machine-bridge-mcp 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.8 - 2026-07-14
+
+### Effective account authority reporting
+
+- Separate the authenticated account authority from the local daemon capability ceiling in remote diagnostics. `server_info.authorization.effective_policy` and `effective_tools` are now the authoritative account fields, while `daemon.policy` and `daemon.tools` are explicitly scoped as pre-role ceilings. The response also includes a deterministic authority summary and scope labels so clients cannot reasonably equate an `editor` account with a `full` daemon.
+- Make remote `project_overview` return the role-intersected policy and tools at its existing top-level fields, while preserving the daemon values separately as `daemonPolicy` and `daemonTools`. Add a Worker integration regression that authorizes an `editor` account against a canonical `full` daemon and proves shell/browser tools remain excluded at both reporting surfaces and at relay enforcement.
+- Update MCP initialization guidance, tool descriptions, operations diagnostics, architecture, client, account, testing, and generated tool-reference documentation to use the effective-account fields when diagnosing permissions.
+
 ## 1.0.7 - 2026-07-14
 
 ### Browser-complete OAuth callback navigation

package/README.md

@@ -144,6 +144,8 @@ The Worker grants browser CORS response access to the exact first-party origins
 
 One Worker supports several named accounts and OAuth clients. Accounts have independent passwords, roles, active state, versions, codes, and tokens. The roles are `reviewer`, `editor`, `operator`, and `owner`; their effective authority is intersected with the connected daemon policy and enforced in both the Worker and local runtime. Role changes, suspension, password rotation, and removal revoke only the affected account.
 
+For remote connections, `server_info.authorization.effective_policy` and `server_info.authorization.effective_tools` are the authoritative account-permission fields. `server_info.daemon.policy` and `server_info.daemon.tools` describe only the local daemon capability ceiling before account-role filtering. Remote `project_overview` likewise places the effective account policy/tools in `policy` and `tools`, while preserving the daemon ceiling separately as `daemonPolicy` and `daemonTools`.
+
 This is application-level authorization, not kernel or browser-profile isolation. All accounts reach one daemon running as one OS user. Use separate Workers and preferably separate low-privilege OS accounts, containers, or VMs for mutually untrusted users or hard tenant isolation. See [Multi-account authorization and tenancy](docs/MULTI_ACCOUNT.md).
 
 ## Optional local stdio MCP

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.7"
+  "version_name": "1.0.8"
 }

package/docs/ARCHITECTURE.md

@@ -239,7 +239,7 @@ Browser-origin handling separates CORS response sharing from protocol authentica
 
 ## Observability
 
-Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status, policy origin/revision, managed-job counts, resource alias names without paths or values, daemon/relay-advertised tool counts, relay route state without endpoint details, and privacy-preserving capability-routing evidence. It explicitly reports that the host-exposed subset is unknown to the server. `diagnose_runtime` runs fixed local probes and explicitly reports that its own request reached the daemon.
+Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status, managed-job counts, resource alias names without paths or values, relay route state without endpoint details, and privacy-preserving capability-routing evidence. It separates the daemon capability ceiling from the authenticated account authority: `daemon.policy`/`daemon.tools` retain the pre-role ceiling, while `authorization.effective_policy`/`authorization.effective_tools` and the top-level `tools` report the role-intersected authority before any host-side filtering. It explicitly reports that the host-exposed subset is unknown to the server. `diagnose_runtime` runs fixed local probes and explicitly reports that its own request reached the daemon.
 
 Foreground logging defaults to `info`; autostart uses `warn`. Authenticated readiness, persistent degradation, and recovery are user-visible state transitions. Brief relay interruptions, raw transport close details, retry timing, and all per-tool starts/successes/failures/cancellations/durations are debug-only. Unexpected local and Worker infrastructure errors are reduced to classes. Messages, strings, arrays, object depth/key counts, and serialized fields are bounded.
 

package/docs/CLIENTS.md

@@ -149,7 +149,7 @@ For SSH automation, prefer `generate_ssh_key_resource` under canonical full, or
 
 The local `full` profile controls Machine Bridge's own tool catalog, path resolver, path display, process environment, and shell availability. It does not control the MCP host's model policy, approval UI, connector gateway, or platform execution filters.
 
