machine-bridge-mcp 0.6.0 → 0.7.1

package/src/local/atomic-fs.mjs

@@ -0,0 +1,37 @@
+import { renameSync } from "node:fs";
+
+const TRANSIENT_REPLACE_ERRORS = new Set(["EACCES", "EBUSY", "EPERM", "ENOTEMPTY"]);
+const WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
+
+export function replaceFileSync(source, target, options = {}) {
+  const rename = typeof options.rename === "function" ? options.rename : renameSync;
+  const attempts = clampInteger(options.attempts, 8, 1, 32);
+  const baseDelayMs = clampInteger(options.baseDelayMs, 15, 0, 1000);
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      rename(source, target);
+      return { attempts: attempt };
+    } catch (error) {
+      lastError = error;
+      if (!isTransientReplaceError(error) || attempt === attempts) throw error;
+      sleepSync(Math.min(baseDelayMs * attempt, 250));
+    }
+  }
+  throw lastError || new Error("atomic file replacement failed");
+}
+
+export function isTransientReplaceError(error) {
+  return TRANSIENT_REPLACE_ERRORS.has(String(error?.code || ""));
+}
+
+function sleepSync(milliseconds) {
+  if (milliseconds <= 0) return;
+  Atomics.wait(WAIT_BUFFER, 0, 0, milliseconds);
+}
+
+function clampInteger(value, fallback, minimum, maximum) {
+  const parsed = Number.parseInt(String(value ?? ""), 10);
+  const number = Number.isFinite(parsed) ? parsed : fallback;
+  return Math.min(Math.max(number, minimum), maximum);
+}

package/src/local/cli.mjs

@@ -5,10 +5,12 @@ import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalDaemon } from "./daemon.mjs";
 import { runStdioServer } from "./stdio.mjs";
-import { DEFAULT_POLICY_PROFILE, DEFAULT_POLICY_REVISION, POLICY_PROFILES, normalizePolicy, policyProfile } from "./tools.mjs";
+import { assertCanonicalFullPolicy, DEFAULT_POLICY_PROFILE, DEFAULT_POLICY_REVISION, POLICY_PROFILES, normalizePolicy, policyProfile, toolsForPolicy } from "./tools.mjs";
 import { classifyOperationalError, createLogger, normalizeLogLevel, sanitizeLogText } from "./log.mjs";
 import { activeManagedJobs, inspectResourceFile, loadManagedJobPlan, ManagedJobManager, publicResourceRegistry, validateResourceName } from "./managed-jobs.mjs";
 import { runWrangler } from "./shell.mjs";
+import { generateRegisteredSshKey } from "./resource-operations.mjs";
+import { runFullAccessTest } from "./full-access-test.mjs";
 import {
   acquireDaemonLock,
   acquireStartupLock,
@@ -38,7 +40,7 @@ const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
   "daemonOnly", "noAutostart", "noPrintCredentials", "printMcpCredentials",
   "printCredentials", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
-  "yes", "keepWorker", "allowInsecurePermissions",
+  "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
 ]);
 const VALUE_OPTIONS = new Set([
   "workspace", "stateDir", "workerName", "profile", "execMode", "client", "logLevel",
@@ -60,6 +62,7 @@ export async function main(argv = process.argv.slice(2)) {
     case "client-config": return clientConfigCommand(args);
     case "status": return statusCommand(args);
     case "doctor": return doctorCommand(args);
+    case "full-test": return fullTestCommand(args);
     case "workspace": return workspaceCommand(args);
     case "service":
     case "autostart": return serviceCommand(args);
@@ -84,11 +87,12 @@ const COMMAND_OPTIONS = {
   "client-config": new Set(["workspace", "stateDir", "profile", "client", "json"]),
   status: new Set(["workspace", "stateDir"]),
   doctor: new Set(["workspace", "stateDir"]),
+  "full-test": new Set(["workspace", "stateDir", "json"]),
   "rotate-secrets": new Set(["workspace", "stateDir", "workerName", "noPrintCredentials", "printMcpCredentials", "printCredentials", "quiet"]),
   workspace: new Set(["workspace", "stateDir"]),
   service: new Set(["workspace", "stateDir", "quiet"]),
   autostart: new Set(["workspace", "stateDir", "quiet"]),
-  resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "json"]),
+  resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
 };
@@ -123,7 +127,7 @@ function toKebab(value) {
 
