machine-bridge-mcp 1.2.10 → 2.0.0

package/src/local/process-sessions.mjs

@@ -7,6 +7,7 @@ import { terminateProcessTree, terminateProcessTreeWithEscalation } from "./proc
 import { createToolAuthorizer } from "./policy.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { clampInteger } from "./numbers.mjs";
+import { ProcessOutputStream } from "./process-output-stream.mjs";
 import {
   MAX_PROCESS_SESSIONS, MAX_PROCESS_SESSION_OUTPUT_BYTES, MAX_PROCESS_SESSION_STDIN_BYTES, PROCESS_SESSION_RETENTION_MS,
 } from "./execution-limits.mjs";
@@ -40,11 +41,37 @@ export class ProcessSessionManager {
     for (const session of this.sessions.values()) notifySessionWaiters(session);
   }
 
+  retainCompletedOutput({ command, cwd, stdout, stderr, exitCode, startedAt, closedAt = Date.now() }) {
+    this.prune();
+    this.evictExitedForCapacity();
+    if (this.sessions.size >= MAX_PROCESS_SESSIONS) return null;
+    const completedAt = Number.isFinite(Number(closedAt)) ? Number(closedAt) : Date.now();
+    const session = {
+      id: `proc_${randomBytes(24).toString("base64url")}`,
+      child: null,
+      argv0: basename(String(command || "process")),
+      cwd,
+      stdout,
+      stderr,
+      startedAt: Number.isFinite(Number(startedAt)) ? Number(startedAt) : completedAt,
+      lastActivity: completedAt,
+      closedAt: completedAt,
+      exitCode: Number.isInteger(exitCode) ? exitCode : null,
+      signal: null,
+      stdinClosed: true,
+      waiters: new Set(),
+      terminationTimer: null,
+    };
+    this.sessions.set(session.id, session);
+    return this.summary(session);
+  }
+
   async start(args, context = {}) {
     this.authorizeTool("start_process");
     const argv = validateArgv(args.argv);
     const cwd = await this.resolveCwd(args.cwd || ".");
     this.prune();
+    this.evictExitedForCapacity();
     if (this.sessions.size >= MAX_PROCESS_SESSIONS) throw new Error(`process session limit reached (${MAX_PROCESS_SESSIONS})`);
     this.throwIfCancelled(context);
 
@@ -59,8 +86,8 @@ export class ProcessSessionManager {
       child,
       argv0: basename(argv[0]),
       cwd,
-      stdout: createSessionStream(),
-      stderr: createSessionStream(),
+      stdout: new ProcessOutputStream(MAX_PROCESS_SESSION_OUTPUT_BYTES),
+      stderr: new ProcessOutputStream(MAX_PROCESS_SESSION_OUTPUT_BYTES),
       startedAt: Date.now(),
       lastActivity: Date.now(),
       closedAt: null,
@@ -74,12 +101,12 @@ export class ProcessSessionManager {
     this.trackChild(child, context.callId);
 
     child.stdout.on("data", (chunk) => {
-      appendSessionStream(session.stdout, chunk);
+      session.stdout.append(chunk);
       session.lastActivity = Date.now();
       notifySessionWaiters(session);
     });
     child.stderr.on("data", (chunk) => {
-      appendSessionStream(session.stderr, chunk);
+      session.stderr.append(chunk);
       session.lastActivity = Date.now();
       notifySessionWaiters(session);
     });
@@ -94,7 +121,7 @@ export class ProcessSessionManager {
     });
 
     child.on("error", (error) => {
-      appendSessionStream(session.stderr, Buffer.from(`${boundedErrorMessage(error)}\n`));
+      session.stderr.append(Buffer.from(`${boundedErrorMessage(error)}\n`));
       session.lastActivity = Date.now();
       notifySessionWaiters(session);
     });
@@ -132,8 +159,8 @@ export class ProcessSessionManager {
     session.lastActivity = Date.now();
     return {
       ...this.summary(session),
-      stdout: readSessionStream(session.stdout, stdoutOffset, maxBytes),
-      stderr: readSessionStream(session.stderr, stderrOffset, maxBytes),
+      stdout: session.stdout.read(stdoutOffset, maxBytes),
+      stderr: session.stderr.read(stderrOffset, maxBytes),
     };
   }
 