-Machine Bridge itself does not block files because their names look sensitive. If `server_info` reports `full` and a direct call is still rejected before a structured tool result, the host/connector may have blocked delivery. If `diagnose_runtime` responds but its fixed process or shell probe fails, the likely source is local OS policy, endpoint-security software, permissions, or shell configuration. Changing `--profile`, `--unrestricted-paths`, or `--absolute-paths` cannot override either layer.
+Machine Bridge itself does not block files because their names look sensitive. In remote mode, first inspect `server_info.authorization.effective_policy` and `effective_tools`; `daemon.policy` is only the local ceiling. If the effective profile is `full` and the effective tool is present but a direct call is still rejected before a structured result, the host/connector may have blocked delivery. If `diagnose_runtime` responds but its fixed process or shell probe fails, the likely source is local OS policy, endpoint-security software, permissions, or shell configuration. Changing `--profile`, `--unrestricted-paths`, or `--absolute-paths` cannot override either layer.
 
 Do not attempt to evade a host refusal by renaming, encoding, or switching to another arbitrary execution tool. Instead:
 

package/docs/MULTI_ACCOUNT.md

@@ -25,6 +25,8 @@ The effective tool set is the intersection of:
 
 The Worker filters `tools/list` and rejects unauthorized calls before relay. Every accepted relay call also carries `account_id`, `account_version`, and `role`; the local runtime validates the role again before dispatch. The shared policy contract remains the single source of capability semantics.
 
+Authenticated `server_info` deliberately reports both layers. `authorization.effective_policy` and `authorization.effective_tools` are authoritative for the current account. The nested `daemon.policy` and `daemon.tools` fields are only the local capability ceiling before account-role filtering; a `full` daemon does not make an `editor` account full. Remote `project_overview` uses the effective values at top-level `policy` and `tools` and preserves the daemon values as `daemonPolicy` and `daemonTools`.
+
 ## Account lifecycle
 
 List accounts:

package/docs/OPERATIONS.md

@@ -14,7 +14,8 @@ machine-mcp service status
 
 | Result | Interpretation |
 |---|---|
-| `server_info` reports full and all relay tools, but the current session UI exposes fewer tools | Host/connector post-relay filtering; Machine Bridge cannot enumerate or override that subset |
+| `authorization.effective_policy.profile` is `full` and the tool is in `authorization.effective_tools`, but the current session UI exposes fewer tools | Host/connector post-relay filtering; Machine Bridge cannot enumerate or override that subset |
+| `daemon.policy.profile` is `full` but `authorization.effective_policy.profile` is `review`, `edit`, or `agent` | Expected account-role narrowing; the daemon field is only a capability ceiling and must not be reported as the account permission |
 | `capability_routing.bootstrap_observed` is false | The current local runtime has not received `session_bootstrap`; reconnect or inspect host initialization handling |
 | `task_resolution_observed` is false after a substantive task | The host/model did not call `resolve_task_capabilities`; server-side discovery cannot force that host decision |
 | Task resolution ran but all match counts are zero | The resolver ran successfully but found no sufficiently relevant local skill, command, or application |

package/docs/TESTING.md

@@ -53,7 +53,7 @@ The suite includes:
 - deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- live local Worker OAuth registration, consent, URL-constructed `303` callbacks including the ChatGPT redirect URI and encoded state, PKCE, token replay rejection, throttling, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure.
+- live local Worker OAuth registration, consent, URL-constructed `303` callbacks including the ChatGPT redirect URI and encoded state, PKCE, token replay rejection, throttling, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
 - a real headless-Chrome OAuth navigation regression with a negative control showing that `form-action 'self'` blocks a cross-origin `303`, followed by the production policy shape proving the exact callback origin receives `code` and `state`. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
 

package/docs/TOOL_REFERENCE.md

@@ -66,7 +66,7 @@ Tool count: **51**.
 
 **Server information**
 
-Return bridge/runtime metadata, active policy, protocol versions, and available tools.
+Return authenticated account authority, effective policy/tools, daemon capability ceiling, runtime metadata, and protocol status. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.
 
 | Contract field | Value |
 |---|---|
@@ -89,7 +89,7 @@ Return bridge/runtime metadata, active policy, protocol versions, and available
 
 **Project overview**
 
-Summarize the connected workspace, repository root, local policy, and top-level entries.
+Summarize the connected workspace and repository. Remote responses report the authenticated account effective policy/tools at policy and tools, with the daemon capability ceiling preserved separately as daemonPolicy and daemonTools.
 
 | Contract field | Value |
 |---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/shared/server-metadata.json