 export function validatePositionals(command, args) {
   const count = args._.length;
-  if (["start", "stdio", "status", "doctor", "rotate-secrets"].includes(command)) {
+  if (["start", "stdio", "status", "doctor", "full-test", "rotate-secrets"].includes(command)) {
     if (count > 1) throw new Error(`${command} accepts at most one positional workspace path`);
     if (args.workspace && count) throw new Error("workspace path was provided both positionally and with --workspace");
     return;
@@ -148,7 +152,7 @@ export function validatePositionals(command, args) {
   }
   if (command === "resource") {
     const action = String(args._[0] || "list");
-    const max = action === "add" ? 3 : action === "remove" || action === "check" ? 2 : 1;
+    const max = action === "add" || action === "generate-ssh-key" ? 3 : action === "remove" || action === "check" ? 2 : 1;
     if (count > max) throw new Error(`resource ${action} received too many positional arguments`);
     return;
   }
@@ -474,10 +478,19 @@ async function resourceCommand(args) {
   state.resources ||= {};
 
   if (action === "list") {
-    const resources = publicResourceRegistry(state.resources);
-    if (args.json) console.log(JSON.stringify({ workspace, resources }, null, 2));
+    const includePaths = args.showPaths === true;
+    const resources = publicResourceRegistry(state.resources, { includePaths });
+    if (args.json) console.log(JSON.stringify({
+      workspace: includePaths ? workspace : "<local-workspace>",
+      paths_exposed: includePaths,
+      resources,
+    }, null, 2));
     else if (!Object.keys(resources).length) console.log("No local resources registered.");
-    else for (const [name, value] of Object.entries(resources)) console.log(`${name}	${value.path}	${value.mode || "n/a"}	${value.size ?? "n/a"} bytes`);
+    else for (const [name, value] of Object.entries(resources)) {
+      const fields = [name, value.mode || "n/a", `${value.size ?? "n/a"} bytes`];
+      if (includePaths) fields.splice(1, 0, value.path);
+      console.log(fields.join("\t"));
+    }
     return;
   }
 
@@ -496,11 +509,14 @@ async function resourceCommand(args) {
       }
       latest.resources[name] = inspected;
       saveState(latest);
-      const result = { name, ...inspected, contents_exposed: false, available_to_new_jobs_immediately: true };
+      const result = publicResourceInspection(name, inspected, {
+        includePath: args.showPaths === true,
+        available_to_new_jobs_immediately: true,
+      });
       if (args.json) console.log(JSON.stringify(result, null, 2));
       else {
         console.log(`Registered local resource: ${name}`);
-        console.log(`Path: ${inspected.path}`);
+        if (args.showPaths === true) console.log(`Path: ${inspected.path}`);
         console.log(`Mode: ${inspected.mode || "n/a"}; size: ${inspected.size} bytes`);
         console.log("The resource is available to newly submitted managed jobs immediately.");
       }
@@ -510,6 +526,45 @@ async function resourceCommand(args) {
     return;
   }
 
+  if (action === "generate-ssh-key") {
+    const name = validateResourceName(args._[1]);
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
+    const requestedPath = args._[2] ? expandHome(args._[2]) : join(home, ".ssh", `machine-mcp-${name}-ed25519`);
+    const key = await generateRegisteredSshKey({
+      workspace,
+      stateDir: args.stateDir,
+      name,
+      targetPath: requestedPath,
+      comment: `machine-mcp:${name}`,
+    });
+    const includePaths = args.showPaths === true;
+    const result = {
+      name: key.name,
+      created: key.created,
+      fingerprint: key.fingerprint,
+      key_type: key.keyType,
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      private_key_content_exposed: key.privateKeyContentExposed,
+      registered: key.registered,
+      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+      paths_exposed: includePaths,
+      ...(includePaths ? { private_key_path: key.privateKeyPath, public_key_path: key.publicKeyPath } : {}),
+    };
+    if (args.json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`${key.created ? "Generated and registered" : "Reused and registered"} SSH key resource: ${name}`);
+      if (includePaths) {
+        console.log(`Private key: ${key.privateKeyPath}`);
+        console.log(`Public key: ${key.publicKeyPath}`);
+      }
+      console.log(`Fingerprint: ${key.fingerprint}`);
+      console.log("Private key content was not printed or sent through MCP.");
+    }
+    return;
+  }
+
   if (action === "remove") {
     const name = validateResourceName(args._[1]);
     const lock = acquireStartupLock(state);
@@ -537,15 +592,33 @@ async function resourceCommand(args) {
     const resource = state.resources[name];
     if (!resource) throw new Error(`local resource is not registered: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
-    const result = { name, ...inspected, contents_exposed: false };
+    const result = publicResourceInspection(name, inspected, { includePath: args.showPaths === true });
     if (args.json) console.log(JSON.stringify(result, null, 2));
-    else console.log(`${name}: available (${inspected.mode || "n/a"}, ${inspected.size} bytes)`);
+    else {
+      const pathDetail = args.showPaths === true ? ` at ${inspected.path}` : "";
+      console.log(`${name}: available${pathDetail} (${inspected.mode || "n/a"}, ${inspected.size} bytes)`);
+    }
     return;
   }
 
