machine-bridge-mcp 1.2.10 → 2.0.0

package/scripts/github-backlog.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+export function closingIssueNumbers(messages) {
+  const numbers = new Set();
+  const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?[ \t]+#(\d+)\b/gi;
+  for (const match of String(messages || "").matchAll(pattern)) numbers.add(Number(match[1]));
+  return numbers;
+}
+
+export function backlogBlockers({ issues = [], pullRequests = [], branch = "", commitMessages = "" }) {
+  const closing = closingIssueNumbers(commitMessages);
+  const issueBlockers = issues.filter((issue) => !closing.has(Number(issue.number)));
+  const pullRequestBlockers = pullRequests.filter((pull) => !(
+    String(pull.headRefName || "") === branch
+    && pull.headRepository
+    && pull.headRepository === pull.baseRepository
+  ));
+  return { issueBlockers, pullRequestBlockers, closing: [...closing].sort((left, right) => left - right) };
+}
+
+export function assertGitHubBacklogReady(options = {}) {
+  const run = options.run || runCommand;
+  const cwd = options.cwd || root;
+  const branch = options.branch || output(run, "git", ["branch", "--show-current"], cwd);
+  if (!branch) throw new Error("cannot inspect GitHub backlog from a detached HEAD");
+  const commitMessages = output(run, "git", ["log", "--format=%B%x00", "origin/main..HEAD"], cwd);
+  const issueRows = pagedJson(output(run, "gh", [
+    "api", "--paginate", "--slurp", "repos/{owner}/{repo}/issues?state=open&per_page=100",
+  ], cwd), "open GitHub issues");
+  const pullRows = pagedJson(output(run, "gh", [
+    "api", "--paginate", "--slurp", "repos/{owner}/{repo}/pulls?state=open&per_page=100",
+  ], cwd), "open GitHub pull requests");
+  const issues = issueRows
+    .filter((item) => !item.pull_request)
+    .map((item) => ({ number: item.number, title: item.title, url: item.html_url }));
+  const pullRequests = pullRows.map((item) => ({
+    number: item.number,
+    title: item.title,
+    headRefName: item.head?.ref,
+    headRepository: item.head?.repo?.full_name,
+    baseRepository: item.base?.repo?.full_name,
+    url: item.html_url,
+  }));
+  const blockers = backlogBlockers({ issues, pullRequests, branch, commitMessages });
+  if (!blockers.issueBlockers.length && !blockers.pullRequestBlockers.length) {
+    const covered = blockers.closing.length ? `; closing issue(s): ${blockers.closing.map((number) => `#${number}`).join(", ")}` : "";
+    return { branch, issues, pullRequests, ...blockers, message: `GitHub backlog gate passed${covered}.` };
+  }
+  throw new Error(formatBlockers(blockers, branch));
+}
+
+function formatBlockers(blockers, branch) {
+  const lines = ["GitHub backlog is not ready for another push."];
+  if (blockers.issueBlockers.length) {
+    lines.push("Open issues not closed by a commit in origin/main..HEAD:");
+    for (const issue of blockers.issueBlockers) lines.push(`- #${issue.number} ${boundedTitle(issue.title)}${issue.url ? ` (${issue.url})` : ""}`);
+  }
+  if (blockers.pullRequestBlockers.length) {
+    lines.push(`Open pull requests other than the current branch (${branch}):`);
+    for (const pull of blockers.pullRequestBlockers) lines.push(`- #${pull.number} ${boundedTitle(pull.title)} [${pull.headRefName || "unknown branch"}]${pull.url ? ` (${pull.url})` : ""}`);
+  }
+  lines.push("Resolve or close every blocker before pushing. The current branch may cover an issue with a standard closing keyword such as 'Closes #47'.");
+  return lines.join("\n");
+}
+
+function boundedTitle(value) {
+  return String(value || "untitled").replace(/[\r\n]+/g, " ").slice(0, 200);
+}
+
+function pagedJson(text, label) {
+  let pages;
+  try { pages = JSON.parse(text || "[]"); }
+  catch (error) { throw new Error(`${label} response was not valid JSON: ${error.message}`); }
+  if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) {
+    throw new Error(`${label} response was not a slurped page array`);
+  }
+  return pages.flat();
+}
+
+function output(run, command, args, cwd) {
+  const result = run(command, args, cwd);
+  return String(result.stdout || "").trim();
+}
+
+function runCommand(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    env: process.env,
+    stdio: "pipe",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || "").trim();
+    throw new Error(`${command} ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const result = assertGitHubBacklogReady();
+    console.log(result.message);
+  } catch (error) {
+    console.error(`GitHub backlog gate failed: ${error?.message || error}`);
+    process.exit(1);
+  }
+}

