machine-bridge-mcp 2.0.0 → 3.0.0-beta.11

package/docs/UPGRADING.md

@@ -2,37 +2,121 @@
 
 ## Supported upgrade contract
 
-Machine Bridge does not retain parallel implementations for obsolete MCP protocol dates, policy revisions, state schemas, lock formats, or browser-extension protocols. The supported path is a direct upgrade from the immediately preceding published package while its state already uses the current schema.
+Machine Bridge supports direct upgrade from the immediately preceding published release. Obsolete transport, state, lock, browser-extension, and authorization implementations are not retained as hidden compatibility paths.
 
-Version 2.0.0 is a coordinated Worker/daemon security-protocol upgrade. It replaces the long-lived daemon bearer with a P-256 device identity, replaces network account-administration bearer requests with per-request HMAC signatures, shortens OAuth access tokens, introduces refresh-token families and replay revocation, and adds local capability leases for high-impact remote effects. The Worker and daemon must converge on 2.0.0 together; the removed daemon bearer protocol is not retained as a fallback.
+Version 3.0.0 is a coordinated Worker, daemon, CLI, and browser-extension security upgrade. Mixed 2.x and 3.x components are intentionally unavailable.
 
-On the first 2.0.0 state load, a workspace without a device identity generates one locally, removes the legacy daemon secret, and rotates the deployment-wide OAuth token version. Existing pre-2.0 access and refresh credentials therefore fail closed and every client must authorize again. The device private JWK remains in owner-only local state; only the public JWK is deployed to the Worker. Subsequent ordinary starts preserve both the device identity and token version.
+The major changes are:
 
-The canonical `full` profile is unchanged as a capability ceiling. Authenticated owner operations use that ceiling directly without terminal approval. High-impact operations from delegated non-owner accounts require a local account/client-bound lease, while their normal workspace-contained reads and edits and project inspection remain automatic. Because the packaged extension controls an existing browser profile, one `browser-session` lease covers profile reads and actions; registered-resource input or file upload uses the separate `data-export` scope. An operator may approve the requested scope or explicitly open a temporary `full` window for at most eight hours. Lease state is independent of the policy profile and does not migrate into OAuth credentials.
+- account roles become non-escalatable hard ceilings;
+- terminal approval IDs and runtime capability leases are removed from authorization;
+- OAuth clients become persistently bound to one account and role version;
+- process sessions, retained output, and managed jobs bind to account, client, and refresh-token family;
+- account administration moves from a long-lived symmetric secret to root-certified ephemeral P-256 session signatures;
+- daemon connections use a root-certified 24-hour in-memory session key;
+- macOS can use a non-exportable Secure Enclave root only through an explicitly configured, provisioning-profile-validated broker; otherwise it retains the portable owner-only root;
+- supported OAuth clients may use DPoP-bound access and refresh tokens;
+- generic path-based remote file access to Machine Bridge control-plane state is denied even to `owner`; arbitrary owner shell execution remains local-user authority;
+- delegated process execution requires a behaviorally verified OS sandbox and otherwise fails closed;
+- local security events form a bounded, privacy-preserving hash chain.
 
-Version 1.2.0 could accept prototype-shaped account roles through malformed administration input. On the first 1.2.1 or later Worker access, such an account is preserved for recovery but repaired fail-closed: its role becomes `reviewer`, it is disabled, its account version advances, and its authorization codes and tokens are removed. An operator can then assign a valid role, enable the account, and rotate its password through the normal account administration flow. A local policy record with an unknown profile label is normalized to `custom` while retaining its explicit capability fields; an invalid explicit `--profile` is rejected.
+## Version 2 to version 3
 
