machine-bridge-mcp 0.6.2 → 0.8.0

package/src/local/service.mjs

@@ -1,8 +1,9 @@
-import { chmodSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { run } from "./shell.mjs";
-import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";
+import { ensureOwnerOnlyDir, expandHome, ownerOnlyFile } from "./state.mjs";
+import { replaceFileSync } from "./atomic-fs.mjs";
 
 const LABEL = "dev.machine-bridge-mcp.daemon";
 const WINDOWS_TASK = "MachineBridgeMCP";
@@ -55,23 +56,29 @@ export function trimAutostartLogs(stateRoot, options = {}) {
   const logs = path.join(root, "logs");
   for (const name of ["daemon.out.log", "daemon.err.log"]) {
     const file = path.join(logs, name);
+    let fd;
     try {
-      const info = statSync(file);
+      if (!existsSync(file)) continue;
+      const before = lstatSync(file);
+      if (before.isSymbolicLink() || !before.isFile()) continue;
+      const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
+      fd = openSync(file, Number(fsConstants.O_RDWR) | noFollow);
+      const info = fstatSync(fd);
+      if (!info.isFile()) continue;
       if (info.size > maxBytes) {
-        const fd = openSync(file, "r");
-        let buffer;
-        try {
-          const current = fstatSync(fd);
-          const length = Math.min(keepBytes, current.size);
-          buffer = Buffer.alloc(length);
-          readSync(fd, buffer, 0, length, Math.max(0, current.size - length));
-        } finally {
-          closeSync(fd);
-        }
-        writeFileSync(file, lineSafeTail(buffer), { mode: 0o600 });
+        const length = Math.min(keepBytes, info.size);
+        const buffer = Buffer.alloc(length);
+        readSync(fd, buffer, 0, length, Math.max(0, info.size - length));
+        const tail = lineSafeTail(buffer);
+        ftruncateSync(fd, 0);
+        if (tail.length) writeSync(fd, tail, 0, tail.length, 0);
       }
-      chmodSync(file, 0o600);
-    } catch {}
+      try { chmodSync(file, 0o600); } catch {}
+    } catch {
+      // Operational log maintenance is best effort and must not stop startup.
+    } finally {
+      if (fd !== undefined) try { closeSync(fd); } catch {}
+    }
   }
 }
 
@@ -87,22 +94,76 @@ function lineSafeTail(buffer) {
 function serviceSpec({ workspace, stateRoot, entryScript }) {
   const root = expandHome(stateRoot);
   const logs = path.join(root, "logs");
+  const resolvedEntryScript = path.resolve(entryScript);
+  const node = stableNodeExecutable();
   ensureOwnerOnlyDir(root);
   ensureOwnerOnlyDir(logs);
-  for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) {
-    writeFileSync(file, "", { flag: "a", mode: 0o600 });
-    try { chmodSync(file, 0o600); } catch {}
-  }
+  for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) ensurePrivateLogFile(file);
   return {
     workspace,
     stateRoot: root,
-    entryScript: path.resolve(entryScript),
-    node: process.execPath,
+    entryScript: resolvedEntryScript,
+    node,
+    pathEnv: serviceEnvironmentPath({ node, entryScript: resolvedEntryScript }),
     stdout: path.join(logs, "daemon.out.log"),
     stderr: path.join(logs, "daemon.err.log"),
   };
 }
 