package/scripts/github-push.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
+import { assertGitHubBacklogReady } from "./github-backlog.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -13,6 +14,9 @@ try {
   const branch = output("git", ["branch", "--show-current"]);
   if (!branch) throw new Error("cannot push from a detached HEAD");
   if (branch === "main") throw new Error("direct pushes to main are prohibited; push a reviewed branch and merge through a pull request");
+  run("git", ["fetch", "origin", "main", "--prune"]);
+  const backlog = assertGitHubBacklogReady({ cwd: root, branch });
+  console.log(backlog.message);
 
   const acceptance = verifyCurrentReleaseAcceptance(root);
   if (acceptance.required) {

package/scripts/local-release-acceptance.mjs

@@ -53,9 +53,9 @@ function prepareCandidate() {
   writeFileSync(candidateManifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
   const phrase = confirmationPhrase(pkg.name, pkg.version);
   console.log(`Release candidate created: ${join(candidateDirectory, metadata.filename)}`);
-  console.log("The repository owner must start this exact candidate in a local terminal with:");
+  console.log("After the repository owner explicitly authorizes this exact candidate in the active conversation, the coding agent starts it through Machine Bridge with:");
   console.log("npm run release:candidate:start -- --allow-worker-deploy");
-  console.log("Leave the candidate running while the coding agent verifies connection readiness and representative functionality through Machine Bridge.");
+  console.log("The owner does not need to run a terminal authorization command. The coding agent keeps the candidate running while verifying connection readiness and representative functionality through Machine Bridge.");
   console.log("After that observed live verification succeeds, the coding agent records acceptance with:");
   console.log(`npm run release:accept -- --confirm \"${phrase}\"`);
   console.log("Automated tests alone do not authorize acceptance or the first GitHub push.");

package/scripts/release-acceptance.mjs

@@ -1,6 +1,5 @@
 import { createHash } from "node:crypto";
 import {
-  lstatSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -8,22 +7,27 @@ import {
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { readBoundedRegularFileSync } from "../src/local/secure-file.mjs";
 
 export const ACCEPTANCE_SCHEMA_VERSION = 1;
 export const ACCEPTANCE_POLICY_VERSION = "1.2.8";
 export const AGENT_VERIFIED_ACCEPTANCE_VERSION = "1.2.9";
-export const ACCEPTANCE_CONFIRMATION = "owner-started-agent-verified-local-candidate";
+export const AGENT_OPERATED_ACCEPTANCE_VERSION = "2.0.0";
+export const ACCEPTANCE_CONFIRMATION = "owner-authorized-agent-operated-local-candidate";
+export const OWNER_STARTED_ACCEPTANCE_CONFIRMATION = "owner-started-agent-verified-local-candidate";
 export const LEGACY_ACCEPTANCE_CONFIRMATION = "repository-owner-local-test";
 const MAX_ACCEPTANCE_BYTES = 64 * 1024;
+const MAX_RELEASE_TARBALL_BYTES = 64 * 1024 * 1024;
 
 export function requiresLocalAcceptance(version) {
   return compareVersions(parseVersion(version), parseVersion(ACCEPTANCE_POLICY_VERSION)) >= 0;
 }
 
 export function acceptanceConfirmationForVersion(version) {
-  return compareVersions(parseVersion(version), parseVersion(AGENT_VERIFIED_ACCEPTANCE_VERSION)) >= 0
-    ? ACCEPTANCE_CONFIRMATION
-    : LEGACY_ACCEPTANCE_CONFIRMATION;
+  const parsed = parseVersion(version);
+  if (compareVersions(parsed, parseVersion(AGENT_OPERATED_ACCEPTANCE_VERSION)) >= 0) return ACCEPTANCE_CONFIRMATION;
+  if (compareVersions(parsed, parseVersion(AGENT_VERIFIED_ACCEPTANCE_VERSION)) >= 0) return OWNER_STARTED_ACCEPTANCE_CONFIRMATION;
+  return LEGACY_ACCEPTANCE_CONFIRMATION;
 }
 
