machine-bridge-mcp 1.2.11 → 2.0.0

package/src/local/operation-risk.mjs

@@ -0,0 +1,221 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+
+export const OPERATION_APPROVAL_SCOPES = Object.freeze([
+  "shell",
+  "external-write",
+  "sensitive-write",
+  "external-read",
+  "sensitive-read",
+  "browser-session",
+  "data-export",
+  "persistent-job",
+  "application-control",
+  "credential-operation",
+  "full",
+]);
+
+const SHELL_TOOLS = new Set(["exec_command", "run_process", "start_process", "run_local_command", "read_process", "write_process", "kill_process"]);
+const PERSISTENT_TOOLS = new Set(["stage_job", "start_job", "list_jobs", "read_job", "cancel_job"]);
+const APPLICATION_CONTROL_TOOLS = new Set(["open_local_application", "inspect_local_application", "operate_local_application"]);
+const CREDENTIAL_TOOLS = new Set(["generate_ssh_key_resource"]);
+const BROWSER_PROFILE_TOOLS = new Set([
+  "pair_browser_extension", "browser_list_tabs", "browser_manage_tabs", "browser_get_source",
+  "browser_inspect_page", "browser_wait", "browser_action", "browser_fill_form", "browser_screenshot",
+]);
+const AUTOMATIC_TOOLS = new Set([
+  "server_info", "project_overview", "list_local_applications", "browser_status", "list_roots",
+  "diagnose_runtime", "list_local_resources",
+]);
+const FILE_WRITE_TOOLS = new Set(["write_file", "edit_file"]);
+const FILE_READ_TOOLS = new Set([
+  "session_bootstrap", "resolve_task_capabilities", "agent_context", "list_local_skills", "load_local_skill", "list_local_commands",
+  "list_dir", "list_files", "read_file", "view_image", "search_text",
+  "git_status", "git_diff", "git_log", "git_show",
+]);
+const SENSITIVE_SEGMENTS = new Set([
+  ".ssh", ".aws", ".azure", ".gnupg", ".kube", ".docker", ".npmrc", ".pypirc",
+  "keychains", "cookies", "login data", "credentials", "secrets",
+]);
+
+export function reviewedOperationToolNames() {
+  return new Set([
+    ...AUTOMATIC_TOOLS,
+    ...SHELL_TOOLS,
+    ...PERSISTENT_TOOLS,
+    ...APPLICATION_CONTROL_TOOLS,
+    ...CREDENTIAL_TOOLS,
+    ...BROWSER_PROFILE_TOOLS,
+    ...FILE_WRITE_TOOLS,
+    ...FILE_READ_TOOLS,
+    "browser_upload_files",
+    "apply_patch",
+  ]);
+}
+
+export async function classifyOperation(tool, args = {}, options = {}) {
+  const name = String(tool || "");
+  if (SHELL_TOOLS.has(name)) return requirement("shell", "remote shell or process control", name, args);
+  if (PERSISTENT_TOOLS.has(name)) return requirement("persistent-job", "persistent managed job", name, args);
+  if (name === "operate_local_application" && args.value_resource) {
+    return requirement(["application-control", "data-export"], "desktop application control using protected local data", name, {
+      application: args.application,
+      action: args.action,
+      value_resource: args.value_resource,
+    });
+  }
+  if (APPLICATION_CONTROL_TOOLS.has(name)) return requirement("application-control", "desktop application control", name, args);
+  if (CREDENTIAL_TOOLS.has(name)) return requirement("credential-operation", "credential or key operation", name, args);
+  if (name === "browser_upload_files") {
+    return requirement(["browser-session", "data-export"], "existing browser profile file upload", name, args);
+  }
+  if (name === "browser_action" && args.value_resource) {
