machine-bridge-mcp 1.2.11 → 2.0.0

package/docs/OVERVIEW.md

@@ -2,9 +2,10 @@
 
 Machine Bridge is one local authority surface with two MCP transports. The architecture is organized around three independent questions:
 
-1. **Who may request an operation?** Remote OAuth account identity and role, or the local process identity that launched stdio.
+1. **Who may request an operation?** Remote OAuth account/client identity and role, or the local process identity that launched stdio.
 2. **Which tools are exposed?** The shared tool catalog, policy profile, and account-role intersection.
-3. **What can an exposed tool actually do?** The local runtime, workspace/path rules, operating-system user authority, and platform security controls.
+3. **Is this remote effect currently authorized?** Direct authenticated-owner authority within the daemon ceiling, automatic delegated workspace-safe behavior, or an account/client-bound delegated capability lease.
+4. **What can an authorized tool actually do?** The local runtime, workspace/path rules, operating-system user authority, and platform security controls.
 
 Transport authentication does not create an operating-system sandbox. The local daemon executes with the authority of its OS user.
 
@@ -14,13 +15,14 @@ Transport authentication does not create an operating-system sandbox. The local
 flowchart LR
   HC[Hosted MCP client] -->|HTTPS + OAuth 2.1 / PKCE| W[Cloudflare Worker]
   W --> DO[Durable Object room]
-  DO -->|Authenticated outbound WebSocket| R[LocalRuntime]
+  DO -->|P-256 device-authenticated WebSocket| R[LocalRuntime]
 
   LC[Local MCP client] -->|stdio| S[stdio adapter]
   S --> R
 
   R --> PG[PolicyGate + account access]
-  PG --> TE[ToolExecutor]
+  PG --> OA[OperationAuthorizer]
+  OA --> TE[ToolExecutor]
   TE --> FS[Workspace file service]
   TE --> PS[Process services]
   TE --> MJ[Managed jobs]
@@ -40,9 +42,10 @@ flowchart LR
 
 1. The Worker validates OAuth client, token, account state, role, resource binding, and MCP session state.
 2. The Worker filters advertised tools by account role and the daemon-reported capability ceiling.
-3. The Durable Object relays a bounded tool envelope over the authenticated daemon socket.
+3. The Durable Object relays a bounded tool envelope carrying account and OAuth client identity over the device-authenticated daemon socket.
 4. The local runtime revalidates account authorization, policy, call lifecycle, timeout, and cancellation.
-5. The selected local service executes with the daemon OS user's authority.
+5. The local transaction gate directly permits authenticated owner work within the daemon ceiling; delegated accounts receive automatic workspace-safe behavior or require a matching bounded capability lease for a high-impact effect.
+6. The selected local service executes with the daemon OS user's authority.
 
 The Worker never receives ambient filesystem or process authority. It receives only explicit request/result messages.
 
@@ -65,6 +68,7 @@ Local and Worker code consume these contracts. Generated references and drift te
 `LocalRuntime` is an orchestrator, not a low-level implementation module. It composes:
 
 - policy and account authorization;
+- authenticated-owner direct authority plus delegated effect classification and local capability leases;
 - call registration, timeout, cancellation, and observability;
 - workspace and path services;
 - direct and shell process execution;
@@ -78,9 +82,9 @@ Low-level responsibilities remain in focused modules. Architecture tests enforce
 
 ## State and lifecycle
 
-Each canonical workspace has independent profile state, Worker identity, credentials, locks, service metadata, and managed jobs. State mutations use owner-only files where supported, bounded reads, atomic replacement, and process-identity-aware locks.
+Each canonical workspace has independent profile state, Worker identity, credentials, local capability leases, locks, service metadata, and managed jobs. State mutations use owner-only files where supported, bounded reads, atomic replacement, and process-identity-aware locks.
 
-The relay distinguishes connectivity, authentication, readiness probing, and active service. A candidate daemon must complete an end-to-end probe before replacing an incumbent. Disconnect cancels relay-owned calls and terminates associated local processes.
+The relay distinguishes signed preflight, challenge authentication, readiness probing, and active service. A candidate daemon must prove possession of the enrolled P-256 key and complete an end-to-end probe before replacing an incumbent. Disconnect cancels relay-owned calls and terminates associated local processes.
 