-A state file from an older unsupported schema is rejected rather than guessed or silently rewritten. Upgrade an old installation through the last release that understands its schema, or initialize a new workspace and re-register resources. Do not edit schema numbers by hand.
+### Device-root migration
+
+`3.0.0-beta.1`, `3.0.0-beta.2`, `3.0.0-beta.3`, `3.0.0-beta.4`, `3.0.0-beta.5`, and `3.0.0-beta.6` are blocked and must not be activated, accepted, published, or promoted. Beta.1 changed the canonical JWK member order used by version 2 device identifiers. Beta.2 repaired that compatibility issue but attempted to create a persistent Secure Enclave key from an ad-hoc-signed runtime helper, which macOS rejected with `errSecMissingEntitlement` (`-34018`). Beta.3 completed owner activation but exposed delegated project/Git authority defects. Beta.4 corrected those defects, yet continued owner-machine auditing found service-control self-termination, timestamp-less mixed-format logs, system-VPN relay outages amplified by a sixty-second reconnect cap, and additional state/browser/job/process boundaries. Beta.5 corrected those findings and passed live Worker/daemon/start/restart verification, but its launchd definition captured npm lifecycle PATH injection and the prior candidate runtime that activation then removed. Beta.6 removed stale candidate paths but selected only the first npm marker; nested npm activation retained an inner project-bin prefix. None of the blocked candidates intentionally rotated or invalidated the existing portable device root.
+
+`3.0.0-beta.7` retains the portable P-256 root by default and is the next supported candidate path. It includes the beta.5 authority, relay, state, browser, managed-job, process-tree, audit-lock, hard-link, and service-lifecycle corrections, then makes the persistent service PATH independent of nested npm lifecycle injection and inactive candidate runtimes. Normal startup performs no Keychain operation and requests no user presence unless an explicitly provisioned broker is configured.
+
+Secure Enclave enrollment is optional and explicit. Set `MBM_MACOS_TRUST_BROKER` to the absolute executable path inside an app-like broker that is signed by an Apple development or distribution identity and whose data-protection Keychain entitlements are validated by an embedded provisioning profile. Machine Bridge then verifies that the path is a non-symlink regular executable, rejects group/other-writable files, verifies the strict code signature, records the signing identifier and Team ID, and performs an end-to-end create/delete probe with a temporary Secure Enclave key. A source-built or ad-hoc-signed helper is intentionally rejected.
+
+When a provisioned broker is configured, migration remains two-phase:
+
+1. the broker creates the non-exportable key and Machine Bridge stores only its canonical broker binding, public JWK, key ID, and Keychain tag as `pendingDeviceIdentity`;
+2. the Worker is deployed with that pending public key;
+3. Worker health and exact-version convergence are verified;
+4. only then is the pending root promoted to active state.
+
+A failed probe, upload, interrupted process, or failed health check leaves the old active root intact. `--daemon-only` refuses to activate an undeployed pending root. Every later public-key check and signature revalidates the canonical broker path, code-signing identifier, and Team ID.
+
+Other platforms, and macOS installations without a provisioned broker, use the portable P-256 provider. Its private JWK remains owner-only local state and is explicitly reported as exportable.
+
+### OAuth clients and tokens
+
+Existing clients may need to authorize again so the Worker can record the new trusted account binding. A refresh token whose client record is not bound to the current account version and role fails closed.
+
+Access tokens remain short-lived. Refresh tokens remain one-time rotating and family-bound. Reuse of an already-rotated refresh token revokes the complete family, including active access tokens.
+
+DPoP is optional. A client that supports DPoP may bind its token family to a P-256 key; clients without DPoP continue with Bearer tokens under the same account, client, role, and family checks.
+
+### Removed authorization workflows
+
+Version 3 does not create or consume pending approval IDs. The following workflows are obsolete:
+
+```text
+machine-mcp approval approve ...
+machine-mcp approval grant ...
+machine-mcp job approve ...
+```
+
+Legacy version 2 lease state may be listed, revoked, or cleared for cleanup, but it has no effect on runtime authority.
+
+`stage_job` is a non-executing draft and cannot be promoted by a terminal approval command. A trusted owner uses `start_job`; a local machine operator may submit a reviewed plan with `machine-mcp job submit PLAN.json`.
+
+### Removed administration secret
+
+`ACCOUNT_ADMIN_SECRET` is deleted from local state and is no longer deployed to the Worker. Account and OAuth-client administration uses the same root-certified ephemeral session established for daemon startup or an independently authorized local administration command.
 