@@ -207,6 +234,9 @@ export class ProcessSessionManager {
     for (const [id, session] of this.sessions) {
       if (session.closedAt !== null && session.lastActivity < cutoff) this.sessions.delete(id);
     }
+  }
+
+  evictExitedForCapacity() {
     if (this.sessions.size < MAX_PROCESS_SESSIONS) return;
     const exited = [...this.sessions.values()]
       .filter((session) => session.closedAt !== null)
@@ -240,50 +270,6 @@ function waitForSpawn(child) {
   });
 }
 
-function createSessionStream() {
-  return { buffer: Buffer.alloc(0), baseOffset: 0, totalBytes: 0 };
-}
-
-function appendSessionStream(stream, chunk) {
-  const input = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ""));
-  stream.totalBytes += input.length;
-  let combined = stream.buffer.length ? Buffer.concat([stream.buffer, input]) : Buffer.from(input);
-  if (combined.length > MAX_PROCESS_SESSION_OUTPUT_BYTES) {
-    const dropped = combined.length - MAX_PROCESS_SESSION_OUTPUT_BYTES;
-    combined = combined.subarray(dropped);
-    stream.baseOffset += dropped;
-  }
-  stream.buffer = combined;
-}
-
-function readSessionStream(stream, requestedOffset, maxBytes) {
-  const clampedOffset = Math.min(requestedOffset, stream.totalBytes);
-  const effectiveOffset = Math.max(clampedOffset, stream.baseOffset);
-  const start = effectiveOffset - stream.baseOffset;
-  const slice = stream.buffer.subarray(start, Math.min(stream.buffer.length, start + maxBytes));
-  let data;
-  let dataBase64;
-  let encoding = "utf8";
-  try {
-    data = new TextDecoder("utf-8", { fatal: true }).decode(slice);
-  } catch {
-    data = new TextDecoder("utf-8").decode(slice);
-    dataBase64 = slice.toString("base64");
-    encoding = "base64";
-  }
-  return {
-    data,
-    ...(dataBase64 ? { data_base64: dataBase64 } : {}),
-    encoding,
-    requested_offset: requestedOffset,
-    start_offset: effectiveOffset,
-    next_offset: effectiveOffset + slice.length,
-    total_offset: stream.totalBytes,
-    truncated_before: requestedOffset < stream.baseOffset,
-    truncated_after: effectiveOffset + slice.length < stream.totalBytes,
-  };
-}
-
 function sessionHasOutputAfter(session, stdoutOffset, stderrOffset) {
   return session.stdout.totalBytes > stdoutOffset || session.stderr.totalBytes > stderrOffset;
 }

package/src/local/relay-connection.mjs

@@ -23,10 +23,9 @@ const DEFAULT_SCHEDULER = Object.freeze({
 export class RelayConnection {
   constructor(options = {}) {
     this.workerUrl = normalizeWorkerUrl(options.workerUrl);
-    if (typeof options.secret !== "string" || options.secret.length < 16) throw new Error("daemon secret is missing or too short");
-    this.secret = options.secret;
     this.logger = options.logger || console;
     this.helloMessage = typeof options.helloMessage === "function" ? options.helloMessage : () => ({ type: "hello" });
+    this.connectionHeaders = typeof options.connectionHeaders === "function" ? options.connectionHeaders : () => ({});
     this.expectedServer = String(options.expectedServer || "");
     this.expectedVersion = String(options.expectedVersion || "");
     this.onMessage = typeof options.onMessage === "function" ? options.onMessage : () => {};
@@ -164,6 +163,13 @@ export class RelayConnection {
       return false;
     }
     this.logger.debug?.("remote relay welcome received");
+    Promise.resolve(this.helloMessage(message)).then((hello) => {
+      if (this.socket !== socket || this.closed || this.authenticated) return;
+      if (!this.sendOnSocket(socket, hello)) this.failPermanently("relay_authentication_failed");
+    }).catch((error) => {
+      this.logger.debug?.("could not create daemon authentication proof", { error_class: classifyOperationalError(error) });
+      this.failPermanently("relay_authentication_failed");
+    });
     return true;
   }
 