@@ -12,10 +12,10 @@
     "For existing-browser work, use the paired Machine Bridge browser extension. It operates the user current Chromium profile and tabs, can inspect DOM/source, fill complex forms, and inject sensitive text from registered local resources without returning those values.",
     "For local application work, use structured application discovery and Accessibility actions. Arbitrary caller-supplied AppleScript or JavaScript is intentionally not accepted.",
     "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
-    "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
+    "In remote multi-account mode, account authority is the intersection of the authenticated account role and the daemon capability ceiling. Only authorization.effective_policy and authorization.effective_tools describe that account authority; daemon.policy is not the account permission.",
     "Filename sensitivity is not classified by this server; the MCP host, connector gateway, local OS, or endpoint-security software may enforce additional independent rules.",
     "A named full profile is canonical: it always enables writes, shell execution, unrestricted paths, the full parent environment, absolute paths, and the complete tool catalog. Any explicit narrowing is stored as custom.",
-    "The full catalog is what the local daemon and relay advertise. A connector host or platform can expose only a subset to a particular session; Machine Bridge cannot observe, authorize, or override that host-side filtering.",
+    "The local daemon may advertise the full catalog as its capability ceiling. In remote mode, the Worker relays only the intersection allowed by the authenticated account role; a connector host may then expose an even smaller subset that Machine Bridge cannot observe or override.",
     "Use diagnose_runtime to distinguish a request that reached the daemon from local filesystem, process-spawn, shell, managed-job-storage, and resource failures. A tool call blocked before any response cannot be diagnosed by the server.",
     "Never request or return secret-file contents when a local resource alias can be used. Resources are registered through the local machine-mcp CLI; under canonical full policy, generate_ssh_key_resource can generate and register an Ed25519 key without returning private content and may be injected by path, stdin, or environment without entering MCP arguments.",
     "If execution-class tools are unavailable but write access remains, use stage_job to persist a reviewed plan without running it; the operator can launch it locally with machine-mcp job approve JOB_ID.",

package/src/shared/tool-catalog.json

@@ -2,7 +2,7 @@
   {
     "name": "server_info",
     "title": "Server information",
-    "description": "Return bridge/runtime metadata, active policy, protocol versions, and available tools.",
+    "description": "Return authenticated account authority, effective policy/tools, daemon capability ceiling, runtime metadata, and protocol status. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -18,7 +18,7 @@
   {
     "name": "project_overview",
     "title": "Project overview",
-    "description": "Summarize the connected workspace, repository root, local policy, and top-level entries.",
+    "description": "Summarize the connected workspace and repository. Remote responses report the authenticated account effective policy/tools at policy and tools, with the daemon capability ceiling preserved separately as daemonPolicy and daemonTools.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,

