machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/local/npm-cli.mjs

@@ -0,0 +1,42 @@
+import { realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+export function resolveNpmCli(options = {}) {
+  const env = options.env && typeof options.env === "object" ? options.env : process.env;
+  const nodeExecutable = path.resolve(String(options.nodeExecutable || process.execPath));
+  const nodeDirectory = path.dirname(nodeExecutable);
+  const packageManagerPrefix = nodePackageManagerPrefix(nodeExecutable);
+  const candidates = [
+    options.npmCli,
+    ...(options.allowLifecycleNpmCli === false ? [] : [env.npm_execpath]),
+    path.resolve(nodeDirectory, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    path.join(nodeDirectory, "node_modules", "npm", "bin", "npm-cli.js"),
+    packageManagerPrefix && path.join(packageManagerPrefix, "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    ...(options.allowFallbackLocations === false ? [] : [
+      env.ProgramFiles && path.join(env.ProgramFiles, "nodejs", "node_modules", "npm", "bin", "npm-cli.js"),
+      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, "Programs", "nodejs", "node_modules", "npm", "bin", "npm-cli.js"),
+      "/opt/homebrew/lib/node_modules/npm/bin/npm-cli.js",
+      "/usr/local/lib/node_modules/npm/bin/npm-cli.js",
+      "/usr/lib/node_modules/npm/bin/npm-cli.js",
+    ]),
+  ].filter(Boolean);
+  for (const candidate of candidates) {
+    if (!path.isAbsolute(String(candidate))) continue;
+    try {
+      const canonical = realpathSync(String(candidate));
+      const info = statSync(canonical);
+      if (!info.isFile()) continue;
+      if (process.platform !== "win32" && (Number(info.mode) & 0o022) !== 0) continue;
+      return canonical;
+    } catch {
+      // Candidate discovery is bounded and failure of one conventional location is irrelevant.
+    }
+  }
+  throw new Error("npm 12 CLI could not be located; install npm 12 alongside Node.js 26 and retry");
+}
+
+function nodePackageManagerPrefix(nodeExecutable) {
+  const marker = `${path.sep}Cellar${path.sep}`;
+  const index = nodeExecutable.indexOf(marker);
+  return index > 0 ? nodeExecutable.slice(0, index) : "";
+}

package/src/local/npm-environment.mjs

@@ -0,0 +1,37 @@
+const NESTED_NPM_MODE_KEYS = new Set([
+  "npm_config_global_style",
+  "npm_config_install_strategy",
+  "npm_config_strict_peer_deps",
+  "npm_config_legacy_peer_deps",
+  "npm_config_force",
+  "npm_config_shrinkwrap",
+  "npm_config_package_lock",
+  "npm_config_parseable",
+  "npm_config_json",
+  "npm_config_if_present",
+  "npm_config_dry_run",
+  "npm_config_global",
+  "npm_config_prefix",
+  "npm_config_workspace",
+  "npm_config_workspaces",
+  "npm_config_ignore_scripts",
+  "npm_config_package_lock_only",
+  "npm_config_omit",
+  "npm_config_include",
+  "npm_config_production",
+  "npm_config_save",
+  "npm_config_save_dev",
+  "npm_config_save_optional",
+  "npm_config_save_peer",
+]);
+
+export function nestedNpmEnvironment(environment = process.env) {
+  if (!environment || typeof environment !== "object" || Array.isArray(environment)) {
+    throw new TypeError("nested npm environment must be an environment record");
+  }
+  const result = { ...environment };
+  for (const key of Object.keys(result)) {
+    if (NESTED_NPM_MODE_KEYS.has(key.toLowerCase())) delete result[key];
+  }
+  return result;
+}

