+  const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
+  const fd = openSync(filePath, Number(fsConstants.O_RDONLY) | noFollow);
+  try {
+    const info = fstatSync(fd);
+    if (!info.isFile()) throw new Error(`${label} is not a regular file`);
+    if (info.size > maxBytes) throw new Error(`${label} exceeds ${maxBytes} bytes`);
+    const buffer = Buffer.alloc(info.size);
+    let offset = 0;
+    while (offset < buffer.length) {
+      const count = readSync(fd, buffer, offset, buffer.length - offset, offset);
+      if (count === 0) break;
+      offset += count;
+    }
+    return buffer.subarray(0, offset).toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+
 function readJsonObjectOrBackup(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+    const parsed = JSON.parse(readBoundedUtf8(filePath, MAX_STATE_JSON_BYTES, "state JSON"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("JSON root must be an object");
     return parsed;
   } catch {
@@ -286,7 +309,7 @@ function assertSafeStateRootForRemoval(root) {
 }
 
 function assertValidStateMarker(marker, options = {}) {
-  const content = readFileSync(marker, "utf8");
+  const content = readBoundedUtf8(marker, MAX_MARKER_BYTES, "state marker");
   try {
     const value = JSON.parse(content);
     if (value?.app === appName && value?.schema === 1) return;
@@ -315,7 +338,7 @@ function stateRootMatchesRecordedWorkspace(root) {
       if (!entry.isDirectory()) continue;
       const stateFile = path.join(profiles, entry.name, "state.json");
       if (!existsSync(stateFile)) continue;
-      const value = JSON.parse(readFileSync(stateFile, "utf8"));
+      const value = JSON.parse(readBoundedUtf8(stateFile, MAX_STATE_JSON_BYTES, "state JSON"));
       if (typeof value?.workspace?.path !== "string") continue;
       try { if (realpathSync(value.workspace.path) === root) return true; } catch {}
     }
@@ -327,7 +350,7 @@ function isRecognizableLegacyStateRoot(root) {
   const config = path.join(root, "config.json");
   try {
     if (existsSync(config)) {
-      const value = JSON.parse(readFileSync(config, "utf8"));
+      const value = JSON.parse(readBoundedUtf8(config, MAX_STATE_JSON_BYTES, "config JSON"));
       if (
         value &&
         typeof value.selectedWorkspace === "string" &&
@@ -343,7 +366,7 @@ function isRecognizableLegacyStateRoot(root) {
       if (!entry.isDirectory() || !/^[a-f0-9]{24}$/.test(entry.name)) continue;
       const stateFile = path.join(profiles, entry.name, "state.json");
       if (!existsSync(stateFile)) continue;
-      const value = JSON.parse(readFileSync(stateFile, "utf8"));
+      const value = JSON.parse(readBoundedUtf8(stateFile, MAX_STATE_JSON_BYTES, "state JSON"));
       if (value?.workspace?.hash === entry.name && typeof value?.workspace?.path === "string") return true;
     }
   } catch {}
@@ -354,11 +377,13 @@ function atomicWriteJson(filePath, value) {
   const dir = path.dirname(filePath);
   ensureOwnerOnlyDir(dir);
   cleanupStaleAtomicTemps(dir, path.basename(filePath));
+  const serialized = `${JSON.stringify(value, null, 2)}\n`;
+  if (Buffer.byteLength(serialized) > MAX_STATE_JSON_BYTES) throw new Error(`state JSON exceeds ${MAX_STATE_JSON_BYTES} bytes`);
   const tempPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
   let fd;
   try {
     fd = openSync(tempPath, "wx", 0o600);
-    writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+    writeFileSync(fd, serialized, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
@@ -412,11 +437,11 @@ export function ensureWorkerSecrets(state, options = {}) {
   if (!state.worker.name || options.workerName) state.worker.name = options.workerName || defaultWorkerName(state.workspace.hash);
 }
 
-export function defaultWorkerName(hash) {
+function defaultWorkerName(hash) {
   return `mbm-${String(hash || "default").slice(0, 12)}`;
 }
 
-export function randomToken(prefix) {
+function randomToken(prefix) {
   return `${prefix}_${randomBytes(32).toString("base64url")}`;
 }
 
@@ -424,9 +449,6 @@ export function sha256(value) {
   return createHash("sha256").update(String(value)).digest("hex");
 }
 
