machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/local/runtime.mjs

@@ -1,44 +1,54 @@
 import { randomBytes } from "node:crypto";
 import { realpathSync, rmSync } from "node:fs";
-import { lstat, realpath, stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { isRelayReadyContext } from "./relay-connection.mjs";
+import { isRelayReadyContext } from "./relay-connection-classification.mjs";
 import { ProcessSessionManager } from "./process-sessions.mjs";
-import { MAX_CONCURRENT_TOOL_CALLS } from "./execution-limits.mjs";
+import { CONTROL_PLANE_TOOL_NAMES, MAX_CONCURRENT_TOOL_CALLS, RESERVED_CONTROL_TOOL_CALLS, executionGuardrailsSnapshot } from "./execution-limits.mjs";
 export { MAX_COMMAND_BYTES } from "./process-contract.mjs";
 import { normalizePolicy, PolicyGate } from "./tools.mjs";
-import { publicError } from "./errors.mjs";
+import { BridgeError, publicError } from "./errors.mjs";
 import { ProcessTracker } from "./process-tracker.mjs";
 import { CallRegistry } from "./call-registry.mjs";
 import { RuntimeObservability } from "./observability.mjs";
 import { ToolExecutor } from "./tool-executor.mjs";
 import { boundedErrorMessage, ProcessExecutionService } from "./process-execution.mjs";
 import { GitService } from "./git-service.mjs";
+import { FileMutationCoordinator } from "./file-mutation-coordinator.mjs";
+import { createTrustedGitResolver } from "./trusted-git-executable.mjs";
 import { LifecycleController } from "./lifecycle.mjs";
 import { MAX_WRITE_BYTES, sha256, WorkspaceFileService } from "./workspace-file-service.mjs";
+import { projectRuntimeInfo } from "./runtime-info-projection.mjs";
+import { projectOverviewDetail, projectProjectOverview } from "../shared/project-overview-projection.mjs";
 export { MAX_WRITE_BYTES, sha256 } from "./workspace-file-service.mjs";
 import { classifyOperationalError } from "./log.mjs";
-import { inspectResourceFile, ManagedJobManager } from "./managed-jobs.mjs";
-import { generateRegisteredSshKey } from "./resource-operations.mjs";
-import { expandHome } from "./state.mjs";
+import { ManagedJobManager } from "./managed-jobs.mjs";
 import { AgentContextManager } from "./agent-context.mjs";
 import { AppAutomationManager } from "./app-automation.mjs";
+import { projectApplicationCapabilities } from "./application-capability-projection.mjs";
+import { applicationBackgroundInputConfiguration } from "./macos-background-input.mjs";
 import { BrowserBridgeManager } from "./browser-bridge.mjs";
+import { ComputerUseManager } from "./computer-use.mjs";
 import { CapabilityObserver } from "./capability-observer.mjs";
-import { readBoundedRegularFileSync } from "./secure-file.mjs";
 import { isPlainRecord } from "./records.mjs";
 import { AccountAccessGate } from "./account-access.mjs";
 import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
 import { diagnoseRuntime as runRuntimeDiagnostics } from "./runtime-diagnostics.mjs";
 import { bindRuntimeToolHandlers, runtimeToolHandlerNames as registeredRuntimeToolHandlerNames } from "./runtime-tool-handlers.mjs";
 import { OperationAuthorizer } from "./operation-authorization.mjs";
-import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelayToolCall } from "./runtime-relay.mjs";
+import { SecurityAuditLog } from "./security-audit-log.mjs";
+import { delegatedProcessIsolationStatus } from "./delegated-process-sandbox.mjs";
+import { policyForContext } from "./authority-context.mjs";
+import { createRuntimeRelayConnection, normalizeRelayToolCall } from "./runtime-relay.mjs";
+import { handleRuntimeRelayControlMessage } from "./runtime-relay-control.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
-import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage, stateRootFromProfileStatePath } from "./runtime-paths.mjs";
-import {
-  resolveTaskCapabilities as resolveRuntimeTaskCapabilities,
-  sessionBootstrap as buildRuntimeSessionBootstrap,
-} from "./runtime-capabilities.mjs";
+import { RuntimeResourceService } from "./runtime-resource-service.mjs";
+import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage } from "./runtime-paths.mjs";
+import { pathEntryIfExists } from "./path-inspection.mjs";
+import { ResourceCoordinator } from "./resource-admission.mjs";
+import { RemoteActivityIdleSleepGuard } from "./remote-activity-idle-sleep-guard.mjs";
+import { runRuntimeDirectProcess, runRuntimeExecCommand, runRuntimeLocalCommand } from "./runtime-process-routing.mjs";
+import { resolveTaskCapabilities as resolveRuntimeTaskCapabilities, sessionBootstrap as buildRuntimeSessionBootstrap } from "./runtime-capabilities.mjs";
 
 const SLOW_TOOL_CALL_MS = 30_000;
 
