machine-bridge-mcp 1.0.7 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.1.0 - 2026-07-15
+
+### Claude and Microsoft Copilot Studio remote MCP
+
+- Add hosted-client OAuth interoperability for Claude custom connectors and Microsoft Copilot Studio while preserving the existing Streamable HTTP transport and current MCP protocol contract. Authorization-server and protected-resource discovery now advertise `offline_access` and the refresh-token grant; dynamic client registration declares both authorization-code and refresh-token grants.
+- Issue hashed access and refresh-token records from authorization-code exchange. Public-client refresh requests are form-encoded, bound to the original client/account/version/role/scope/resource, and rotate the refresh token atomically. Reuse, expiry, account changes, or deployment token-version changes return `invalid_grant`. Refresh state uses a separate versioned Durable Object key, so existing primary OAuth state does not require migration. The per-source DCR throttle now counts only registrations that have not completed authorization, preventing legitimate Claude or Copilot reconnections from consuming the abuse quota while retaining the deployment-wide client cap.
+- Exercise the exact hosted Claude callback, the unauthenticated `resource_metadata` challenge, discovery/DCR metadata, refreshed MCP access, refresh replay rejection, and account-targeted refresh revocation in the real Worker integration. Document Claude and Copilot Studio setup, and retain the narrow ChatGPT/Grok browser CORS set because Claude and Copilot Studio connect through cloud-side infrastructure rather than browser-origin response sharing.
+
+## 1.0.8 - 2026-07-14
+
+### Effective account authority reporting
+
+- Separate the authenticated account authority from the local daemon capability ceiling in remote diagnostics. `server_info.authorization.effective_policy` and `effective_tools` are now the authoritative account fields, while `daemon.policy` and `daemon.tools` are explicitly scoped as pre-role ceilings. The response also includes a deterministic authority summary and scope labels so clients cannot reasonably equate an `editor` account with a `full` daemon.
+- Make remote `project_overview` return the role-intersected policy and tools at its existing top-level fields, while preserving the daemon values separately as `daemonPolicy` and `daemonTools`. Add a Worker integration regression that authorizes an `editor` account against a canonical `full` daemon and proves shell/browser tools remain excluded at both reporting surfaces and at relay enforcement.
+- Update MCP initialization guidance, tool descriptions, operations diagnostics, architecture, client, account, testing, and generated tool-reference documentation to use the effective-account fields when diagnosing permissions.
+
 ## 1.0.7 - 2026-07-14
 
 ### Browser-complete OAuth callback navigation

package/README.md

@@ -5,7 +5,7 @@
 It supports two transports:
 
 ```text
-Remote clients such as ChatGPT
+Remote clients such as ChatGPT, Claude, and Copilot Studio
         HTTPS + OAuth 2.1 / PKCE
                   |
        Cloudflare Worker + Durable Object
@@ -47,7 +47,7 @@ This default prioritizes usability, not least privilege. `run_process` and proce
 
 ## Install
 
-For prerequisites, first remote deployment, ChatGPT connection, stdio configuration, browser pairing, upgrades, troubleshooting, and removal, follow [Installation and first use](docs/GETTING_STARTED.md). The commands below are the compact installation reference.
+For prerequisites, first remote deployment, hosted-client connection, stdio configuration, browser pairing, upgrades, troubleshooting, and removal, follow [Installation and first use](docs/GETTING_STARTED.md). The commands below are the compact installation reference.
 
 Version 1 supports only MCP protocol `2025-11-25`. Existing current-schema local state upgrades in place, but clients must reconnect and the unpacked browser extension must be reloaded after package upgrade.
 
@@ -95,7 +95,7 @@ npm install
 .\mbm.cmd             # Windows cmd
 ```
 
-## Remote MCP for ChatGPT
+## Remote MCP for hosted clients
 
 After a global installation, `machine-mcp` can be launched from any Command Prompt or terminal; the package installation directory is not the workspace. On the first interactive Windows start, the CLI asks:
 
@@ -136,13 +136,23 @@ Use the printed URL in the MCP client:
 MCP Server URL: https://<worker>.<account>.workers.dev/mcp
 ```
 
-During OAuth authorization, enter the name and password of a Machine Bridge account. The first start creates `owner` and prints its generated password once. Additional accounts are managed with `machine-mcp account`. The authorization flow uses PKCE S256, exact redirect/resource binding, expiring hashed access tokens, per-account version checks, and a deployment-wide token version for emergency bulk revocation.
+During OAuth authorization, enter the name and password of a Machine Bridge account. The first start creates `owner` and prints its generated password once. Additional accounts are managed with `machine-mcp account`. The authorization flow exposes protected-resource and authorization-server discovery, dynamic client registration, PKCE S256, exact redirect/resource binding, `offline_access`, expiring hashed access and refresh-token records, public-client refresh-token rotation, per-account version checks, and a deployment-wide token version for emergency bulk revocation.
 
-The Worker grants browser CORS response access to the exact first-party origins used by ChatGPT (`https://chatgpt.com` and the legacy `https://chat.openai.com`) and Grok (`https://grok.com` and its X-hosted surface at `https://x.com`). Users do not need to run Wrangler or edit Cloudflare variables. `MBM_ALLOWED_ORIGINS` remains an operator-only, comma-separated extension point for other exact origins; it is additive and does not replace the built-in set. Wildcards and `null` do not receive CORS permission. Actual OAuth navigations and form submissions are not rejected solely because a browser container supplies an opaque or client-specific `Origin`; authorization still depends on exact redirect/resource binding, PKCE, account authentication, and bearer-token validation. The consent page CSP permits form navigation only to the Worker itself and the exact validated redirect origin for that request, so Chromium can follow the successful `303` callback without granting arbitrary form destinations.
+The same `/mcp` endpoint supports the current hosted-client paths documented by their vendors:
+
+- ChatGPT and Grok can use the public Streamable HTTP endpoint and browser OAuth flow.
+- Claude custom connectors can add the exact `/mcp` URL and use dynamic client registration. The hosted Claude callback `https://claude.ai/api/mcp/auth_callback`, `offline_access`, form-encoded token exchange, proactive/reactive refresh, and one-time refresh-token rotation are covered by the Worker integration contract.
+- Microsoft Copilot Studio can use **Tools > Add a tool > New tool > Model Context Protocol**, select **OAuth 2.0 > Dynamic discovery**, and point **Server URL** at the exact `/mcp` endpoint. Machine Bridge advertises the Streamable transport, discovery metadata, DCR, access tokens, and rotating refresh tokens expected by that path.
+
+These are protocol and integration-contract claims, not evidence that every external tenant, plan, administrator policy, or host-side tool filter has been tested. Claude remote connectors originate from Anthropic's cloud, and Copilot Studio reaches MCP servers through Power Platform connectivity; neither requires adding a browser origin to Machine Bridge's CORS list.
+
+The Worker grants browser CORS response access to the exact first-party origins used by ChatGPT (`https://chatgpt.com` and the legacy `https://chat.openai.com`) and Grok (`https://grok.com` and its X-hosted surface at `https://x.com`). Users do not need to run Wrangler or edit Cloudflare variables. `MBM_ALLOWED_ORIGINS` remains an operator-only, comma-separated extension point for other exact browser origins; it is additive and does not replace the built-in set. Wildcards and `null` do not receive CORS permission. Actual OAuth navigations and form submissions are not rejected solely because a browser container supplies an opaque or client-specific `Origin`; authorization still depends on exact redirect/resource binding, PKCE, account authentication, and bearer-token validation. The consent page CSP permits form navigation only to the Worker itself and the exact validated redirect origin for that request, so Chromium can follow the successful `303` callback without granting arbitrary form destinations.
 
 ### Multiple clients and accounts
 
-One Worker supports several named accounts and OAuth clients. Accounts have independent passwords, roles, active state, versions, codes, and tokens. The roles are `reviewer`, `editor`, `operator`, and `owner`; their effective authority is intersected with the connected daemon policy and enforced in both the Worker and local runtime. Role changes, suspension, password rotation, and removal revoke only the affected account.
+One Worker supports several named accounts and OAuth clients. Accounts have independent passwords, roles, active state, versions, authorization codes, access tokens, and refresh tokens. The roles are `reviewer`, `editor`, `operator`, and `owner`; their effective authority is intersected with the connected daemon policy and enforced in both the Worker and local runtime. Role changes, suspension, password rotation, and removal revoke only the affected account.
+
+For remote connections, `server_info.authorization.effective_policy` and `server_info.authorization.effective_tools` are the authoritative account-permission fields. `server_info.daemon.policy` and `server_info.daemon.tools` describe only the local daemon capability ceiling before account-role filtering. Remote `project_overview` likewise places the effective account policy/tools in `policy` and `tools`, while preserving the daemon ceiling separately as `daemonPolicy` and `daemonTools`.
 
 This is application-level authorization, not kernel or browser-profile isolation. All accounts reach one daemon running as one OS user. Use separate Workers and preferably separate low-privilege OS accounts, containers, or VMs for mutually untrusted users or hard tenant isolation. See [Multi-account authorization and tenancy](docs/MULTI_ACCOUNT.md).
 
@@ -217,7 +227,7 @@ machine-mcp browser status
 
 Load the printed unpacked-extension directory in the Chromium profile you actually use; Machine Bridge does not install it into Playwright or a separate automation profile. After every Machine Bridge upgrade, reload the unpacked extension and accept any new browser permission. `machine-mcp browser status` reports both the expected packaged extension build and the authenticated connected build/protocol, and states that Machine Bridge did not launch the browser. It cannot infer whether the extension was loaded into a daily or isolated profile; that is determined by where the user installed it. Trusted input uses the Chromium `debugger` permission only for fixed, short-lived DevTools Input commands. The badge shows `ON` only after the broker acknowledges the version/capability handshake. The local pairing token remains in owner-only state and non-cacheable loopback HTML; it is not returned through MCP. For a mass-market release, distribute the same extension as a signed browser-store build rather than asking end users to enable Developer mode. See [Local application and browser automation](docs/LOCAL_AUTOMATION.md).
 
-Machine Bridge can discover, refresh, rank, and load capabilities automatically. The ChatGPT/MCP host still owns tool selection and approval, so the server cannot force a host to expose or invoke a recommended skill, command, app, or browser operation. Check `server_info.observability.capability_routing` or `project_overview.capabilityRouting` to distinguish “the host never called the resolver” from “the resolver ran but found no relevant capability.”
+Machine Bridge can discover, refresh, rank, and load capabilities automatically. The MCP host still owns tool selection and approval, so the server cannot force a host to expose or invoke a recommended skill, command, app, or browser operation. Check `server_info.observability.capability_routing` or `project_overview.capabilityRouting` to distinguish “the host never called the resolver” from “the resolver ran but found no relevant capability.”
 
 
 ## Runtime lifecycle and observability
@@ -470,7 +480,7 @@ The service definition contains neither credentials nor a duplicate policy. It l
 machine-mcp rotate-secrets
 ```
 
-Rotation stops the installed service, refuses to proceed while another foreground daemon owns the workspace lock, and rotates the account-administration secret, daemon secret, and deployment-wide OAuth token version. It invalidates every account access token and requires all clients to authorize again. Use `machine-mcp account rotate-password NAME` for targeted password rotation without affecting other accounts.
+Rotation stops the installed service, refuses to proceed while another foreground daemon owns the workspace lock, and rotates the account-administration secret, daemon secret, and deployment-wide OAuth token version. It invalidates every account access and refresh token and requires all clients to authorize again. Use `machine-mcp account rotate-password NAME` for targeted password rotation without affecting other accounts.
 
