machine-bridge-mcp 2.0.0 → 3.0.0-beta.11

package/src/local/state.mjs

@@ -7,9 +7,11 @@ import serverMetadata from "../shared/server-metadata.json" with { type: "json"
 import { replaceFileSync } from "./atomic-fs.mjs";
 import { createExclusiveFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
-import { createDeviceIdentity, validateDeviceIdentity } from "./device-identity.mjs";
+import { createDeviceIdentity } from "./device-identity.mjs";
+import { validateDeviceRootIdentity } from "./device-root-provider.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
+import { isPlainRecord } from "./records.mjs";
 
 export const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 export const appName = String(serverMetadata.name);
@@ -17,6 +19,7 @@ const STATE_MARKER = ".machine-bridge-mcp-state";
 const STATE_MARKER_SCHEMA = 2;
 export const STATE_SCHEMA_VERSION = 6;
 const GLOBAL_CONFIG_SCHEMA = 1;
+const RECOVERY_MARKER_SCHEMA = 1;
 const CORRUPT_RECOVERY = Symbol("corrupt-recovery");
 const MAX_STATE_JSON_BYTES = 2 * 1024 * 1024;
 const MAX_LOCK_BYTES = 64 * 1024;
@@ -66,7 +69,7 @@ export function loadGlobalConfig(stateRoot = defaultStateRoot()) {
   const file = configPath(root);
   if (!existsSync(file)) return { schemaVersion: GLOBAL_CONFIG_SCHEMA };
   ownerOnlyFile(file);
-  const config = readJsonObjectOrBackup(file);
+  const config = readJsonObjectOrBackup(file, { allowEmptyRecovery: true });
   if (config[CORRUPT_RECOVERY]) return { schemaVersion: GLOBAL_CONFIG_SCHEMA };
   if (config.schemaVersion !== GLOBAL_CONFIG_SCHEMA) {
     throw new Error("global configuration schema is obsolete; remove the state root and initialize the current version");
@@ -149,6 +152,16 @@ function assertStateRootSeparatedFromWorkspace(stateRoot, workspace) {
   }
 }
 
+function samePotentialPathIdentity(left, right) {
+  try {
+    const a = canonicalizePotentialPath(String(left));
+    const b = canonicalizePotentialPath(String(right));
+    return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+  } catch {
+    return false;
+  }
+}
+
 function sameWorkspaceIdentity(left, right) {
   try {
     const a = resolveWorkspace(left);
@@ -169,13 +182,20 @@ export function loadState(workspace, options = {}) {
   const profileDir = profileDirForWorkspace(canonicalWorkspace, stateRoot);
   const statePath = path.join(profileDir, "state.json");
   ensureOwnerOnlyDir(profileDir);
+  const recoveryPath = recoveryMarkerPath(statePath);
+  const recoveryPending = existsSync(recoveryPath);
+  const recoveryMarker = recoveryPending ? readRecoveryMarker(recoveryPath, statePath) : null;
   let state = {};
   if (existsSync(statePath)) {
     ownerOnlyFile(statePath);
-    state = readJsonObjectOrBackup(statePath);
-    if (!state[CORRUPT_RECOVERY] && state.schemaVersion !== STATE_SCHEMA_VERSION) {
+    state = readJsonObjectOrBackup(statePath, { recoveryPath });
+    if (state.schemaVersion !== STATE_SCHEMA_VERSION) {
       throw new Error("workspace state schema is obsolete; remove the state root and initialize the current version");
     }
+    assertWorkspaceStateEnvelope(state, { canonicalWorkspace, stateRoot, profileDir, statePath });
+    if (recoveryPending) unlinkSync(recoveryPath);
+  } else if (recoveryPending) {
+    throw recoveryRequiredError(recoveryMarker);
   }
   state.schemaVersion = STATE_SCHEMA_VERSION;
   state.workspace = {
@@ -185,17 +205,57 @@ export function loadState(workspace, options = {}) {
   };
   state.paths = { stateRoot, profileDir, statePath };
   state.worker ||= {};
+  delete state.worker.accountAdminSecret;
   state.policy ||= {};
   state.resources ||= {};
   return state;
 }
 