@@ -47,7 +57,7 @@ export function runtimeToolHandlerNames() {
 }
 
 export class LocalRuntime {
-  constructor({ workerUrl = "", deviceIdentity = null, expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", approvalRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {} }) {
+  constructor({ workerUrl = "", deviceIdentity = null, expectedRelayVersion = "", workspace, policy, logger = console, onSuperseded = null, onFatal = null, jobRoot = "", securityStateRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "", agentHome = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "", recoverJobs = true, applicationAutomation = {}, deviceRootStatus = null, resolveGitExecutable = null, processResourceWaitMs = undefined, resourceCoordinatorRoot = "", resourceCoordinatorOptions = null }) {
     const remoteWorkerUrl = workerUrl ? String(workerUrl) : "";
     this.workspaceInput = resolve(workspace || process.cwd());
     this.workspace = realpathSync.native ? realpathSync.native(this.workspaceInput) : realpathSync(this.workspaceInput);
@@ -58,18 +68,27 @@ export class LocalRuntime {
     this.logger = logger;
     this.onSuperseded = typeof onSuperseded === "function" ? onSuperseded : null;
     this.resourceStatePath = resourceStatePath ? resolve(resourceStatePath) : "";
+    this.deviceRootStatus = deviceRootStatus && typeof deviceRootStatus === "object" ? Object.freeze({ ...deviceRootStatus }) : null;
     this.processTracker = new ProcessTracker();
+    this.resourceCoordinator = new ResourceCoordinator({ ...(resourceCoordinatorOptions || {}), ...(resourceCoordinatorRoot ? { root: resourceCoordinatorRoot } : {}) });
+    if (processResourceWaitMs !== undefined && (!Number.isInteger(processResourceWaitMs) || processResourceWaitMs < 0)) {
+      throw new TypeError("processResourceWaitMs must be a non-negative integer when configured");
+    }
+    const resourceWaitMs = processResourceWaitMs === undefined ? undefined : Math.min(processResourceWaitMs, 30 * 60_000);
     this.lifecycle = new LifecycleController("local runtime");
     this.observability = new RuntimeObservability();
     this.relayInstanceId = `daemon_${randomBytes(18).toString("base64url")}`;
     this.activeRelayCalls = new Set();
     this.suppressedRelayResults = new Map();
-    this.relayResumeSessionId = 0;
+    this.relayResumeSessionId = 0; this.relayResumeMissingIds = [];
+    this.remoteActivityIdleSleepGuard = new RemoteActivityIdleSleepGuard({ logger: this.logger });
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
+      reserved: RESERVED_CONTROL_TOOL_CALLS,
+      reservedTools: CONTROL_PLANE_TOOL_NAMES,
       onCancel: (record) => {
         this.processSessionManager?.notifyCancellation();
-        this.browserBridgeManager?.cancelCall(record.id);
+        this.browserBridgeManager?.cancelCall(record.id, record.controller.signal.reason);
         this.processTracker.terminateCall(record.id);
         this.logger.event?.("debug", "tool.call.cancel_requested", {
           call_id: shortCallId(record.id), tool: record.tool, origin: record.origin,
@@ -77,18 +96,20 @@ export class LocalRuntime {
       },
       onFinish: (record) => this.processTracker.releaseCall(record.id),
     });
-    this.mutationQueue = Promise.resolve();
+    this.fileMutationCoordinator = new FileMutationCoordinator();
     this.capabilityObserver = new CapabilityObserver();
     this.runtimeDir = createRuntimeDir();
+    this.resolveGitExecutable = createTrustedGitResolver({ resolve: resolveGitExecutable, workspace: this.workspace, stateRoot: browserStateRoot, runtimeDir: this.runtimeDir, home: agentHome });
     this.workspaceFileService = new WorkspaceFileService({
       workspace: this.workspace,
       policy: this.policy,
       policyGate: this.policyGate,
-      resolveExistingPath: (value) => this.resolveExistingPath(value),
-      resolveWritePath: (value) => this.resolveWritePath(value),
-      displayPath: (value) => this.displayPath(value),
+      policyForContext: (context) => this.effectivePolicy(context),
+      resolveExistingPath: (value, context) => this.resolveExistingPath(value, context),
+      resolveWritePath: (value, context) => this.resolveWritePath(value, context),
+      displayPath: (value, context) => this.displayPath(value, context),
       throwIfCancelled: (context) => this.throwIfCancelled(context),
-      withMutationLock: (operation) => this.withMutationLock(operation),
+      withMutationPaths: (paths, operation) => this.fileMutationCoordinator.withPaths(paths, operation),
     });
     if (typeof jobRoot !== "string" || !jobRoot.trim()) throw new Error("persistent managed-job root is required");
     this.managedJobManager = new ManagedJobManager({
@@ -96,31 +117,38 @@ export class LocalRuntime {
       workspace: this.workspace,
       policy: this.policy,
       authorizeTool: (tool) => this.policyGate.assert(tool),
+      policyForContext: (context) => this.effectivePolicy(context),
       resources,
       resourceStatePath,
       stateRoot: browserStateRoot,
       logger: this.logger,
       recover: recoverJobs,
+      runnerEnvironmentOverrides: resourceCoordinatorRoot ? { AGENT_RESOURCE_COORDINATOR_ROOT: resolve(resourceCoordinatorRoot) } : {},
     });
     this.processSessionManager = new ProcessSessionManager({
       workspace: this.workspace,
       policy: this.policy,
       authorizeTool: (tool) => this.policyGate.assert(tool),
+      policyForContext: (context) => this.effectivePolicy(context),
       runtimeDir: this.runtimeDir,
       processTracker: this.processTracker,
-      resolveCwd: async (input) => {
-        const cwd = await this.resolveExistingPath(input);
+      resourceCoordinator: this.resourceCoordinator,
+      resourceWaitMs,
+      resolveCwd: async (input, context) => {
+        const cwd = await this.resolveExistingPath(input, context);
         if (!(await stat(cwd)).isDirectory()) throw new Error("cwd is not a directory");
         return cwd;
       },
-      displayPath: (value) => this.displayPath(value),
+      displayPath: (value, context) => this.displayPath(value, context),