+    return requirement(["browser-session", "data-export"], "existing browser profile input from protected local data", name, {
+      action: args.action,
+      tab_id: args.tab_id,
+      value_resource: args.value_resource,
+    });
+  }
+  if (name === "browser_fill_form" && Array.isArray(args.fields) && args.fields.some((field) => field?.value_resource || field?.sensitive === true)) {
+    return requirement(["browser-session", "data-export"], "existing browser profile form containing protected local data", name, {
+      tab_id: args.tab_id,
+      resource_fields: args.fields.filter((field) => field?.value_resource || field?.sensitive === true).length,
+      submit: args.submit === true,
+    });
+  }
+  if (BROWSER_PROFILE_TOOLS.has(name)) {
+    return requirement("browser-session", "access to the existing browser profile", name, {
+      action: args.action,
+      tab_id: args.tab_id,
+      frame_id: args.frame_id,
+      submit: args.submit === true,
+    });
+  }
+  if (FILE_WRITE_TOOLS.has(name)) {
+    const target = await canonicalWritePath(args.path, options);
+    const scopes = pathWriteScopes(options.workspace, target);
+    if (scopes.length) return requirement(scopes, pathWriteCategory(scopes), name, { path: target });
+  }
+  if (name === "apply_patch") {
+    const paths = patchPaths(args.patch);
+    const targets = [];
+    for (const candidate of paths) targets.push(await canonicalWritePath(candidate, options));
+    const scopes = normalizeScopes(targets.flatMap((target) => pathWriteScopes(options.workspace, target)));
+    if (scopes.length) return requirement(scopes, pathWriteCategory(scopes, "patch"), name, { paths: targets });
+  }
+  if (FILE_READ_TOOLS.has(name) && args.path !== undefined) {
+    const target = await canonicalExistingPath(args.path, options);
+    const scopes = [];
+    if (!isWithin(options.workspace, target)) scopes.push("external-read");
+    if (isSensitivePath(target)) scopes.push("sensitive-read");
+    if (scopes.length) return requirement(scopes, pathReadCategory(scopes), name, { path: target });
+  }
+  return null;
+}
+
+function requirement(scopes, category, tool, target) {
+  const normalized = normalizeScopes(Array.isArray(scopes) ? scopes : [scopes]);
+  if (!normalized.length) throw new Error("operation approval requirement is missing a scope");
+  return {
+    scope: normalized[0],
+    scopes: normalized,
+    category,
+    targetHash: createHash("sha256").update(JSON.stringify({ tool, target: redactTarget(target) })).digest("hex"),
+  };
+}
+
+function normalizeScopes(scopes) {
+  const requested = new Set(scopes.map((scope) => String(scope || "")));
+  return OPERATION_APPROVAL_SCOPES.filter((scope) => requested.has(scope));
+}
+
+function pathWriteScopes(workspace, target) {
+  const scopes = [];
+  if (!isWithin(workspace, target)) scopes.push("external-write");
+  if (isSensitiveWritePath(target)) scopes.push("sensitive-write");
+  return scopes;
+}
+
+function pathWriteCategory(scopes, subject = "write") {
+  const external = scopes.includes("external-write");
+  const sensitive = scopes.includes("sensitive-write");
+  if (external && sensitive) return `${subject} outside the selected workspace to a credential or persistence-sensitive path`;
+  if (sensitive) return `${subject} to a credential or persistence-sensitive path`;