 export function saveState(state) {
-  assertNoForeignMaintenance(state?.paths?.stateRoot);
-  const statePath = state?.paths?.statePath;
-  if (!statePath) throw new Error("state path is missing");
-  ensureOwnerOnlyDir(path.dirname(statePath));
-  atomicWriteJson(statePath, { ...state });
+  const envelope = assertWorkspaceStateEnvelope(state);
+  assertNoForeignMaintenance(envelope.stateRoot);
+  assertValidStateMarker(path.join(envelope.stateRoot, STATE_MARKER));
+  ensureOwnerOnlyDir(envelope.profileDir);
+  atomicWriteJson(envelope.statePath, { ...state });
+  const recoveryPath = recoveryMarkerPath(envelope.statePath);
+  if (existsSync(recoveryPath)) unlinkSync(recoveryPath);
+}
+
+function assertWorkspaceStateEnvelope(state, expected = {}) {
+  if (!isPlainRecord(state) || state.schemaVersion !== STATE_SCHEMA_VERSION) {
+    throw new Error("workspace state envelope is incomplete or uses the wrong schema");
+  }
+  if (!isPlainRecord(state.workspace) || typeof state.workspace.path !== "string" || typeof state.workspace.hash !== "string") {
+    throw new Error("workspace state envelope is missing workspace identity");
+  }
+  if (!isPlainRecord(state.paths) || !isPlainRecord(state.worker) || !isPlainRecord(state.policy) || !isPlainRecord(state.resources)) {
+    throw new Error("workspace state envelope is missing required object fields");
+  }
+  const canonicalWorkspace = resolveWorkspace(expected.canonicalWorkspace || state.workspace.path);
+  const expectedHash = workspaceHash(canonicalWorkspace);
+  if (!sameWorkspaceIdentity(state.workspace.path, canonicalWorkspace) || state.workspace.hash !== expectedHash) {
+    throw new Error("workspace state envelope does not match the selected workspace");
+  }
+  if (typeof state.paths.stateRoot !== "string" || !state.paths.stateRoot
+      || typeof state.paths.profileDir !== "string" || !state.paths.profileDir
+      || typeof state.paths.statePath !== "string" || !state.paths.statePath) {
+    throw new Error("workspace state envelope is missing canonical state paths");
+  }
+  const stateRoot = canonicalizePotentialPath(expected.stateRoot || state.paths.stateRoot);
+  const profileDir = canonicalizePotentialPath(expected.profileDir || state.paths.profileDir);
+  const statePath = canonicalizePotentialPath(expected.statePath || state.paths.statePath);
+  const expectedProfileDir = canonicalizePotentialPath(profileDirForWorkspace(canonicalWorkspace, stateRoot));
+  const expectedStatePath = canonicalizePotentialPath(path.join(expectedProfileDir, "state.json"));
+  if (!samePotentialPathIdentity(profileDir, expectedProfileDir) || !samePotentialPathIdentity(statePath, expectedStatePath)) {
+    throw new Error("workspace state envelope contains inconsistent state paths");
+  }
+  if (!samePotentialPathIdentity(state.paths.stateRoot, stateRoot)
+      || !samePotentialPathIdentity(state.paths.profileDir, profileDir)
+      || !samePotentialPathIdentity(state.paths.statePath, statePath)) {
+    throw new Error("workspace state envelope does not match the active state location");
+  }
+  assertStateRootSeparatedFromWorkspace(stateRoot, canonicalWorkspace);
+  return { canonicalWorkspace, stateRoot, profileDir, statePath };
 }
 
 export function daemonLockPathForState(state) {
@@ -422,7 +482,7 @@ function readBoundedUtf8(filePath, maxBytes, label) {
   }
 }
 