       throwIfCancelled: (context) => this.throwIfCancelled(context),
+      remoteActivityGuard: this.remoteActivityIdleSleepGuard,
     });
     this.agentContextManager = new AgentContextManager({
       workspace: this.workspace,
       policy: this.policy,
-      displayPath: (value) => this.displayPath(value),
-      resolveExistingPath: (value) => this.resolveExistingPath(value),
+      policyForContext: (context) => this.effectivePolicy(context),
+      displayPath: (value, context) => this.displayPath(value, context),
+      resolveExistingPath: (value, context) => this.resolveExistingPath(value, context),
       throwIfCancelled: (context) => this.throwIfCancelled(context),
       home: agentHome,
       codexHome,
@@ -129,37 +157,42 @@ export class LocalRuntime {
       workspace: this.workspace,
       policy: this.policy,
       policyGate: this.policyGate,
+      policyForContext: (context) => this.effectivePolicy(context),
       runtimeDir: this.runtimeDir,
       processTracker: this.processTracker,
-      resolveExistingPath: (value) => this.resolveExistingPath(value),
+      resourceCoordinator: this.resourceCoordinator,
+      resourceWaitMs,
+      resolveExistingPath: (value, context) => this.resolveExistingPath(value, context),
       resolveLocalCommand: (args, context) => this.agentContextManager.resolveLocalCommand(args, context),
-      displayPath: (value) => this.displayPath(value),
+      displayPath: (value, context) => this.displayPath(value, context),
       throwIfCancelled: (context) => this.throwIfCancelled(context),
-      retainCompletedOutput: (value) => this.processSessionManager.retainCompletedOutput(value),
+      retainCompletedOutput: (value, context) => this.processSessionManager.retainCompletedOutput(value, context),
     });
     this.gitService = new GitService({
-      resolveExistingPath: (value) => this.resolveExistingPath(value),
-      displayPath: (value) => this.displayPath(value),
-      runProcess: (...args) => this.processExecutionService.run(...args),
+      resolveExistingPath: (value, context) => this.resolveExistingPath(value, context),
+      resolveWritePath: (value, context) => this.resolveWritePath(value, context),
+      displayPath: (value, context) => this.displayPath(value, context),
+      runInternalProcess: (...args) => this.processExecutionService.runFixedInternal(...args),
+      gitExecutable: () => this.resolveGitExecutable(),
       maximumBytes: MAX_WRITE_BYTES,
     });
-    const runProcess = (cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin) => this.runProcess(cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin);
-    const readResourceText = (name) => this.readLocalResourceText(name);
-    const readResourceBinary = (name) => this.readLocalResourceBinary(name);
-    this.appAutomationManager = new AppAutomationManager({
-      ...applicationAutomation,
-      policy: this.policy,
+    this.runtimeResourceService = new RuntimeResourceService({
+      workspace: this.workspace,
+      resourceStatePath: this.resourceStatePath,
+      currentResources: () => this.managedJobManager.currentResources(),
       authorizeTool: (tool) => this.policyGate.assert(tool),
-      displayPath: (value) => this.displayPath(value),
-      runProcess,
-      readResourceText,
-      throwIfCancelled: (context) => this.throwIfCancelled(context),
     });
+    const runProcess = (cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin, options) => this.runProcess(cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin, options);
+    const readResourceText = (name) => this.runtimeResourceService.readText(name);
+    const readResourceBinary = (name) => this.runtimeResourceService.readBinary(name);
+    this.appAutomationManager = createAppAutomationManager(this, applicationAutomation, runProcess, readResourceText);
+    this.securityAudit = new SecurityAuditLog({ root: securityStateRoot });
     this.operationAuthorizer = new OperationAuthorizer({
       workspace: this.workspace,
-      root: approvalRoot,
-      resolveExistingPath: (value) => this.resolveExistingPath(value),
-      resolveWritePath: (value) => this.resolveWritePath(value),
+      root: securityStateRoot,
+      resolveExistingPath: (value, context) => this.resolveExistingPath(value, context),
+      resolveWritePath: (value, context) => this.resolveWritePath(value, context),
+      protectedRoots: [securityStateRoot, browserStateRoot],
     });
     this.browserBridgeManager = new BrowserBridgeManager({
       policy: this.policy,
@@ -171,6 +204,12 @@ export class LocalRuntime {
       throwIfCancelled: (context) => this.throwIfCancelled(context),
       logger: this.logger,
     });
+    this.computerUseManager = new ComputerUseManager({
+      authorizeTool: (tool) => this.policyGate.assert(tool),
+      browserBridgeManager: this.browserBridgeManager,
+      appAutomationManager: this.appAutomationManager,
+      throwIfCancelled: (context) => this.throwIfCancelled(context),
+    });
     this.toolExecutor = new ToolExecutor({
       handlers: bindRuntimeToolHandlers(this),
       policyGate: this.policyGate,
@@ -178,8 +217,11 @@ export class LocalRuntime {
       operationAuthorizer: this.operationAuthorizer,
       callRegistry: this.callRegistry,
       observability: this.observability,
+      securityAudit: this.securityAudit,
       logger: this.logger,
-      safeMessage: (error, args) => this.safeErrorMessage(error, args),
+      onAuthorizedRelayActivityStart: () => this.remoteActivityIdleSleepGuard.beginActivity(),
+      onAuthorizedRelayActivityEnd: () => this.remoteActivityIdleSleepGuard.endActivity(),
+      safeMessage: (error, args, context) => this.safeErrorMessage(error, args, context),
       slowMs: SLOW_TOOL_CALL_MS,
     });
     this.relay = createRuntimeRelayConnection(this, {
@@ -195,15 +237,25 @@ export class LocalRuntime {
       terminate: () => this.terminateActiveProcesses("SIGTERM", true),
     });
   }
-
   tools() { return this.policyGate.names().filter((name) => name !== "server_info"); }
 
