machine-bridge-mcp 1.1.2 → 1.1.4

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.1.4 - 2026-07-15
+
+### File integrity and contract corrections
+
+- Preserve exact UTF-8 line endings in `read_file` whole-file and line-range results. CRLF files no longer return LF-normalized content paired with a SHA-256 value for different text.
+- Flush workspace write and patch staging files through their open descriptors before atomic commit, remove partial staging files after failed writes, and report incomplete staging cleanup instead of leaving hidden residual data silently. This aligns `write_file`, `edit_file`, and `apply_patch` with the documented durability contract while retaining exact POSIX mode application.
+- Surface incomplete `apply_patch` rollback as an explicit recovery error, and return a warning when a committed transaction cannot remove an internal staging or backup artifact instead of silently hiding residual workspace state.
+- Enforce the documented 3-64 character account-name rule for newly created accounts in both the local administration client and Worker. Existing one-character accounts created by older versions remain discoverable for login and administration.
+- Correct CLI `--json` guidance to state that a newly generated account password is intentionally included once during initial creation or rotation; stored administration, daemon, and token-version secrets remain omitted.
+
+## 1.1.3 - 2026-07-15
+
+### Copilot Studio final OAuth callback
+
+- Complete the Power Platform browser callback chain by allowing `https://copilotstudio.microsoft.com` only when the already validated OAuth redirect URI belongs to Microsoft's HTTPS `consent.azure-apim.net` domain. Copilot Studio redirects global consent to a regional consent endpoint and then to its own `/connection/oauth/redirect` page; Chromium applies the originating authorization page's `form-action` policy across every hop.
+- Preserve the narrow security boundary: ordinary OAuth clients still receive only `'self'` plus their exact validated redirect origin, Microsoft consent callbacks retain the consent-subdomain allowance, and lookalike domains receive neither the regional nor Copilot Studio exception.
+- Extend the real Chrome regression to prove four policy states: self-only blocks the first callback, global-only blocks the regional handoff, global-plus-regional blocks the final Studio handoff, and the complete policy preserves `code` and `state` through the entire chain.
+
 ## 1.1.2 - 2026-07-15
 
 ### Copilot Studio regional OAuth callback

package/README.md

@@ -150,7 +150,7 @@ The same `/mcp` endpoint supports the current hosted-client paths documented by
 
 These are protocol and integration-contract claims, not evidence that every external tenant, plan, administrator policy, or host-side tool filter has been tested. Claude remote connectors originate from Anthropic's cloud, and Copilot Studio reaches MCP servers through Power Platform connectivity; neither requires adding a browser origin to Machine Bridge's CORS list.
 
-The Worker grants browser CORS response access to the exact first-party origins used by ChatGPT (`https://chatgpt.com` and the legacy `https://chat.openai.com`) and Grok (`https://grok.com` and its X-hosted surface at `https://x.com`). Users do not need to run Wrangler or edit Cloudflare variables. `MBM_ALLOWED_ORIGINS` remains an operator-only, comma-separated extension point for other exact browser origins; it is additive and does not replace the built-in set. Wildcards and `null` do not receive CORS permission. Actual OAuth navigations and form submissions are not rejected solely because a browser container supplies an opaque or client-specific `Origin`; authorization still depends on exact redirect/resource binding, PKCE, account authentication, and bearer-token validation. The consent page CSP permits form navigation only to the Worker itself and the validated redirect origin for that request. When the validated callback belongs to Microsoft `consent.azure-apim.net`, it additionally permits HTTPS subdomains of that same Microsoft consent domain so Power Platform can hand the global callback to its regional endpoint without granting arbitrary form destinations.
+The Worker grants browser CORS response access to the exact first-party origins used by ChatGPT (`https://chatgpt.com` and the legacy `https://chat.openai.com`) and Grok (`https://grok.com` and its X-hosted surface at `https://x.com`). Users do not need to run Wrangler or edit Cloudflare variables. `MBM_ALLOWED_ORIGINS` remains an operator-only, comma-separated extension point for other exact browser origins; it is additive and does not replace the built-in set. Wildcards and `null` do not receive CORS permission. Actual OAuth navigations and form submissions are not rejected solely because a browser container supplies an opaque or client-specific `Origin`; authorization still depends on exact redirect/resource binding, PKCE, account authentication, and bearer-token validation. The consent page CSP permits form navigation only to the Worker itself and the validated redirect origin for that request. When the validated callback belongs to Microsoft `consent.azure-apim.net`, it additionally permits HTTPS subdomains of that same Microsoft consent domain and the exact `https://copilotstudio.microsoft.com` origin. This lets Power Platform hand the global callback to its regional endpoint and then return to Copilot Studio without granting arbitrary form destinations.
 
