machine-bridge-mcp 0.5.0 → 0.6.2

package/src/local/resource-operations.mjs

@@ -0,0 +1,66 @@
+import { realpathSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { inspectResourceFile, validateResourceName } from "./managed-jobs.mjs";
+import { generateSshKeyPair } from "./ssh-key.mjs";
+import { acquireStartupLock, loadState, saveState } from "./state.mjs";
+
+export async function generateRegisteredSshKey({ workspace, stateDir, name: rawName, targetPath, comment = "" }) {
+  const name = validateResourceName(rawName);
+  if (typeof targetPath !== "string" || !targetPath.trim()) throw new Error("SSH private key target path is required");
+  const target = resolve(targetPath);
+  const state = loadState(workspace, { stateDir });
+  const lock = acquireStartupLock(state);
+  if (!lock.acquired) throw new Error("another state-changing operation is already running for this workspace");
+  let key = null;
+  try {
+    state.resources ||= {};
+    const existing = state.resources[name];
+    if (existing?.path && !samePathIdentity(existing.path, target)) {
+      throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
+    }
+    if (!existing && Object.keys(state.resources).length >= 64) throw new Error("local resource registry limit reached (64)");
+    key = await generateSshKeyPair({
+      privateKeyPath: target,
+      type: "ed25519",
+      comment: comment || `machine-mcp:${name}`,
+    });
+    const inspected = inspectResourceFile(key.privateKeyPath);
+    state.resources[name] = inspected;
+    try {
+      saveState(state);
+    } catch (error) {
+      if (key.created) {
+        await rm(key.privateKeyPath, { force: true }).catch(() => {});
+        await rm(key.publicKeyPath, { force: true }).catch(() => {});
+      }
+      throw error;
+    }
+    return {
+      name,
+      created: key.created,
+      registered: true,
+      privateKeyPath: key.privateKeyPath,
+      publicKeyPath: key.publicKeyPath,
+      fingerprint: key.fingerprint,
+      keyType: key.publicKeyType,
+      privateMode: key.privateMode,
+      publicMode: key.publicMode,
+      privateKeyContentExposed: false,
+      availableToNewJobsImmediately: true,
+    };
+  } finally {
+    lock.release();
+  }
+}
+
+function samePathIdentity(left, right) {
+  const a = canonicalIfExisting(left);
+  const b = canonicalIfExisting(right);
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+function canonicalIfExisting(value) {
+  const absolute = resolve(String(value));
+  try { return realpathSync.native ? realpathSync.native(absolute) : realpathSync(absolute); } catch { return absolute; }
+}

