machine-bridge-mcp 1.2.10 → 2.0.0

package/src/shared/result-projection.d.mts

@@ -0,0 +1,6 @@
+export const MCP_TEXT_PROJECTION_KEY: "$mcpText";
+export function mirroredResultText(value: unknown): string;
+export function projectMcpResult(value: unknown): {
+  text: string;
+  structuredContent: Record<string, unknown> | null;
+};

package/src/shared/result-projection.json

@@ -0,0 +1,4 @@
+{
+  "maxMirroredJsonBytes": 16384,
+  "maximumSummaryKeys": 8
+}

package/src/shared/result-projection.mjs

@@ -0,0 +1,50 @@
+// @ts-check
+
+import resultProjection from "./result-projection.json" with { type: "json" };
+
+export const MCP_TEXT_PROJECTION_KEY = "$mcpText";
+
+/**
+ * Keep MCP text content useful for human-only clients without duplicating a
+ * large object that is already present in structuredContent.
+ * @param {unknown} value
+ */
+export function mirroredResultText(value) {
+  if (typeof value === "string") return value;
+  const serialized = JSON.stringify(value, null, 2);
+  if (typeof serialized !== "string") return String(value ?? "");
+  const bytes = new TextEncoder().encode(serialized).byteLength;
+  if (bytes <= Number(resultProjection.maxMirroredJsonBytes)) return serialized;
+  const object = asObject(value);
+  const keys = Object.keys(object)
+    .slice(0, Number(resultProjection.maximumSummaryKeys))
+    .map((key) => key.replace(/[\r\n\t]+/g, " ").slice(0, 80));
+  const fields = keys.length ? ` Fields: ${keys.join(", ")}.` : "";
+  return `Structured result is ${bytes} bytes and is available in structuredContent.${fields}`;
+}
+
+/**
+ * Extract an optional domain-provided text projection while keeping the
+ * authoritative structured object single-copy and marker-free.
+ * @param {unknown} value
+ */
+export function projectMcpResult(value) {
+  const object = asObject(value);
+  if (Object.prototype.hasOwnProperty.call(object, MCP_TEXT_PROJECTION_KEY)
+      && typeof object[MCP_TEXT_PROJECTION_KEY] === "string") {
+    const structuredContent = { ...object };
+    const text = String(structuredContent[MCP_TEXT_PROJECTION_KEY]).slice(0, 4096);
+    delete structuredContent[MCP_TEXT_PROJECTION_KEY];
+    return { text, structuredContent };
+  }
+  return {
+    text: mirroredResultText(value),
+    structuredContent: value && typeof value === "object" && !Array.isArray(value) ? value : null,
+  };
+}
+
+/** @param {unknown} value */
+function asObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}

package/src/shared/server-metadata.json

@@ -24,6 +24,7 @@
     "Managed-job resource redaction is defense in depth, not a guarantee against transformed or partial secret output. Use capture_output=discard for steps that may echo credentials.",
     "Do not use shell encoding, renaming, or alternate tools to bypass host or platform safety policy.",
     "run_process avoids shell parsing but is not an OS sandbox. exec_command is exposed only in shell mode and has the local user's authority.",
+    "For commands that may produce substantial output, prefer start_process/read_process or use the output_session_id returned by a truncated run_process, run_local_command, or exec_command result. Read output in bounded pages instead of repeatedly requesting a larger one-shot response.",
     "Per-tool success, failure, cancellation, and timing events are debug-only; default logs contain lifecycle and infrastructure events, not a tool-call transcript.",
     "Inspect before editing, prefer read_file line ranges, edit_file, or apply_patch over whole-file replacement, and report commands that were run."
   ]

