machine-bridge-mcp 0.6.2 → 0.8.0

package/src/local/managed-jobs.mjs

@@ -1,10 +1,11 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureOwnerOnlyDir, ownerOnlyFile } from "./state.mjs";
 import { replaceFileSync } from "./atomic-fs.mjs";
+import { readBoundedRegularFileSync, readBoundedRegularFileWithInfoSync } from "./secure-file.mjs";
 
 const RESOURCE_NAME = /^[a-z][a-z0-9._-]{0,63}$/;
 const JOB_ID = /^job_[A-Za-z0-9_-]{24,}$/;
@@ -95,36 +96,44 @@ export class ManagedJobManager {
   approve(args = {}, { localOperator = false } = {}) {
     if (!localOperator) this.assertEnabled("approve_job");
     const dir = this.jobDir(args.job_id);
-    const statusFile = join(dir, "status.json");
-    const status = readRequiredJson(statusFile, 256 * 1024, "job status");
-    if (status.status !== "staged") throw new Error(`job is not staged: ${status.status}`);
-    readRequiredJson(join(dir, "plan.json"), MAX_PLAN_BYTES, "job plan");
-    status.status = "queued";
-    status.updated_at = new Date().toISOString();
-    status.approved_at = status.updated_at;
-    status.approval = localOperator ? "local-operator" : "mcp";
-    status.cleanup_guarantee = "best-effort-finally-and-recovery";
-    atomicWriteJson(statusFile, status, 256 * 1024);
+    const transition = acquireJobTransitionLock(dir);
+    if (!transition) throw new Error("job state is being modified by another process; retry after inspecting its current status");
     try {
-      launchRunner(dir);
-    } catch (error) {
-      failRunnerLaunch(dir, status, error);
-      throw error;
+      const statusFile = join(dir, "status.json");
+      const status = readRequiredJson(statusFile, 256 * 1024, "job status");
+      if (status.status !== "staged") throw new Error(`job is not staged: ${status.status}`);
+      const plan = readRequiredJson(join(dir, "plan.json"), MAX_PLAN_BYTES, "job plan");
+      assertPlanIntegrity(plan, status);
+      status.status = "queued";
+      status.updated_at = new Date().toISOString();
+      status.approved_at = status.updated_at;
+      status.approval = localOperator ? "local-operator" : "mcp";
+      status.cleanup_guarantee = "best-effort-finally-and-recovery";
+      atomicWriteJson(statusFile, status, 256 * 1024);
+      try {
+        launchRunner(dir);
+      } catch (error) {
+        failRunnerLaunch(dir, status, error);
+        throw error;
+      }
+      return {
+        accepted: true,
+        job_id: status.job_id,
+        name: status.name,
+        status: "queued",
+        detached: true,
+        continues_without_mcp_connection: true,
+        approval: status.approval,
+        plan_sha256: status.plan_sha256,
+        cleanup: {
+          resource_copies: "best-effort",
+          finally_steps: "best-effort-if-declared",
+          restart_recovery: "best-effort-on-next-runtime-or-cli-start",
+        },
+      };
+    } finally {
+      transition.release();
     }
-    return {
-      accepted: true,
-      job_id: status.job_id,
-      name: status.name,
-      status: "queued",
-      detached: true,
-      continues_without_mcp_connection: true,
-      approval: status.approval,
-      cleanup: {
-        resource_copies: "best-effort",
-        finally_steps: "best-effort-if-declared",
-        restart_recovery: "best-effort-on-next-runtime-or-cli-start",
-      },
-    };
   }
 
   createJob(args, { launch }) {
@@ -225,48 +234,55 @@ export class ManagedJobManager {
     this.reconcileStatus(dir);
     const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
     const plan = readJson(join(dir, "plan.json"), MAX_PLAN_BYTES);
+    if (plan) assertPlanIntegrity(plan, status);
     return {
       ...publicStatus(status),
+      plan_integrity_verified: Boolean(plan),
       ...(plan ? { review_plan: reviewablePlan(plan) } : {}),
     };
   }
 