 Managed jobs use a separate durable lifecycle. Their plans are integrity-bound, runners are process-identity checked, transitions are lock-protected, terminal plans are scrubbed, and recovery is bounded.
 

package/docs/PROJECT_STANDARDS.md

@@ -20,7 +20,7 @@ Direct pushes to `main`, force pushes, and branch deletion are blocked by reposi
 
 ### Completion ownership and local acceptance
 
-Repository automation owns implementation, local validation, observed candidate verification, acceptance recording, and pull-request completion. For every npm-package change, automation generates the exact candidate tarball with `npm run release:candidate` and stops before the first GitHub push. The repository owner explicitly authorizes the live candidate Worker update and runs `npm run release:candidate:start -- --allow-worker-deploy` on the maintainer machine and leaves the candidate running. The coding agent verifies the deployed Worker version/hash, remote health, relay readiness, connected local version, and representative functionality through Machine Bridge, then records a passing decision with `npm run release:accept -- --confirm "I VERIFIED machine-bridge-mcp <version> CANDIDATE ON THE OWNER MACHINE AND IT WORKS"`. Automated checks or an unobserved process are not sufficient evidence.
+Repository automation owns implementation, local validation, observed candidate verification, acceptance recording, and pull-request completion. For every npm-package change, automation generates the exact candidate tarball with `npm run release:candidate` and stops before the first GitHub push. The repository owner explicitly authorizes the live candidate Worker update in the active conversation. The coding agent starts the exact candidate through Machine Bridge with `npm run release:candidate:start -- --allow-worker-deploy`, verifies the deployed Worker version/hash, remote health, relay readiness, connected local version, and representative functionality, then records a passing decision with `npm run release:accept -- --confirm "I VERIFIED machine-bridge-mcp <version> CANDIDATE ON THE OWNER MACHINE AND IT WORKS"`. No owner terminal approval command is part of the standard workflow. Automated checks or an unobserved process are not sufficient evidence.
 
 The tracked `release-acceptance/v<version>.json` record binds the observed result to the npm tarball SHA-1 and SHA-512 integrity value. The record is excluded from the package, so a content-preserving squash merge does not invalidate it; any source, executable script, package metadata, or packaged-documentation change produces a different package hash and requires a regenerated candidate and another observed live verification. `npm run github:push`, pull-request CI, and `npm run release` verify the record. Raw direct pushes of release-relevant branches are prohibited.
 

package/docs/RELEASING.md

@@ -40,13 +40,13 @@ A repository-only change under paths such as `.github/` may be merged without a
 
 ## Interactive local candidate acceptance
 
-The repository owner starts the exact `.release-candidate/*.tgz` artifact on the maintainer machine with:
+The repository owner explicitly authorizes the exact `.release-candidate/*.tgz` artifact and any configured same-name Worker update in the active conversation. The coding agent then runs the candidate startup helper through Machine Bridge:
 
 ```sh
 npm run release:candidate:start -- --allow-worker-deploy
 ```
 
-This command verifies the pending tarball hashes, installs it into the ignored `.release-candidate/runtime/` prefix without replacing the normal global installation, explicitly authorizes startup to update the configured same-name Worker when its version or deployment hash differs, and starts the installed candidate in the foreground. This is an in-place live candidate deployment, not an isolated staging Worker. The owner leaves that process running. The coding agent then connects through Machine Bridge and verifies at minimum:
+The helper verifies the pending tarball hashes, installs it into the ignored `.release-candidate/runtime/` prefix without replacing the normal global installation, updates the configured same-name Worker when its version or deployment hash differs, and starts the installed candidate in the foreground. This is an in-place live candidate deployment, not an isolated staging Worker. The owner does not need to execute a terminal authorization command. The coding agent then verifies at minimum:
 
 - the remote Worker reports the candidate version and the persisted deployment hash matches the candidate Worker bundle;
 - the remote health route succeeds without redirect;
@@ -63,7 +63,7 @@ npm run release:accept -- --confirm "I VERIFIED machine-bridge-mcp 1.2.9 CANDIDA
 
 This creates `release-acceptance/v<version>.json` containing package identity, npm tarball hashes, a portable Git-content digest, timestamp, result, and a fixed observed-verification marker. The portable digest is computed with a temporary Git index containing `HEAD` plus the complete working tree; the real staging area is not modified. The record does not store a personal name, machine path, command output, credential, or user content. It is intentionally excluded from the npm package, so adding it does not change the tested tarball.
 
-The command repacks the current tree and refuses to record acceptance if any packaged byte changed after candidate preparation. Automated tests alone, a prepared tarball, a process the agent did not observe, or an ambiguous owner response do not authorize acceptance. Version 1.2.8 owner-recorded acceptance remains supported as a historical marker; version 1.2.9 and later require the owner-started, agent-observed workflow.
+The command repacks the current tree and refuses to record acceptance if any packaged byte changed after candidate preparation. Automated tests alone, a prepared tarball, a process the agent did not observe, or an ambiguous owner response do not authorize acceptance. Version 1.2.8 owner-recorded acceptance and the 1.2.9 owner-started marker remain supported as historical formats; version 2.0.0 and later require explicit owner authorization plus agent-operated, agent-observed verification.
 
