machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/local/cli-options.mjs

@@ -3,10 +3,10 @@ import { normalizeLogLevel } from "./log.mjs";
 const BOOLEAN_OPTIONS = new Set([
   "help", "version", "quiet", "json", "verbose", "rotateSecrets", "forceWorker",
   "daemonOnly", "noAutostart", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
-  "yes", "keepWorker", "allowInsecurePermissions", "showPaths", "full",
+  "yes", "keepWorker", "allowInsecurePermissions", "showPaths",
 ]);
 const VALUE_OPTIONS = new Set([
-  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "account", "duration", "logLevel", "logFormat",
+  "workspace", "stateDir", "workerName", "profile", "execMode", "client", "logLevel", "logFormat",
 ]);
 
 const LOG_FORMATS = new Set(["text", "json"]);
@@ -17,6 +17,10 @@ const COMMAND_OPTIONS = new Map(Object.entries({
     "daemonOnly", "noAutostart",
     "profile", "execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
   ]),
+  activate: new Set([
+    "workspace", "stateDir", "workerName", "quiet", "json", "verbose", "logLevel", "logFormat", "rotateSecrets", "forceWorker",
+    "profile", "execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths",
+  ]),
   stdio: new Set(["workspace", "stateDir", "profile", "execMode", "noWrite", "noExec", "fullEnv", "unrestrictedPaths", "absolutePaths", "verbose", "quiet", "logLevel", "logFormat"]),
   "client-config": new Set(["workspace", "stateDir", "profile", "client", "json"]),
   status: new Set(["workspace", "stateDir"]),
@@ -28,21 +32,19 @@ const COMMAND_OPTIONS = new Map(Object.entries({
   autostart: new Set(["workspace", "stateDir", "quiet"]),
   resource: new Set(["workspace", "stateDir", "allowInsecurePermissions", "showPaths", "json"]),
   account: new Set(["workspace", "stateDir", "json", "yes"]),
-  approval: new Set(["workspace", "stateDir", "json", "yes", "client", "account", "duration", "full"]),
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
 }));
 
-const SINGLE_WORKSPACE_POSITIONAL_COMMANDS = new Set(["start", "stdio", "status", "doctor", "full-test", "rotate-secrets"]);
+const SINGLE_WORKSPACE_POSITIONAL_COMMANDS = new Set(["start", "activate", "stdio", "status", "doctor", "full-test", "rotate-secrets"]);
 const STATIC_POSITIONAL_RULES = new Map([
   ["client-config", Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" })],
   ["uninstall", Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" })],
 ]);
 const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
-const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
-const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
-const APPROVAL_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, approve: 2, grant: 2, revoke: 2, clear: 1 }));
+const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, submit: 2 }));
+const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, clients: 1, "revoke-client": 2, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
 const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
@@ -50,7 +52,7 @@ const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   },
   service(args) {
     const action = String(args._[0] || "status");
-    return { max: ["install", "status", "stop", "uninstall", "remove"].includes(action) ? 2 : 1, tooMany: `service ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
+    return { max: ["install", "status", "stop"].includes(action) ? 2 : 1, tooMany: `service ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
   },
   autostart(args) { return ACTION_POSITIONAL_RULES.get("service")(args); },
   resource(args) {
@@ -61,17 +63,14 @@ const ACTION_POSITIONAL_RULES = new Map(Object.entries({
     const action = String(args._[0] || "list");
     return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
-  approval(args) {
-    const action = String(args._[0] || "list");
-    return { max: APPROVAL_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `approval ${action} received too many positional arguments` };
-  },
   browser(args) {
     const action = String(args._[0] || "status");
     return { max: 1, tooMany: `browser ${action} received too many positional arguments` };
   },
   job(args) {
     const action = String(args._[0] || "list");
-    return { max: JOB_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `job ${action} received too many positional arguments` };
+    const max = JOB_POSITIONAL_LIMITS.get(action);
+    return max === undefined ? null : { max, tooMany: `job ${action} received too many positional arguments` };
   },
 }));
 