   cancel(args = {}) {
     const dir = this.jobDir(args.job_id);
-    this.reconcileStatus(dir);
-    const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
-    if (status.status === "staged") {
-      const now = new Date().toISOString();
-      status.status = "cancelled_before_start";
-      status.updated_at = now;
-      status.finished_at = now;
-      status.error_class = "cancelled";
-      status.cleanup_guarantee = "not-started";
-      atomicWriteJson(join(dir, "status.json"), status, 256 * 1024);
-      atomicWriteJson(join(dir, "result.json"), {
-        job_id: status.job_id,
-        name: status.name,
-        status: status.status,
-        steps: [],
-        finally_steps: [],
-        error_class: "cancelled",
-        cleanup_error_class: null,
-        finished_at: now,
-      }, 4 * 1024 * 1024);
-      scrubFinishedPlan(dir, status);
-      return { ...publicStatus(status), cancellation_requested: true, cleanup_will_run: false, execution_started: false };
-    }
-    if (!ACTIVE_JOB_STATES.has(status.status)) {
-      return { ...publicStatus(status), cancellation_requested: false, already_finished: true };
+    const transition = acquireJobTransitionLock(dir);
+    if (!transition) throw new Error("job state is being modified by another process; retry after inspecting its current status");
+    try {
+      this.reconcileStatus(dir);
+      const status = readRequiredJson(join(dir, "status.json"), 256 * 1024, "job status");
+      if (status.status === "staged") {
+        const now = new Date().toISOString();
+        status.status = "cancelled_before_start";
+        status.updated_at = now;
+        status.finished_at = now;
+        status.error_class = "cancelled";
+        status.cleanup_guarantee = "not-started";
+        atomicWriteJson(join(dir, "status.json"), status, 256 * 1024);
+        atomicWriteJson(join(dir, "result.json"), {
+          job_id: status.job_id,
+          name: status.name,
+          status: status.status,
+          steps: [],
+          finally_steps: [],
+          error_class: "cancelled",
+          cleanup_error_class: null,
+          finished_at: now,
+        }, 4 * 1024 * 1024);
+        scrubFinishedPlan(dir, status);
+        return { ...publicStatus(status), cancellation_requested: true, cleanup_will_run: false, execution_started: false };
+      }
+      if (!ACTIVE_JOB_STATES.has(status.status)) {
+        return { ...publicStatus(status), cancellation_requested: false, already_finished: true };
+      }
+      writeFileSync(join(dir, "cancel"), `${new Date().toISOString()}\n`, { mode: 0o600 });
+      return {
+        ...publicStatus(status),
+        cancellation_requested: true,
+        cancellation_delivery: "runner-poll",
+        cleanup_will_run: true,
+      };
+    } finally {
+      transition.release();
     }
-    writeFileSync(join(dir, "cancel"), `${new Date().toISOString()}\n`, { mode: 0o600 });
-    return {
-      ...publicStatus(status),
-      cancellation_requested: true,
-      cancellation_delivery: "runner-poll",
-      cleanup_will_run: true,
-    };
-
   }
 
   currentResources() {
@@ -312,38 +328,10 @@ export class ManagedJobManager {
       if (Number.isInteger(pid) && pid > 0 && isPidAlive(pid)) return;
       const recoveryAttempts = Number(status.recovery_attempts || 0);
       if (recoveryAttempts >= MAX_RECOVERY_ATTEMPTS) {
-        const now = new Date().toISOString();
-        status.status = "recovery_exhausted";
-        status.updated_at = now;
-        status.finished_at = now;
-        status.error_class = "recovery_exhausted";
-        status.current_phase = null;
-        status.current_step = null;
-        atomicWriteJson(file, status, 256 * 1024);
-        atomicWriteJson(join(dir, "result.json"), {
-          job_id: status.job_id,
-          name: status.name,
-          status: status.status,
-          recovered: true,
-          steps: [],
-          finally_steps: [],
-          error_class: "recovery_exhausted",
-          cleanup_error_class: "recovery_exhausted",
-          recovery_attempts: recoveryAttempts,
-          finished_at: now,
-        }, 4 * 1024 * 1024);
-        rmSync(join(dir, "runtime"), { recursive: true, force: true });
-        scrubFinishedPlan(dir, status);
+        markRecoveryExhausted(dir, file, status, recoveryAttempts);
         return;
       }
-      status.status = "interrupted";
-      status.updated_at = new Date().toISOString();
-      status.finished_at = status.updated_at;
-      status.error_class = "runner_interrupted";
-      status.recovery_attempts = recoveryAttempts + 1;
-      atomicWriteJson(file, status, 256 * 1024);
-      rmSync(join(dir, "runtime"), { recursive: true, force: true });
-      const runnerPid = launchRunner(dir, true);
+      const runnerPid = relaunchInterruptedJob(dir, file, status, recoveryAttempts);
       recoveryLock.handoff(runnerPid);
       handedOff = true;
     } finally {
@@ -438,13 +426,14 @@ export function validateResourceName(value) {
 export function inspectResourceFile(inputPath, { allowInsecurePermissions = false, includeHash = false } = {}) {
   const path = resolve(String(inputPath || ""));
   const canonical = realpathFile(path);
-  const { buffer: content, info } = readBoundedFileWithInfo(canonical, MAX_RESOURCE_BYTES);
+  const { buffer: content, info } = readBoundedRegularFileWithInfoSync(canonical, MAX_RESOURCE_BYTES);
   if (process.platform !== "win32" && !allowInsecurePermissions && (info.mode & 0o077) !== 0) {
     throw new Error("resource file is readable by group or others; restrict permissions or use --allow-insecure-permissions");
   }
   return {
     kind: "file",
     path: canonical,
+    pathAliases: normalizeResourcePathAliases([path, canonical]),
     size: info.size,
     mode: process.platform === "win32" ? null : `0${(info.mode & 0o777).toString(8)}`,
     updatedAt: new Date().toISOString(),
@@ -453,15 +442,16 @@ export function inspectResourceFile(inputPath, { allowInsecurePermissions = fals
   };
 }
 
