machine-bridge-mcp 0.6.2 → 0.7.1

package/src/local/managed-jobs.mjs

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureOwnerOnlyDir, ownerOnlyFile } from "./state.mjs";
@@ -95,36 +95,44 @@ export class ManagedJobManager {
   approve(args = {}, { localOperator = false } = {}) {
     if (!localOperator) this.assertEnabled("approve_job");
     const dir = this.jobDir(args.job_id);
-    const statusFile = join(dir, "status.json");
-    const status = readRequiredJson(statusFile, 256 * 1024, "job status");
-    if (status.status !== "staged") throw new Error(`job is not staged: ${status.status}`);
-    readRequiredJson(join(dir, "plan.json"), MAX_PLAN_BYTES, "job plan");
-    status.status = "queued";
-    status.updated_at = new Date().toISOString();
-    status.approved_at = status.updated_at;
-    status.approval = localOperator ? "local-operator" : "mcp";
-    status.cleanup_guarantee = "best-effort-finally-and-recovery";
-    atomicWriteJson(statusFile, status, 256 * 1024);
+    const transition = acquireJobTransitionLock(dir);
+    if (!transition) throw new Error("job state is being modified by another process; retry after inspecting its current status");
     try {
-      launchRunner(dir);
-    } catch (error) {
-      failRunnerLaunch(dir, status, error);
-      throw error;
+      const statusFile = join(dir, "status.json");
+      const status = readRequiredJson(statusFile, 256 * 1024, "job status");
+      if (status.status !== "staged") throw new Error(`job is not staged: ${status.status}`);
+      const plan = readRequiredJson(join(dir, "plan.json"), MAX_PLAN_BYTES, "job plan");
+      assertPlanIntegrity(plan, status);
+      status.status = "queued";
+      status.updated_at = new Date().toISOString();
+      status.approved_at = status.updated_at;
+      status.approval = localOperator ? "local-operator" : "mcp";
+      status.cleanup_guarantee = "best-effort-finally-and-recovery";
+      atomicWriteJson(statusFile, status, 256 * 1024);
+      try {
+        launchRunner(dir);
+      } catch (error) {
+        failRunnerLaunch(dir, status, error);
+        throw error;
+      }
+      return {
+        accepted: true,
+        job_id: status.job_id,
+        name: status.name,
+        status: "queued",
+        detached: true,
+        continues_without_mcp_connection: true,
+        approval: status.approval,
+        plan_sha256: status.plan_sha256,
+        cleanup: {
+          resource_copies: "best-effort",
+          finally_steps: "best-effort-if-declared",
+          restart_recovery: "best-effort-on-next-runtime-or-cli-start",
+        },
+      };
+    } finally {
+      transition.release();
     }
-    return {
-      accepted: true,
-      job_id: status.job_id,
-      name: status.name,
-      status: "queued",
-      detached: true,
-      continues_without_mcp_connection: true,
-      approval: status.approval,
-      cleanup: {
-        resource_copies: "best-effort",
-        finally_steps: "best-effort-if-declared",
-        restart_recovery: "best-effort-on-next-runtime-or-cli-start",
-      },
-    };
   }
 
   createJob(args, { launch }) {
@@ -225,48 +233,55 @@ export class ManagedJobManager {
     this.reconcileStatus(dir);
     const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
     const plan = readJson(join(dir, "plan.json"), MAX_PLAN_BYTES);
+    if (plan) assertPlanIntegrity(plan, status);
     return {
       ...publicStatus(status),
+      plan_integrity_verified: Boolean(plan),
       ...(plan ? { review_plan: reviewablePlan(plan) } : {}),
     };
   }
 