+  return `${subject} outside the selected workspace`;
+}
+
+function pathReadCategory(scopes) {
+  const external = scopes.includes("external-read");
+  const sensitive = scopes.includes("sensitive-read");
+  if (external && sensitive) return "read outside the selected workspace from a credential-sensitive location";
+  if (sensitive) return "read from a credential-sensitive location";
+  return "read outside the selected workspace";
+}
+
+function redactTarget(value) {
+  if (!value || typeof value !== "object") return String(value || "");
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (["content", "command", "stdin", "value", "old_text", "new_text", "patch"].includes(key)) {
+      out[key] = `<sha256:${createHash("sha256").update(String(item || "")).digest("hex")}>`;
+    } else out[key] = item;
+  }
+  return out;
+}
+
+async function canonicalExistingPath(value, options) {
+  if (typeof options.resolveExistingPath === "function") return options.resolveExistingPath(value);
+  return path.resolve(options.workspace, String(value || "."));
+}
+
+async function canonicalWritePath(value, options) {
+  if (typeof options.resolveWritePath === "function") return options.resolveWritePath(value);
+  return path.resolve(options.workspace, String(value || "."));
+}
+
+function isWithin(workspace, target) {
+  const relative = path.relative(path.resolve(workspace), path.resolve(target));
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+
+function isSensitivePath(target) {
+  const lower = path.resolve(target).toLowerCase();
+  const segments = lower.split(/[\\/]+/);
+  if (segments.some((segment) => SENSITIVE_SEGMENTS.has(segment))) return true;
+  const base = path.basename(lower);
+  return isSensitiveEnvironmentFile(base) || /(?:token|secret|credential|private[-_]?key)/.test(base);
+}
+
+function isSensitiveWritePath(target) {
+  const lower = path.resolve(target).toLowerCase();
+  const normalized = lower.split(path.sep).join("/");
+  const base = path.basename(lower);
+  if (isSensitivePath(lower)) return true;
+  if ([".zshrc", ".bashrc", ".bash_profile", ".profile", ".gitconfig", ".netrc", ".curlrc", "authorized_keys", "sshd_config", "sudoers"].includes(base)) return true;
+  return normalized.includes("/.git/hooks/")
+    || normalized.endsWith("/.git/config")
+    || normalized.endsWith("/.config/git/config")
+    || normalized.includes("/library/launchagents/")
+    || normalized.includes("/library/launchdaemons/")
+    || normalized.includes("/.config/autostart/")
+    || normalized.includes("/.config/systemd/user/")
+    || normalized.includes("/start menu/programs/startup/")
+    || normalized.endsWith("/.config/fish/config.fish");
+}
+
+function isSensitiveEnvironmentFile(base) {
+  if (base === ".env") return true;
+  if (!base.startsWith(".env.")) return false;
+  return ![".env.example", ".env.sample", ".env.template", ".env.defaults"].includes(base);
+}
+
+function patchPaths(patch) {
+  const paths = [];
+  for (const line of String(patch || "").split(/\r?\n/)) {
+    const match = /^(?:\*\*\* (?:Add|Update|Delete) File:|\*\*\* Move to:|\+\+\+|---)\s+(.+)$/.exec(line);
+    if (!match) continue;
+    const value = match[1].replace(/^[ab]\//, "").trim();
+    if (value && value !== "/dev/null") paths.push(value);
+  }
+  return paths;
+}