@@ -273,9 +279,11 @@ export class RelayConnection {
     let socket;
     try {
       const proxy = this.proxyAgentForUrl(wsUrl);
+      const headers = this.connectionHeaders();
+      if (!headers || typeof headers !== "object" || Array.isArray(headers)) throw new Error("relay connection headers are invalid");
       this.networkRoute = proxy?.agent ? "proxy" : "direct";
       socket = new this.WebSocketClass(wsUrl, {
-        headers: { "X-Bridge-Token": this.secret },
+        headers,
         maxPayload: this.maxPayload,
         ...(proxy?.agent ? { agent: proxy.agent } : {}),
       });
@@ -308,8 +316,7 @@ export class RelayConnection {
         return;
       }
       this.lastInboundAt = this.now();
-      this.logger.debug?.("remote relay transport opened; awaiting authentication acknowledgement");
-      if (!this.sendOnSocket(socket, this.helloMessage())) return;
+      this.logger.debug?.("remote relay transport opened; awaiting device challenge");
       this.clearTimer("handshakeTimer", "clearTimeout");
       this.handshakeTimer = this.scheduler.setTimeout(() => {
         if (this.socket !== socket || this.closed || this.ready) return;

package/src/local/runtime-relay.mjs

@@ -1,5 +1,6 @@
 import { Buffer } from "node:buffer";
 import { RelayConnection } from "./relay-connection.mjs";
+import { createDaemonAuthentication, createDaemonPreflightHeaders } from "./device-identity.mjs";
 import { MCP_SUPPORTED_PROTOCOL_VERSIONS, SERVER_NAME } from "./tools.mjs";
 import { normalizeAccountRole } from "./account-access.mjs";
 import { clampInteger } from "./numbers.mjs";
@@ -7,21 +8,27 @@ import { isPlainRecord } from "./records.mjs";
 
 export const MAX_RELAY_MESSAGE_BYTES = 8 * 1024 * 1024;
 
-export function createRuntimeRelayConnection(runtime, { workerUrl, secret, expectedVersion, onFatal }) {
+export function createRuntimeRelayConnection(runtime, { workerUrl, deviceIdentity, expectedVersion, onFatal }) {
   if (!workerUrl) return null;
   return new RelayConnection({
     workerUrl,
-    secret,
     logger: runtime.logger,
     maxPayload: MAX_RELAY_MESSAGE_BYTES,
     expectedServer: SERVER_NAME,
     expectedVersion: String(expectedVersion || ""),
-    helloMessage: () => ({
+    connectionHeaders: () => createDaemonPreflightHeaders(
+      deviceIdentity,
+      workerUrl,
+      SERVER_NAME,
+      String(expectedVersion || ""),
+    ),
+    helloMessage: async (welcome) => ({
       type: "hello",
       instance_id: runtime.relayInstanceId,
       tools: runtime.tools(),
       policy: runtime.policy,
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
+      authentication: await createDaemonAuthentication(deviceIdentity, welcome, runtime.relayInstanceId),
     }),
     onMessage: (data, relayContext) => handleRelayData(runtime, data, relayContext),
     onDisconnect: () => runtime.handleRelayDisconnect(),
@@ -82,8 +89,9 @@ function normalizeRelayAuthorization(value) {
   if (!isPlainRecord(value)) return null;
   const accountId = typeof value.account_id === "string" && /^acct_[A-Za-z0-9_-]{20,96}$/.test(value.account_id) ? value.account_id : "";
   const accountVersion = Number(value.account_version);
+  const clientId = typeof value.client_id === "string" && /^mcp_client_[A-Za-z0-9_-]{43}$/.test(value.client_id) ? value.client_id : "";
   let role;
   try { role = normalizeAccountRole(value.role); } catch { return null; }
-  if (!accountId || !Number.isInteger(accountVersion) || accountVersion < 1) return null;
-  return Object.freeze({ account_id: accountId, account_version: accountVersion, role });
+  if (!accountId || !clientId || !Number.isInteger(accountVersion) || accountVersion < 1) return null;
+  return Object.freeze({ account_id: accountId, account_version: accountVersion, client_id: clientId, role });
 }