 ## Push and review
 

package/docs/TESTING.md

@@ -19,7 +19,7 @@ The repository requires Node.js 26 and npm 12. `.node-version`, `.nvmrc`, `packa
 The suite includes:
 
 - package-impact classification derived from the npm package manifest, allowing repository-only GitHub workflow maintenance without weakening version requirements for shipped content;
-- interactive candidate acceptance hashing, including owner-authorized in-place Worker deployment plus owner-started candidate verification, exact tarball SHA-1/SHA-512 matching, descriptor-first no-follow reads, path-identity/symlink regressions, acceptance-record exclusion from the package, legacy 1.2.8 marker compatibility, and invalidation after any packaged-byte change;
+- interactive candidate acceptance hashing, including owner-authorized in-place Worker deployment plus agent-operated candidate verification, exact tarball SHA-1/SHA-512 matching, descriptor-first no-follow reads, path-identity/symlink regressions, acceptance-record exclusion from the package, legacy 1.2.8 marker compatibility, and invalidation after any packaged-byte change;
 - one-shot process output preview/continuation, completed-session paging, bounded nonzero-exit details, UTF-8-safe head/tail diagnostics, compact local/Worker MCP text mirrors, and quiet-success/bounded-failure verification-runner behavior;
 - GitHub backlog enforcement that paginates all open issues and pull requests, permits only the current branch PR, and requires standard closing keywords for every open issue before a guarded push;
 - release-impact enforcement requiring a new package version and CHANGELOG section for release-relevant changes;
@@ -70,7 +70,10 @@ The suite includes:
 - independently injected service CLI status/install/start/stop/uninstall/remove paths, including provider failure, no selected workspace, no deployed Worker, aliases, and default output/exit adapters;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, access/refresh rotation, stale refresh replay rejection, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, candidate/probing/ready transitions, invalid readiness-result rejection, incumbent preservation until verified handover, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
+- P-256 daemon identity generation, signed WebSocket preflight, one-time transactional nonce consumption, challenge transcript binding, wrong-key/tamper/expiry/replay rejection, and prevention of unauthenticated candidate churn;
+- local operation-risk classification and catalog-wide review coverage; authenticated-owner direct execution; account/client-bound compound capability leases for delegated accounts; ordinary workspace automation; external-sensitive path composition; sensitive/persistence writes; symbolic-link ancestor and patch-move destination canonicalization; browser-session/application-control plus data-export composition; process/job continuation; scoped/full approval; cross-process daemon/CLI mutation serialization; expiry/revocation; owner-only persistence; and malformed-record rejection;
+- signed account-administration requests with origin/method/path/body/time/nonce binding, transactional one-time nonce consumption, legacy bearer rejection, nonce replay rejection, and malformed nonce-state fail-closed behavior;
+- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, fifteen-minute access tokens, refresh-family idle/absolute limits, bounded consumed-token/revoked-family replay state, record-level schema validation, access/refresh rotation, stale refresh replay rejection with whole-family access/refresh revocation, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, candidate/probing/ready transitions, invalid readiness-result rejection, incumbent preservation until verified handover, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
 - a real headless-Chrome OAuth navigation regression with four cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback blocks the regional redirect, allowing the registered and regional callbacks blocks the final Copilot Studio redirect, and the complete policy preserves `code` and `state` through all three cross-origin hops. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
 

package/docs/THREAT_MODEL.md

@@ -14,7 +14,7 @@ The main protected assets are:
 
 - workspace and local-user-accessible files;
 - process execution authority and inherited environment values;
-- daemon secret, account administration secret, account password verifiers, OAuth authorization codes, access tokens, and refresh tokens;
+- daemon device private key, account-administration HMAC key, account password verifiers, OAuth authorization codes, access tokens, refresh tokens, and local capability leases;
 - Worker and Durable Object routing state;
 - owner-only profile, lock, resource, service, and managed-job state;
 - registered local resource contents and paths;
@@ -30,7 +30,7 @@ The hosted client and its prompts, tools, extensions, and retrieved content are
 
 ### Worker to local daemon
 
-The Worker is a relay and authorization layer, not a source of local authority. The daemon accepts only an authenticated, version-compatible relay session. End-to-end readiness requires a local probe result through the active session. Every remote tool call carries bounded account authority that is rechecked locally.
+The Worker is a relay and authorization layer, not a source of local authority. The daemon accepts only a version-compatible relay that proves possession of the enrolled P-256 device key in both a signed upgrade preflight and a Worker challenge. End-to-end readiness requires a local probe result through the active session. Every remote tool call carries bounded account and OAuth-client identity that is rechecked locally, followed by effect-level local transaction authorization.
 
 ### MCP host to local stdio process
 
@@ -50,7 +50,7 @@ State paths, locks, plans, resources, and service definitions are security-sensi
 
 ### Maintainer to release infrastructure
 
-Repository checks reduce accidental or malicious package drift, but source hosting, npm ownership, protected environments, maintainer accounts, and human review remain external trust dependencies. Repository automation cannot manufacture independent review or claim live candidate success without observing the owner-started candidate. It may record acceptance after that observed verification.
+Repository checks reduce accidental or malicious package drift, but source hosting, npm ownership, protected environments, maintainer accounts, and human review remain external trust dependencies. Repository automation cannot manufacture independent review or claim live candidate success without observing the explicitly owner-authorized candidate. It may record acceptance after that observed verification.
 