 ### Multiple clients and accounts
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.1.2"
+  "version_name": "1.1.4"
 }

package/docs/ARCHITECTURE.md

@@ -243,7 +243,7 @@ Removal first acquires a state-root maintenance lock that blocks new profile/sta
 
 OAuth metadata is pruned on access. Expired authorization codes, access tokens, refresh tokens, old throttling records, and inactive clients without active credentials are removed. Account disablement, role or password changes, removal, and deployment-wide token-version rotation make both token classes unusable; stale refresh records are deleted when the refresh store is next read. Source identities are deployment-keyed HMAC values, not stored source addresses or reversible unsalted hashes.
 
-Browser-origin handling separates CORS response sharing from protocol authentication. Preflight succeeds only for the Worker's own origin, a fixed first-party set for ChatGPT (`https://chatgpt.com`, `https://chat.openai.com`) and Grok (`https://grok.com`, `https://x.com`), or optional exact comma-separated additions from `MBM_ALLOWED_ORIGINS`; wildcard and `null` origins are not granted CORS access. Actual requests are routed without using `Origin` as an authentication boundary, and `Access-Control-Allow-Origin` is added only when that exact predicate passes. This permits OAuth top-level navigation and form submission from opaque or client-specific containers while exact redirect/resource binding, PKCE, account credentials, bearer tokens, and private admin/daemon secrets enforce authority. The authorization document's `form-action` policy is generated only after request validation and contains `'self'` plus the exact origin of that validated redirect URI. If that validated origin is Microsoft `consent.azure-apim.net`, the policy also admits `https://*.consent.azure-apim.net`; Power Platform first receives the authorization code at its global consent endpoint and then redirects to a regional endpoint, and Chromium applies `form-action` across that redirect chain. No other callback receives a wildcard source. This allows successful callback navigation without opening form submission to unrelated origins. Hosted Claude remote connectors originate from Anthropic infrastructure and Copilot Studio uses Power Platform connectivity, so their server-to-server requests do not require browser CORS entries; adding those brands to the browser allowlist would expand response sharing without enabling either integration.
+Browser-origin handling separates CORS response sharing from protocol authentication. Preflight succeeds only for the Worker's own origin, a fixed first-party set for ChatGPT (`https://chatgpt.com`, `https://chat.openai.com`) and Grok (`https://grok.com`, `https://x.com`), or optional exact comma-separated additions from `MBM_ALLOWED_ORIGINS`; wildcard and `null` origins are not granted CORS access. Actual requests are routed without using `Origin` as an authentication boundary, and `Access-Control-Allow-Origin` is added only when that exact predicate passes. This permits OAuth top-level navigation and form submission from opaque or client-specific containers while exact redirect/resource binding, PKCE, account credentials, bearer tokens, and private admin/daemon secrets enforce authority. The authorization document's `form-action` policy is generated only after request validation and contains `'self'` plus the exact origin of that validated redirect URI. If that validated origin is Microsoft `consent.azure-apim.net`, the policy also admits `https://*.consent.azure-apim.net` and the exact `https://copilotstudio.microsoft.com` origin; Power Platform receives the authorization code at its global consent endpoint, redirects to a regional endpoint, and then returns to Copilot Studio, while Chromium applies `form-action` across the complete redirect chain. No other callback receives either exception. This allows successful callback navigation without opening form submission to unrelated origins. Hosted Claude remote connectors originate from Anthropic infrastructure and Copilot Studio uses Power Platform connectivity, so their server-to-server requests do not require browser CORS entries; adding those brands to the browser allowlist would expand response sharing without enabling either integration.
 