package/src/local/operation-state-lock.mjs

@@ -0,0 +1,92 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { createExclusiveFileSync, removeOwnedJsonFileSync } from "./exclusive-file.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
+import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
+import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const LOCK_PURPOSE = "operation-authorization";
+const LOCK_FILE = "operation-authorization.lock";
+const MAX_LOCK_BYTES = 8 * 1024;
+const DEFAULT_WAIT_MS = 5_000;
+const DEFAULT_POLL_MS = 25;
+
+export async function withOperationStateLock(root, callback, options = {}) {
+  if (typeof callback !== "function") throw new TypeError("operation-state lock requires a callback");
+  const requestedRoot = String(root || "").trim();
+  if (!requestedRoot) throw new Error("operation-state lock root is missing");
+  const directory = path.resolve(requestedRoot);
+  ensureOwnerOnlyDirectorySync(directory);
+  const lockPath = path.join(directory, LOCK_FILE);
+  const timeoutMs = positiveInteger(options.timeoutMs, DEFAULT_WAIT_MS);
+  const pollMs = positiveInteger(options.pollMs, DEFAULT_POLL_MS);
+  const deadline = createMonotonicDeadline(timeoutMs);
+  const owner = lockOwner();
+
+  while (true) {
+    try {
+      createExclusiveFileSync(lockPath, `${JSON.stringify(owner, null, 2)}\n`, { mode: 0o600 });
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      const existing = readLockOwner(lockPath);
+      if (!existing) throw new Error("operation authorization lock is malformed; inspect the owner-only state directory");
+      if (existing.purpose !== LOCK_PURPOSE) throw new Error("operation authorization lock contains mismatched purpose metadata");
+      const identity = inspectProcessInstance(existing, { maxAgeMs: Number.POSITIVE_INFINITY });
+      if (identity.reclaimable) {
+        if (removeOwnedJsonFileSync(lockPath, { token: existing.token, purpose: LOCK_PURPOSE }, { maxBytes: MAX_LOCK_BYTES })) continue;
+      }
+      if (deadline.expired()) {
+        const pid = Number.isInteger(existing.pid) ? `pid ${existing.pid}` : "unknown process";
+        throw new Error(`operation authorization state is busy (${pid}); retry after the current approval operation finishes`);
+      }
+      await delay(Math.min(pollMs, Math.max(1, deadline.remainingMs())));
+    }
+  }
+
+  let result;
+  let callbackError;
+  try {
+    result = await callback();
+  } catch (error) {
+    callbackError = error;
+  }
+  const released = removeOwnedJsonFileSync(lockPath, { token: owner.token, purpose: LOCK_PURPOSE }, { maxBytes: MAX_LOCK_BYTES });
+  if (!released) throw new Error("operation authorization lock changed before release; approval state may require inspection");
+  if (callbackError) throw callbackError;
+  return result;
+}
+
+function lockOwner() {
+  return {
+    pid: process.pid,
+    token: randomBytes(16).toString("hex"),
+    purpose: LOCK_PURPOSE,
+    startedAt: new Date().toISOString(),
+    processStartedAt: new Date(currentProcessStartTimeMs()).toISOString(),
+    entryScript: String(process.argv[1] || "").slice(0, 4096),
+  };
+}
+
+function readLockOwner(file) {
+  if (!existsSync(file)) return null;
+  let parsed;
+  try { parsed = JSON.parse(readBoundedRegularFileSync(file, MAX_LOCK_BYTES, "operation authorization lock").toString("utf8")); } catch { return null; }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (!Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
+  if (!/^[a-f0-9]{32}$/.test(String(parsed.token || ""))) return null;
+  if (parsed.purpose !== LOCK_PURPOSE) return null;
+  if (!Number.isFinite(Date.parse(String(parsed.startedAt || "")))) return null;
+  if (!Number.isFinite(Date.parse(String(parsed.processStartedAt || "")))) return null;
+  return parsed;
+}
+
+function positiveInteger(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
+}
+
+function delay(milliseconds) {
+  return new Promise((resolvePromise) => { setTimeout(resolvePromise, milliseconds); });
+}

package/src/local/relay-connection.mjs

@@ -23,10 +23,9 @@ const DEFAULT_SCHEDULER = Object.freeze({
 export class RelayConnection {
   constructor(options = {}) {
     this.workerUrl = normalizeWorkerUrl(options.workerUrl);
-    if (typeof options.secret !== "string" || options.secret.length < 16) throw new Error("daemon secret is missing or too short");
-    this.secret = options.secret;
     this.logger = options.logger || console;
     this.helloMessage = typeof options.helloMessage === "function" ? options.helloMessage : () => ({ type: "hello" });
+    this.connectionHeaders = typeof options.connectionHeaders === "function" ? options.connectionHeaders : () => ({});
     this.expectedServer = String(options.expectedServer || "");
     this.expectedVersion = String(options.expectedVersion || "");
     this.onMessage = typeof options.onMessage === "function" ? options.onMessage : () => {};
@@ -164,6 +163,13 @@ export class RelayConnection {
       return false;
     }
     this.logger.debug?.("remote relay welcome received");
+    Promise.resolve(this.helloMessage(message)).then((hello) => {
+      if (this.socket !== socket || this.closed || this.authenticated) return;
+      if (!this.sendOnSocket(socket, hello)) this.failPermanently("relay_authentication_failed");
+    }).catch((error) => {
+      this.logger.debug?.("could not create daemon authentication proof", { error_class: classifyOperationalError(error) });
+      this.failPermanently("relay_authentication_failed");
+    });
     return true;
   }
 