-export function fileSha256(filePath) {
-  return createHash("sha256").update(readFileSync(filePath)).digest("hex");
-}
 
 export function ensureOwnerOnlyDir(dir) {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -434,6 +456,9 @@ export function ensureOwnerOnlyDir(dir) {
 }
 
 export function ownerOnlyFile(filePath) {
+  const info = lstatSync(filePath);
+  if (info.isSymbolicLink()) throw new Error(`owner-only file must not be a symbolic link: ${filePath}`);
+  if (!info.isFile()) throw new Error(`owner-only path is not a regular file: ${filePath}`);
   try { chmodSync(filePath, 0o600); } catch {}
 }
 

package/src/local/stdio.mjs

@@ -2,11 +2,12 @@ import readline from "node:readline";
 import { readFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { LocalDaemon } from "./daemon.mjs";
-import { formatFields, sanitizeLogText } from "./log.mjs";
+import { classifyOperationalError, createLogger } from "./log.mjs";
 import {
   MCP_INSTRUCTIONS,
   MCP_PROTOCOL_VERSION,
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
+  SERVER_NAME,
   rpcError,
   rpcResult,
   toolResult,
@@ -14,10 +15,11 @@ import {
 } from "./tools.mjs";
 
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
+const SLOW_TOOL_CALL_MS = 30_000;
 const PACKAGE_VERSION = String(JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version);
 
-export async function runStdioServer({ workspace, policy, verbose = false }) {
-  const logger = stderrLogger(verbose);
+export async function runStdioServer({ workspace, policy, logLevel = "info" }) {
+  const logger = createLogger({ component: "stdio", level: logLevel, stderrOnly: true, color: false });
   const runtime = new LocalDaemon({ workspace, policy, logger });
   const pending = new Map();
   let negotiatedVersion = MCP_PROTOCOL_VERSION;
@@ -40,7 +42,7 @@ export async function runStdioServer({ workspace, policy, verbose = false }) {
       return;
     }
     void handleLine(line).catch((error) => {
-      logger.error("stdio request handler failed", { error: errorMessage(error) });
+      logger.error("stdio request handler failed", { error_class: classifyOperationalError(error) });
     });
   });
 
@@ -74,7 +76,7 @@ export async function runStdioServer({ workspace, policy, verbose = false }) {
         protocolVersion: negotiatedVersion,
         capabilities: { tools: { listChanged: false }, logging: {} },
         serverInfo: {
-          name: "machine-bridge-mcp",
+          name: SERVER_NAME,
           title: "Machine Bridge MCP",
           version: PACKAGE_VERSION,
           description: "Workspace-scoped local coding tools over MCP stdio or authenticated remote relay.",
@@ -128,11 +130,15 @@ export async function runStdioServer({ workspace, policy, verbose = false }) {
       try {
         const result = await runtime.executeTool(name, args, { callId });
         send(rpcResult(message.id, toolResult(result)));
-        logger.info("tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: Date.now() - started, ok: true });
+        const durationMs = Date.now() - started;
+        if (durationMs >= SLOW_TOOL_CALL_MS) logger.info("slow tool call completed", { tool: name, duration_ms: durationMs });
+        else logger.debug("tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs });
       } catch (error) {
         const safeError = runtime.safeErrorMessage(error);
         send(rpcResult(message.id, toolResult({ error: safeError }, true)));
-        logger.warn("tool call failed", { call_id: callId.slice(0, 20), tool: name, duration_ms: Date.now() - started, ok: false, error_class: classifyError(error) });
+        const durationMs = Date.now() - started;
+        logger.warn("tool call failed", { tool: name, duration_ms: durationMs, error_class: classifyOperationalError(error) });
+        logger.debug("tool call failure correlation", { call_id: callId.slice(0, 20) });
       } finally {
         if (key) pending.delete(key);
         runtime.finishCall(callId);
@@ -162,33 +168,3 @@ function jsonRpcIdKey(value) {
 function asObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-
-function classifyError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  if (/cancel/i.test(message)) return "cancelled";
-  if (/timed out/i.test(message)) return "timeout";
-  if (/outside the configured workspace/i.test(message)) return "path_boundary";
-  if (/disabled|requires .* mode/i.test(message)) return "policy_denied";
-  if (/not found|ENOENT/i.test(message)) return "not_found";
-  if (/permission|EACCES|EPERM/i.test(message)) return "permission_denied";
-  if (/maximum|exceeds|max_bytes|too many/i.test(message)) return "limit_exceeded";
-  if (/invalid|must|requires|ambiguous|mismatch/i.test(message)) return "invalid_request";
-  return "execution_failed";
-}
-
-function errorMessage(error) {
-  return sanitizeLogText(error instanceof Error ? error.message : String(error)).slice(0, 4096) || "tool call failed";
-}
-
-function stderrLogger(verbose) {
-  const write = (level, message, fields) => {
-    if (level === "debug" && !verbose) return;
-    process.stderr.write(`[${level}] stdio: ${sanitizeLogText(message)}${formatFields(fields)}\n`);
-  };
-  return {
-    info(message, fields) { write("info", message, fields); },
-    warn(message, fields) { write("warn", message, fields); },
-    error(message, fields) { write("error", message, fields); },
-    debug(message, fields) { write("debug", message, fields); },
-  };
-}