   cancel(args = {}) {
     const dir = this.jobDir(args.job_id);
-    this.reconcileStatus(dir);
-    const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
-    if (status.status === "staged") {
-      const now = new Date().toISOString();
-      status.status = "cancelled_before_start";
-      status.updated_at = now;
-      status.finished_at = now;
-      status.error_class = "cancelled";
-      status.cleanup_guarantee = "not-started";
-      atomicWriteJson(join(dir, "status.json"), status, 256 * 1024);
-      atomicWriteJson(join(dir, "result.json"), {
-        job_id: status.job_id,
-        name: status.name,
-        status: status.status,
-        steps: [],
-        finally_steps: [],
-        error_class: "cancelled",
-        cleanup_error_class: null,
-        finished_at: now,
-      }, 4 * 1024 * 1024);
-      scrubFinishedPlan(dir, status);
-      return { ...publicStatus(status), cancellation_requested: true, cleanup_will_run: false, execution_started: false };
-    }
-    if (!ACTIVE_JOB_STATES.has(status.status)) {
-      return { ...publicStatus(status), cancellation_requested: false, already_finished: true };
+    const transition = acquireJobTransitionLock(dir);
+    if (!transition) throw new Error("job state is being modified by another process; retry after inspecting its current status");
+    try {
+      this.reconcileStatus(dir);
+      const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
+      if (status.status === "staged") {
+        const now = new Date().toISOString();
+        status.status = "cancelled_before_start";
+        status.updated_at = now;
+        status.finished_at = now;
+        status.error_class = "cancelled";
+        status.cleanup_guarantee = "not-started";
+        atomicWriteJson(join(dir, "status.json"), status, 256 * 1024);
+        atomicWriteJson(join(dir, "result.json"), {
+          job_id: status.job_id,
+          name: status.name,
+          status: status.status,
+          steps: [],
+          finally_steps: [],
+          error_class: "cancelled",
+          cleanup_error_class: null,
+          finished_at: now,
+        }, 4 * 1024 * 1024);
+        scrubFinishedPlan(dir, status);
+        return { ...publicStatus(status), cancellation_requested: true, cleanup_will_run: false, execution_started: false };
+      }
+      if (!ACTIVE_JOB_STATES.has(status.status)) {
+        return { ...publicStatus(status), cancellation_requested: false, already_finished: true };
+      }
+      writeFileSync(join(dir, "cancel"), `${new Date().toISOString()}\n`, { mode: 0o600 });
+      return {
+        ...publicStatus(status),
+        cancellation_requested: true,
+        cancellation_delivery: "runner-poll",
+        cleanup_will_run: true,
+      };
+    } finally {
+      transition.release();
     }
-    writeFileSync(join(dir, "cancel"), `${new Date().toISOString()}\n`, { mode: 0o600 });
-    return {
-      ...publicStatus(status),
-      cancellation_requested: true,
-      cancellation_delivery: "runner-poll",
-      cleanup_will_run: true,
-    };
-
   }
 
   currentResources() {
@@ -343,6 +358,7 @@ export class ManagedJobManager {
       status.recovery_attempts = recoveryAttempts + 1;
       atomicWriteJson(file, status, 256 * 1024);
       rmSync(join(dir, "runtime"), { recursive: true, force: true });
+      rmSync(join(dir, "runner.pid"), { force: true });
       const runnerPid = launchRunner(dir, true);
       recoveryLock.handoff(runnerPid);
       handedOff = true;
@@ -445,6 +461,7 @@ export function inspectResourceFile(inputPath, { allowInsecurePermissions = fals
   return {
     kind: "file",
     path: canonical,
+    pathAliases: normalizeResourcePathAliases([path, canonical]),
     size: info.size,
     mode: process.platform === "win32" ? null : `0${(info.mode & 0o777).toString(8)}`,
     updatedAt: new Date().toISOString(),
@@ -453,15 +470,16 @@ export function inspectResourceFile(inputPath, { allowInsecurePermissions = fals
   };
 }
 
-export function publicResourceRegistry(resources = {}) {
+export function publicResourceRegistry(resources = {}, { includePaths = false } = {}) {
   const normalized = normalizeResourceRegistry(resources);
   return Object.fromEntries(Object.entries(normalized).map(([name, value]) => [name, {
     kind: value.kind,
-    path: value.path,
     size: value.size ?? null,
     mode: value.mode ?? null,
     updatedAt: value.updatedAt ?? null,
     allowInsecurePermissions: value.allowInsecurePermissions === true,
+    paths_exposed: includePaths,
+    ...(includePaths ? { path: value.path } : {}),
   }]));
 }
 
