machine-bridge-mcp 0.6.2 → 0.7.1

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Cross-client MCP bridge for canonical local automation, files, Git, SSH resources, managed jobs, and processes over stdio or an OAuth-protected remote relay.",
   "type": "module",
   "license": "MIT",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=26.0.0"
   },
   "bin": {
     "machine-bridge-mcp": "bin/machine-mcp.mjs",
@@ -20,11 +20,15 @@
     "src/shared",
     "src/worker/index.ts",
     "scripts/sync-worker-version.mjs",
+    "scripts/privacy-check.mjs",
+    "scripts/release-impact-check.mjs",
+    "scripts/network-retry.mjs",
     "wrangler.jsonc",
     "tsconfig.json",
     "README.md",
     "SECURITY.md",
     "CHANGELOG.md",
+    "CONTRIBUTING.md",
     "docs",
     "LICENSE"
   ],
@@ -35,12 +39,12 @@
     "version:sync": "node scripts/sync-worker-version.mjs",
     "version:check": "node scripts/sync-worker-version.mjs --check",
     "version": "node scripts/sync-worker-version.mjs && git add package.json package-lock.json src/worker/index.ts",
-    "prepack": "npm run version:check",
+    "prepack": "npm run version:check && npm run privacy:check && npm run release-impact:check",
     "prepublishOnly": "npm run check && npm run version:check && npm run release:check",
     "worker:types": "wrangler types src/worker/worker-configuration.d.ts",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
-    "syntax": "sh -n mbm && node --check bin/machine-mcp.mjs && node --check src/local/cli.mjs && node --check src/local/daemon.mjs && node --check src/local/patch.mjs && node --check src/local/process-sessions.mjs && node --check src/local/tools.mjs && node --check src/local/stdio.mjs && node --check src/local/state.mjs && node --check src/local/shell.mjs && node --check src/local/service.mjs && node --check src/local/log.mjs && node --check src/local/atomic-fs.mjs && node --check src/local/ssh-key.mjs && node --check src/local/resource-operations.mjs && node --check src/local/full-access-test.mjs && node --check src/local/managed-jobs.mjs && node --check src/local/job-runner.mjs && node --check scripts/sync-worker-version.mjs && node --check scripts/github-release.mjs && node --check tests/worker-integration-test.mjs && node --check tests/stdio-integration-test.mjs && node --check tests/catalog-test.mjs && node --check tests/local-self-test.mjs && node --check tests/daemon-self-test.mjs && node --check tests/managed-jobs-test.mjs && node --check tests/ssh-key-test.mjs && node --check tests/full-access-test.mjs && node --check tests/atomic-fs-test.mjs",
-    "check": "npm run typecheck && npm run syntax && npm run catalog:test && npm run self-test && npm run atomic-fs:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "syntax": "sh -n mbm && node --check bin/machine-mcp.mjs && node --check src/local/cli.mjs && node --check src/local/daemon.mjs && node --check src/local/patch.mjs && node --check src/local/process-sessions.mjs && node --check src/local/tools.mjs && node --check src/local/stdio.mjs && node --check src/local/state.mjs && node --check src/local/shell.mjs && node --check src/local/service.mjs && node --check src/local/log.mjs && node --check src/local/atomic-fs.mjs && node --check src/local/ssh-key.mjs && node --check src/local/resource-operations.mjs && node --check src/local/full-access-test.mjs && node --check src/local/managed-jobs.mjs && node --check src/local/job-runner.mjs && node --check scripts/sync-worker-version.mjs && node --check scripts/privacy-check.mjs && node --check scripts/release-impact-check.mjs && node --check scripts/network-retry.mjs && node --check scripts/github-release.mjs && node --check tests/worker-integration-test.mjs && node --check tests/stdio-integration-test.mjs && node --check tests/catalog-test.mjs && node --check tests/local-self-test.mjs && node --check tests/daemon-self-test.mjs && node --check tests/managed-jobs-test.mjs && node --check tests/ssh-key-test.mjs && node --check tests/full-access-test.mjs && node --check tests/atomic-fs-test.mjs && node --check tests/package-test.mjs && node --check tests/release-impact-test.mjs && node --check tests/privacy-test.mjs && node --check tests/network-retry-test.mjs",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run network-retry:test && npm run typecheck && npm run syntax && npm run catalog:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -51,15 +55,21 @@
     "managed-jobs:test": "node tests/managed-jobs-test.mjs",
     "ssh-key:test": "node tests/ssh-key-test.mjs",
     "full-access:test": "node tests/full-access-test.mjs",
-    "atomic-fs:test": "node tests/atomic-fs-test.mjs"
+    "atomic-fs:test": "node tests/atomic-fs-test.mjs",
+    "privacy:check": "node scripts/privacy-check.mjs",
+    "package:test": "node tests/package-test.mjs",
+    "release-impact:check": "node scripts/release-impact-check.mjs",
+    "release-impact:test": "node tests/release-impact-test.mjs",
+    "privacy:test": "node tests/privacy-test.mjs",
+    "network-retry:test": "node tests/network-retry-test.mjs"
   },
   "dependencies": {
     "wrangler": "4.110.0",
     "ws": "8.21.0"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "typescript": "^7.0.2"
+    "@types/node": "26.1.1",
+    "typescript": "7.0.2"
   },
   "keywords": [
     "mcp",
@@ -89,5 +99,18 @@
     "sharp@0.34.5": true,
     "workerd@1.20260708.1": true,
     "fsevents": false
+  },
+  "packageManager": "npm@12.0.1",
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": ">=26.0.0",
+      "onFail": "error"
+    },
+    "packageManager": {
+      "name": "npm",
+      "version": ">=12.0.0",
+      "onFail": "error"
+    }
   }
 }