+export function stableNodeExecutable(options = {}) {
+  const platform = String(options.platform || process.platform);
+  const execPath = path.resolve(String(options.execPath || process.execPath));
+  const pathEnv = String(options.pathEnv ?? process.env.PATH ?? "");
+  let canonicalExec;
+  try { canonicalExec = realpathSync(execPath); } catch { return execPath; }
+  const executableName = platform === "win32" ? "node.exe" : "node";
+  for (const directory of pathEnv.split(path.delimiter).filter(Boolean)) {
+    const candidate = path.resolve(directory, executableName);
+    try {
+      const info = lstatSync(candidate);
+      if (!info.isFile() && !info.isSymbolicLink()) continue;
+      const candidateCanonical = realpathSync(candidate);
+      const sameExecutable = platform === "win32"
+        ? candidateCanonical.toLowerCase() === canonicalExec.toLowerCase()
+        : candidateCanonical === canonicalExec;
+      if (!sameExecutable) continue;
+      if (platform !== "win32" && (statSync(candidate).mode & 0o111) === 0) continue;
+      return candidate;
+    } catch {}
+  }
+  return execPath;
+}
+
+export function serviceEnvironmentPath(options = {}) {
+  const platform = String(options.platform || process.platform);
+  const delimiter = String(options.delimiter || (platform === "win32" ? ";" : ":"));
+  const pathEnv = String(options.pathEnv ?? process.env.PATH ?? "");
+  const node = String(options.node || process.execPath || "");
+  const entryScript = String(options.entryScript || "");
+  const defaults = platform === "darwin"
+    ? ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]
+    : platform === "win32"
+      ? []
+      : ["/usr/local/bin", "/usr/bin", "/bin", "/usr/local/sbin", "/usr/sbin", "/sbin"];
+  const candidates = [
+    node ? path.dirname(path.resolve(node)) : "",
+    entryScript ? path.dirname(path.resolve(entryScript)) : "",
+    ...pathEnv.split(delimiter),
+    ...defaults,
+  ];
+  const seen = new Set();
+  const entries = [];
+  for (const raw of candidates) {
+    if (!raw || !path.isAbsolute(raw)) continue;
+    const normalized = path.resolve(raw);
+    const key = platform === "win32" ? normalized.toLowerCase() : normalized;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entries.push(normalized);
+  }
+  return entries.join(delimiter);
+}
+
 export function daemonArgs(spec) {
   return [
     spec.entryScript,
@@ -115,6 +176,38 @@ export function daemonArgs(spec) {
   ];
 }
 
+function ensurePrivateLogFile(file) {
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("autostart log path must be a regular non-symbolic-link file");
+  }
+  const noFollow = Number(fsConstants.O_NOFOLLOW || 0);
+  const fd = openSync(file, Number(fsConstants.O_WRONLY) | Number(fsConstants.O_CREAT) | Number(fsConstants.O_APPEND) | noFollow, 0o600);
+  try {
+    if (!fstatSync(fd).isFile()) throw new Error("autostart log path is not a regular file");
+  } finally {
+    closeSync(fd);
+  }
+  ownerOnlyFile(file);
+}
+
+function writePrivateServiceFile(file, content) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  if (existsSync(file)) {
+    const info = lstatSync(file);
+    if (info.isSymbolicLink() || !info.isFile()) throw new Error("autostart configuration path must be a regular non-symbolic-link file");
+  }
+  const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
+    replaceFileSync(temporary, file);
+    ownerOnlyFile(file);
+  } catch (error) {
+    try { rmSync(temporary, { force: true }); } catch {}
+    throw error;
+  }
+}
+
 function launchdPlistPath() {
   return path.join(os.homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
 }
@@ -123,8 +216,8 @@ async function installLaunchd(spec, logger) {
   const plistPath = launchdPlistPath();
   mkdirSync(path.dirname(plistPath), { recursive: true });
   const args = [spec.node, ...daemonArgs(spec)];
-  writeFileSync(plistPath, launchdPlist({ args, stdout: spec.stdout, stderr: spec.stderr }), { mode: 0o644 });
-  logger.info?.(`Autostart installed for next login: ${plistPath}`);
+  writePrivateServiceFile(plistPath, launchdPlist({ args, pathEnv: spec.pathEnv, stdout: spec.stdout, stderr: spec.stderr }));
+  logger.info?.("Autostart installed for next login.");
   return { ok: true, provider: "launchd", path: plistPath };
 }
 