 ## State and observability
 
@@ -497,7 +507,7 @@ npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 ```
 
-`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, semantic undefined-identifier checks, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, an isolated installation of the actual packed tarball whose zero-argument CLI startup must reach a controlled Worker-deployment boundary, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, a live local OAuth/Worker/WebSocket/MCP flow, and a real Chromium negative/positive test for CSP-governed OAuth callback navigation. GitHub Actions runs the complete suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline.
+`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, semantic undefined-identifier checks, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, an isolated installation of the actual packed tarball whose zero-argument CLI startup must reach a controlled Worker-deployment boundary, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, a live local OAuth/Worker/WebSocket/MCP flow covering discovery, Claude callback routing, rotating refresh tokens, replay rejection, and account-targeted refresh revocation, plus a real Chromium negative/positive test for CSP-governed OAuth callback navigation. GitHub Actions runs the complete suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline.
 
 The cross-cutting 0.12.0 review, corrected failure modes, and residual OS-level limits are recorded in [docs/AUDIT.md](docs/AUDIT.md). See also [docs/GETTING_STARTED.md](docs/GETTING_STARTED.md), [docs/MULTI_ACCOUNT.md](docs/MULTI_ACCOUNT.md), [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md), [docs/LOCAL_AUTOMATION.md](docs/LOCAL_AUTOMATION.md), [docs/MANAGED_JOBS.md](docs/MANAGED_JOBS.md), [docs/TESTING.md](docs/TESTING.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), [docs/ENGINEERING.md](docs/ENGINEERING.md), [docs/PROJECT_STANDARDS.md](docs/PROJECT_STANDARDS.md), the generated [MCP tool reference](docs/TOOL_REFERENCE.md), and [SECURITY.md](SECURITY.md).
 

package/SECURITY.md

@@ -40,7 +40,7 @@ The Worker is a remote authentication and relay boundary. The local runtime is t
 
 ### Accounts are authorization boundaries, not OS sandboxes
 
-Remote mode supports named accounts with independent passwords, roles, active state, versions, OAuth codes, and access tokens. The roles `reviewer`, `editor`, `operator`, and `owner` map to the local review, edit, agent, and full policy profiles. The Worker intersects the account role with the connected daemon policy, and the local runtime validates the account role again before dispatch. Account suspension, role changes, password rotation, and removal revoke only that account.
+Remote mode supports named accounts with independent passwords, roles, active state, versions, OAuth authorization codes, access tokens, and rotating refresh tokens. The roles `reviewer`, `editor`, `operator`, and `owner` map to the local review, edit, agent, and full policy profiles. The Worker intersects the account role with the connected daemon policy, and the local runtime validates the account role again before dispatch. Account suspension, role changes, password rotation, and removal revoke only that account.
 
 An OAuth `client_id` still identifies client software and redirect URIs; it is not an account. One account can authorize several clients, and one client can be authorized by several accounts.
 
@@ -162,11 +162,11 @@ Runner diagnostic logs are owner-only and do not receive child stdout/stderr. Ex
 
 ## OAuth and public endpoints
 
-Remote mode uses authorization code flow with PKCE S256, exact redirect/resource/client binding, expiring authorization codes and access tokens, hashed token storage, per-account version checks, deployment-wide token-version revocation, and bounded dynamic client registration. Authorization codes and tokens are bound to one account ID, account version, and role. Successful consent constructs the registered callback through the URL API and returns `303 See Other`; response parameters are encoded rather than concatenated into an unchecked header string.
+Remote mode uses authorization code flow with PKCE S256, exact redirect/resource/client binding, protected-resource and authorization-server discovery, bounded dynamic client registration, `offline_access`, expiring authorization codes, access tokens, and refresh tokens, hashed bearer-token storage, per-account version checks, and deployment-wide token-version revocation. Authorization codes and both token classes are bound to one client ID, account ID, account version, role, scope, and resource. Public-client refresh tokens are single-use: a successful refresh atomically stores a new access/refresh pair and removes the presented refresh token; replay and account/version invalidation return RFC 6749 `invalid_grant`. Successful consent constructs the registered callback through the URL API and returns `303 See Other`; response parameters are encoded rather than concatenated into an unchecked header string.
 
 The authorization page displays the validated client name and redirect URI. Enter an account name and password only after initiating the connection and recognizing both values.
 
-Password failures and registrations are limited by deployment-keyed HMAC source identity. Browser requests are same-origin unless an exact origin is listed in `MBM_ALLOWED_ORIGINS`; loopback OAuth redirect permission does not grant browser-origin access.
+Password failures and pending, not-yet-authorized client registrations are limited by deployment-keyed HMAC source identity; successfully authorized DCR clients no longer consume that pending-registration quota, while the global client cap remains authoritative. Browser requests are same-origin unless an exact origin is listed in `MBM_ALLOWED_ORIGINS`; loopback OAuth redirect permission does not grant browser-origin access.
 
 Public health and metadata do not expose live workspace or daemon status. The daemon handshake omits workspace path/name/hash and process ID.
 
@@ -174,7 +174,7 @@ Public health and metadata do not expose live workspace or daemon status. The da
 
 Only one authenticated daemon is active. Candidates have a handshake deadline and cannot displace the current daemon before success. Pending calls are socket-bound, client-request-bound, concurrency-limited, size-limited, and timed out. Duplicate in-flight request IDs are rejected only within the same authenticated MCP session. Initialization returns a stateless HMAC-bound `MCP-Session-Id`; the signature binds the session nonce to the OAuth token identity, so one account can use multiple concurrent chat windows without sharing a cancellation or request-id namespace. Independent sessionless POST requests are not indexed by token and request id. A session id is an integrity/correlation token, not a second authorization credential.
 
-Request bodies, WebSocket messages, tool outputs, traversals, sessions, stdin writes, OAuth records, clients, codes, tokens, and failure identities are bounded. Disconnect/replacement terminates active child process trees.
+Request bodies, WebSocket messages, tool outputs, traversals, sessions, stdin writes, OAuth records, clients, codes, access tokens, refresh tokens, and failure identities are bounded. Disconnect/replacement terminates active child process trees.
 
 These controls reduce accidental exhaustion and simple abuse. They do not replace Cloudflare account MFA, WAF/rate limits, usage alerts, or cost controls for an internet-facing Worker.
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.7",
+  "version": "1.1.0",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.7"
+  "version_name": "1.1.0"
 }

package/docs/ARCHITECTURE.md

@@ -103,14 +103,14 @@ The stdio server implements newline-delimited JSON-RPC over stdin/stdout. It neg
 
 All requests for a deployed Worker route to one named Durable Object. It owns:
 
-- OAuth clients, authorization codes, hashed access-token records, and throttling metadata;
+- OAuth clients, authorization codes, hashed access-token records, an independently versioned hashed refresh-token store, and throttling metadata;
 - one active authenticated daemon WebSocket plus bounded candidate sockets;
 - policy/tool metadata attached to the active socket;
 - a bounded in-memory map of pending daemon calls.
 
 The Worker verifies OAuth, validates MCP envelopes and optional protocol headers, converts `tools/call` into WebSocket messages, correlates cancellation by access-token hash and JSON-RPC ID, and formats text/structured/image results. It has no local filesystem or process API.
 
-The OAuth store separates client registrations from named accounts. A `client_id` identifies an MCP application and redirect URIs; account records identify the authorized human or service identity. Codes and tokens bind client ID, account ID, account version, role, scope, resource, and expiration. The Worker intersects the role with the active daemon policy before advertising or relaying tools, and the local runtime validates the relayed role again. One bridge-specific Durable Object and one local runtime remain the normal topology for a workspace/trust domain; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
+The primary OAuth store separates client registrations and named accounts from authorization codes and access-token records. A separate Durable Object key owns refresh-token records so refresh support can be added without rewriting the live primary-store schema. A `client_id` identifies an MCP application and redirect URIs; account records identify the authorized human or service identity. Codes, access tokens, and refresh tokens bind client ID, account ID, account version, role, scope, resource, token version, and expiration. Only hashes of bearer tokens are persisted, and every public-client refresh invalidates the presented refresh token while returning a replacement. The Worker intersects the role with the active daemon policy before advertising or relaying tools, and the local runtime validates the relayed role again. One bridge-specific Durable Object and one local runtime remain the normal topology for a workspace/trust domain; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
 
 The daemon attachment deliberately omits workspace path/name/hash and process ID. Explicit authenticated tools may return workspace metadata according to local path-display policy.
 