package/src/local/ssh-key.mjs

@@ -0,0 +1,125 @@
+import { constants as fsConstants } from "node:fs";
+import { chmod, copyFile, link, lstat, mkdir, readFile, rm, stat, unlink } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { run } from "./shell.mjs";
+
+const KEY_TYPES = new Set(["ed25519", "rsa"]);
+
+export async function generateSshKeyPair(options = {}) {
+  const privateKeyPath = resolve(String(options.privateKeyPath || ""));
+  if (!privateKeyPath || privateKeyPath === resolve(".")) throw new Error("private key path is required");
+  const publicKeyPath = `${privateKeyPath}.pub`;
+  const type = String(options.type || "ed25519").toLowerCase();
+  if (!KEY_TYPES.has(type)) throw new Error("SSH key type must be ed25519 or rsa");
+  const comment = boundedComment(options.comment || `machine-mcp:${basename(privateKeyPath)}`);
+  const parent = dirname(privateKeyPath);
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(parent, 0o700);
+
+  const privateInfo = await safeLstat(privateKeyPath);
+  const publicInfo = await safeLstat(publicKeyPath);
+  if (privateInfo?.isSymbolicLink() || publicInfo?.isSymbolicLink()) throw new Error("SSH key path must not be a symbolic link");
+  if (privateInfo || publicInfo) {
+    if (!privateInfo?.isFile() || !publicInfo?.isFile()) throw new Error("SSH key pair is incomplete or not a pair of regular files");
+    await secureKeyModes(privateKeyPath, publicKeyPath);
+    return inspectSshKeyPair(privateKeyPath, publicKeyPath, false);
+  }
+
+  const suffix = `${process.pid}-${randomBytes(8).toString("hex")}`;
+  const tempPrivate = resolve(parent, `.${basename(privateKeyPath)}.mbm-${suffix}`);
+  const tempPublic = `${tempPrivate}.pub`;
+  try {
+    const args = ["-q", "-t", type];
+    if (type === "rsa") args.push("-b", String(normalizeRsaBits(options.bits)));
+    args.push("-N", "", "-f", tempPrivate, "-C", comment);
+    const generated = await run("ssh-keygen", args, { capture: true, timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
+    if (generated.code !== 0) throw new Error("ssh-keygen failed");
+    await secureKeyModes(tempPrivate, tempPublic);
+    await installNoReplace(tempPrivate, privateKeyPath);
+    try {
+      await installNoReplace(tempPublic, publicKeyPath);
+    } catch (error) {
+      await rm(privateKeyPath, { force: true });
+      throw error;
+    }
+    await secureKeyModes(privateKeyPath, publicKeyPath);
+    return inspectSshKeyPair(privateKeyPath, publicKeyPath, true);
+  } finally {
+    await rm(tempPrivate, { force: true });
+    await rm(tempPublic, { force: true });
+  }
+}
+
+export async function inspectSshKeyPair(privateKeyPath, publicKeyPath = `${privateKeyPath}.pub`, created = false) {
+  const privateInfo = await stat(privateKeyPath);
+  const publicInfo = await stat(publicKeyPath);
+  if (!privateInfo.isFile() || !publicInfo.isFile()) throw new Error("SSH key pair is not composed of regular files");
+  const derived = await run("ssh-keygen", ["-y", "-P", "", "-f", privateKeyPath], {
+    capture: true,
+    allowFailure: true,
+    timeoutMs: 15_000,
+    maxOutputBytes: 64 * 1024,
+  });
+  if (derived.code !== 0) throw new Error("SSH private key cannot be used non-interactively or is invalid");
+  const publicLine = (await readFile(publicKeyPath, "utf8")).trim();
+  if (!/^(ssh-ed25519|ssh-rsa)\s+[A-Za-z0-9+/=]+(?:\s+.*)?$/.test(publicLine)) throw new Error("generated SSH public key is invalid");
+  const expectedFields = publicLine.split(/\s+/).slice(0, 2).join(" ");
+  const derivedFields = derived.stdout.trim().split(/\s+/).slice(0, 2).join(" ");
+  if (expectedFields !== derivedFields) throw new Error("SSH public key does not match the private key");
+  const fingerprint = await run("ssh-keygen", ["-lf", publicKeyPath, "-E", "sha256"], {
+    capture: true,
+    timeoutMs: 15_000,
+    maxOutputBytes: 64 * 1024,
+  });
+  return {
+    created,
+    privateKeyPath: resolve(privateKeyPath),
+    publicKeyPath: resolve(publicKeyPath),
+    privateMode: process.platform === "win32" ? null : `0${(privateInfo.mode & 0o777).toString(8)}`,
+    publicMode: process.platform === "win32" ? null : `0${(publicInfo.mode & 0o777).toString(8)}`,
+    fingerprint: fingerprint.stdout.trim(),
+    publicKeyType: publicLine.split(/\s+/, 1)[0],
+  };
+}
+
+async function installNoReplace(source, target) {
+  try {
+    await link(source, target);
+    await unlink(source);
+  } catch (error) {
+    if (error?.code === "EXDEV") {
+      await copyFile(source, target, fsConstants.COPYFILE_EXCL);
+      await unlink(source);
+      return;
+    }
+    if (error?.code === "EEXIST") throw new Error(`refusing to replace existing SSH key file: ${target}`);
+    throw error;
+  }
+}
+
+async function secureKeyModes(privateKeyPath, publicKeyPath) {
+  if (process.platform === "win32") return;
+  await chmod(privateKeyPath, 0o600);
+  await chmod(publicKeyPath, 0o644);
+}
+
+async function safeLstat(path) {
+  try { return await lstat(path); } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function boundedComment(value) {
+  const comment = String(value || "").replace(/[\r\n\0]/g, " ").trim();
+  if (!comment) return "machine-mcp";
+  if (Buffer.byteLength(comment) > 256) throw new Error("SSH key comment exceeds 256 bytes");
+  return comment;
+}
+
+function normalizeRsaBits(value) {
+  const bits = Number.parseInt(String(value || "3072"), 10);
+  if (![2048, 3072, 4096].includes(bits)) throw new Error("RSA bits must be 2048, 3072, or 4096");
+  return bits;
+}

package/src/local/state.mjs

@@ -1,9 +1,10 @@
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 export const appName = String(serverMetadata.name);
@@ -20,7 +21,7 @@ export function expandHome(input = "") {
 