 ## Attacker models
 
@@ -71,7 +71,8 @@ The implementation aims to preserve these invariants:
 
 - deny unknown, malformed, stale, duplicated, unauthorized, or over-limit requests;
 - intersect remote account authority with the daemon capability ceiling in both Worker and local runtime;
-- keep transport authentication separate from tool authorization and OS authority;
+- permit authenticated owner automation directly within the daemon ceiling while binding delegated high-impact effects to local account/client-scoped, time-bounded capability leases;
+- keep transport authentication, account/tool authorization, transaction authorization, and OS authority separate;
 - use direct argv execution without shell interpretation unless the explicit shell tool is authorized;
 - canonicalize confined paths and reject symlink-based write escape;
 - bound request bodies, messages, files, output, logs, state, retained results, and concurrency;
@@ -102,7 +103,7 @@ Machine Bridge does **not** claim to provide:
 
 ### Canonical `full` profile
 
-`full` intentionally exposes the complete catalog, unrestricted local-user paths, shell execution, parent environment, and absolute path output. A malicious authorized client can use that authority destructively. The mitigation is a narrower profile or a separate low-privilege OS boundary, not additional warning text.
+`full` intentionally preserves the complete catalog, unrestricted local-user paths, shell execution, parent environment, browser/application authority, and absolute path output. Version 2.0 treats the authenticated owner role as authorization to use that ceiling without a second terminal prompt. This prioritizes uninterrupted owner automation: compromise of an active owner OAuth client can exercise the complete daemon ceiling. Delegated accounts remain lease-bound for higher-impact effects. A malicious delegated client holding both valid OAuth credentials and an active matching lease can still act destructively within that lease. A temporary `full` lease is therefore an explicit automation window, not a sandbox or an endorsement of untrusted instructions. Use a narrower profile or a separate low-privilege OS boundary for mutually untrusted workloads.
 
 ### Application and browser automation
 
@@ -128,7 +129,7 @@ Code cannot create a second independent reviewer, npm OIDC trust relationship, p
 
 The main regression suites cover:
 
-- OAuth, account, policy, MCP session, daemon readiness, and relay replacement;
+- OAuth, refresh-family replay revocation, signed administration requests, account, policy, device-authenticated daemon readiness, relay replacement, and local capability leases;
 - path confinement, atomic writes, state locks, service lifecycle, managed-job recovery, and destructive cleanup;
 - direct process boundaries, shell separation, process-tree termination, timeout, cancellation, and disconnect;
 - browser pairing, version/capability handshake, owner/client broker routing, sensitive-field handling, trusted input, and CSP navigation;

package/docs/UPGRADING.md

@@ -4,9 +4,11 @@
 
 Machine Bridge does not retain parallel implementations for obsolete MCP protocol dates, policy revisions, state schemas, lock formats, or browser-extension protocols. The supported path is a direct upgrade from the immediately preceding published package while its state already uses the current schema.
 
-Version 1.2.6 keeps local state schema version 6 and policy revision 5 unchanged. Existing 1.2.5 workspaces, named accounts, resource registrations, managed-job history, Worker identity, and browser pairing state are reused without a schema conversion. The package change hardens relay ready-context propagation and verified service-daemon takeover for recovery daemons; it does not alter stored authority or credential records.
+Version 2.0.0 is a coordinated Worker/daemon security-protocol upgrade. It replaces the long-lived daemon bearer with a P-256 device identity, replaces network account-administration bearer requests with per-request HMAC signatures, shortens OAuth access tokens, introduces refresh-token families and replay revocation, and adds local capability leases for high-impact remote effects. The Worker and daemon must converge on 2.0.0 together; the removed daemon bearer protocol is not retained as a fallback.
 
-Version 1.2.6 still requires the Worker, local daemon, and browser extension to converge on the same package version. The 1.2.5 candidate → probing → ready negotiation remains mandatory; mixed components fail closed. Normal startup redeploys the versioned Worker when required and can now stop a verified same-workspace service daemon even when its process argv used only `--daemon-only` without repeating `--workspace` and `--state-dir`. Reload the unpacked extension after convergence even though this release does not change its browser protocol.
+On the first 2.0.0 state load, a workspace without a device identity generates one locally, removes the legacy daemon secret, and rotates the deployment-wide OAuth token version. Existing pre-2.0 access and refresh credentials therefore fail closed and every client must authorize again. The device private JWK remains in owner-only local state; only the public JWK is deployed to the Worker. Subsequent ordinary starts preserve both the device identity and token version.
+
+The canonical `full` profile is unchanged as a capability ceiling. Authenticated owner operations use that ceiling directly without terminal approval. High-impact operations from delegated non-owner accounts require a local account/client-bound lease, while their normal workspace-contained reads and edits and project inspection remain automatic. Because the packaged extension controls an existing browser profile, one `browser-session` lease covers profile reads and actions; registered-resource input or file upload uses the separate `data-export` scope. An operator may approve the requested scope or explicitly open a temporary `full` window for at most eight hours. Lease state is independent of the policy profile and does not migrate into OAuth credentials.
 