-function readJsonObjectOrBackup(filePath) {
+function readJsonObjectOrBackup(filePath, options = {}) {
   const text = readBoundedUtf8(filePath, MAX_STATE_JSON_BYTES, "state JSON");
   let parsed;
   try {
@@ -434,10 +494,39 @@ function readJsonObjectOrBackup(filePath) {
     replaceFileSync(filePath, backupPath);
     ownerOnlyFile(backupPath);
     pruneBackups(filePath, 3);
-    const recovered = {};
-    Object.defineProperty(recovered, CORRUPT_RECOVERY, { value: true });
-    return recovered;
+    if (options.allowEmptyRecovery === true) {
+      const recovered = {};
+      Object.defineProperty(recovered, CORRUPT_RECOVERY, { value: true });
+      return recovered;
+    }
+    const recoveryPath = options.recoveryPath || recoveryMarkerPath(filePath);
+    const marker = { schemaVersion: RECOVERY_MARKER_SCHEMA, backup: path.basename(backupPath), detectedAt: new Date().toISOString() };
+    replaceFileAtomicallySync(recoveryPath, `${JSON.stringify(marker, null, 2)}\n`, { mode: 0o600 });
+    ownerOnlyFile(recoveryPath);
+    throw recoveryRequiredError(marker);
+  }
+}
+
+function recoveryMarkerPath(statePath) { return `${statePath}.recovery-required`; }
+
+function readRecoveryMarker(markerPath, statePath) {
+  ownerOnlyFile(markerPath);
+  let marker;
+  try { marker = JSON.parse(readBoundedUtf8(markerPath, MAX_MARKER_BYTES, "state recovery marker")); }
+  catch { throw new Error("workspace state recovery marker is invalid; inspect the profile manually before continuing"); }
+  if (marker?.schemaVersion !== RECOVERY_MARKER_SCHEMA || typeof marker.backup !== "string"
+      || !marker.backup.startsWith(`${path.basename(statePath)}.corrupt-`) || path.basename(marker.backup) !== marker.backup
+      || !Number.isFinite(Date.parse(String(marker.detectedAt || "")))) {
+    throw new Error("workspace state recovery marker is invalid; inspect the profile manually before continuing");
   }
+  return Object.freeze({ schemaVersion: marker.schemaVersion, backup: marker.backup, detectedAt: marker.detectedAt });
+}
+
+function recoveryRequiredError(marker) {
+  const backup = marker?.backup || "the bounded corrupt backup";
+  const error = new Error(`workspace state recovery is required; invalid JSON was preserved as ${backup}. Restore a valid current-schema state.json or intentionally remove this profile before restarting`);
+  error.code = "state_recovery_required";
+  return error;
 }
 
 function ensureStateRoot(inputRoot) {
@@ -592,10 +681,11 @@ function pruneBackups(filePath, keep) {
 
 export function ensureWorkerSecrets(state, options = {}) {
   state.worker ||= {};
+  delete state.worker.accountAdminSecret;
   const enrollingDeviceIdentity = !state.worker.deviceIdentity;
-  if (!state.worker.accountAdminSecret || options.rotateSecrets) state.worker.accountAdminSecret = randomToken("account_admin");
-  if (enrollingDeviceIdentity || options.rotateSecrets) state.worker.deviceIdentity = createDeviceIdentity();
-  else validateDeviceIdentity(state.worker.deviceIdentity);
+  if (enrollingDeviceIdentity || (options.rotateSecrets && !options.deferDeviceRotation)) state.worker.deviceIdentity = createDeviceIdentity();
+  else validateDeviceRootIdentity(state.worker.deviceIdentity);
+  if (state.worker.pendingDeviceIdentity) validateDeviceRootIdentity(state.worker.pendingDeviceIdentity);
   delete state.worker.daemonSecret;
   if (!state.worker.oauthTokenVersion || enrollingDeviceIdentity || options.rotateSecrets) {
     state.worker.oauthTokenVersion = randomToken("token_version");
@@ -622,6 +712,42 @@ export function ensureWorkerSecrets(state, options = {}) {
   delete state.worker.updatedAt;
 }
 
