machine-bridge-mcp 0.6.0 → 0.6.2

package/src/local/daemon.mjs

@@ -9,9 +9,11 @@ import { applyUpdateHunks, parsePatchEnvelope } from "./patch.mjs";
 import { executionEnv, workspaceShellCommand } from "./shell.mjs";
 import { MAX_COMMAND_BYTES, ProcessSessionManager, terminateProcessTree, validateArgv } from "./process-sessions.mjs";
 export { MAX_COMMAND_BYTES } from "./process-sessions.mjs";
-import { MCP_PROTOCOL_VERSION, MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, SERVER_NAME, toolNamesForPolicy } from "./tools.mjs";
+import { allToolNames, assertCanonicalFullPolicy, isCanonicalFullPolicy, MCP_PROTOCOL_VERSION, MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, POLICY_PROFILES, SERVER_NAME, toolNamesForPolicy } from "./tools.mjs";
 import { classifyOperationalError } from "./log.mjs";
 import { ManagedJobManager } from "./managed-jobs.mjs";
+import { generateRegisteredSshKey } from "./resource-operations.mjs";
+import { expandHome } from "./state.mjs";
 
 export const MAX_WRITE_BYTES = 5 * 1024 * 1024;
 const MAX_WS_MESSAGE_BYTES = 8 * 1024 * 1024;
@@ -33,6 +35,7 @@ export class LocalDaemon {
     this.policy = normalizePolicy(policy);
     this.logger = logger;
     this.onSuperseded = typeof onSuperseded === "function" ? onSuperseded : null;
+    this.resourceStatePath = resourceStatePath ? resolve(resourceStatePath) : "";
     this.closed = false;
     this.ws = null;
     this.heartbeat = null;
@@ -85,6 +88,11 @@ export class LocalDaemon {
       workspace: this.displayPath(this.workspace),
       workspace_name: basename(this.workspace),
       policy: this.policy,
+      policy_contract: {
+        named_profile_is_canonical: this.policy.profile === "custom" || policyMatchesNamedProfile(this.policy),
+        full_catalog_complete: this.policy.profile === "full" ? isCanonicalFullPolicy(this.policy) && this.tools().length + 1 === allToolNames().length : null,
+        machine_bridge_internal_denials_under_full: this.policy.profile === "full" && isCanonicalFullPolicy(this.policy) ? false : null,
+      },
       enforcement: {
         filesystem_scope: this.policy.unrestrictedPaths ? "local-user-accessible" : "workspace",
         sensitive_filename_filter: false,
@@ -92,6 +100,11 @@ export class LocalDaemon {
         host_policy_is_independent: true,
       },
       tools: ["server_info", ...this.tools()],
+      observability: {
+        per_tool_events: "debug-only",
+        default_logs_include_tool_failures: false,
+        tool_arguments_or_results_logged: false,
+      },
       runtime: {
         environment: this.policy.minimalEnv ? "isolated-minimal" : "full-parent",
         runtime_dir: this.policy.exposeAbsolutePaths ? this.runtimeDir : "<private-runtime-dir>",
@@ -251,14 +264,12 @@ export class LocalDaemon {
       if (this.cancelledCalls.has(id)) throw new Error("tool call cancelled");
       this.send({ type: "tool_result", id, ok: true, result });
       const durationMs = Date.now() - started;
-      if (durationMs >= SLOW_TOOL_CALL_MS) this.logger.info?.("slow tool call completed", { tool, duration_ms: durationMs });
-      else this.logger.debug?.("tool call completed", { call_id: shortCallId(id), tool, duration_ms: durationMs });
+      this.logger.debug?.(durationMs >= SLOW_TOOL_CALL_MS ? "slow tool call completed" : "tool call completed", { call_id: shortCallId(id), tool, duration_ms: durationMs });
     } catch (error) {
       const safeError = this.safeErrorMessage(error);
       this.send({ type: "tool_result", id, ok: false, error: { message: safeError } });
       const durationMs = Date.now() - started;
-      this.logger.warn?.("tool call failed", { tool, duration_ms: durationMs, error_class: classifyOperationalError(error) });
-      this.logger.debug?.("tool call failure correlation", { call_id: shortCallId(id) });
+      this.logger.debug?.("tool call failed", { call_id: shortCallId(id), tool, duration_ms: durationMs, error_class: classifyOperationalError(error) });
     } finally {
       clearTimeout(deadline);
       this.activeToolCalls -= 1;
@@ -306,6 +317,7 @@ export class LocalDaemon {
       case "git_show": return this.gitShow(args, context);
       case "diagnose_runtime": return this.diagnoseRuntime(context);
       case "list_local_resources": return this.managedJobManager.listResources();
+      case "generate_ssh_key_resource": return this.generateSshKeyResource(args, context);
       case "stage_job": return this.managedJobManager.stage(args);
       case "start_job": return this.managedJobManager.start(args);
       case "list_jobs": return this.managedJobManager.list(args);
@@ -729,6 +741,37 @@ export class LocalDaemon {
     };
   }
 