package/src/worker/authority.ts

@@ -0,0 +1,146 @@
+import policyContract from "../shared/policy-contract.json";
+import { accountRolePolicy, accountRoleToolNames, type AccountRole } from "./access";
+import type { DaemonPolicy } from "./policy";
+
+type EffectivePolicy = {
+  scope: "authenticated_account_effective_authority";
+  derived_from: ["account_role_policy", "daemon_capability_ceiling"];
+  profile: string;
+  revision: number;
+  allowWrite: boolean;
+  allowExec: boolean;
+  execMode: DaemonPolicy["execMode"];
+  unrestrictedPaths: boolean;
+  minimalEnv: boolean;
+  exposeAbsolutePaths: boolean;
+};
+
+type AccountIdentity = { accountId: string; accountVersion: number; role: AccountRole };
+
+type AccountAuthority = {
+  account: { account_id: string; role: AccountRole; version: number };
+  account_policy: DaemonPolicy & { scope: "account_role_capability_ceiling" };
+  daemon_policy_ceiling: DaemonPolicy | null;
+  effective_policy: EffectivePolicy | null;
+  effective_tools: string[];
+  effective_tool_count: number;
+  account_role_is_owner: boolean;
+  effective_profile_is_full: boolean;
+  interpretation: {
+    authoritative_permission_fields: ["effective_policy", "effective_tools"];
+    daemon_policy: string;
+    host_filtering: string;
+  };
+  summary: string;
+};
+
+export type DaemonCeilingStatus = Record<string, unknown> & {
+  policy: DaemonPolicy | null;
+  tools: string[];
+  policy_scope: "daemon_capability_ceiling_not_account_authority";
+  tools_scope: "daemon_advertised_before_account_role_filtering";
+};
+
+const profileFields = ["allowWrite", "execMode", "unrestrictedPaths", "minimalEnv", "exposeAbsolutePaths"] as const;
+const profiles = policyContract.profiles as Record<string, Pick<DaemonPolicy, typeof profileFields[number]> & { profile: string }>;
+const execRank: Record<DaemonPolicy["execMode"], number> = { off: 0, direct: 1, shell: 2 };
+
+export function describeDaemonCeiling(value: Record<string, unknown>): DaemonCeilingStatus {
+  return {
+    ...value,
+    policy: isDaemonPolicy(value.policy) ? value.policy : null,
+    tools: Array.isArray(value.tools) ? value.tools.filter((item): item is string => typeof item === "string") : [],
+    policy_scope: "daemon_capability_ceiling_not_account_authority",
+    tools_scope: "daemon_advertised_before_account_role_filtering",
+  };
+}
+
+export function accountAuthoritySnapshot(input: AccountIdentity & {
+  daemonPolicy: DaemonPolicy | null;
+  effectiveTools: string[];
+}): AccountAuthority {
+  const accountPolicy = accountRolePolicy(input.role);
+  const effectivePolicy = input.daemonPolicy ? intersectPolicies(accountPolicy, input.daemonPolicy) : null;
+  const effectiveTools = [...new Set(input.effectiveTools)];
+  const daemonProfile = input.daemonPolicy?.profile ?? "disconnected";
+  const effectiveProfile = effectivePolicy?.profile ?? "unavailable";
+  return {
+    account: { account_id: input.accountId, role: input.role, version: input.accountVersion },
+    account_policy: { ...accountPolicy, scope: "account_role_capability_ceiling" },
+    daemon_policy_ceiling: input.daemonPolicy,
+    effective_policy: effectivePolicy,
+    effective_tools: effectiveTools,
+    effective_tool_count: effectiveTools.length,
+    account_role_is_owner: input.role === "owner",
+    effective_profile_is_full: effectivePolicy?.profile === "full",
+    interpretation: {
+      authoritative_permission_fields: ["effective_policy", "effective_tools"],
+      daemon_policy: "daemon.policy is only the local daemon capability ceiling; it is not the authenticated account permission",
+      host_filtering: "the MCP host may expose a smaller subset than effective_tools, and Machine Bridge cannot observe that post-relay subset",
+    },
+    summary: input.daemonPolicy
+      ? `Authenticated account role ${input.role} has effective profile ${effectiveProfile}. daemon.policy.profile=${daemonProfile} is only the daemon capability ceiling, not this account's permission.`
+      : `Authenticated account role ${input.role} is configured for profile ${accountPolicy.profile}, but no daemon is connected; only Worker-local tools are currently available.`,
+  };
+}
+
+export function decorateProjectOverview(value: unknown, account: AccountIdentity): unknown {
+  if (!isRecord(value)) return value;
+  const daemonPolicy = isDaemonPolicy(value.policy) ? value.policy : null;
+  const daemonTools = Array.isArray(value.tools) ? value.tools.filter((item): item is string => typeof item === "string") : [];
+  const effectiveTools = ["server_info", ...accountRoleToolNames(account.role, daemonTools)];
+  const authority = accountAuthoritySnapshot({ ...account, daemonPolicy, effectiveTools });
+  return {
+    ...value,
+    daemonPolicy,
+    daemonTools,
+    policy: authority.effective_policy,
+    tools: authority.effective_tools,
+    policyScope: "authenticated_account_effective_authority",
+    toolsScope: "authenticated_account_effective_tools_before_host_filtering",
+    authorization: authority,
+  };
+}
+
+function intersectPolicies(accountPolicy: DaemonPolicy, daemonPolicy: DaemonPolicy): EffectivePolicy {
+  const execMode = execRank[accountPolicy.execMode] <= execRank[daemonPolicy.execMode] ? accountPolicy.execMode : daemonPolicy.execMode;
+  const capabilities = {
+    allowWrite: accountPolicy.allowWrite && daemonPolicy.allowWrite,
+    execMode,
+    unrestrictedPaths: accountPolicy.unrestrictedPaths && daemonPolicy.unrestrictedPaths,
+    minimalEnv: accountPolicy.minimalEnv || daemonPolicy.minimalEnv,
+    exposeAbsolutePaths: accountPolicy.exposeAbsolutePaths && daemonPolicy.exposeAbsolutePaths,
+  };
+  return {
+    scope: "authenticated_account_effective_authority",
+    derived_from: ["account_role_policy", "daemon_capability_ceiling"],
+    profile: matchingProfile(capabilities),
+    revision: Math.max(accountPolicy.revision, daemonPolicy.revision),
+    ...capabilities,
+    allowExec: execMode !== "off",
+  };
+}
+
+function matchingProfile(capabilities: Pick<EffectivePolicy, typeof profileFields[number]>): string {
+  for (const [name, profile] of Object.entries(profiles)) {
+    if (profileFields.every((field) => profile[field] === capabilities[field])) return name;
+  }
+  return "custom";
+}
+
+function isDaemonPolicy(value: unknown): value is DaemonPolicy {
+  if (!isRecord(value)) return false;
+  return typeof value.profile === "string"
+    && typeof value.origin === "string"
+    && Number.isInteger(value.revision)
+    && typeof value.allowWrite === "boolean"
+    && typeof value.allowExec === "boolean"
+    && (value.execMode === "off" || value.execMode === "direct" || value.execMode === "shell")
+    && typeof value.unrestrictedPaths === "boolean"
+    && typeof value.minimalEnv === "boolean"
+    && typeof value.exposeAbsolutePaths === "boolean";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/src/worker/index.ts