 ## Normal upgrade
 
-1. Finish or cancel ordinary interactive process sessions. Accepted managed jobs may continue independently, but inspect them before replacing the daemon.
-2. Install the new package with the pinned npm procedure in [Getting started](GETTING_STARTED.md).
-3. Run `machine-mcp doctor`.
-4. Start `machine-mcp` normally in the foreground for each workspace. Startup generates the device identity if needed, rotates the old deployment token version, deploys the matching public key and 2.0.0 Worker, verifies end-to-end readiness, and only then may replace the prior service daemon.
-5. Reauthorize every remote MCP client. Pre-2.0 access and refresh tokens are intentionally invalid.
-6. Reload the unpacked browser extension. Protocol and packaged-version equality are mandatory; an old extension cannot replace a working compatible connection.
-7. Exercise one safe read and one high-impact operation. Approve the resulting scope or an explicit temporary `--full` window through the local CLI, then retry the operation.
-8. Restore or reinstall background service operation only after the foreground path is healthy.
+1. Inspect or cancel interactive processes and managed jobs that should not survive daemon replacement.
+2. Back up the owner-only state directory with an operating-system tool that preserves permissions. Do not upload or publish the backup.
+3. Install the version 3 package.
+4. Run `machine-mcp doctor`.
+5. Start each workspace normally in the foreground. Without a provisioned broker, macOS reuses the portable root and does not prompt.
+6. When `MBM_MACOS_TRUST_BROKER` is intentionally configured, verify the broker deployment first and complete the single user-presence request used to sign the daemon session certificate. Do not start with `--daemon-only` during this optional root migration.
+7. Allow Machine Bridge to deploy and verify the matching version 3 Worker. A pending root is promoted only after health convergence.
+8. Reconnect each hosted MCP client and complete OAuth authorization when requested.
+9. Inspect trusted clients with `machine-mcp account clients` and revoke stale or duplicate records.
+10. Reload the version 3 browser extension.
+11. Verify one safe workspace read, one ordinary edit, and one owner-only action appropriate for the deployment.
+12. Restore background service operation only after the foreground path is healthy.
+
+## Verification
+
+After upgrade, `server_info` should report:
+
+- matching Worker and daemon version;
+- end-to-end relay readiness;
+- the authenticated account role and effective policy;
+- a current OAuth client and refresh family;
+- device-root provider and exportability;
+- ephemeral session use for reconnect signing;
+- delegated sandbox status;
+- security-audit chain health.
+
+A full daemon policy is not proof that a delegated account has full authority. Use `authorization.effective_policy` and `authorization.effective_tools` for the current request.
 
 ## Upgrade safety
 
-Before replacing live software, copy the owner-only state directory using operating-system tools that preserve permissions. Do not publish or attach that backup: it contains credentials and private resource metadata.
+Machine Bridge rejects unreadable, malformed, foreign-schema, or ambiguous state rather than silently initializing replacement state.
+
+Worker deployment records upload success separately from health convergence. A post-upload network failure does not trigger an uncontrolled repeated write, and a pending root is not promoted merely because Wrangler returned success.
 
-Machine Bridge never treats an unreadable or foreign-schema state file as empty state. It also records a successful Worker upload before secondary health verification, so a network or proxy failure after deployment does not trigger an uncontrolled repeated write.
+The packaged Swift broker source is a development and protocol-conformance fixture only. The local build is ad-hoc signed and is deliberately rejected by the production validator because it cannot obtain a provisioning-profile-validated data-protection Keychain access group. A production Secure Enclave broker must be shipped as an app-like, correctly signed and provisioned component outside the npm runtime build.
 