package/src/shared/tool-catalog.json

@@ -1230,7 +1230,7 @@
   {
     "name": "run_local_command",
     "title": "Run registered local command",
-    "description": "Run an effective manifest or automatic package-script command through its fixed argv, cwd, timeout ceiling, and extra-argument policy.",
+    "description": "Run an effective manifest or automatic package-script command through its fixed argv, cwd, timeout ceiling, and extra-argument policy. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
     "availability": "direct-exec",
     "annotations": {
       "readOnlyHint": false,
@@ -1665,7 +1665,7 @@
   {
     "name": "run_process",
     "title": "Run process directly",
-    "description": "Execute an argv array without a command shell. This avoids shell parsing but does not sandbox the executable or code it launches.",
+    "description": "Execute an argv array without a command shell. This avoids shell parsing but does not sandbox the executable or code it launches. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
     "availability": "direct-exec",
     "annotations": {
       "readOnlyHint": false,
@@ -1737,7 +1737,7 @@
   {
     "name": "read_process",
     "title": "Read process session",
-    "description": "Read bounded stdout and stderr deltas from a server-managed process session, optionally waiting briefly for new output.",
+    "description": "Read bounded stdout and stderr deltas from a running process session or a recently completed one-shot command continuation, optionally waiting briefly for new output.",
     "availability": "direct-exec",
     "annotations": {
       "readOnlyHint": true,
@@ -2382,7 +2382,7 @@
   {
     "name": "exec_command",
     "title": "Execute shell command",
-    "description": "Execute a shell command with workspace cwd. This is not a sandbox and has the operating-system authority of the local user.",
+    "description": "Execute a shell command with workspace cwd. This is not a sandbox and has the operating-system authority of the local user. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
     "availability": "shell-exec",
     "annotations": {
       "readOnlyHint": false,

package/src/worker/account-admin.ts

@@ -1,4 +1,6 @@
+import { ADMIN_AUTH_SCHEME, ADMIN_AUTH_TTL_SECONDS, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { json, methodNotAllowed, parseRequestBody } from "./http.ts";
+import { consumeBoundedNonce } from "./nonce-store.ts";
 import {
   accountByName, createAccount, publicAccount, replaceAccountPassword, revokeAccountCredentials,
   safeEqual, updateAccount, type AccountRecord, type OAuthStore,
@@ -7,10 +9,67 @@ import {
 const BODY_LIMIT_BYTES = 64 * 1024;
 const MAX_ACCOUNTS = 64;
 
-export async function accountAdminAuthorized(request: Request, expected: string): Promise<boolean> {
-  const header = request.headers.get("authorization") ?? "";
-  const supplied = /^Bearer\s+(.+)$/i.exec(header)?.[1] ?? "";
-  return Boolean(expected && await safeEqual(supplied, expected));
+export interface AccountAdminAuthorization {
+  nonce: string;
+  expiresAt: number;
+}
+
+export async function accountAdminAuthorized(
+  request: Request,
+  expected: string,
+  now = Math.floor(Date.now() / 1000),
+): Promise<AccountAdminAuthorization | null> {
+  if (!expected) return null;
+  const scheme = request.headers.get("X-Bridge-Admin-Scheme") || "";
+  const issuedAt = Number(request.headers.get("X-Bridge-Admin-Time"));
+  const nonce = request.headers.get("X-Bridge-Admin-Nonce") || "";
+  const bodyHash = request.headers.get("X-Bridge-Admin-Body-SHA256") || "";
+  const suppliedSignature = request.headers.get("X-Bridge-Admin-Signature") || "";
+  if (scheme !== ADMIN_AUTH_SCHEME) return null;
+  if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > ADMIN_AUTH_TTL_SECONDS) return null;
+  if (!/^[A-Za-z0-9_-]{32,128}$/.test(nonce) || !/^[a-f0-9]{64}$/.test(bodyHash) || !/^[A-Za-z0-9_-]{43}$/.test(suppliedSignature)) return null;
+  let transcript: string;
+  try {
+    transcript = adminAuthTranscript({
+      origin: new URL(request.url).origin,
+      method: request.method.toUpperCase(),
+      pathname: new URL(request.url).pathname,
+      bodyHash,
+      issuedAt,
+      nonce,
+    });
+  } catch {
+    return null;
+  }
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(expected),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const expectedSignature = base64Url(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(transcript))));
+  if (!(await safeEqual(suppliedSignature, expectedSignature))) return null;
+  const body = new Uint8Array(await request.clone().arrayBuffer());
+  if (body.byteLength > BODY_LIMIT_BYTES) return null;
+  const actualBodyHash = hex(new Uint8Array(await crypto.subtle.digest("SHA-256", body)));
+  if (!(await safeEqual(bodyHash, actualBodyHash))) return null;
+  return { nonce, expiresAt: Math.max(now, issuedAt) + ADMIN_AUTH_TTL_SECONDS };
+}
+
+export async function consumeAccountAdminNonce(
+  storage: DurableObjectStorage,
+  authorization: AccountAdminAuthorization,
+  now = Math.floor(Date.now() / 1000),
+): Promise<boolean> {
+  return consumeBoundedNonce(storage, {
+    key: "account-admin-nonces",
+    nonce: authorization.nonce,
+    expiresAt: authorization.expiresAt,
+    now,
+    noncePattern: /^[A-Za-z0-9_-]{32,128}$/,
+    maximum: 256,
+  });
 }
 