@@ -141,16 +141,16 @@ flowchart LR
   CLI --> S[Autostart provider]
 ```
 
-Remote OAuth binds each code and token to a named Machine Bridge account, account version, and role, so accounts are independent application-level authorization principals. The Worker intersects that role with the connected daemon policy, and the local runtime enforces the relayed authorization again. This distinction is not operating-system tenancy: every account still reaches one daemon, workspace, browser profile, and OS user authority. Local stdio access relies on the local process and configuration boundary. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
+Remote OAuth binds each code, access token, and refresh token to a named Machine Bridge account, account version, and role, so accounts are independent application-level authorization principals. The Worker intersects that role with the connected daemon policy, and the local runtime enforces the relayed authorization again. This distinction is not operating-system tenancy: every account still reaches one daemon, workspace, browser profile, and OS user authority. Local stdio access relies on the local process and configuration boundary. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
 
 ## Remote request lifecycle
 
 1. The MCP client discovers protected-resource and authorization-server metadata.
-2. It dynamically registers bounded redirect metadata.
+2. It dynamically registers bounded redirect metadata. Per-source throttling counts only registrations that have not yet completed authorization, while a separate global cap bounds all retained clients.
 3. The Worker validates authorization parameters before displaying a password form.
 4. The user verifies client name and redirect URI and enters a Machine Bridge account name and password.
-5. The Worker creates a five-minute code bound to client, redirect, resource, scope, and PKCE challenge.
-6. A valid verifier exchanges the one-time code for an expiring bearer token; only its hash is stored.
+5. The Worker creates a five-minute code bound to client, redirect, resource, normalized scope, and PKCE challenge.
+6. A valid verifier exchanges the one-time code for an expiring access token and refresh token; only their hashes are stored. A refresh request is bound to the original public client, account, scope, resource, and deployment token version, and atomically replaces the refresh token so replay returns `invalid_grant`.
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. `tools/list` is derived from the active daemon handshake; without a daemon, only `server_info` is advertised.
 9. `tools/call` receives a random relay call ID and is bound to the current socket and authenticated client request key.
@@ -233,13 +233,13 @@ Active managed jobs persist an owner-only plan, status, runner process identity,
 
 Removal first acquires a state-root maintenance lock that blocks new profile/state claims and state-backed operations from already constructed managed-job/browser managers, then stops the platform service and all known verified workspace daemons. It then validates the state marker, canonical target, known contents, active or unreadable locks, filesystem root/home/current/package/workspace/source exclusions, managed jobs, and Worker deletion outcome before recursive deletion. Any unresolved phase retains definitions and state.
 
-OAuth metadata is pruned on access. Expired codes/tokens, old throttling records, and inactive clients without active credentials are removed. Source identities are deployment-keyed HMAC values, not stored source addresses or reversible unsalted hashes.
+OAuth metadata is pruned on access. Expired authorization codes, access tokens, refresh tokens, old throttling records, and inactive clients without active credentials are removed. Account disablement, role or password changes, removal, and deployment-wide token-version rotation make both token classes unusable; stale refresh records are deleted when the refresh store is next read. Source identities are deployment-keyed HMAC values, not stored source addresses or reversible unsalted hashes.
 
-Browser-origin handling separates CORS response sharing from protocol authentication. Preflight succeeds only for the Worker's own origin, a fixed first-party set for ChatGPT (`https://chatgpt.com`, `https://chat.openai.com`) and Grok (`https://grok.com`, `https://x.com`), or optional exact comma-separated additions from `MBM_ALLOWED_ORIGINS`; wildcard and `null` origins are not granted CORS access. Actual requests are routed without using `Origin` as an authentication boundary, and `Access-Control-Allow-Origin` is added only when that exact predicate passes. This permits OAuth top-level navigation and form submission from opaque or client-specific containers while exact redirect/resource binding, PKCE, account credentials, bearer tokens, and private admin/daemon secrets enforce authority. The authorization document's `form-action` policy is generated only after request validation and contains `'self'` plus the exact origin of that validated redirect URI. This allows Chromium to follow the successful form submission's `303` callback without opening form navigation to unrelated origins.
+Browser-origin handling separates CORS response sharing from protocol authentication. Preflight succeeds only for the Worker's own origin, a fixed first-party set for ChatGPT (`https://chatgpt.com`, `https://chat.openai.com`) and Grok (`https://grok.com`, `https://x.com`), or optional exact comma-separated additions from `MBM_ALLOWED_ORIGINS`; wildcard and `null` origins are not granted CORS access. Actual requests are routed without using `Origin` as an authentication boundary, and `Access-Control-Allow-Origin` is added only when that exact predicate passes. This permits OAuth top-level navigation and form submission from opaque or client-specific containers while exact redirect/resource binding, PKCE, account credentials, bearer tokens, and private admin/daemon secrets enforce authority. The authorization document's `form-action` policy is generated only after request validation and contains `'self'` plus the exact origin of that validated redirect URI. This allows Chromium to follow the successful form submission's `303` callback without opening form navigation to unrelated origins. Hosted Claude remote connectors originate from Anthropic infrastructure and Copilot Studio uses Power Platform connectivity, so their server-to-server requests do not require browser CORS entries; adding those brands to the browser allowlist would expand response sharing without enabling either integration.
 
 ## Observability
 
-Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status, policy origin/revision, managed-job counts, resource alias names without paths or values, daemon/relay-advertised tool counts, relay route state without endpoint details, and privacy-preserving capability-routing evidence. It explicitly reports that the host-exposed subset is unknown to the server. `diagnose_runtime` runs fixed local probes and explicitly reports that its own request reached the daemon.
+Public health exposes only server identity and version. Authenticated `server_info` exposes bounded runtime status, managed-job counts, resource alias names without paths or values, relay route state without endpoint details, and privacy-preserving capability-routing evidence. It separates the daemon capability ceiling from the authenticated account authority: `daemon.policy`/`daemon.tools` retain the pre-role ceiling, while `authorization.effective_policy`/`authorization.effective_tools` and the top-level `tools` report the role-intersected authority before any host-side filtering. It explicitly reports that the host-exposed subset is unknown to the server. `diagnose_runtime` runs fixed local probes and explicitly reports that its own request reached the daemon.
 
 Foreground logging defaults to `info`; autostart uses `warn`. Authenticated readiness, persistent degradation, and recovery are user-visible state transitions. Brief relay interruptions, raw transport close details, retry timing, and all per-tool starts/successes/failures/cancellations/durations are debug-only. Unexpected local and Worker infrastructure errors are reduced to classes. Messages, strings, arrays, object depth/key counts, and serialized fields are bounded.
 

package/docs/AUDIT.md

@@ -1,5 +1,13 @@
 # Engineering and security audit
 
+## 2026-07-15 hosted-client OAuth interoperability audit
+
+The Claude and Microsoft Copilot Studio request was first tested against the existing protocol boundary rather than implemented as a brand allowlist. Both clients already use the deployed Streamable HTTP endpoint; the material gap was token continuity. Anthropic's connector contract advertises `offline_access`, performs form-encoded refreshes, and requires public-client refresh-token rotation. Copilot Studio's recommended Dynamic discovery path likewise discovers DCR/OAuth endpoints and exchanges refresh tokens. Adding browser origins alone would not implement either contract: Claude remote connectors originate from Anthropic cloud infrastructure, while Copilot Studio uses Power Platform connectivity. The fixed ChatGPT/Grok browser CORS set therefore remains unchanged.
+
+The Worker now advertises the refresh grant and `offline_access`, stores only hashes of access and refresh tokens, and rotates every refresh token in one Durable Object write with the associated access-token update. Refresh records live under a separate versioned storage key, preserving the current primary OAuth-store schema and avoiding a destructive live migration. Refreshes remain bound to client, account, account version, role, normalized scope, resource, and deployment token version. Old-token replay and account-version changes return `invalid_grant`; account suspension, role/password changes, removal, and global token-version rotation cannot extend authority through refresh. Because both hosted clients may create a new DCR client for a fresh connection, the source throttle now counts only registrations that have not completed authorization; the global retained-client bound is unchanged.
+
+The workerd integration proves the hosted Claude callback, the unauthenticated `resource_metadata` challenge, discovery metadata, DCR grant advertisement, `offline_access`, form-encoded refresh, access/refresh replacement, replay rejection, continued MCP use with the refreshed access token, and targeted account refresh revocation. Copilot Studio compatibility is established at the documented protocol boundary rather than claimed as a live tenant test; Power Platform data policies, plan availability, tenant administration, and host-side tool filtering remain external controls.
+
 This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, including the version 1.0.2 elapsed-time review and the version 1.0.3 code-scanning inventory correction. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
 
 

package/docs/CLIENTS.md

@@ -7,7 +7,7 @@ An MCP server is not a model provider. It exposes tools, resources, or prompts.
 For this project:
 
 ```text
-Claude Desktop / Cursor / Codex / ChatGPT Desktop / another MCP host
+Claude Desktop / Cursor / Codex / ChatGPT Desktop / another local MCP host
         owns the model, account, conversation, approvals, and tool-selection loop
                               |
                               | stdio or Streamable HTTP
@@ -32,7 +32,7 @@ For many users, the client's native filesystem, patch, terminal, and approval sy
 The stdio mode exists for narrower cases:
 
 1. **One tool contract across several clients.** The same tool names, schemas, patch behavior, Git handling, process sessions, result formats, and logging work in Claude Desktop, Cursor, Codex, ChatGPT Desktop, and other MCP hosts.
-2. **Transport parity.** The local client can use essentially the same Machine Bridge runtime that remote ChatGPT access uses, without maintaining a second implementation.
+2. **Transport parity.** The local client can use essentially the same Machine Bridge runtime that hosted ChatGPT, Claude, Grok, and Copilot Studio connections use, without maintaining a second implementation.
 3. **No remote relay for same-machine use.** The host launches the server directly, so no Cloudflare Worker, public URL, OAuth flow, or network round trip is needed.
 4. **Capabilities missing from a particular host.** Exact edit semantics, transactional multi-file patches, retained process sessions, image results, or the project's policy profiles may be useful even when the host has basic shell tools.
 5. **Durable managed jobs.** The same detached job/resource/finally semantics are available to local and remote hosts, while local CLI remains an operator fallback.
@@ -44,7 +44,7 @@ It is therefore an optional compatibility and reuse surface, not a replacement f
 
 | Situation | Recommended path |
 |---|---|
-| ChatGPT web or another service must reach this computer remotely | Remote Worker with HTTPS/OAuth |
+| ChatGPT, Claude, Grok, Copilot Studio, or another hosted service must reach this computer remotely | Remote Worker with Streamable HTTPS/OAuth |
 | A local MCP host needs Machine Bridge-specific tools | stdio |
 | The local coding client already provides everything needed | Use the client's native tools; do not configure Machine Bridge stdio |
 | Several local clients should share identical tool semantics | stdio |
@@ -56,7 +56,7 @@ The MCP specification defines stdio and Streamable HTTP as standard transports.
 