+  async generateSshKeyResource(args = {}, context = {}) {
+    this.throwIfCancelled(context);
+    assertCanonicalFullPolicy(this.policy);
+    if (!this.resourceStatePath) throw new Error("local resource state is unavailable in this runtime");
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
+    const target = args.path
+      ? resolve(expandHome(String(args.path)))
+      : resolve(home, ".ssh", `machine-mcp-${args.name}-ed25519`);
+    const key = await generateRegisteredSshKey({
+      workspace: this.workspace,
+      stateDir: stateRootFromProfileStatePath(this.resourceStatePath),
+      name: args.name,
+      targetPath: target,
+      comment: args.comment || `machine-mcp:${args.name}`,
+    });
+    return {
+      name: key.name,
+      created: key.created,
+      registered: key.registered,
+      private_key_path: this.displayPath(key.privateKeyPath),
+      public_key_path: this.displayPath(key.publicKeyPath),
+      fingerprint: key.fingerprint,
+      key_type: key.keyType,
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      private_key_content_exposed: key.privateKeyContentExposed,
+      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+    };
+  }
+
   async runDirectProcess(args, context = {}) {
     if (this.policy.execMode !== "direct" && this.policy.execMode !== "shell") throw new Error("run_process is disabled by daemon policy");
     const argv = validateArgv(args.argv);
@@ -931,6 +974,25 @@ export class LocalDaemon {
   }
 }
 
+function policyMatchesNamedProfile(policy) {
+  const named = POLICY_PROFILES[policy.profile];
+  if (!named) return false;
+  return policy.allowWrite === named.allowWrite
+    && policy.execMode === named.execMode
+    && policy.unrestrictedPaths === named.unrestrictedPaths
+    && policy.minimalEnv === named.minimalEnv
+    && policy.exposeAbsolutePaths === named.exposeAbsolutePaths;
+}
+
+function stateRootFromProfileStatePath(statePath) {
+  const absolute = resolve(statePath);
+  if (basename(absolute) !== "state.json") throw new Error("local resource state path is invalid");
+  const profileDir = dirname(absolute);
+  const profilesDir = dirname(profileDir);
+  if (basename(profilesDir) !== "profiles") throw new Error("local resource state path is outside the expected profile layout");
+  return dirname(profilesDir);
+}
+
 function normalizeWorkerUrl(value) {
   let url;
   try { url = new URL(String(value || "")); } catch { throw new Error("invalid Worker URL"); }