-export function publicResourceRegistry(resources = {}) {
+export function publicResourceRegistry(resources = {}, { includePaths = false } = {}) {
   const normalized = normalizeResourceRegistry(resources);
   return Object.fromEntries(Object.entries(normalized).map(([name, value]) => [name, {
     kind: value.kind,
-    path: value.path,
     size: value.size ?? null,
     mode: value.mode ?? null,
     updatedAt: value.updatedAt ?? null,
     allowInsecurePermissions: value.allowInsecurePermissions === true,
+    paths_exposed: includePaths,
+    ...(includePaths ? { path: value.path } : {}),
   }]));
 }
 
@@ -580,7 +570,11 @@ function referencedResources(steps, registry) {
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true, includeHash: true });
     totalBytes += inspected.size;
     if (totalBytes > MAX_JOB_RESOURCE_BYTES) throw new Error(`job resources exceed ${MAX_JOB_RESOURCE_BYTES} bytes`);
-    out[name] = { ...inspected, allowInsecurePermissions: resource.allowInsecurePermissions === true };
+    out[name] = {
+      ...inspected,
+      pathAliases: normalizeResourcePathAliases([...(resource.pathAliases || []), ...(inspected.pathAliases || [])]),
+      allowInsecurePermissions: resource.allowInsecurePermissions === true,
+    };
   }
   return out;
 }
@@ -594,6 +588,7 @@ function normalizeResourceRegistry(resources) {
     out[name] = {
       kind: "file",
       path: resolve(rawValue.path),
+      pathAliases: normalizeResourcePathAliases([rawValue.path, ...(Array.isArray(rawValue.pathAliases) ? rawValue.pathAliases : [])]),
       size: Number.isFinite(Number(rawValue.size)) ? Number(rawValue.size) : null,
       mode: rawValue.mode ?? null,
       updatedAt: rawValue.updatedAt ?? null,
@@ -603,6 +598,17 @@ function normalizeResourceRegistry(resources) {
   return out;
 }
 
+function normalizeResourcePathAliases(values) {
+  const aliases = [];
+  for (const value of values) {
+    if (typeof value !== "string" || !value || value.includes("\0") || value.length > 4096) continue;
+    const absolute = resolve(value);
+    if (!aliases.includes(absolute)) aliases.push(absolute);
+    if (aliases.length >= 8) break;
+  }
+  return aliases;
+}
+
 function resolveJobCwd(value, workspace, unrestrictedPaths) {
   const raw = boundedString(value, 4096, "cwd");
   const candidate = isAbsolute(raw) ? resolve(raw) : resolve(workspace, raw);
@@ -640,15 +646,76 @@ function failRunnerLaunch(dir, status, error) {
   scrubFinishedPlan(dir, failed);
 }
 