 Version 1.2.0 could accept prototype-shaped account roles through malformed administration input. On the first 1.2.1 or later Worker access, such an account is preserved for recovery but repaired fail-closed: its role becomes `reviewer`, it is disabled, its account version advances, and its authorization codes and tokens are removed. An operator can then assign a valid role, enable the account, and rotate its password through the normal account administration flow. A local policy record with an unknown profile label is normalized to `custom` while retaining its explicit capability fields; an invalid explicit `--profile` is rejected.
 
@@ -17,9 +19,11 @@ A state file from an older unsupported schema is rejected rather than guessed or
 1. Finish or cancel ordinary interactive process sessions. Accepted managed jobs may continue independently, but inspect them before replacing the daemon.
 2. Install the new package with the pinned npm procedure in [Getting started](GETTING_STARTED.md).
 3. Run `machine-mcp doctor`.
-4. Start `machine-mcp` normally for each workspace. Startup verifies state, stops only a verified same-workspace daemon, converges the Worker deployment, and takes over using the installed version.
-5. Reload the unpacked browser extension. Protocol and packaged-version equality are mandatory; an old extension cannot replace a working compatible connection.
-6. Reconnect MCP clients if they retain stale tool or session metadata.
+4. Start `machine-mcp` normally in the foreground for each workspace. Startup generates the device identity if needed, rotates the old deployment token version, deploys the matching public key and 2.0.0 Worker, verifies end-to-end readiness, and only then may replace the prior service daemon.
+5. Reauthorize every remote MCP client. Pre-2.0 access and refresh tokens are intentionally invalid.
+6. Reload the unpacked browser extension. Protocol and packaged-version equality are mandatory; an old extension cannot replace a working compatible connection.
+7. Exercise one safe read and one high-impact operation. Approve the resulting scope or an explicit temporary `--full` window through the local CLI, then retry the operation.
+8. Restore or reinstall background service operation only after the foreground path is healthy.
 
 ## Upgrade safety
 
@@ -29,6 +33,6 @@ Machine Bridge never treats an unreadable or foreign-schema state file as empty
 
 ## Rollback
 
-Rollback is supported only when the older package understands every persisted schema and protocol already written by the newer package. Version 1.2.6 does not advance local state or policy schemas, so a complete rollback to 1.2.5 is structurally possible. The Worker, daemon, and extension must be rolled back together; restoring only one component recreates an unavailable mixed-version system. The preferred recovery is still to fix forward so incomplete ready-context dispatch and orphan recovery-daemon takeover remain corrected.
+Rollback is supported only from a complete pre-upgrade backup. Version 2.0.0 changes Worker/daemon authentication, OAuth refresh state, administration authentication, and local credential material. An older package cannot use the new device protocol or refresh-family state. Rolling back package files alone therefore produces an unavailable or incorrectly authenticated mixed system. Restore the complete owner-only profile backup, prior Worker secret set/build, package version, service definition, and browser extension as one unit, or fix forward.
 
 Never roll back by copying only selected state files or changing version fields. Restore one complete verified state backup, package version, Worker build, and browser extension as a single operational unit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.2.11",
+  "version": "2.0.0",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -133,7 +133,9 @@
     "check-runner:test": "node tests/check-runner-test.mjs",
     "process-output:test": "node tests/process-output-continuation-test.mjs",
     "github-backlog:test": "node tests/github-backlog-test.mjs",
-    "github:backlog": "node scripts/github-backlog.mjs"
+    "github:backlog": "node scripts/github-backlog.mjs",
+    "operation-authorization:test": "node tests/operation-authorization-test.mjs",
+    "device-auth:test": "node tests/device-auth-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",

package/scripts/check-plan.mjs

@@ -10,6 +10,7 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "github-backlog:test",
   "secure-file:test",
   "worker-secret-file:test",
+  "device-auth:test",
   "sarif-security:test",
   "shell:test",
   "architecture:test",
@@ -21,6 +22,7 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "commit-message:test",
   "policy:test",
   "account:test",
+  "operation-authorization:test",
   "worker-oauth-controller:test",
   "policy-docs:check",
   "tool-docs:check",