 ## Observability
 

package/docs/AUDIT.md

@@ -16,7 +16,7 @@ The Claude and Microsoft Copilot Studio request was first tested against the exi
 
 The Worker now advertises the refresh grant and `offline_access`, stores only hashes of access and refresh tokens, and rotates every refresh token in one Durable Object write with the associated access-token update. Refresh records live under a separate versioned storage key, preserving the current primary OAuth-store schema and avoiding a destructive live migration. Refreshes remain bound to client, account, account version, role, normalized scope, resource, and deployment token version. Old-token replay and account-version changes return `invalid_grant`; account suspension, role/password changes, removal, and global token-version rotation cannot extend authority through refresh. Because both hosted clients may create a new DCR client for a fresh connection, the source throttle now counts only registrations that have not completed authorization; the global retained-client bound is unchanged.
 
-The workerd integration proves the hosted Claude callback, the unauthenticated `resource_metadata` challenge, discovery metadata, DCR grant advertisement, `offline_access`, form-encoded refresh, access/refresh replacement, replay rejection, continued MCP use with the refreshed access token, and targeted account refresh revocation. A live Copilot Studio connection exposed an additional browser boundary: Power Platform redirects the validated global `consent.azure-apim.net` callback to a regional subdomain, while Chromium enforces the originating authorization page's `form-action` policy across that redirect chain. The Worker therefore adds the Microsoft consent-subdomain source only when the already validated redirect URI is itself on that HTTPS domain; all other clients retain the exact-origin policy. Power Platform data policies, plan availability, tenant administration, and host-side tool filtering remain external controls.
+The workerd integration proves the hosted Claude callback, the unauthenticated `resource_metadata` challenge, discovery metadata, DCR grant advertisement, `offline_access`, form-encoded refresh, access/refresh replacement, replay rejection, continued MCP use with the refreshed access token, and targeted account refresh revocation. A live Copilot Studio connection exposed an additional browser boundary: Power Platform redirects the validated global `consent.azure-apim.net` callback to a regional subdomain, while Chromium enforces the originating authorization page's `form-action` policy across that redirect chain. The Worker therefore adds the Microsoft consent-subdomain source and the exact Copilot Studio origin only when the already validated redirect URI is itself on that HTTPS domain; all other clients retain the exact-origin policy. Power Platform data policies, plan availability, tenant administration, and host-side tool filtering remain external controls.
 
 This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, including the version 1.0.2 elapsed-time review and the version 1.0.3 code-scanning inventory correction. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
 

package/docs/CLIENTS.md

@@ -130,7 +130,7 @@ Supported configuration paths are:
 - **Claude custom connectors:** add the exact `/mcp` URL under Claude's connector settings and leave static OAuth client credentials empty so Claude can use DCR. Hosted Claude surfaces use `https://claude.ai/api/mcp/auth_callback`; the Worker accepts that exact registered redirect and rotates refresh tokens for the public client. See Anthropic's [remote custom connector guide](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) and [authentication contract](https://claude.com/docs/connectors/building/authentication).
 - **Microsoft Copilot Studio:** from the agent's **Tools** page, select **Add a tool > New tool > Model Context Protocol**, enter the `/mcp` URL, then select **OAuth 2.0 > Dynamic discovery**. Create the connection and add it to the agent. See Microsoft's [existing MCP server guide](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent).
 