package/src/local/full-access-test.mjs

@@ -0,0 +1,206 @@
+import { chmod, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { LocalDaemon } from "./daemon.mjs";
+import { generateSshKeyPair } from "./ssh-key.mjs";
+import { run } from "./shell.mjs";
+import { allToolNames, assertCanonicalFullPolicy, policyProfile } from "./tools.mjs";
+
+const TERMINAL_JOB_STATES = new Set([
+  "succeeded", "failed", "cancelled", "runner_failed", "runner_launch_failed",
+  "recovery_failed", "recovery_exhausted", "succeeded_cleanup_failed",
+  "failed_cleanup_failed", "cancelled_cleanup_failed",
+]);
+
+export async function runFullAccessTest({ workspace, policy = policyProfile("full", "explicit") } = {}) {
+  const canonicalPolicy = assertCanonicalFullPolicy(policy);
+  const root = await mkdtemp(join(tmpdir(), "machine-mcp-full-test-"));
+  const jobRoot = join(root, "jobs");
+  const outsideDir = join(root, "outside-workspace");
+  const keyPath = join(root, "ssh", "operator-ed25519");
+  const authorizedKeysPath = join(root, "authorized_keys");
+  const mainMarker = join(root, "managed-main.txt");
+  const cleanupMarker = join(root, "managed-cleanup.txt");
+  const checks = [];
+  const sentinelKey = `MBM_FULL_TEST_${Date.now()}`;
+  const previousSentinel = process.env[sentinelKey];
+  process.env[sentinelKey] = "visible";
+  let runtime;
+
+  try {
+    runtime = new LocalDaemon({
+      workspace: resolve(workspace),
+      policy: canonicalPolicy,
+      jobRoot,
+      resources: {},
+      logger: silentLogger(),
+      recoverJobs: false,
+    });
+
+    const toolNames = runtime.tools();
+    checks.push(check("full-policy-invariant", toolNames.length === allToolNames().length - 1, {
+      profile: canonicalPolicy.profile,
+      exposed_tools: toolNames.length + 1,
+      catalog_tools: allToolNames().length,
+    }));
+
+    const outsideFile = join(outsideDir, "outside.txt");
+    const written = await runtime.writeFile({ path: outsideFile, content: "full-outside-write\n", create_only: true });
+    const read = await runtime.readFile(outsideFile, 1024);
+    const canonicalOutsideFile = await realpath(outsideFile);
+    checks.push(check("unrestricted-filesystem", written.ok === true && read.content === "full-outside-write\n", {
+      absolute_path_returned: await equivalentPath(read.path, canonicalOutsideFile),
+    }));
+
+    const direct = await runtime.runDirectProcess({
+      argv: [process.execPath, "-e", "process.stdout.write(process.cwd())"],
+      cwd: outsideDir,
+      timeout_seconds: 10,
+    });
+    checks.push(check("direct-process-outside-workspace", direct.code === 0 && await equivalentPath(direct.stdout.trim(), outsideDir)));
+
+    const inherited = await runtime.runDirectProcess({
+      argv: [process.execPath, "-e", `process.stdout.write(process.env[${JSON.stringify(sentinelKey)}] || '')`],
+      timeout_seconds: 10,
+    });
+    checks.push(check("full-parent-environment", inherited.code === 0 && inherited.stdout === "visible"));
+
+    const shellCommand = process.platform === "win32" ? "[Console]::Out.Write('full-shell')" : "printf full-shell";
+    const shell = await runtime.execCommand(shellCommand, 10);
+    checks.push(check("shell-execution", shell.code === 0 && shell.stdout.trim() === "full-shell"));
+
+    const key = await generateSshKeyPair({
+      privateKeyPath: keyPath,
+      type: "ed25519",
+      comment: "machine-mcp-full-test",
+    });
+    const publicLine = (await readFile(key.publicKeyPath, "utf8")).trim();
+    await runtime.writeFile({ path: authorizedKeysPath, content: `${publicLine}\n`, create_only: true });
+    if (process.platform !== "win32") await chmod(authorizedKeysPath, 0o600);
+    const authorized = await readFile(authorizedKeysPath, "utf8");
+    checks.push(check("ssh-key-generation", key.created && key.publicKeyType === "ssh-ed25519", {
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      fingerprint_available: Boolean(key.fingerprint),
+      private_key_content_exposed: false,
+    }));
+    checks.push(check("authorized-keys-sandbox-write", authorized === `${publicLine}\n`, {
+      target_is_temporary_sandbox: true,
+    }));
+
+    const nullConfig = process.platform === "win32" ? "NUL" : "/dev/null";
+    const sshConfig = await run("ssh", ["-F", nullConfig, "-G", "localhost"], {