+export function deploymentDeviceIdentity(state) {
+  const identity = state?.worker?.pendingDeviceIdentity || state?.worker?.deviceIdentity;
+  return validateDeviceRootIdentity(identity);
+}
+
+export function promotePendingDeviceIdentity(state) {
+  const pending = state?.worker?.pendingDeviceIdentity;
+  if (!pending) return false;
+  validateDeviceRootIdentity(pending);
+  const current = state.worker.deviceIdentity;
+  if (current) {
+    const previous = Array.isArray(state.worker.previousDeviceIdentities) ? state.worker.previousDeviceIdentities : [];
+    state.worker.previousDeviceIdentities = [...previous, publicDeviceRootRecord(current)].slice(-2);
+  }
+  state.worker.deviceIdentity = pending;
+  delete state.worker.pendingDeviceIdentity;
+  return true;
+}
+
+function publicDeviceRootRecord(identity) {
+  validateDeviceRootIdentity(identity);
+  return {
+    scheme: identity.scheme,
+    provider: identity.provider || "portable-jwk-v1",
+    brokerProtocol: identity.brokerProtocol || undefined,
+    brokerPath: identity.brokerPath || undefined,
+    brokerIdentifier: identity.brokerIdentifier || undefined,
+    brokerTeamIdentifier: identity.brokerTeamIdentifier || undefined,
+    keyTag: identity.keyTag || undefined,
+    publicJwk: identity.publicJwk,
+    keyId: identity.keyId,
+    createdAt: identity.createdAt,
+    retiredAt: new Date().toISOString(),
+  };
+}
+
 function defaultWorkerName(hash) {
   return `mbm-${String(hash || "default").slice(0, 12)}`;
 }
@@ -640,8 +766,8 @@ export function ownerOnlyFile(filePath) {
 
 export function redactState(state) {
   const clone = redactHomeInValue(JSON.parse(JSON.stringify(state)));
-  if (clone.worker?.accountAdminSecret) clone.worker.accountAdminSecret = "<redacted>";
   if (clone.worker?.deviceIdentity?.privateJwk?.d) clone.worker.deviceIdentity.privateJwk.d = "<redacted>";
+  redactBrokerPaths(clone.worker);
   if (clone.worker?.oauthTokenVersion) clone.worker.oauthTokenVersion = "<redacted>";
   if (clone.resources && typeof clone.resources === "object") {
     for (const value of Object.values(clone.resources)) {
@@ -653,6 +779,18 @@ export function redactState(state) {
   return clone;
 }
 
+
+function redactBrokerPaths(worker) {
+  if (!worker || typeof worker !== "object") return;
+  for (const identity of [
+    worker.deviceIdentity,
+    worker.pendingDeviceIdentity,
+    ...(Array.isArray(worker.previousDeviceIdentities) ? worker.previousDeviceIdentities : []),
+  ]) {
+    if (identity?.brokerPath) identity.brokerPath = "<local-broker-path>";
+  }
+}
+
 function redactHomeInValue(value) {
   const home = os.homedir();
   if (typeof value === "string") {

package/src/local/stdio.mjs

@@ -15,6 +15,7 @@ import {
 } from "./tools.mjs";
 
 const MAX_LINE_BYTES = 8 * 1024 * 1024;
+const MAX_PENDING_TOOL_CALLS = 32;
 const PACKAGE_VERSION = String(JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version);
 
 export async function runStdioServer({ workspace, policy, logLevel = "info", jobRoot = "", resources = {}, resourceStatePath = "", browserStateRoot = "" }) {
@@ -108,6 +109,10 @@ export async function runStdioServer({ workspace, policy, logLevel = "info", job
       return;
     }
     const args = asObject(params.arguments);
+    if (pending.size >= MAX_PENDING_TOOL_CALLS) {
+      send(rpcError(message.id, -32000, "Too many concurrent tool calls"));
+      return;
+    }
     const callId = `stdio_${randomBytes(16).toString("hex")}`;
     const key = jsonRpcIdKey(message.id);
     if (key && pending.has(key)) {

package/src/local/tool-executor.mjs

@@ -1,5 +1,6 @@
 import { performance } from "node:perf_hooks";
 import { errorCode, normalizeBridgeError } from "./errors.mjs";
+import { normalizeToolResult } from "./tool-result-boundary.mjs";
 