 export async function handleAccountAdminOperation(options: {
@@ -101,3 +160,13 @@ async function rotatePassword(request: Request, store: OAuthStore, save: () => P
 function activeOwnerCount(store: OAuthStore): number {
   return Object.values(store.accounts).filter((account) => account.active && account.role === "owner").length;
 }
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+function hex(bytes: Uint8Array): string {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/src/worker/daemon-auth.ts

@@ -0,0 +1,205 @@
+import { DAEMON_AUTH_CHALLENGE_TTL_SECONDS, DAEMON_AUTH_SCHEME, DAEMON_PREFLIGHT_SCHEME, DAEMON_PREFLIGHT_TTL_SECONDS, daemonAuthTranscript, daemonPreflightTranscript } from "../shared/daemon-auth.mjs";
+import { safeEqual } from "./oauth-state.ts";
+import { consumeBoundedNonce } from "./nonce-store.ts";
+
+export interface DaemonChallenge {
+  scheme: typeof DAEMON_AUTH_SCHEME;
+  challenge: string;
+  issuedAt: number;
+  expiresAt: number;
+  workerOrigin: string;
+}
+
+export function createDaemonChallenge(workerOrigin: string, now = Math.floor(Date.now() / 1000)): DaemonChallenge {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return {
+    scheme: DAEMON_AUTH_SCHEME,
+    challenge: `daemon_challenge_${base64Url(bytes)}`,
+    issuedAt: now,
+    expiresAt: now + DAEMON_AUTH_CHALLENGE_TTL_SECONDS,
+    workerOrigin: normalizeWorkerOrigin(workerOrigin),
+  };
+}
+
+
+export function sanitizeDaemonChallengeAttachment(value: Record<string, unknown>): Partial<{
+  authChallenge: string;
+  authIssuedAt: number;
+  authExpiresAt: number;
+  workerOrigin: string;
+}> {
+  const authChallenge = typeof value.authChallenge === "string" && /^daemon_challenge_[A-Za-z0-9_-]{40,96}$/.test(value.authChallenge)
+    ? value.authChallenge
+    : undefined;
+  const authIssuedAt = positiveSafeInteger(value.authIssuedAt);
+  const authExpiresAt = positiveSafeInteger(value.authExpiresAt);
+  let workerOrigin: string | undefined;
+  try { workerOrigin = normalizeWorkerOrigin(String(value.workerOrigin || "")); } catch {}
+  return { authChallenge, authIssuedAt, authExpiresAt, workerOrigin };
+}
+
+export interface DaemonPreflightAuthorization {
+  nonce: string;
+  expiresAt: number;
+}
+
+export async function verifyDaemonPreflight(input: {
+  publicKeyJson: string;
+  headers: Headers;
+  workerOrigin: string;
+  server: string;
+  version: string;
+  now?: number;
+}): Promise<DaemonPreflightAuthorization | null> {
+  const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  const scheme = input.headers.get("X-Bridge-Device-Scheme") || "";
+  const keyId = input.headers.get("X-Bridge-Device-Key") || "";
+  const nonce = input.headers.get("X-Bridge-Device-Nonce") || "";
+  const issuedAt = Number(input.headers.get("X-Bridge-Device-Time"));
+  const signature = decodeBase64Url(input.headers.get("X-Bridge-Device-Signature") || "", 64);
+  if (scheme !== DAEMON_PREFLIGHT_SCHEME || !signature) return null;
+  if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > DAEMON_PREFLIGHT_TTL_SECONDS) return null;
+  if (!/^[A-Za-z0-9_-]{24,128}$/.test(nonce)) return null;
+  let publicJwk: JsonWebKey;
+  try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return null; }
+  if (!(await safeEqual(keyId, await publicKeyId(publicJwk)))) return null;
+  let transcript: string;
+  try {
+    transcript = daemonPreflightTranscript({
+      workerOrigin: input.workerOrigin,
+      server: input.server,
+      version: input.version,
+      nonce,
+      issuedAt,
+    });
+  } catch {
+    return null;
+  }
+  try {
+    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    const valid = await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      signature,
+      new TextEncoder().encode(transcript),