+      capture: true,
+      allowFailure: true,
+      timeoutMs: 15_000,
+      maxOutputBytes: 256 * 1024,
+    });
+    checks.push(check("ssh-client", sshConfig.code === 0));
+
+    const gcloud = await run("gcloud", ["--version"], {
+      capture: true,
+      allowFailure: true,
+      timeoutMs: 30_000,
+      maxOutputBytes: 64 * 1024,
+    });
+    const osLoginHelp = gcloud.code === 0
+      ? await run("gcloud", ["help", "compute", "os-login", "ssh-keys", "add"], {
+          capture: true,
+          allowFailure: true,
+          timeoutMs: 30_000,
+          maxOutputBytes: 128 * 1024,
+        })
+      : { code: 127 };
+    checks.push(check("google-cloud-cli", gcloud.code === 0, {
+      os_login_key_command_available: osLoginHelp.code === 0,
+      external_changes_made: false,
+    }));
+
+    const sudo = process.platform === "win32"
+      ? { code: 0, skipped: true }
+      : await run("sudo", ["-n", "true"], {
+          capture: true,
+          allowFailure: true,
+          timeoutMs: 10_000,
+          maxOutputBytes: 16 * 1024,
+        });
+    checks.push({
+      name: "noninteractive-sudo-probe",
+      ok: true,
+      available: process.platform === "win32" ? null : sudo.code === 0,
+      password_or_policy_required: process.platform === "win32" ? null : sudo.code !== 0,
+      skipped: process.platform === "win32",
+      state_changed: false,
+    });
+
+    const accepted = runtime.managedJobManager.start({
+      name: "full access lifecycle test",
+      temporary_files: [{ name: "main.js", content: "require('node:fs').writeFileSync(process.argv[2],'main')" }],
+      steps: [{ argv: [process.execPath, "{{temp:main.js}}", mainMarker], timeout_seconds: 10 }],
+      finally_steps: [{ argv: [process.execPath, "-e", "require('node:fs').writeFileSync(process.argv[1],'cleanup')", cleanupMarker], timeout_seconds: 10 }],
+    });
+    const job = await waitForJob(runtime.managedJobManager, accepted.job_id, 15_000);
+    checks.push(check("detached-managed-job", job.status === "succeeded"
+      && await fileEquals(mainMarker, "main")
+      && await fileEquals(cleanupMarker, "cleanup"), {
+      status: job.status,
+      error_class: job.error_class ?? job.result?.error_class ?? null,
+      cleanup_error_class: job.result?.cleanup_error_class ?? null,
+      cleanup_attempted: true,
+    }));
+
+    const coreChecks = checks.filter((item) => !["google-cloud-cli", "noninteractive-sudo-probe"].includes(item.name));
+    const operatorChecks = checks.filter((item) => ["ssh-key-generation", "authorized-keys-sandbox-write", "ssh-client", "google-cloud-cli"].includes(item.name));
+    return {
+      ok: coreChecks.every((item) => item.ok === true),
+      operator_workflow_ready: operatorChecks.every((item) => item.ok === true),
+      machine: {
+        platform: process.platform,
+        architecture: process.arch,
+        node: process.version,
+      },
+      policy: canonicalPolicy,
+      checks,
+      guarantees: {
+        machine_bridge_internal_policy_denials_under_full: false,
+        host_or_connector_policy_overridden: false,
+        operating_system_policy_overridden: false,
+        external_cloud_or_remote_state_changed: false,
+      },
+    };
+  } finally {
+    runtime?.stop();
+    if (previousSentinel === undefined) delete process.env[sentinelKey];
+    else process.env[sentinelKey] = previousSentinel;
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+async function waitForJob(manager, jobId, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const value = manager.read({ job_id: jobId });
+    if (TERMINAL_JOB_STATES.has(value.status)) return value;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));
+  }
+  throw new Error("full access managed-job test timed out");
+}
+
+async function equivalentPath(left, right) {
+  try { return await realpath(resolve(left)) === await realpath(resolve(right)); } catch { return false; }
+}
+
+async function fileEquals(path, expected) {
+  try { return await readFile(path, "utf8") === expected; } catch { return false; }
+}
+
+function check(name, ok, detail = {}) {
+  return { name, ok: Boolean(ok), ...detail };
+}
+
+function silentLogger() {
+  return {
+    info() {}, success() {}, warn() {}, error() {}, debug() {},
+  };
+}