@@ -580,7 +598,11 @@ function referencedResources(steps, registry) {
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true, includeHash: true });
     totalBytes += inspected.size;
     if (totalBytes > MAX_JOB_RESOURCE_BYTES) throw new Error(`job resources exceed ${MAX_JOB_RESOURCE_BYTES} bytes`);
-    out[name] = { ...inspected, allowInsecurePermissions: resource.allowInsecurePermissions === true };
+    out[name] = {
+      ...inspected,
+      pathAliases: normalizeResourcePathAliases([...(resource.pathAliases || []), ...(inspected.pathAliases || [])]),
+      allowInsecurePermissions: resource.allowInsecurePermissions === true,
+    };
   }
   return out;
 }
@@ -594,6 +616,7 @@ function normalizeResourceRegistry(resources) {
     out[name] = {
       kind: "file",
       path: resolve(rawValue.path),
+      pathAliases: normalizeResourcePathAliases([rawValue.path, ...(Array.isArray(rawValue.pathAliases) ? rawValue.pathAliases : [])]),
       size: Number.isFinite(Number(rawValue.size)) ? Number(rawValue.size) : null,
       mode: rawValue.mode ?? null,
       updatedAt: rawValue.updatedAt ?? null,
@@ -603,6 +626,17 @@ function normalizeResourceRegistry(resources) {
   return out;
 }
 
+function normalizeResourcePathAliases(values) {
+  const aliases = [];
+  for (const value of values) {
+    if (typeof value !== "string" || !value || value.includes("\0") || value.length > 4096) continue;
+    const absolute = resolve(value);
+    if (!aliases.includes(absolute)) aliases.push(absolute);
+    if (aliases.length >= 8) break;
+  }
+  return aliases;
+}
+
 function resolveJobCwd(value, workspace, unrestrictedPaths) {
   const raw = boundedString(value, 4096, "cwd");
   const candidate = isAbsolute(raw) ? resolve(raw) : resolve(workspace, raw);
@@ -656,7 +690,42 @@ function acquireRecoveryLock(dir) {
       let owner = 0;
       try { owner = Number.parseInt(readBoundedFile(file, 64).toString("utf8").trim(), 10); } catch {}
       const age = Date.now() - safeMtime(file);
-      if ((owner > 0 && isPidAlive(owner)) || age < 60_000) return null;
+      const ownerAlive = owner > 0 && isPidAlive(owner);
+      const definitelyStale = age >= 5 * 60_000 || (!ownerAlive && age >= 60_000);
+      if (!definitelyStale) return null;
+      rmSync(file, { force: true });
+    }
+  }
+  return null;
+}
+
+function planSha256(plan) {
+  return createHash("sha256").update(JSON.stringify(plan)).digest("hex");
+}
+
+function assertPlanIntegrity(plan, status) {
+  const expected = String(status?.plan_sha256 || "");
+  const actual = planSha256(plan);
+  if (!/^[a-f0-9]{64}$/.test(expected) || actual !== expected) {
+    throw new Error("managed job plan integrity check failed; inspect the plan and do not approve it");
+  }
+  return actual;
+}
+
+function acquireJobTransitionLock(dir) {
+  const file = join(dir, "transition.lock");
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      writeFileSync(file, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
+      return { release() { rmSync(file, { force: true }); } };
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      let owner = 0;
+      try { owner = Number.parseInt(readBoundedFile(file, 64).toString("utf8").trim(), 10); } catch {}
+      const age = Date.now() - safeMtime(file);
+      const ownerAlive = owner > 0 && isPidAlive(owner);
+      const definitelyStale = age >= 5 * 60_000 || (!ownerAlive && age >= 60_000);
+      if (!definitelyStale) return null;
       rmSync(file, { force: true });
     }
   }
@@ -670,18 +739,20 @@ function launchRunner(dir, recover = false) {
   const stderrFile = join(dir, "runner.err.log");
   trimDiagnosticFile(stdoutFile);
   trimDiagnosticFile(stderrFile);
-  const stdoutFd = openSync(stdoutFile, "a", 0o600);
-  const stderrFd = openSync(stderrFile, "a", 0o600);
+  let stdoutFd;
+  let stderrFd;
   let child;
   try {
+    stdoutFd = openPrivateAppendFile(stdoutFile);
+    stderrFd = openPrivateAppendFile(stderrFile);
     child = spawn(process.execPath, args, {
       detached: true,
       stdio: ["ignore", stdoutFd, stderrFd],
       windowsHide: true,
     });
   } finally {
-    closeSync(stdoutFd);
-    closeSync(stderrFd);
+    if (stdoutFd !== undefined) closeSync(stdoutFd);
+    if (stderrFd !== undefined) closeSync(stderrFd);
   }
   ownerOnlyFile(stdoutFile);
   ownerOnlyFile(stderrFile);
@@ -704,6 +775,7 @@ function scrubFinishedPlan(dir, status) {
   rmSync(join(dir, "plan.json"), { force: true });
   rmSync(join(dir, "runner.pid"), { force: true });
   rmSync(join(dir, "recovery.lock"), { force: true });
+  rmSync(join(dir, "transition.lock"), { force: true });
 }
 