package/src/local/operation-authorization.mjs

@@ -1,24 +1,12 @@
-import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
+import { createHmac, randomBytes } from "node:crypto";
 import path from "node:path";
+import accessContract from "../shared/access-contract.json" with { type: "json" };
 import { BridgeError } from "./errors.mjs";
 import { OPERATION_APPROVAL_SCOPES, classifyOperation } from "./operation-risk.mjs";
-import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
-import { withOperationStateLock } from "./operation-state-lock.mjs";
-import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
-
-const SCHEMA_VERSION = 1;
-const MAX_STATE_BYTES = 256 * 1024;
-const MAX_PENDING = 100;
-const MAX_LEASES = 256;
-const PENDING_TTL_SECONDS = 10 * 60;
-const DEFAULT_LEASE_SECONDS = 60 * 60;
-const MAX_LEASE_SECONDS = 12 * 60 * 60;
-const FULL_MAX_LEASE_SECONDS = 8 * 60 * 60;
 
 export { OPERATION_APPROVAL_SCOPES, classifyOperation };
 
-const SCOPE_SET = new Set(OPERATION_APPROVAL_SCOPES);
+const OWNER_ONLY_TOOLS = new Set((accessContract.ownerOnlyTools || []).map(String));
 
 export class OperationAuthorizer {
   constructor(options = {}) {
@@ -26,341 +14,97 @@ export class OperationAuthorizer {
     this.root = options.root ? path.resolve(String(options.root)) : "";
     this.resolveExistingPath = options.resolveExistingPath;
     this.resolveWritePath = options.resolveWritePath;
+    this.protectedRoots = Array.isArray(options.protectedRoots) ? options.protectedRoots.filter(Boolean).map((value) => path.resolve(String(value))) : [];
+    this.auditTargetKey = Buffer.from(options.auditTargetKey || randomBytes(32));
     this.now = typeof options.now === "function" ? options.now : Date.now;
-    this.queue = Promise.resolve();
   }
 