package/src/local/job-runner.mjs

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { executionEnv } from "./shell.mjs";
 import { terminateProcessTree } from "./process-sessions.mjs";
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 const RESOURCE_TOKEN = /\{\{resource:([a-z][a-z0-9._-]{0,63})\}\}/g;
 const TEMP_TOKEN = /\{\{temp:([a-z][a-z0-9._-]{0,63})\}\}/g;
@@ -419,7 +420,7 @@ function writeJson(file, value, maxBytes) {
   if (Buffer.byteLength(text) > maxBytes) throw new Error(`job JSON exceeds ${maxBytes} bytes`);
   const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   writeFileSync(temp, text, { mode: 0o600, flag: "wx" });
-  renameSync(temp, file);
+  replaceFileSync(temp, file);
   chmodSync(file, 0o600);
 }
 

package/src/local/managed-jobs.mjs

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureOwnerOnlyDir, ownerOnlyFile } from "./state.mjs";
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 const RESOURCE_NAME = /^[a-z][a-z0-9._-]{0,63}$/;
 const JOB_ID = /^job_[A-Za-z0-9_-]{24,}$/;
@@ -747,7 +748,7 @@ function atomicWriteJson(file, value, maxBytes) {
   if (Buffer.byteLength(text) > maxBytes) throw new Error(`JSON exceeds ${maxBytes} bytes`);
   const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   writeFileSync(temp, text, { mode: 0o600, flag: "wx" });
-  renameSync(temp, file);
+  replaceFileSync(temp, file);
   ownerOnlyFile(file);
 }
 

package/src/local/resource-operations.mjs

@@ -0,0 +1,66 @@
+import { realpathSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { inspectResourceFile, validateResourceName } from "./managed-jobs.mjs";
+import { generateSshKeyPair } from "./ssh-key.mjs";
+import { acquireStartupLock, loadState, saveState } from "./state.mjs";
+
+export async function generateRegisteredSshKey({ workspace, stateDir, name: rawName, targetPath, comment = "" }) {
+  const name = validateResourceName(rawName);
+  if (typeof targetPath !== "string" || !targetPath.trim()) throw new Error("SSH private key target path is required");
+  const target = resolve(targetPath);
+  const state = loadState(workspace, { stateDir });
+  const lock = acquireStartupLock(state);
+  if (!lock.acquired) throw new Error("another state-changing operation is already running for this workspace");
+  let key = null;
+  try {
+    state.resources ||= {};
+    const existing = state.resources[name];
+    if (existing?.path && !samePathIdentity(existing.path, target)) {
+      throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
+    }
+    if (!existing && Object.keys(state.resources).length >= 64) throw new Error("local resource registry limit reached (64)");
+    key = await generateSshKeyPair({
+      privateKeyPath: target,
+      type: "ed25519",
+      comment: comment || `machine-mcp:${name}`,
+    });
+    const inspected = inspectResourceFile(key.privateKeyPath);
+    state.resources[name] = inspected;
+    try {
+      saveState(state);
+    } catch (error) {
+      if (key.created) {
+        await rm(key.privateKeyPath, { force: true }).catch(() => {});
+        await rm(key.publicKeyPath, { force: true }).catch(() => {});
+      }
+      throw error;
+    }
+    return {
+      name,
+      created: key.created,
+      registered: true,
+      privateKeyPath: key.privateKeyPath,
+      publicKeyPath: key.publicKeyPath,
+      fingerprint: key.fingerprint,
+      keyType: key.publicKeyType,
+      privateMode: key.privateMode,
+      publicMode: key.publicMode,
+      privateKeyContentExposed: false,
+      availableToNewJobsImmediately: true,
+    };
+  } finally {
+    lock.release();
+  }
+}
+
+function samePathIdentity(left, right) {
+  const a = canonicalIfExisting(left);
+  const b = canonicalIfExisting(right);
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+function canonicalIfExisting(value) {
+  const absolute = resolve(String(value));
+  try { return realpathSync.native ? realpathSync.native(absolute) : realpathSync(absolute); } catch { return absolute; }
+}