 export class ToolExecutor {
   constructor(options = {}) {
@@ -9,12 +10,13 @@ export class ToolExecutor {
     this.accountAccessGate = options.accountAccessGate;
     this.operationAuthorizer = options.operationAuthorizer;
     this.observability = options.observability;
+    this.securityAudit = options.securityAudit || null;
     this.logger = options.logger || console;
     this.safeMessage = typeof options.safeMessage === "function" ? options.safeMessage : (error) => String(error?.message || error || "operation failed");
     this.slowMs = Number.isFinite(Number(options.slowMs)) ? Math.max(1, Number(options.slowMs)) : 30_000;
     this.pipeline = composeMiddleware([
       lifecycleMiddleware(this.callRegistry),
-      observabilityMiddleware(this.observability, this.logger, this.safeMessage, this.slowMs),
+      observabilityMiddleware(this.observability, this.securityAudit, this.logger, this.safeMessage, this.slowMs),
       authorizeMiddleware(this.policyGate, this.accountAccessGate, this.operationAuthorizer),
     ], invokeHandler(this.handlers));
   }
@@ -32,10 +34,15 @@ function authorizeMiddleware(policyGate, accountAccessGate, operationAuthorizer)
   return async (operation, next) => {
     policyGate.assert(operation.tool);
     if (operation.context.origin === "relay") {
-      const role = operation.request.authorization?.role;
+      const authorization = operation.request.authorization;
+      const role = authorization?.role;
       if (!role) throw new Error("relay tool call is missing an account role");
       accountAccessGate.assert(role, operation.tool);
-      await operationAuthorizer?.authorize(operation);
+      operation.context.authority = accountAccessGate.authority(authorization, policyGate.policy, "relay");
+      const decision = await operationAuthorizer?.authorize(operation);
+      if (decision) operation.context.operationAuthorization = decision;
+    } else {
+      operation.context.authority = accountAccessGate.authority({}, policyGate.policy, "local");
     }
     return next(operation);
   };
@@ -61,7 +68,7 @@ function lifecycleMiddleware(callRegistry) {
   };
 }
 
-function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
+function observabilityMiddleware(observability, securityAudit, logger, safeMessage, slowMs) {
   return async (operation, next) => {
     const started = performance.now();
     observability.start(operation.tool);
@@ -71,23 +78,30 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       origin: operation.context.origin,
     }, "Tool call started");
     try {
-      const result = await next(operation);
+      const normalizedResult = normalizeToolResult(await next(operation));
+      const result = normalizedResult.value;
       const durationMs = performance.now() - started;
       const slow = durationMs >= slowMs;
       observability.finish(operation.tool, { status: "completed", durationMs, slow });
+      await recordSecurityAudit(securityAudit, operation, { outcome: "completed", durationMs, outputBytes: normalizedResult.bytes });
       logger.event?.("debug", slow ? "tool.call.slow" : "tool.call.completed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin, duration_ms: durationMs,
+        authority_role: operation.context.authority?.principal?.role || "local",
+        risk_category: operation.context.operationAuthorization?.category || "ordinary",
       }, slow ? "Tool call completed slowly" : "Tool call completed");
       return result;
     } catch (error) {
-      const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args) });
+      const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args, operation.context) });
       const durationMs = performance.now() - started;
       const code = errorCode(normalized);
       const status = code === "cancelled" ? "cancelled" : code === "timeout" ? "timeout" : "failed";
       observability.finish(operation.tool, { status, durationMs, errorCode: code, slow: durationMs >= slowMs });
+      await recordSecurityAudit(securityAudit, operation, { outcome: status, durationMs, errorCode: code });
       logger.event?.("debug", "tool.call.failed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin,
         duration_ms: durationMs, error_code: code, retryable: normalized.retryable,
+        authority_role: operation.context.authority?.principal?.role || "local",
+        risk_category: operation.context.operationAuthorization?.category || "ordinary",
       }, "Tool call failed");
       throw normalized;
     }
@@ -102,6 +116,25 @@ function invokeHandler(handlers) {
   };
 }
 