package/scripts/local-release-acceptance.mjs

@@ -53,9 +53,9 @@ function prepareCandidate() {
   writeFileSync(candidateManifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
   const phrase = confirmationPhrase(pkg.name, pkg.version);
   console.log(`Release candidate created: ${join(candidateDirectory, metadata.filename)}`);
-  console.log("The repository owner must start this exact candidate in a local terminal with:");
+  console.log("After the repository owner explicitly authorizes this exact candidate in the active conversation, the coding agent starts it through Machine Bridge with:");
   console.log("npm run release:candidate:start -- --allow-worker-deploy");
-  console.log("Leave the candidate running while the coding agent verifies connection readiness and representative functionality through Machine Bridge.");
+  console.log("The owner does not need to run a terminal authorization command. The coding agent keeps the candidate running while verifying connection readiness and representative functionality through Machine Bridge.");
   console.log("After that observed live verification succeeds, the coding agent records acceptance with:");
   console.log(`npm run release:accept -- --confirm \"${phrase}\"`);
   console.log("Automated tests alone do not authorize acceptance or the first GitHub push.");

package/scripts/release-acceptance.mjs

@@ -12,7 +12,9 @@ import { readBoundedRegularFileSync } from "../src/local/secure-file.mjs";
 export const ACCEPTANCE_SCHEMA_VERSION = 1;
 export const ACCEPTANCE_POLICY_VERSION = "1.2.8";
 export const AGENT_VERIFIED_ACCEPTANCE_VERSION = "1.2.9";
-export const ACCEPTANCE_CONFIRMATION = "owner-started-agent-verified-local-candidate";
+export const AGENT_OPERATED_ACCEPTANCE_VERSION = "2.0.0";
+export const ACCEPTANCE_CONFIRMATION = "owner-authorized-agent-operated-local-candidate";
+export const OWNER_STARTED_ACCEPTANCE_CONFIRMATION = "owner-started-agent-verified-local-candidate";
 export const LEGACY_ACCEPTANCE_CONFIRMATION = "repository-owner-local-test";
 const MAX_ACCEPTANCE_BYTES = 64 * 1024;
 const MAX_RELEASE_TARBALL_BYTES = 64 * 1024 * 1024;
@@ -22,9 +24,10 @@ export function requiresLocalAcceptance(version) {
 }
 
 export function acceptanceConfirmationForVersion(version) {
-  return compareVersions(parseVersion(version), parseVersion(AGENT_VERIFIED_ACCEPTANCE_VERSION)) >= 0
-    ? ACCEPTANCE_CONFIRMATION
-    : LEGACY_ACCEPTANCE_CONFIRMATION;
+  const parsed = parseVersion(version);
+  if (compareVersions(parsed, parseVersion(AGENT_OPERATED_ACCEPTANCE_VERSION)) >= 0) return ACCEPTANCE_CONFIRMATION;
+  if (compareVersions(parsed, parseVersion(AGENT_VERIFIED_ACCEPTANCE_VERSION)) >= 0) return OWNER_STARTED_ACCEPTANCE_CONFIRMATION;
+  return LEGACY_ACCEPTANCE_CONFIRMATION;
 }
 
 export function acceptancePath(root, version) {

package/src/local/account-admin.mjs

@@ -1,4 +1,5 @@
-import { randomBytes } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { ADMIN_AUTH_SCHEME, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { ACCOUNT_ROLES, normalizeAccountRole } from "./account-access.mjs";
 import { BridgeError } from "./errors.mjs";
 
@@ -58,13 +59,21 @@ export class AccountAdminClient {
   }
 
   async request(method, pathname, body) {
+    const serializedBody = body === undefined ? "" : JSON.stringify(body);
+    const headers = accountAdminRequestHeaders({
+      secret: this.adminSecret,
+      origin: this.workerUrl,
+      method,
+      pathname,
+      body: serializedBody,
+    });
     const response = await this.fetchImpl(`${this.workerUrl}${pathname}`, {
       method,
       headers: {
-        authorization: `Bearer ${this.adminSecret}`,
+        ...headers,
         ...(body === undefined ? {} : { "content-type": "application/json" }),
       },
-      body: body === undefined ? undefined : JSON.stringify(body),
+      body: body === undefined ? undefined : serializedBody,
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
       cache: "no-store",
     }).catch((error) => {
@@ -80,6 +89,22 @@ export class AccountAdminClient {
   }
 }
 