   async authorize(operation) {
-    if (operation?.context?.origin !== "relay") return { allowed: true, source: "local" };
-    const authorization = operation.request?.authorization;
-    const accountId = String(authorization?.account_id || "");
-    const clientId = String(authorization?.client_id || "");
-    const role = String(authorization?.role || "").trim().toLowerCase();
-    if (!/^acct_[A-Za-z0-9_-]{20,96}$/.test(accountId) || !/^mcp_client_[A-Za-z0-9_-]{43}$/.test(clientId)) {
-      throw new BridgeError("authorization_denied", "relay operation is missing authenticated client identity");
+    if (operation?.context?.origin !== "relay") {
+      return { allowed: true, source: "local", category: "local operation", scopes: [], targetHash: "" };
+    }
+    const authority = operation.context?.authority;
+    const principal = authority?.principal;
+    if (!authority || principal?.kind !== "account") {
+      throw new BridgeError("authorization_denied", "relay operation is missing effective authority context");
     }
-    if (role === "owner") {
-      return {
-        allowed: true,
-        source: "authenticated-owner",
-        accountId,
-        clientId,
+    if (!authority.owner && OWNER_ONLY_TOOLS.has(operation.tool)) {
+      operation.context.operationAuthorization = {
+        allowed: false,
+        source: "role-ceiling",
+        category: "owner-only tool",
+        scopes: [],
+        targetHash: "",
       };
+      throw new BridgeError("authorization_denied", `account role ${principal.role} cannot use owner-only tool ${operation.tool}`, {
+        details: { reason: "account_role_owner_only_tool_ceiling", tool: operation.tool, role: principal.role },
+      });
     }
     const requirement = await classifyOperation(operation.tool, operation.args, {
       workspace: this.workspace,
-      resolveExistingPath: this.resolveExistingPath,
-      resolveWritePath: this.resolveWritePath,
+      resolveExistingPath: (value) => this.resolveExistingPath(value, operation.context),
+      resolveWritePath: (value) => this.resolveWritePath(value, operation.context),
     });
-    if (!requirement) return { allowed: true, source: "automatic" };
-    if (!this.root) throw new BridgeError("authorization_denied", "local operation approval storage is unavailable");
-
-    const requiredScopes = normalizeScopes(requirement.scopes || [requirement.scope]);
-    const matches = matchingLeases(this.root, { accountId, clientId, scopes: requiredScopes }, this.now());
-    const missingScopes = requiredScopes.filter((scope) => !matches.byScope.has(scope));
-    if (!missingScopes.length) {
-      const leaseIds = [...new Set(matches.leases.map((lease) => lease.id))];
-      return {
-        allowed: true,
-        source: "lease",
-        leaseId: leaseIds[0],
-        leaseIds,
-        scope: requiredScopes[0],
-        scopes: requiredScopes,
-      };
+    const decision = operationDecision(requirement, authority, this.auditTargetKey);
+    operation.context.operationAuthorization = { ...decision, allowed: false };
+    if (requirement && requirement.canonicalTargets?.some((target) => this.protectedRoots.some((root) => isWithinRoot(root, target)))) {
+      throw new BridgeError("authorization_denied", "Machine Bridge control-plane state cannot be accessed through generic path-based remote tools", {
+        details: { reason: "control_plane_state_protected", tool: operation.tool },
+      });
     }
-
-    const pending = await this.enqueue(() => recordPendingApproval(this.root, {
-      accountId,
-      clientId,
-      tool: operation.tool,
-      scopes: missingScopes,
-      category: requirement.category,
-      targetHash: requirement.targetHash,
-    }, this.now()));
-    const scopeText = missingScopes.join(", ");
-    throw new BridgeError(
-      "authorization_denied",
-      `local approval required for ${requirement.category} (${scopeText}); approve the missing scopes with: machine-mcp approval approve ${pending.id} --duration 1h; or open an explicit temporary full window with: machine-mcp approval approve ${pending.id} --full`,
-      {
-        retryable: true,
-        details: {
-          reason: "local_approval_required",
-          approval_id: pending.id,
-          scope: missingScopes[0],
-          scopes: missingScopes,
-          required_scopes: requiredScopes,
-          expires_at: pending.expires_at,
-          approve_command: `machine-mcp approval approve ${pending.id} --duration 1h`,
-          full_command: `machine-mcp approval approve ${pending.id} --full`,
-        },
-      },
-    );
-  }
-
-  enqueue(callback) {
-    const result = this.queue.then(callback, callback);
-    this.queue = result.then(() => undefined, () => undefined);
-    return result;
+    if (requirement) assertRequirementWithinAuthority(requirement, authority, operation.tool);
+    return { ...decision, allowed: true };
   }
 }
 
-export function listOperationApprovals(root, now = Date.now()) {
+function operationDecision(requirement, authority, auditTargetKey) {
   return {
-    leases: currentLeases(root, now),
-    pending: currentPending(root, now),
+    source: authority.owner ? "trusted-owner" : "role-ceiling",
+    category: requirement?.category || "ordinary operation",
+    scopes: requirement ? normalizeScopes(requirement.scopes || [requirement.scope]) : [],
+    targetHash: requirement ? auditTargetFingerprint(auditTargetKey, requirement.targetHash) : "",
   };
 }
 