package/src/local/runtime.mjs

@@ -31,6 +31,7 @@ import { AccountAccessGate } from "./account-access.mjs";
 import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
 import { diagnoseRuntime as runRuntimeDiagnostics } from "./runtime-diagnostics.mjs";
 import { bindRuntimeToolHandlers, runtimeToolHandlerNames as registeredRuntimeToolHandlerNames } from "./runtime-tool-handlers.mjs";
+import { OperationAuthorizer } from "./operation-authorization.mjs";
 import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelayToolCall } from "./runtime-relay.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage, stateRootFromProfileStatePath } from "./runtime-paths.mjs";
@@ -46,9 +47,8 @@ export function runtimeToolHandlerNames() {
 }
 
 export class LocalRuntime {
-  constructor({ workerUrl = "", secret = "", expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {} }) {
+  constructor({ workerUrl = "", deviceIdentity = null, expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", approvalRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {} }) {
     const remoteWorkerUrl = workerUrl ? String(workerUrl) : "";
-    const remoteSecret = secret || "";
     this.workspaceInput = resolve(workspace || process.cwd());
     this.workspace = realpathSync.native ? realpathSync.native(this.workspaceInput) : realpathSync(this.workspaceInput);
     this.workspaceCanonicalPromise = null;
@@ -135,6 +135,7 @@ export class LocalRuntime {
       resolveLocalCommand: (args, context) => this.agentContextManager.resolveLocalCommand(args, context),
       displayPath: (value) => this.displayPath(value),
       throwIfCancelled: (context) => this.throwIfCancelled(context),
+      retainCompletedOutput: (value) => this.processSessionManager.retainCompletedOutput(value),
     });
     this.gitService = new GitService({
       resolveExistingPath: (value) => this.resolveExistingPath(value),
@@ -154,6 +155,12 @@ export class LocalRuntime {
       readResourceText,
       throwIfCancelled: (context) => this.throwIfCancelled(context),
     });
+    this.operationAuthorizer = new OperationAuthorizer({
+      workspace: this.workspace,
+      root: approvalRoot,
+      resolveExistingPath: (value) => this.resolveExistingPath(value),
+      resolveWritePath: (value) => this.resolveWritePath(value),
+    });
     this.browserBridgeManager = new BrowserBridgeManager({
       policy: this.policy,
       authorizeTool: (tool) => this.policyGate.assert(tool),
@@ -168,6 +175,7 @@ export class LocalRuntime {
       handlers: bindRuntimeToolHandlers(this),
       policyGate: this.policyGate,
       accountAccessGate: this.accountAccessGate,
+      operationAuthorizer: this.operationAuthorizer,
       callRegistry: this.callRegistry,
       observability: this.observability,
       logger: this.logger,
@@ -175,7 +183,7 @@ export class LocalRuntime {
       slowMs: SLOW_TOOL_CALL_MS,
     });
     this.relay = createRuntimeRelayConnection(this, {
-      workerUrl: remoteWorkerUrl, secret: remoteSecret, expectedVersion: expectedRelayVersion, onFatal,
+      workerUrl: remoteWorkerUrl, deviceIdentity, expectedVersion: expectedRelayVersion, onFatal,
     });
     this.relayCallRecovery = new RelayCallRecovery({
       logger: this.logger,
@@ -209,7 +217,7 @@ export class LocalRuntime {
   }
 
   async start() {
-    if (!this.relay) throw new Error("remote daemon start requires a Worker URL and daemon secret");
+    if (!this.relay) throw new Error("remote daemon start requires a Worker URL and device identity");
     if (!this.lifecycle.beginStart()) return;
     if (this.policy.profile === "full") {
       void this.browserBridgeManager.ensureStarted().catch((error) => {
@@ -600,8 +608,8 @@ export class LocalRuntime {
 