-  runtimeInfo() {
-    return buildRuntimeInfo({
+  effectiveToolNames(context = {}) {
+    const policyNames = this.policyGate.names();
+    const principal = context?.authority?.principal;
+    if (principal?.kind !== "account") return policyNames;
+    const accountNames = new Set(this.accountAccessGate.names(principal.role));
+    return policyNames.filter((name) => accountNames.has(name));
+  }
+
+  serverInfo(args = {}, context = {}) { return projectRuntimeInfo(this.runtimeInfo(context), args.detail); }
+
+  runtimeInfo(context = {}) {
+    const info = buildRuntimeInfo({
       workspace: this.workspace,
-      displayPath: (value) => this.displayPath(value),
-      policy: this.policy,
-      toolNames: this.tools(),
+      displayPath: (value) => this.displayPath(value, context),
+      policy: this.effectivePolicy(context),
+      toolNames: this.effectiveToolNames(context).filter((name) => name !== "server_info"),
+      daemonToolNames: this.tools(),
       capabilityObserver: this.capabilityObserver,
       observability: this.observability,
       callRegistry: this.callRegistry,
@@ -213,7 +265,17 @@ export class LocalRuntime {
       processTracker: this.processTracker,
       processSessionManager: this.processSessionManager,
       managedJobManager: this.managedJobManager,
+      securityAudit: this.securityAudit.snapshot(), deviceRootStatus: this.deviceRootStatus, context,
     });
+    return {
+      ...info,
+      trust: {
+        ...info.trust,
+        daemon_session: { ephemeral: true, certificate_lifetime_seconds: 86400, reconnect_prompts: false },
+        delegated_process_isolation: delegatedProcessIsolationStatus(),
+        routine_operation_prompts: false,
+      },
+    };
   }
 
   async start() {
@@ -225,27 +287,34 @@ export class LocalRuntime {
       });
     }
     try {
-      await this.relay.start();
+      const relayReady = await this.relay.start();
+      if (this.lifecycle.snapshot().state !== "starting") return;
+      if (relayReady !== true) throw new BridgeError("cancelled", "runtime relay startup was cancelled", { retryable: true });
       this.lifecycle.markRunning();
     } catch (error) {
+      if (this.lifecycle.snapshot().state !== "starting") return;
       this.lifecycle.markFailed(error);
       throw error;
     }
   }
 