 ## Rollback
 
-Rollback is supported only from a complete pre-upgrade backup. Version 2.0.0 changes Worker/daemon authentication, OAuth refresh state, administration authentication, and local credential material. An older package cannot use the new device protocol or refresh-family state. Rolling back package files alone therefore produces an unavailable or incorrectly authenticated mixed system. Restore the complete owner-only profile backup, prior Worker secret set/build, package version, service definition, and browser extension as one unit, or fix forward.
+Rollback is supported only as a complete unit from a verified pre-upgrade backup.
+
+Version 3 changes daemon authentication, account administration, OAuth client trust, object ownership, local authorization, and device-root storage. Copying an older package over version 3 state produces a mixed system that should fail closed.
+
+A rollback must restore together:
+
+- the complete prior owner-only state root;
+- the prior package;
+- the prior Worker build and secrets;
+- the prior service definition;
+- the prior browser extension.
 
-Never roll back by copying only selected state files or changing version fields. Restore one complete verified state backup, package version, Worker build, and browser extension as a single operational unit.
+Do not roll back by editing version or schema fields, copying selected credential files, or restoring only the Worker. Prefer fixing forward when a complete backup is unavailable.

package/native/macos/MachineBridgeTrustBroker.swift

@@ -0,0 +1,233 @@
+import Foundation
+import Security
+import LocalAuthentication
+
+private enum BrokerError: Error, CustomStringConvertible {
+    case usage(String)
+    case security(OSStatus, String)
+    case invalidKey(String)
+    case invalidInput(String)
+
+    var description: String {
+        switch self {
+        case .usage(let value), .invalidKey(let value), .invalidInput(let value): return value
+        case .security(let status, let operation):
+            let text = SecCopyErrorMessageString(status, nil) as String? ?? "OSStatus \(status)"
+            return "\(operation) failed: \(text)"
+        }
+    }
+}
+
+private struct Output: Encodable {
+    let ok: Bool
+    let provider: String
+    let keyTag: String
+    let publicJwk: PublicJwk?
+    let signature: String?
+    let secureEnclave: Bool
+}
+
+private struct PublicJwk: Codable {
+    let kty: String
+    let crv: String
+    let x: String
+    let y: String
+}
+
+private let providerName = "macos-secure-enclave-v1"
+
+@main
+private struct MachineBridgeTrustBroker {
+    static func main() {
+        do {
+            let arguments = CommandLine.arguments
+            guard arguments.count >= 4, arguments[2] == "--tag" else {
+                throw BrokerError.usage("usage: machine-bridge-trust-broker <ensure|public|sign|delete|status> --tag <tag> [--reason <text>]")
+            }
+            let action = arguments[1]
+            let tag = arguments[3]
+            guard tag.range(of: #"^[A-Za-z0-9._-]{8,180}$"#, options: .regularExpression) != nil else {
+                throw BrokerError.invalidInput("key tag is invalid")
+            }
+            let reason = option("--reason", in: arguments) ?? "Authorize Machine Bridge startup"
+            let result: Output
+            switch action {
+            case "ensure":
+                let key = try ensurePrivateKey(tag: tag)
+                result = try output(tag: tag, key: key, signature: nil)
+            case "public":
+                let key = try loadPrivateKey(tag: tag, prompt: nil, allowInteraction: false)
+                result = try output(tag: tag, key: key, signature: nil)
+            case "status":
+                let key = try? loadPrivateKey(tag: tag, prompt: nil, allowInteraction: false)
+                if let key {
+                    result = try output(tag: tag, key: key, signature: nil)
+                } else {
+                    result = Output(ok: false, provider: providerName, keyTag: tag, publicJwk: nil, signature: nil, secureEnclave: secureEnclaveAvailable())
+                }