 export function acceptancePath(root, version) {
@@ -76,20 +80,25 @@ export function packProject(root, destination) {
 
 export function readAcceptance(root, version) {
   const path = acceptancePath(root, version);
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isFile()) {
-    throw new Error(`release acceptance record must be a regular file: ${path}`);
-  }
-  if (stat.size > MAX_ACCEPTANCE_BYTES) {
-    throw new Error(`release acceptance record exceeds ${MAX_ACCEPTANCE_BYTES} bytes`);
+  let bytes;
+  try {
+    bytes = readBoundedRegularFileSync(
+      path, MAX_ACCEPTANCE_BYTES, "release acceptance record",
+      { verifyPathIdentity: true },
+    );
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (message.includes("exceeds")) throw new Error(`release acceptance record exceeds ${MAX_ACCEPTANCE_BYTES} bytes`);
+    if (message.includes("regular file") || message.includes("symbolic link") || message.includes("identity changed")) {
+      throw new Error(`release acceptance record must be a regular file: ${path}`);
+    }
+    throw error;
   }
-  let value;
   try {
-    value = JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(bytes.toString("utf8"));
   } catch (error) {
     throw new Error(`release acceptance record is not valid JSON: ${error.message}`);
   }
-  return value;
 }
 
 export function verifyAcceptanceRecord(record, metadata) {
@@ -134,9 +143,19 @@ export function verifyCurrentReleaseAcceptance(root) {
 }
 
 export function verifyTarball(path, metadata) {
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("release candidate tarball is not a regular file");
-  const bytes = readFileSync(path);
+  let bytes;
+  try {
+    bytes = readBoundedRegularFileSync(
+      path, MAX_RELEASE_TARBALL_BYTES, "release candidate tarball",
+      { verifyPathIdentity: true },
+    );
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (message.includes("regular file") || message.includes("symbolic link") || message.includes("identity changed")) {
+      throw new Error("release candidate tarball is not a regular file");
+    }
+    throw error;
+  }
   const shasum = createHash("sha1").update(bytes).digest("hex");
   const integrity = `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
   if (shasum !== metadata.shasum || integrity !== metadata.integrity) {

package/scripts/run-checks.mjs

@@ -1,29 +1,19 @@
-import { spawnSync } from "node:child_process";
-import { performance } from "node:perf_hooks";
 import { checkTasks } from "./check-plan.mjs";
+import { runVerificationPlan } from "./check-runner.mjs";
 
 const mode = process.argv[2] || "full";
 const tasks = checkTasks(mode);
-const npmCli = process.env.npm_execpath;
-if (!npmCli) throw new Error("check runner must run through npm so npm_execpath is available");
-const planStartedAt = performance.now();
 
-console.log(`running ${mode} verification plan (${tasks.length} tasks)`);
-for (const [index, task] of tasks.entries()) {
-  const taskStartedAt = performance.now();
-  console.log(`\n[${index + 1}/${tasks.length}] npm run ${task}`);
-  const result = spawnSync(process.execPath, [npmCli, "run", task], {
-    cwd: process.cwd(),
-    env: process.env,
-    stdio: "inherit",
+try {
+  await runVerificationPlan({
+    mode,
+    tasks,
+    npmCli: process.env.npm_execpath,
+    verbose: process.env.MBM_CHECK_VERBOSE === "1",
   });
-  const elapsedSeconds = ((performance.now() - taskStartedAt) / 1000).toFixed(1);
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    console.error(`verification task failed after ${elapsedSeconds}s: ${task}`);
-    process.exit(result.status || 1);
+} catch (error) {
+  if (error?.message && !String(error.message).startsWith("verification task failed:")) {
+    console.error(error.message);
   }
-  console.log(`completed ${task} in ${elapsedSeconds}s`);
+  process.exit(Number(error?.exitCode) || 1);
 }
-const totalSeconds = ((performance.now() - planStartedAt) / 1000).toFixed(1);
-console.log(`\n${mode} verification plan passed in ${totalSeconds}s`);

package/src/local/account-admin.mjs

@@ -1,4 +1,5 @@
-import { randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { ADMIN_AUTH_SCHEME, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { ACCOUNT_ROLES, normalizeAccountRole } from "./account-access.mjs";
 import { BridgeError } from "./errors.mjs";
 