package/src/local/cli-ready-output.mjs

@@ -0,0 +1,52 @@
+import { createLogger } from "./log.mjs";
+
+export function printStartJson(state, { requestedChangesApplied = true, notice = "", initialOwner = null } = {}) {
+  createLogger({ component: "ready" }).json({
+    mcp: {
+      server_url: state.worker.mcpServerUrl,
+      worker_url: state.worker.url,
+      worker_name: state.worker.name,
+    },
+    ...(initialOwner ? { initial_owner: initialOwner } : {}),
+    workspace: state.workspace.path,
+    state_path: state.paths.statePath,
+    policy: state.policy,
+    requested_changes_applied: requestedChangesApplied,
+    ...(notice ? { notice } : {}),
+  });
+}
+
+export function printMcpConnection(state, { quiet = false, verbose = false, initialOwner = null, logger: readyLogger = null } = {}) {
+  const output = readyLogger || createLogger({ component: "ready", quiet, level: quiet ? "error" : verbose ? "debug" : "info" });
+  if (output.format === "json" && !initialOwner) {
+    output.event("success", "daemon.ready", {
+      mcp_server_url: state.worker.mcpServerUrl,
+      worker_name: state.worker.name,
+      workspace_path: state.workspace.path,
+      policy_profile: state.policy.profile,
+      policy_origin: state.policy.origin,
+      write_enabled: state.policy.allowWrite,
+      exec_mode: state.policy.execMode,
+    }, "Remote MCP bridge is ready");
+    return;
+  }
+  const logger = output;
+  logger.success("Remote MCP bridge is ready");
+  logger.plain(`  MCP Server URL: ${state.worker.mcpServerUrl}`);
+  if (initialOwner) {
+    logger.warn("Initial owner account created; save the password now because it is not stored locally or shown again. Do not share this terminal output; rotate the password immediately if it has been exposed.");
+    logger.plain(`  Account: ${initialOwner.name}`);
+    logger.plain(`  Password: ${initialOwner.password}`);
+  } else {
+    logger.safePlain("  Use `machine-mcp account` to manage account access.");
+  }
+  logger.plain(`  Workspace: ${state.workspace.path}`);
+  logger.safePlain(`  Policy: ${formatPolicySummary(state.policy)}`);
+  if (verbose) logger.plain(`  State: ${state.paths.statePath}`);
+}
+
+export function formatPolicySummary(policy = {}) {
+  const scope = policy.unrestrictedPaths ? "all local paths" : "workspace only";
+  const environment = policy.minimalEnv ? "isolated env" : "full parent env";
+  return `${policy.profile || "custom"} [${policy.origin || "unknown"}; write=${policy.allowWrite ? "on" : "off"}; exec=${policy.execMode || "off"}; ${scope}; ${environment}; absolute_paths=${policy.exposeAbsolutePaths ? "on" : "off"}]`;
+}

package/src/local/cli-service.mjs

@@ -3,12 +3,16 @@ import * as defaultService from "./service.mjs";
 import { inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
 import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
 import { serviceEnvironmentSummary } from "./service-environment.mjs";
+import { scheduleServiceRestart } from "./service-restart-scheduler.mjs";
+import { startOwnedServiceRuntime } from "./service-runtime.mjs";
+import { loadServiceOwner } from "./service-owner.mjs";
 import { loadState, resolveWorkspace, selectedWorkspace } from "./state.mjs";
 