-  stop() {
+  async stop() {
     if (!this.lifecycle.beginStop()) return;
     try {
       this.relay?.stop();
       this.relayCallRecovery.stop();
-      this.callRegistry.cancelAll("runtime stopped");
-      this.terminateActiveProcesses("SIGKILL");
-      this.processSessionManager.clear();
+      await this.callRegistry.cancelAllAndWait("runtime stopped");
+      await this.processTracker.drain("SIGKILL");
+      await this.processSessionManager.clearAndWait();
+      this.remoteActivityIdleSleepGuard.stop();
+      await this.securityAudit.close();
       this.browserBridgeManager?.stop();
       rmSync(this.runtimeDir, { recursive: true, force: true });
-    } finally {
-      this.lifecycle.markStopped();
+    } catch (error) {
+      this.lifecycle.markStopFailed(error);
+      throw error;
     }
+    this.lifecycle.markStopped();
   }
 
   send(value) {
@@ -255,70 +324,28 @@ export class LocalRuntime {
   async handleMessage(raw, relayContext = {}) {
     let message;
     try { message = JSON.parse(raw); } catch {
-      this.handleRelayProtocolViolation("invalid_server_json");
+      this.handleRelayProtocolViolation("invalid_server_json", relayContext);
       return;
     }
-    if (!isPlainRecord(message)) {
-      this.handleRelayProtocolViolation("invalid_server_message");
-      return;
+    if (!isPlainRecord(message)) return this.handleRelayProtocolViolation("invalid_server_message", relayContext);
+    if (message.type === "tool_call") {
+      if (!isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("tool_call_before_ready", relayContext);
+      return this.handleRelayToolCall(message, relayContext);
     }
-    if (this.handleRelayControlMessage(message, relayContext)) return;
+    if (await this.handleRelayControlMessage(message, relayContext)) return;
     if (message.type === "relay_probe") {
-      if (isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("unexpected_relay_probe");
+      if (isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("unexpected_relay_probe", relayContext);
       this.handleRelayProbe(message, relayContext);
       return;
     }
-    if (message.type !== "tool_call") return this.handleRelayProtocolViolation("unexpected_server_message_type");
-    if (!isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("tool_call_before_ready");
-    await this.handleRelayToolCall(message);
+    return this.handleRelayProtocolViolation("unexpected_server_message_type", relayContext);
   }
 
-  handleRelayControlMessage(message, relayContext = {}) {
-    if (message.type === "welcome") {
-      this.relay?.observeWelcome(message);
-      return true;
-    }
-    if (message.type === "hello_ack") {
-      this.relayResumeSessionId = 0;
-      this.relay?.acknowledge(message);
-      return true;
-    }
-    if (message.type === "resume_calls") {
-      const sessionId = Number(relayContext.sessionId) || 0;
-      const resume = normalizeRelayResumeCalls(message);
-      if (!resume.ok || !sessionId || relayContext.authenticated !== true || relayContext.ready === true) {
-        this.handleRelayProtocolViolation("invalid_resume_calls");
-        return true;
-      }
-      this.reconcileRelayCalls(resume.ids);
-      this.relayResumeSessionId = sessionId;
-      return true;
-    }
-    if (message.type === "ready_ack") {
-      const sessionId = Number(relayContext.sessionId) || 0;
-      if (!sessionId || sessionId !== this.relayResumeSessionId) {
-        this.handleRelayProtocolViolation("resume_calls_required");
-        return true;
-      }
-      this.relay?.confirmReady(message);
-      this.relayResumeSessionId = 0;
-      return true;
-    }
-    if (message.type === "pong") return true;
-    if (message.type === "error") {
-      this.relay?.handleServerError(message);
-      return true;
-    }
-    if (message.type === "cancel_call") {
-      if (typeof message.id === "string") this.cancelRelayCall(message.id, "caller_cancelled");
-      return true;
-    }
-    return false;
-  }
+  handleRelayControlMessage(message, relayContext = {}) { return handleRuntimeRelayControlMessage(this, message, relayContext); }
 
-  handleRelayProtocolViolation(errorCode) {
+  handleRelayProtocolViolation(errorCode, relayContext = {}) {
     if (this.relay) {
-      this.relay.handleServerError({ type: "error", error: errorCode });
+      this.relay.handleServerError({ type: "error", error: errorCode }, relayContext);
       return;
     }
     this.logger.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon");
@@ -327,12 +354,14 @@ export class LocalRuntime {
   handleRelayProbe(message, relayContext = {}) {
     const id = typeof message?.id === "string" && /^probe_[A-Za-z0-9_-]{8,240}$/.test(message.id) ? message.id : "";
     const relaySessionId = Number(relayContext.sessionId) || 0;
-    if (!id || !relaySessionId) return this.handleRelayProtocolViolation("invalid_relay_probe");
+    if (!id || !relaySessionId) return this.handleRelayProtocolViolation("invalid_relay_probe", relayContext);
     const outcome = this.relay?.sendForSession?.({ type: "relay_probe_result", id }, relaySessionId);
-    if (!outcome?.ok) this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    if (!outcome?.ok && !["send_failed", "transport_unavailable", "session_ended"].includes(outcome?.reason)) {
+      this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    }
   }
 