@@ -151,7 +244,7 @@ async function uninstallLaunchd(logger) {
   await stopLaunchd(logger).catch(() => {});
   const plistPath = launchdPlistPath();
   if (existsSync(plistPath)) rmSync(plistPath, { force: true });
-  logger.info?.(`Autostart removed: ${plistPath}`);
+  logger.info?.("Autostart removed.");
   return { ok: true, provider: "launchd", path: plistPath };
 }
 
@@ -162,7 +255,7 @@ async function statusLaunchd() {
   return { ok: existsSync(plistPath), provider: "launchd", installed: existsSync(plistPath), path: plistPath, active: result.code === 0, detail: result.stdout || result.stderr };
 }
 
-function launchdPlist({ args, stdout, stderr }) {
+export function launchdPlist({ args, pathEnv, stdout, stderr }) {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -172,6 +265,10 @@ function launchdPlist({ args, stdout, stderr }) {
   <array>
 ${args.map(arg => `    <string>${escapeXml(arg)}</string>`).join("\n")}
   </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${escapeXml(pathEnv)}</string>
+  </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key>
   <dict>
@@ -191,11 +288,11 @@ function systemdPath() {
 async function installSystemd(spec, logger) {
   const servicePath = systemdPath();
   mkdirSync(path.dirname(servicePath), { recursive: true });
-  writeFileSync(servicePath, systemdUnit(spec), { mode: 0o644 });
+  writePrivateServiceFile(servicePath, systemdUnit(spec));
   const reload = await serviceRun("systemctl", ["--user", "daemon-reload"]);
   const enable = await serviceRun("systemctl", ["--user", "enable", "machine-bridge-mcp.service"]);
   const linger = await serviceRun("loginctl", ["enable-linger", os.userInfo().username]);
-  logger.info?.(`Autostart installed: ${servicePath}`);
+  logger.info?.("Autostart installed.");
   return { ok: reload.code === 0 && enable.code === 0, provider: "systemd", path: servicePath, reload, enable, linger };
 }
 
@@ -204,7 +301,7 @@ async function uninstallSystemd(logger) {
   const servicePath = systemdPath();
   if (existsSync(servicePath)) rmSync(servicePath, { force: true });
   await serviceRun("systemctl", ["--user", "daemon-reload"]);
-  logger.info?.(`Autostart removed: ${servicePath}`);
+  logger.info?.("Autostart removed.");
   return { ok: true, provider: "systemd", path: servicePath };
 }
 
@@ -214,7 +311,7 @@ async function statusSystemd() {
   return { ok: existsSync(servicePath), provider: "systemd", installed: existsSync(servicePath), path: servicePath, active: result.code === 0, detail: result.stdout || result.stderr };
 }
 
-function systemdUnit(spec) {
+export function systemdUnit(spec) {
   const execArgs = [spec.node, ...daemonArgs(spec)].map(systemdQuote).join(" ");
   return `[Unit]
 Description=Machine Bridge MCP daemon
@@ -223,6 +320,7 @@ After=network-online.target
 [Service]
 Type=simple
 ExecStart=${execArgs}
+Environment=${systemdQuote(`PATH=${spec.pathEnv}`)}
 Restart=on-failure
 RestartSec=5
 StandardOutput=append:${spec.stdout}

package/src/local/shell.mjs

@@ -85,7 +85,7 @@ function finalizeOutput(value, truncated) {
   return truncated > 0 ? `${value}\n\n[truncated ${truncated} bytes]` : value;
 }
 
-export function findWranglerCommand() {
+function findWranglerCommand() {
   const suffix = process.platform === "win32" ? ".cmd" : "";
   const local = path.join(packageRoot, "node_modules", ".bin", `wrangler${suffix}`);
   if (existsSync(local)) return { cmd: local, argsPrefix: [] };

package/src/local/ssh-key.mjs

@@ -7,44 +7,62 @@ import { run } from "./shell.mjs";
 const KEY_TYPES = new Set(["ed25519", "rsa"]);
 