 const SERVICE_ACTION_HANDLERS = new Map([
   ["status", serviceStatusAction],
   ["install", serviceInstallAction],
   ["start", serviceStartAction],
+  ["restart", serviceRestartAction],
   ["stop", serviceStopAction],
   ["uninstall", serviceUninstallAction],
   ["remove", serviceUninstallAction],
@@ -19,11 +23,18 @@ export function createServiceCommand(dependencies) {
     chooseWorkspace: requiredFunction(dependencies.chooseWorkspace, "chooseWorkspace"),
     stateRootFromArgs: requiredFunction(dependencies.stateRootFromArgs, "stateRootFromArgs"),
     structuredLogger: requiredFunction(dependencies.structuredLogger, "structuredLogger"),
+    currentPackageVersion: requiredFunction(dependencies.currentPackageVersion, "currentPackageVersion"),
     service: dependencies.service || defaultService,
     inspectWorkspaceDaemon: dependencies.inspectWorkspaceDaemon || inspectWorkspaceDaemon,
     stopWorkspaceServiceDaemon: dependencies.stopWorkspaceServiceDaemon || stopWorkspaceServiceDaemon,
     stopAndRemoveAutostart: dependencies.stopAndRemoveAutostart || stopAndRemoveAutostart,
     serviceEnvironmentSummary: dependencies.serviceEnvironmentSummary || serviceEnvironmentSummary,
+    loadServiceOwner: dependencies.loadServiceOwner || loadServiceOwner,
+    scheduleServiceRestart: dependencies.scheduleServiceRestart || scheduleServiceRestart,
+    startOwnedServiceRuntime: dependencies.startOwnedServiceRuntime || startOwnedServiceRuntime,
+    acquireMachineServiceLockWithWait: requiredFunction(
+      dependencies.acquireMachineServiceLockWithWait, "acquireMachineServiceLockWithWait",
+    ),
     loadState: dependencies.loadState || loadState,
     resolveWorkspace: dependencies.resolveWorkspace || resolveWorkspace,
     selectedWorkspace: dependencies.selectedWorkspace || selectedWorkspace,
@@ -39,19 +50,46 @@ async function serviceCommand(args, context) {
   const handler = SERVICE_ACTION_HANDLERS.get(action);
   if (!handler) throw new Error(`Unknown service action: ${action}`);
   const stateRoot = context.stateRootFromArgs(args);
-  return handler({ args, stateRoot, service: context.service, context });
+  if (!new Set(["install", "start", "stop", "uninstall", "remove"]).has(action)) {
+    return handler({ args, stateRoot, service: context.service, context });
+  }
+  const lock = await context.acquireMachineServiceLockWithWait({ operation: `service-${action}` });
+  if (!lock?.acquired || typeof lock.release !== "function") {
+    throw new Error("machine-service operation lock could not be acquired");
+  }
+  try {
+    return await handler({ args, stateRoot, service: context.service, context });
+  } finally {
+    lock.release();
+  }
 }
 
 async function serviceStatusAction({ args, stateRoot, service, context }) {
   const status = await service.autostartStatus();
-  const state = optionalServiceState(args, stateRoot, context);
-  const workspaceDaemon = state ? context.inspectWorkspaceDaemon(state) : null;
+  let owner = null;
+  let ownerProjection = { status: "missing", version: null };
+  try {
+    owner = context.loadServiceOwner();
+    if (owner) ownerProjection = { status: owner.status, version: owner.version };
+  } catch {
+    ownerProjection = { status: "invalid", version: null, error_class: "invalid_state" };
+  }
+  const explicitState = hasExplicitServiceTarget(args) ? optionalServiceState(args, stateRoot, context) : null;
+  const ownerState = !explicitState && owner?.status === "committed"
+    ? context.loadState(owner.workspace, { stateDir: owner.stateRoot })
+    : null;
+  const state = explicitState || ownerState || optionalServiceState(args, stateRoot, context);
+  const effectiveStateRoot = ownerState ? owner.stateRoot : stateRoot;
+  const workspaceDaemon = state ? context.inspectWorkspaceDaemon(state, ownerState ? {
+    expectedVersion: owner.version, expectedEntryScript: owner.entryScript,
+  } : {}) : null;
   printServiceResult({
     ...status,
     workspace: state?.workspace?.path || null,
     workspace_daemon: workspaceDaemon,
-    service_environment: context.serviceEnvironmentSummary(stateRoot),
-    effective_active: Boolean(status.active || workspaceDaemon?.alive),
+    service_owner: ownerProjection,
+    service_environment: context.serviceEnvironmentSummary(effectiveStateRoot),
+    effective_active: status.active === true || workspaceDaemon?.alive === true ? true : status.active === false ? false : null,
     orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
   }, context, false);
 }
@@ -63,24 +101,49 @@ async function serviceInstallAction({ args, stateRoot, service, context }) {
   if (!state.worker?.url) {
     throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
   }
+  const provider = await service.autostartStatus();
+  const daemon = context.inspectWorkspaceDaemon(state);
+  if (typeof provider?.active !== "boolean") {
+    throw new Error("machine service activity could not be verified before installation");
+  }
+  if (provider.active || daemon?.alive) {
+    throw new Error("refusing to replace the machine service definition while a provider or workspace daemon is active");
+  }
   const result = await service.installAutostart({
     workspace,
     stateRoot,
     entryScript: context.entryScript,
+    version: context.currentPackageVersion(),
     logger: context.structuredLogger(Boolean(args.quiet)),
   });
   printServiceResult(result, context);
 }
 