 export function resolveWorkspace(input = process.cwd()) {
   const resolved = path.resolve(expandHome(input));
-  return realpathSync(resolved);
+  return realpathSync.native ? realpathSync.native(resolved) : realpathSync(resolved);
 }
 
 export function defaultStateRoot() {
@@ -52,9 +53,10 @@ export function saveGlobalConfig(config, stateRoot = defaultStateRoot()) {
 
 export function setSelectedWorkspace(workspace, stateRoot = defaultStateRoot()) {
   const root = expandHome(stateRoot);
+  const canonicalWorkspace = resolveWorkspace(workspace);
   const config = loadGlobalConfig(root);
-  config.selectedWorkspace = workspace;
-  config.selectedWorkspaceHash = workspaceHash(workspace);
+  config.selectedWorkspace = canonicalWorkspace;
+  config.selectedWorkspaceHash = workspaceHash(canonicalWorkspace);
   saveGlobalConfig(config, root);
   return config;
 }
@@ -79,7 +81,9 @@ export function removeStateRoot(stateRoot = defaultStateRoot()) {
 }
 
 export function workspaceHash(workspace) {
-  return createHash("sha256").update(String(workspace)).digest("hex").slice(0, 24);
+  const canonical = resolveWorkspace(workspace);
+  const identity = process.platform === "win32" ? canonical.toLowerCase() : canonical;
+  return createHash("sha256").update(identity).digest("hex").slice(0, 24);
 }
 
 function profileDirForWorkspace(workspace, stateRoot = defaultStateRoot()) {
@@ -87,9 +91,43 @@ function profileDirForWorkspace(workspace, stateRoot = defaultStateRoot()) {
 }
 
 
+function matchingLegacyProfileDir(canonicalWorkspace, stateRoot) {
+  const profilesRoot = path.join(stateRoot, "profiles");
+  if (!existsSync(profilesRoot)) return "";
+  const matches = [];
+  for (const entry of readdirSync(profilesRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !/^[a-f0-9]{24}$/.test(entry.name)) continue;
+    const profileDir = path.join(profilesRoot, entry.name);
+    const stateFile = path.join(profileDir, "state.json");
+    if (!existsSync(stateFile)) continue;
+    try {
+      const value = JSON.parse(readBoundedUtf8(stateFile, MAX_STATE_JSON_BYTES, "state JSON"));
+      const storedWorkspace = value?.workspace?.path;
+      if (typeof storedWorkspace !== "string") continue;
+      if (sameWorkspaceIdentity(storedWorkspace, canonicalWorkspace)) matches.push(profileDir);
+    } catch {}
+  }
+  if (matches.length > 1) throw new Error("multiple Machine Bridge profiles refer to the same canonical workspace; remove or merge the duplicate state profiles");
+  return matches[0] || "";
+}
+
+function sameWorkspaceIdentity(left, right) {
+  try {
+    const a = resolveWorkspace(left);
+    const b = resolveWorkspace(right);
+    return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+  } catch {
+    return false;
+  }
+}
+
 export function loadState(workspace, options = {}) {
+  const canonicalWorkspace = resolveWorkspace(workspace);
   const stateRoot = ensureStateRoot(options.stateDir ? expandHome(options.stateDir) : defaultStateRoot());
-  const profileDir = profileDirForWorkspace(workspace, stateRoot);
+  const canonicalProfileDir = profileDirForWorkspace(canonicalWorkspace, stateRoot);
+  const profileDir = existsSync(canonicalProfileDir)
+    ? canonicalProfileDir
+    : matchingLegacyProfileDir(canonicalWorkspace, stateRoot) || canonicalProfileDir;
   const statePath = path.join(profileDir, "state.json");
   ensureOwnerOnlyDir(profileDir);
   let state = {};
@@ -97,15 +135,16 @@ export function loadState(workspace, options = {}) {
     ownerOnlyFile(statePath);
     state = readJsonObjectOrBackup(statePath);
   }
-  state.schemaVersion = 4;
+  state.schemaVersion = 5;
   state.workspace = {
-    path: workspace,
-    hash: workspaceHash(workspace),
+    path: canonicalWorkspace,
+    hash: path.basename(profileDir),
     updatedAt: new Date().toISOString(),
   };
   state.paths = { stateRoot, profileDir, statePath };
   state.worker ||= {};
   state.policy ||= {};
+  state.resources ||= {};
   delete state.localApi;
   return state;
 }
@@ -236,9 +275,9 @@ function readJsonObjectOrBackup(filePath) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("JSON root must be an object");
     return parsed;
   } catch {
-    const backupPath = `${filePath}.corrupt-${Date.now()}`;
+    const backupPath = `${filePath}.corrupt-${Date.now()}-${randomBytes(4).toString("hex")}`;
     try {
-      renameSync(filePath, backupPath);
+      replaceFileSync(filePath, backupPath);
       ownerOnlyFile(backupPath);
       pruneBackups(filePath, 3);
     } catch {}
@@ -387,7 +426,7 @@ function atomicWriteJson(filePath, value) {
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
-    renameSync(tempPath, filePath);
+    replaceFileSync(tempPath, filePath);
     ownerOnlyFile(filePath);
   } catch (error) {
     if (fd !== undefined) {
@@ -467,6 +506,11 @@ export function redactState(state) {
   if (clone.worker?.oauthPassword) clone.worker.oauthPassword = "<redacted>";
   if (clone.worker?.daemonSecret) clone.worker.daemonSecret = "<redacted>";
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
+  if (clone.resources && typeof clone.resources === "object") {
+    for (const value of Object.values(clone.resources)) {
+      if (value && typeof value === "object" && value.path) value.path = "<local-resource-path>";
+    }
+  }
   return clone;
 }
 