-export async function approvePendingOperation(root, pendingId, duration = "1h", now = Date.now(), scopeOverride = "") {
-  if (scopeOverride && scopeOverride !== "full") throw new Error("pending approval scopes may only be elevated to full");
-  return withOperationStateLock(root, async () => {
-    const pendingState = readPendingState(root);
-    const leaseState = readLeaseState(root);
-    const current = epochSeconds(now);
-    const pending = pendingState.pending.find((entry) => entry.id === String(pendingId || "") && entry.expires_at > current);
-    if (!pending) throw new Error("pending approval was not found or has expired");
-    const scopes = scopeOverride ? [scopeOverride] : pending.scopes;
-    let lease = leaseState.leases.find((entry) => entry.source_approval_id === pending.id && entry.expires_at > current);
-    if (!lease) {
-      lease = appendLease(leaseState, {
-        accountId: pending.account_id,
-        clientId: pending.client_id,
-        scopes,
-        duration,
-        sourceApprovalId: pending.id,
-      }, now);
-      writeJson(leasePath(root), leaseState);
-    }
-    pendingState.pending = pendingState.pending.filter((entry) => entry.id !== pending.id && entry.expires_at > current);
-    writeJson(pendingPath(root), pendingState);
-    return lease;
-  });
-}
-
-export async function grantOperationLease(root, { accountId = "*", clientId, scope, duration = "1h" }, now = Date.now()) {
-  if (!/^mcp_client_[A-Za-z0-9_-]{43}$/.test(String(clientId || "")) && clientId !== "*") {
-    throw new Error("approval grant requires a valid OAuth client id or *");
-  }
-  if (accountId !== "*" && !/^acct_[A-Za-z0-9_-]{20,96}$/.test(String(accountId || ""))) {
-    throw new Error("approval account id is invalid");
-  }
-  return withOperationStateLock(root, async () => {
-    const state = readLeaseState(root);
-    const lease = appendLease(state, { accountId, clientId, scopes: [scope], duration }, now);
-    writeJson(leasePath(root), state);
-    return lease;
-  });
+function auditTargetFingerprint(key, value) {
+  return createHmac("sha256", key).update(String(value || "")).digest("hex");
 }
 
-export async function revokeOperationLease(root, leaseId, now = Date.now()) {
-  return withOperationStateLock(root, async () => {
-    const state = readLeaseState(root);
-    const current = epochSeconds(now);
-    const requested = String(leaseId || "");
-    const removed = state.leases.some((lease) => lease.id === requested && lease.expires_at > current);
-    const before = state.leases.length;
-    state.leases = state.leases.filter((lease) => lease.expires_at > current && lease.id !== requested);
-    if (state.leases.length !== before) writeJson(leasePath(root), state);
-    return removed;
-  });
+function normalizeScopes(scopes) {
+  const requested = new Set((Array.isArray(scopes) ? scopes : []).map((scope) => String(scope || "")));
+  return OPERATION_APPROVAL_SCOPES.filter((scope) => requested.has(scope));
 }
 
-export async function clearOperationLeases(root) {
-  return withOperationStateLock(root, async () => {
-    writeJson(leasePath(root), emptyLeaseState());
-  });
+function isWithinRoot(root, target) {
+  const relative = path.relative(path.resolve(root), path.resolve(target));
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
 }
 