+
+export function accountAdminRequestHeaders({ secret, origin, method, pathname, body = "", now = Date.now(), nonce = randomBytes(24).toString("base64url") }) {
+  if (typeof secret !== "string" || secret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
+  const issuedAt = Math.floor(Number(now) / 1000);
+  const bodyHash = createHash("sha256").update(String(body)).digest("hex");
+  const transcript = adminAuthTranscript({ origin, method: String(method).toUpperCase(), pathname, bodyHash, issuedAt, nonce });
+  const signature = createHmac("sha256", secret).update(transcript).digest("base64url");
+  return {
+    "X-Bridge-Admin-Scheme": ADMIN_AUTH_SCHEME,
+    "X-Bridge-Admin-Time": String(issuedAt),
+    "X-Bridge-Admin-Nonce": nonce,
+    "X-Bridge-Admin-Body-SHA256": bodyHash,
+    "X-Bridge-Admin-Signature": signature,
+  };
+}
+
 export function accountRoleNames() {
   return Object.keys(ACCOUNT_ROLES);
 }

package/src/local/cli-approval.mjs

@@ -0,0 +1,117 @@
+import {
+  OPERATION_APPROVAL_SCOPES,
+  approvePendingOperation,
+  clearOperationLeases,
+  grantOperationLease,
+  listOperationApprovals,
+  revokeOperationLease,
+} from "./operation-authorization.mjs";
+import { loadState } from "./state.mjs";
+
+const ACTIONS = new Set(["list", "approve", "grant", "revoke", "clear"]);
+
+export function createApprovalCommand({ chooseWorkspace, confirm }) {
+  if (typeof chooseWorkspace !== "function" || typeof confirm !== "function") {
+    throw new TypeError("approval command requires chooseWorkspace and confirm dependencies");
+  }
+  return async function approvalCommand(args) {
+    const action = String(args._[0] || "list").toLowerCase();
+    if (!ACTIONS.has(action)) throw new Error(`Unknown approval action: ${action}`);
+    const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
+    const state = loadState(workspace, { stateDir: args.stateDir });
+    const root = state.paths.profileDir;
+    if (action === "list") return renderList(listOperationApprovals(root), args.json === true);
+    if (action === "approve") {
+      const id = requiredPositional(args, 1, "approval approve requires APPROVAL_ID");
+      return renderLease(await approvePendingOperation(
+        root,
+        id,
+        args.duration || (args.full ? "8h" : "1h"),
+        Date.now(),
+        args.full ? "full" : "",
+      ), args.json === true, "Approved");
+    }
+    if (action === "grant") {
+      const scope = requiredPositional(args, 1, "approval grant requires SCOPE");
+      if (!OPERATION_APPROVAL_SCOPES.includes(scope)) {
+        throw new Error(`approval scope must be one of: ${OPERATION_APPROVAL_SCOPES.join(", ")}`);
+      }
+      const clientId = String(args.client || "");
+      const accountId = String(args.account || "");
+      if (!clientId) throw new Error("approval grant requires --client CLIENT_ID; use * only for an intentional all-client lease");
+      if (!accountId) throw new Error("approval grant requires --account ACCOUNT_ID; use * only for an intentional all-account lease");
+      return renderLease(await grantOperationLease(root, {
+        accountId,
+        clientId,
+        scope,
+        duration: args.duration || "1h",
+      }), args.json === true, "Granted");
+    }
+    if (action === "revoke") {
+      const id = requiredPositional(args, 1, "approval revoke requires LEASE_ID");
+      const removed = await revokeOperationLease(root, id);
+      if (args.json) console.log(JSON.stringify({ lease_id: id, revoked: removed }, null, 2));
+      else console.log(removed ? `Revoked capability lease: ${id}` : `Capability lease was not active: ${id}`);
+      return;
+    }
+    const approved = await confirm("Revoke all active remote capability leases?", args.yes === true);
+    if (!approved) {
+      console.log("No capability leases were changed.");
+      return;
+    }
+    await clearOperationLeases(root);
+    if (args.json) console.log(JSON.stringify({ cleared: true }, null, 2));
+    else console.log("Revoked all active remote capability leases.");
+  };
+}
+
+function renderList(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (!result.pending.length && !result.leases.length) {
+    console.log("No pending approvals or active capability leases.");
+    return;
+  }
+  if (result.pending.length) {
+    console.log("Pending approvals:");
+    for (const item of result.pending) {
+      console.log(`  ${item.id}\t${scopeText(item.scopes)}\t${item.category}\tclient ${shortId(item.client_id)}\texpires ${formatTime(item.expires_at)}`);
+    }
+  }
+  if (result.leases.length) {
+    console.log("Active capability leases:");
+    for (const item of result.leases) {
+      console.log(`  ${item.id}\t${scopeText(item.scopes)}\tclient ${shortId(item.client_id)}\texpires ${formatTime(item.expires_at)}`);
+    }
+  }
+}
+
+function renderLease(lease, json, verb) {
+  if (json) {
+    console.log(JSON.stringify(lease, null, 2));
+    return;
+  }
+  console.log(`${verb} ${scopeText(lease.scopes)} capability lease for client ${shortId(lease.client_id)} until ${formatTime(lease.expires_at)}.`);
+  console.log(`Lease ID: ${lease.id}`);
+}
+
+function requiredPositional(args, index, message) {
+  const value = String(args._[index] || "");
+  if (!value) throw new Error(message);
+  return value;
+}
+
+function scopeText(scopes) {
+  return Array.isArray(scopes) ? scopes.join("+") : "<invalid-scope>";
+}
+
+function shortId(value) {
+  const text = String(value || "");
+  return text === "*" ? "*" : `${text.slice(0, 14)}...${text.slice(-6)}`;
+}
+
+function formatTime(epochSeconds) {
+  return new Date(Number(epochSeconds) * 1000).toISOString();
+}