package/src/local/stdio.mjs

@@ -18,9 +18,9 @@ const MAX_LINE_BYTES = 8 * 1024 * 1024;
 const SLOW_TOOL_CALL_MS = 30_000;
 const PACKAGE_VERSION = String(JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version);
 
-export async function runStdioServer({ workspace, policy, logLevel = "info" }) {
+export async function runStdioServer({ workspace, policy, logLevel = "info", jobRoot = "", resources = {}, resourceStatePath = "" }) {
   const logger = createLogger({ component: "stdio", level: logLevel, stderrOnly: true, color: false });
-  const runtime = new LocalDaemon({ workspace, policy, logger });
+  const runtime = new LocalDaemon({ workspace, policy, logger, jobRoot, resources, resourceStatePath });
   const pending = new Map();
   let negotiatedVersion = MCP_PROTOCOL_VERSION;
   let initialized = false;
@@ -131,14 +131,12 @@ export async function runStdioServer({ workspace, policy, logLevel = "info" }) {
         const result = await runtime.executeTool(name, args, { callId });
         send(rpcResult(message.id, toolResult(result)));
         const durationMs = Date.now() - started;
-        if (durationMs >= SLOW_TOOL_CALL_MS) logger.info("slow tool call completed", { tool: name, duration_ms: durationMs });
-        else logger.debug("tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs });
+        logger.debug(durationMs >= SLOW_TOOL_CALL_MS ? "slow tool call completed" : "tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs });
       } catch (error) {
         const safeError = runtime.safeErrorMessage(error);
         send(rpcResult(message.id, toolResult({ error: safeError }, true)));
         const durationMs = Date.now() - started;
-        logger.warn("tool call failed", { tool: name, duration_ms: durationMs, error_class: classifyOperationalError(error) });
-        logger.debug("tool call failure correlation", { call_id: callId.slice(0, 20) });
+        logger.debug("tool call failed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs, error_class: classifyOperationalError(error) });
       } finally {
         if (key) pending.delete(key);
         runtime.finishCall(callId);

package/src/local/tools.mjs

@@ -9,7 +9,7 @@ export const MCP_INSTRUCTIONS = Object.freeze(serverMetadata.instructions.map((v
 
 
 export const DEFAULT_POLICY_PROFILE = "full";
-export const DEFAULT_POLICY_REVISION = 2;
+export const DEFAULT_POLICY_REVISION = 3;
 