 function reviewablePlan(plan) {
@@ -786,10 +858,27 @@ function readBoundedFileWithInfo(file, maxBytes) {
   }
 }
 
+function openPrivateAppendFile(file) {
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("runner diagnostic path must be a regular file and not a symbolic link");
+  }
+  const flags = Number(fsConstants.O_WRONLY) | Number(fsConstants.O_CREAT) | Number(fsConstants.O_APPEND) | Number(fsConstants.O_NOFOLLOW || 0);
+  const fd = openSync(file, flags, 0o600);
+  try {
+    if (!fstatSync(fd).isFile()) throw new Error("runner diagnostic path is not a regular file");
+    chmodSync(file, 0o600);
+    return fd;
+  } catch (error) {
+    closeSync(fd);
+    throw error;
+  }
+}
+
 function trimDiagnosticFile(file, maxBytes = 64 * 1024, keepBytes = 32 * 1024) {
   let fd;
   try {
-    const flags = Number(fsConstants.O_RDONLY) | Number(fsConstants.O_NOFOLLOW || 0);
+    const flags = Number(fsConstants.O_RDWR) | Number(fsConstants.O_NOFOLLOW || 0);
     fd = openSync(file, flags);
     const info = fstatSync(fd);
     if (!info.isFile() || info.size <= maxBytes) return;
@@ -804,9 +893,9 @@ function trimDiagnosticFile(file, maxBytes = 64 * 1024, keepBytes = 32 * 1024) {
     let tail = buffer.subarray(0, offset);
     const newline = tail.indexOf(0x0a);
     if (newline >= 0 && newline < tail.length - 1) tail = tail.subarray(newline + 1);
-    closeSync(fd);
-    fd = undefined;
-    writeFileSync(file, tail, { mode: 0o600 });
+    ftruncateSync(fd, 0);
+    if (tail.length) writeSync(fd, tail, 0, tail.length, 0);
+    try { chmodSync(file, 0o600); } catch {}
   } catch {
   } finally {
     if (fd !== undefined) try { closeSync(fd); } catch {}

package/src/local/process-sessions.mjs

@@ -4,11 +4,11 @@ import { basename } from "node:path";
 import { executionEnv } from "./shell.mjs";
 
 export const MAX_COMMAND_BYTES = 64 * 1024;
-export const MAX_ARGV_ITEMS = 256;
-export const MAX_PROCESS_SESSIONS = 8;
-export const MAX_SESSION_OUTPUT_BYTES = 1024 * 1024;
-export const MAX_PROCESS_STDIN_BYTES = 64 * 1024;
-export const PROCESS_SESSION_RETENTION_MS = 30 * 60 * 1000;
+const MAX_ARGV_ITEMS = 256;
+const MAX_PROCESS_SESSIONS = 8;
+const MAX_SESSION_OUTPUT_BYTES = 1024 * 1024;
+const MAX_PROCESS_STDIN_BYTES = 64 * 1024;
+const PROCESS_SESSION_RETENTION_MS = 30 * 60 * 1000;
 
 export class ProcessSessionManager {
   constructor({ workspace, policy, runtimeDir, activeProcesses, callProcesses, resolveCwd, displayPath, throwIfCancelled }) {