package/scripts/network-retry.mjs

@@ -0,0 +1,47 @@
+import { spawnSync } from "node:child_process";
+
+const WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
+const TRANSIENT_NETWORK_FAILURE = /(?:SSL_ERROR_SYSCALL|SSL_connect|TLS handshake timeout|Client network socket disconnected before secure TLS connection was established|unexpected EOF|unexpected eof while reading|\bEOF\b|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|ECONNREFUSED|Could not resolve host|Failed to connect|connection (?:was )?reset|remote end hung up|unexpected disconnect|HTTP (?:429|5\d\d)|(?:502|503|504) (?:Bad Gateway|Service Unavailable|Gateway Timeout))/i;
+
+export function runNetworkCommand(command, args, options = {}) {
+  const attempts = clampInteger(options.attempts, 3, 1, 5);
+  const baseDelayMs = clampInteger(options.baseDelayMs, 750, 0, 10_000);
+  const actualArgs = networkCommandArgs(command, args);
+  let result;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    result = spawnSync(command, actualArgs, {
+      cwd: options.cwd,
+      encoding: "utf8",
+      stdio: "pipe",
+      env: options.env,
+      windowsHide: true,
+    });
+    result.attempts = attempt;
+    if (!isTransientNetworkFailure(result) || attempt === attempts) return result;
+    sleepSync(Math.min(baseDelayMs * attempt, 5_000));
+  }
+  return result;
+}
+
+export function networkCommandArgs(command, args) {
+  return command === "git" ? ["-c", "http.version=HTTP/1.1", ...args] : [...args];
+}
+
+export function isTransientNetworkFailure(result) {
+  if (result?.error) {
+    const code = String(result.error.code || "");
+    if (["ECONNRESET", "ETIMEDOUT", "EAI_AGAIN", "ENETUNREACH", "ECONNREFUSED"].includes(code)) return true;
+  }
+  const detail = `${result?.stdout ?? ""}\n${result?.stderr ?? ""}\n${result?.error?.message ?? ""}`;
+  return TRANSIENT_NETWORK_FAILURE.test(detail);
+}
+
+function sleepSync(milliseconds) {
+  if (milliseconds > 0) Atomics.wait(WAIT_BUFFER, 0, 0, milliseconds);
+}
+
+function clampInteger(value, fallback, minimum, maximum) {
+  const parsed = Number.parseInt(String(value ?? ""), 10);
+  const number = Number.isFinite(parsed) ? parsed : fallback;
+  return Math.min(Math.max(number, minimum), maximum);
+}