 export const POLICY_PROFILES = Object.freeze({
   review: Object.freeze({ profile: "review", allowWrite: false, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
@@ -34,8 +34,9 @@ export function normalizePolicy(policy = {}) {
       : "off";
   const origin = POLICY_ORIGINS.has(policy.origin) ? policy.origin : "custom";
   const revision = Number.isInteger(policy.revision) && policy.revision > 0 ? policy.revision : DEFAULT_POLICY_REVISION;
-  return {
-    profile: typeof policy.profile === "string" && policy.profile ? policy.profile : "custom",
+  const requestedProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const normalized = {
+    profile: requestedProfile,
     origin,
     revision,
     allowWrite: policy.allowWrite === true,
@@ -45,6 +46,38 @@ export function normalizePolicy(policy = {}) {
     minimalEnv: policy.minimalEnv !== false,
     exposeAbsolutePaths: policy.exposeAbsolutePaths === true,
   };
+  if (POLICY_PROFILES[requestedProfile]) {
+    const canonical = POLICY_PROFILES[requestedProfile];
+    normalized.allowWrite = canonical.allowWrite;
+    normalized.allowExec = canonical.execMode !== "off";
+    normalized.execMode = canonical.execMode;
+    normalized.unrestrictedPaths = canonical.unrestrictedPaths;
+    normalized.minimalEnv = canonical.minimalEnv;
+    normalized.exposeAbsolutePaths = canonical.exposeAbsolutePaths;
+  }
+  return normalized;
+}
+
+export function isCanonicalFullPolicy(policy = {}) {
+  return policyCapabilitiesEqual(normalizePolicy(policy), POLICY_PROFILES.full);
+}
+
+export function assertCanonicalFullPolicy(policy = {}) {
+  const normalized = normalizePolicy(policy);
+  if (!isCanonicalFullPolicy(normalized) || normalized.profile !== "full") {
+    throw new Error("full profile invariant failed: full must enable writes, shell execution, unrestricted paths, full parent environment, and absolute paths");
+  }
+  const exposed = toolsForPolicy(normalized);
+  if (exposed.length !== catalog.length) throw new Error("full profile invariant failed: complete tool catalog is not exposed");
+  return normalized;
+}
+
+function policyCapabilitiesEqual(left, right) {
+  return left.allowWrite === right.allowWrite
+    && left.execMode === right.execMode
+    && left.unrestrictedPaths === right.unrestrictedPaths
+    && left.minimalEnv === right.minimalEnv
+    && left.exposeAbsolutePaths === right.exposeAbsolutePaths;
 }
 
 export function toolsForPolicy(policy = {}) {
@@ -92,6 +125,7 @@ function isAvailable(availability, policy) {
   if (availability === "write") return policy.allowWrite;
   if (availability === "direct-exec") return policy.execMode === "direct" || policy.execMode === "shell";
   if (availability === "shell-exec") return policy.execMode === "shell";
+  if (availability === "full") return policy.profile === "full" && isCanonicalFullPolicy(policy);
   return false;
 }
 

package/src/shared/server-metadata.json

@@ -10,8 +10,17 @@
     "You are connected to a local workspace through machine-bridge-mcp.",
     "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
     "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
-    "Filename sensitivity is not classified by this server; the MCP host may enforce additional independent rules.",
+    "Filename sensitivity is not classified by this server; the MCP host, connector gateway, local OS, or endpoint-security software may enforce additional independent rules.",
+    "A named full profile is canonical: it always enables writes, shell execution, unrestricted paths, the full parent environment, absolute paths, and the complete tool catalog. Any explicit narrowing is stored as custom.",
+    "Use diagnose_runtime to distinguish a request that reached the daemon from local filesystem, process-spawn, shell, managed-job-storage, and resource failures. A tool call blocked before any response cannot be diagnosed by the server.",
+    "Never request or return secret-file contents when a local resource alias can be used. Resources are registered through the local machine-mcp CLI; under canonical full policy, generate_ssh_key_resource can generate and register an Ed25519 key without returning private content and may be injected by path, stdin, or environment without entering MCP arguments.",
+    "If execution-class tools are unavailable but write access remains, use stage_job to persist a reviewed plan without running it; the operator can launch it locally with machine-mcp job approve JOB_ID.",
+    "For multi-step, remote, long-running, or cleanup-sensitive work, prefer one start_job call with argv steps, job-scoped temporary_files, and idempotent finally_steps. The detached runner continues after MCP disconnects; inspect it with read_job or the local machine-mcp job CLI.",
+    "Prefer sending remote shell programs through a process stdin rather than creating remote helper files. If temporary files are necessary, use {{temp:name}} or explicit finally_steps.",
+    "Managed-job resource redaction is defense in depth, not a guarantee against transformed or partial secret output. Use capture_output=discard for steps that may echo credentials.",
+    "Do not use shell encoding, renaming, or alternate tools to bypass host or platform safety policy.",
     "run_process avoids shell parsing but is not an OS sandbox. exec_command is exposed only in shell mode and has the local user's authority.",
+    "Per-tool success, failure, cancellation, and timing events are debug-only; default logs contain lifecycle and infrastructure events, not a tool-call transcript.",
     "Inspect before editing, prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run."
   ]
 }