+
+async function recordSecurityAudit(securityAudit, operation, outcome) {
+  if (!securityAudit?.record || operation.context.origin !== "relay") return;
+  const decision = operation.context.operationAuthorization || {};
+  const recorded = await securityAudit.record({
+    ...outcome,
+    tool: operation.tool,
+    riskCategory: decision.category || "ordinary operation",
+    targetHash: decision.targetHash || "",
+    principal: operation.context.authority?.principal || {},
+    inputBytes: safeByteLength(operation.args),
+  });
+  if (!recorded) operation.context.auditWarning = "security_audit_unavailable";
+}
+
+function safeByteLength(value) {
+  try { return Buffer.byteLength(JSON.stringify(value)); } catch { return 0; }
+}
+
 function shortCallId(value) {
   return String(value || "").slice(0, 20);
 }

package/src/local/tool-result-boundary.mjs

@@ -0,0 +1,51 @@
+import { Buffer } from "node:buffer";
+import { BridgeError } from "./errors.mjs";
+
+export const MAX_TOOL_RESULT_BYTES = 7 * 1024 * 1024;
+
+export function normalizeToolResult(value, options = {}) {
+  const maximumBytes = positiveInteger(options.maximumBytes, MAX_TOOL_RESULT_BYTES);
+  let serialized;
+  try {
+    serialized = JSON.stringify(value, rejectUnsupportedJsonValue);
+  } catch (error) {
+    if (error instanceof BridgeError) throw error;
+    throw new BridgeError("internal_error", "tool returned a result that could not be serialized", {
+      cause: error instanceof Error ? error : undefined,
+      expose: false,
+    });
+  }
+  if (typeof serialized !== "string") {
+    throw new BridgeError("internal_error", "tool returned an unsupported result", { expose: false });
+  }
+  const bytes = Buffer.byteLength(serialized);
+  if (bytes > maximumBytes) {
+    throw new BridgeError("limit_exceeded", "tool result exceeded the relay response limit", {
+      retryable: false,
+      details: { maximum_bytes: maximumBytes, actual_bytes: bytes },
+    });
+  }
+  try {
+    return Object.freeze({ value: JSON.parse(serialized), bytes });
+  } catch (error) {
+    throw new BridgeError("internal_error", "tool result normalization failed", {
+      cause: error instanceof Error ? error : undefined,
+      expose: false,
+    });
+  }
+}
+
+function rejectUnsupportedJsonValue(_key, current) {
+  if (typeof current === "bigint" || typeof current === "function" || typeof current === "symbol" || typeof current === "undefined") {
+    throw new BridgeError("internal_error", "tool returned a non-JSON value", { expose: false });
+  }
+  if (typeof current === "number" && !Number.isFinite(current)) {
+    throw new BridgeError("internal_error", "tool returned a non-finite number", { expose: false });
+  }
+  return current;
+}
+
+function positiveInteger(value, fallback) {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+}

package/src/local/tools.mjs

@@ -10,6 +10,7 @@ export {
   allToolNames,
   assertCanonicalFullPolicy,
   assertToolAllowed,
+  intersectPolicies,
   isCanonicalFullPolicy,
   normalizePolicy,
   policyAllowsAvailability,