+            case "sign":
+                let data = FileHandle.standardInput.readDataToEndOfFile()
+                guard !data.isEmpty, data.count <= 64 * 1024 else { throw BrokerError.invalidInput("signing input is empty or too large") }
+                guard String(data: data, encoding: .utf8) != nil else { throw BrokerError.invalidInput("signing input is not UTF-8") }
+                let key = try loadPrivateKey(tag: tag, prompt: reason, allowInteraction: true)
+                var error: Unmanaged<CFError>?
+                guard let der = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &error) as Data? else {
+                    throw error?.takeRetainedValue() ?? BrokerError.invalidKey("Secure Enclave signing failed")
+                }
+                let raw = try derToP1363(der)
+                result = try output(tag: tag, key: key, signature: raw.base64URLEncodedString())
+            case "delete":
+                let status = SecItemDelete(keyQuery(tag: tag, returnRef: false, allowInteraction: false, prompt: nil) as CFDictionary)
+                guard status == errSecSuccess || status == errSecItemNotFound else { throw BrokerError.security(status, "delete key") }
+                result = Output(ok: true, provider: providerName, keyTag: tag, publicJwk: nil, signature: nil, secureEnclave: secureEnclaveAvailable())
+            default:
+                throw BrokerError.usage("unknown action: \(action)")
+            }
+            try emit(result)
+        } catch {
+            let message = String(describing: error)
+            FileHandle.standardError.write(Data("machine-bridge-trust-broker: \(message)\n".utf8))
+            exit(1)
+        }
+    }
+}
+
+private func ensurePrivateKey(tag: String) throws -> SecKey {
+    if let existing = try? loadPrivateKey(tag: tag, prompt: nil, allowInteraction: false) { return existing }
+    guard secureEnclaveAvailable() else { throw BrokerError.invalidKey("Secure Enclave is unavailable") }
+    var accessError: Unmanaged<CFError>?
+    guard let access = SecAccessControlCreateWithFlags(
+        nil,
+        kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+        [.privateKeyUsage, .userPresence],
+        &accessError
+    ) else {
+        throw accessError?.takeRetainedValue() ?? BrokerError.invalidKey("could not create Secure Enclave access control")
+    }
+    let privateAttributes: [String: Any] = [
+        kSecAttrIsPermanent as String: true,
+        kSecAttrApplicationTag as String: Data(tag.utf8),
+        kSecAttrAccessControl as String: access,
+    ]
+    let attributes: [String: Any] = [
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrKeySizeInBits as String: 256,
+        kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+        kSecPrivateKeyAttrs as String: privateAttributes,
+    ]
+    var keyError: Unmanaged<CFError>?
+    guard let key = SecKeyCreateRandomKey(attributes as CFDictionary, &keyError) else {
+        throw keyError?.takeRetainedValue() ?? BrokerError.invalidKey("could not create Secure Enclave key")
+    }
+    return key
+}
+
+private func loadPrivateKey(tag: String, prompt: String?, allowInteraction: Bool) throws -> SecKey {
+    let query = keyQuery(tag: tag, returnRef: true, allowInteraction: allowInteraction, prompt: prompt)
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &result)
+    guard status == errSecSuccess, let key = result as! SecKey? else { throw BrokerError.security(status, "load Secure Enclave key") }
+    return key
+}
+
+private func keyQuery(tag: String, returnRef: Bool, allowInteraction: Bool, prompt: String?) -> [String: Any] {
+    var query: [String: Any] = [
+        kSecClass as String: kSecClassKey,
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrApplicationTag as String: Data(tag.utf8),
+        kSecReturnRef as String: returnRef,
+        kSecMatchLimit as String: kSecMatchLimitOne,
+    ]
+    let context = LAContext()
+    if allowInteraction {
+        context.localizedReason = prompt ?? "Authorize Machine Bridge startup"
+    } else {
+        context.interactionNotAllowed = true
+    }
