machine-bridge-mcp 0.7.1 → 0.8.0

package/src/local/full-access-test.mjs

@@ -2,7 +2,7 @@ import { chmod, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import process from "node:process";
-import { LocalDaemon } from "./daemon.mjs";
+import { LocalRuntime } from "./runtime.mjs";
 import { generateSshKeyPair } from "./ssh-key.mjs";
 import { run } from "./shell.mjs";
 import { allToolNames, assertCanonicalFullPolicy, policyProfile } from "./tools.mjs";
@@ -29,7 +29,7 @@ export async function runFullAccessTest({ workspace, policy = policyProfile("ful
   let runtime;
 
   try {
-    runtime = new LocalDaemon({
+    runtime = new LocalRuntime({
       workspace: resolve(workspace),
       policy: canonicalPolicy,
       jobRoot,

package/src/local/job-runner.mjs

@@ -1,10 +1,11 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, mkdirSync, openSync, readSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { executionEnv } from "./shell.mjs";
 import { terminateProcessTree } from "./process-sessions.mjs";
 import { replaceFileSync } from "./atomic-fs.mjs";
+import { readBoundedRegularFileSync } from "./secure-file.mjs";
 
 const RESOURCE_TOKEN = /\{\{resource:([a-z][a-z0-9._-]{0,63})\}\}/g;
 const TEMP_TOKEN = /\{\{temp:([a-z][a-z0-9._-]{0,63})\}\}/g;
@@ -486,23 +487,7 @@ function readJson(file, maxBytes) {
 }
 
 function readBoundedFile(file, maxBytes) {
-  const flags = Number(fsConstants.O_RDONLY) | Number(fsConstants.O_NOFOLLOW || 0);
-  const fd = openSync(file, flags);
-  try {
-    const info = fstatSync(fd);
-    if (!info.isFile()) throw new Error("path is not a regular file");
-    if (info.size > maxBytes) throw new Error(`file exceeds ${maxBytes} bytes`);
-    const buffer = Buffer.alloc(info.size);
-    let offset = 0;
-    while (offset < buffer.length) {
-      const count = readSync(fd, buffer, offset, buffer.length - offset, offset);
-      if (!count) break;
-      offset += count;
-    }
-    return buffer.subarray(0, offset);
-  } finally {
-    closeSync(fd);
-  }
+  return readBoundedRegularFileSync(file, maxBytes);
 }
 
 function classifyError(error) {

package/src/local/log.mjs

@@ -71,6 +71,8 @@ export function classifyOperationalError(error) {
   const message = error instanceof Error ? error.message : String(error ?? "");
   if (/cancel/i.test(message)) return "cancelled";
   if (/timed out/i.test(message)) return "timeout";
+  if (/unauthorized|forbidden|authentication|\b401\b|\b403\b/i.test(message)) return "authentication_failed";
+  if (/ECONNRESET|ECONNREFUSED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH|ENOTFOUND|EAI_AGAIN|socket hang up|network|websocket|TLS|SSL/i.test(message)) return "network_error";
   if (/outside the configured workspace/i.test(message)) return "path_boundary";
   if (/disabled|requires .* mode/i.test(message)) return "policy_denied";
   if (/not found|ENOENT/i.test(message)) return "not_found";

package/src/local/managed-jobs.mjs

@@ -5,6 +5,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "nod
 import { fileURLToPath } from "node:url";
 import { ensureOwnerOnlyDir, ownerOnlyFile } from "./state.mjs";
 import { replaceFileSync } from "./atomic-fs.mjs";
+import { readBoundedRegularFileSync, readBoundedRegularFileWithInfoSync } from "./secure-file.mjs";
 
 const RESOURCE_NAME = /^[a-z][a-z0-9._-]{0,63}$/;
 const JOB_ID = /^job_[A-Za-z0-9_-]{24,}$/;
@@ -327,39 +328,10 @@ export class ManagedJobManager {
       if (Number.isInteger(pid) && pid > 0 && isPidAlive(pid)) return;
       const recoveryAttempts = Number(status.recovery_attempts || 0);
       if (recoveryAttempts >= MAX_RECOVERY_ATTEMPTS) {
-        const now = new Date().toISOString();
-        status.status = "recovery_exhausted";
-        status.updated_at = now;
-        status.finished_at = now;
-        status.error_class = "recovery_exhausted";
-        status.current_phase = null;
-        status.current_step = null;
-        atomicWriteJson(file, status, 256 * 1024);
-        atomicWriteJson(join(dir, "result.json"), {
-          job_id: status.job_id,
-          name: status.name,
-          status: status.status,
-          recovered: true,
-          steps: [],
-          finally_steps: [],
-          error_class: "recovery_exhausted",
-          cleanup_error_class: "recovery_exhausted",
-          recovery_attempts: recoveryAttempts,
-          finished_at: now,
-        }, 4 * 1024 * 1024);
-        rmSync(join(dir, "runtime"), { recursive: true, force: true });
-        scrubFinishedPlan(dir, status);
+        markRecoveryExhausted(dir, file, status, recoveryAttempts);
         return;
       }
-      status.status = "interrupted";
-      status.updated_at = new Date().toISOString();
-      status.finished_at = status.updated_at;
-      status.error_class = "runner_interrupted";
-      status.recovery_attempts = recoveryAttempts + 1;
-      atomicWriteJson(file, status, 256 * 1024);
-      rmSync(join(dir, "runtime"), { recursive: true, force: true });
-      rmSync(join(dir, "runner.pid"), { force: true });
-      const runnerPid = launchRunner(dir, true);
+      const runnerPid = relaunchInterruptedJob(dir, file, status, recoveryAttempts);
       recoveryLock.handoff(runnerPid);
       handedOff = true;
     } finally {
@@ -454,7 +426,7 @@ export function validateResourceName(value) {
 export function inspectResourceFile(inputPath, { allowInsecurePermissions = false, includeHash = false } = {}) {
   const path = resolve(String(inputPath || ""));
   const canonical = realpathFile(path);
-  const { buffer: content, info } = readBoundedFileWithInfo(canonical, MAX_RESOURCE_BYTES);
+  const { buffer: content, info } = readBoundedRegularFileWithInfoSync(canonical, MAX_RESOURCE_BYTES);
   if (process.platform !== "win32" && !allowInsecurePermissions && (info.mode & 0o077) !== 0) {
     throw new Error("resource file is readable by group or others; restrict permissions or use --allow-insecure-permissions");
   }
@@ -674,29 +646,47 @@ function failRunnerLaunch(dir, status, error) {
   scrubFinishedPlan(dir, failed);
 }
 