   async resolveWritePath(inputPath = ".") {
     const candidate = this.resolvePath(inputPath);
-    if (this.policy.unrestrictedPaths) return candidate;
     const candidateInfo = await lstat(candidate).catch(() => null);
+    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
     let ancestor = candidate;
     while (!(await lstat(ancestor).catch(() => null))) {
       const parent = dirname(ancestor);
@@ -609,8 +617,7 @@ export class LocalRuntime {
       ancestor = parent;
     }
     const [workspace, canonicalAncestor] = await Promise.all([this.canonicalWorkspace(), realpath(ancestor)]);
-    assertContainedPath(workspace, canonicalAncestor);
-    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
+    if (!this.policy.unrestrictedPaths) assertContainedPath(workspace, canonicalAncestor);
     const suffix = relative(ancestor, candidate);
     return suffix ? resolve(canonicalAncestor, suffix) : canonicalAncestor;
   }

package/src/local/secure-file.mjs

@@ -16,6 +16,11 @@ export function openRegularFileSync(file, flags, options = {}) {
   try {
     const info = fstatSync(fd);
     if (!info.isFile()) throw new Error(`${label} is not a regular file`);
+    if (options.verifyPathIdentity === true) {
+      const pathInfo = lstatSync(file);
+      if (pathInfo.isSymbolicLink() || !pathInfo.isFile()) throw new Error(`${label} must be a regular file and not a symbolic link`);
+      if (!sameFileIdentity(info, pathInfo)) throw new Error(`${label} identity changed while opening`);
+    }
     if (Number.isInteger(options.chmod)) setDescriptorMode(fd, options.chmod);
     return { fd, info };
   } catch (error) {
@@ -37,15 +42,19 @@ export function chmodRegularFileSync(file, mode, label = "path") {
   return withRegularFileSync(file, fsConstants.O_RDONLY, { label, chmod: mode }, () => undefined);
 }
 
-export function readBoundedRegularFileSync(file, maxBytes, label = "path") {
-  return readBoundedRegularFileWithInfoSync(file, maxBytes, label).buffer;
+export function readBoundedRegularFileSync(file, maxBytes, label = "path", options = {}) {
+  return readBoundedRegularFileWithInfoSync(file, maxBytes, label, options).buffer;
 }
 
-export function readBoundedRegularFileWithInfoSync(file, maxBytes, label = "path") {
+export function readBoundedRegularFileWithInfoSync(file, maxBytes, label = "path", options = {}) {
   const limit = Number(maxBytes);
   if (!Number.isSafeInteger(limit) || limit < 0) throw new Error("maximum file size must be a non-negative safe integer");
-  return withRegularFileSync(file, fsConstants.O_RDONLY, { label }, (fd, info) => {
+  return withRegularFileSync(file, fsConstants.O_RDONLY, {
+    label,
+    verifyPathIdentity: options.verifyPathIdentity === true,
+  }, (fd, info) => {
     if (info.size > limit) throw new Error(`file exceeds ${limit} bytes`);
+    options.afterOpen?.({ fd, info });
     const buffer = Buffer.alloc(info.size);
     let offset = 0;
     while (offset < buffer.length) {
@@ -104,3 +113,14 @@ function setDescriptorMode(fd, mode) {
     if (process.platform !== "win32") throw error;
   }
 }
+
+function sameFileIdentity(left, right) {
+  const leftDevice = Number(left.dev);
+  const rightDevice = Number(right.dev);
+  const leftInode = Number(left.ino);
+  const rightInode = Number(right.ino);
+  if ([leftDevice, rightDevice, leftInode, rightInode].every((value) => Number.isSafeInteger(value) && value >= 0)) {
+    return leftDevice === rightDevice && leftInode === rightInode;
+  }
+  return true;
+}

package/src/local/state.mjs

@@ -7,6 +7,7 @@ import serverMetadata from "../shared/server-metadata.json" with { type: "json"
 import { replaceFileSync } from "./atomic-fs.mjs";
 import { createExclusiveFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
+import { createDeviceIdentity, validateDeviceIdentity } from "./device-identity.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -591,9 +592,14 @@ function pruneBackups(filePath, keep) {
 