+    query[kSecUseAuthenticationContext as String] = context
+    return query
+}
+
+private func output(tag: String, key: SecKey, signature: String?) throws -> Output {
+    guard let publicKey = SecKeyCopyPublicKey(key) else { throw BrokerError.invalidKey("public key is unavailable") }
+    var error: Unmanaged<CFError>?
+    guard let external = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else {
+        throw error?.takeRetainedValue() ?? BrokerError.invalidKey("public key export failed")
+    }
+    guard external.count == 65, external.first == 0x04 else { throw BrokerError.invalidKey("public key representation is invalid") }
+    let x = external.subdata(in: 1..<33).base64URLEncodedString()
+    let y = external.subdata(in: 33..<65).base64URLEncodedString()
+    return Output(
+        ok: true,
+        provider: providerName,
+        keyTag: tag,
+        publicJwk: PublicJwk(kty: "EC", crv: "P-256", x: x, y: y),
+        signature: signature,
+        secureEnclave: true
+    )
+}
+
+private func secureEnclaveAvailable() -> Bool {
+    let attributes: [String: Any] = [
+        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+        kSecAttrKeySizeInBits as String: 256,
+        kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
+        kSecPrivateKeyAttrs as String: [kSecAttrIsPermanent as String: false],
+    ]
+    var error: Unmanaged<CFError>?
+    return SecKeyCreateRandomKey(attributes as CFDictionary, &error) != nil
+}
+
+private func derToP1363(_ data: Data) throws -> Data {
+    var index = 0
+    func readByte() throws -> UInt8 {
+        guard index < data.count else { throw BrokerError.invalidInput("ECDSA signature is truncated") }
+        defer { index += 1 }
+        return data[index]
+    }
+    func readLength() throws -> Int {
+        let first = try readByte()
+        if first < 0x80 { return Int(first) }
+        let count = Int(first & 0x7f)
+        guard count > 0, count <= 2 else { throw BrokerError.invalidInput("ECDSA signature length is invalid") }
+        var length = 0
+        for _ in 0..<count { length = (length << 8) | Int(try readByte()) }
+        return length
+    }
+    guard try readByte() == 0x30 else { throw BrokerError.invalidInput("ECDSA signature sequence is invalid") }
+    let sequenceLength = try readLength()
+    guard sequenceLength == data.count - index else { throw BrokerError.invalidInput("ECDSA signature sequence length is invalid") }
+    func readInteger() throws -> Data {
+        guard try readByte() == 0x02 else { throw BrokerError.invalidInput("ECDSA signature integer is invalid") }
+        let length = try readLength()
+        guard length > 0, index + length <= data.count else { throw BrokerError.invalidInput("ECDSA signature integer is truncated") }
+        var value = data.subdata(in: index..<(index + length))
+        index += length
+        while value.count > 32, value.first == 0 { value.removeFirst() }
+        guard value.count <= 32 else { throw BrokerError.invalidInput("ECDSA signature integer is too large") }
+        if value.count < 32 { value = Data(repeating: 0, count: 32 - value.count) + value }
+        return value
+    }
+    let r = try readInteger()
+    let s = try readInteger()
+    guard index == data.count else { throw BrokerError.invalidInput("ECDSA signature has trailing bytes") }
+    return r + s
+}
+
+private func option(_ name: String, in arguments: [String]) -> String? {
+    guard let index = arguments.firstIndex(of: name), index + 1 < arguments.count else { return nil }
+    return arguments[index + 1]
+}
+
+private func emit<T: Encodable>(_ value: T) throws {
+    let encoder = JSONEncoder()
+    encoder.outputFormatting = [.sortedKeys]
+    FileHandle.standardOutput.write(try encoder.encode(value))
+    FileHandle.standardOutput.write(Data("\n".utf8))
+}
+
+private extension Data {
+    func base64URLEncodedString() -> String {
+        base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "2.0.0",
+  "version": "3.0.0-beta.11",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -22,6 +22,7 @@
     "src/shared",
     "src/worker",
     "scripts",
+    "native",