+    );
+    return valid ? { nonce, expiresAt: issuedAt + DAEMON_PREFLIGHT_TTL_SECONDS } : null;
+  } catch {
+    return null;
+  }
+}
+
+
+export async function consumeDaemonPreflightNonce(
+  storage: DurableObjectStorage,
+  authorization: DaemonPreflightAuthorization,
+  now = Math.floor(Date.now() / 1000),
+): Promise<boolean> {
+  return consumeBoundedNonce(storage, {
+    key: "daemon-preflight-nonces",
+    nonce: authorization.nonce,
+    expiresAt: authorization.expiresAt,
+    now,
+    noncePattern: /^[A-Za-z0-9_-]{24,128}$/,
+    maximum: 128,
+  });
+}
+
+export async function verifyDaemonAuthentication(input: {
+  publicKeyJson: string;
+  authentication: unknown;
+  challenge: DaemonChallenge;
+  server: string;
+  version: string;
+  instanceId: string;
+  now?: number;
+}): Promise<boolean> {
+  const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  if (now < input.challenge.issuedAt - 5 || now > input.challenge.expiresAt) return false;
+  if (!input.authentication || typeof input.authentication !== "object" || Array.isArray(input.authentication)) return false;
+  const auth = input.authentication as Record<string, unknown>;
+  if (auth.scheme !== DAEMON_AUTH_SCHEME) return false;
+  if (!(await safeEqual(String(auth.challenge || ""), input.challenge.challenge))) return false;
+  if (Number(auth.issued_at) !== input.challenge.issuedAt) return false;
+  const signature = decodeBase64Url(String(auth.signature || ""), 64);
+  if (!signature) return false;
+  let publicJwk: JsonWebKey;
+  try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return false; }
+  const expectedKeyId = await publicKeyId(publicJwk);
+  if (!(await safeEqual(String(auth.key_id || ""), expectedKeyId))) return false;
+  let transcript: string;
+  try {
+    transcript = daemonAuthTranscript({
+      challenge: input.challenge.challenge,
+      workerOrigin: input.challenge.workerOrigin,
+      server: input.server,
+      version: input.version,
+      instanceId: input.instanceId,
+      issuedAt: input.challenge.issuedAt,
+    });
+  } catch {
+    return false;
+  }
+  try {
+    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    return crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      signature,
+      new TextEncoder().encode(transcript),
+    );
+  } catch {
+    return false;
+  }
+}
+
+function parsePublicJwk(value: string): JsonWebKey {
+  const parsed = JSON.parse(value) as JsonWebKey;
+  if (!parsed || parsed.kty !== "EC" || parsed.crv !== "P-256") throw new Error("invalid device public key");
+  if (typeof parsed.x !== "string" || typeof parsed.y !== "string" || parsed.d !== undefined) throw new Error("invalid device public key");
+  return { kty: "EC", crv: "P-256", x: parsed.x, y: parsed.y, ext: true, key_ops: ["verify"] };
+}
+
+async function publicKeyId(jwk: JsonWebKey): Promise<string> {
+  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+  return `device_${base64Url(new Uint8Array(digest)).slice(0, 32)}`;
+}
+
+function decodeBase64Url(value: string, expectedBytes: number): Uint8Array<ArrayBuffer> | null {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - (normalized.length % 4)) % 4);
+  try {
+    const binary = atob(normalized + padding);
+    if (binary.length !== expectedBytes) return null;
+    const bytes = new Uint8Array(expectedBytes);
+    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+
+function positiveSafeInteger(value: unknown): number | undefined {
+  const number = Number(value);
+  return Number.isSafeInteger(number) && number > 0 ? number : undefined;
+}
+
+function normalizeWorkerOrigin(value: string): string {
+  const url = new URL(value);
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("invalid Worker origin");
+  }
+  return url.origin;
+}