 export async function generateSshKeyPair(options = {}) {
+  const request = normalizeKeyRequest(options);
+  await mkdir(request.parent, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(request.parent, 0o700);
+
+  const existing = await inspectExistingKeyFiles(request.privateKeyPath, request.publicKeyPath);
+  if (existing) {
+    await secureKeyModes(request.privateKeyPath, request.publicKeyPath);
+    return inspectSshKeyPair(request.privateKeyPath, request.publicKeyPath, false);
+  }
+  return createSshKeyPair(request);
+}
+
+function normalizeKeyRequest(options) {
   const privateKeyPath = resolve(String(options.privateKeyPath || ""));
   if (!privateKeyPath || privateKeyPath === resolve(".")) throw new Error("private key path is required");
-  const publicKeyPath = `${privateKeyPath}.pub`;
   const type = String(options.type || "ed25519").toLowerCase();
   if (!KEY_TYPES.has(type)) throw new Error("SSH key type must be ed25519 or rsa");
-  const comment = boundedComment(options.comment || `machine-mcp:${basename(privateKeyPath)}`);
-  const parent = dirname(privateKeyPath);
-  await mkdir(parent, { recursive: true, mode: 0o700 });
-  if (process.platform !== "win32") await chmod(parent, 0o700);
+  return {
+    privateKeyPath,
+    publicKeyPath: `${privateKeyPath}.pub`,
+    parent: dirname(privateKeyPath),
+    type,
+    bits: options.bits,
+    comment: boundedComment(options.comment || `machine-mcp:${basename(privateKeyPath)}`),
+  };
+}
 
+async function inspectExistingKeyFiles(privateKeyPath, publicKeyPath) {
   const privateInfo = await safeLstat(privateKeyPath);
   const publicInfo = await safeLstat(publicKeyPath);
   if (privateInfo?.isSymbolicLink() || publicInfo?.isSymbolicLink()) throw new Error("SSH key path must not be a symbolic link");
-  if (privateInfo || publicInfo) {
-    if (!privateInfo?.isFile() || !publicInfo?.isFile()) throw new Error("SSH key pair is incomplete or not a pair of regular files");
-    await secureKeyModes(privateKeyPath, publicKeyPath);
-    return inspectSshKeyPair(privateKeyPath, publicKeyPath, false);
-  }
+  if (!privateInfo && !publicInfo) return false;
+  if (!privateInfo?.isFile() || !publicInfo?.isFile()) throw new Error("SSH key pair is incomplete or not a pair of regular files");
+  return true;
+}
 
+async function createSshKeyPair(request) {
   const suffix = `${process.pid}-${randomBytes(8).toString("hex")}`;
-  const tempPrivate = resolve(parent, `.${basename(privateKeyPath)}.mbm-${suffix}`);
+  const tempPrivate = resolve(request.parent, `.${basename(request.privateKeyPath)}.mbm-${suffix}`);
   const tempPublic = `${tempPrivate}.pub`;
   try {
-    const args = ["-q", "-t", type];
-    if (type === "rsa") args.push("-b", String(normalizeRsaBits(options.bits)));
-    args.push("-N", "", "-f", tempPrivate, "-C", comment);
+    const args = ["-q", "-t", request.type];
+    if (request.type === "rsa") args.push("-b", String(normalizeRsaBits(request.bits)));
+    args.push("-N", "", "-f", tempPrivate, "-C", request.comment);
     const generated = await run("ssh-keygen", args, { capture: true, timeoutMs: 30_000, maxOutputBytes: 64 * 1024 });
     if (generated.code !== 0) throw new Error("ssh-keygen failed");
     await secureKeyModes(tempPrivate, tempPublic);
-    await installNoReplace(tempPrivate, privateKeyPath);
+    await installNoReplace(tempPrivate, request.privateKeyPath);
     try {
-      await installNoReplace(tempPublic, publicKeyPath);
+      await installNoReplace(tempPublic, request.publicKeyPath);
     } catch (error) {
-      await rm(privateKeyPath, { force: true });
+      await rm(request.privateKeyPath, { force: true });
       throw error;
     }
-    await secureKeyModes(privateKeyPath, publicKeyPath);
-    return inspectSshKeyPair(privateKeyPath, publicKeyPath, true);
+    await secureKeyModes(request.privateKeyPath, request.publicKeyPath);
+    return inspectSshKeyPair(request.privateKeyPath, request.publicKeyPath, true);
   } finally {
     await rm(tempPrivate, { force: true });
     await rm(tempPublic, { force: true });
@@ -72,13 +90,15 @@ export async function inspectSshKeyPair(privateKeyPath, publicKeyPath = `${priva
     timeoutMs: 15_000,
     maxOutputBytes: 64 * 1024,
   });
+  const fingerprintValue = fingerprint.stdout.trim().split(/\s+/)[1] || "";
+  if (!/^SHA256:[A-Za-z0-9+/=]+$/.test(fingerprintValue)) throw new Error("SSH key fingerprint output is invalid");
   return {
     created,
     privateKeyPath: resolve(privateKeyPath),
     publicKeyPath: resolve(publicKeyPath),
     privateMode: process.platform === "win32" ? null : `0${(privateInfo.mode & 0o777).toString(8)}`,
     publicMode: process.platform === "win32" ? null : `0${(publicInfo.mode & 0o777).toString(8)}`,
-    fingerprint: fingerprint.stdout.trim(),
+    fingerprint: fingerprintValue,
     publicKeyType: publicLine.split(/\s+/, 1)[0],
   };
 }
@@ -112,7 +132,7 @@ async function safeLstat(path) {
 }
 