-export function parseApprovalDuration(value, scopes = "") {
-  const text = String(value || "1h").trim().toLowerCase();
-  const match = /^(\d+)(m|h)$/.exec(text);
-  if (!match) throw new Error("approval duration must use minutes or hours, for example 30m or 2h");
-  const seconds = Number(match[1]) * (match[2] === "h" ? 3600 : 60);
-  const normalizedScopes = normalizeScopes(Array.isArray(scopes) ? scopes : [scopes]);
-  const maximum = normalizedScopes.includes("full") ? FULL_MAX_LEASE_SECONDS : MAX_LEASE_SECONDS;
-  if (!Number.isSafeInteger(seconds) || seconds < 60 || seconds > maximum) {
-    throw new Error(`approval duration must be between 1m and ${maximum / 3600}h`);
+function assertRequirementWithinAuthority(requirement, authority, tool) {
+  const scopes = normalizeScopes(requirement.scopes || [requirement.scope]);
+  const policy = authority.effectivePolicy;
+  const role = authority.principal.role;
+  if (scopes.includes("full") && !authority.owner) {
+    throw new BridgeError("authorization_denied", "full authority is reserved for the owner account");
   }
-  return seconds;
-}
-
-async function recordPendingApproval(root, input, now) {
-  return withOperationStateLock(root, async () => {
-    const state = readPendingState(root);
-    const current = epochSeconds(now);
-    const scopes = normalizeScopes(input.scopes);
-    state.pending = state.pending.filter((entry) => entry.expires_at > current);
-    const existing = state.pending.find((entry) => (
-      entry.account_id === input.accountId
-      && entry.client_id === input.clientId
-      && sameScopes(entry.scopes, scopes)
-      && entry.target_hash === input.targetHash
-    ));
-    if (existing) return existing;
-    const pending = {
-      id: `approval_${randomBytes(18).toString("base64url")}`,
-      account_id: input.accountId,
-      client_id: input.clientId,
-      tool: String(input.tool).slice(0, 128),
-      scopes,
-      category: String(input.category).slice(0, 160),
-      target_hash: input.targetHash,
-      created_at: current,
-      expires_at: current + PENDING_TTL_SECONDS,
-    };
-    state.pending.push(pending);
-    state.pending = state.pending.slice(-MAX_PENDING);
-    writeJson(pendingPath(root), state);
-    return pending;
-  });
-}
-
-function appendLease(state, input, now) {
-  const scopes = normalizeScopes(input.scopes);
-  if (!scopes.length) throw new Error("capability lease requires at least one known scope");
-  if (scopes.includes("full") && scopes.length !== 1) throw new Error("full capability lease cannot be combined with narrower scopes");
-  const seconds = parseApprovalDuration(input.duration || `${DEFAULT_LEASE_SECONDS / 3600}h`, scopes);
-  const current = epochSeconds(now);
-  state.leases = state.leases.filter((lease) => lease.expires_at > current);
-  if (state.leases.length >= MAX_LEASES) throw new Error(`operation capability leases exceed the maximum of ${MAX_LEASES}`);
-  const lease = {
-    id: `lease_${randomBytes(18).toString("base64url")}`,
-    account_id: String(input.accountId || "*"),
-    client_id: String(input.clientId || ""),
-    scopes,
-    created_at: current,
-    expires_at: current + seconds,
-    ...(input.sourceApprovalId ? { source_approval_id: String(input.sourceApprovalId) } : {}),
-  };
-  state.leases.push(lease);
-  return lease;
-}
-
-function matchingLeases(root, input, now) {
-  const current = epochSeconds(now);
-  const candidates = currentLeases(root, now).filter((lease) => (
-    (lease.account_id === "*" || lease.account_id === input.accountId)
-    && (lease.client_id === "*" || lease.client_id === input.clientId)
-    && lease.expires_at > current
-  ));
-  const byScope = new Map();
-  for (const scope of input.scopes) {
-    const lease = candidates.find((entry) => entry.scopes.includes("full") || entry.scopes.includes(scope));
-    if (lease) byScope.set(scope, lease);
+  if ((scopes.includes("external-read") || scopes.includes("external-write")) && !policy.unrestrictedPaths) {
+    throw new BridgeError("authorization_denied", `account role ${role} is confined to the selected workspace`, {
+      details: { reason: "account_role_path_ceiling", tool, role },
+    });
   }
-  return { byScope, leases: [...byScope.values()] };
-}
-
-function currentLeases(root, now) {
-  const current = epochSeconds(now);
-  return readLeaseState(root).leases.filter((lease) => lease.expires_at > current);
-}
-
-function currentPending(root, now) {
-  const current = epochSeconds(now);
-  return readPendingState(root).pending.filter((entry) => entry.expires_at > current);
-}
-
-function readLeaseState(root) {
-  return readState(leasePath(root), emptyLeaseState, "leases", validLease);
-}
-
-function readPendingState(root) {
-  return readState(pendingPath(root), emptyPendingState, "pending", validPending);
-}
-
-function readState(file, empty, arrayKey, validEntry) {
-  if (!existsSync(file)) return empty();
