machine-bridge-mcp 0.6.0 → 0.7.1

package/src/local/full-access-test.mjs

@@ -0,0 +1,206 @@
+import { chmod, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { LocalDaemon } from "./daemon.mjs";
+import { generateSshKeyPair } from "./ssh-key.mjs";
+import { run } from "./shell.mjs";
+import { allToolNames, assertCanonicalFullPolicy, policyProfile } from "./tools.mjs";
+
+const TERMINAL_JOB_STATES = new Set([
+  "succeeded", "failed", "cancelled", "runner_failed", "runner_launch_failed",
+  "recovery_failed", "recovery_exhausted", "succeeded_cleanup_failed",
+  "failed_cleanup_failed", "cancelled_cleanup_failed",
+]);
+
+export async function runFullAccessTest({ workspace, policy = policyProfile("full", "explicit") } = {}) {
+  const canonicalPolicy = assertCanonicalFullPolicy(policy);
+  const root = await mkdtemp(join(tmpdir(), "machine-mcp-full-test-"));
+  const jobRoot = join(root, "jobs");
+  const outsideDir = join(root, "outside-workspace");
+  const keyPath = join(root, "ssh", "operator-ed25519");
+  const authorizedKeysPath = join(root, "authorized_keys");
+  const mainMarker = join(root, "managed-main.txt");
+  const cleanupMarker = join(root, "managed-cleanup.txt");
+  const checks = [];
+  const sentinelKey = `MBM_FULL_TEST_${Date.now()}`;
+  const previousSentinel = process.env[sentinelKey];
+  process.env[sentinelKey] = "visible";
+  let runtime;
+
+  try {
+    runtime = new LocalDaemon({
+      workspace: resolve(workspace),
+      policy: canonicalPolicy,
+      jobRoot,
+      resources: {},
+      logger: silentLogger(),
+      recoverJobs: false,
+    });
+
+    const toolNames = runtime.tools();
+    checks.push(check("full-policy-invariant", toolNames.length === allToolNames().length - 1, {
+      profile: canonicalPolicy.profile,
+      exposed_tools: toolNames.length + 1,
+      catalog_tools: allToolNames().length,
+    }));
+
+    const outsideFile = join(outsideDir, "outside.txt");
+    const written = await runtime.writeFile({ path: outsideFile, content: "full-outside-write\n", create_only: true });
+    const read = await runtime.readFile(outsideFile, 1024);
+    const canonicalOutsideFile = await realpath(outsideFile);
+    checks.push(check("unrestricted-filesystem", written.ok === true && read.content === "full-outside-write\n", {
+      absolute_path_returned: await equivalentPath(read.path, canonicalOutsideFile),
+    }));
+
+    const direct = await runtime.runDirectProcess({
+      argv: [process.execPath, "-e", "process.stdout.write(process.cwd())"],
+      cwd: outsideDir,
+      timeout_seconds: 10,
+    });
+    checks.push(check("direct-process-outside-workspace", direct.code === 0 && await equivalentPath(direct.stdout.trim(), outsideDir)));
+
+    const inherited = await runtime.runDirectProcess({
+      argv: [process.execPath, "-e", `process.stdout.write(process.env[${JSON.stringify(sentinelKey)}] || '')`],
+      timeout_seconds: 10,
+    });
+    checks.push(check("full-parent-environment", inherited.code === 0 && inherited.stdout === "visible"));
+
+    const shellCommand = process.platform === "win32" ? "[Console]::Out.Write('full-shell')" : "printf full-shell";
+    const shell = await runtime.execCommand(shellCommand, 10);
+    checks.push(check("shell-execution", shell.code === 0 && shell.stdout.trim() === "full-shell"));
+
+    const key = await generateSshKeyPair({
+      privateKeyPath: keyPath,
+      type: "ed25519",
+      comment: "machine-mcp-full-test",
+    });
+    const publicLine = (await readFile(key.publicKeyPath, "utf8")).trim();
+    await runtime.writeFile({ path: authorizedKeysPath, content: `${publicLine}\n`, create_only: true });
+    if (process.platform !== "win32") await chmod(authorizedKeysPath, 0o600);
+    const authorized = await readFile(authorizedKeysPath, "utf8");
+    checks.push(check("ssh-key-generation", key.created && key.publicKeyType === "ssh-ed25519", {
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      fingerprint_available: Boolean(key.fingerprint),
+      private_key_content_exposed: false,
+    }));
+    checks.push(check("authorized-keys-sandbox-write", authorized === `${publicLine}\n`, {
+      target_is_temporary_sandbox: true,
+    }));
+
+    const nullConfig = process.platform === "win32" ? "NUL" : "/dev/null";
+    const sshConfig = await run("ssh", ["-F", nullConfig, "-G", "localhost"], {