   throw new Error(`Unknown resource action: ${action}`);
 }
 
+function publicResourceInspection(name, inspected, { includePath = false, ...extra } = {}) {
+  return {
+    name,
+    kind: inspected.kind,
+    size: inspected.size ?? null,
+    mode: inspected.mode ?? null,
+    updated_at: inspected.updatedAt ?? null,
+    allow_insecure_permissions: inspected.allowInsecurePermissions === true,
+    ...extra,
+    paths_exposed: includePath,
+    contents_exposed: false,
+    ...(includePath ? { path: inspected.path } : {}),
+  };
+}
+
 async function jobCommand(args) {
   const action = String(args._[0] || "list").toLowerCase();
   const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
@@ -875,7 +948,7 @@ async function statusCommand(args) {
 async function doctorCommand(args) {
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
   const checks = [];
-  checks.push({ name: "node", ok: Number(process.versions.node.split(".")[0]) >= 22, detail: process.version });
+  checks.push({ name: "node", ok: isSupportedNodeVersion(), detail: process.version });
   const wrangler = await runWrangler(["--version"], { capture: true, allowFailure: true });
   checks.push({ name: "wrangler", ok: wrangler.code === 0, detail: (wrangler.stdout || wrangler.stderr).trim() });
   const whoami = await runWrangler(["whoami"], { capture: true, allowFailure: true });
@@ -884,6 +957,14 @@ async function doctorCommand(args) {
   const storedPolicyOrigin = state.policy?.origin;
   state.policy = resolvePolicy({}, state.policy);
   checks.push({ name: "policy", ok: true, detail: formatPolicySummary(state.policy) });
+  if (state.policy.profile === "full") {
+    try {
+      assertCanonicalFullPolicy(state.policy);
+      checks.push({ name: "full-policy-contract", ok: true, detail: `${toolsForPolicy(state.policy).length} tools exposed` });
+    } catch (error) {
+      checks.push({ name: "full-policy-contract", ok: false, detail: sanitizeLines(error?.message || error) });
+    }
+  }
   const health = state.worker?.url ? await workerHealth(state.worker.url) : { ok: false, error: "no worker url" };
   checks.push({ name: "worker-health", ok: health.ok, detail: health.ok ? state.worker.url : health.error });
   const diagnosticRuntime = new LocalDaemon({
@@ -917,6 +998,15 @@ async function doctorCommand(args) {
   }, null, 2));
 }
 
+async function fullTestCommand(args) {
+  const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
+  const state = loadState(workspace, { stateDir: args.stateDir });
+  const policy = resolvePolicy({}, state.policy);
+  const result = await runFullAccessTest({ workspace, policy });
+  console.log(JSON.stringify(result, null, 2));
+  if (!result.ok) process.exitCode = 1;
+}
+
 async function rotateSecretsCommand(args) {
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
@@ -1161,9 +1251,13 @@ function validateWorkerName(value) {
   return name;
 }
 
+export function isSupportedNodeVersion(version = process.versions.node) {
+  const major = Number(String(version || "").split(".")[0]);
+  return Number.isInteger(major) && major >= 26;
+}
+
 function assertNodeVersion() {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major < 22) throw new Error(`Node.js >=22 is required; current ${process.version}`);
+  if (!isSupportedNodeVersion()) throw new Error(`Node.js >=26 is required; current ${process.version}`);
 }
 
 function usage() {
@@ -1188,7 +1282,10 @@ Commands:
   service uninstall Remove only the autostart entry
   status            Print redacted local profile state and Worker health
   doctor            Check Node, Wrangler, Cloudflare login, Worker health
+  full-test         Run real local full-profile capability tests in a temporary sandbox
   rotate-secrets    Rotate MCP password and daemon secret in local state
+  resource generate-ssh-key NAME [PATH]
+                    Generate/reuse an Ed25519 key locally and register its private file by alias
   uninstall         Delete known Worker(s), remove autostart and local state
 