 MCP initialization and `resolve_task_capabilities` give the host a current view of conservative built-in working agreements, bounded project facts, explicit global/project instructions, skills, explicit/automatic package commands, applications, and browser capability. The resolver rescans rather than relying on a stale dynamic tool list and can return the best matching skill instructions in one call. No instruction file is required for the default layers, and no repository file is written automatically.
 
-The host still owns the agent loop. ChatGPT web may use the recommendation automatically, ask for confirmation, expose only part of the catalog, or ignore server instructions. No MCP implementation can guarantee automatic invocation from the server side. Machine Bridge models that limitation explicitly instead of treating a recommendation as execution.
+The host still owns the agent loop. A hosted client may use the recommendation automatically, ask for confirmation, expose only part of the catalog, or ignore server instructions. No MCP implementation can guarantee automatic invocation from the server side. Machine Bridge models that limitation explicitly instead of treating a recommendation as execution.
 
 For browser tasks, the remote host reaches the local extension through the Worker and daemon. The extension controls the existing Chromium profile; it is not a separate Playwright profile.
 
@@ -114,7 +114,7 @@ args = ["/absolute/path/to/machine-mcp.mjs", "stdio", "--workspace", "/path/to/p
 
 Codex CLI, the Codex IDE extension, and supported ChatGPT Desktop Codex hosts can share MCP configuration on the same Codex host. ChatGPT web does not read local Codex configuration files; web use requires a hosted plugin/connector or a reachable remote MCP endpoint.
 
-## Remote ChatGPT and Grok connection
+## Remote hosted-client connection
 
 Run:
 
@@ -122,9 +122,17 @@ Run:
 machine-mcp --workspace /path/to/project
 ```
 
-Enter the printed `/mcp` URL in the remote MCP connector. During OAuth authorization, verify the displayed client name and redirect URI before entering a Machine Bridge account name and password. The Worker has exact built-in CORS response support for `https://chatgpt.com`, legacy `https://chat.openai.com`, `https://grok.com`, and the X-hosted Grok surface at `https://x.com`; no direct Wrangler command or Cloudflare variable edit is required. OAuth navigations and form submissions from opaque or client-specific browser containers are routed normally but receive no cross-origin response-sharing permission unless their exact origin is allowed. The authorization page also permits form navigation only to itself and the exact validated redirect origin, which is required for Chromium to follow the successful `303` back to the client.
+Enter the printed `/mcp` URL in the remote MCP connector. During OAuth authorization, verify the displayed client name and redirect URI before entering a Machine Bridge account name and password. The Worker exposes Streamable HTTP plus protected-resource discovery, authorization-server discovery, dynamic client registration, PKCE S256, `offline_access`, and rotating refresh tokens.
 
-Several OAuth clients and named accounts can coexist. Accounts have independent passwords, roles, active state, versions, and targeted revocation. Their effective tool sets are intersected with the connected daemon policy. All accounts still share one daemon and OS user, so hard tenant isolation requires separate deployments; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
+Supported configuration paths are:
+
+- **ChatGPT and Grok:** enter the `/mcp` URL in the corresponding remote connector. The Worker has exact built-in CORS response support for `https://chatgpt.com`, legacy `https://chat.openai.com`, `https://grok.com`, and the X-hosted Grok surface at `https://x.com`.
+- **Claude custom connectors:** add the exact `/mcp` URL under Claude's connector settings and leave static OAuth client credentials empty so Claude can use DCR. Hosted Claude surfaces use `https://claude.ai/api/mcp/auth_callback`; the Worker accepts that exact registered redirect and rotates refresh tokens for the public client. See Anthropic's [remote custom connector guide](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) and [authentication contract](https://claude.com/docs/connectors/building/authentication).
+- **Microsoft Copilot Studio:** from the agent's **Tools** page, select **Add a tool > New tool > Model Context Protocol**, enter the `/mcp` URL, then select **OAuth 2.0 > Dynamic discovery**. Create the connection and add it to the agent. See Microsoft's [existing MCP server guide](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent).
+
+OAuth navigations and form submissions from opaque or client-specific browser containers are routed normally but receive no cross-origin response-sharing permission unless their exact origin is allowed. The authorization page permits form navigation only to itself and the exact validated redirect origin. Claude remote connectors originate from Anthropic infrastructure, while Copilot Studio connectivity runs through Power Platform connectors, so neither is a reason to broaden the browser CORS allowlist.
+
+Several OAuth clients and named accounts can coexist. Accounts have independent passwords, roles, active state, versions, authorization codes, access tokens, refresh tokens, and targeted revocation. Their effective tool sets are intersected with the connected daemon policy. All accounts still share one daemon and OS user, so hard tenant isolation requires separate deployments; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
 
 ## Profile guidance
 
@@ -149,7 +157,7 @@ For SSH automation, prefer `generate_ssh_key_resource` under canonical full, or
 
 The local `full` profile controls Machine Bridge's own tool catalog, path resolver, path display, process environment, and shell availability. It does not control the MCP host's model policy, approval UI, connector gateway, or platform execution filters.
 
-Machine Bridge itself does not block files because their names look sensitive. If `server_info` reports `full` and a direct call is still rejected before a structured tool result, the host/connector may have blocked delivery. If `diagnose_runtime` responds but its fixed process or shell probe fails, the likely source is local OS policy, endpoint-security software, permissions, or shell configuration. Changing `--profile`, `--unrestricted-paths`, or `--absolute-paths` cannot override either layer.
+Machine Bridge itself does not block files because their names look sensitive. In remote mode, first inspect `server_info.authorization.effective_policy` and `effective_tools`; `daemon.policy` is only the local ceiling. If the effective profile is `full` and the effective tool is present but a direct call is still rejected before a structured result, the host/connector may have blocked delivery. If `diagnose_runtime` responds but its fixed process or shell probe fails, the likely source is local OS policy, endpoint-security software, permissions, or shell configuration. Changing `--profile`, `--unrestricted-paths`, or `--absolute-paths` cannot override either layer.
 
 Do not attempt to evade a host refusal by renaming, encoding, or switching to another arbitrary execution tool. Instead:
 

package/docs/GETTING_STARTED.md

@@ -1,6 +1,6 @@
 # Installation and first-use guide
 
-This guide covers a clean installation, the first remote ChatGPT connection, local stdio clients, browser setup, routine operation, upgrades, troubleshooting, and removal.
+This guide covers a clean installation, first remote connections from ChatGPT, Claude, Grok, and Microsoft Copilot Studio, local stdio clients, browser setup, routine operation, upgrades, troubleshooting, and removal.
 
 ## 1. Decide which connection mode you need
 
@@ -8,7 +8,7 @@ Machine Bridge has two transports. Choose one before installing:
 
 | Requirement | Use | Cloudflare required | Process that must remain available |
 |---|---|---:|---|
-| ChatGPT web, a hosted agent, or another device must reach this computer | Remote HTTPS/OAuth | Yes | Machine Bridge daemon or installed login service |
+| ChatGPT, Claude, Grok, Copilot Studio, a hosted agent, or another device must reach this computer | Remote Streamable HTTPS/OAuth | Yes | Machine Bridge daemon or installed login service |
 | Claude Desktop, Cursor, Codex, ChatGPT Desktop, or another local host runs on this computer | Local stdio | No | The MCP host launches Machine Bridge as a subprocess |
 | The local coding client already has equivalent file, Git, patch, and terminal tools | Neither | No | None |
 
@@ -181,7 +181,7 @@ To avoid installing autostart during a temporary test:
 machine-mcp --workspace /path/to/project --no-autostart
 ```
 
-## 7. Connect ChatGPT
+## 7. Connect a hosted MCP client
 
 Machine Bridge prints the remote endpoint and, only when creating the first account, a one-time owner password:
 
@@ -204,7 +204,35 @@ Current ChatGPT developer-mode flow, as documented in OpenAI's [Connect from Cha
 7. Enter the Machine Bridge account name and password only after those values are recognized.
 8. Create a new chat and enable the app for that conversation.
 
-ChatGPT navigation labels can change. The invariant is that the client must connect to the public `/mcp` endpoint and complete the OAuth authorization page served by the Worker. The same public `/mcp` URL can be entered in Grok where remote MCP configuration is available. Machine Bridge grants CORS response access to the exact `https://grok.com` and `https://x.com` browser origins as well as ChatGPT's current and legacy origins without requiring a Wrangler command. OAuth navigation and form POST requests are not failed solely because an embedded authorization container reports an opaque or different origin. After validation, the consent page CSP includes only the exact registered callback origin so the browser can complete the `303` return to ChatGPT or Grok.
+ChatGPT navigation labels can change. The invariant is that the client must connect to the public `/mcp` endpoint and complete the OAuth authorization page served by the Worker. The same public `/mcp` URL can be entered in Grok where remote MCP configuration is available. Machine Bridge grants CORS response access to the exact `https://grok.com` and `https://x.com` browser origins as well as ChatGPT's current and legacy origins without requiring a Wrangler command. OAuth navigation and form POST requests are not failed solely because an embedded authorization container reports an opaque or different origin. After validation, the consent page CSP includes only the exact registered callback origin so the browser can complete the `303` return.
+
+### Claude custom connector
+
+For an individual Pro or Max account, Anthropic currently documents this flow:
+
+1. Open **Customize > Connectors**.
+2. Select **+ > Add custom connector**.
+3. Enter the exact printed `/mcp` URL.
+4. Leave optional static OAuth client credentials empty; Machine Bridge supports dynamic client registration.
+5. Add the connector, select **Connect**, and complete the Machine Bridge authorization page.
+6. Enable the connector for a conversation from the chat's connector menu.
+
+For Team and Enterprise organizations, an Owner first adds **Custom > Web** under **Organization settings > Connectors**, after which members connect individually. Hosted Claude surfaces register `https://claude.ai/api/mcp/auth_callback`, request `offline_access` when advertised, and refresh tokens before or after access-token expiry. Machine Bridge accepts that callback and rotates each public-client refresh token exactly once. See Anthropic's [custom connector guide](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) and [connector authentication requirements](https://claude.com/docs/connectors/building/authentication).
+
+### Microsoft Copilot Studio
+
+Microsoft currently recommends the MCP onboarding wizard:
+
+1. Open the agent's **Tools** page.
+2. Select **Add a tool > New tool > Model Context Protocol**.
+3. Enter a server name, description, and the exact printed `/mcp` URL.
+4. Select **OAuth 2.0**, then **Dynamic discovery**.
+5. Select **Create**, then **Next**.
+6. Create or select a connection and choose **Add to agent**.
+
+Copilot Studio supports Streamable transport rather than the obsolete SSE transport. Its dynamic-discovery path uses the Worker's protected-resource metadata, authorization-server metadata, DCR endpoint, authorization-code exchange, and refresh-token exchange. See Microsoft's [existing MCP server guide](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent). Power Platform data policies and tenant administration can still block a connection independently of Machine Bridge.
+
+Claude remote connectors originate from Anthropic's cloud, and Copilot Studio reaches the endpoint through Power Platform connectors. Those server-to-server paths do not require adding Claude or Microsoft browser domains to `MBM_ALLOWED_ORIGINS`; widening CORS would not solve tenant, firewall, or Power Platform policy failures.
 
