machine-bridge-mcp 0.6.0 → 0.7.1

package/src/local/tools.mjs

@@ -9,7 +9,7 @@ export const MCP_INSTRUCTIONS = Object.freeze(serverMetadata.instructions.map((v
 
 
 export const DEFAULT_POLICY_PROFILE = "full";
-export const DEFAULT_POLICY_REVISION = 2;
+export const DEFAULT_POLICY_REVISION = 3;
 
 export const POLICY_PROFILES = Object.freeze({
   review: Object.freeze({ profile: "review", allowWrite: false, execMode: "off", unrestrictedPaths: false, minimalEnv: true, exposeAbsolutePaths: false }),
@@ -34,8 +34,9 @@ export function normalizePolicy(policy = {}) {
       : "off";
   const origin = POLICY_ORIGINS.has(policy.origin) ? policy.origin : "custom";
   const revision = Number.isInteger(policy.revision) && policy.revision > 0 ? policy.revision : DEFAULT_POLICY_REVISION;
-  return {
-    profile: typeof policy.profile === "string" && policy.profile ? policy.profile : "custom",
+  const requestedProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const normalized = {
+    profile: requestedProfile,
     origin,
     revision,
     allowWrite: policy.allowWrite === true,
@@ -45,6 +46,38 @@ export function normalizePolicy(policy = {}) {
     minimalEnv: policy.minimalEnv !== false,
     exposeAbsolutePaths: policy.exposeAbsolutePaths === true,
   };
+  if (POLICY_PROFILES[requestedProfile]) {
+    const canonical = POLICY_PROFILES[requestedProfile];
+    normalized.allowWrite = canonical.allowWrite;
+    normalized.allowExec = canonical.execMode !== "off";
+    normalized.execMode = canonical.execMode;
+    normalized.unrestrictedPaths = canonical.unrestrictedPaths;
+    normalized.minimalEnv = canonical.minimalEnv;
+    normalized.exposeAbsolutePaths = canonical.exposeAbsolutePaths;
+  }
+  return normalized;
+}
+
+export function isCanonicalFullPolicy(policy = {}) {
+  return policyCapabilitiesEqual(normalizePolicy(policy), POLICY_PROFILES.full);
+}
+
+export function assertCanonicalFullPolicy(policy = {}) {
+  const normalized = normalizePolicy(policy);
+  if (!isCanonicalFullPolicy(normalized) || normalized.profile !== "full") {
+    throw new Error("full profile invariant failed: full must enable writes, shell execution, unrestricted paths, full parent environment, and absolute paths");
+  }
+  const exposed = toolsForPolicy(normalized);
+  if (exposed.length !== catalog.length) throw new Error("full profile invariant failed: complete tool catalog is not exposed");
+  return normalized;
+}
+
+function policyCapabilitiesEqual(left, right) {
+  return left.allowWrite === right.allowWrite
+    && left.execMode === right.execMode
+    && left.unrestrictedPaths === right.unrestrictedPaths
+    && left.minimalEnv === right.minimalEnv
+    && left.exposeAbsolutePaths === right.exposeAbsolutePaths;
 }
 
 export function toolsForPolicy(policy = {}) {
@@ -92,6 +125,7 @@ function isAvailable(availability, policy) {
   if (availability === "write") return policy.allowWrite;
   if (availability === "direct-exec") return policy.execMode === "direct" || policy.execMode === "shell";
   if (availability === "shell-exec") return policy.execMode === "shell";
+  if (availability === "full") return policy.profile === "full" && isCanonicalFullPolicy(policy);
   return false;
 }
 