package/src/worker/daemon-sockets.ts

@@ -1,6 +1,7 @@
 import { isLiveDaemonAttachment, withDaemonLastSeenAt, type DaemonRole } from "./daemon-liveness.ts";
 import { sanitizeMetadataText } from "./http.ts";
 import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy.ts";
+import { sanitizeDaemonChallengeAttachment, type DaemonChallenge } from "./daemon-auth.ts";
 
 export interface DaemonAttachment {
   role: DaemonRole;
@@ -10,6 +11,10 @@ export interface DaemonAttachment {
   instanceId?: string;
   policy?: DaemonPolicy;
   tools?: string[];
+  authChallenge?: string;
+  authIssuedAt?: number;
+  authExpiresAt?: number;
+  workerOrigin?: string;
 }
 
 interface WebSocketContext {
@@ -33,6 +38,7 @@ export class DaemonSocketRegistry {
       instanceId: sanitizeDaemonInstanceId(candidate.instanceId),
       policy,
       tools: sanitizeDaemonTools(candidate.tools, policy),
+      ...sanitizeDaemonChallengeAttachment(candidate as Record<string, unknown>),
     };
   }
 
@@ -52,8 +58,15 @@ export class DaemonSocketRegistry {
     return this.context.getWebSockets().filter((socket) => this.attachment(socket)?.role !== "daemon" && socket.readyState === WebSocket.OPEN);
   }
 
-  beginCandidate(socket: WebSocket, connectedAt = new Date().toISOString()): void {
-    socket.serializeAttachment({ role: "candidate", connectedAt } satisfies DaemonAttachment);
+  beginCandidate(socket: WebSocket, challenge: DaemonChallenge, connectedAt = new Date().toISOString()): void {
+    socket.serializeAttachment({
+      role: "candidate",
+      connectedAt,
+      authChallenge: challenge.challenge,
+      authIssuedAt: challenge.issuedAt,
+      authExpiresAt: challenge.expiresAt,
+      workerOrigin: challenge.workerOrigin,
+    } satisfies DaemonAttachment);
   }
 
   beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; policy: DaemonPolicy; tools: string[] }): void {

package/src/worker/errors.ts

@@ -8,12 +8,14 @@ const WORKER_ERROR_CODES = new Set([
 export class WorkerToolError extends Error {
   readonly code: string;
   readonly retryable: boolean;
+  readonly details?: Record<string, unknown>;
 
-  constructor(code: string, message: string, retryable = false) {
+  constructor(code: string, message: string, retryable = false, details?: Record<string, unknown>) {
     super(message);
     this.name = "WorkerToolError";
     this.code = normalizeCode(code);
     this.retryable = retryable;
+    this.details = details;
   }
 }
 
@@ -23,11 +25,19 @@ export function daemonToolError(value: unknown): WorkerToolError {
   const message = typeof input.message === "string" && input.message
     ? input.message.slice(0, 2000)
     : "daemon tool failed";
-  return new WorkerToolError(code, message, input.retryable === true);
+  return new WorkerToolError(
+    code, message, input.retryable === true,
+    isRecord(input.details) ? input.details : undefined,
+  );
 }
 