package/src/local/cli-options.mjs

@@ -3,10 +3,10 @@ import { normalizeLogLevel } from "./log.mjs";
 const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
   "daemonOnly", "noAutostart", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
-  "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
+  "yes", "keepWorker", "allowInsecurePermissions", "showPaths", "full",
 ]);
 const VALUE_OPTIONS = new Set([
-  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "logLevel", "logFormat",
+  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "account", "duration", "logLevel", "logFormat",
 ]);
 
 const LOG_FORMATS = new Set(["text", "json"]);
@@ -28,6 +28,7 @@ const COMMAND_OPTIONS = new Map(Object.entries({
   autostart: new Set(["workspace", "stateDir", "quiet"]),
   resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
   account: new Set(["workspace", "stateDir", "json", "yes"]),
+  approval: new Set(["workspace", "stateDir", "json", "yes", "client", "account", "duration", "full"]),
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
@@ -41,6 +42,7 @@ const STATIC_POSITIONAL_RULES = new Map([
 const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
 const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
 const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const APPROVAL_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, approve: 2, grant: 2, revoke: 2, clear: 1 }));
 const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
@@ -59,6 +61,10 @@ const ACTION_POSITIONAL_RULES = new Map(Object.entries({
     const action = String(args._[0] || "list");
     return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
+  approval(args) {
+    const action = String(args._[0] || "list");
+    return { max: APPROVAL_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `approval ${action} received too many positional arguments` };
+  },
   browser(args) {
     const action = String(args._[0] || "status");
     return { max: 1, tooMany: `browser ${action} received too many positional arguments` };

package/src/local/cli.mjs

@@ -10,6 +10,7 @@ import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./to
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { createApprovalCommand } from "./cli-approval.mjs";
 import { createServiceCommand } from "./cli-service.mjs";
 import { generateAccountPassword } from "./account-admin.mjs";
 import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
@@ -49,6 +50,7 @@ import {
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
+const approvalCommand = createApprovalCommand({ chooseWorkspace, confirm });
 const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
 
 const COMMAND_HANDLERS = new Map([
@@ -64,6 +66,7 @@ const COMMAND_HANDLERS = new Map([
   ["rotate-secrets", rotateSecretsCommand],
   ["resource", localAdminCommands.resourceCommand],
   ["account", accountCommand],
+  ["approval", approvalCommand],
   ["browser", localAdminCommands.browserCommand],
   ["job", localAdminCommands.jobCommand],
   ["uninstall", uninstallCommand],
@@ -300,12 +303,13 @@ async function ensureInitialOwnerAccount(state) {
 function createRemoteRuntime({ args, workspace, state, daemonLock }) {
   return new LocalRuntime({
     workerUrl: state.worker.url,
-    secret: state.worker.daemonSecret,
+    deviceIdentity: state.worker.deviceIdentity,
     expectedRelayVersion: currentPackageVersion(),
     workspace,
     policy: state.policy,
     logger: createLogger({ level: args.json ? "error" : effectiveLogLevel(args), format: effectiveLogFormat(args), component: "daemon" }),
     jobRoot: join(state.paths.profileDir, "jobs"),
+    approvalRoot: state.paths.profileDir,
     resources: state.resources,
     resourceStatePath: state.paths.statePath,
     browserStateRoot: state.paths.stateRoot,
@@ -745,9 +749,16 @@ Commands:
   status            Print redacted local profile state and Worker health
   doctor            Check Node, Wrangler, Cloudflare login, Worker health
   full-test         Run real local full-profile capability tests in a temporary sandbox
-  rotate-secrets    Rotate account-admin, daemon, and global token-version secrets
+  rotate-secrets    Rotate account-admin, device identity, and global token-version secrets
   account list|add|role|enable|disable|rotate-password|remove
                     Manage isolated remote accounts and targeted revocation
+  approval list     Show pending high-impact operations and active capability leases
+  approval approve APPROVAL_ID [--duration 1h] [--full]
+                    Approve its scope, or open an explicit full window (maximum 8h)
+  approval grant SCOPE --account ACCOUNT_ID --client CLIENT_ID [--duration 1h]
+                    Pre-authorize a bounded scope; use * values only intentionally
+  approval revoke LEASE_ID | approval clear
+                    Revoke one or all local capability leases
   resource generate-ssh-key NAME [PATH]
                     Generate/reuse an Ed25519 key locally and register its private file by alias
   browser status    Show browser-extension bridge and connection status