package/src/local/service.mjs

@@ -1,8 +1,9 @@
-import { chmodSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { run } from "./shell.mjs";
-import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";
+import { ensureOwnerOnlyDir, expandHome, ownerOnlyFile } from "./state.mjs";
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 const LABEL = "dev.machine-bridge-mcp.daemon";
 const WINDOWS_TASK = "MachineBridgeMCP";
@@ -55,23 +56,29 @@ export function trimAutostartLogs(stateRoot, options = {}) {
   const logs = path.join(root, "logs");
   for (const name of ["daemon.out.log", "daemon.err.log"]) {
     const file = path.join(logs, name);
+    let fd;
     try {
-      const info = statSync(file);
+      if (!existsSync(file)) continue;
+      const before = lstatSync(file);
+      if (before.isSymbolicLink() || !before.isFile()) continue;
+      const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
+      fd = openSync(file, Number(fsConstants.O_RDWR) | noFollow);
+      const info = fstatSync(fd);
+      if (!info.isFile()) continue;
       if (info.size > maxBytes) {
-        const fd = openSync(file, "r");
-        let buffer;
-        try {
-          const current = fstatSync(fd);
-          const length = Math.min(keepBytes, current.size);
-          buffer = Buffer.alloc(length);
-          readSync(fd, buffer, 0, length, Math.max(0, current.size - length));
-        } finally {
-          closeSync(fd);
-        }
-        writeFileSync(file, lineSafeTail(buffer), { mode: 0o600 });
+        const length = Math.min(keepBytes, info.size);
+        const buffer = Buffer.alloc(length);
+        readSync(fd, buffer, 0, length, Math.max(0, info.size - length));
+        const tail = lineSafeTail(buffer);
+        ftruncateSync(fd, 0);
+        if (tail.length) writeSync(fd, tail, 0, tail.length, 0);
       }
-      chmodSync(file, 0o600);
-    } catch {}
+      try { chmodSync(file, 0o600); } catch {}
+    } catch {
+      // Operational log maintenance is best effort and must not stop startup.
+    } finally {
+      if (fd !== undefined) try { closeSync(fd); } catch {}
+    }
   }
 }
 
@@ -87,22 +94,76 @@ function lineSafeTail(buffer) {
 function serviceSpec({ workspace, stateRoot, entryScript }) {
   const root = expandHome(stateRoot);
   const logs = path.join(root, "logs");
+  const resolvedEntryScript = path.resolve(entryScript);
+  const node = stableNodeExecutable();
   ensureOwnerOnlyDir(root);
   ensureOwnerOnlyDir(logs);
-  for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) {
-    writeFileSync(file, "", { flag: "a", mode: 0o600 });
-    try { chmodSync(file, 0o600); } catch {}
-  }
+  for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) ensurePrivateLogFile(file);
   return {
     workspace,
     stateRoot: root,
-    entryScript: path.resolve(entryScript),
-    node: process.execPath,
+    entryScript: resolvedEntryScript,
+    node,
+    pathEnv: serviceEnvironmentPath({ node, entryScript: resolvedEntryScript }),
     stdout: path.join(logs, "daemon.out.log"),
     stderr: path.join(logs, "daemon.err.log"),
   };
 }
 