+      capture: true,
+      allowFailure: true,
+      timeoutMs: 15_000,
+      maxOutputBytes: 256 * 1024,
+    });
+    checks.push(check("ssh-client", sshConfig.code === 0));
+
+    const gcloud = await run("gcloud", ["--version"], {
+      capture: true,
+      allowFailure: true,
+      timeoutMs: 30_000,
+      maxOutputBytes: 64 * 1024,
+    });
+    const osLoginHelp = gcloud.code === 0
+      ? await run("gcloud", ["help", "compute", "os-login", "ssh-keys", "add"], {
+          capture: true,
+          allowFailure: true,
+          timeoutMs: 30_000,
+          maxOutputBytes: 128 * 1024,
+        })
+      : { code: 127 };
+    checks.push(check("google-cloud-cli", gcloud.code === 0, {
+      os_login_key_command_available: osLoginHelp.code === 0,
+      external_changes_made: false,
+    }));
+
+    const sudo = process.platform === "win32"
+      ? { code: 0, skipped: true }
+      : await run("sudo", ["-n", "true"], {
+          capture: true,
+          allowFailure: true,
+          timeoutMs: 10_000,
+          maxOutputBytes: 16 * 1024,
+        });
+    checks.push({
+      name: "noninteractive-sudo-probe",
+      ok: true,
+      available: process.platform === "win32" ? null : sudo.code === 0,
+      password_or_policy_required: process.platform === "win32" ? null : sudo.code !== 0,
+      skipped: process.platform === "win32",
+      state_changed: false,
+    });
+
+    const accepted = runtime.managedJobManager.start({
+      name: "full access lifecycle test",
+      temporary_files: [{ name: "main.js", content: "require('node:fs').writeFileSync(process.argv[2],'main')" }],
+      steps: [{ argv: [process.execPath, "{{temp:main.js}}", mainMarker], timeout_seconds: 10 }],
+      finally_steps: [{ argv: [process.execPath, "-e", "require('node:fs').writeFileSync(process.argv[1],'cleanup')", cleanupMarker], timeout_seconds: 10 }],
+    });
+    const job = await waitForJob(runtime.managedJobManager, accepted.job_id, 15_000);
+    checks.push(check("detached-managed-job", job.status === "succeeded"
+      && await fileEquals(mainMarker, "main")
+      && await fileEquals(cleanupMarker, "cleanup"), {
+      status: job.status,
+      error_class: job.error_class ?? job.result?.error_class ?? null,
+      cleanup_error_class: job.result?.cleanup_error_class ?? null,
+      cleanup_attempted: true,
+    }));
+
+    const coreChecks = checks.filter((item) => !["google-cloud-cli", "noninteractive-sudo-probe"].includes(item.name));
+    const operatorChecks = checks.filter((item) => ["ssh-key-generation", "authorized-keys-sandbox-write", "ssh-client", "google-cloud-cli"].includes(item.name));
+    return {
+      ok: coreChecks.every((item) => item.ok === true),
+      operator_workflow_ready: operatorChecks.every((item) => item.ok === true),
+      machine: {
+        platform: process.platform,
+        architecture: process.arch,
+        node: process.version,
+      },
+      policy: canonicalPolicy,
+      checks,
+      guarantees: {
+        machine_bridge_internal_policy_denials_under_full: false,
+        host_or_connector_policy_overridden: false,
+        operating_system_policy_overridden: false,
+        external_cloud_or_remote_state_changed: false,
+      },
+    };
+  } finally {
+    runtime?.stop();
+    if (previousSentinel === undefined) delete process.env[sentinelKey];
+    else process.env[sentinelKey] = previousSentinel;
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+async function waitForJob(manager, jobId, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const value = manager.read({ job_id: jobId });
+    if (TERMINAL_JOB_STATES.has(value.status)) return value;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));
+  }
+  throw new Error("full access managed-job test timed out");
+}
+
+async function equivalentPath(left, right) {
+  try { return await realpath(resolve(left)) === await realpath(resolve(right)); } catch { return false; }
+}
+
+async function fileEquals(path, expected) {
+  try { return await readFile(path, "utf8") === expected; } catch { return false; }
+}
+
+function check(name, ok, detail = {}) {
+  return { name, ok: Boolean(ok), ...detail };
+}
+
+function silentLogger() {
+  return {
+    info() {}, success() {}, warn() {}, error() {}, debug() {},
+  };
+}