-export function publicWorkerToolError(error: unknown): { code: string; message: string; retryable: boolean } {
-  if (error instanceof WorkerToolError) return { code: error.code, message: error.message, retryable: error.retryable };
+export function publicWorkerToolError(error: unknown): { code: string; message: string; retryable: boolean; details?: Record<string, unknown> } {
+  if (error instanceof WorkerToolError) {
+    return {
+      code: error.code, message: error.message, retryable: error.retryable,
+      ...(error.details ? { details: error.details } : {}),
+    };
+  }
   return { code: "execution_failed", message: "tool execution failed", retryable: false };
 }
 
@@ -36,6 +46,10 @@ function normalizeCode(value: unknown): string {
   return WORKER_ERROR_CODES.has(code) ? code : "execution_failed";
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 function asObject(value: unknown): Record<string, unknown> {
   return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
 }

package/src/worker/index.ts

@@ -11,6 +11,7 @@ import {
   isFreshDaemonCandidate,
 } from "./daemon-liveness.ts";
 import { DaemonSocketRegistry } from "./daemon-sockets.ts";
+import { consumeDaemonPreflightNonce, createDaemonChallenge, verifyDaemonAuthentication, verifyDaemonPreflight } from "./daemon-auth.ts";
 import { mcpClientRequestKey, resolveMcpSession } from "./mcp-session.ts";
 import { daemonToolTimeoutMs } from "./tool-timeout.ts";
 import { WorkerObservability } from "./observability.ts";
@@ -20,7 +21,7 @@ import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from ".
 import { OAuthController, type AuthorizedToken, type OAuthControllerEnv } from "./oauth-controller.ts";
 import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority.ts";
 import { serverInfoTool, workspaceTools } from "./tool-catalog.ts";
-import { OFFLINE_ACCESS_SCOPE, randomToken, safeEqual } from "./oauth-state.ts";
+import { OFFLINE_ACCESS_SCOPE, randomToken } from "./oauth-state.ts";
 import {
   HttpError, applyCors, baseUrl, bearerToken, corsPreflight, json, methodNotAllowed,
   parseJsonRequest, workerErrorClass,
@@ -34,7 +35,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.10";
+const SERVER_VERSION = "2.0.0";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -46,7 +47,7 @@ const DAEMON_RECONNECT_GRACE_MS = 30_000;
 interface BridgeEnv extends OAuthControllerEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
   ACCOUNT_ADMIN_SECRET: string;
-  DAEMON_SHARED_SECRET: string;
+  DAEMON_DEVICE_PUBLIC_KEY: string;
   OAUTH_TOKEN_VERSION: string;
   MBM_WORKER_MAX_BODY_BYTES?: string;
   MBM_ALLOWED_ORIGINS?: string;
@@ -179,12 +180,34 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         await this.scheduleSocketAlarms();
         return;
       }
-      const daemonPolicy = sanitizeDaemonPolicy(body.policy);
       const instanceId = daemonInstanceId(body.instance_id);
       if (!instanceId) {
         rejectDaemonMessage(ws, "invalid_daemon_instance", 1002, "daemon instance id required");
         return;
       }
+      if (!socketAttachment.authChallenge || !socketAttachment.authIssuedAt || !socketAttachment.authExpiresAt || !socketAttachment.workerOrigin) {
+        rejectDaemonMessage(ws, "missing_daemon_challenge", 1008, "daemon challenge missing");
+        return;
+      }
+      const authenticated = await verifyDaemonAuthentication({
+        publicKeyJson: this.env.DAEMON_DEVICE_PUBLIC_KEY ?? "",
+        authentication: body.authentication,
+        challenge: {
+          scheme: "device-signature-v1",
+          challenge: socketAttachment.authChallenge,
+          issuedAt: socketAttachment.authIssuedAt,
+          expiresAt: socketAttachment.authExpiresAt,
+          workerOrigin: socketAttachment.workerOrigin,
+        },
+        server: SERVER_NAME,
+        version: SERVER_VERSION,
+        instanceId,
+      });
+      if (!authenticated) {
+        rejectDaemonMessage(ws, "daemon_authentication_failed", 1008, "daemon authentication failed");
+        return;
+      }
+      const daemonPolicy = sanitizeDaemonPolicy(body.policy);
       const authenticatedAt = new Date().toISOString();
       const probeId = randomToken("probe");
       this.daemonRegistry.beginProbe(ws, {
@@ -482,7 +505,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       try {
         socket.send(JSON.stringify({
           type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
-          authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
+          authorization: {
+            account_id: authorized.accountId,
+            account_version: authorized.accountVersion,
+            client_id: authorized.clientId,
+            role: authorized.role,
+          },
         }));
       } catch {
         this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
@@ -508,9 +536,19 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async acceptDaemonWebSocket(request: Request): Promise<Response> {
     if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return new Response("Expected Upgrade: websocket", { status: 426 });
-    const expected = this.env.DAEMON_SHARED_SECRET ?? "";
-    const supplied = request.headers.get("X-Bridge-Token") ?? "";
-    if (!expected || !(await safeEqual(supplied, expected))) return new Response("Unauthorized daemon", { status: 401 });
+    if (!this.env.DAEMON_DEVICE_PUBLIC_KEY) return new Response("Daemon device identity is not configured", { status: 503 });
+    const workerOrigin = new URL(request.url).origin;
+    const preflight = await verifyDaemonPreflight({
+      publicKeyJson: this.env.DAEMON_DEVICE_PUBLIC_KEY,
+      headers: request.headers,
+      workerOrigin,
+      server: SERVER_NAME,
+      version: SERVER_VERSION,
+    });
+    if (!preflight || !(await consumeDaemonPreflightNonce(this.ctx.storage, preflight))) {
+      return new Response("Unauthorized daemon device", { status: 401 });
+    }
+    const challenge = createDaemonChallenge(workerOrigin);
 