+export function stableNodeExecutable(options = {}) {
+  const platform = String(options.platform || process.platform);
+  const execPath = path.resolve(String(options.execPath || process.execPath));
+  const pathEnv = String(options.pathEnv ?? process.env.PATH ?? "");
+  let canonicalExec;
+  try { canonicalExec = realpathSync(execPath); } catch { return execPath; }
+  const executableName = platform === "win32" ? "node.exe" : "node";
+  for (const directory of pathEnv.split(path.delimiter).filter(Boolean)) {
+    const candidate = path.resolve(directory, executableName);
+    try {
+      const info = lstatSync(candidate);
+      if (!info.isFile() && !info.isSymbolicLink()) continue;
+      const candidateCanonical = realpathSync(candidate);
+      const sameExecutable = platform === "win32"
+        ? candidateCanonical.toLowerCase() === canonicalExec.toLowerCase()
+        : candidateCanonical === canonicalExec;
+      if (!sameExecutable) continue;
+      if (platform !== "win32" && (statSync(candidate).mode & 0o111) === 0) continue;
+      return candidate;
+    } catch {}
+  }
+  return execPath;
+}
+
+export function serviceEnvironmentPath(options = {}) {
+  const platform = String(options.platform || process.platform);
+  const delimiter = String(options.delimiter || (platform === "win32" ? ";" : ":"));
+  const pathEnv = String(options.pathEnv ?? process.env.PATH ?? "");
+  const node = String(options.node || process.execPath || "");
+  const entryScript = String(options.entryScript || "");
+  const defaults = platform === "darwin"
+    ? ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]
+    : platform === "win32"
+      ? []
+      : ["/usr/local/bin", "/usr/bin", "/bin", "/usr/local/sbin", "/usr/sbin", "/sbin"];
+  const candidates = [
+    node ? path.dirname(path.resolve(node)) : "",
+    entryScript ? path.dirname(path.resolve(entryScript)) : "",
+    ...pathEnv.split(delimiter),
+    ...defaults,
+  ];
+  const seen = new Set();
+  const entries = [];
+  for (const raw of candidates) {
+    if (!raw || !path.isAbsolute(raw)) continue;
+    const normalized = path.resolve(raw);
+    const key = platform === "win32" ? normalized.toLowerCase() : normalized;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entries.push(normalized);
+  }
+  return entries.join(delimiter);
+}
+
 export function daemonArgs(spec) {
   return [
     spec.entryScript,
@@ -115,6 +176,38 @@ export function daemonArgs(spec) {
   ];
 }
 
+function ensurePrivateLogFile(file) {
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("autostart log path must be a regular non-symbolic-link file");
+  }
+  const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
+  const fd = openSync(file, Number(fsConstants.O_WRONLY) | Number(fsConstants.O_CREAT) | Number(fsConstants.O_APPEND) | noFollow, 0o600);
+  try {
+    if (!fstatSync(fd).isFile()) throw new Error("autostart log path is not a regular file");
+  } finally {
+    closeSync(fd);
+  }
+  ownerOnlyFile(file);
+}
+
+function writePrivateServiceFile(file, content) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("autostart configuration path must be a regular non-symbolic-link file");
+  }
+  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
+    replaceFileSync(temporary, file);
+    ownerOnlyFile(file);
+  } catch (error) {
+    try { rmSync(temporary, { force: true }); } catch {}
+    throw error;
+  }
+}
+
 function launchdPlistPath() {
   return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
 }
@@ -123,8 +216,8 @@ async function installLaunchd(spec, logger) {
   const plistPath = launchdPlistPath();
   mkdirSync(path.dirname(plistPath), { recursive: true });
   const args = [spec.node, ...daemonArgs(spec)];
-  writeFileSync(plistPath, launchdPlist({ args, stdout: spec.stdout, stderr: spec.stderr }), { mode: 0o644 });
-  logger.info?.(`Autostart installed for next login: ${plistPath}`);
+  writePrivateServiceFile(plistPath, launchdPlist({ args, pathEnv: spec.pathEnv, stdout: spec.stdout, stderr: spec.stderr }));
+  logger.info?.("Autostart installed for next login.");
   return { ok: true, provider: "launchd", path: plistPath };
 }
 
@@ -151,7 +244,7 @@ async function uninstallLaunchd(logger) {
   await stopLaunchd(logger).catch(() => {});
   const plistPath = launchdPlistPath();
   if (existsSync(plistPath)) rmSync(plistPath, { force: true });
-  logger.info?.(`Autostart removed: ${plistPath}`);
+  logger.info?.("Autostart removed.");
   return { ok: true, provider: "launchd", path: plistPath };
 }
 
@@ -162,7 +255,7 @@ async function statusLaunchd() {
   return { ok: existsSync(plistPath), provider: "launchd", installed: existsSync(plistPath), path: plistPath, active: result.code === 0, detail: result.stdout || result.stderr };
 }
 