package/src/local/job-runner.mjs

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { executionEnv } from "./shell.mjs";
 import { terminateProcessTree } from "./process-sessions.mjs";
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 const RESOURCE_TOKEN = /\{\{resource:([a-z][a-z0-9._-]{0,63})\}\}/g;
 const TEMP_TOKEN = /\{\{temp:([a-z][a-z0-9._-]{0,63})\}\}/g;
@@ -12,10 +13,13 @@ const MAX_OUTPUT_BYTES = 64 * 1024;
 const MAX_JOB_CAPTURE_BYTES = 256 * 1024;
 const MAX_RESULT_BYTES = 4 * 1024 * 1024;
 const MAX_STATUS_BYTES = 256 * 1024;
+const JOB_ID = /^job_[A-Za-z0-9_-]{24,}$/;
 
 const options = parseArgs(process.argv.slice(2));
-const jobDir = resolve(options.jobDir || "");
-if (!jobDir) throw new Error("--job-dir is required");
+const jobDirInput = typeof options.jobDir === "string" ? options.jobDir.trim() : "";
+if (!jobDirInput) throw new Error("--job-dir is required");
+const jobDir = resolve(jobDirInput);
+if (!JOB_ID.test(basename(jobDir))) throw new Error("--job-dir must name a managed job directory");
 const recover = options.recover === true;
 const planFile = join(jobDir, "plan.json");
 const statusFile = join(jobDir, "status.json");
@@ -42,17 +46,19 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
   process.on(signal, () => requestCancellation());
 }
 
-writeFileSync(runnerPidFile, `${process.pid}\n`, { mode: 0o600 });
+const initial = readJson(statusFile, MAX_STATUS_BYTES);
+assertLaunchState(initial);
+writeFileSync(runnerPidFile, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
 if (recover) rmSync(join(jobDir, "recovery.lock"), { force: true });
 try {
-  await main();
+  const plan = readJson(planFile, 1024 * 1024);
+  assertPlanIntegrity(plan, initial);
+  await main(plan, initial);
 } catch (error) {
   recordFatalRunnerError(error);
 }
 
-async function main() {
-  const plan = readJson(planFile, 1024 * 1024);
-  const initial = readJson(statusFile, MAX_STATUS_BYTES);
+async function main(plan, initial) {
   const status = {
     ...initial,
     runner_pid: process.pid,
@@ -136,6 +142,20 @@ async function main() {
   try { rmSync(cancelFile, { force: true }); } catch {}
 }
 