package/src/local/ssh-key.mjs

@@ -0,0 +1,125 @@
+import { constants as fsConstants } from "node:fs";
+import { chmod, copyFile, link, lstat, mkdir, readFile, rm, stat, unlink } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { run } from "./shell.mjs";
+
+const KEY_TYPES = new Set(["ed25519", "rsa"]);
+
+export async function generateSshKeyPair(options = {}) {
+  const privateKeyPath = resolve(String(options.privateKeyPath || ""));
+  if (!privateKeyPath || privateKeyPath === resolve(".")) throw new Error("private key path is required");
+  const publicKeyPath = `${privateKeyPath}.pub`;
+  const type = String(options.type || "ed25519").toLowerCase();
+  if (!KEY_TYPES.has(type)) throw new Error("SSH key type must be ed25519 or rsa");
+  const comment = boundedComment(options.comment || `machine-mcp:${basename(privateKeyPath)}`);
+  const parent = dirname(privateKeyPath);
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(parent, 0o700);
+
+  const privateInfo = await safeLstat(privateKeyPath);
+  const publicInfo = await safeLstat(publicKeyPath);
+  if (privateInfo?.isSymbolicLink() || publicInfo?.isSymbolicLink()) throw new Error("SSH key path must not be a symbolic link");
+  if (privateInfo || publicInfo) {
+    if (!privateInfo?.isFile() || !publicInfo?.isFile()) throw new Error("SSH key pair is incomplete or not a pair of regular files");
+    await secureKeyModes(privateKeyPath, publicKeyPath);
+    return inspectSshKeyPair(privateKeyPath, publicKeyPath, false);
+  }
+
+  const suffix = `${process.pid}-${randomBytes(8).toString("hex")}`;
+  const tempPrivate = resolve(parent, `.${basename(privateKeyPath)}.mbm-${suffix}`);
+  const tempPublic = `${tempPrivate}.pub`;
+  try {
+    const args = ["-q", "-t", type];
+    if (type === "rsa") args.push("-b", String(normalizeRsaBits(options.bits)));
+    args.push("-N", "", "-f", tempPrivate, "-C", comment);
+    const generated = await run("ssh-keygen", args, { capture: true, timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
+    if (generated.code !== 0) throw new Error("ssh-keygen failed");
+    await secureKeyModes(tempPrivate, tempPublic);
+    await installNoReplace(tempPrivate, privateKeyPath);
+    try {
+      await installNoReplace(tempPublic, publicKeyPath);
+    } catch (error) {
+      await rm(privateKeyPath, { force: true });
+      throw error;
+    }
+    await secureKeyModes(privateKeyPath, publicKeyPath);
+    return inspectSshKeyPair(privateKeyPath, publicKeyPath, true);
+  } finally {
+    await rm(tempPrivate, { force: true });
+    await rm(tempPublic, { force: true });
+  }
+}
+
+export async function inspectSshKeyPair(privateKeyPath, publicKeyPath = `${privateKeyPath}.pub`, created = false) {
+  const privateInfo = await stat(privateKeyPath);
+  const publicInfo = await stat(publicKeyPath);
+  if (!privateInfo.isFile() || !publicInfo.isFile()) throw new Error("SSH key pair is not composed of regular files");
+  const derived = await run("ssh-keygen", ["-y", "-P", "", "-f", privateKeyPath], {
+    capture: true,
+    allowFailure: true,
+    timeoutMs: 15_000,
+    maxOutputBytes: 64 * 1024,
+  });
+  if (derived.code !== 0) throw new Error("SSH private key cannot be used non-interactively or is invalid");
+  const publicLine = (await readFile(publicKeyPath, "utf8")).trim();
+  if (!/^(ssh-ed25519|ssh-rsa)\s+[A-Za-z0-9+/=]+(?:\s+.*)?$/.test(publicLine)) throw new Error("generated SSH public key is invalid");
+  const expectedFields = publicLine.split(/\s+/).slice(0, 2).join(" ");
+  const derivedFields = derived.stdout.trim().split(/\s+/).slice(0, 2).join(" ");
+  if (expectedFields !== derivedFields) throw new Error("SSH public key does not match the private key");
+  const fingerprint = await run("ssh-keygen", ["-lf", publicKeyPath, "-E", "sha256"], {
+    capture: true,
+    timeoutMs: 15_000,
+    maxOutputBytes: 64 * 1024,
+  });
+  return {
+    created,
+    privateKeyPath: resolve(privateKeyPath),
+    publicKeyPath: resolve(publicKeyPath),
+    privateMode: process.platform === "win32" ? null : `0${(privateInfo.mode & 0o777).toString(8)}`,
+    publicMode: process.platform === "win32" ? null : `0${(publicInfo.mode & 0o777).toString(8)}`,
+    fingerprint: fingerprint.stdout.trim(),
+    publicKeyType: publicLine.split(/\s+/, 1)[0],
+  };
+}
+
+async function installNoReplace(source, target) {
+  try {
+    await link(source, target);
+    await unlink(source);
+  } catch (error) {
+    if (error?.code === "EXDEV") {
+      await copyFile(source, target, fsConstants.COPYFILE_EXCL);
+      await unlink(source);
+      return;
+    }
+    if (error?.code === "EEXIST") throw new Error(`refusing to replace existing SSH key file: ${target}`);
+    throw error;
+  }
+}
+
+async function secureKeyModes(privateKeyPath, publicKeyPath) {
+  if (process.platform === "win32") return;
+  await chmod(privateKeyPath, 0o600);
+  await chmod(publicKeyPath, 0o644);
+}
+
+async function safeLstat(path) {
+  try { return await lstat(path); } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function boundedComment(value) {
+  const comment = String(value || "").replace(/[\r\n\0]/g, " ").trim();
+  if (!comment) return "machine-mcp";
+  if (Buffer.byteLength(comment) > 256) throw new Error("SSH key comment exceeds 256 bytes");
+  return comment;
+}
+
+function normalizeRsaBits(value) {
+  const bits = Number.parseInt(String(value || "3072"), 10);
+  if (![2048, 3072, 4096].includes(bits)) throw new Error("RSA bits must be 2048, 3072, or 4096");
+  return bits;
+}