-  async handleRelayToolCall(message) {
+  async handleRelayToolCall(message, relayContext = {}) {
     const envelope = normalizeRelayToolCall(message);
     if (!envelope.ok) {
       this.logger.warn?.("Received an invalid tool request from the relay; the request was rejected.");
@@ -348,7 +377,7 @@ export class LocalRuntime {
       return;
     }
     if (this.activeRelayCalls.has(envelope.id)) {
-      this.handleRelayProtocolViolation("duplicate_tool_call_id");
+      this.handleRelayProtocolViolation("duplicate_tool_call_id", relayContext);
       return;
     }
     this.activeRelayCalls.add(envelope.id);
@@ -400,14 +429,17 @@ export class LocalRuntime {
   }
 
   reconcileRelayCalls(resumedCallIds) {
-    this.relayCallRecovery.reconcile(
+    return this.relayCallRecovery.reconcile(
       resumedCallIds,
       (callId) => this.cancelRelayCall(callId, "caller_no_longer_waiting"),
     );
   }
 
+  relayOwnedCallIds() { return this.relayCallRecovery?.ownedCallIds?.() ?? [...this.activeRelayCalls]; }
+
   handleRelayDisconnect() {
     this.relayResumeSessionId = 0;
+    this.relayResumeMissingIds = [];
     this.relayCallRecovery.disconnected();
   }
 
@@ -426,21 +458,25 @@ export class LocalRuntime {
     });
   }
 
-  async projectOverview(context = {}) {
-    return buildProjectOverview({
+  async projectOverview(args = {}, context = {}) {
+    const effectivePolicy = this.effectivePolicy(context);
+    const overview = await buildProjectOverview({
       workspace: this.workspace,
-      displayPath: (value) => this.displayPath(value),
-      policy: this.policy,
-      toolNames: this.tools(),
+      displayPath: (value) => this.displayPath(value, context),
+      policy: effectivePolicy,
+      toolNames: this.effectiveToolNames(context).filter((name) => name !== "server_info"),
+      daemonPolicy: this.policy,
+      daemonToolNames: this.tools(),
       capabilityObserver: this.capabilityObserver,
       listTopLevel: (callContext) => this.listDir(".", callContext),
-      runProcess: (...args) => this.runProcess(...args),
-      safeErrorMessage: (error) => this.safeErrorMessage(error),
+      resolveGitRoot: async (callContext) => (await this.gitService.context(".", callContext)).root || "",
+      safeErrorMessage: (error) => this.safeErrorMessage(error, {}, context),
       throwIfCancelled: (callContext) => this.throwIfCancelled(callContext),
     }, context);
+    return projectProjectOverview(overview, projectOverviewDetail(args));
   }
 
-  listRoots() { return this.workspaceFileService.listRoots(); }
+  listRoots(context = {}) { return this.workspaceFileService.listRoots(context); }
 
   listDir(pathValue, context = {}) { return this.workspaceFileService.listDir(pathValue, context); }
 
@@ -474,51 +510,35 @@ export class LocalRuntime {
     return this.gitService.show(args, context);
   }
 
+  gitCommit(args = {}, context = {}) {
+    return this.gitService.commit(args, context);
+  }
+
   async diagnoseRuntime(context = {}) {
     return runRuntimeDiagnostics({
       policy: this.policy,
       runtimeDir: this.runtimeDir,
       workspace: this.workspace,
-      runProcess: (...args) => this.runProcess(...args),
-      probeShell: (callContext) => this.processExecutionService.probeShell(callContext),
+      runFixedInternal: (...args) => this.processExecutionService.runFixedInternal(...args),
+      probeShell: (callContext, timeoutMs) => this.processExecutionService.probeShell(callContext, timeoutMs),
       managedJobManager: this.managedJobManager,
+      resourceCoordinatorSnapshot: () => this.resourceCoordinator.snapshot({ cwd: this.workspace }),
+      relayStatus: () => this.relay?.status?.() || null,
+      controlPlaneState: {
+        lifecycle: this.lifecycle.snapshot(),
+        inFlightCalls: this.callRegistry.snapshot(),
+        processes: this.processTracker.snapshot(),
+        executionGuardrails: executionGuardrailsSnapshot(),
+        securityAudit: this.securityAudit.snapshot(),
+        idleSleepGuard: this.remoteActivityIdleSleepGuard.snapshot(),
+      },
       throwIfCancelled: (callContext) => this.throwIfCancelled(callContext),
     }, context);
   }
 
   async generateSshKeyResource(args = {}, context = {}) {
     this.throwIfCancelled(context);
-    this.policyGate.assert("generate_ssh_key_resource");
-    if (!this.resourceStatePath) throw new Error("local resource state is unavailable in this runtime");
-    const home = process.env.HOME || process.env.USERPROFILE;
-    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
-    const target = args.path
-      ? resolve(expandHome(String(args.path)))
-      : resolve(home, ".ssh", `machine-mcp-${args.name}-ed25519`);
-    const key = await generateRegisteredSshKey({
-      workspace: this.workspace,
-      stateDir: stateRootFromProfileStatePath(this.resourceStatePath),
-      name: args.name,
-      targetPath: target,
-      comment: args.comment || `machine-mcp:${args.name}`,
-    });
-    const exposePaths = args.expose_paths === true;
-    return {
-      name: key.name,
-      created: key.created,
-      registered: key.registered,
-      fingerprint: key.fingerprint,
-      key_type: key.keyType,
-      private_mode: key.privateMode,
-      public_mode: key.publicMode,
-      private_key_content_exposed: key.privateKeyContentExposed,
-      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
-      paths_exposed: exposePaths,
-      ...(exposePaths ? {
-        private_key_path: resolve(key.privateKeyPath),
-        public_key_path: resolve(key.publicKeyPath),
-      } : {}),
-    };
+    return this.runtimeResourceService.generateSshKey(args);
   }
 