 Start options:
@@ -1214,6 +1311,7 @@ Start options:
   --quiet               Alias for --log-level error
   --allow-insecure-permissions
                         Permit resource registration when a file is group/other-readable
+  --show-paths          Include local absolute paths in resource command output
 
 Uninstall options:
   --keep-worker         Do not delete deployed Worker(s) during uninstall

package/src/local/daemon.mjs

@@ -9,9 +9,11 @@ import { applyUpdateHunks, parsePatchEnvelope } from "./patch.mjs";
 import { executionEnv, workspaceShellCommand } from "./shell.mjs";
 import { MAX_COMMAND_BYTES, ProcessSessionManager, terminateProcessTree, validateArgv } from "./process-sessions.mjs";
 export { MAX_COMMAND_BYTES } from "./process-sessions.mjs";
-import { MCP_PROTOCOL_VERSION, MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, SERVER_NAME, toolNamesForPolicy } from "./tools.mjs";
+import { allToolNames, assertCanonicalFullPolicy, isCanonicalFullPolicy, MCP_PROTOCOL_VERSION, MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, POLICY_PROFILES, SERVER_NAME, toolNamesForPolicy } from "./tools.mjs";
 import { classifyOperationalError } from "./log.mjs";
 import { ManagedJobManager } from "./managed-jobs.mjs";
+import { generateRegisteredSshKey } from "./resource-operations.mjs";
+import { expandHome } from "./state.mjs";
 
 export const MAX_WRITE_BYTES = 5 * 1024 * 1024;
 const MAX_WS_MESSAGE_BYTES = 8 * 1024 * 1024;
@@ -33,6 +35,7 @@ export class LocalDaemon {
     this.policy = normalizePolicy(policy);
     this.logger = logger;
     this.onSuperseded = typeof onSuperseded === "function" ? onSuperseded : null;
+    this.resourceStatePath = resourceStatePath ? resolve(resourceStatePath) : "";
     this.closed = false;
     this.ws = null;
     this.heartbeat = null;
@@ -83,15 +86,31 @@ export class LocalDaemon {
       protocol_version: MCP_PROTOCOL_VERSION,
       supported_protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
       workspace: this.displayPath(this.workspace),
-      workspace_name: basename(this.workspace),
+      workspace_name: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
       policy: this.policy,
+      policy_contract: {
+        named_profile_is_canonical: this.policy.profile === "custom" || policyMatchesNamedProfile(this.policy),
+        full_catalog_complete: this.policy.profile === "full" ? isCanonicalFullPolicy(this.policy) && this.tools().length + 1 === allToolNames().length : null,
+        machine_bridge_internal_denials_under_full: this.policy.profile === "full" && isCanonicalFullPolicy(this.policy) ? false : null,
+      },
       enforcement: {
         filesystem_scope: this.policy.unrestrictedPaths ? "local-user-accessible" : "workspace",
         sensitive_filename_filter: false,
         operating_system_permissions_apply: true,
         host_policy_is_independent: true,
       },
+      tool_delivery: {
+        full_profile_scope: "local-daemon-and-relay-advertisement",
+        daemon_advertised_tool_count: this.tools().length + 1,
+        host_exposed_tools_known_to_server: false,
+        host_may_expose_subset: true,
+      },
       tools: ["server_info", ...this.tools()],
+      observability: {
+        per_tool_events: "debug-only",
+        default_logs_include_tool_failures: false,
+        tool_arguments_or_results_logged: false,
+      },
       runtime: {
         environment: this.policy.minimalEnv ? "isolated-minimal" : "full-parent",
         runtime_dir: this.policy.exposeAbsolutePaths ? this.runtimeDir : "<private-runtime-dir>",
@@ -131,7 +150,7 @@ export class LocalDaemon {
     if (this.closed) return;
     const wsUrl = `${this.workerUrl.replace(/^http/i, "ws")}/daemon/ws`;
     this.logger.debug?.("connecting to remote relay", { endpoint: redactUrl(wsUrl) });
-    const socket = new WebSocket(wsUrl, { headers: { "X-Bridge-Token": this.secret } });
+    const socket = new WebSocket(wsUrl, { headers: { "X-Bridge-Token": this.secret }, maxPayload: MAX_WS_MESSAGE_BYTES });
     this.ws = socket;
 
