machine-bridge-mcp 0.6.2 → 0.7.1

package/src/local/daemon.mjs

@@ -86,7 +86,7 @@ export class LocalDaemon {
       protocol_version: MCP_PROTOCOL_VERSION,
       supported_protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
       workspace: this.displayPath(this.workspace),
-      workspace_name: basename(this.workspace),
+      workspace_name: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
       policy: this.policy,
       policy_contract: {
         named_profile_is_canonical: this.policy.profile === "custom" || policyMatchesNamedProfile(this.policy),
@@ -99,6 +99,12 @@ export class LocalDaemon {
         operating_system_permissions_apply: true,
         host_policy_is_independent: true,
       },
+      tool_delivery: {
+        full_profile_scope: "local-daemon-and-relay-advertisement",
+        daemon_advertised_tool_count: this.tools().length + 1,
+        host_exposed_tools_known_to_server: false,
+        host_may_expose_subset: true,
+      },
       tools: ["server_info", ...this.tools()],
       observability: {
         per_tool_events: "debug-only",
@@ -144,7 +150,7 @@ export class LocalDaemon {
     if (this.closed) return;
     const wsUrl = `${this.workerUrl.replace(/^http/i, "ws")}/daemon/ws`;
     this.logger.debug?.("connecting to remote relay", { endpoint: redactUrl(wsUrl) });
-    const socket = new WebSocket(wsUrl, { headers: { "X-Bridge-Token": this.secret } });
+    const socket = new WebSocket(wsUrl, { headers: { "X-Bridge-Token": this.secret }, maxPayload: MAX_WS_MESSAGE_BYTES });
     this.ws = socket;
 
     socket.on("open", () => {
@@ -266,7 +272,7 @@ export class LocalDaemon {
       const durationMs = Date.now() - started;
       this.logger.debug?.(durationMs >= SLOW_TOOL_CALL_MS ? "slow tool call completed" : "tool call completed", { call_id: shortCallId(id), tool, duration_ms: durationMs });
     } catch (error) {
-      const safeError = this.safeErrorMessage(error);
+      const safeError = this.safeErrorMessage(error, argumentsValue);
       this.send({ type: "tool_result", id, ok: false, error: { message: safeError } });
       const durationMs = Date.now() - started;
       this.logger.debug?.("tool call failed", { call_id: shortCallId(id), tool, duration_ms: durationMs, error_class: classifyOperationalError(error) });
@@ -339,7 +345,7 @@ export class LocalDaemon {
     const git = await this.runProcess("git", ["-c", "core.fsmonitor=false", "-C", this.workspace, "rev-parse", "--show-toplevel"], 10_000, true, 512 * 1024, context);
     return {
       workspace: this.displayPath(this.workspace),
-      workspaceName: basename(this.workspace),
+      workspaceName: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
       gitRoot: git.code === 0 ? this.displayPath(git.stdout.trim()) : "",
       policy: this.policy,
       tools: ["server_info", ...this.tools()],
@@ -348,7 +354,7 @@ export class LocalDaemon {
   }
 
   listRoots() {
-    const roots = [{ name: basename(this.workspace), path: this.displayPath(this.workspace), default: true }];
+    const roots = [{ name: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace", path: this.displayPath(this.workspace), default: true }];
     if (this.policy.unrestrictedPaths) {
       const home = process.env.HOME || process.env.USERPROFILE;
       if (home && home !== this.workspace) roots.push({ name: "home", path: this.displayPath(resolve(home)), default: false });
@@ -757,18 +763,22 @@ export class LocalDaemon {
       targetPath: target,
       comment: args.comment || `machine-mcp:${args.name}`,
     });
+    const exposePaths = args.expose_paths === true;
     return {
       name: key.name,
       created: key.created,
       registered: key.registered,
-      private_key_path: this.displayPath(key.privateKeyPath),
-      public_key_path: this.displayPath(key.publicKeyPath),
       fingerprint: key.fingerprint,
       key_type: key.keyType,
       private_mode: key.privateMode,
       public_mode: key.publicMode,
       private_key_content_exposed: key.privateKeyContentExposed,
       available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+      paths_exposed: exposePaths,
+      ...(exposePaths ? {
+        private_key_path: resolve(key.privateKeyPath),
+        public_key_path: resolve(key.publicKeyPath),
+      } : {}),
     };
   }
 