     for (const socket of this.daemonRegistry.nonReadySockets()) {
       closeWebSocketQuietly(socket, 1012, "replaced by newer daemon candidate");
@@ -520,9 +558,20 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const [client, server] = Object.values(pair) as [WebSocket, WebSocket];
     this.ctx.acceptWebSocket(server);
     this.observability.socketCandidate();
-    this.daemonRegistry.beginCandidate(server);
+    this.daemonRegistry.beginCandidate(server, challenge);
     await this.scheduleSocketAlarms();
-    server.send(JSON.stringify({ type: "welcome", server: SERVER_NAME, version: SERVER_VERSION }));
+    server.send(JSON.stringify({
+      type: "welcome",
+      server: SERVER_NAME,
+      version: SERVER_VERSION,
+      worker_origin: workerOrigin,
+      authentication: {
+        scheme: challenge.scheme,
+        challenge: challenge.challenge,
+        issued_at: challenge.issuedAt,
+        expires_at: challenge.expiresAt,
+      },
+    }));
     return new Response(null, { status: 101, webSocket: client });
   }
 

package/src/worker/mcp-jsonrpc.ts

@@ -1,3 +1,4 @@
+import { projectMcpResult } from "../shared/result-projection.mjs";
 const JSONRPC_VERSION = "2.0";
 const MAX_SESSION_INSTRUCTION_BYTES = 3 * 1024 * 1024;
 
@@ -48,11 +49,12 @@ export function textToolResult(value: unknown, isError = false): Record<string,
       return result;
     }
   }
+  const projection = projectMcpResult(value);
   const result: Record<string, unknown> = {
-    content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }],
+    content: [{ type: "text", text: projection.text }],
     isError,
   };
-  if (value && typeof value === "object" && !Array.isArray(value)) result.structuredContent = value;
+  if (projection.structuredContent) result.structuredContent = projection.structuredContent;
   return result;
 }