@@ -58,13 +59,21 @@ export class AccountAdminClient {
   }
 
   async request(method, pathname, body) {
+    const serializedBody = body === undefined ? "" : JSON.stringify(body);
+    const headers = accountAdminRequestHeaders({
+      secret: this.adminSecret,
+      origin: this.workerUrl,
+      method,
+      pathname,
+      body: serializedBody,
+    });
     const response = await this.fetchImpl(`${this.workerUrl}${pathname}`, {
       method,
       headers: {
-        authorization: `Bearer ${this.adminSecret}`,
+        ...headers,
         ...(body === undefined ? {} : { "content-type": "application/json" }),
       },
-      body: body === undefined ? undefined : JSON.stringify(body),
+      body: body === undefined ? undefined : serializedBody,
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       cache: "no-store",
     }).catch((error) => {
@@ -80,6 +89,22 @@ export class AccountAdminClient {
   }
 }
 
+
+export function accountAdminRequestHeaders({ secret, origin, method, pathname, body = "", now = Date.now(), nonce = randomBytes(24).toString("base64url") }) {
+  if (typeof secret !== "string" || secret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
+  const issuedAt = Math.floor(Number(now) / 1000);
+  const bodyHash = createHash("sha256").update(String(body)).digest("hex");
+  const transcript = adminAuthTranscript({ origin, method: String(method).toUpperCase(), pathname, bodyHash, issuedAt, nonce });
+  const signature = createHmac("sha256", secret).update(transcript).digest("base64url");
+  return {
+    "X-Bridge-Admin-Scheme": ADMIN_AUTH_SCHEME,
+    "X-Bridge-Admin-Time": String(issuedAt),
+    "X-Bridge-Admin-Nonce": nonce,
+    "X-Bridge-Admin-Body-SHA256": bodyHash,
+    "X-Bridge-Admin-Signature": signature,
+  };
+}
+
 export function accountRoleNames() {
   return Object.keys(ACCOUNT_ROLES);
 }

package/src/local/bounded-output.mjs

@@ -39,12 +39,29 @@ export class BoundedOutput {
   }
 
   get truncatedBytes() {
-    return Math.max(0, this.totalBytes - this.maximum);
+    if (this.full) return 0;
+    const head = decodeUtf8Boundary(this.head, "head");
+    const tail = decodeUtf8Boundary(this.tail, "tail");
+    return Math.max(0, this.totalBytes - head.bytes - tail.bytes);
   }
 
   text() {
     if (this.full) return this.full.toString("utf8");
-    const marker = `\n\n[truncated ${this.truncatedBytes} bytes; preserved beginning and end]\n\n`;
-    return `${this.head.toString("utf8")}${marker}${this.tail.toString("utf8")}`;
+    const head = decodeUtf8Boundary(this.head, "head");
+    const tail = decodeUtf8Boundary(this.tail, "tail");
+    const omitted = Math.max(0, this.totalBytes - head.bytes - tail.bytes);
+    const marker = `\n\n[truncated ${omitted} bytes; preserved beginning and end]\n\n`;
+    return `${head.text}${marker}${tail.text}`;
   }
 }
+
+function decodeUtf8Boundary(buffer, side) {
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  for (let trim = 0; trim <= Math.min(3, buffer.length); trim += 1) {
+    const slice = side === "head"
+      ? buffer.subarray(0, buffer.length - trim)
+      : buffer.subarray(trim);
+    try { return { text: decoder.decode(slice), bytes: slice.length }; } catch { /* try the next code-point boundary */ }
+  }
+  return { text: new TextDecoder("utf-8").decode(buffer), bytes: buffer.length };
+}