package/scripts/privacy-check.mjs

@@ -0,0 +1,177 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const selfPath = "scripts/privacy-check.mjs";
+const candidates = collectCandidateFiles(root);
+const denylist = loadDenylist(path.join(root, ".privacy-denylist"));
+const findings = [];
+
+for (const relativePath of candidates) {
+  if (relativePath === ".privacy-denylist") continue;
+  scanDenylistPath(relativePath, denylist, findings);
+  const fullPath = path.join(root, relativePath);
+  let info;
+  try { info = lstatSync(fullPath); } catch { continue; }
+  if (info.isSymbolicLink()) {
+    findings.push({ path: relativePath, line: 1, rule: "symbolic link in publication surface" });
+    continue;
+  }
+  if (!info.isFile()) continue;
+  let buffer;
+  try { buffer = readFileSync(fullPath); } catch { continue; }
+  if (buffer.length > 5 * 1024 * 1024) {
+    findings.push({ path: relativePath, line: 1, rule: "file exceeds privacy scanner size limit and requires manual review" });
+    continue;
+  }
+  if (buffer.includes(0)) {
+    findings.push({ path: relativePath, line: 1, rule: "binary file in publication surface requires manual review" });
+    continue;
+  }
+  let text;
+  try { text = new TextDecoder("utf-8", { fatal: true }).decode(buffer); } catch {
+    findings.push({ path: relativePath, line: 1, rule: "non-UTF-8 file in publication surface requires manual review" });
+    continue;
+  }
+  if (relativePath !== selfPath) scanBuiltIn(relativePath, text, findings);
+  scanDenylist(relativePath, text, denylist, findings);
+}
+
+if (findings.length) {
+  for (const finding of findings.slice(0, 100)) {
+    process.stderr.write(`${redactReportPath(finding.path, denylist)}:${finding.line}: ${finding.rule}\n`);
+  }
+  if (findings.length > 100) process.stderr.write(`... ${findings.length - 100} additional findings omitted\n`);
+  process.stderr.write("Privacy check failed. Replace private identifiers with synthetic examples or review the local denylist.\n");
+  process.exit(1);
+}
+
+process.stderr.write(`privacy check ok (${candidates.length} tracked/unignored files; ${denylist.length} local denylist entries)\n`);
+
+function collectCandidateFiles(directory) {
+  try {
+    return execFileSync("git", ["-C", directory, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+      encoding: "buffer",
+      maxBuffer: 32 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+    }).toString("utf8").split("\0").filter(Boolean).sort();
+  } catch {
+    const excluded = new Set([".git", ".wrangler", "node_modules"]);
+    const files = [];
+    const stack = [""];
+    while (stack.length) {
+      const relative = stack.pop();
+      const absolute = path.join(directory, relative);
+      let entries;
+      try { entries = readdirSync(absolute, { withFileTypes: true }); } catch { continue; }
+      for (const entry of entries) {
+        if (excluded.has(entry.name) || entry.name === ".privacy-denylist") continue;
+        const child = relative ? path.join(relative, entry.name) : entry.name;
+        if (entry.isDirectory()) stack.push(child);
+        else if (entry.isFile() || entry.isSymbolicLink()) files.push(child.split(path.sep).join("/"));
+      }
+    }
+    return files.sort();
+  }
+}
+
+function redactReportPath(relativePath, entries) {
+  let shown = String(relativePath);
+  for (const entry of entries) {
+    const expression = new RegExp(escapeRegExp(entry), "gi");
+    shown = shown.replace(expression, "<private>");
+  }
+  return shown;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function scanBuiltIn(relativePath, text, out) {
+  const rules = [
+    ["private key material", /-----BEGIN\s+(?:OPENSSH|RSA|EC|DSA)\s+PRIVATE\s+KEY-----/g],
+    ["AWS access key", /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g],
+    ["GitHub access token", /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g],
+    ["API secret token", /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+    ["absolute macOS/Linux home path", /(?:^|[\s"'=(:,])\/(?:Users|home)\/([^/\s"'<>]+)\//gm],
+    ["absolute Windows home path", /(?:^|[\s"'=(:,])\b[A-Za-z]:\\Users\\([^\\\s"'<>]+)\\/gm],
+  ];
+  for (const [rule, expression] of rules) {
+    for (const match of text.matchAll(expression)) {
+      if (rule.includes("home path") && isSyntheticUser(String(match[1] || ""))) continue;
+      out.push({ path: relativePath, line: lineNumber(text, match.index || 0), rule });
+    }
+  }
+  const sshLike = /\b[A-Za-z_][A-Za-z0-9._-]*@([A-Za-z0-9.-]+)\b/g;
+  for (const match of text.matchAll(sshLike)) {
+    if (isReservedExampleHost(match[1]) || !hasNearbySshContext(text, match.index || 0)) continue;
+    out.push({ path: relativePath, line: lineNumber(text, match.index || 0), rule: "non-example SSH user@host identifier" });
+  }
+}
+
+function scanDenylistPath(relativePath, entries, out) {
+  const lower = relativePath.toLocaleLowerCase("en-US");
+  for (const entry of entries) {
+    if (lower.includes(entry)) out.push({ path: relativePath, line: 1, rule: "local private-identifier denylist match in file path" });
+  }
+}
+
+function scanDenylist(relativePath, text, entries, out) {
+  const lower = text.toLocaleLowerCase("en-US");
+  for (const entry of entries) {
+    let offset = 0;
+    while ((offset = lower.indexOf(entry, offset)) !== -1) {
+      out.push({ path: relativePath, line: lineNumber(text, offset), rule: "local private-identifier denylist match" });
+      offset += Math.max(1, entry.length);
+    }
+  }
+}
+
+function loadDenylist(file) {
+  if (!existsSync(file)) return [];
+  let text;
+  try { text = readFileSync(file, "utf8"); } catch { return []; }
+  return [...new Set(text.split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith("#") && line.length >= 3)
+    .map((line) => line.toLocaleLowerCase("en-US")))];
+}
+
+function isSyntheticUser(value) {
+  return /^(?:user|username|example|test|name|home|runner|workspace|tmp|private|path|package)$/i.test(value)
+    || /^<[^>]+>$/.test(value);
+}
+
+function hasNearbySshContext(text, offset) {
+  const lineStart = Math.max(0, text.lastIndexOf("\n", offset - 1));
+  let start = lineStart;
+  for (let count = 0; count < 4 && start > 0; count += 1) start = Math.max(0, text.lastIndexOf("\n", start - 1));
+  let end = offset;
+  for (let count = 0; count < 4 && end < text.length; count += 1) {
+    const next = text.indexOf("\n", end + 1);
+    end = next === -1 ? text.length : next;
+  }
+  return /\b(?:ssh|scp|sftp)\b/i.test(text.slice(start, end));
+}
+
+function isReservedExampleHost(host) {
+  const value = String(host || "").toLowerCase().replace(/\.$/, "");
+  return value === "localhost"
+    || value === "127.0.0.1"
+    || value === "::1"
+    || value === "example"
+    || value.endsWith(".example")
+    || value.endsWith(".example.com")
+    || value.endsWith(".example.net")
+    || value.endsWith(".example.org")
+    || value.endsWith(".invalid");
+}
+
+function lineNumber(text, offset) {
+  let line = 1;
+  for (let index = 0; index < offset; index += 1) if (text.charCodeAt(index) === 10) line += 1;
+  return line;
+}