 export function ensureWorkerSecrets(state, options = {}) {
   state.worker ||= {};
+  const enrollingDeviceIdentity = !state.worker.deviceIdentity;
   if (!state.worker.accountAdminSecret || options.rotateSecrets) state.worker.accountAdminSecret = randomToken("account_admin");
-  if (!state.worker.daemonSecret || options.rotateSecrets) state.worker.daemonSecret = randomToken("daemon_secret");
-  if (!state.worker.oauthTokenVersion || options.rotateSecrets) state.worker.oauthTokenVersion = randomToken("token_version");
+  if (enrollingDeviceIdentity || options.rotateSecrets) state.worker.deviceIdentity = createDeviceIdentity();
+  else validateDeviceIdentity(state.worker.deviceIdentity);
+  delete state.worker.daemonSecret;
+  if (!state.worker.oauthTokenVersion || enrollingDeviceIdentity || options.rotateSecrets) {
+    state.worker.oauthTokenVersion = randomToken("token_version");
+  }
 
   const requestedName = options.workerName || "";
   if (!state.worker.name) {
@@ -635,7 +641,7 @@ export function ownerOnlyFile(filePath) {
 export function redactState(state) {
   const clone = redactHomeInValue(JSON.parse(JSON.stringify(state)));
   if (clone.worker?.accountAdminSecret) clone.worker.accountAdminSecret = "<redacted>";
-  if (clone.worker?.daemonSecret) clone.worker.daemonSecret = "<redacted>";
+  if (clone.worker?.deviceIdentity?.privateJwk?.d) clone.worker.deviceIdentity.privateJwk.d = "<redacted>";
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
   if (clone.resources && typeof clone.resources === "object") {
     for (const value of Object.values(clone.resources)) {

package/src/local/tool-executor.mjs

@@ -7,6 +7,7 @@ export class ToolExecutor {
     this.policyGate = options.policyGate;
     this.callRegistry = options.callRegistry;
     this.accountAccessGate = options.accountAccessGate;
+    this.operationAuthorizer = options.operationAuthorizer;
     this.observability = options.observability;
     this.logger = options.logger || console;
     this.safeMessage = typeof options.safeMessage === "function" ? options.safeMessage : (error) => String(error?.message || error || "operation failed");
@@ -14,7 +15,7 @@ export class ToolExecutor {
     this.pipeline = composeMiddleware([
       lifecycleMiddleware(this.callRegistry),
       observabilityMiddleware(this.observability, this.logger, this.safeMessage, this.slowMs),
-      authorizeMiddleware(this.policyGate, this.accountAccessGate),
+      authorizeMiddleware(this.policyGate, this.accountAccessGate, this.operationAuthorizer),
     ], invokeHandler(this.handlers));
   }
 
@@ -27,13 +28,14 @@ export function composeMiddleware(middleware, terminal) {
   return middleware.reduceRight((next, current) => (operation) => current(operation, next), terminal);
 }
 
-function authorizeMiddleware(policyGate, accountAccessGate) {
+function authorizeMiddleware(policyGate, accountAccessGate, operationAuthorizer) {
   return async (operation, next) => {
     policyGate.assert(operation.tool);
     if (operation.context.origin === "relay") {
       const role = operation.request.authorization?.role;
       if (!role) throw new Error("relay tool call is missing an account role");
       accountAccessGate.assert(role, operation.tool);
+      await operationAuthorizer?.authorize(operation);
     }
     return next(operation);
   };

package/src/local/tools.mjs

@@ -1,4 +1,5 @@
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
+import { projectMcpResult } from "../shared/result-projection.mjs";
 export {
   DEFAULT_POLICY_PROFILE,
   DEFAULT_POLICY_REVISION,
@@ -28,10 +29,9 @@ export const MCP_INSTRUCTIONS = Object.freeze(serverMetadata.instructions.map((v
 export function toolResult(value, isError = false) {
   const special = specialMcpResult(value);
   if (special) return { ...special, isError };
-  const structuredContent = toStructuredContent(value);
-  const text = typeof value === "string" ? value : JSON.stringify(value, null, 2);
-  const result = { content: [{ type: "text", text }], isError };
-  if (structuredContent) result.structuredContent = structuredContent;
+  const projection = projectMcpResult(value);
+  const result = { content: [{ type: "text", text: projection.text }], isError };
+  if (projection.structuredContent) result.structuredContent = projection.structuredContent;
   return result;
 }
 