package/src/local/trusted-executable.mjs

@@ -0,0 +1,53 @@
+import { accessSync, constants as fsConstants, realpathSync, statSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { BridgeError } from "./errors.mjs";
+
+export function resolveTrustedExecutable(options = {}) {
+  const platform = String(options.platform || process.platform);
+  const candidates = Array.isArray(options.candidates) ? options.candidates : [];
+  const deniedRoots = [options.workspace, options.stateRoot, options.runtimeDir, options.home || safeHome()]
+    .filter(Boolean).map((value) => canonicalOrResolved(String(value), options.realpath || realpathSync));
+  const realpath = options.realpath || realpathSync;
+  const stat = options.stat || statSync;
+  const access = options.access || accessSync;
+  for (const candidate of candidates) {
+    if (!path.isAbsolute(String(candidate || ""))) continue;
+    let canonical;
+    let info;
+    try {
+      canonical = realpath(String(candidate));
+      info = stat(canonical);
+      if (!info.isFile()) continue;
+      if (platform !== "win32") access(canonical, fsConstants.X_OK);
+    } catch { continue; }
+    if (platform !== "win32" && (Number(info.mode) & 0o022) !== 0) continue;
+    if (deniedRoots.some((root) => isWithin(canonical, root, platform))) continue;
+    return canonical;
+  }
+  const label = String(options.label || "required executable").replace(/[^A-Za-z0-9._ -]/g, "").trim() || "required executable";
+  const reason = String(options.reason || "trusted_executable_unavailable").replace(/[^A-Za-z0-9_-]/g, "_");
+  throw new BridgeError("unavailable", `trusted ${label} is unavailable`, { details: { reason, platform } });
+}
+
+export function createTrustedExecutableResolver(options = {}) {
+  const injected = typeof options.resolve === "function" ? options.resolve : null;
+  let cached = "";
+  return () => {
+    if (cached) return cached;
+    cached = String(injected ? injected() : resolveTrustedExecutable(options));
+    if (!path.isAbsolute(cached)) throw new BridgeError("unavailable", `trusted ${options.label || "executable"} is unavailable`);
+    return cached;
+  };
+}
+
+function canonicalOrResolved(value, realpath) {
+  try { return realpath(path.resolve(value)); } catch { return path.resolve(value); }
+}
+function isWithin(candidate, root, platform) {
+  const left = platform === "win32" ? candidate.toLowerCase() : candidate;
+  const right = platform === "win32" ? root.toLowerCase() : root;
+  const relative = path.relative(right, left);
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+function safeHome() { try { return os.homedir(); } catch { return ""; } }

package/src/local/trusted-git-executable.mjs

@@ -0,0 +1,34 @@
+import path from "node:path";
+import { createTrustedExecutableResolver, resolveTrustedExecutable } from "./trusted-executable.mjs";
+
+export function resolveTrustedGitExecutable(options = {}) {
+  const platform = String(options.platform || process.platform);
+  return resolveTrustedExecutable({
+    ...options,
+    platform,
+    label: "Git executable",
+    reason: "trusted_git_executable_unavailable",
+    candidates: Array.isArray(options.candidates) ? options.candidates : defaultGitCandidates(platform, options.env || process.env),
+  });
+}
+
+export function createTrustedGitResolver(options = {}) {
+  const platform = String(options.platform || process.platform);
+  return createTrustedExecutableResolver({
+    ...options,
+    platform,
+    label: "Git executable",
+    reason: "trusted_git_executable_unavailable",
+    candidates: Array.isArray(options.candidates) ? options.candidates : defaultGitCandidates(platform, options.env || process.env),
+  });
+}
+
+function defaultGitCandidates(platform, env) {
+  if (platform === "win32") {
+    return [env.ProgramFiles, env["ProgramFiles(x86)"]]
+      .filter(Boolean)
+      .flatMap((root) => [path.join(root, "Git", "cmd", "git.exe"), path.join(root, "Git", "bin", "git.exe")]);
+  }
+  if (platform === "darwin") return ["/usr/bin/git", "/opt/homebrew/bin/git", "/usr/local/bin/git"];
+  return ["/usr/bin/git", "/bin/git", "/usr/local/bin/git"];
+}

package/src/local/trusted-github-cli.mjs

@@ -0,0 +1,24 @@
+import path from "node:path";
+import { resolveTrustedExecutable } from "./trusted-executable.mjs";
+
+export function resolveTrustedGithubCli(options = {}) {
+  const platform = String(options.platform || process.platform);
+  return resolveTrustedExecutable({
+    ...options,
+    platform,
+    label: "GitHub CLI executable",
+    reason: "trusted_github_cli_unavailable",
+    candidates: Array.isArray(options.candidates) ? options.candidates : githubCliCandidates(platform, options.env || process.env),
+  });
+}
+
+function githubCliCandidates(platform, env) {
+  if (platform === "win32") {
+    return [
+      env.ProgramFiles && path.join(env.ProgramFiles, "GitHub CLI", "gh.exe"),
+      env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, "Programs", "GitHub CLI", "gh.exe"),
+    ].filter(Boolean);
+  }
+  if (platform === "darwin") return ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"];
+  return ["/usr/bin/gh", "/usr/local/bin/gh", "/snap/bin/gh"];
+}