-  const raw = readBoundedRegularFileSync(file, MAX_STATE_BYTES, "operation approval state");
-  let parsed;
-  try { parsed = JSON.parse(raw.toString("utf8")); } catch (error) {
-    throw new Error("operation approval state is not valid JSON", { cause: error });
+  if ((scopes.includes("sensitive-read") || scopes.includes("sensitive-write") || scopes.includes("credential-operation")) && !authority.owner) {
+    throw new BridgeError("authorization_denied", `account role ${role} cannot access credential or persistence-sensitive targets`, {
+      details: { reason: "account_role_sensitive_ceiling", tool, role },
+    });
   }
-  if (
-    !parsed
-    || typeof parsed !== "object"
-    || Array.isArray(parsed)
-    || parsed.schemaVersion !== SCHEMA_VERSION
-    || !Array.isArray(parsed[arrayKey])
-    || !parsed[arrayKey].every(validEntry)
-  ) {
-    throw new Error("operation approval state schema is invalid");
+  if (scopes.includes("shell") && !policy.allowExec) {
+    throw new BridgeError("authorization_denied", `account role ${role} cannot execute local processes`, {
+      details: { reason: "account_role_execution_ceiling", tool, role },
+    });
+  }
+  if ((scopes.includes("browser-session") || scopes.includes("application-control") || scopes.includes("data-export")) && !authority.owner) {
+    throw new BridgeError("authorization_denied", `account role ${role} cannot control the owner browser or desktop session`, {
+      details: { reason: "account_role_interactive_ceiling", tool, role },
+    });
   }
-  return parsed;
-}
-
-function validLease(value) {
-  if (!plainRecord(value)) return false;
-  if (!/^lease_[A-Za-z0-9_-]{24}$/.test(value.id)) return false;
-  if (!validAccountBinding(value.account_id) || !validClientBinding(value.client_id)) return false;
-  if (!validScopes(value.scopes) || !validTimestampRange(value.created_at, value.expires_at)) return false;
-  const maximum = value.scopes.includes("full") ? FULL_MAX_LEASE_SECONDS : MAX_LEASE_SECONDS;
-  if (value.expires_at - value.created_at > maximum) return false;
-  return value.source_approval_id === undefined || /^approval_[A-Za-z0-9_-]{24}$/.test(value.source_approval_id);
-}
-
-function validPending(value) {
-  if (!plainRecord(value)) return false;
-  return /^approval_[A-Za-z0-9_-]{24}$/.test(value.id)
-    && validAccountBinding(value.account_id, false)
-    && validClientBinding(value.client_id, false)
-    && /^[a-z][a-z0-9_]{0,127}$/.test(value.tool)
-    && validScopes(value.scopes, false)
-    && typeof value.category === "string"
-    && value.category.length > 0
-    && value.category.length <= 160
-    && !/[\u0000-\u001f\u007f]/.test(value.category)
-    && /^[a-f0-9]{64}$/.test(value.target_hash)
-    && validTimestampRange(value.created_at, value.expires_at)
-    && value.expires_at - value.created_at === PENDING_TTL_SECONDS;
-}
-
-function validScopes(value, allowFull = true) {
-  if (!Array.isArray(value) || value.length < 1 || value.length > OPERATION_APPROVAL_SCOPES.length) return false;
-  if (value.some((scope) => !SCOPE_SET.has(scope))) return false;
-  if (!sameScopes(value, normalizeScopes(value))) return false;
-  if (!allowFull && value.includes("full")) return false;
-  return !value.includes("full") || value.length === 1;
-}
-
-function normalizeScopes(scopes) {
-  const requested = new Set((Array.isArray(scopes) ? scopes : []).map((scope) => String(scope || "")));
-  return OPERATION_APPROVAL_SCOPES.filter((scope) => requested.has(scope));
-}
-
-function sameScopes(left, right) {
-  return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((scope, index) => scope === right[index]);
-}
-
-function validAccountBinding(value, wildcard = true) {
-  return (wildcard && value === "*") || /^acct_[A-Za-z0-9_-]{20,96}$/.test(String(value || ""));
-}
-
-function validClientBinding(value, wildcard = true) {
-  return (wildcard && value === "*") || /^mcp_client_[A-Za-z0-9_-]{43}$/.test(String(value || ""));
-}
-
-function validTimestampRange(createdAt, expiresAt) {
-  return Number.isSafeInteger(createdAt)
-    && Number.isSafeInteger(expiresAt)
-    && createdAt > 0
-    && expiresAt > createdAt;
-}
-
-function plainRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function writeJson(file, value) {
-  ensureOwnerOnlyDirectorySync(path.dirname(file));
-  const content = `${JSON.stringify(value, null, 2)}\n`;
-  if (Buffer.byteLength(content) > MAX_STATE_BYTES) throw new Error("operation approval state exceeds its size limit");
-  replaceFileAtomicallySync(file, content, { mode: 0o600 });
 }
-
-function leasePath(root) { return path.join(path.resolve(root), "operation-leases.json"); }
-function pendingPath(root) { return path.join(path.resolve(root), "operation-pending.json"); }
-function emptyLeaseState() { return { schemaVersion: SCHEMA_VERSION, leases: [] }; }
-function emptyPendingState() { return { schemaVersion: SCHEMA_VERSION, pending: [] }; }
-function epochSeconds(value) { return Math.floor(Number(value) / 1000); }