+function markRecoveryExhausted(dir, statusFile, status, recoveryAttempts) {
+  const now = new Date().toISOString();
+  Object.assign(status, {
+    status: "recovery_exhausted",
+    updated_at: now,
+    finished_at: now,
+    error_class: "recovery_exhausted",
+    current_phase: null,
+    current_step: null,
+  });
+  atomicWriteJson(statusFile, status, 256 * 1024);
+  atomicWriteJson(join(dir, "result.json"), {
+    job_id: status.job_id,
+    name: status.name,
+    status: status.status,
+    recovered: true,
+    steps: [],
+    finally_steps: [],
+    error_class: "recovery_exhausted",
+    cleanup_error_class: "recovery_exhausted",
+    recovery_attempts: recoveryAttempts,
+    finished_at: now,
+  }, 4 * 1024 * 1024);
+  rmSync(join(dir, "runtime"), { recursive: true, force: true });
+  scrubFinishedPlan(dir, status);
+}
+
+function relaunchInterruptedJob(dir, statusFile, status, recoveryAttempts) {
+  status.status = "interrupted";
+  status.updated_at = new Date().toISOString();
+  status.finished_at = status.updated_at;
+  status.error_class = "runner_interrupted";
+  status.recovery_attempts = recoveryAttempts + 1;
+  atomicWriteJson(statusFile, status, 256 * 1024);
+  rmSync(join(dir, "runtime"), { recursive: true, force: true });
+  rmSync(join(dir, "runner.pid"), { force: true });
+  return launchRunner(dir, true);
+}
+
 function acquireRecoveryLock(dir) {
-  const file = join(dir, "recovery.lock");
+  return acquirePidLock(join(dir, "recovery.lock"), { allowHandoff: true });
+}
+
+function planSha256(plan) {
+  return createHash("sha256").update(JSON.stringify(plan)).digest("hex");
+}
+
+function assertPlanIntegrity(plan, status) {
+  const expected = String(status?.plan_sha256 || "");
+  const actual = planSha256(plan);
+  if (!/^[a-f0-9]{64}$/.test(expected) || actual !== expected) {
+    throw new Error("managed job plan integrity check failed; inspect the plan and do not approve it");
+  }
+  return actual;
+}
+
+function acquireJobTransitionLock(dir) {
+  return acquirePidLock(join(dir, "transition.lock"));
+}
+
+function acquirePidLock(file, { allowHandoff = false } = {}) {
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       writeFileSync(file, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
       return {
-        handoff(pid) {
-          if (Number.isInteger(pid) && pid > 0) writeFileSync(file, `${pid}\n`, { mode: 0o600 });
-        },
+        ...(allowHandoff ? {
+          handoff(pid) {
+            if (Number.isInteger(pid) && pid > 0) writeFileSync(file, `${pid}\n`, { mode: 0o600 });
+          },
+        } : {}),
         release() { rmSync(file, { force: true }); },
       };
     } catch (error) {
@@ -656,7 +723,9 @@ function acquireRecoveryLock(dir) {
       let owner = 0;
       try { owner = Number.parseInt(readBoundedFile(file, 64).toString("utf8").trim(), 10); } catch {}
       const age = Date.now() - safeMtime(file);
-      if ((owner > 0 && isPidAlive(owner)) || age < 60_000) return null;
+      const ownerAlive = owner > 0 && isPidAlive(owner);
+      const definitelyStale = age >= 5 * 60_000 || (!ownerAlive && age >= 60_000);
+      if (!definitelyStale) return null;
       rmSync(file, { force: true });
     }
   }
@@ -670,18 +739,20 @@ function launchRunner(dir, recover = false) {
   const stderrFile = join(dir, "runner.err.log");
   trimDiagnosticFile(stdoutFile);
   trimDiagnosticFile(stderrFile);
-  const stdoutFd = openSync(stdoutFile, "a", 0o600);
-  const stderrFd = openSync(stderrFile, "a", 0o600);
+  let stdoutFd;
+  let stderrFd;
   let child;
   try {
+    stdoutFd = openPrivateAppendFile(stdoutFile);
+    stderrFd = openPrivateAppendFile(stderrFile);
     child = spawn(process.execPath, args, {
       detached: true,
       stdio: ["ignore", stdoutFd, stderrFd],
       windowsHide: true,
     });
   } finally {
-    closeSync(stdoutFd);
-    closeSync(stderrFd);
+    if (stdoutFd !== undefined) closeSync(stdoutFd);
+    if (stderrFd !== undefined) closeSync(stderrFd);
   }
   ownerOnlyFile(stdoutFile);
   ownerOnlyFile(stderrFile);
@@ -704,6 +775,7 @@ function scrubFinishedPlan(dir, status) {
   rmSync(join(dir, "plan.json"), { force: true });
   rmSync(join(dir, "runner.pid"), { force: true });
   rmSync(join(dir, "recovery.lock"), { force: true });
+  rmSync(join(dir, "transition.lock"), { force: true });
 }
 
 function reviewablePlan(plan) {
@@ -763,33 +835,30 @@ function readRequiredJson(file, maxBytes, label) {
 }
 
 function readBoundedFile(file, maxBytes) {
-  return readBoundedFileWithInfo(file, maxBytes).buffer;
+  return readBoundedRegularFileSync(file, maxBytes);
 }
 