@@ -273,9 +279,11 @@ export class RelayConnection {
     let socket;
     try {
       const proxy = this.proxyAgentForUrl(wsUrl);
+      const headers = this.connectionHeaders();
+      if (!headers || typeof headers !== "object" || Array.isArray(headers)) throw new Error("relay connection headers are invalid");
       this.networkRoute = proxy?.agent ? "proxy" : "direct";
       socket = new this.WebSocketClass(wsUrl, {
-        headers: { "X-Bridge-Token": this.secret },
+        headers,
         maxPayload: this.maxPayload,
         ...(proxy?.agent ? { agent: proxy.agent } : {}),
       });
@@ -308,8 +316,7 @@ export class RelayConnection {
         return;
       }
       this.lastInboundAt = this.now();
-      this.logger.debug?.("remote relay transport opened; awaiting authentication acknowledgement");
-      if (!this.sendOnSocket(socket, this.helloMessage())) return;
+      this.logger.debug?.("remote relay transport opened; awaiting device challenge");
       this.clearTimer("handshakeTimer", "clearTimeout");
       this.handshakeTimer = this.scheduler.setTimeout(() => {
         if (this.socket !== socket || this.closed || this.ready) return;

package/src/local/runtime-relay.mjs

@@ -1,5 +1,6 @@
 import { Buffer } from "node:buffer";
 import { RelayConnection } from "./relay-connection.mjs";
+import { createDaemonAuthentication, createDaemonPreflightHeaders } from "./device-identity.mjs";
 import { MCP_SUPPORTED_PROTOCOL_VERSIONS, SERVER_NAME } from "./tools.mjs";
 import { normalizeAccountRole } from "./account-access.mjs";
 import { clampInteger } from "./numbers.mjs";
@@ -7,21 +8,27 @@ import { isPlainRecord } from "./records.mjs";
 
 export const MAX_RELAY_MESSAGE_BYTES = 8 * 1024 * 1024;
 
-export function createRuntimeRelayConnection(runtime, { workerUrl, secret, expectedVersion, onFatal }) {
+export function createRuntimeRelayConnection(runtime, { workerUrl, deviceIdentity, expectedVersion, onFatal }) {
   if (!workerUrl) return null;
   return new RelayConnection({
     workerUrl,
-    secret,
     logger: runtime.logger,
     maxPayload: MAX_RELAY_MESSAGE_BYTES,
     expectedServer: SERVER_NAME,
     expectedVersion: String(expectedVersion || ""),
-    helloMessage: () => ({
+    connectionHeaders: () => createDaemonPreflightHeaders(
+      deviceIdentity,
+      workerUrl,
+      SERVER_NAME,
+      String(expectedVersion || ""),
+    ),
+    helloMessage: async (welcome) => ({
       type: "hello",
       instance_id: runtime.relayInstanceId,
       tools: runtime.tools(),
       policy: runtime.policy,
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
+      authentication: await createDaemonAuthentication(deviceIdentity, welcome, runtime.relayInstanceId),
     }),
     onMessage: (data, relayContext) => handleRelayData(runtime, data, relayContext),
     onDisconnect: () => runtime.handleRelayDisconnect(),
@@ -82,8 +89,9 @@ function normalizeRelayAuthorization(value) {
   if (!isPlainRecord(value)) return null;
   const accountId = typeof value.account_id === "string" && /^acct_[A-Za-z0-9_-]{20,96}$/.test(value.account_id) ? value.account_id : "";
   const accountVersion = Number(value.account_version);
+  const clientId = typeof value.client_id === "string" && /^mcp_client_[A-Za-z0-9_-]{43}$/.test(value.client_id) ? value.client_id : "";
   let role;
   try { role = normalizeAccountRole(value.role); } catch { return null; }
-  if (!accountId || !Number.isInteger(accountVersion) || accountVersion < 1) return null;
-  return Object.freeze({ account_id: accountId, account_version: accountVersion, role });
+  if (!accountId || !clientId || !Number.isInteger(accountVersion) || accountVersion < 1) return null;
+  return Object.freeze({ account_id: accountId, account_version: accountVersion, client_id: clientId, role });
 }

package/src/local/runtime.mjs

@@ -31,6 +31,7 @@ import { AccountAccessGate } from "./account-access.mjs";
 import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
 import { diagnoseRuntime as runRuntimeDiagnostics } from "./runtime-diagnostics.mjs";
 import { bindRuntimeToolHandlers, runtimeToolHandlerNames as registeredRuntimeToolHandlerNames } from "./runtime-tool-handlers.mjs";
+import { OperationAuthorizer } from "./operation-authorization.mjs";
 import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelayToolCall } from "./runtime-relay.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage, stateRootFromProfileStatePath } from "./runtime-paths.mjs";
@@ -46,9 +47,8 @@ export function runtimeToolHandlerNames() {
 }
 