 ## 8. Verify the first connection
 
@@ -368,7 +396,9 @@ A connected Worker with no authenticated daemon can authorize OAuth successfully
 
 ### MCP-host layer
 
-If `server_info` or `project_overview` never returns a structured Machine Bridge result, the host may not have delivered the call. Check the host's plugin/app enablement, tool permissions, approval UI, and connection status.
+If `server_info` or `project_overview` never returns a structured Machine Bridge result, the host may not have delivered the call. Check the host's plugin/app enablement, tool permissions, approval UI, connection status, tenant policy, and whether its configured server URL exactly ends in `/mcp`.
+
+An OAuth refresh response of `invalid_grant` is intentional after refresh-token rotation, account suspension, role change, password rotation, removal, or deployment-wide token-version rotation. Remove and reconnect the hosted connector rather than retrying the stale refresh token.
 
 ### Operating-system layer
 

package/docs/LOGGING.md

@@ -79,7 +79,7 @@ The implementation omits:
 - stdin, stdout, and stderr;
 - file, patch, image, and temporary-file content;
 - OAuth request bodies;
-- account passwords, account-administration secrets, daemon secrets, authorization codes, and access tokens;
+- account passwords, account-administration secrets, daemon secrets, authorization codes, access tokens, and refresh tokens;
 - registered resource values and source paths;
 - browser pairing tokens, page URLs/source, DOM metadata, form values, uploaded file bytes, and screenshots;
 - application names, Accessibility trees, selectors, and entered values;

package/docs/MULTI_ACCOUNT.md

@@ -2,7 +2,7 @@
 
 ## What isolation means
 
-Machine Bridge remote mode supports several named accounts on one workspace Worker. Each account has an independent password, role, active state, version, OAuth authorization codes, and access tokens. Account changes revoke only that account's outstanding credentials.
+Machine Bridge remote mode supports several named accounts on one workspace Worker. Each account has an independent password, role, active state, version, OAuth authorization codes, access tokens, and refresh tokens. Account changes revoke only that account's outstanding credentials.
 
 This is application-level authorization, not operating-system isolation. All accounts ultimately reach one local daemon running as one OS user. Roles limit which Machine Bridge tools can be listed and invoked; they do not create separate filesystems, browser profiles, process namespaces, keychains, network identities, or kernel security boundaries.
 
@@ -25,6 +25,8 @@ The effective tool set is the intersection of:
 
 The Worker filters `tools/list` and rejects unauthorized calls before relay. Every accepted relay call also carries `account_id`, `account_version`, and `role`; the local runtime validates the role again before dispatch. The shared policy contract remains the single source of capability semantics.
 
+Authenticated `server_info` deliberately reports both layers. `authorization.effective_policy` and `authorization.effective_tools` are authoritative for the current account. The nested `daemon.policy` and `daemon.tools` fields are only the local capability ceiling before account-role filtering; a `full` daemon does not make an `editor` account full. Remote `project_overview` uses the effective values at top-level `policy` and `tools` and preserves the daemon values as `daemonPolicy` and `daemonTools`.
+
 ## Account lifecycle
 
 List accounts:

package/docs/OPERATIONS.md

@@ -14,7 +14,8 @@ machine-mcp service status
 
 | Result | Interpretation |
 |---|---|
-| `server_info` reports full and all relay tools, but the current session UI exposes fewer tools | Host/connector post-relay filtering; Machine Bridge cannot enumerate or override that subset |
+| `authorization.effective_policy.profile` is `full` and the tool is in `authorization.effective_tools`, but the current session UI exposes fewer tools | Host/connector post-relay filtering; Machine Bridge cannot enumerate or override that subset |
+| `daemon.policy.profile` is `full` but `authorization.effective_policy.profile` is `review`, `edit`, or `agent` | Expected account-role narrowing; the daemon field is only a capability ceiling and must not be reported as the account permission |
 | `capability_routing.bootstrap_observed` is false | The current local runtime has not received `session_bootstrap`; reconnect or inspect host initialization handling |
 | `task_resolution_observed` is false after a substantive task | The host/model did not call `resolve_task_capabilities`; server-side discovery cannot force that host decision |
 | Task resolution ran but all match counts are zero | The resolver ran successfully but found no sufficiently relevant local skill, command, or application |
@@ -197,6 +198,12 @@ Uninstall refuses to remove local state while any managed job remains active. Ac
 
 See [MANAGED_JOBS.md](MANAGED_JOBS.md).
 
+## Hosted OAuth reconnection
+
+Hosted clients may refresh access without asking the user to authorize again. Machine Bridge returns a replacement refresh token on every successful public-client refresh and invalidates the presented token. `invalid_grant` therefore means the token was already rotated, expired, or revoked by an account change or deployment-wide token-version rotation. Remove and reconnect the hosted connector; repeatedly retrying the stale token cannot recover it.
+
+Claude and Copilot Studio call the public Worker from their cloud connectivity layers. Do not add broad Anthropic or Microsoft domains to `MBM_ALLOWED_ORIGINS` as a connectivity workaround; that variable controls browser response sharing, not server-to-server reachability, tenant policy, WAF rules, or Power Platform data policy.
+
 ## Reconnect and replacement
 
 The daemon sends heartbeats and reconnects with bounded exponential backoff and jitter. A new socket remains a candidate until it authenticates and sends a valid `hello`; only then does it replace the previous daemon.

package/docs/TESTING.md

@@ -53,7 +53,7 @@ The suite includes:
 - deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- live local Worker OAuth registration, consent, URL-constructed `303` callbacks including the ChatGPT redirect URI and encoded state, PKCE, token replay rejection, throttling, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure.
+- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, access/refresh rotation, stale refresh replay rejection, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
 - a real headless-Chrome OAuth navigation regression with a negative control showing that `form-action 'self'` blocks a cross-origin `303`, followed by the production policy shape proving the exact callback origin receives `code` and `state`. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
 

package/docs/TOOL_REFERENCE.md

@@ -66,7 +66,7 @@ Tool count: **51**.
 
 **Server information**
 
-Return bridge/runtime metadata, active policy, protocol versions, and available tools.
+Return authenticated account authority, effective policy/tools, daemon capability ceiling, runtime metadata, and protocol status. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.
 
 | Contract field | Value |
 |---|---|
@@ -89,7 +89,7 @@ Return bridge/runtime metadata, active policy, protocol versions, and available
 
 **Project overview**
 
-Summarize the connected workspace, repository root, local policy, and top-level entries.
+Summarize the connected workspace and repository. Remote responses report the authenticated account effective policy/tools at policy and tools, with the daemon capability ceiling preserved separately as daemonPolicy and daemonTools.
 
 | Contract field | Value |
 |---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.7",
+  "version": "1.1.0",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/shared/server-metadata.json

@@ -12,10 +12,10 @@
     "For existing-browser work, use the paired Machine Bridge browser extension. It operates the user current Chromium profile and tabs, can inspect DOM/source, fill complex forms, and inject sensitive text from registered local resources without returning those values.",
     "For local application work, use structured application discovery and Accessibility actions. Arbitrary caller-supplied AppleScript or JavaScript is intentionally not accepted.",
     "Remote mode uses a Cloudflare relay; stdio mode runs on the local machine. File and command operations execute on the user's local runtime, not in the Worker.",
-    "Filesystem scope and path display follow the active local policy; the default full profile is unrestricted.",
+    "In remote multi-account mode, account authority is the intersection of the authenticated account role and the daemon capability ceiling. Only authorization.effective_policy and authorization.effective_tools describe that account authority; daemon.policy is not the account permission.",
     "Filename sensitivity is not classified by this server; the MCP host, connector gateway, local OS, or endpoint-security software may enforce additional independent rules.",
     "A named full profile is canonical: it always enables writes, shell execution, unrestricted paths, the full parent environment, absolute paths, and the complete tool catalog. Any explicit narrowing is stored as custom.",
-    "The full catalog is what the local daemon and relay advertise. A connector host or platform can expose only a subset to a particular session; Machine Bridge cannot observe, authorize, or override that host-side filtering.",
+    "The local daemon may advertise the full catalog as its capability ceiling. In remote mode, the Worker relays only the intersection allowed by the authenticated account role; a connector host may then expose an even smaller subset that Machine Bridge cannot observe or override.",
     "Use diagnose_runtime to distinguish a request that reached the daemon from local filesystem, process-spawn, shell, managed-job-storage, and resource failures. A tool call blocked before any response cannot be diagnosed by the server.",
     "Never request or return secret-file contents when a local resource alias can be used. Resources are registered through the local machine-mcp CLI; under canonical full policy, generate_ssh_key_resource can generate and register an Ed25519 key without returning private content and may be injected by path, stdin, or environment without entering MCP arguments.",
     "If execution-class tools are unavailable but write access remains, use stage_job to persist a reviewed plan without running it; the operator can launch it locally with machine-mcp job approve JOB_ID.",

package/src/shared/tool-catalog.json

@@ -2,7 +2,7 @@
   {
     "name": "server_info",
     "title": "Server information",
-    "description": "Return bridge/runtime metadata, active policy, protocol versions, and available tools.",
+    "description": "Return authenticated account authority, effective policy/tools, daemon capability ceiling, runtime metadata, and protocol status. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -18,7 +18,7 @@
   {
     "name": "project_overview",
     "title": "Project overview",
-    "description": "Summarize the connected workspace, repository root, local policy, and top-level entries.",
+    "description": "Summarize the connected workspace and repository. Remote responses report the authenticated account effective policy/tools at policy and tools, with the daemon capability ceiling preserved separately as daemonPolicy and daemonTools.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,