package/src/local/tools.mjs

@@ -1,16 +1,30 @@
 import catalog from "../shared/tool-catalog.json" with { type: "json" };
+import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
 
-export const MCP_PROTOCOL_VERSION = "2025-11-25";
-export const MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"];
+export const SERVER_NAME = String(serverMetadata.name);
+export const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
+export const MCP_SUPPORTED_PROTOCOL_VERSIONS = Object.freeze(serverMetadata.supportedProtocolVersions.map((value) => String(value)));
 
-export const MCP_INSTRUCTIONS = [
-  "You are connected to a local workspace through machine-bridge-mcp.",
-  "Remote mode uses a Cloudflare relay; stdio mode runs entirely on the local machine.",
-  "File and command operations execute on the user's local runtime, not in the Worker.",
-  "Relative paths use the configured workspace. Direct filesystem tools are workspace-scoped unless unrestricted paths are explicitly enabled.",
-  "run_process avoids shell parsing but is not an OS sandbox. exec_command is only exposed in shell execution mode and has the local user's authority.",
-  "Inspect before editing, prefer edit_file or apply_patch over whole-file replacement, and report commands that were run.",
-].join("\n");
+export const MCP_INSTRUCTIONS = Object.freeze(serverMetadata.instructions.map((value) => String(value))).join("\n");
+
+
+export const DEFAULT_POLICY_PROFILE = "full";
+export const DEFAULT_POLICY_REVISION = 2;
+
+export const POLICY_PROFILES = Object.freeze({
+  review: Object.freeze({ profile: "review", allowWrite: false, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
+  edit: Object.freeze({ profile: "edit", allowWrite: true, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
+  agent: Object.freeze({ profile: "agent", allowWrite: true, execMode: "direct", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
+  full: Object.freeze({ profile: "full", allowWrite: true, execMode: "shell", unrestrictedPaths: true, minimalEnv: false, exposeAbsolutePaths: true }),
+});
+
+const POLICY_ORIGINS = new Set(["default", "explicit", "custom", "migrated", "legacy-preserved"]);
+
+export function policyProfile(name, origin = "explicit") {
+  const profile = String(name || "").trim().toLowerCase();
+  if (!POLICY_PROFILES[profile]) throw new Error(`unknown policy profile: ${profile}`);
+  return normalizePolicy({ ...POLICY_PROFILES[profile], origin, revision: DEFAULT_POLICY_REVISION });
+}
 
 export function normalizePolicy(policy = {}) {
   const execMode = ["off", "direct", "shell"].includes(policy.execMode)
@@ -18,8 +32,12 @@ export function normalizePolicy(policy = {}) {
     : policy.allowExec === true
       ? "shell"
       : "off";
+  const origin = POLICY_ORIGINS.has(policy.origin) ? policy.origin : "custom";
+  const revision = Number.isInteger(policy.revision) && policy.revision > 0 ? policy.revision : DEFAULT_POLICY_REVISION;
   return {
     profile: typeof policy.profile === "string" && policy.profile ? policy.profile : "custom",
+    origin,
+    revision,
     allowWrite: policy.allowWrite === true,
     allowExec: execMode !== "off",
     execMode,
@@ -44,9 +62,6 @@ export function allToolNames() {
   return catalog.map((tool) => tool.name);
 }
 