+function assertLaunchState(status) {
+  if (!status || typeof status !== "object" || Array.isArray(status)) throw new Error("job status is unavailable or invalid");
+  const expected = recover ? "interrupted" : "queued";
+  if (status.status !== expected) throw new Error(`runner cannot start job in status: ${status.status}`);
+  if (status.approval === "pending-local-operator" || !status.approval) throw new Error("runner cannot start an unapproved managed job");
+}
+
+function assertPlanIntegrity(plan, status) {
+  if (!plan || typeof plan !== "object" || Array.isArray(plan)) throw new Error("job plan is unavailable or invalid");
+  const expected = String(status?.plan_sha256 || "");
+  const actual = createHash("sha256").update(JSON.stringify(plan)).digest("hex");
+  if (!/^[a-f0-9]{64}$/.test(expected) || actual !== expected) throw new Error("managed job plan integrity check failed");
+}
+
 function recordFatalRunnerError(error) {
   rmSync(runtimeDir, { recursive: true, force: true });
   const now = new Date().toISOString();
@@ -233,11 +253,12 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
     let stderrTruncated = 0;
     let timedOut = false;
     let closed = false;
+    let killTimer = null;
     const timer = setTimeout(() => {
       timedOut = true;
       terminateProcessTree(child, "SIGTERM");
-      const kill = setTimeout(() => terminateProcessTree(child, "SIGKILL"), 2000);
-      kill.unref?.();
+      killTimer = setTimeout(() => terminateProcessTree(child, "SIGKILL"), 2000);
+      killTimer.unref?.();
     }, timeoutMs);
     timer.unref?.();
     const cancellationPoll = setInterval(() => {
@@ -278,6 +299,7 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
       if (closed) return;
       closed = true;
       clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
       clearInterval(cancellationPoll);
       activeChild = null;
       activeChildCancellationAware = false;
@@ -292,6 +314,7 @@ function materializeResources(resources) {
   mkdirSync(resourcesDir, { recursive: true, mode: 0o700 });
   chmodSync(resourcesDir, 0o700);
   const paths = {};
+  const sourcePaths = {};
   const bytes = {};
   const redactions = {};
   for (const [name, resource] of Object.entries(resources)) {
@@ -302,6 +325,10 @@ function materializeResources(resources) {
     const target = join(resourcesDir, name);
     writeFileSync(target, data, { mode: 0o600, flag: "wx" });
     paths[name] = target;
+    sourcePaths[name] = [...new Set([
+      ...resourcePathVariants(resource.path),
+      ...(Array.isArray(resource.pathAliases) ? resource.pathAliases.flatMap(resourcePathVariants) : []),
+    ])].sort((left, right) => right.length - left.length);
     bytes[name] = data;
     const patterns = [];
     try {
@@ -315,7 +342,7 @@ function materializeResources(resources) {
     }
     redactions[name] = [...new Set(patterns.filter((value) => value.length > 0))].sort((a, b) => b.length - a.length);
   }
-  return { paths, bytes, redactions };
+  return { paths, sourcePaths, bytes, redactions };
 }
 
 function materializeTemporaryFiles(files) {
@@ -365,15 +392,46 @@ function substitute(value, plan, context) {
     });
 }
 
+function resourcePathVariants(value) {
+  const canonical = resolve(value);
+  const variants = new Set(pathTextVariants(canonical));
+  if (process.platform === "darwin" && canonical.startsWith("/private/")) {
+    for (const variant of pathTextVariants(canonical.slice("/private".length))) variants.add(variant);
+  }
+  return [...variants].sort((left, right) => right.length - left.length);
+}
+
+function pathTextVariants(value) {
+  const path = String(value);
+  return [...new Set([path, path.replaceAll("\\", "/"), path.replaceAll("/", "\\")])];
+}
+
+function replacePathText(text, value, replacement) {
+  let output = text;
+  for (const variant of pathTextVariants(value)) {
+    if (!variant) continue;
+    if (process.platform === "win32") output = output.replace(new RegExp(escapeRegExp(variant), "gi"), replacement);
+    else output = output.split(variant).join(replacement);
+  }
+  return output;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 function redactOutput(buffer, context) {
   let text = new TextDecoder("utf-8").decode(buffer);
   for (const [name, path] of Object.entries(context.paths)) {
-    text = text.split(path).join(`<resource:${name}>`);
+    text = replacePathText(text, path, `<resource:${name}>`);
+  }
+  for (const [name, paths] of Object.entries(context.sourcePaths || {})) {
+    for (const path of paths) text = replacePathText(text, path, `<resource-source:${name}>`);
   }
   for (const [name, path] of Object.entries(context.temporaryPaths)) {
-    text = text.split(path).join(`<temp:${name}>`);
+    text = replacePathText(text, path, `<temp:${name}>`);
   }
-  text = text.split(runtimeDir).join("<job-runtime>");
+  text = replacePathText(text, runtimeDir, "<job-runtime>");
   for (const [name, patterns] of Object.entries(context.redactions)) {
     for (const value of patterns) text = text.split(value).join(`<redacted-resource:${name}>`);
   }
@@ -419,7 +477,7 @@ function writeJson(file, value, maxBytes) {
   if (Buffer.byteLength(text) > maxBytes) throw new Error(`job JSON exceeds ${maxBytes} bytes`);
   const temp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
   writeFileSync(temp, text, { mode: 0o600, flag: "wx" });
-  renameSync(temp, file);
+  replaceFileSync(temp, file);
   chmodSync(file, 0o600);
 }
 