-OAuth navigations and form submissions from opaque or client-specific browser containers are routed normally but receive no cross-origin response-sharing permission unless their exact origin is allowed. The authorization page permits form navigation only to itself and the validated redirect origin. For a validated Microsoft `consent.azure-apim.net` callback, the form policy also permits HTTPS subdomains of that same Microsoft consent domain because Power Platform redirects its global callback to a regional endpoint. Claude remote connectors originate from Anthropic infrastructure, while Copilot Studio connectivity runs through Power Platform connectors, so neither is a reason to broaden the browser CORS allowlist.
+OAuth navigations and form submissions from opaque or client-specific browser containers are routed normally but receive no cross-origin response-sharing permission unless their exact origin is allowed. The authorization page permits form navigation only to itself and the validated redirect origin. For a validated Microsoft `consent.azure-apim.net` callback, the form policy also permits HTTPS subdomains of that same Microsoft consent domain and the exact Copilot Studio origin because Power Platform redirects its global callback to a regional endpoint and then back to Copilot Studio. Claude remote connectors originate from Anthropic infrastructure, while Copilot Studio connectivity runs through Power Platform connectors, so neither is a reason to broaden the browser CORS allowlist.
 
 Several OAuth clients and named accounts can coexist. Accounts have independent passwords, roles, active state, versions, authorization codes, access tokens, refresh tokens, and targeted revocation. Their effective tool sets are intersected with the connected daemon policy. All accounts still share one daemon and OS user, so hard tenant isolation requires separate deployments; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
 

package/docs/GETTING_STARTED.md

@@ -233,7 +233,7 @@ Microsoft currently recommends the MCP onboarding wizard:
 5. Select **Create**, then **Next**.
 6. Create or select a connection and choose **Add to agent**.
 
-Copilot Studio supports Streamable transport rather than the obsolete SSE transport. Its dynamic-discovery path uses the Worker's protected-resource metadata, authorization-server metadata, DCR endpoint, authorization-code exchange, and refresh-token exchange. The authorization page also permits Power Platform's global `consent.azure-apim.net` callback to hand the browser to its regional consent endpoint. See Microsoft's [existing MCP server guide](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent). Power Platform data policies and tenant administration can still block a connection independently of Machine Bridge.
+Copilot Studio supports Streamable transport rather than the obsolete SSE transport. Its dynamic-discovery path uses the Worker's protected-resource metadata, authorization-server metadata, DCR endpoint, authorization-code exchange, and refresh-token exchange. The authorization page also permits Power Platform's global `consent.azure-apim.net` callback to hand the browser to its regional consent endpoint and then to Copilot Studio's `/connection/oauth/redirect` page. See Microsoft's [existing MCP server guide](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent). Power Platform data policies and tenant administration can still block a connection independently of Machine Bridge.
 
 Claude remote connectors originate from Anthropic's cloud, and Copilot Studio reaches the endpoint through Power Platform connectors. Those server-to-server paths do not require adding Claude or Microsoft browser domains to `MBM_ALLOWED_ORIGINS`; widening CORS would not solve tenant, firewall, or Power Platform policy failures.
 

package/docs/TESTING.md

@@ -55,9 +55,9 @@ The suite includes:
 - deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, access/refresh rotation, stale refresh replay rejection, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with a Microsoft consent-domain regional handoff exception, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
+- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, access/refresh rotation, stale refresh replay rejection, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
-- a real headless-Chrome OAuth navigation regression with three cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback still blocks a second cross-origin redirect, and allowing both callback origins completes the two-hop chain while preserving `code` and `state`. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
+- a real headless-Chrome OAuth navigation regression with four cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback blocks the regional redirect, allowing the registered and regional callbacks blocks the final Copilot Studio redirect, and the complete policy preserves `code` and `state` through all three cross-origin hops. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
 