@@ -831,7 +841,7 @@ export class LocalDaemon {
       timer.unref?.();
       const cleanup = () => {
         clearTimeout(timer);
-        if (killTimer && !timedOut) clearTimeout(killTimer);
+        if (killTimer) clearTimeout(killTimer);
         this.activeProcesses.delete(child);
         if (context.callId) {
           const set = this.callProcesses.get(context.callId);
@@ -944,19 +954,25 @@ export class LocalDaemon {
 
   displayPath(fullPath) {
     const absolute = resolve(fullPath);
-    if (this.policy.exposeAbsolutePaths || this.policy.unrestrictedPaths) return absolute;
-    assertContainedPath(this.workspace, absolute);
+    if (this.policy.exposeAbsolutePaths) return absolute;
     const shown = relative(this.workspace, absolute);
-    return shown ? shown.split(sep).join("/") : ".";
+    const insideWorkspace = shown === "" || (!shown.startsWith(`..${sep}`) && shown !== ".." && !isAbsolute(shown));
+    if (insideWorkspace) return shown ? shown.split(sep).join("/") : ".";
+    return `<external-path:${sha256(absolute).slice(0, 12)}>`;
   }
 
-  safeErrorMessage(error) {
+  safeErrorMessage(error, toolArgs = {}) {
     let message = boundedErrorMessage(error);
     if (!this.policy.exposeAbsolutePaths) {
       for (const prefix of equivalentPathPrefixes(this.workspace, this.workspaceInput)) message = replacePathPrefix(message, prefix, ".");
       for (const prefix of equivalentPathPrefixes(this.runtimeDir)) message = replacePathPrefix(message, prefix, "<runtime>");
       const home = process.env.HOME || process.env.USERPROFILE;
       if (home) message = replacePathPrefix(message, resolve(home), "<home>");
+      for (const candidate of collectToolPathCandidates(error, toolArgs, this.workspaceInput)) {
+        const absolute = isAbsolute(candidate) ? resolve(candidate) : resolve(this.workspaceInput, candidate);
+        const replacement = this.displayPath(absolute);
+        for (const prefix of equivalentPathPrefixes(candidate, absolute)) message = replacePathPrefix(message, prefix, replacement);
+      }
     }
     return message;
   }
@@ -1202,6 +1218,27 @@ function isPlainRecord(value) {
 }
 
 
+function collectToolPathCandidates(error, toolArgs, workspace) {
+  const candidates = new Set();
+  for (const value of [error?.path, error?.dest]) if (typeof value === "string" && value) candidates.add(value);
+  const visit = (value, key = "", depth = 0) => {
+    if (depth > 5 || value === null || value === undefined) return;
+    if (typeof value === "string") {
+      if (/(?:^|[_-])(?:path|cwd|workspace|root|directory|dir)(?:$|[_-])/i.test(key) && value && !value.includes("\0")) candidates.add(value);
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value.slice(0, 64)) visit(item, key, depth + 1);
+      return;
+    }
+    if (typeof value !== "object") return;
+    for (const [childKey, child] of Object.entries(value).slice(0, 128)) visit(child, childKey, depth + 1);
+  };
+  visit(toolArgs);
+  candidates.delete(workspace);
+  return [...candidates].sort((left, right) => right.length - left.length);
+}
+
 function equivalentPathPrefixes(...values) {
   const prefixes = new Set(values.filter(Boolean).map((value) => String(value)));
   for (const value of [...prefixes]) {

package/src/local/job-runner.mjs

@@ -13,10 +13,13 @@ const MAX_OUTPUT_BYTES = 64 * 1024;
 const MAX_JOB_CAPTURE_BYTES = 256 * 1024;
 const MAX_RESULT_BYTES = 4 * 1024 * 1024;
 const MAX_STATUS_BYTES = 256 * 1024;
+const JOB_ID = /^job_[A-Za-z0-9_-]{24,}$/;
 
 const options = parseArgs(process.argv.slice(2));
-const jobDir = resolve(options.jobDir || "");
-if (!jobDir) throw new Error("--job-dir is required");
+const jobDirInput = typeof options.jobDir === "string" ? options.jobDir.trim() : "";
+if (!jobDirInput) throw new Error("--job-dir is required");
+const jobDir = resolve(jobDirInput);
+if (!JOB_ID.test(basename(jobDir))) throw new Error("--job-dir must name a managed job directory");
 const recover = options.recover === true;
 const planFile = join(jobDir, "plan.json");
 const statusFile = join(jobDir, "status.json");
@@ -43,17 +46,19 @@ for (const signal of ["SIGTERM", "SIGINT"]) {
   process.on(signal, () => requestCancellation());
 }
 
-writeFileSync(runnerPidFile, `${process.pid}\n`, { mode: 0o600 });
+const initial = readJson(statusFile, MAX_STATUS_BYTES);
+assertLaunchState(initial);
+writeFileSync(runnerPidFile, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
 if (recover) rmSync(join(jobDir, "recovery.lock"), { force: true });
 try {
-  await main();
+  const plan = readJson(planFile, 1024 * 1024);
+  assertPlanIntegrity(plan, initial);
+  await main(plan, initial);
 } catch (error) {
   recordFatalRunnerError(error);
 }
 