package/src/worker/authority.ts

@@ -0,0 +1,146 @@
+import policyContract from "../shared/policy-contract.json";
+import { accountRolePolicy, accountRoleToolNames, type AccountRole } from "./access";
+import type { DaemonPolicy } from "./policy";
+
+type EffectivePolicy = {
+  scope: "authenticated_account_effective_authority";
+  derived_from: ["account_role_policy", "daemon_capability_ceiling"];
+  profile: string;
+  revision: number;
+  allowWrite: boolean;
+  allowExec: boolean;
+  execMode: DaemonPolicy["execMode"];
+  unrestrictedPaths: boolean;
+  minimalEnv: boolean;
+  exposeAbsolutePaths: boolean;
+};
+
+type AccountIdentity = { accountId: string; accountVersion: number; role: AccountRole };
+
+type AccountAuthority = {
+  account: { account_id: string; role: AccountRole; version: number };
+  account_policy: DaemonPolicy & { scope: "account_role_capability_ceiling" };
+  daemon_policy_ceiling: DaemonPolicy | null;
+  effective_policy: EffectivePolicy | null;
+  effective_tools: string[];
+  effective_tool_count: number;
+  account_role_is_owner: boolean;
+  effective_profile_is_full: boolean;
+  interpretation: {
+    authoritative_permission_fields: ["effective_policy", "effective_tools"];
+    daemon_policy: string;
+    host_filtering: string;
+  };
+  summary: string;
+};
+
+export type DaemonCeilingStatus = Record<string, unknown> & {
+  policy: DaemonPolicy | null;
+  tools: string[];
+  policy_scope: "daemon_capability_ceiling_not_account_authority";
+  tools_scope: "daemon_advertised_before_account_role_filtering";
+};
+
+const profileFields = ["allowWrite", "execMode", "unrestrictedPaths", "minimalEnv", "exposeAbsolutePaths"] as const;
+const profiles = policyContract.profiles as Record<string, Pick<DaemonPolicy, typeof profileFields[number]> & { profile: string }>;
+const execRank: Record<DaemonPolicy["execMode"], number> = { off: 0, direct: 1, shell: 2 };
+
+export function describeDaemonCeiling(value: Record<string, unknown>): DaemonCeilingStatus {
+  return {
+    ...value,
+    policy: isDaemonPolicy(value.policy) ? value.policy : null,
+    tools: Array.isArray(value.tools) ? value.tools.filter((item): item is string => typeof item === "string") : [],
+    policy_scope: "daemon_capability_ceiling_not_account_authority",
+    tools_scope: "daemon_advertised_before_account_role_filtering",
+  };
+}
+
+export function accountAuthoritySnapshot(input: AccountIdentity & {
+  daemonPolicy: DaemonPolicy | null;
+  effectiveTools: string[];
+}): AccountAuthority {
+  const accountPolicy = accountRolePolicy(input.role);
+  const effectivePolicy = input.daemonPolicy ? intersectPolicies(accountPolicy, input.daemonPolicy) : null;
+  const effectiveTools = [...new Set(input.effectiveTools)];
+  const daemonProfile = input.daemonPolicy?.profile ?? "disconnected";
+  const effectiveProfile = effectivePolicy?.profile ?? "unavailable";
+  return {
+    account: { account_id: input.accountId, role: input.role, version: input.accountVersion },
+    account_policy: { ...accountPolicy, scope: "account_role_capability_ceiling" },
+    daemon_policy_ceiling: input.daemonPolicy,
+    effective_policy: effectivePolicy,
+    effective_tools: effectiveTools,
+    effective_tool_count: effectiveTools.length,
+    account_role_is_owner: input.role === "owner",
+    effective_profile_is_full: effectivePolicy?.profile === "full",
+    interpretation: {
+      authoritative_permission_fields: ["effective_policy", "effective_tools"],
+      daemon_policy: "daemon.policy is only the local daemon capability ceiling; it is not the authenticated account permission",
+      host_filtering: "the MCP host may expose a smaller subset than effective_tools, and Machine Bridge cannot observe that post-relay subset",
+    },
+    summary: input.daemonPolicy
+      ? `Authenticated account role ${input.role} has effective profile ${effectiveProfile}. daemon.policy.profile=${daemonProfile} is only the daemon capability ceiling, not this account's permission.`
+      : `Authenticated account role ${input.role} is configured for profile ${accountPolicy.profile}, but no daemon is connected; only Worker-local tools are currently available.`,
+  };
+}
+
+export function decorateProjectOverview(value: unknown, account: AccountIdentity): unknown {
+  if (!isRecord(value)) return value;
+  const daemonPolicy = isDaemonPolicy(value.policy) ? value.policy : null;
+  const daemonTools = Array.isArray(value.tools) ? value.tools.filter((item): item is string => typeof item === "string") : [];
+  const effectiveTools = ["server_info", ...accountRoleToolNames(account.role, daemonTools)];
+  const authority = accountAuthoritySnapshot({ ...account, daemonPolicy, effectiveTools });
+  return {
+    ...value,
+    daemonPolicy,
+    daemonTools,
+    policy: authority.effective_policy,
+    tools: authority.effective_tools,
+    policyScope: "authenticated_account_effective_authority",
+    toolsScope: "authenticated_account_effective_tools_before_host_filtering",
+    authorization: authority,
+  };
+}
+
+function intersectPolicies(accountPolicy: DaemonPolicy, daemonPolicy: DaemonPolicy): EffectivePolicy {
+  const execMode = execRank[accountPolicy.execMode] <= execRank[daemonPolicy.execMode] ? accountPolicy.execMode : daemonPolicy.execMode;
+  const capabilities = {
+    allowWrite: accountPolicy.allowWrite && daemonPolicy.allowWrite,
+    execMode,
+    unrestrictedPaths: accountPolicy.unrestrictedPaths && daemonPolicy.unrestrictedPaths,
+    minimalEnv: accountPolicy.minimalEnv || daemonPolicy.minimalEnv,
+    exposeAbsolutePaths: accountPolicy.exposeAbsolutePaths && daemonPolicy.exposeAbsolutePaths,
+  };
+  return {
+    scope: "authenticated_account_effective_authority",
+    derived_from: ["account_role_policy", "daemon_capability_ceiling"],
+    profile: matchingProfile(capabilities),
+    revision: Math.max(accountPolicy.revision, daemonPolicy.revision),
+    ...capabilities,
+    allowExec: execMode !== "off",
+  };
+}
+
+function matchingProfile(capabilities: Pick<EffectivePolicy, typeof profileFields[number]>): string {
+  for (const [name, profile] of Object.entries(profiles)) {
+    if (profileFields.every((field) => profile[field] === capabilities[field])) return name;
+  }
+  return "custom";
+}
+
+function isDaemonPolicy(value: unknown): value is DaemonPolicy {
+  if (!isRecord(value)) return false;
+  return typeof value.profile === "string"
+    && typeof value.origin === "string"
+    && Number.isInteger(value.revision)
+    && typeof value.allowWrite === "boolean"
+    && typeof value.allowExec === "boolean"
+    && (value.execMode === "off" || value.execMode === "direct" || value.execMode === "shell")
+    && typeof value.unrestrictedPaths === "boolean"
+    && typeof value.minimalEnv === "boolean"
+    && typeof value.exposeAbsolutePaths === "boolean";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/src/worker/index.ts

@@ -7,11 +7,13 @@ import { WorkerObservability } from "./observability";
 import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./errors";
 import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy";
 import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from "./access";
+import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority";
 import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin";
+import { exchangeOAuthToken } from "./oauth-tokens";
 import { serverInfoTool, workspaceTools } from "./tool-catalog";
 import {
-  AUTH_BLOCK_SECONDS, accountByName, authorizationIdentity, emptyOAuthStore, isCurrentOAuthStore,
-  pkceS256, pruneAuthFailures, pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken,
+  AUTH_BLOCK_SECONDS, OFFLINE_ACCESS_SCOPE, accountByName, authorizationIdentity, emptyOAuthStore,
+  isCurrentOAuthStore, pruneAuthFailures, pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken,
   recordAuthorizationFailure, safeEqual, sha256Hex, validateAuthorizationRequest, verifyAccountPassword,
   type OAuthClient, type OAuthStore, type ValidatedAuthorization,
 } from "./oauth-state";
@@ -22,13 +24,12 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.7";
+const SERVER_VERSION = "1.1.0";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
-const TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
 const MAX_PENDING_CALLS = 32;
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
@@ -37,10 +38,8 @@ const OAUTH_UNUSED_CLIENT_TTL_SECONDS = 60 * 60;
 const MAX_OAUTH_CLIENTS = 50;
 const MAX_OAUTH_CLIENTS_PER_IDENTITY = 5;
 const OAUTH_CLIENT_IDLE_TTL_SECONDS = 60 * 60 * 24 * 90;
-const MAX_TOKENS_PER_CLIENT = 20;
 const MAX_CODES_PER_CLIENT = 10;
 const MAX_OAUTH_CODES = 200;
-const MAX_OAUTH_TOKENS = 500;
 const MAX_AUTH_FAILURE_IDENTITIES = 200;
 const AUTHORIZATION_FIELDS = new Set(["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "resource", "state"]);
 