package/src/local/operation-risk.mjs

@@ -18,6 +18,7 @@ export const OPERATION_APPROVAL_SCOPES = Object.freeze([
 const SHELL_TOOLS = new Set(["exec_command", "run_process", "start_process", "run_local_command", "read_process", "write_process", "kill_process"]);
 const PERSISTENT_TOOLS = new Set(["stage_job", "start_job", "list_jobs", "read_job", "cancel_job"]);
 const APPLICATION_CONTROL_TOOLS = new Set(["open_local_application", "inspect_local_application", "operate_local_application"]);
+const COMPUTER_USE_TOOLS = new Set(["computer_observe", "computer_act"]);
 const CREDENTIAL_TOOLS = new Set(["generate_ssh_key_resource"]);
 const BROWSER_PROFILE_TOOLS = new Set([
   "pair_browser_extension", "browser_list_tabs", "browser_manage_tabs", "browser_get_source",
@@ -27,16 +28,17 @@ const AUTOMATIC_TOOLS = new Set([
   "server_info", "project_overview", "list_local_applications", "browser_status", "list_roots",
   "diagnose_runtime", "list_local_resources",
 ]);
-const FILE_WRITE_TOOLS = new Set(["write_file", "edit_file"]);
+const FILE_WRITE_TOOLS = new Set(["write_file", "edit_file", "git_commit"]);
 const FILE_READ_TOOLS = new Set([
   "session_bootstrap", "resolve_task_capabilities", "agent_context", "list_local_skills", "load_local_skill", "list_local_commands",
   "list_dir", "list_files", "read_file", "view_image", "search_text",
   "git_status", "git_diff", "git_log", "git_show",
 ]);
 const SENSITIVE_SEGMENTS = new Set([
-  ".ssh", ".aws", ".azure", ".gnupg", ".kube", ".docker", ".npmrc", ".pypirc",
+  ".git", ".ssh", ".aws", ".azure", ".gnupg", ".kube", ".docker", ".npmrc", ".pypirc",
   "keychains", "cookies", "login data", "credentials", "secrets",
 ]);
+const RESOURCE_TOKEN = /\{\{resource:[a-z][a-z0-9._-]{0,63}\}\}/;
 
 export function reviewedOperationToolNames() {
   return new Set([
@@ -44,6 +46,7 @@ export function reviewedOperationToolNames() {
     ...SHELL_TOOLS,
     ...PERSISTENT_TOOLS,
     ...APPLICATION_CONTROL_TOOLS,
+    ...COMPUTER_USE_TOOLS,
     ...CREDENTIAL_TOOLS,
     ...BROWSER_PROFILE_TOOLS,
     ...FILE_WRITE_TOOLS,
@@ -55,8 +58,24 @@ export function reviewedOperationToolNames() {
 