 ## Opt-in live desktop and browser validation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/account-admin.mjs

@@ -94,7 +94,7 @@ function normalizeWorkerUrl(value) {
 
 function normalizeAccountName(value) {
   const name = String(value || "").trim().toLowerCase();
-  if (!/^[a-z0-9](?:[a-z0-9._-]{1,62}[a-z0-9])?$/.test(name)) throw new BridgeError("invalid_request", "account name must contain 3-64 lowercase letters, digits, dots, underscores, or hyphens");
+  if (!/^[a-z0-9][a-z0-9._-]{1,62}[a-z0-9]$/.test(name)) throw new BridgeError("invalid_request", "account name must contain 3-64 lowercase letters, digits, dots, underscores, or hyphens");
   return name;
 }
 

package/src/local/cli.mjs

@@ -843,7 +843,7 @@ Start options:
   --unrestricted-paths  Allow filesystem tools outside the workspace
   --absolute-paths      Return absolute local paths (enabled by the full profile)
   --state-dir DIR       Override state root
-  --json                Print machine-readable output; secrets are never included
+  --json                Print machine-readable output; newly generated account passwords are included once
   --log-level LEVEL     error, warn, info (default), or debug
   --log-format FORMAT   text (default) or newline-delimited json
   --verbose             Alias for --log-level debug; includes per-tool success/correlation logs

package/src/local/workspace-file-service.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { chmod, link, lstat, mkdir, open, opendir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { link, lstat, mkdir, open, opendir, rename, rm, stat } from "node:fs/promises";
 import path, { basename, dirname, join, resolve } from "node:path";
 import { applyUpdateHunks, parsePatchEnvelope } from "./patch.mjs";
 import { clampInteger } from "./numbers.mjs";
@@ -92,14 +92,18 @@ export class WorkspaceFileService {
     this.throwIfCancelled(context);
     const maxBytes = clampInteger(args.max_bytes, 1024 * 1024, 1, MAX_WRITE_BYTES);
     const startLine = args.start_line === undefined ? 1 : clampInteger(args.start_line, 1, 1, Number.MAX_SAFE_INTEGER);
-    const rawLines = content.split(/\r?\n/);
-    const totalLines = content.endsWith("\n") ? Math.max(1, rawLines.length - 1) : rawLines.length;
+    const lineStarts = [0];
+    for (let index = 0; index < content.length; index += 1) {
+      if (content[index] === "\n" && index + 1 < content.length) lineStarts.push(index + 1);
+    }
+    const totalLines = lineStarts.length;
     const endLine = args.end_line === undefined ? totalLines : clampInteger(args.end_line, totalLines, 1, Number.MAX_SAFE_INTEGER);
     if (endLine < startLine) throw new Error("end_line must be greater than or equal to start_line");
     if (startLine > totalLines) throw new Error(`start_line exceeds total lines (${startLine} > ${totalLines})`);
     const selectedEnd = Math.min(endLine, totalLines);
-    let selected = rawLines.slice(startLine - 1, selectedEnd).join("\n");
-    if (selectedEnd < totalLines || content.endsWith("\n")) selected += "\n";
+    const selectedStartOffset = lineStarts[startLine - 1];
+    const selectedEndOffset = selectedEnd < totalLines ? lineStarts[selectedEnd] : content.length;
+    const selected = content.slice(selectedStartOffset, selectedEndOffset);
     const selectedBytes = Buffer.byteLength(selected);
     if (selectedBytes > maxBytes) throw new Error(`selected content exceeds max_bytes (${selectedBytes} > ${maxBytes})`);
     return {
@@ -221,9 +225,10 @@ export class WorkspaceFileService {
       }
       assertNoResolvedPatchCollisions(prepared);
       this.throwIfCancelled(context);
-      await commitPatchTransaction(prepared);
+      const transaction = await commitPatchTransaction(prepared);
       return {
         ok: true,
+        ...(transaction.warnings.length ? { warnings: transaction.warnings } : {}),
         files: prepared.map((item) => ({
           operation: item.kind,
           path: this.displayPath(item.target || item.source),
@@ -331,11 +336,22 @@ async function readUtf8File(filePath) {
   return decodeUtf8(buffer);
 }
 