package/src/local/cli-approval.mjs

@@ -0,0 +1,117 @@
+import {
+  OPERATION_APPROVAL_SCOPES,
+  approvePendingOperation,
+  clearOperationLeases,
+  grantOperationLease,
+  listOperationApprovals,
+  revokeOperationLease,
+} from "./operation-authorization.mjs";
+import { loadState } from "./state.mjs";
+
+const ACTIONS = new Set(["list", "approve", "grant", "revoke", "clear"]);
+
+export function createApprovalCommand({ chooseWorkspace, confirm }) {
+  if (typeof chooseWorkspace !== "function" || typeof confirm !== "function") {
+    throw new TypeError("approval command requires chooseWorkspace and confirm dependencies");
+  }
+  return async function approvalCommand(args) {
+    const action = String(args._[0] || "list").toLowerCase();
+    if (!ACTIONS.has(action)) throw new Error(`Unknown approval action: ${action}`);
+    const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
+    const state = loadState(workspace, { stateDir: args.stateDir });
+    const root = state.paths.profileDir;
+    if (action === "list") return renderList(listOperationApprovals(root), args.json === true);
+    if (action === "approve") {
+      const id = requiredPositional(args, 1, "approval approve requires APPROVAL_ID");
+      return renderLease(await approvePendingOperation(
+        root,
+        id,
+        args.duration || (args.full ? "8h" : "1h"),
+        Date.now(),
+        args.full ? "full" : "",
+      ), args.json === true, "Approved");
+    }
+    if (action === "grant") {
+      const scope = requiredPositional(args, 1, "approval grant requires SCOPE");
+      if (!OPERATION_APPROVAL_SCOPES.includes(scope)) {
+        throw new Error(`approval scope must be one of: ${OPERATION_APPROVAL_SCOPES.join(", ")}`);
+      }
+      const clientId = String(args.client || "");
+      const accountId = String(args.account || "");
+      if (!clientId) throw new Error("approval grant requires --client CLIENT_ID; use * only for an intentional all-client lease");
+      if (!accountId) throw new Error("approval grant requires --account ACCOUNT_ID; use * only for an intentional all-account lease");
+      return renderLease(await grantOperationLease(root, {
+        accountId,
+        clientId,
+        scope,
+        duration: args.duration || "1h",
+      }), args.json === true, "Granted");
+    }
+    if (action === "revoke") {
+      const id = requiredPositional(args, 1, "approval revoke requires LEASE_ID");
+      const removed = await revokeOperationLease(root, id);
+      if (args.json) console.log(JSON.stringify({ lease_id: id, revoked: removed }, null, 2));
+      else console.log(removed ? `Revoked capability lease: ${id}` : `Capability lease was not active: ${id}`);
+      return;
+    }
+    const approved = await confirm("Revoke all active remote capability leases?", args.yes === true);
+    if (!approved) {
+      console.log("No capability leases were changed.");
+      return;
+    }
+    await clearOperationLeases(root);
+    if (args.json) console.log(JSON.stringify({ cleared: true }, null, 2));
+    else console.log("Revoked all active remote capability leases.");
+  };
+}
+
+function renderList(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (!result.pending.length && !result.leases.length) {
+    console.log("No pending approvals or active capability leases.");
+    return;
+  }
+  if (result.pending.length) {
+    console.log("Pending approvals:");
+    for (const item of result.pending) {
+      console.log(`  ${item.id}\t${scopeText(item.scopes)}\t${item.category}\tclient ${shortId(item.client_id)}\texpires ${formatTime(item.expires_at)}`);
+    }
+  }
+  if (result.leases.length) {
+    console.log("Active capability leases:");
+    for (const item of result.leases) {
+      console.log(`  ${item.id}\t${scopeText(item.scopes)}\tclient ${shortId(item.client_id)}\texpires ${formatTime(item.expires_at)}`);
+    }
+  }
+}
+
+function renderLease(lease, json, verb) {
+  if (json) {
+    console.log(JSON.stringify(lease, null, 2));
+    return;
+  }
+  console.log(`${verb} ${scopeText(lease.scopes)} capability lease for client ${shortId(lease.client_id)} until ${formatTime(lease.expires_at)}.`);
+  console.log(`Lease ID: ${lease.id}`);
+}
+
+function requiredPositional(args, index, message) {
+  const value = String(args._[index] || "");
+  if (!value) throw new Error(message);
+  return value;
+}
+
+function scopeText(scopes) {
+  return Array.isArray(scopes) ? scopes.join("+") : "<invalid-scope>";
+}
+
+function shortId(value) {
+  const text = String(value || "");
+  return text === "*" ? "*" : `${text.slice(0, 14)}...${text.slice(-6)}`;
+}
+
+function formatTime(epochSeconds) {
+  return new Date(Number(epochSeconds) * 1000).toISOString();
+}