package/src/local/windows-service.mjs

@@ -50,6 +50,20 @@ export async function startWindowsTask(logger = console, options = {}) {
   const before = await statusWindowsTask({ ...options, run });
   if (before.installed === null) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "task_status_unavailable", status: before };
   if (before.installed === false) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "not_installed", status: before };
+  if (before.active === true) {
+    logger.info?.("Windows Scheduled Task is already running");
+    return {
+      ok: true,
+      provider: "schtasks",
+      task: WINDOWS_TASK,
+      installed: true,
+      active_before: true,
+      active: true,
+      already_running: true,
+      reason: "already_running",
+      status: before,
+    };
+  }
   const command = await run("schtasks", ["/Run", "/TN", WINDOWS_TASK]);
   const after = await waitForWindowsStatus(
     status => status.active === true || completedSince(before, status),
@@ -68,6 +82,12 @@ export async function startWindowsTask(logger = console, options = {}) {
     reason: after.active === true ? "started" : completed ? "completed" : "start_not_observed",
   };
 }
+export async function restartWindowsTask(logger = console, options = {}) {
+  const stopped = await stopWindowsTask(logger, options);
+  if (!stopped.ok) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "stop_failed", stop: stopped };
+  const started = await startWindowsTask(logger, options);
+  return { ...started, restarted: started.ok === true, stop: stopped };
+}
 
 export async function stopWindowsTask(logger = console, options = {}) {
   const run = requiredRun(options.run);

package/src/local/worker-deployment.mjs

@@ -2,7 +2,7 @@ import { createHmac } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path, { resolve } from "node:path";
 import { runWrangler } from "./shell.mjs";
-import { packageRoot, saveState } from "./state.mjs";
+import { deploymentDeviceIdentity, packageRoot, saveState } from "./state.mjs";
 import { withWorkerSecretsFile } from "./worker-secret-file.mjs";
 import { publicDeviceJwkJson } from "./device-identity.mjs";
 import {
@@ -81,8 +81,7 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
 export function workerDeploymentFingerprint(state, options = {}) {
   const root = resolve(options.packageRoot || packageRoot);
   const keyMaterial = [
-    String(state.worker.accountAdminSecret || ""),
-    publicDeviceJwkJson(state.worker.deviceIdentity),
+    publicDeviceJwkJson(deploymentDeviceIdentity(state)),
     String(state.worker.oauthTokenVersion || ""),
   ].join("\0");
   const fingerprint = createHmac("sha256", keyMaterial);
@@ -119,7 +118,7 @@ export function workerUrlMatchesName(workerUrl, workerName) {
 }
 
 function hasCompleteWorkerState(worker = {}) {
-  return Boolean(worker.url && worker.mcpServerUrl && worker.accountAdminSecret && worker.deviceIdentity && worker.oauthTokenVersion && worker.name);
+  return Boolean(worker.url && worker.mcpServerUrl && worker.deviceIdentity && worker.oauthTokenVersion && worker.name);
 }
 
 function workerDeployHashFiles(root) {

package/src/local/worker-secret-file.mjs

@@ -4,6 +4,7 @@ import { resolve } from "node:path";
 import { createExclusiveFileSync } from "./exclusive-file.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { publicDeviceJwkJson } from "./device-identity.mjs";
+import { deploymentDeviceIdentity } from "./state.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync } from "./secure-file.mjs";
 
 const SECRET_FILE_PATTERN = /^worker-secrets-(\d+)-(\d+)(?:-p(\d+))?(?:-([a-f0-9]+))?\.json$/;
@@ -17,8 +18,7 @@ export async function withWorkerSecretsFile(state, callback, options = {}) {
   const random = (options.randomBytes || randomBytes)(6).toString("hex");
   const tempPath = resolve(dir, `worker-secrets-${process.pid}-${createdAt}-p${processStartedAt}-${random}.json`);
   const payload = {
-    ACCOUNT_ADMIN_SECRET: state.worker.accountAdminSecret,
-    DAEMON_DEVICE_PUBLIC_KEY: publicDeviceJwkJson(state.worker.deviceIdentity),
+    DAEMON_DEVICE_PUBLIC_KEY: publicDeviceJwkJson(deploymentDeviceIdentity(state)),
     OAUTH_TOKEN_VERSION: state.worker.oauthTokenVersion,
   };