@@ -55,8 +55,3 @@ function specialMcpResult(value) {
   }
   return result;
 }
-
-function toStructuredContent(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  return value;
-}

package/src/local/worker-deployment.mjs

@@ -4,6 +4,7 @@ import path, { resolve } from "node:path";
 import { runWrangler } from "./shell.mjs";
 import { packageRoot, saveState } from "./state.mjs";
 import { withWorkerSecretsFile } from "./worker-secret-file.mjs";
+import { publicDeviceJwkJson } from "./device-identity.mjs";
 import {
   normalizeWorkerOrigin,
   retryWorkerHealth,
@@ -81,11 +82,11 @@ export function workerDeploymentFingerprint(state, options = {}) {
   const root = resolve(options.packageRoot || packageRoot);
   const keyMaterial = [
     String(state.worker.accountAdminSecret || ""),
-    String(state.worker.daemonSecret || ""),
+    publicDeviceJwkJson(state.worker.deviceIdentity),
     String(state.worker.oauthTokenVersion || ""),
   ].join("\0");
   const fingerprint = createHmac("sha256", keyMaterial);
-  fingerprint.update("mbm-worker-deploy-v3");
+  fingerprint.update("mbm-worker-deploy-v4");
   fingerprint.update(String(state.worker.name || ""));
   for (const file of workerDeployHashFiles(root)) {
     fingerprint.update(path.relative(root, file));
@@ -118,7 +119,7 @@ export function workerUrlMatchesName(workerUrl, workerName) {
 }
 
 function hasCompleteWorkerState(worker = {}) {
-  return Boolean(worker.url && worker.mcpServerUrl && worker.accountAdminSecret && worker.daemonSecret && worker.oauthTokenVersion && worker.name);
+  return Boolean(worker.url && worker.mcpServerUrl && worker.accountAdminSecret && worker.deviceIdentity && worker.oauthTokenVersion && worker.name);
 }
 
 function workerDeployHashFiles(root) {

package/src/local/worker-secret-file.mjs

@@ -3,6 +3,7 @@ import { lstatSync, readdirSync, unlinkSync } from "node:fs";
 import { resolve } from "node:path";
 import { createExclusiveFileSync } from "./exclusive-file.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
+import { publicDeviceJwkJson } from "./device-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync } from "./secure-file.mjs";
 
 const SECRET_FILE_PATTERN = /^worker-secrets-(\d+)-(\d+)(?:-p(\d+))?(?:-([a-f0-9]+))?\.json$/;
@@ -17,7 +18,7 @@ export async function withWorkerSecretsFile(state, callback, options = {}) {
   const tempPath = resolve(dir, `worker-secrets-${process.pid}-${createdAt}-p${processStartedAt}-${random}.json`);
   const payload = {
     ACCOUNT_ADMIN_SECRET: state.worker.accountAdminSecret,
-    DAEMON_SHARED_SECRET: state.worker.daemonSecret,
+    DAEMON_DEVICE_PUBLIC_KEY: publicDeviceJwkJson(state.worker.deviceIdentity),
     OAUTH_TOKEN_VERSION: state.worker.oauthTokenVersion,
   };
 

package/src/shared/admin-auth.d.mts

@@ -0,0 +1,10 @@
+export const ADMIN_AUTH_SCHEME: "hmac-sha256-v1";
+export const ADMIN_AUTH_TTL_SECONDS: number;
+export function adminAuthTranscript(input: {
+  origin: unknown;
+  method: unknown;
+  pathname: unknown;
+  bodyHash: unknown;
+  issuedAt: unknown;
+  nonce: unknown;
+}): string;