+function markRecoveryExhausted(dir, statusFile, status, recoveryAttempts) {
+  const now = new Date().toISOString();
+  Object.assign(status, {
+    status: "recovery_exhausted",
+    updated_at: now,
+    finished_at: now,
+    error_class: "recovery_exhausted",
+    current_phase: null,
+    current_step: null,
+  });
+  atomicWriteJson(statusFile, status, 256 * 1024);
+  atomicWriteJson(join(dir, "result.json"), {
+    job_id: status.job_id,
+    name: status.name,
+    status: status.status,
+    recovered: true,
+    steps: [],
+    finally_steps: [],
+    error_class: "recovery_exhausted",
+    cleanup_error_class: "recovery_exhausted",
+    recovery_attempts: recoveryAttempts,
+    finished_at: now,
+  }, 4 * 1024 * 1024);
+  rmSync(join(dir, "runtime"), { recursive: true, force: true });
+  scrubFinishedPlan(dir, status);
+}
+
+function relaunchInterruptedJob(dir, statusFile, status, recoveryAttempts) {
+  status.status = "interrupted";
+  status.updated_at = new Date().toISOString();
+  status.finished_at = status.updated_at;
+  status.error_class = "runner_interrupted";
+  status.recovery_attempts = recoveryAttempts + 1;
+  atomicWriteJson(statusFile, status, 256 * 1024);
+  rmSync(join(dir, "runtime"), { recursive: true, force: true });
+  rmSync(join(dir, "runner.pid"), { force: true });
+  return launchRunner(dir, true);
+}
+
 function acquireRecoveryLock(dir) {
-  const file = join(dir, "recovery.lock");
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    try {
-      writeFileSync(file, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
-      return {
-        handoff(pid) {
-          if (Number.isInteger(pid) && pid > 0) writeFileSync(file, `${pid}\n`, { mode: 0o600 });
-        },
-        release() { rmSync(file, { force: true }); },
-      };
-    } catch (error) {
-      if (error?.code !== "EEXIST") throw error;
-      let owner = 0;
-      try { owner = Number.parseInt(readBoundedFile(file, 64).toString("utf8").trim(), 10); } catch {}
-      const age = Date.now() - safeMtime(file);
-      const ownerAlive = owner > 0 && isPidAlive(owner);
-      const definitelyStale = age >= 5 * 60_000 || (!ownerAlive && age >= 60_000);
-      if (!definitelyStale) return null;
-      rmSync(file, { force: true });
-    }
-  }
-  return null;
+  return acquirePidLock(join(dir, "recovery.lock"), { allowHandoff: true });
 }
 
 function planSha256(plan) {
@@ -713,11 +703,21 @@ function assertPlanIntegrity(plan, status) {
 }
 
 function acquireJobTransitionLock(dir) {
-  const file = join(dir, "transition.lock");
+  return acquirePidLock(join(dir, "transition.lock"));
+}
+
+function acquirePidLock(file, { allowHandoff = false } = {}) {
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
       writeFileSync(file, `${process.pid}\n`, { mode: 0o600, flag: "wx" });
-      return { release() { rmSync(file, { force: true }); } };
+      return {
+        ...(allowHandoff ? {
+          handoff(pid) {
+            if (Number.isInteger(pid) && pid > 0) writeFileSync(file, `${pid}\n`, { mode: 0o600 });
+          },
+        } : {}),
+        release() { rmSync(file, { force: true }); },
+      };
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
       let owner = 0;
@@ -835,27 +835,7 @@ function readRequiredJson(file, maxBytes, label) {
 }
 
 function readBoundedFile(file, maxBytes) {
-  return readBoundedFileWithInfo(file, maxBytes).buffer;
-}
-
-function readBoundedFileWithInfo(file, maxBytes) {
-  const flags = Number(fsConstants.O_RDONLY) | Number(fsConstants.O_NOFOLLOW || 0);
-  const fd = openSync(file, flags);
-  try {
-    const info = fstatSync(fd);
-    if (!info.isFile()) throw new Error("path is not a regular file");
-    if (info.size > maxBytes) throw new Error(`file exceeds ${maxBytes} bytes`);
-    const buffer = Buffer.alloc(info.size);
-    let offset = 0;
-    while (offset < buffer.length) {
-      const count = readSync(fd, buffer, offset, buffer.length - offset, offset);
-      if (!count) break;
-      offset += count;
-    }
-    return { buffer: buffer.subarray(0, offset), info };
-  } finally {
-    closeSync(fd);
-  }
+  return readBoundedRegularFileSync(file, maxBytes);
 }
 
 function openPrivateAppendFile(file) {