package/src/shared/server-metadata.json

@@ -11,14 +11,17 @@
     "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
     "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
     "Filename sensitivity is not classified by this server; the MCP host, connector gateway, local OS, or endpoint-security software may enforce additional independent rules.",
+    "A named full profile is canonical: it always enables writes, shell execution, unrestricted paths, the full parent environment, absolute paths, and the complete tool catalog. Any explicit narrowing is stored as custom.",
+    "The full catalog is what the local daemon and relay advertise. A connector host or platform can expose only a subset to a particular session; Machine Bridge cannot observe, authorize, or override that host-side filtering.",
     "Use diagnose_runtime to distinguish a request that reached the daemon from local filesystem, process-spawn, shell, managed-job-storage, and resource failures. A tool call blocked before any response cannot be diagnosed by the server.",
-    "Never request or return secret-file contents when a local resource alias can be used. Resources are registered only through the local machine-mcp CLI and may be injected by path, stdin, or environment without entering MCP arguments.",
+    "Never request or return secret-file contents when a local resource alias can be used. Resources are registered through the local machine-mcp CLI; under canonical full policy, generate_ssh_key_resource can generate and register an Ed25519 key without returning private content and may be injected by path, stdin, or environment without entering MCP arguments.",
     "If execution-class tools are unavailable but write access remains, use stage_job to persist a reviewed plan without running it; the operator can launch it locally with machine-mcp job approve JOB_ID.",
     "For multi-step, remote, long-running, or cleanup-sensitive work, prefer one start_job call with argv steps, job-scoped temporary_files, and idempotent finally_steps. The detached runner continues after MCP disconnects; inspect it with read_job or the local machine-mcp job CLI.",
     "Prefer sending remote shell programs through a process stdin rather than creating remote helper files. If temporary files are necessary, use {{temp:name}} or explicit finally_steps.",
     "Managed-job resource redaction is defense in depth, not a guarantee against transformed or partial secret output. Use capture_output=discard for steps that may echo credentials.",
     "Do not use shell encoding, renaming, or alternate tools to bypass host or platform safety policy.",
     "run_process avoids shell parsing but is not an OS sandbox. exec_command is exposed only in shell mode and has the local user's authority.",
+    "Per-tool success, failure, cancellation, and timing events are debug-only; default logs contain lifecycle and infrastructure events, not a tool-call transcript.",
     "Inspect before editing, prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run."
   ]
 }

package/src/shared/tool-catalog.json

@@ -635,6 +635,43 @@
       "additionalProperties": false
     }
   },
+  {
+    "name": "generate_ssh_key_resource",
+    "title": "Generate SSH key resource",
+    "description": "Generate or reuse an Ed25519 SSH key pair on the local machine and register the private key file as a local resource alias. Private key content is never returned. Local paths are omitted unless expose_paths=true; fingerprint, permissions, and registration status are returned. Available only under canonical full policy.",
+    "availability": "full",
+    "annotations": {
+      "readOnlyHint": false,
+      "destructiveHint": false,
+      "idempotentHint": true,
+      "openWorldHint": false
+    },
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$"
+        },
+        "path": {
+          "type": "string",
+          "maxLength": 4096
+        },
+        "comment": {
+          "type": "string",
+          "maxLength": 256
+        },
+        "expose_paths": {
+          "type": "boolean",
+          "description": "Return local private/public key paths. Defaults to false."
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false
+    }
+  },
   {
     "name": "stage_job",
     "title": "Stage managed job for local approval",

package/src/worker/index.ts

@@ -3,7 +3,7 @@ import toolCatalog from "../shared/tool-catalog.json";
 import serverMetadata from "../shared/server-metadata.json";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "0.6.0";
+const SERVER_VERSION = "0.7.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -27,6 +27,7 @@ const AUTH_FAILURE_WINDOW_SECONDS = 10 * 60;
 const AUTH_BLOCK_SECONDS = 15 * 60;
 const AUTH_FAILURE_LIMIT = 10;
 const AUTHORIZATION_FIELDS = new Set(["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "resource", "state"]);
+const UNSAFE_DISPLAY_CONTROLS = /[\u0000-\u001f\u007f\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g;
 
 interface BridgeEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
@@ -361,6 +362,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (request.method === "ping") return rpcResult(request.id, {});
     if (request.method === "tools/list") return rpcResult(request.id, { tools: this.allTools() });
     if (request.method === "tools/call") {
+      if (request.id === undefined || request.id === null) return rpcError(null, -32600, "tools/call requires a non-null request id");
       const params = asObject(request.params);
       const name = requiredString(params, "name");
       const args = asObject(params.arguments);
@@ -376,13 +378,22 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async callTool(name: string, args: Record<string, unknown>, base: string, requestKey?: string): Promise<unknown> {
     if (name === "server_info") {
+      const daemon = this.daemonStatus(true);
+      const tools = this.allTools().map((tool) => tool.name);
       return {
         name: SERVER_NAME,
         version: SERVER_VERSION,
         mcp_url: `${base}/mcp`,
         oauth: this.authorizationServerMetadata(base),
-        daemon: this.daemonStatus(true),
-        tools: this.allTools().map((tool) => tool.name),
+        daemon,
+        tools,
+        tool_delivery: {
+          full_profile_scope: "local-daemon-and-relay-advertisement",
+          daemon_advertised_tool_count: daemon.tool_count,
+          relay_advertised_tool_count: tools.length,
+          host_exposed_tools_known_to_server: false,
+          host_may_expose_subset: true,
+        },
       };
     }
     if (workspaceTools.some((tool) => tool.name === name)) {
@@ -657,13 +668,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (redirectUris.length > 5) {
       return json({ error: "invalid_client_metadata", error_description: "redirect_uris must contain at most 5 entries" }, 400);
     }
-    const normalized = [...new Set(redirectUris.map((item) => String(item)))];
-    if (normalized.some((item) => item.length > 1024)) {
+    const suppliedRedirectUris = redirectUris.map((item) => String(item));
+    if (suppliedRedirectUris.some((item) => item.length > 1024)) {
       return json({ error: "invalid_client_metadata", error_description: "redirect_uri is too long" }, 400);
     }
-    if (!normalized.every(isAllowedRedirectUri)) {
-      return json({ error: "invalid_client_metadata", error_description: "redirect_uris must be https or local http" }, 400);
+    const canonicalRedirectUris = suppliedRedirectUris.map(normalizeRedirectUri);
+    if (canonicalRedirectUris.some((item) => item === null)) {
+      return json({ error: "invalid_client_metadata", error_description: "redirect_uris must be canonicalizable https or local http URLs without credentials or fragments" }, 400);
     }
+    const normalized = [...new Set(canonicalRedirectUris as string[])];
 