 async function serviceStartAction({ args, service, context }) {
-  const result = await service.startAutostart({ logger: context.structuredLogger(Boolean(args.quiet)) });
+  assertGlobalServiceAction(args, "start");
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const result = await context.startOwnedServiceRuntime({
+    logger,
+    readProvider: service.autostartStatus,
+    mutateProvider: service.startAutostart,
+    stopProvider: service.stopAutostart,
+  });
   printServiceResult(result, context);
 }
 
+async function serviceRestartAction({ args, context }) {
+  assertGlobalServiceAction(args, "restart");
+  const result = await context.scheduleServiceRestart();
+  printServiceResult({ ...result, provider: "detached-handoff", reason: "restart_scheduled" }, context);
+}
+
 async function serviceStopAction({ args, stateRoot, service, context }) {
   const logger = context.structuredLogger(Boolean(args.quiet));
-  const provider = await service.stopAutostart({ logger });
   const state = optionalServiceState(args, stateRoot, context);
+  const status = await service.autostartStatus();
+  const before = state ? context.inspectWorkspaceDaemon(state) : null;
+  assertExplicitStopTarget(args, status, before);
+  const provider = await service.stopAutostart({ logger });
   const workspaceDaemon = state
     ? await context.stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
     : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
@@ -92,16 +155,17 @@ async function serviceStopAction({ args, stateRoot, service, context }) {
   }, context);
 }
 
-async function serviceUninstallAction({ args, stateRoot, service, context }) {
+async function serviceUninstallAction({ args, stateRoot, context }) {
+  assertGlobalServiceAction(args, "uninstall");
   const logger = context.structuredLogger(Boolean(args.quiet));
-  const state = optionalServiceState(args, stateRoot, context);
+  const state = optionalServiceState({ ...args, workspace: undefined, stateDir: undefined }, stateRoot, context);
   const lifecycle = await context.stopAndRemoveAutostart({
     states: state ? [state] : [],
     stateRoot,
     logger,
     reason: "service uninstall",
-    stopAutostart: service.stopAutostart,
-    uninstallAutostart: service.uninstallAutostart,
+    stopAutostart: context.service.stopAutostart,
+    uninstallAutostart: context.service.uninstallAutostart,
     stopWorkspaceServiceDaemon: context.stopWorkspaceServiceDaemon,
   });
   printServiceResult({
@@ -112,6 +176,22 @@ async function serviceUninstallAction({ args, stateRoot, service, context }) {
   }, context);
 }
 
+function assertGlobalServiceAction(args, action) {
+  if (args.workspace || args.stateDir || args._[1]) {
+    throw new Error(`service ${action} acts on the single installed machine service and does not accept workspace or state overrides; use service install to change its owner`);
+  }
+}
+
+function assertExplicitStopTarget(args, status, workspaceDaemon) {
+  if (!hasExplicitServiceTarget(args) || status?.active !== true) return;
+  if (workspaceDaemon?.alive === true && workspaceDaemon?.verified_service_daemon === true) return;
+  throw new Error("refusing to stop the active machine service because the requested workspace/state does not own its verified daemon; omit the target to stop the installed service globally");
+}
+
+function hasExplicitServiceTarget(args) {
+  return Boolean(args.workspace || args.stateDir || args._[1]);
+}
+
 function optionalServiceState(args, stateRoot, context) {
   const requested = args.workspace || args._[1] || context.selectedWorkspace(stateRoot);
   if (!requested || requested === true) return null;