package/scripts/release-impact-check.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+const VERSION_TAG = /^v(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+
+const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const current = parseVersion(String(pkg.version || ""));
+if (!current) fail("package.json contains an invalid version");
+
+const tags = git(["tag", "--merged", "HEAD", "--sort=-version:refname", "--list", "v[0-9]*"])
+  .split("\n")
+  .map((value) => value.trim())
+  .filter((value) => VERSION_TAG.test(value));
+if (!tags.length) {
+  process.stderr.write("release impact check skipped: no reachable version tag\n");
+  process.exit(0);
+}
+
+const latestTag = tags[0];
+const latest = parseVersion(latestTag.slice(1));
+const changed = new Set([
+  ...lines(git(["diff", "--name-only", latestTag, "--"])),
+  ...lines(git(["ls-files", "--others", "--exclude-standard"])),
+]);
+const relevant = [...changed].sort();
+
+if (!relevant.length) {
+  process.stderr.write(`release impact check ok: no release-relevant changes since ${latestTag}\n`);
+  process.exit(0);
+}
+if (compareVersions(current, latest) <= 0) {
+  fail(`release-relevant changes exist since ${latestTag}, but package.json is still ${pkg.version}; bump the npm version and add a CHANGELOG section before merging`);
+}
+
+const changelog = readFileSync(new URL("../CHANGELOG.md", import.meta.url), "utf8");
+const heading = new RegExp(`^## ${escapeRegExp(pkg.version)}(?:\\s+-[^\\n]*)?$`, "m");
+if (!heading.test(changelog)) fail(`CHANGELOG.md has no section for ${pkg.version}`);
+
+process.stderr.write(`release impact check ok: ${relevant.length} release-relevant file(s) since ${latestTag}; next npm version ${pkg.version}\n`);
+
+function git(args) {
+  try {
+    return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  } catch (error) {
+    const detail = String(error?.stderr || error?.message || error).trim();
+    fail(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+}
+
+function lines(value) {
+  return value ? value.split("\n").map((item) => item.trim()).filter(Boolean) : [];
+}
+
+function parseVersion(value) {
+  const match = String(value).match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/);
+  return match ? { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), prerelease: match[4] || "" } : null;
+}
+
+function compareVersions(left, right) {
+  for (const key of ["major", "minor", "patch"]) {
+    if (left[key] !== right[key]) return left[key] - right[key];
+  }
+  if (left.prerelease === right.prerelease) return 0;
+  if (!left.prerelease) return 1;
+  if (!right.prerelease) return -1;
+  return left.prerelease.localeCompare(right.prerelease);
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function fail(message) {
+  process.stderr.write(`release impact check failed: ${message}\n`);
+  process.exit(1);
+}