     socket.on("open", () => {
@@ -251,14 +270,12 @@ export class LocalDaemon {
       if (this.cancelledCalls.has(id)) throw new Error("tool call cancelled");
       this.send({ type: "tool_result", id, ok: true, result });
       const durationMs = Date.now() - started;
-      if (durationMs >= SLOW_TOOL_CALL_MS) this.logger.info?.("slow tool call completed", { tool, duration_ms: durationMs });
-      else this.logger.debug?.("tool call completed", { call_id: shortCallId(id), tool, duration_ms: durationMs });
+      this.logger.debug?.(durationMs >= SLOW_TOOL_CALL_MS ? "slow tool call completed" : "tool call completed", { call_id: shortCallId(id), tool, duration_ms: durationMs });
     } catch (error) {
-      const safeError = this.safeErrorMessage(error);
+      const safeError = this.safeErrorMessage(error, argumentsValue);
       this.send({ type: "tool_result", id, ok: false, error: { message: safeError } });
       const durationMs = Date.now() - started;
-      this.logger.warn?.("tool call failed", { tool, duration_ms: durationMs, error_class: classifyOperationalError(error) });
-      this.logger.debug?.("tool call failure correlation", { call_id: shortCallId(id) });
+      this.logger.debug?.("tool call failed", { call_id: shortCallId(id), tool, duration_ms: durationMs, error_class: classifyOperationalError(error) });
     } finally {
       clearTimeout(deadline);
       this.activeToolCalls -= 1;
@@ -306,6 +323,7 @@ export class LocalDaemon {
       case "git_show": return this.gitShow(args, context);
       case "diagnose_runtime": return this.diagnoseRuntime(context);
       case "list_local_resources": return this.managedJobManager.listResources();
+      case "generate_ssh_key_resource": return this.generateSshKeyResource(args, context);
       case "stage_job": return this.managedJobManager.stage(args);
       case "start_job": return this.managedJobManager.start(args);
       case "list_jobs": return this.managedJobManager.list(args);
@@ -327,7 +345,7 @@ export class LocalDaemon {
     const git = await this.runProcess("git", ["-c", "core.fsmonitor=false", "-C", this.workspace, "rev-parse", "--show-toplevel"], 10_000, true, 512 * 1024, context);
     return {
       workspace: this.displayPath(this.workspace),
-      workspaceName: basename(this.workspace),
+      workspaceName: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
       gitRoot: git.code === 0 ? this.displayPath(git.stdout.trim()) : "",
       policy: this.policy,
       tools: ["server_info", ...this.tools()],
@@ -336,7 +354,7 @@ export class LocalDaemon {
   }
 
   listRoots() {
-    const roots = [{ name: basename(this.workspace), path: this.displayPath(this.workspace), default: true }];
+    const roots = [{ name: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace", path: this.displayPath(this.workspace), default: true }];
     if (this.policy.unrestrictedPaths) {
       const home = process.env.HOME || process.env.USERPROFILE;
       if (home && home !== this.workspace) roots.push({ name: "home", path: this.displayPath(resolve(home)), default: false });
@@ -729,6 +747,41 @@ export class LocalDaemon {
     };
   }
 
+  async generateSshKeyResource(args = {}, context = {}) {
+    this.throwIfCancelled(context);
+    assertCanonicalFullPolicy(this.policy);
+    if (!this.resourceStatePath) throw new Error("local resource state is unavailable in this runtime");
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
+    const target = args.path
+      ? resolve(expandHome(String(args.path)))
+      : resolve(home, ".ssh", `machine-mcp-${args.name}-ed25519`);
+    const key = await generateRegisteredSshKey({
+      workspace: this.workspace,
+      stateDir: stateRootFromProfileStatePath(this.resourceStatePath),
+      name: args.name,
+      targetPath: target,
+      comment: args.comment || `machine-mcp:${args.name}`,
+    });
+    const exposePaths = args.expose_paths === true;
+    return {
+      name: key.name,
+      created: key.created,
+      registered: key.registered,
+      fingerprint: key.fingerprint,
+      key_type: key.keyType,
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      private_key_content_exposed: key.privateKeyContentExposed,
+      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+      paths_exposed: exposePaths,
+      ...(exposePaths ? {
+        private_key_path: resolve(key.privateKeyPath),
+        public_key_path: resolve(key.publicKeyPath),
+      } : {}),
+    };
+  }
+
   async runDirectProcess(args, context = {}) {
     if (this.policy.execMode !== "direct" && this.policy.execMode !== "shell") throw new Error("run_process is disabled by daemon policy");
     const argv = validateArgv(args.argv);
@@ -788,7 +841,7 @@ export class LocalDaemon {
       timer.unref?.();
       const cleanup = () => {
         clearTimeout(timer);
-        if (killTimer && !timedOut) clearTimeout(killTimer);
+        if (killTimer) clearTimeout(killTimer);
         this.activeProcesses.delete(child);
         if (context.callId) {
           const set = this.callProcesses.get(context.callId);
@@ -901,19 +954,25 @@ export class LocalDaemon {
 