@@ -7,6 +7,7 @@ import { WorkerObservability } from "./observability";
 import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./errors";
 import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy";
 import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from "./access";
+import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority";
 import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin";
 import { serverInfoTool, workspaceTools } from "./tool-catalog";
 import {
@@ -22,7 +23,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.7";
+const SERVER_VERSION = "1.0.8";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -342,17 +343,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     return rpcError(request.id, -32601, `Method not found: ${request.method}`);
   }
-
   private async callTool(name: string, args: Record<string, unknown>, base: string, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
     if (name === "server_info") {
-      const daemon = this.daemonStatus(true);
-      const tools = this.allTools(authorized.role).map((tool) => tool.name);
+      const { daemon, tools, authorization } = this.authorityContext(authorized);
       return {
         name: SERVER_NAME,
         version: SERVER_VERSION,
         mcp_url: `${base}/mcp`,
         oauth: this.authorizationServerMetadata(base),
-        account: { account_id: authorized.accountId, role: authorized.role, version: authorized.accountVersion },
+        account: authorization.account,
+        authorization,
+        authority_summary: authorization.summary,
         daemon,
         worker: {
           pending_calls: this.pending.snapshot(),
@@ -360,10 +361,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           observability: this.observability.snapshot(),
         },
         tools,
+        tools_scope: "authenticated_account_effective_tools_before_host_filtering",
         tool_delivery: {
-          full_profile_scope: "local-daemon-and-relay-advertisement",
+          full_profile_scope: "daemon-capability-ceiling-before-account-filtering",
           daemon_advertised_tool_count: daemon.tool_count,
           relay_advertised_tool_count: tools.length,
+          effective_account_tool_count: tools.length,
+          relay_advertised_scope: "authenticated_account_effective_tools_before_host_filtering",
           host_exposed_tools_known_to_server: false,
           host_may_expose_subset: true,
         },
@@ -372,11 +376,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (workspaceTools.some((tool) => tool.name === name)) {
       if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
-      return this.callDaemonTool(name, args, authorized, requestKey);
+      const result = await this.callDaemonTool(name, args, authorized, requestKey);
+      return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
+        accountVersion: authorized.accountVersion, role: authorized.role }) : result;
     }
     throw new Error(`unknown tool: ${name}`);
   }
-
   private async callDaemonTool(name: string, args: Record<string, unknown>, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
     const socket = this.daemonSockets()[0];
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
@@ -419,7 +424,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       throw error;
     }
   }
-
   private cancelClientRequest(requestKey?: string): void {
     if (!requestKey) return;
     this.pending.cancelRequest(requestKey, (record) => {
@@ -456,11 +460,16 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const localTools = workspaceTools.filter((tool) => advertised.has(tool.name));
     return [serverInfoTool, ...localTools].map((tool) => structuredClone(tool));
   }
-
+  private authorityContext(authorized: AuthorizedToken) {
+    const daemon = describeDaemonCeiling(this.daemonStatus(true));
+    const tools = this.allTools(authorized.role).map((tool) => String(tool.name));
+    const authorization = accountAuthoritySnapshot({ accountId: authorized.accountId, accountVersion: authorized.accountVersion,
+      role: authorized.role, daemonPolicy: daemon.policy, effectiveTools: tools });
+    return { daemon, tools, authorization };
+  }
   private daemonToolEnabled(name: string): boolean {
     return this.daemonAdvertisedTools().has(name);
   }
-
   private daemonAdvertisedTools(): Set<string> {
     const socket = this.daemonSockets()[0];
     if (!socket) return new Set();