@@ -342,17 +341,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     return rpcError(request.id, -32601, `Method not found: ${request.method}`);
   }
-
   private async callTool(name: string, args: Record<string, unknown>, base: string, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
     if (name === "server_info") {
-      const daemon = this.daemonStatus(true);
-      const tools = this.allTools(authorized.role).map((tool) => tool.name);
+      const { daemon, tools, authorization } = this.authorityContext(authorized);
       return {
         name: SERVER_NAME,
         version: SERVER_VERSION,
         mcp_url: `${base}/mcp`,
         oauth: this.authorizationServerMetadata(base),
-        account: { account_id: authorized.accountId, role: authorized.role, version: authorized.accountVersion },
+        account: authorization.account,
+        authorization,
+        authority_summary: authorization.summary,
         daemon,
         worker: {
           pending_calls: this.pending.snapshot(),
@@ -360,10 +359,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           observability: this.observability.snapshot(),
         },
         tools,
+        tools_scope: "authenticated_account_effective_tools_before_host_filtering",
         tool_delivery: {
-          full_profile_scope: "local-daemon-and-relay-advertisement",
+          full_profile_scope: "daemon-capability-ceiling-before-account-filtering",
           daemon_advertised_tool_count: daemon.tool_count,
           relay_advertised_tool_count: tools.length,
+          effective_account_tool_count: tools.length,
+          relay_advertised_scope: "authenticated_account_effective_tools_before_host_filtering",
           host_exposed_tools_known_to_server: false,
           host_may_expose_subset: true,
         },
@@ -372,11 +374,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (workspaceTools.some((tool) => tool.name === name)) {
       if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
-      return this.callDaemonTool(name, args, authorized, requestKey);
+      const result = await this.callDaemonTool(name, args, authorized, requestKey);
+      return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
+        accountVersion: authorized.accountVersion, role: authorized.role }) : result;
     }
     throw new Error(`unknown tool: ${name}`);
   }
-
   private async callDaemonTool(name: string, args: Record<string, unknown>, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
     const socket = this.daemonSockets()[0];
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
@@ -419,7 +422,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       throw error;
     }
   }
-
   private cancelClientRequest(requestKey?: string): void {
     if (!requestKey) return;
     this.pending.cancelRequest(requestKey, (record) => {
@@ -456,11 +458,16 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const localTools = workspaceTools.filter((tool) => advertised.has(tool.name));
     return [serverInfoTool, ...localTools].map((tool) => structuredClone(tool));
   }
-
+  private authorityContext(authorized: AuthorizedToken) {
+    const daemon = describeDaemonCeiling(this.daemonStatus(true));
+    const tools = this.allTools(authorized.role).map((tool) => String(tool.name));
+    const authorization = accountAuthoritySnapshot({ accountId: authorized.accountId, accountVersion: authorized.accountVersion,
+      role: authorized.role, daemonPolicy: daemon.policy, effectiveTools: tools });
+    return { daemon, tools, authorization };
+  }
   private daemonToolEnabled(name: string): boolean {
     return this.daemonAdvertisedTools().has(name);
   }
-
   private daemonAdvertisedTools(): Set<string> {
     const socket = this.daemonSockets()[0];
     if (!socket) return new Set();
@@ -582,10 +589,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       token_endpoint: `${base}/oauth/token`,
       registration_endpoint: `${base}/oauth/register`,
       response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code"],
+      grant_types_supported: ["authorization_code", "refresh_token"],
       token_endpoint_auth_methods_supported: ["none"],
       code_challenge_methods_supported: ["S256"],
-      scopes_supported: [SERVER_NAME],
+      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
     };
   }
 
@@ -593,7 +600,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     return {
       resource: `${base}/mcp`,
       authorization_servers: [base],
-      scopes_supported: [SERVER_NAME],
+      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
       bearer_methods_supported: ["header"],
       resource_name: SERVER_NAME,
     };
@@ -637,7 +644,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         delete client.registration_identity;
         changed = true;
       }
-      const ttl = client.last_used_at === client.created_at ? OAUTH_UNUSED_CLIENT_TTL_SECONDS : OAUTH_CLIENT_IDLE_TTL_SECONDS;
+      const ttl = client.has_been_authorized === false ? OAUTH_UNUSED_CLIENT_TTL_SECONDS : OAUTH_CLIENT_IDLE_TTL_SECONDS;
       if (!activeClientIds.has(clientId) && client.last_used_at + ttl <= now) {
         delete store.clients[clientId];
         changed = true;
@@ -680,9 +687,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     return this.withOAuthLock(async () => {
       const store = await this.oauthStore();
       const registrationIdentity = await authorizationIdentity(request, this.identityKey());
-      const identityClientCount = Object.values(store.clients).filter((client) => client.registration_identity === registrationIdentity).length;
-      if (identityClientCount >= MAX_OAUTH_CLIENTS_PER_IDENTITY) {
-        return json({ error: "too_many_requests", error_description: "client registration limit reached for this source" }, 429);
+      const pendingIdentityClientCount = Object.values(store.clients).filter((client) => (
+        client.registration_identity === registrationIdentity && client.has_been_authorized === false
+      )).length;
+      if (pendingIdentityClientCount >= MAX_OAUTH_CLIENTS_PER_IDENTITY) {
+        return json({ error: "too_many_requests", error_description: "pending client registration limit reached for this source" }, 429);
       }
       if (Object.keys(store.clients).length >= MAX_OAUTH_CLIENTS) {
         return json({ error: "temporarily_unavailable", error_description: "client registry is full; remove stale state or retry after inactive clients expire" }, 503);
@@ -694,6 +703,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         redirect_uris: normalized,
         created_at: now,
         last_used_at: now,
+        has_been_authorized: false,
         registration_identity: registrationIdentity,
       };
       store.clients[client.client_id] = client;
@@ -702,7 +712,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         client_id: client.client_id,
         client_name: client.client_name,
         redirect_uris: client.redirect_uris,
-        grant_types: ["authorization_code"],
+        grant_types: ["authorization_code", "refresh_token"],
         response_types: ["code"],
         token_endpoint_auth_method: "none",
         client_id_issued_at: client.created_at,
@@ -798,6 +808,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       }
       delete store.auth_failures[identity];
       client.last_used_at = now;
+      client.has_been_authorized = true;
 
       const code = randomToken("mcp_code");
       const redirectLocation = authorizationRedirectLocation(redirectUri, code, state);
@@ -820,45 +831,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     });
   }
 
-  private async exchangeToken(request: Request, base: string): Promise<Response> {
-    const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
-    if (String(body.grant_type ?? "") !== "authorization_code") return json({ error: "unsupported_grant_type" }, 400);
-
-    const code = String(body.code ?? "");
-    const verifier = String(body.code_verifier ?? "");
-    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
-    return this.withOAuthLock(async () => {
-      const store = await this.oauthStore();
-      const record = store.codes[code];
-      if (!record) return json({ error: "invalid_grant" }, 400);
-      if (String(body.client_id ?? "") !== record.client_id || String(body.redirect_uri ?? "") !== record.redirect_uri) {
-        return json({ error: "invalid_grant", error_description: "client or redirect mismatch" }, 400);
-      }
-      if (String(body.resource ?? record.resource) !== record.resource) {
-        return json({ error: "invalid_target", error_description: "resource mismatch" }, 400);
-      }
-      if (!(await safeEqual(await pkceS256(verifier), record.code_challenge))) {
-        return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
-      }
-
-      const tokenVersion = this.env.OAUTH_TOKEN_VERSION ?? "";
-      if (!tokenVersion) return json({ error: "server_error", error_description: "OAuth token version is not configured" }, 503);
-      delete store.codes[code];
-      const accessToken = randomToken("mcp_at");
-      store.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
-        client_id: record.client_id,
-        account_id: record.account_id,
-        account_version: record.account_version,
-        role: record.role,
-        scope: record.scope,
-        resource: `${base}/mcp`,
-        version: tokenVersion,
-        expires_at: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS,
-      };
-      pruneClientRecordByExpiry(store.tokens, record.client_id, MAX_TOKENS_PER_CLIENT);
-      pruneRecordByExpiry(store.tokens, MAX_OAUTH_TOKENS);
-      await this.ctx.storage.put("oauth", store);
-      return json({ access_token: accessToken, token_type: "Bearer", expires_in: TOKEN_TTL_SECONDS, scope: record.scope });
+  private exchangeToken(request: Request, base: string): Promise<Response> {
+    return exchangeOAuthToken(request, base, {
+      storage: this.ctx.storage,
+      tokenVersion: this.env.OAUTH_TOKEN_VERSION ?? "",
+      serverName: SERVER_NAME,
+      loadOAuthStore: () => this.oauthStore(),
+      withLock: (callback) => this.withOAuthLock(callback),
     });
   }
 

package/src/worker/oauth-state.ts

@@ -1,6 +1,8 @@
 import { normalizeAccountRole, type AccountRole } from "./access";
 
 const OAUTH_STORE_SCHEMA_VERSION = 1;
+const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 1;
+export const OFFLINE_ACCESS_SCOPE = "offline_access";
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
 
 export interface AccountRecord {
@@ -22,6 +24,7 @@ export interface OAuthClient {
   redirect_uris: string[];
   created_at: number;
   last_used_at: number;
+  has_been_authorized?: boolean;
   registration_identity?: string;
 }
 
@@ -48,6 +51,13 @@ export interface OAuthToken {
   expires_at: number;
 }
 
+export type OAuthRefreshToken = OAuthToken;
+
+export interface OAuthRefreshStore {
+  schema_version: number;
+  tokens: Record<string, OAuthRefreshToken>;
+}
+
 export interface OAuthFailure {
   count: number;
   window_started: number;
@@ -89,6 +99,13 @@ export function emptyOAuthStore(): OAuthStore {
   };
 }
 
+export function emptyOAuthRefreshStore(): OAuthRefreshStore {
+  return {
+    schema_version: OAUTH_REFRESH_STORE_SCHEMA_VERSION,
+    tokens: {},
+  };
+}
+
 export function isCurrentOAuthStore(value: unknown): value is OAuthStore {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const store = value as Partial<OAuthStore>;
@@ -100,6 +117,24 @@ export function isCurrentOAuthStore(value: unknown): value is OAuthStore {
     && isRecord(store.auth_failures);
 }
 