-function launchdPlist({ args, stdout, stderr }) {
+export function launchdPlist({ args, pathEnv, stdout, stderr }) {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -172,6 +265,10 @@ function launchdPlist({ args, stdout, stderr }) {
   <array>
 ${args.map(arg => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${escapeXml(pathEnv)}</string>
+  </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key>
   <dict>
@@ -191,11 +288,11 @@ function systemdPath() {
 async function installSystemd(spec, logger) {
   const servicePath = systemdPath();
   mkdirSync(path.dirname(servicePath), { recursive: true });
-  writeFileSync(servicePath, systemdUnit(spec), { mode: 0o644 });
+  writePrivateServiceFile(servicePath, systemdUnit(spec));
   const reload = await serviceRun("systemctl", ["--user", "daemon-reload"]);
   const enable = await serviceRun("systemctl", ["--user", "enable", "machine-bridge-mcp.service"]);
   const linger = await serviceRun("loginctl", ["enable-linger", os.userInfo().username]);
-  logger.info?.(`Autostart installed: ${servicePath}`);
+  logger.info?.("Autostart installed.");
   return { ok: reload.code === 0 && enable.code === 0, provider: "systemd", path: servicePath, reload, enable, linger };
 }
 
@@ -204,7 +301,7 @@ async function uninstallSystemd(logger) {
   const servicePath = systemdPath();
   if (existsSync(servicePath)) rmSync(servicePath, { force: true });
   await serviceRun("systemctl", ["--user", "daemon-reload"]);
-  logger.info?.(`Autostart removed: ${servicePath}`);
+  logger.info?.("Autostart removed.");
   return { ok: true, provider: "systemd", path: servicePath };
 }
 
@@ -214,7 +311,7 @@ async function statusSystemd() {
   return { ok: existsSync(servicePath), provider: "systemd", installed: existsSync(servicePath), path: servicePath, active: result.code === 0, detail: result.stdout || result.stderr };
 }
 
-function systemdUnit(spec) {
+export function systemdUnit(spec) {
   const execArgs = [spec.node, ...daemonArgs(spec)].map(systemdQuote).join(" ");
   return `[Unit]
 Description=Machine Bridge MCP daemon
@@ -223,6 +320,7 @@ After=network-online.target
 [Service]
 Type=simple
 ExecStart=${execArgs}
+Environment=${systemdQuote(`PATH=${spec.pathEnv}`)}
 Restart=on-failure
 RestartSec=5
 StandardOutput=append:${spec.stdout}

package/src/local/shell.mjs

@@ -85,7 +85,7 @@ function finalizeOutput(value, truncated) {
   return truncated > 0 ? `${value}\n\n[truncated ${truncated} bytes]` : value;
 }
 
-export function findWranglerCommand() {
+function findWranglerCommand() {
   const suffix = process.platform === "win32" ? ".cmd" : "";
   const local = path.join(packageRoot, "node_modules", ".bin", `wrangler${suffix}`);
   if (existsSync(local)) return { cmd: local, argsPrefix: [] };

package/src/local/ssh-key.mjs

@@ -72,13 +72,15 @@ export async function inspectSshKeyPair(privateKeyPath, publicKeyPath = `${priva
     timeoutMs: 15_000,
     maxOutputBytes: 64 * 1024,
   });
+  const fingerprintValue = fingerprint.stdout.trim().split(/\s+/)[1] || "";
+  if (!/^SHA256:[A-Za-z0-9+/=]+$/.test(fingerprintValue)) throw new Error("SSH key fingerprint output is invalid");
   return {
     created,
     privateKeyPath: resolve(privateKeyPath),
     publicKeyPath: resolve(publicKeyPath),
     privateMode: process.platform === "win32" ? null : `0${(privateInfo.mode & 0o777).toString(8)}`,
     publicMode: process.platform === "win32" ? null : `0${(publicInfo.mode & 0o777).toString(8)}`,
-    fingerprint: fingerprint.stdout.trim(),
+    fingerprint: fingerprintValue,
     publicKeyType: publicLine.split(/\s+/, 1)[0],
   };
 }
@@ -112,7 +114,7 @@ async function safeLstat(path) {
 }
 
 function boundedComment(value) {
-  const comment = String(value || "").replace(/[\r\n\0]/g, " ").trim();
+  const comment = String(value || "").replace(/[\r\n\0\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, " ").replace(/\s+/g, " ").trim();
   if (!comment) return "machine-mcp";
   if (Buffer.byteLength(comment) > 256) throw new Error("SSH key comment exceeds 256 bytes");
   return comment;