-async function main() {
-  const plan = readJson(planFile, 1024 * 1024);
-  const initial = readJson(statusFile, MAX_STATUS_BYTES);
+async function main(plan, initial) {
   const status = {
     ...initial,
     runner_pid: process.pid,
@@ -137,6 +142,20 @@ async function main() {
   try { rmSync(cancelFile, { force: true }); } catch {}
 }
 
+function assertLaunchState(status) {
+  if (!status || typeof status !== "object" || Array.isArray(status)) throw new Error("job status is unavailable or invalid");
+  const expected = recover ? "interrupted" : "queued";
+  if (status.status !== expected) throw new Error(`runner cannot start job in status: ${status.status}`);
+  if (status.approval === "pending-local-operator" || !status.approval) throw new Error("runner cannot start an unapproved managed job");
+}
+
+function assertPlanIntegrity(plan, status) {
+  if (!plan || typeof plan !== "object" || Array.isArray(plan)) throw new Error("job plan is unavailable or invalid");
+  const expected = String(status?.plan_sha256 || "");
+  const actual = createHash("sha256").update(JSON.stringify(plan)).digest("hex");
+  if (!/^[a-f0-9]{64}$/.test(expected) || actual !== expected) throw new Error("managed job plan integrity check failed");
+}
+
 function recordFatalRunnerError(error) {
   rmSync(runtimeDir, { recursive: true, force: true });
   const now = new Date().toISOString();
@@ -234,11 +253,12 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
     let stderrTruncated = 0;
     let timedOut = false;
     let closed = false;
+    let killTimer = null;
     const timer = setTimeout(() => {
       timedOut = true;
       terminateProcessTree(child, "SIGTERM");
-      const kill = setTimeout(() => terminateProcessTree(child, "SIGKILL"), 2000);
-      kill.unref?.();
+      killTimer = setTimeout(() => terminateProcessTree(child, "SIGKILL"), 2000);
+      killTimer.unref?.();
     }, timeoutMs);
     timer.unref?.();
     const cancellationPoll = setInterval(() => {
@@ -279,6 +299,7 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
       if (closed) return;
       closed = true;
       clearTimeout(timer);
+      if (killTimer) clearTimeout(killTimer);
       clearInterval(cancellationPoll);
       activeChild = null;
       activeChildCancellationAware = false;
@@ -293,6 +314,7 @@ function materializeResources(resources) {
   mkdirSync(resourcesDir, { recursive: true, mode: 0o700 });
   chmodSync(resourcesDir, 0o700);
   const paths = {};
+  const sourcePaths = {};
   const bytes = {};
   const redactions = {};
   for (const [name, resource] of Object.entries(resources)) {
@@ -303,6 +325,10 @@ function materializeResources(resources) {
     const target = join(resourcesDir, name);
     writeFileSync(target, data, { mode: 0o600, flag: "wx" });
     paths[name] = target;
+    sourcePaths[name] = [...new Set([
+      ...resourcePathVariants(resource.path),
+      ...(Array.isArray(resource.pathAliases) ? resource.pathAliases.flatMap(resourcePathVariants) : []),
+    ])].sort((left, right) => right.length - left.length);
     bytes[name] = data;
     const patterns = [];
     try {
@@ -316,7 +342,7 @@ function materializeResources(resources) {
     }
     redactions[name] = [...new Set(patterns.filter((value) => value.length > 0))].sort((a, b) => b.length - a.length);
   }
-  return { paths, bytes, redactions };
+  return { paths, sourcePaths, bytes, redactions };
 }
 
 function materializeTemporaryFiles(files) {
@@ -366,15 +392,46 @@ function substitute(value, plan, context) {
     });
 }
 