 export class LocalRuntime {
-  constructor({ workerUrl = "", secret = "", expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {} }) {
+  constructor({ workerUrl = "", deviceIdentity = null, expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", approvalRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {} }) {
     const remoteWorkerUrl = workerUrl ? String(workerUrl) : "";
-    const remoteSecret = secret || "";
     this.workspaceInput = resolve(workspace || process.cwd());
     this.workspace = realpathSync.native ? realpathSync.native(this.workspaceInput) : realpathSync(this.workspaceInput);
     this.workspaceCanonicalPromise = null;
@@ -155,6 +155,12 @@ export class LocalRuntime {
       readResourceText,
       throwIfCancelled: (context) => this.throwIfCancelled(context),
     });
+    this.operationAuthorizer = new OperationAuthorizer({
+      workspace: this.workspace,
+      root: approvalRoot,
+      resolveExistingPath: (value) => this.resolveExistingPath(value),
+      resolveWritePath: (value) => this.resolveWritePath(value),
+    });
     this.browserBridgeManager = new BrowserBridgeManager({
       policy: this.policy,
       authorizeTool: (tool) => this.policyGate.assert(tool),
@@ -169,6 +175,7 @@ export class LocalRuntime {
       handlers: bindRuntimeToolHandlers(this),
       policyGate: this.policyGate,
       accountAccessGate: this.accountAccessGate,
+      operationAuthorizer: this.operationAuthorizer,
       callRegistry: this.callRegistry,
       observability: this.observability,
       logger: this.logger,
@@ -176,7 +183,7 @@ export class LocalRuntime {
       slowMs: SLOW_TOOL_CALL_MS,
     });
     this.relay = createRuntimeRelayConnection(this, {
-      workerUrl: remoteWorkerUrl, secret: remoteSecret, expectedVersion: expectedRelayVersion, onFatal,
+      workerUrl: remoteWorkerUrl, deviceIdentity, expectedVersion: expectedRelayVersion, onFatal,
     });
     this.relayCallRecovery = new RelayCallRecovery({
       logger: this.logger,
@@ -210,7 +217,7 @@ export class LocalRuntime {
   }
 
   async start() {
-    if (!this.relay) throw new Error("remote daemon start requires a Worker URL and daemon secret");
+    if (!this.relay) throw new Error("remote daemon start requires a Worker URL and device identity");
     if (!this.lifecycle.beginStart()) return;
     if (this.policy.profile === "full") {
       void this.browserBridgeManager.ensureStarted().catch((error) => {
@@ -601,8 +608,8 @@ export class LocalRuntime {
 
   async resolveWritePath(inputPath = ".") {
     const candidate = this.resolvePath(inputPath);
-    if (this.policy.unrestrictedPaths) return candidate;
     const candidateInfo = await lstat(candidate).catch(() => null);
+    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
     let ancestor = candidate;
     while (!(await lstat(ancestor).catch(() => null))) {
       const parent = dirname(ancestor);
@@ -610,8 +617,7 @@ export class LocalRuntime {
       ancestor = parent;
     }
     const [workspace, canonicalAncestor] = await Promise.all([this.canonicalWorkspace(), realpath(ancestor)]);
-    assertContainedPath(workspace, canonicalAncestor);
-    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
+    if (!this.policy.unrestrictedPaths) assertContainedPath(workspace, canonicalAncestor);
     const suffix = relative(ancestor, candidate);
     return suffix ? resolve(canonicalAncestor, suffix) : canonicalAncestor;
   }

package/src/local/state.mjs

@@ -7,6 +7,7 @@ import serverMetadata from "../shared/server-metadata.json" with { type: "json"
 import { replaceFileSync } from "./atomic-fs.mjs";
 import { createExclusiveFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
+import { createDeviceIdentity, validateDeviceIdentity } from "./device-identity.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -591,9 +592,14 @@ function pruneBackups(filePath, keep) {
 