-export function findTool(name) {
-  return catalog.find((tool) => tool.name === name) || null;
-}
 
 export function toolResult(value, isError = false) {
   const special = specialMcpResult(value);

package/src/shared/server-metadata.json

@@ -0,0 +1,17 @@
+{
+  "name": "machine-bridge-mcp",
+  "protocolVersion": "2025-11-25",
+  "supportedProtocolVersions": [
+    "2025-11-25",
+    "2025-06-18",
+    "2025-03-26"
+  ],
+  "instructions": [
+    "You are connected to a local workspace through machine-bridge-mcp.",
+    "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
+    "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
+    "Filename sensitivity is not classified by this server; the MCP host may enforce additional independent rules.",
+    "run_process avoids shell parsing but is not an OS sandbox. exec_command is exposed only in shell mode and has the local user's authority.",
+    "Inspect before editing, prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run."
+  ]
+}

package/src/shared/tool-catalog.json

@@ -34,7 +34,7 @@
   {
     "name": "list_roots",
     "title": "List workspace roots",
-    "description": "List filesystem roots exposed by the local runtime. Paths are workspace-relative unless absolute-path output is explicitly enabled.",
+    "description": "List filesystem roots exposed by the active local policy. The default full profile exposes local filesystem roots and returns absolute paths.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -100,7 +100,7 @@
   {
     "name": "read_file",
     "title": "Read text file",
-    "description": "Read a UTF-8 file or an inclusive 1-based line range. Filesystem paths are workspace-scoped unless unrestricted paths are explicitly enabled.",
+    "description": "Read a UTF-8 regular file or an inclusive 1-based line range. The server does not block sensitive-looking filenames; access follows the active local policy and operating-system permissions.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,

package/src/worker/index.ts

@@ -1,10 +1,11 @@
 import { DurableObject } from "cloudflare:workers";
 import toolCatalog from "../shared/tool-catalog.json";
+import serverMetadata from "../shared/server-metadata.json";
 
-const SERVER_NAME = "machine-bridge-mcp";
-const SERVER_VERSION = "0.4.2";
-const MCP_PROTOCOL_VERSION = "2025-11-25";
-const MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26"] as const;
+const SERVER_NAME = String(serverMetadata.name);
+const SERVER_VERSION = "0.5.0";
+const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
+const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
@@ -121,13 +122,8 @@ const allCatalogTools = toolCatalog as ToolDefinition[];
 const serverInfoTool = publicTool(allCatalogTools.find((tool) => tool.name === "server_info")!);
 const workspaceTools = allCatalogTools.filter((tool) => tool.name !== "server_info").map(publicTool);
 
-const MCP_INSTRUCTIONS = [
-  "You are connected to a local workspace through machine-bridge-mcp.",
-  "The Cloudflare Worker authenticates and relays calls; file and command operations execute on the user's local runtime.",
-  "Relative paths use the configured workspace. Direct filesystem tools are workspace-scoped unless unrestricted paths are explicitly enabled.",
-  "run_process avoids shell parsing but is not an OS sandbox. exec_command is only exposed in shell mode and has the local user's authority.",
-  "Prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run.",
-].join("\n");
+const MCP_INSTRUCTIONS = serverMetadata.instructions.map((value) => String(value)).join("\n");
+
 
 function publicTool(tool: ToolDefinition): ToolDefinition {
   const { availability: _availability, ...definition } = tool;
@@ -1001,8 +997,14 @@ function daemonPolicyAllows(availability: unknown, policy: Record<string, unknow
 function sanitizeDaemonPolicy(value: unknown): Record<string, unknown> {
   const policy = asObject(value);
   const execMode = policy.execMode === "shell" || policy.execMode === "direct" ? policy.execMode : "off";
+  const origin = sanitizeMetadataText(policy.origin, 32);
+  const revision = Number.isInteger(policy.revision) && Number(policy.revision) > 0
+    ? Math.min(Number(policy.revision), 1_000_000)
+    : 1;
   return {
     profile: sanitizeMetadataText(policy.profile, 32) ?? "custom",
+    origin: ["default", "explicit", "custom", "migrated", "legacy-preserved"].includes(origin ?? "") ? origin : "custom",
+    revision,
     allowWrite: policy.allowWrite === true,
     allowExec: execMode !== "off",
     execMode,