package/src/shared/admin-auth.mjs

@@ -0,0 +1,36 @@
+export const ADMIN_AUTH_SCHEME = "hmac-sha256-v1";
+export const ADMIN_AUTH_TTL_SECONDS = 5 * 60;
+
+export function adminAuthTranscript(input = {}) {
+  const origin = requiredOrigin(input.origin);
+  const method = requiredToken(input.method, "method", /^[A-Z]{3,10}$/);
+  const pathname = requiredToken(input.pathname, "pathname", /^\/[A-Za-z0-9/_-]{1,255}$/);
+  const bodyHash = requiredToken(input.bodyHash, "body hash", /^[a-f0-9]{64}$/);
+  const issuedAt = requiredInteger(input.issuedAt, "issued at");
+  const nonce = requiredToken(input.nonce, "nonce", /^[A-Za-z0-9_-]{32,128}$/);
+  return [ADMIN_AUTH_SCHEME, origin, method, pathname, bodyHash, issuedAt, nonce].join("\0");
+}
+
+
+function requiredOrigin(value) {
+  let url;
+  try { url = new URL(String(value || "")); } catch { throw new Error("admin authentication origin is invalid"); }
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("admin authentication origin is invalid");
+  }
+  return url.origin;
+}
+
+function requiredToken(value, label, pattern) {
+  const text = String(value || "");
+  if (!pattern.test(text)) throw new Error(`admin authentication ${label} is invalid`);
+  return text;
+}
+
+function requiredInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error(`admin authentication ${label} is invalid`);
+  return String(number);
+}

package/src/shared/daemon-auth.d.mts

@@ -0,0 +1,20 @@
+export const DAEMON_AUTH_SCHEME: "device-signature-v1";
+export const DAEMON_PREFLIGHT_SCHEME: "device-preflight-v1";
+export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS: number;
+export const DAEMON_PREFLIGHT_TTL_SECONDS: number;
+export function daemonAuthTranscript(input: {
+  challenge: unknown;
+  workerOrigin: unknown;
+  server: unknown;
+  version: unknown;
+  instanceId: unknown;
+  issuedAt: unknown;
+}): string;
+
+export function daemonPreflightTranscript(input: {
+  workerOrigin: unknown;
+  server: unknown;
+  version: unknown;
+  nonce: unknown;
+  issuedAt: unknown;
+}): string;

package/src/shared/daemon-auth.mjs

@@ -0,0 +1,55 @@
+export const DAEMON_AUTH_SCHEME = "device-signature-v1";
+export const DAEMON_PREFLIGHT_SCHEME = "device-preflight-v1";
+export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS = 30;
+export const DAEMON_PREFLIGHT_TTL_SECONDS = 5 * 60;
+
+
+export function daemonPreflightTranscript(input = {}) {
+  const values = [
+    DAEMON_PREFLIGHT_SCHEME,
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.nonce, "preflight nonce", 24, 128),
+    requiredInteger(input.issuedAt, "preflight issued at"),
+  ];
+  return values.join("\0");
+}
+
+export function daemonAuthTranscript(input = {}) {
+  const values = [
+    DAEMON_AUTH_SCHEME,
+    requiredText(input.challenge, "challenge", 16, 256),
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.instanceId, "instance id", 16, 128),
+    requiredInteger(input.issuedAt, "issued at"),
+  ];
+  return values.join("\0");
+}
+
+function requiredText(value, label, minimum, maximum) {
+  const text = String(value || "");
+  if (text.length < minimum || text.length > maximum || /[\0\r\n]/.test(text)) {
+    throw new Error(`daemon authentication ${label} is invalid`);
+  }
+  return text;
+}
+
+function requiredOrigin(value) {
+  let url;
+  try { url = new URL(String(value || "")); } catch { throw new Error("daemon authentication Worker origin is invalid"); }
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("daemon authentication Worker origin is invalid");
+  }
+  return url.origin;
+}
+
+function requiredInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error(`daemon authentication ${label} is invalid`);
+  return String(number);
+}