package/src/local/log.mjs

@@ -1,4 +1,5 @@
 import process from "node:process";
+import os from "node:os";
 
 const COLORS = {
   reset: "\x1b[0m",
@@ -15,8 +16,16 @@ const MAX_LOG_ARRAY_ITEMS = 32;
 const MAX_LOG_OBJECT_KEYS = 48;
 const LEVEL_RANK = Object.freeze({ debug: 10, info: 20, success: 20, warn: 30, error: 40 });
 const SENSITIVE_KEY = /(authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)/i;
+const LOCAL_PATH_KEY = /(path|paths|cwd|workspace|directory|(?:^|[_-])dir(?:$|[_-])|root|home)/i;
 const SECRET_VALUE = /\b(?:mcp_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
 const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
+const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
+const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g;
+const API_SECRET = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g;
+const PRIVATE_KEY_HEADER = /-----BEGIN\s+(?:OPENSSH|RSA|EC|DSA)\s+PRIVATE\s+KEY-----/g;
+const HOME_PATHS = [...new Set([process.env.HOME, process.env.USERPROFILE, safeHomeDirectory()].filter(value => typeof value === "string" && value.length > 1))]
+  .sort((left, right) => right.length - left.length);
 
 export function createLogger(options = {}) {
   const quiet = Boolean(options.quiet);
@@ -86,8 +95,9 @@ export function formatFields(fields) {
   }
 }
 
-export function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth = 0) {
+function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth = 0) {
   if (SENSITIVE_KEY.test(key)) return "<redacted>";
+  if (LOCAL_PATH_KEY.test(key)) return "<local-path>";
   if (value instanceof Error) return sanitizeLogText(value.message || value.name);
   if (typeof value === "string") return sanitizeLogText(value);
   if (typeof value === "bigint") return value.toString();
@@ -106,9 +116,19 @@ export function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth =
 export function sanitizeLogText(value, maxChars = MAX_LOG_MESSAGE_CHARS) {
   let raw;
   try { raw = String(value ?? ""); } catch { raw = "<unprintable>"; }
-  const sanitized = raw
+  let sanitized = raw
     .replace(SECRET_VALUE, "<redacted-secret>")
     .replace(BEARER_VALUE, "Bearer <redacted>")
+    .replace(AWS_ACCESS_KEY, "<redacted-cloud-key>")
+    .replace(GITHUB_TOKEN, "<redacted-access-token>")
+    .replace(API_SECRET, "<redacted-api-secret>")
+    .replace(PRIVATE_KEY_HEADER, "<redacted-private-key-header>")
+    .replace(EMAIL_VALUE, "<redacted-email>");
+  for (const home of HOME_PATHS) sanitized = sanitized.split(home).join("<home>");
+  sanitized = sanitized
+    .replace(/\/(?:Users|home)\/[^/\s"'<>]+(?=\/|$)/g, "<home>")
+    .replace(/\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?=\\|$)/g, "<home>")
+    .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
     .replace(/[\r\n\t]/g, match => match === "\t" ? "\\t" : "\\n")
     .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "?");
   if (!Number.isFinite(Number(maxChars)) || Number(maxChars) <= 0) return "";
@@ -116,6 +136,10 @@ export function sanitizeLogText(value, maxChars = MAX_LOG_MESSAGE_CHARS) {
   return sanitized.length > limit ? `${sanitized.slice(0, limit - 1)}…` : sanitized;
 }
 
+function safeHomeDirectory() {
+  try { return os.homedir(); } catch { return ""; }
+}
+
 function shouldUseColor(options) {
   if (options.color === false || process.env.NO_COLOR) return false;
   if (options.color === true) return true;