package/src/local/cli.mjs

@@ -40,7 +40,7 @@ const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
   "daemonOnly", "noAutostart", "noPrintCredentials", "printMcpCredentials",
   "printCredentials", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
-  "yes", "keepWorker", "allowInsecurePermissions",
+  "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
 ]);
 const VALUE_OPTIONS = new Set([
   "workspace", "stateDir", "workerName", "profile", "execMode", "client", "logLevel",
@@ -92,7 +92,7 @@ const COMMAND_OPTIONS = {
   workspace: new Set(["workspace", "stateDir"]),
   service: new Set(["workspace", "stateDir", "quiet"]),
   autostart: new Set(["workspace", "stateDir", "quiet"]),
-  resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "json"]),
+  resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
 };
@@ -478,10 +478,19 @@ async function resourceCommand(args) {
   state.resources ||= {};
 
   if (action === "list") {
-    const resources = publicResourceRegistry(state.resources);
-    if (args.json) console.log(JSON.stringify({ workspace, resources }, null, 2));
+    const includePaths = args.showPaths === true;
+    const resources = publicResourceRegistry(state.resources, { includePaths });
+    if (args.json) console.log(JSON.stringify({
+      workspace: includePaths ? workspace : "<local-workspace>",
+      paths_exposed: includePaths,
+      resources,
+    }, null, 2));
     else if (!Object.keys(resources).length) console.log("No local resources registered.");
-    else for (const [name, value] of Object.entries(resources)) console.log(`${name}	${value.path}	${value.mode || "n/a"}	${value.size ?? "n/a"} bytes`);
+    else for (const [name, value] of Object.entries(resources)) {
+      const fields = [name, value.mode || "n/a", `${value.size ?? "n/a"} bytes`];
+      if (includePaths) fields.splice(1, 0, value.path);
+      console.log(fields.join("\t"));
+    }
     return;
   }
 