+function resourcePathVariants(value) {
+  const canonical = resolve(value);
+  const variants = new Set(pathTextVariants(canonical));
+  if (process.platform === "darwin" && canonical.startsWith("/private/")) {
+    for (const variant of pathTextVariants(canonical.slice("/private".length))) variants.add(variant);
+  }
+  return [...variants].sort((left, right) => right.length - left.length);
+}
+
+function pathTextVariants(value) {
+  const path = String(value);
+  return [...new Set([path, path.replaceAll("\\", "/"), path.replaceAll("/", "\\")])];
+}
+
+function replacePathText(text, value, replacement) {
+  let output = text;
+  for (const variant of pathTextVariants(value)) {
+    if (!variant) continue;
+    if (process.platform === "win32") output = output.replace(new RegExp(escapeRegExp(variant), "gi"), replacement);
+    else output = output.split(variant).join(replacement);
+  }
+  return output;
+}
+
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 function redactOutput(buffer, context) {
   let text = new TextDecoder("utf-8").decode(buffer);
   for (const [name, path] of Object.entries(context.paths)) {
-    text = text.split(path).join(`<resource:${name}>`);
+    text = replacePathText(text, path, `<resource:${name}>`);
+  }
+  for (const [name, paths] of Object.entries(context.sourcePaths || {})) {
+    for (const path of paths) text = replacePathText(text, path, `<resource-source:${name}>`);
   }
   for (const [name, path] of Object.entries(context.temporaryPaths)) {
-    text = text.split(path).join(`<temp:${name}>`);
+    text = replacePathText(text, path, `<temp:${name}>`);
   }
-  text = text.split(runtimeDir).join("<job-runtime>");
+  text = replacePathText(text, runtimeDir, "<job-runtime>");
   for (const [name, patterns] of Object.entries(context.redactions)) {
     for (const value of patterns) text = text.split(value).join(`<redacted-resource:${name}>`);
   }

package/src/local/log.mjs

@@ -1,4 +1,5 @@
 import process from "node:process";
+import os from "node:os";
 
 const COLORS = {
   reset: "\x1b[0m",
@@ -15,8 +16,16 @@ const MAX_LOG_ARRAY_ITEMS = 32;
 const MAX_LOG_OBJECT_KEYS = 48;
 const LEVEL_RANK = Object.freeze({ debug: 10, info: 20, success: 20, warn: 30, error: 40 });
 const SENSITIVE_KEY = /(authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)/i;
+const LOCAL_PATH_KEY = /(path|paths|cwd|workspace|directory|(?:^|[_-])dir(?:$|[_-])|root|home)/i;
 const SECRET_VALUE = /\b(?:mcp_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
 const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
+const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
+const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g;
+const API_SECRET = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g;
+const PRIVATE_KEY_HEADER = /-----BEGIN\s+(?:OPENSSH|RSA|EC|DSA)\s+PRIVATE\s+KEY-----/g;
+const HOME_PATHS = [...new Set([process.env.HOME, process.env.USERPROFILE, safeHomeDirectory()].filter(value => typeof value === "string" && value.length > 1))]
+  .sort((left, right) => right.length - left.length);
 
 export function createLogger(options = {}) {
   const quiet = Boolean(options.quiet);
@@ -86,8 +95,9 @@ export function formatFields(fields) {
   }
 }
 
-export function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth = 0) {
+function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth = 0) {
   if (SENSITIVE_KEY.test(key)) return "<redacted>";
+  if (LOCAL_PATH_KEY.test(key)) return "<local-path>";
   if (value instanceof Error) return sanitizeLogText(value.message || value.name);
   if (typeof value === "string") return sanitizeLogText(value);
   if (typeof value === "bigint") return value.toString();
@@ -106,9 +116,19 @@ export function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth =
 export function sanitizeLogText(value, maxChars = MAX_LOG_MESSAGE_CHARS) {
   let raw;
   try { raw = String(value ?? ""); } catch { raw = "<unprintable>"; }
-  const sanitized = raw
+  let sanitized = raw
     .replace(SECRET_VALUE, "<redacted-secret>")
     .replace(BEARER_VALUE, "Bearer <redacted>")
+    .replace(AWS_ACCESS_KEY, "<redacted-cloud-key>")
+    .replace(GITHUB_TOKEN, "<redacted-access-token>")
+    .replace(API_SECRET, "<redacted-api-secret>")
+    .replace(PRIVATE_KEY_HEADER, "<redacted-private-key-header>")
+    .replace(EMAIL_VALUE, "<redacted-email>");
+  for (const home of HOME_PATHS) sanitized = sanitized.split(home).join("<home>");
+  sanitized = sanitized
+    .replace(/\/(?:Users|home)\/[^/\s"'<>]+(?=\/|$)/g, "<home>")
+    .replace(/\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?=\\|$)/g, "<home>")
+    .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
     .replace(/[\r\n\t]/g, match => match === "\t" ? "\\t" : "\\n")
     .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "?");
   if (!Number.isFinite(Number(maxChars)) || Number(maxChars) <= 0) return "";
@@ -116,6 +136,10 @@ export function sanitizeLogText(value, maxChars = MAX_LOG_MESSAGE_CHARS) {
   return sanitized.length > limit ? `${sanitized.slice(0, limit - 1)}…` : sanitized;
 }
 
+function safeHomeDirectory() {
+  try { return os.homedir(); } catch { return ""; }
+}
+
 function shouldUseColor(options) {
   if (options.color === false || process.env.NO_COLOR) return false;
   if (options.color === true) return true;