   async sessionBootstrap(args = {}, context = {}) {
@@ -526,7 +546,8 @@ export class LocalRuntime {
       agentContextManager: this.agentContextManager,
       appAutomationManager: this.appAutomationManager,
       capabilityObserver: this.capabilityObserver,
-      policy: this.policy,
+      policy: this.effectivePolicy(context),
+      availableTools: this.effectiveToolNames(context),
     }, args, context);
   }
 
@@ -535,51 +556,54 @@ export class LocalRuntime {
       agentContextManager: this.agentContextManager,
       appAutomationManager: this.appAutomationManager,
       capabilityObserver: this.capabilityObserver,
-      policy: this.policy,
+      policy: this.effectivePolicy(context),
+      availableTools: this.effectiveToolNames(context),
     }, args, context);
   }
 
-  readLocalResourceBinary(name) {
-    const registry = this.managedJobManager.currentResources();
-    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
-    if (!resource) throw new Error(`unknown local resource: ${name}`);
-    const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
-    if (inspected.size > 1024 * 1024) throw new Error("local resource exceeds 1 MiB browser injection limit");
-    return { buffer: readBoundedRegularFileSync(resource.path, 1024 * 1024), path: resource.path, size: inspected.size };
-  }
+  runDirectProcess(args, context = {}) { return runRuntimeDirectProcess(this, args, context); }
 
-  readLocalResourceText(name) {
-    const { buffer } = this.readLocalResourceBinary(name);
-    try {
-      return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
-    } catch {
-      throw new Error(`local resource is not valid UTF-8 text: ${name}`);
-    }
-  }
+  runLocalCommand(args, context = {}) { return runRuntimeLocalCommand(this, args, context); }
 
-  runDirectProcess(args, context = {}) {
-    return this.processExecutionService.runDirect(args, context);
-  }
+  execCommand(args, context = {}) { return runRuntimeExecCommand(this, args, context); }
 
-  runLocalCommand(args, context = {}) {
-    return this.processExecutionService.runRegistered(args, context);
+  terminateActiveProcesses(signal = "SIGTERM", escalate = false) {
+    this.processExecutionService.terminateAll(signal, escalate);
   }
 
-  execCommand(command, timeoutSeconds, context = {}) {
-    return this.processExecutionService.runShell(command, timeoutSeconds, context);
+  async applyAuthorityRevocation(revocation) {
+    let calls = 0; let sessions = 0; let jobs = 0;
+    const failures = [];
+    let sessionRevocation = null;
+    try { calls = this.callRegistry.cancelAuthority(revocation); } catch (error) { failures.push(error); }
+    try { sessionRevocation = Promise.resolve(this.processSessionManager.revokeAuthority(revocation)); }
+    catch (error) { failures.push(error); }
+    try { jobs = this.managedJobManager.revokeAuthority(revocation); } catch (error) { failures.push(error); }
+    if (sessionRevocation) {
+      try { sessions = await sessionRevocation; } catch (error) { failures.push(error); }
+    }
+    if (failures.length) {
+      throw new BridgeError("unavailable", "local authority revocation was incomplete; retained revocation must be retried", {
+        cause: new AggregateError(failures, "local authority revocation failures"), retryable: true,
+      });
+    }
+    this.logger.event?.("debug", "authority.revocation.applied", {
+      calls_cancelled: calls, process_sessions_revoked: sessions, managed_jobs_cancelled: jobs,
+    }, "Revoked authority removed local execution ownership");
+    return { calls_cancelled: calls, process_sessions_revoked: sessions, managed_jobs_cancelled: jobs };
   }
 
-  terminateActiveProcesses(signal = "SIGTERM", escalate = false) {
-    this.processExecutionService.terminateAll(signal, escalate);
+  runProcess(cmd, args, timeoutMs, allowFailure = false, maxOutputBytes = 512 * 1024, context = {}, cwd = this.workspace, stdin = null, options = {}) {
+    return this.processExecutionService.run(cmd, args, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin, options);
   }
 
-  runProcess(cmd, args, timeoutMs, allowFailure = false, maxOutputBytes = 512 * 1024, context = {}, cwd = this.workspace, stdin = null) {
-    return this.processExecutionService.run(cmd, args, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin);
+  effectivePolicy(context = {}) {
+    return policyForContext(context, this.policy);
   }
 
   resolvePath(inputPath = ".") {
     const raw = String(inputPath || ".");
-    if (raw.includes("\0")) throw new Error("path contains a NUL byte");
+    if (raw.includes("\0")) throw new BridgeError("invalid_request", "path contains a NUL byte", { details: { reason: "nul_byte" } });
     return isAbsolute(raw) ? resolve(raw) : resolve(this.workspaceInput, raw);
   }
 
