machine-bridge-mcp 0.6.0 → 0.6.2

package/src/local/tools.mjs

@@ -9,7 +9,7 @@ export const MCP_INSTRUCTIONS = Object.freeze(serverMetadata.instructions.map((v
 
 
 export const DEFAULT_POLICY_PROFILE = "full";
-export const DEFAULT_POLICY_REVISION = 2;
+export const DEFAULT_POLICY_REVISION = 3;
 
 export const POLICY_PROFILES = Object.freeze({
   review: Object.freeze({ profile: "review", allowWrite: false, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
@@ -34,8 +34,9 @@ export function normalizePolicy(policy = {}) {
       : "off";
   const origin = POLICY_ORIGINS.has(policy.origin) ? policy.origin : "custom";
   const revision = Number.isInteger(policy.revision) && policy.revision > 0 ? policy.revision : DEFAULT_POLICY_REVISION;
-  return {
-    profile: typeof policy.profile === "string" && policy.profile ? policy.profile : "custom",
+  const requestedProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const normalized = {
+    profile: requestedProfile,
     origin,
     revision,
     allowWrite: policy.allowWrite === true,
@@ -45,6 +46,38 @@ export function normalizePolicy(policy = {}) {
     minimalEnv: policy.minimalEnv !== false,
     exposeAbsolutePaths: policy.exposeAbsolutePaths === true,
   };
+  if (POLICY_PROFILES[requestedProfile]) {
+    const canonical = POLICY_PROFILES[requestedProfile];
+    normalized.allowWrite = canonical.allowWrite;
+    normalized.allowExec = canonical.execMode !== "off";
+    normalized.execMode = canonical.execMode;
+    normalized.unrestrictedPaths = canonical.unrestrictedPaths;
+    normalized.minimalEnv = canonical.minimalEnv;
+    normalized.exposeAbsolutePaths = canonical.exposeAbsolutePaths;
+  }
+  return normalized;
+}
+
+export function isCanonicalFullPolicy(policy = {}) {
+  return policyCapabilitiesEqual(normalizePolicy(policy), POLICY_PROFILES.full);
+}
+
+export function assertCanonicalFullPolicy(policy = {}) {
+  const normalized = normalizePolicy(policy);
+  if (!isCanonicalFullPolicy(normalized) || normalized.profile !== "full") {
+    throw new Error("full profile invariant failed: full must enable writes, shell execution, unrestricted paths, full parent environment, and absolute paths");
+  }
+  const exposed = toolsForPolicy(normalized);
+  if (exposed.length !== catalog.length) throw new Error("full profile invariant failed: complete tool catalog is not exposed");
+  return normalized;
+}
+
+function policyCapabilitiesEqual(left, right) {
+  return left.allowWrite === right.allowWrite
+    && left.execMode === right.execMode
+    && left.unrestrictedPaths === right.unrestrictedPaths
+    && left.minimalEnv === right.minimalEnv
+    && left.exposeAbsolutePaths === right.exposeAbsolutePaths;
 }
 
 export function toolsForPolicy(policy = {}) {
@@ -92,6 +125,7 @@ function isAvailable(availability, policy) {
   if (availability === "write") return policy.allowWrite;
   if (availability === "direct-exec") return policy.execMode === "direct" || policy.execMode === "shell";
   if (availability === "shell-exec") return policy.execMode === "shell";
+  if (availability === "full") return policy.profile === "full" && isCanonicalFullPolicy(policy);
   return false;
 }
 

package/src/shared/server-metadata.json

@@ -11,14 +11,16 @@
     "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
     "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
     "Filename sensitivity is not classified by this server; the MCP host, connector gateway, local OS, or endpoint-security software may enforce additional independent rules.",
+    "A named full profile is canonical: it always enables writes, shell execution, unrestricted paths, the full parent environment, absolute paths, and the complete tool catalog. Any explicit narrowing is stored as custom.",
     "Use diagnose_runtime to distinguish a request that reached the daemon from local filesystem, process-spawn, shell, managed-job-storage, and resource failures. A tool call blocked before any response cannot be diagnosed by the server.",
-    "Never request or return secret-file contents when a local resource alias can be used. Resources are registered only through the local machine-mcp CLI and may be injected by path, stdin, or environment without entering MCP arguments.",
+    "Never request or return secret-file contents when a local resource alias can be used. Resources are registered through the local machine-mcp CLI; under canonical full policy, generate_ssh_key_resource can generate and register an Ed25519 key without returning private content and may be injected by path, stdin, or environment without entering MCP arguments.",
     "If execution-class tools are unavailable but write access remains, use stage_job to persist a reviewed plan without running it; the operator can launch it locally with machine-mcp job approve JOB_ID.",
     "For multi-step, remote, long-running, or cleanup-sensitive work, prefer one start_job call with argv steps, job-scoped temporary_files, and idempotent finally_steps. The detached runner continues after MCP disconnects; inspect it with read_job or the local machine-mcp job CLI.",
     "Prefer sending remote shell programs through a process stdin rather than creating remote helper files. If temporary files are necessary, use {{temp:name}} or explicit finally_steps.",
     "Managed-job resource redaction is defense in depth, not a guarantee against transformed or partial secret output. Use capture_output=discard for steps that may echo credentials.",
     "Do not use shell encoding, renaming, or alternate tools to bypass host or platform safety policy.",
     "run_process avoids shell parsing but is not an OS sandbox. exec_command is exposed only in shell mode and has the local user's authority.",
+    "Per-tool success, failure, cancellation, and timing events are debug-only; default logs contain lifecycle and infrastructure events, not a tool-call transcript.",
     "Inspect before editing, prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run."
   ]
 }

package/src/shared/tool-catalog.json

@@ -635,6 +635,39 @@
       "additionalProperties": false
     }
   },
+  {
+    "name": "generate_ssh_key_resource",
+    "title": "Generate SSH key resource",
+    "description": "Generate or reuse an Ed25519 SSH key pair on the local machine and register the private key file as a local resource alias. The private key content is never returned; only local paths, public fingerprint, permissions, and registration status are reported. Available only under canonical full policy.",
+    "availability": "full",
+    "annotations": {
+      "readOnlyHint": false,
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": false
+    },
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$"
+        },
+        "path": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "comment": {
+          "type": "string",
+          "maxLength": 256
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false
+    }
+  },
   {
     "name": "stage_job",
     "title": "Stage managed job for local approval",

package/src/worker/index.ts

@@ -3,7 +3,7 @@ import toolCatalog from "../shared/tool-catalog.json";
 import serverMetadata from "../shared/server-metadata.json";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "0.6.0";
+const SERVER_VERSION = "0.6.2";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -991,6 +991,12 @@ function daemonPolicyAllows(availability: unknown, policy: Record<string, unknow
   if (availability === "write") return policy.allowWrite === true;
   if (availability === "direct-exec") return policy.execMode === "direct" || policy.execMode === "shell";
   if (availability === "shell-exec") return policy.execMode === "shell";
+  if (availability === "full") return policy.profile === "full"
+    && policy.allowWrite === true
+    && policy.execMode === "shell"
+    && policy.unrestrictedPaths === true
+    && policy.minimalEnv === false
+    && policy.exposeAbsolutePaths === true;
   return false;
 }