   displayPath(fullPath) {
     const absolute = resolve(fullPath);
-    if (this.policy.exposeAbsolutePaths || this.policy.unrestrictedPaths) return absolute;
-    assertContainedPath(this.workspace, absolute);
+    if (this.policy.exposeAbsolutePaths) return absolute;
     const shown = relative(this.workspace, absolute);
-    return shown ? shown.split(sep).join("/") : ".";
+    const insideWorkspace = shown === "" || (!shown.startsWith(`..${sep}`) && shown !== ".." && !isAbsolute(shown));
+    if (insideWorkspace) return shown ? shown.split(sep).join("/") : ".";
+    return `<external-path:${sha256(absolute).slice(0, 12)}>`;
   }
 
-  safeErrorMessage(error) {
+  safeErrorMessage(error, toolArgs = {}) {
     let message = boundedErrorMessage(error);
     if (!this.policy.exposeAbsolutePaths) {
       for (const prefix of equivalentPathPrefixes(this.workspace, this.workspaceInput)) message = replacePathPrefix(message, prefix, ".");
       for (const prefix of equivalentPathPrefixes(this.runtimeDir)) message = replacePathPrefix(message, prefix, "<runtime>");
       const home = process.env.HOME || process.env.USERPROFILE;
       if (home) message = replacePathPrefix(message, resolve(home), "<home>");
+      for (const candidate of collectToolPathCandidates(error, toolArgs, this.workspaceInput)) {
+        const absolute = isAbsolute(candidate) ? resolve(candidate) : resolve(this.workspaceInput, candidate);
+        const replacement = this.displayPath(absolute);
+        for (const prefix of equivalentPathPrefixes(candidate, absolute)) message = replacePathPrefix(message, prefix, replacement);
+      }
     }
     return message;
   }
@@ -931,6 +990,25 @@ export class LocalDaemon {
   }
 }
 
+function policyMatchesNamedProfile(policy) {
+  const named = POLICY_PROFILES[policy.profile];
+  if (!named) return false;
+  return policy.allowWrite === named.allowWrite
+    && policy.execMode === named.execMode
+    && policy.unrestrictedPaths === named.unrestrictedPaths
+    && policy.minimalEnv === named.minimalEnv
+    && policy.exposeAbsolutePaths === named.exposeAbsolutePaths;
+}
+
+function stateRootFromProfileStatePath(statePath) {
+  const absolute = resolve(statePath);
+  if (basename(absolute) !== "state.json") throw new Error("local resource state path is invalid");
+  const profileDir = dirname(absolute);
+  const profilesDir = dirname(profileDir);
+  if (basename(profilesDir) !== "profiles") throw new Error("local resource state path is outside the expected profile layout");
+  return dirname(profilesDir);
+}
+
 function normalizeWorkerUrl(value) {
   let url;
   try { url = new URL(String(value || "")); } catch { throw new Error("invalid Worker URL"); }
@@ -1140,6 +1218,27 @@ function isPlainRecord(value) {
 }
 
 
+function collectToolPathCandidates(error, toolArgs, workspace) {
+  const candidates = new Set();
+  for (const value of [error?.path, error?.dest]) if (typeof value === "string" && value) candidates.add(value);
+  const visit = (value, key = "", depth = 0) => {
+    if (depth > 5 || value === null || value === undefined) return;
+    if (typeof value === "string") {
+      if (/(?:^|[_-])(?:path|cwd|workspace|root|directory|dir)(?:$|[_-])/i.test(key) && value && !value.includes("\0")) candidates.add(value);
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value.slice(0, 64)) visit(item, key, depth + 1);
+      return;
+    }
+    if (typeof value !== "object") return;
+    for (const [childKey, child] of Object.entries(value).slice(0, 128)) visit(child, childKey, depth + 1);
+  };
+  visit(toolArgs);
+  candidates.delete(workspace);
+  return [...candidates].sort((left, right) => right.length - left.length);
+}
+
 function equivalentPathPrefixes(...values) {
   const prefixes = new Set(values.filter(Boolean).map((value) => String(value)));
   for (const value of [...prefixes]) {