package/src/local/cli-options.mjs

@@ -3,10 +3,10 @@ import { normalizeLogLevel } from "./log.mjs";
 const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
   "daemonOnly", "noAutostart", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
-  "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
+  "yes", "keepWorker", "allowInsecurePermissions", "showPaths", "full",
 ]);
 const VALUE_OPTIONS = new Set([
-  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "logLevel", "logFormat",
+  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "account", "duration", "logLevel", "logFormat",
 ]);
 
 const LOG_FORMATS = new Set(["text", "json"]);
@@ -28,6 +28,7 @@ const COMMAND_OPTIONS = new Map(Object.entries({
   autostart: new Set(["workspace", "stateDir", "quiet"]),
   resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
   account: new Set(["workspace", "stateDir", "json", "yes"]),
+  approval: new Set(["workspace", "stateDir", "json", "yes", "client", "account", "duration", "full"]),
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
@@ -41,6 +42,7 @@ const STATIC_POSITIONAL_RULES = new Map([
 const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
 const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
 const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const APPROVAL_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, approve: 2, grant: 2, revoke: 2, clear: 1 }));
 const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
@@ -59,6 +61,10 @@ const ACTION_POSITIONAL_RULES = new Map(Object.entries({
     const action = String(args._[0] || "list");
     return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
+  approval(args) {
+    const action = String(args._[0] || "list");
+    return { max: APPROVAL_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `approval ${action} received too many positional arguments` };
+  },
   browser(args) {
     const action = String(args._[0] || "status");
     return { max: 1, tooMany: `browser ${action} received too many positional arguments` };

package/src/local/cli.mjs

@@ -10,6 +10,7 @@ import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./to
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { createApprovalCommand } from "./cli-approval.mjs";
 import { createServiceCommand } from "./cli-service.mjs";
 import { generateAccountPassword } from "./account-admin.mjs";
 import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
@@ -49,6 +50,7 @@ import {
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
+const approvalCommand = createApprovalCommand({ chooseWorkspace, confirm });
 const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
 
 const COMMAND_HANDLERS = new Map([
@@ -64,6 +66,7 @@ const COMMAND_HANDLERS = new Map([
   ["rotate-secrets", rotateSecretsCommand],
   ["resource", localAdminCommands.resourceCommand],
   ["account", accountCommand],
+  ["approval", approvalCommand],
   ["browser", localAdminCommands.browserCommand],
   ["job", localAdminCommands.jobCommand],
   ["uninstall", uninstallCommand],
@@ -300,12 +303,13 @@ async function ensureInitialOwnerAccount(state) {
 function createRemoteRuntime({ args, workspace, state, daemonLock }) {
   return new LocalRuntime({
     workerUrl: state.worker.url,
-    secret: state.worker.daemonSecret,
+    deviceIdentity: state.worker.deviceIdentity,
     expectedRelayVersion: currentPackageVersion(),
     workspace,
     policy: state.policy,
     logger: createLogger({ level: args.json ? "error" : effectiveLogLevel(args), format: effectiveLogFormat(args), component: "daemon" }),
     jobRoot: join(state.paths.profileDir, "jobs"),
+    approvalRoot: state.paths.profileDir,
     resources: state.resources,
     resourceStatePath: state.paths.statePath,
     browserStateRoot: state.paths.stateRoot,
@@ -745,9 +749,16 @@ Commands:
   status            Print redacted local profile state and Worker health
   doctor            Check Node, Wrangler, Cloudflare login, Worker health
   full-test         Run real local full-profile capability tests in a temporary sandbox
-  rotate-secrets    Rotate account-admin, daemon, and global token-version secrets
+  rotate-secrets    Rotate account-admin, device identity, and global token-version secrets
   account list|add|role|enable|disable|rotate-password|remove
                     Manage isolated remote accounts and targeted revocation
+  approval list     Show pending high-impact operations and active capability leases
+  approval approve APPROVAL_ID [--duration 1h] [--full]
+                    Approve its scope, or open an explicit full window (maximum 8h)
+  approval grant SCOPE --account ACCOUNT_ID --client CLIENT_ID [--duration 1h]
+                    Pre-authorize a bounded scope; use * values only intentionally
+  approval revoke LEASE_ID | approval clear
+                    Revoke one or all local capability leases
   resource generate-ssh-key NAME [PATH]
                     Generate/reuse an Ed25519 key locally and register its private file by alias
   browser status    Show browser-extension bridge and connection status