-function readBoundedFileWithInfo(file, maxBytes) {
-  const flags = Number(fsConstants.O_RDONLY) | Number(fsConstants.O_NOFOLLOW || 0);
-  const fd = openSync(file, flags);
+function openPrivateAppendFile(file) {
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("runner diagnostic path must be a regular file and not a symbolic link");
+  }
+  const flags = Number(fsConstants.O_WRONLY) | Number(fsConstants.O_CREAT) | Number(fsConstants.O_APPEND) | Number(fsConstants.O_NOFOLLOW || 0);
+  const fd = openSync(file, flags, 0o600);
   try {
-    const info = fstatSync(fd);
-    if (!info.isFile()) throw new Error("path is not a regular file");
-    if (info.size > maxBytes) throw new Error(`file exceeds ${maxBytes} bytes`);
-    const buffer = Buffer.alloc(info.size);
-    let offset = 0;
-    while (offset < buffer.length) {
-      const count = readSync(fd, buffer, offset, buffer.length - offset, offset);
-      if (!count) break;
-      offset += count;
-    }
-    return { buffer: buffer.subarray(0, offset), info };
-  } finally {
+    if (!fstatSync(fd).isFile()) throw new Error("runner diagnostic path is not a regular file");
+    chmodSync(file, 0o600);
+    return fd;
+  } catch (error) {
     closeSync(fd);
+    throw error;
   }
 }
 
 function trimDiagnosticFile(file, maxBytes = 64 * 1024, keepBytes = 32 * 1024) {
   let fd;
   try {
-    const flags = Number(fsConstants.O_RDONLY) | Number(fsConstants.O_NOFOLLOW || 0);
+    const flags = Number(fsConstants.O_RDWR) | Number(fsConstants.O_NOFOLLOW || 0);
     fd = openSync(file, flags);
     const info = fstatSync(fd);
     if (!info.isFile() || info.size <= maxBytes) return;
@@ -804,9 +873,9 @@ function trimDiagnosticFile(file, maxBytes = 64 * 1024, keepBytes = 32 * 1024) {
     let tail = buffer.subarray(0, offset);
     const newline = tail.indexOf(0x0a);
     if (newline >= 0 && newline < tail.length - 1) tail = tail.subarray(newline + 1);
-    closeSync(fd);
-    fd = undefined;
-    writeFileSync(file, tail, { mode: 0o600 });
+    ftruncateSync(fd, 0);
+    if (tail.length) writeSync(fd, tail, 0, tail.length, 0);
+    try { chmodSync(file, 0o600); } catch {}
   } catch {
   } finally {
     if (fd !== undefined) try { closeSync(fd); } catch {}

package/src/local/process-sessions.mjs

@@ -4,11 +4,11 @@ import { basename } from "node:path";
 import { executionEnv } from "./shell.mjs";
 
 export const MAX_COMMAND_BYTES = 64 * 1024;
-export const MAX_ARGV_ITEMS = 256;
-export const MAX_PROCESS_SESSIONS = 8;
-export const MAX_SESSION_OUTPUT_BYTES = 1024 * 1024;
-export const MAX_PROCESS_STDIN_BYTES = 64 * 1024;
-export const PROCESS_SESSION_RETENTION_MS = 30 * 60 * 1000;
+const MAX_ARGV_ITEMS = 256;
+const MAX_PROCESS_SESSIONS = 8;
+const MAX_SESSION_OUTPUT_BYTES = 1024 * 1024;
+const MAX_PROCESS_STDIN_BYTES = 64 * 1024;
+const PROCESS_SESSION_RETENTION_MS = 30 * 60 * 1000;
 
 export class ProcessSessionManager {
   constructor({ workspace, policy, runtimeDir, activeProcesses, callProcesses, resolveCwd, displayPath, throwIfCancelled }) {