-async function applyExactMode(filePath, mode) {
+async function writeFlushedText(filePath, content, mode) {
+  const handle = await open(filePath, "wx", mode);
+  let failure = null;
   try {
-    await chmod(filePath, mode);
+    await handle.writeFile(content, { encoding: "utf8" });
+    try { await handle.chmod(mode); } catch (error) { if (process.platform !== "win32") throw error; }
+    await handle.sync();
   } catch (error) {
-    if (process.platform !== "win32") throw error;
+    failure = error;
+  }
+  try { await handle.close(); } catch (error) { failure ||= error; }
+  if (failure) {
+    try { await rm(filePath, { force: true }); } catch {
+      throw new Error("staged file write failed and cleanup was incomplete; inspect the destination directory before retrying", { cause: failure });
+    }
+    throw failure;
   }
 }
 
@@ -343,8 +359,7 @@ async function atomicWriteText(full, content, existing = null, options = {}) {
   await mkdir(dirname(full), { recursive: true });
   const temp = join(dirname(full), `.${basename(full)}.mbm-${process.pid}-${randomBytes(6).toString("hex")}.tmp`);
   try {
-    await writeFile(temp, content, { encoding: "utf8", flag: "wx", mode: existing ? existing.mode & 0o777 : 0o600 });
-    if (existing) await applyExactMode(temp, existing.mode & 0o777);
+    await writeFlushedText(temp, content, existing ? existing.mode & 0o777 : 0o600);
     if (options.expectedHash) {
       const current = await readUtf8File(full).catch(() => null);
       if (current === null || sha256(current) !== options.expectedHash) throw new Error("file changed before atomic commit");
@@ -376,7 +391,9 @@ function assertNoResolvedPatchCollisions(operations) {
   }
 }
 
-async function commitPatchTransaction(operations) {
+export async function commitPatchTransaction(operations, options = {}) {
+  const move = options.rename || rename;
+  const remove = options.remove || rm;
   const staged = [];
   const committed = [];
   try {
@@ -384,8 +401,7 @@ async function commitPatchTransaction(operations) {
       if (operation.content === undefined) continue;
       await mkdir(dirname(operation.target), { recursive: true });
       const temp = join(dirname(operation.target), `.${basename(operation.target)}.mbm-patch-${process.pid}-${randomBytes(6).toString("hex")}.tmp`);
-      await writeFile(temp, operation.content, { encoding: "utf8", flag: "wx", mode: operation.mode });
-      await applyExactMode(temp, operation.mode);
+      await writeFlushedText(temp, operation.content, operation.mode);
       staged.push({ operation, temp });
     }
 