package/src/local/state.mjs

@@ -1,9 +1,10 @@
 import { createHash, randomBytes } from "node:crypto";
-import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, writeFileSync, chmodSync, realpathSync, rmSync, unlinkSync, readdirSync, statSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 export const appName = String(serverMetadata.name);
@@ -274,9 +275,9 @@ function readJsonObjectOrBackup(filePath) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("JSON root must be an object");
     return parsed;
   } catch {
-    const backupPath = `${filePath}.corrupt-${Date.now()}`;
+    const backupPath = `${filePath}.corrupt-${Date.now()}-${randomBytes(4).toString("hex")}`;
     try {
-      renameSync(filePath, backupPath);
+      replaceFileSync(filePath, backupPath);
       ownerOnlyFile(backupPath);
       pruneBackups(filePath, 3);
     } catch {}
@@ -425,7 +426,7 @@ function atomicWriteJson(filePath, value) {
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
-    renameSync(tempPath, filePath);
+    replaceFileSync(tempPath, filePath);
     ownerOnlyFile(filePath);
   } catch (error) {
     if (fd !== undefined) {

package/src/local/stdio.mjs

@@ -131,14 +131,12 @@ export async function runStdioServer({ workspace, policy, logLevel = "info", job
         const result = await runtime.executeTool(name, args, { callId });
         send(rpcResult(message.id, toolResult(result)));
         const durationMs = Date.now() - started;
-        if (durationMs >= SLOW_TOOL_CALL_MS) logger.info("slow tool call completed", { tool: name, duration_ms: durationMs });
-        else logger.debug("tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs });
+        logger.debug(durationMs >= SLOW_TOOL_CALL_MS ? "slow tool call completed" : "tool call completed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs });
       } catch (error) {
         const safeError = runtime.safeErrorMessage(error);
         send(rpcResult(message.id, toolResult({ error: safeError }, true)));
         const durationMs = Date.now() - started;
-        logger.warn("tool call failed", { tool: name, duration_ms: durationMs, error_class: classifyOperationalError(error) });
-        logger.debug("tool call failure correlation", { call_id: callId.slice(0, 20) });
+        logger.debug("tool call failed", { call_id: callId.slice(0, 20), tool: name, duration_ms: durationMs, error_class: classifyOperationalError(error) });
       } finally {
         if (key) pending.delete(key);
         runtime.finishCall(callId);