 export function ensureWorkerSecrets(state, options = {}) {
   state.worker ||= {};
+  const enrollingDeviceIdentity = !state.worker.deviceIdentity;
   if (!state.worker.accountAdminSecret || options.rotateSecrets) state.worker.accountAdminSecret = randomToken("account_admin");
-  if (!state.worker.daemonSecret || options.rotateSecrets) state.worker.daemonSecret = randomToken("daemon_secret");
-  if (!state.worker.oauthTokenVersion || options.rotateSecrets) state.worker.oauthTokenVersion = randomToken("token_version");
+  if (enrollingDeviceIdentity || options.rotateSecrets) state.worker.deviceIdentity = createDeviceIdentity();
+  else validateDeviceIdentity(state.worker.deviceIdentity);
+  delete state.worker.daemonSecret;
+  if (!state.worker.oauthTokenVersion || enrollingDeviceIdentity || options.rotateSecrets) {
+    state.worker.oauthTokenVersion = randomToken("token_version");
+  }
 
   const requestedName = options.workerName || "";
   if (!state.worker.name) {
@@ -635,7 +641,7 @@ export function ownerOnlyFile(filePath) {
 export function redactState(state) {
   const clone = redactHomeInValue(JSON.parse(JSON.stringify(state)));
   if (clone.worker?.accountAdminSecret) clone.worker.accountAdminSecret = "<redacted>";
-  if (clone.worker?.daemonSecret) clone.worker.daemonSecret = "<redacted>";
+  if (clone.worker?.deviceIdentity?.privateJwk?.d) clone.worker.deviceIdentity.privateJwk.d = "<redacted>";
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
   if (clone.resources && typeof clone.resources === "object") {
     for (const value of Object.values(clone.resources)) {

package/src/local/tool-executor.mjs

@@ -7,6 +7,7 @@ export class ToolExecutor {
     this.policyGate = options.policyGate;
     this.callRegistry = options.callRegistry;
     this.accountAccessGate = options.accountAccessGate;
+    this.operationAuthorizer = options.operationAuthorizer;
     this.observability = options.observability;
     this.logger = options.logger || console;
     this.safeMessage = typeof options.safeMessage === "function" ? options.safeMessage : (error) => String(error?.message || error || "operation failed");
@@ -14,7 +15,7 @@ export class ToolExecutor {
     this.pipeline = composeMiddleware([
       lifecycleMiddleware(this.callRegistry),
       observabilityMiddleware(this.observability, this.logger, this.safeMessage, this.slowMs),
-      authorizeMiddleware(this.policyGate, this.accountAccessGate),
+      authorizeMiddleware(this.policyGate, this.accountAccessGate, this.operationAuthorizer),
     ], invokeHandler(this.handlers));
   }
 
@@ -27,13 +28,14 @@ export function composeMiddleware(middleware, terminal) {
   return middleware.reduceRight((next, current) => (operation) => current(operation, next), terminal);
 }
 
-function authorizeMiddleware(policyGate, accountAccessGate) {
+function authorizeMiddleware(policyGate, accountAccessGate, operationAuthorizer) {
   return async (operation, next) => {
     policyGate.assert(operation.tool);
     if (operation.context.origin === "relay") {
       const role = operation.request.authorization?.role;
       if (!role) throw new Error("relay tool call is missing an account role");
       accountAccessGate.assert(role, operation.tool);
+      await operationAuthorizer?.authorize(operation);
     }
     return next(operation);
   };

package/src/local/worker-deployment.mjs

@@ -4,6 +4,7 @@ import path, { resolve } from "node:path";
 import { runWrangler } from "./shell.mjs";
 import { packageRoot, saveState } from "./state.mjs";
 import { withWorkerSecretsFile } from "./worker-secret-file.mjs";
+import { publicDeviceJwkJson } from "./device-identity.mjs";
 import {
   normalizeWorkerOrigin,
   retryWorkerHealth,
@@ -81,11 +82,11 @@ export function workerDeploymentFingerprint(state, options = {}) {
   const root = resolve(options.packageRoot || packageRoot);
   const keyMaterial = [
     String(state.worker.accountAdminSecret || ""),
-    String(state.worker.daemonSecret || ""),
+    publicDeviceJwkJson(state.worker.deviceIdentity),
     String(state.worker.oauthTokenVersion || ""),
   ].join("\0");
   const fingerprint = createHmac("sha256", keyMaterial);
-  fingerprint.update("mbm-worker-deploy-v3");
+  fingerprint.update("mbm-worker-deploy-v4");
   fingerprint.update(String(state.worker.name || ""));
   for (const file of workerDeployHashFiles(root)) {
     fingerprint.update(path.relative(root, file));
@@ -118,7 +119,7 @@ export function workerUrlMatchesName(workerUrl, workerName) {
 }
 