@@ -403,26 +419,50 @@ async function commitPatchTransaction(operations) {
       let backup = null;
       if (operation.source) {
         backup = join(dirname(operation.source), `.${basename(operation.source)}.mbm-backup-${process.pid}-${randomBytes(6).toString("hex")}`);
-        await rename(operation.source, backup);
+        await move(operation.source, backup);
       }
       const record = { operation, backup, targetCreated: false };
       committed.push(record);
       const stage = staged.find((item) => item.operation === operation);
       if (stage) {
-        await rename(stage.temp, operation.target);
+        await move(stage.temp, operation.target);
         record.targetCreated = true;
       }
     }
   } catch (error) {
-    for (const item of committed.reverse()) {
-      if (item.targetCreated) await rm(item.operation.target, { force: true }).catch(() => {});
-      if (item.backup) await rename(item.backup, item.operation.source).catch(() => {});
+    const recoveryFailures = [];
+    for (const item of [...committed].reverse()) {
+      if (item.targetCreated) {
+        try { await remove(item.operation.target, { force: true }); } catch (failure) { recoveryFailures.push(failure); }
+      }
+      if (item.backup) {
+        try { await move(item.backup, item.operation.source); } catch (failure) { recoveryFailures.push(failure); }
+      }
+    }
+    recoveryFailures.push(...await removePatchArtifacts(staged.map((item) => item.temp), remove));
+    if (recoveryFailures.length) {
+      throw new Error(`patch transaction failed and recovery was incomplete (${recoveryFailures.length} recovery operation(s) failed); inspect the workspace before retrying`, { cause: error });
     }
     throw error;
-  } finally {
-    for (const item of staged) await rm(item.temp, { force: true }).catch(() => {});
   }
-  for (const item of committed) if (item.backup) await rm(item.backup, { force: true }).catch(() => {});
+
+  const cleanupFailures = await removePatchArtifacts([
+    ...staged.map((item) => item.temp),
+    ...committed.map((item) => item.backup).filter(Boolean),
+  ], remove);
+  return {
+    warnings: cleanupFailures.length
+      ? [`Patch committed, but ${cleanupFailures.length} internal transaction artifact(s) could not be removed; inspect affected directories for .mbm-backup-* or .mbm-patch-* files.`]
+      : [],
+  };
+}
+
+async function removePatchArtifacts(paths, remove) {
+  const failures = [];
+  for (const path of paths) {
+    try { await remove(path, { force: true }); } catch (error) { failures.push(error); }
+  }
+  return failures;
 }
 
 function assertTextSize(content, label) {

package/src/worker/http.ts

@@ -87,8 +87,8 @@ function authorizationFormActionSources(value: string): string[] {
     const sources = [url.origin];
     const microsoftConsentHost = url.hostname === "consent.azure-apim.net" || url.hostname.endsWith(".consent.azure-apim.net");
     if (url.protocol === "https:" && !url.port && microsoftConsentHost) {
-      // Power Platform redirects its global consent callback to a regional subdomain, and CSP checks every hop.
-      sources.push("https://*.consent.azure-apim.net");
+      // Power Platform redirects global consent to a regional endpoint and then back to Copilot Studio; CSP checks every hop.
+      sources.push("https://*.consent.azure-apim.net", "https://copilotstudio.microsoft.com");
     }
     return sources;
   } catch {

package/src/worker/index.ts

@@ -24,7 +24,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.1.2";
+const SERVER_VERSION = "1.1.4";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";

package/src/worker/oauth-state.ts

@@ -4,6 +4,8 @@ const OAUTH_STORE_SCHEMA_VERSION = 1;
 const OAUTH_REFRESH_STORE_SCHEMA_VERSION = 1;
 export const OFFLINE_ACCESS_SCOPE = "offline_access";
 const PASSWORD_TOKEN_PATTERN = /^[a-z][a-z0-9_]{2,31}_[A-Za-z0-9_-]{43}$/;
+const ACCOUNT_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]{1,62}[a-z0-9]$/;
+const LEGACY_ACCOUNT_NAME_PATTERN = /^(?:[a-z0-9]|[a-z0-9][a-z0-9._-]{1,62}[a-z0-9])$/;
 
 export interface AccountRecord {
   account_id: string;
@@ -166,11 +168,12 @@ export function validateAuthorizationRequest(
 
 export function normalizeAccountName(value: unknown): string | null {
   const name = String(value ?? "").trim().toLowerCase();
-  return /^[a-z0-9](?:[a-z0-9._-]{1,62}[a-z0-9])?$/.test(name) ? name : null;
+  return ACCOUNT_NAME_PATTERN.test(name) ? name : null;
 }
 
 export function accountByName(store: OAuthStore, name: unknown): AccountRecord | null {
-  const normalized = normalizeAccountName(name);
+  const candidate = String(name ?? "").trim().toLowerCase();
+  const normalized = LEGACY_ACCOUNT_NAME_PATTERN.test(candidate) ? candidate : null;
   if (!normalized) return null;
   return Object.values(store.accounts).find((account) => account.name === normalized) ?? null;
 }