@@ -599,41 +623,41 @@ export class LocalRuntime {
     return this.workspaceCanonicalPromise;
   }
 
-  async resolveExistingPath(inputPath = ".") {
+  async resolveExistingPath(inputPath = ".", context = {}) {
     const candidate = this.resolvePath(inputPath);
     const [workspace, canonical] = await Promise.all([this.canonicalWorkspace(), realpath(candidate)]);
-    if (!this.policy.unrestrictedPaths) assertContainedPath(workspace, canonical);
+    if (!this.effectivePolicy(context).unrestrictedPaths) assertContainedPath(workspace, canonical);
     return canonical;
   }
 
-  async resolveWritePath(inputPath = ".") {
+  async resolveWritePath(inputPath = ".", context = {}) {
     const candidate = this.resolvePath(inputPath);
-    const candidateInfo = await lstat(candidate).catch(() => null);
-    if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
+    const candidateInfo = await pathEntryIfExists(candidate);
+    if (candidateInfo?.isSymbolicLink()) throw new BridgeError("conflict", "refusing to overwrite a symbolic link", { details: { reason: "symbolic_link" } });
     let ancestor = candidate;
-    while (!(await lstat(ancestor).catch(() => null))) {
+    while (!(await pathEntryIfExists(ancestor))) {
       const parent = dirname(ancestor);
       if (parent === ancestor) break;
       ancestor = parent;
     }
     const [workspace, canonicalAncestor] = await Promise.all([this.canonicalWorkspace(), realpath(ancestor)]);
-    if (!this.policy.unrestrictedPaths) assertContainedPath(workspace, canonicalAncestor);
+    if (!this.effectivePolicy(context).unrestrictedPaths) assertContainedPath(workspace, canonicalAncestor);
     const suffix = relative(ancestor, candidate);
     return suffix ? resolve(canonicalAncestor, suffix) : canonicalAncestor;
   }
 
-  displayPath(fullPath) {
+  displayPath(fullPath, context = {}) {
     const absolute = resolve(fullPath);
-    if (this.policy.exposeAbsolutePaths) return absolute;
+    if (this.effectivePolicy(context).exposeAbsolutePaths) return absolute;
     const shown = relative(this.workspace, absolute);
     const insideWorkspace = shown === "" || (!shown.startsWith(`..${sep}`) && shown !== ".." && !isAbsolute(shown));
     if (insideWorkspace) return shown ? shown.split(sep).join("/") : ".";
     return `<external-path:${sha256(absolute).slice(0, 12)}>`;
   }
 
-  safeErrorMessage(error, toolArgs = {}) {
+  safeErrorMessage(error, toolArgs = {}, context = {}) {
     const message = boundedErrorMessage(error);
-    if (this.policy.exposeAbsolutePaths) return message;
+    if (this.effectivePolicy(context).exposeAbsolutePaths) return message;
     return redactRuntimeErrorMessage(message, {
       error,
       toolArgs,
@@ -641,23 +665,35 @@ export class LocalRuntime {
       workspaceInput: this.workspaceInput,
       runtimeDir: this.runtimeDir,
       home: process.env.HOME || process.env.USERPROFILE || "",
-      displayPath: (value) => this.displayPath(value),
+      displayPath: (value) => this.displayPath(value, context),
     });
   }
 
   throwIfCancelled(context = {}) {
     this.callRegistry.throwIfCancelled(context);
   }
+}
 
-  async withMutationLock(callback) {
-    const previous = this.mutationQueue;
-    let release = () => {};
-    this.mutationQueue = new Promise((resolvePromise) => { release = resolvePromise; });
-    await previous;
-    try { return await callback(); } finally { release(); }
-  }
+function createAppAutomationManager(runtime, applicationAutomation, runProcess, readResourceText) {
+  const { backgroundVisualBackend, backgroundInputService } = applicationBackgroundInputConfiguration(
+    applicationAutomation, runProcess, runtime.runtimeDir,
+  );
+  return new AppAutomationManager({
+    ...applicationAutomation,
+    backgroundVisualBackend,
+    backgroundInputService,
+    policy: runtime.policy,
+    authorizeTool: (tool) => runtime.policyGate.assert(tool),
+    displayPath: (value, context) => runtime.displayPath(value, context),
+    projectCapabilities: (capabilities, context) => projectRuntimeApplicationCapabilities(runtime, capabilities, context),
+    runProcess,
+    readResourceText,
+    throwIfCancelled: (context) => runtime.throwIfCancelled(context),
+  });
 }
 
+function projectRuntimeApplicationCapabilities(runtime, capabilities, context) { const available = new Set(runtime.effectiveToolNames(context)); return projectApplicationCapabilities(capabilities, (tool) => available.has(tool)); }
+
 function shortCallId(value) {
   return String(value || "").slice(0, 20);
 }