     return this.withOAuthLock(async () => {
       const store = await this.oauthStore();
@@ -725,7 +738,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       .filter(([key]) => AUTHORIZATION_FIELDS.has(key))
       .map(([key, value]) => `<input type="hidden" name="${escapeHtml(key)}" value="${escapeHtml(String(value))}">`)
       .join("\n");
-    const resource = authorization?.requestedResource ?? String(submitted?.resource ?? url.searchParams.get("resource") ?? `${base}/mcp`);
+    const resource = normalizeDisplayText(
+      authorization?.requestedResource ?? String(submitted?.resource ?? url.searchParams.get("resource") ?? `${base}/mcp`),
+      1024,
+      `${base}/mcp`,
+    );
     const clientBlock = authorization
       ? `<p><strong>Client:</strong> ${escapeHtml(authorization.client.client_name)}</p>
     <p><strong>Redirect URI:</strong> <code>${escapeHtml(authorization.redirectUri)}</code></p>`
@@ -971,7 +988,7 @@ function isFreshDaemonCandidate(connectedAt: string): boolean {
 
 function sanitizeMetadataText(value: unknown, maxLength: number): string | undefined {
   if (typeof value !== "string") return undefined;
-  const normalized = value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+  const normalized = value.replace(UNSAFE_DISPLAY_CONTROLS, " ").replace(/\s+/g, " ").trim();
   return normalized ? normalized.slice(0, maxLength) : undefined;
 }
 
@@ -991,6 +1008,12 @@ function daemonPolicyAllows(availability: unknown, policy: Record<string, unknow
   if (availability === "write") return policy.allowWrite === true;
   if (availability === "direct-exec") return policy.execMode === "direct" || policy.execMode === "shell";
   if (availability === "shell-exec") return policy.execMode === "shell";
+  if (availability === "full") return policy.profile === "full"
+    && policy.allowWrite === true
+    && policy.execMode === "shell"
+    && policy.unrestrictedPaths === true
+    && policy.minimalEnv === false
+    && policy.exposeAbsolutePaths === true;
   return false;
 }
 
@@ -1266,15 +1289,15 @@ async function pkceS256(verifier: string): Promise<string> {
   return base64Url(new Uint8Array(digest));
 }
 
-function isAllowedRedirectUri(value: string): boolean {
+function normalizeRedirectUri(value: string): string | null {
   try {
     const url = new URL(value);
-    if (url.username || url.password || url.hash) return false;
-    if (url.protocol === "https:" && url.hostname) return true;
-    if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return true;
-    return false;
+    if (url.username || url.password || url.hash) return null;
+    if (url.protocol === "https:" && url.hostname) return url.toString();
+    if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return url.toString();
+    return null;
   } catch {
-    return false;
+    return null;
   }
 }
 
@@ -1353,9 +1376,9 @@ function searchParamsObject(params: URLSearchParams): Record<string, unknown> {
   return out;
 }
 
-function normalizeDisplayText(value: string, maxLength: number): string {
-  const normalized = value.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
-  return (normalized || "MCP Client").slice(0, maxLength);
+function normalizeDisplayText(value: string, maxLength: number, fallback = "MCP Client"): string {
+  const normalized = value.replace(UNSAFE_DISPLAY_CONTROLS, " ").replace(/\s+/g, " ").trim();
+  return (normalized || fallback).slice(0, maxLength);
 }
 
 function escapeHtml(value: string): string {

package/wrangler.jsonc

@@ -2,7 +2,7 @@
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "machine-bridge-mcp",
   "main": "src/worker/index.ts",
-  "compatibility_date": "2026-07-09",
+  "compatibility_date": "2026-07-11",
   "compatibility_flags": ["nodejs_compat"],
   "workers_dev": true,
   "durable_objects": {