 function hasCompleteWorkerState(worker = {}) {
-  return Boolean(worker.url && worker.mcpServerUrl && worker.accountAdminSecret && worker.daemonSecret && worker.oauthTokenVersion && worker.name);
+  return Boolean(worker.url && worker.mcpServerUrl && worker.accountAdminSecret && worker.deviceIdentity && worker.oauthTokenVersion && worker.name);
 }
 
 function workerDeployHashFiles(root) {

package/src/local/worker-secret-file.mjs

@@ -3,6 +3,7 @@ import { lstatSync, readdirSync, unlinkSync } from "node:fs";
 import { resolve } from "node:path";
 import { createExclusiveFileSync } from "./exclusive-file.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
+import { publicDeviceJwkJson } from "./device-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync } from "./secure-file.mjs";
 
 const SECRET_FILE_PATTERN = /^worker-secrets-(\d+)-(\d+)(?:-p(\d+))?(?:-([a-f0-9]+))?\.json$/;
@@ -17,7 +18,7 @@ export async function withWorkerSecretsFile(state, callback, options = {}) {
   const tempPath = resolve(dir, `worker-secrets-${process.pid}-${createdAt}-p${processStartedAt}-${random}.json`);
   const payload = {
     ACCOUNT_ADMIN_SECRET: state.worker.accountAdminSecret,
-    DAEMON_SHARED_SECRET: state.worker.daemonSecret,
+    DAEMON_DEVICE_PUBLIC_KEY: publicDeviceJwkJson(state.worker.deviceIdentity),
     OAUTH_TOKEN_VERSION: state.worker.oauthTokenVersion,
   };
 

package/src/shared/admin-auth.d.mts

@@ -0,0 +1,10 @@
+export const ADMIN_AUTH_SCHEME: "hmac-sha256-v1";
+export const ADMIN_AUTH_TTL_SECONDS: number;
+export function adminAuthTranscript(input: {
+  origin: unknown;
+  method: unknown;
+  pathname: unknown;
+  bodyHash: unknown;
+  issuedAt: unknown;
+  nonce: unknown;
+}): string;

package/src/shared/admin-auth.mjs

@@ -0,0 +1,36 @@
+export const ADMIN_AUTH_SCHEME = "hmac-sha256-v1";
+export const ADMIN_AUTH_TTL_SECONDS = 5 * 60;
+
+export function adminAuthTranscript(input = {}) {
+  const origin = requiredOrigin(input.origin);
+  const method = requiredToken(input.method, "method", /^[A-Z]{3,10}$/);
+  const pathname = requiredToken(input.pathname, "pathname", /^\/[A-Za-z0-9/_-]{1,255}$/);
+  const bodyHash = requiredToken(input.bodyHash, "body hash", /^[a-f0-9]{64}$/);
+  const issuedAt = requiredInteger(input.issuedAt, "issued at");
+  const nonce = requiredToken(input.nonce, "nonce", /^[A-Za-z0-9_-]{32,128}$/);
+  return [ADMIN_AUTH_SCHEME, origin, method, pathname, bodyHash, issuedAt, nonce].join("\0");
+}
+
+
+function requiredOrigin(value) {
+  let url;
+  try { url = new URL(String(value || "")); } catch { throw new Error("admin authentication origin is invalid"); }
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("admin authentication origin is invalid");
+  }
+  return url.origin;
+}
+
+function requiredToken(value, label, pattern) {
+  const text = String(value || "");
+  if (!pattern.test(text)) throw new Error(`admin authentication ${label} is invalid`);
+  return text;
+}
+
+function requiredInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error(`admin authentication ${label} is invalid`);
+  return String(number);
+}