@@ -500,11 +509,14 @@ async function resourceCommand(args) {
       }
       latest.resources[name] = inspected;
       saveState(latest);
-      const result = { name, ...inspected, contents_exposed: false, available_to_new_jobs_immediately: true };
+      const result = publicResourceInspection(name, inspected, {
+        includePath: args.showPaths === true,
+        available_to_new_jobs_immediately: true,
+      });
       if (args.json) console.log(JSON.stringify(result, null, 2));
       else {
         console.log(`Registered local resource: ${name}`);
-        console.log(`Path: ${inspected.path}`);
+        if (args.showPaths === true) console.log(`Path: ${inspected.path}`);
         console.log(`Mode: ${inspected.mode || "n/a"}; size: ${inspected.size} bytes`);
         console.log("The resource is available to newly submitted managed jobs immediately.");
       }
@@ -526,11 +538,10 @@ async function resourceCommand(args) {
       targetPath: requestedPath,
       comment: `machine-mcp:${name}`,
     });
+    const includePaths = args.showPaths === true;
     const result = {
       name: key.name,
       created: key.created,
-      private_key_path: key.privateKeyPath,
-      public_key_path: key.publicKeyPath,
       fingerprint: key.fingerprint,
       key_type: key.keyType,
       private_mode: key.privateMode,
@@ -538,12 +549,16 @@ async function resourceCommand(args) {
       private_key_content_exposed: key.privateKeyContentExposed,
       registered: key.registered,
       available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+      paths_exposed: includePaths,
+      ...(includePaths ? { private_key_path: key.privateKeyPath, public_key_path: key.publicKeyPath } : {}),
     };
     if (args.json) console.log(JSON.stringify(result, null, 2));
     else {
       console.log(`${key.created ? "Generated and registered" : "Reused and registered"} SSH key resource: ${name}`);
-      console.log(`Private key: ${key.privateKeyPath}`);
-      console.log(`Public key: ${key.publicKeyPath}`);
+      if (includePaths) {
+        console.log(`Private key: ${key.privateKeyPath}`);
+        console.log(`Public key: ${key.publicKeyPath}`);
+      }
       console.log(`Fingerprint: ${key.fingerprint}`);
       console.log("Private key content was not printed or sent through MCP.");
     }
@@ -577,15 +592,33 @@ async function resourceCommand(args) {
     const resource = state.resources[name];
     if (!resource) throw new Error(`local resource is not registered: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
-    const result = { name, ...inspected, contents_exposed: false };
+    const result = publicResourceInspection(name, inspected, { includePath: args.showPaths === true });
     if (args.json) console.log(JSON.stringify(result, null, 2));
-    else console.log(`${name}: available (${inspected.mode || "n/a"}, ${inspected.size} bytes)`);
+    else {
+      const pathDetail = args.showPaths === true ? ` at ${inspected.path}` : "";
+      console.log(`${name}: available${pathDetail} (${inspected.mode || "n/a"}, ${inspected.size} bytes)`);
+    }
     return;
   }
 
   throw new Error(`Unknown resource action: ${action}`);
 }
 
+function publicResourceInspection(name, inspected, { includePath = false, ...extra } = {}) {
+  return {
+    name,
+    kind: inspected.kind,
+    size: inspected.size ?? null,
+    mode: inspected.mode ?? null,
+    updated_at: inspected.updatedAt ?? null,
+    allow_insecure_permissions: inspected.allowInsecurePermissions === true,
+    ...extra,
+    paths_exposed: includePath,
+    contents_exposed: false,
+    ...(includePath ? { path: inspected.path } : {}),
+  };
+}
+
 async function jobCommand(args) {
   const action = String(args._[0] || "list").toLowerCase();
   const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
@@ -915,7 +948,7 @@ async function statusCommand(args) {
 async function doctorCommand(args) {
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: false, save: false, allowPositional: true });
   const checks = [];
-  checks.push({ name: "node", ok: Number(process.versions.node.split(".")[0]) >= 22, detail: process.version });
+  checks.push({ name: "node", ok: isSupportedNodeVersion(), detail: process.version });
   const wrangler = await runWrangler(["--version"], { capture: true, allowFailure: true });
   checks.push({ name: "wrangler", ok: wrangler.code === 0, detail: (wrangler.stdout || wrangler.stderr).trim() });
   const whoami = await runWrangler(["whoami"], { capture: true, allowFailure: true });
@@ -1218,9 +1251,13 @@ function validateWorkerName(value) {
   return name;
 }
 
+export function isSupportedNodeVersion(version = process.versions.node) {
+  const major = Number(String(version || "").split(".")[0]);
+  return Number.isInteger(major) && major >= 26;
+}
+
 function assertNodeVersion() {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major < 22) throw new Error(`Node.js >=22 is required; current ${process.version}`);
+  if (!isSupportedNodeVersion()) throw new Error(`Node.js >=26 is required; current ${process.version}`);
 }
 
 function usage() {
@@ -1274,6 +1311,7 @@ Start options:
   --quiet               Alias for --log-level error
   --allow-insecure-permissions
                         Permit resource registration when a file is group/other-readable
+  --show-paths          Include local absolute paths in resource command output
 
 Uninstall options:
   --keep-worker         Do not delete deployed Worker(s) during uninstall