 export async function classifyOperation(tool, args = {}, options = {}) {
   const name = String(tool || "");
+  if (name === "list_local_resources") return requirement("sensitive-read", "protected local resource inventory", name, {});
   if (SHELL_TOOLS.has(name)) return requirement("shell", "remote shell or process control", name, args);
+  if ((name === "stage_job" || name === "start_job") && jobUsesProtectedResources(args)) {
+    return requirement(["persistent-job", "sensitive-read"], "managed job using protected local resources", name, protectedJobProjection(args));
+  }
   if (PERSISTENT_TOOLS.has(name)) return requirement("persistent-job", "persistent managed job", name, args);
+  if (COMPUTER_USE_TOOLS.has(name)) {
+    const surface = String(args.surface || "");
+    const scopes = surface === "browser" ? ["browser-session"] : surface === "application" ? ["application-control"] : [];
+    if (!scopes.length) return null;
+    if (name === "computer_act" && args.value_resource) scopes.push("data-export");
+    return requirement(scopes, surface === "browser" ? "verified computer use in the existing browser profile" : "verified desktop computer use", name, {
+      surface,
+      snapshot_id: args.snapshot_id,
+      action: args.action,
+      value_resource: args.value_resource,
+    });
+  }
   if (name === "operate_local_application" && args.value_resource) {
     return requirement(["application-control", "data-export"], "desktop application control using protected local data", name, {
       application: args.application,
@@ -113,17 +132,45 @@ export async function classifyOperation(tool, args = {}, options = {}) {
   return null;
 }
 
+function jobUsesProtectedResources(args) {
+  const steps = [...(Array.isArray(args?.steps) ? args.steps : []), ...(Array.isArray(args?.finally_steps) ? args.finally_steps : [])];
+  return steps.some((step) => Boolean(step?.stdin_resource)
+    || (step?.env_resources && Object.keys(step.env_resources).length > 0)
+    || (Array.isArray(step?.argv) && step.argv.some((value) => RESOURCE_TOKEN.test(String(value)))));
+}
+
+function protectedJobProjection(args) {
+  const steps = [...(Array.isArray(args?.steps) ? args.steps : []), ...(Array.isArray(args?.finally_steps) ? args.finally_steps : [])];
+  return {
+    step_count: steps.length,
+    resource_reference_count: steps.reduce((count, step) => count + (step?.stdin_resource ? 1 : 0)
+      + Object.keys(step?.env_resources || {}).length
+      + (Array.isArray(step?.argv) ? step.argv.reduce((total, value) => total + (String(value).match(/\{\{resource:[a-z][a-z0-9._-]{0,63}\}\}/g)?.length || 0), 0) : 0), 0),
+  };
+}
+
 function requirement(scopes, category, tool, target) {
   const normalized = normalizeScopes(Array.isArray(scopes) ? scopes : [scopes]);
-  if (!normalized.length) throw new Error("operation approval requirement is missing a scope");
+  if (!normalized.length) throw new Error("operation authorization requirement is missing a scope");
   return {
     scope: normalized[0],
     scopes: normalized,
     category,
     targetHash: createHash("sha256").update(JSON.stringify({ tool, target: redactTarget(target) })).digest("hex"),
+    canonicalTargets: canonicalTargetPaths(target),
   };
 }
 
+function canonicalTargetPaths(target) {
+  if (!target || typeof target !== "object") return [];
+  const values = [];
+  if (typeof target.path === "string" && path.isAbsolute(target.path)) values.push(path.resolve(target.path));
+  if (Array.isArray(target.paths)) {
+    for (const value of target.paths) if (typeof value === "string" && path.isAbsolute(value)) values.push(path.resolve(value));
+  }
+  return [...new Set(values)];
+}
+
 function normalizeScopes(scopes) {
   const requested = new Set(scopes.map((scope) => String(scope || "")));
   return OPERATION_APPROVAL_SCOPES.filter((scope) => requested.has(scope));
@@ -154,7 +201,7 @@ function pathReadCategory(scopes) {
 
 function redactTarget(value) {
   if (!value || typeof value !== "object") return String(value || "");
-  const out = {};
+  const out = Object.create(null);
   for (const [key, item] of Object.entries(value)) {
     if (["content", "command", "stdin", "value", "old_text", "new_text", "patch"].includes(key)) {
       out[key] = `<sha256:${createHash("sha256").update(String(item || "")).digest("hex")}>`;