 function boundedComment(value) {
-  const comment = String(value || "").replace(/[\r\n\0]/g, " ").trim();
+  const comment = String(value || "").replace(/[\r\n\0\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, " ").replace(/\s+/g, " ").trim();
   if (!comment) return "machine-mcp";
   if (Buffer.byteLength(comment) > 256) throw new Error("SSH key comment exceeds 256 bytes");
   return comment;

package/src/local/state.mjs

@@ -80,7 +80,7 @@ export function removeStateRoot(stateRoot = defaultStateRoot()) {
   return true;
 }
 
-export function workspaceHash(workspace) {
+function workspaceHash(workspace) {
   const canonical = resolveWorkspace(workspace);
   const identity = process.platform === "win32" ? canonical.toLowerCase() : canonical;
   return createHash("sha256").update(identity).digest("hex").slice(0, 24);
@@ -160,7 +160,7 @@ export function daemonLockPathForState(state) {
   return lockPathForState(state, "daemon.lock");
 }
 
-export function startupLockPathForState(state) {
+function startupLockPathForState(state) {
   return lockPathForState(state, "startup.lock");
 }
 
@@ -362,7 +362,7 @@ function assertValidStateMarker(marker, options = {}) {
 
 function hasOnlyStateEntries(entries) {
   const allowed = new Set([STATE_MARKER, "config.json", "profiles", "logs"]);
-  return entries.every((entry) => allowed.has(entry) || /^config\.json\.corrupt-\d+$/.test(entry));
+  return entries.every((entry) => allowed.has(entry) || /^config\.json\.corrupt-\d+(?:-[a-f0-9]{8})?$/.test(entry));
 }
 
 function looksLikeSourceTree(root) {
@@ -484,7 +484,7 @@ function randomToken(prefix) {
   return `${prefix}_${randomBytes(32).toString("base64url")}`;
 }
 
-export function sha256(value) {
+function sha256(value) {
   return createHash("sha256").update(String(value)).digest("hex");
 }
 
@@ -508,7 +508,9 @@ export function redactState(state) {
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
   if (clone.resources && typeof clone.resources === "object") {
     for (const value of Object.values(clone.resources)) {
-      if (value && typeof value === "object" && value.path) value.path = "<local-resource-path>";
+      if (!value || typeof value !== "object") continue;
+      if (value.path) value.path = "<local-resource-path>";
+      delete value.pathAliases;
     }
   }
   return clone;