+export function isCurrentOAuthRefreshStore(value: unknown): value is OAuthRefreshStore {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const store = value as Partial<OAuthRefreshStore>;
+  return store.schema_version === OAUTH_REFRESH_STORE_SCHEMA_VERSION && isRecord(store.tokens);
+}
+
+export function normalizeOAuthScope(value: unknown, serverName: string): string | null {
+  const raw = value === undefined ? serverName : String(value).trim();
+  if (!raw) return null;
+  const requested = raw.split(/\s+/);
+  const scopes = new Set(requested);
+  if (scopes.size !== requested.length || !scopes.has(serverName)) return null;
+  for (const scope of scopes) {
+    if (scope !== serverName && scope !== OFFLINE_ACCESS_SCOPE) return null;
+  }
+  return scopes.has(OFFLINE_ACCESS_SCOPE) ? `${serverName} ${OFFLINE_ACCESS_SCOPE}` : serverName;
+}
+
 export function validateAuthorizationRequest(
   body: Record<string, unknown>,
   base: string,
@@ -112,12 +147,12 @@ export function validateAuthorizationRequest(
   const codeChallenge = String(body.code_challenge ?? "");
   const codeChallengeMethod = String(body.code_challenge_method ?? "");
   const requestedResource = String(body.resource ?? `${base}/mcp`);
-  const scope = String(body.scope ?? serverName).trim();
+  const scope = normalizeOAuthScope(body.scope, serverName);
   const state = body.state === undefined ? "" : typeof body.state === "string" ? body.state : "";
 
   if (responseType !== "code") return { error: "response_type must be code.", status: 400 };
   if (requestedResource !== `${base}/mcp`) return { error: "resource mismatch.", status: 400 };
-  if (scope !== serverName) return { error: "unsupported scope.", status: 400 };
+  if (!scope) return { error: "unsupported scope.", status: 400 };
   if (body.state !== undefined && typeof body.state !== "string") return { error: "state must be a string.", status: 400 };
   if (state.length > 1024) return { error: "state is too long.", status: 400 };
   if (codeChallengeMethod !== "S256" || !/^[A-Za-z0-9_-]{43}$/.test(codeChallenge)) {

package/src/worker/oauth-tokens.ts

@@ -0,0 +1,208 @@
+import {
+  emptyOAuthRefreshStore, isCurrentOAuthRefreshStore, normalizeOAuthScope, pkceS256,
+  pruneClientRecordByExpiry, pruneRecordByExpiry, randomToken, safeEqual, sha256Hex,
+  type OAuthCode, type OAuthRefreshStore, type OAuthRefreshToken, type OAuthStore,
+} from "./oauth-state";
+import { HttpError, json, parseRequestBody } from "./http";
+
+const ACCESS_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
+const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 90;
+const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
+const MAX_ACCESS_TOKENS = 500;
+const MAX_ACCESS_TOKENS_PER_CLIENT = 20;
+const MAX_REFRESH_TOKENS = 500;
+const MAX_REFRESH_TOKENS_PER_CLIENT = 20;
+const OAUTH_REFRESH_STORE_KEY = "oauth-refresh";
+
+type OAuthLock = <T>(callback: () => Promise<T>) => Promise<T>;
+
+interface OAuthTokenExchangeOptions {
+  storage: DurableObjectStorage;
+  tokenVersion: string;
+  serverName: string;
+  loadOAuthStore: () => Promise<OAuthStore>;
+  withLock: OAuthLock;
+}
+
+interface IssuedTokenPair {
+  accessToken: string;
+  refreshToken: string;
+}
+
+export async function exchangeOAuthToken(
+  request: Request,
+  base: string,
+  options: OAuthTokenExchangeOptions,
+): Promise<Response> {
+  const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
+  const grantType = String(body.grant_type ?? "");
+  if (grantType === "authorization_code") return exchangeAuthorizationCode(body, base, options);
+  if (grantType === "refresh_token") return exchangeRefreshToken(body, base, options);
+  return json({ error: "unsupported_grant_type" }, 400);
+}
+
+async function exchangeAuthorizationCode(
+  body: Record<string, unknown>,
+  base: string,
+  options: OAuthTokenExchangeOptions,
+): Promise<Response> {
+  const code = String(body.code ?? "");
+  const verifier = String(body.code_verifier ?? "");
+  if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) {
+    return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
+  }
+  return options.withLock(async () => {
+    const oauthStore = await options.loadOAuthStore();
+    const refreshStore = await loadRefreshStore(oauthStore, options);
+    const record = oauthStore.codes[code];
+    if (!record) return json({ error: "invalid_grant" }, 400);
+    if (String(body.client_id ?? "") !== record.client_id || String(body.redirect_uri ?? "") !== record.redirect_uri) {
+      return json({ error: "invalid_grant", error_description: "client or redirect mismatch" }, 400);
+    }
+    if (String(body.resource ?? record.resource) !== record.resource || record.resource !== `${base}/mcp`) {
+      return json({ error: "invalid_target", error_description: "resource mismatch" }, 400);
+    }
+    if (!(await safeEqual(await pkceS256(verifier), record.code_challenge))) {
+      return json({ error: "invalid_grant", error_description: "invalid code_verifier" }, 400);
+    }
+    const client = oauthStore.clients[record.client_id];
+    if (!client) return json({ error: "invalid_grant", error_description: "unknown client" }, 400);
+
+    const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+    delete oauthStore.codes[code];
+    client.last_used_at = Math.floor(Date.now() / 1000);
+    await saveOAuthStores(oauthStore, refreshStore, options.storage);
+    return tokenResponse(issued, record.scope);
+  });
+}
+
+async function exchangeRefreshToken(
+  body: Record<string, unknown>,
+  base: string,
+  options: OAuthTokenExchangeOptions,
+): Promise<Response> {
+  const refreshToken = String(body.refresh_token ?? "");
+  if (!/^mcp_rt_[A-Za-z0-9_-]{43}$/.test(refreshToken)) return json({ error: "invalid_grant" }, 400);
+  return options.withLock(async () => {
+    const oauthStore = await options.loadOAuthStore();
+    const refreshStore = await loadRefreshStore(oauthStore, options);
+    const refreshKey = `sha256:${await sha256Hex(refreshToken)}`;
+    const record = refreshStore.tokens[refreshKey];
+    if (!record) return json({ error: "invalid_grant" }, 400);
+    if (String(body.client_id ?? "") !== record.client_id) {
+      return json({ error: "invalid_grant", error_description: "client mismatch" }, 400);
+    }
+    if (String(body.resource ?? record.resource) !== record.resource || record.resource !== `${base}/mcp`) {
+      return json({ error: "invalid_target", error_description: "resource mismatch" }, 400);
+    }
+    if (body.scope !== undefined && normalizeOAuthScope(body.scope, options.serverName) !== record.scope) {
+      return json({ error: "invalid_scope" }, 400);
+    }
+    if (!options.tokenVersion) {
+      throw new HttpError(503, "server_error", "OAuth token version is not configured");
+    }
+    const account = oauthStore.accounts[record.account_id];
+    const client = oauthStore.clients[record.client_id];
+    if (
+      !record.version
+      || !(await safeEqual(record.version, options.tokenVersion))
+      || !account
+      || !account.active
+      || account.version !== record.account_version
+      || account.role !== record.role
+      || !client
+    ) {
+      delete refreshStore.tokens[refreshKey];
+      await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
+      return json({ error: "invalid_grant" }, 400);
+    }
+
+    const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+    delete refreshStore.tokens[refreshKey];
+    client.last_used_at = Math.floor(Date.now() / 1000);
+    await saveOAuthStores(oauthStore, refreshStore, options.storage);
+    return tokenResponse(issued, record.scope);
+  });
+}
+
+async function loadRefreshStore(
+  oauthStore: OAuthStore,
+  options: OAuthTokenExchangeOptions,
+): Promise<OAuthRefreshStore> {
+  const raw = await options.storage.get<unknown>(OAUTH_REFRESH_STORE_KEY);
+  if (raw !== undefined && !isCurrentOAuthRefreshStore(raw)) {
+    throw new HttpError(503, "oauth_refresh_state_schema_mismatch", "OAuth refresh-token state requires operator repair");
+  }
+  const store = isCurrentOAuthRefreshStore(raw) ? raw : emptyOAuthRefreshStore();
+  let changed = false;
+  const now = Math.floor(Date.now() / 1000);
+  for (const [token, value] of Object.entries(store.tokens)) {
+    const account = oauthStore.accounts[value.account_id];
+    const client = oauthStore.clients[value.client_id];
+    if (
+      value.expires_at <= now
+      || !account
+      || !account.active
+      || account.version !== value.account_version
+      || account.role !== value.role
+      || !client
+    ) {
+      delete store.tokens[token];
+      changed = true;
+    }
+  }
+  if (changed) await options.storage.put(OAUTH_REFRESH_STORE_KEY, store);
+  return store;
+}
+
+async function issueTokenPair(
+  oauthStore: OAuthStore,
+  refreshStore: OAuthRefreshStore,
+  source: OAuthCode | OAuthRefreshToken,
+  tokenVersion: string,
+): Promise<IssuedTokenPair> {
+  if (!tokenVersion) throw new HttpError(503, "server_error", "OAuth token version is not configured");
+  const now = Math.floor(Date.now() / 1000);
+  const accessToken = randomToken("mcp_at");
+  const refreshToken = randomToken("mcp_rt");
+  const common = {
+    client_id: source.client_id,
+    account_id: source.account_id,
+    account_version: source.account_version,
+    role: source.role,
+    scope: source.scope,
+    resource: source.resource,
+    version: tokenVersion,
+  };
+  oauthStore.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
+    ...common,
+    expires_at: now + ACCESS_TOKEN_TTL_SECONDS,
+  };
+  refreshStore.tokens[`sha256:${await sha256Hex(refreshToken)}`] = {
+    ...common,
+    expires_at: now + REFRESH_TOKEN_TTL_SECONDS,
+  };
+  pruneClientRecordByExpiry(oauthStore.tokens, source.client_id, MAX_ACCESS_TOKENS_PER_CLIENT);
+  pruneRecordByExpiry(oauthStore.tokens, MAX_ACCESS_TOKENS);
+  pruneClientRecordByExpiry(refreshStore.tokens, source.client_id, MAX_REFRESH_TOKENS_PER_CLIENT);
+  pruneRecordByExpiry(refreshStore.tokens, MAX_REFRESH_TOKENS);
+  return { accessToken, refreshToken };
+}
+
+function tokenResponse(issued: IssuedTokenPair, scope: string): Response {
+  return json({
+    access_token: issued.accessToken,
+    refresh_token: issued.refreshToken,
+    token_type: "Bearer",
+    expires_in: ACCESS_TOKEN_TTL_SECONDS,
+    scope,
+  });
+}
+
+async function saveOAuthStores(
+  oauthStore: OAuthStore,
+  refreshStore: OAuthRefreshStore,
+  storage: DurableObjectStorage,
+): Promise<void> {
+  await storage.put({ oauth: oauthStore, [OAUTH_REFRESH_STORE_KEY]: refreshStore });
+}