     "wrangler.jsonc",
     "tsconfig.json",
     "tsconfig.local.json",
@@ -43,7 +44,7 @@
     "version:check": "node scripts/sync-worker-version.mjs --check",
     "version": "node scripts/sync-worker-version.mjs && git add package.json package-lock.json src/worker/index.ts browser-extension/manifest.json",
     "prepack": "npm run version:check && npm run privacy:check && npm run release-impact:check",
-    "prepublishOnly": "npm run check && npm run version:check && npm run release:check",
+    "prepublishOnly": "npm run publication:check && npm run check && npm run version:check && npm run release:check",
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit && npm run typecheck:local",
     "syntax": "node scripts/syntax-check.mjs",
@@ -135,12 +136,39 @@
     "github-backlog:test": "node tests/github-backlog-test.mjs",
     "github:backlog": "node scripts/github-backlog.mjs",
     "operation-authorization:test": "node tests/operation-authorization-test.mjs",
-    "device-auth:test": "node tests/device-auth-test.mjs"
+    "device-auth:test": "node tests/device-auth-test.mjs",
+    "device-root-provider:test": "node tests/device-root-provider-test.mjs",
+    "security-audit:test": "node tests/security-audit-log-test.mjs",
+    "delegated-sandbox:test": "node tests/delegated-process-sandbox-test.mjs",
+    "dpop:test": "node tests/dpop-test.mjs",
+    "macos-trust:test": "node tests/macos-trust-broker-test.mjs",
+    "worker-security:test": "node tests/worker-security-boundaries-test.mjs",
+    "publication:check": "node scripts/npm-publication-policy.mjs",
+    "prerelease:release": "node scripts/github-release.mjs --publish-prerelease",
+    "release:candidate:activate": "node scripts/start-release-candidate.mjs --activate-service",
+    "prerelease:install": "node scripts/install-published-prerelease.mjs",
+    "prerelease:soak:accept": "node scripts/release-soak.mjs --record",
+    "release:soak:verify": "node scripts/release-soak.mjs --verify",
+    "release-channel:test": "node tests/release-channel-test.mjs",
+    "promotion-digest:test": "node tests/promotion-digest-test.mjs",
+    "prerelease-activation:test": "node tests/prerelease-activation-test.mjs",
+    "release-soak:test": "node tests/release-soak-test.mjs",
+    "published-release:test": "node tests/published-release-test.mjs",
+    "npm-publication-policy:test": "node tests/npm-publication-policy-test.mjs",
+    "runtime-activation:test": "node tests/runtime-activation-test.mjs",
+    "prerelease:publish": "node scripts/publish-npm.mjs prerelease",
+    "stable:publish": "node scripts/publish-npm.mjs stable",
+    "publish-npm:test": "node tests/publish-npm-test.mjs",
+    "release-candidate-manifest:test": "node tests/release-candidate-manifest-test.mjs",
+    "device-key-id-compatibility:test": "node tests/device-key-id-compatibility-test.mjs",
+    "candidate-runtime-store:test": "node tests/candidate-runtime-store-test.mjs",
+    "service-restart:test": "node tests/service-restart-handoff-test.mjs",
+    "browser-identity:test": "node tests/browser-extension-identity-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",
     "proxy-from-env": "2.1.0",
-    "wrangler": "4.112.0",
+    "wrangler": "4.113.0",
     "ws": "8.21.1"
   },
   "devDependencies": {
@@ -178,9 +206,9 @@
   "homepage": "https://github.com/YuLeiFuYun/machine-bridge-mcp#readme",
   "allowScripts": {
     "esbuild@0.28.1": true,
-    "sharp@0.34.5": true,
     "fsevents": false,
-    "workerd@1.20260714.1": true
+    "sharp@0.35.3": true,
+    "workerd@1.20260721.1": true
   },
   "packageManager": "npm@12.0.1",
   "devEngines": {
@@ -194,5 +222,8 @@
       "version": ">=12.0.0",
       "onFail": "error"
     }
+  },
+  "overrides": {
+    "sharp": "0.35.3"
   }
 }

package/scripts/candidate-runtime-store.mjs

@@ -0,0 +1,38 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { parseReleaseVersion } from "./release-channel.mjs";
+
+const RUNTIME_DIRECTORY_PATTERN = /^v[0-9A-Za-z.-]+-[0-9a-f]{12}-[0-9a-f]{12}$/;
+
+export function candidateRuntimeContainer(stateRoot) {
+  return resolve(stateRoot, "release-channels", "runtimes");
+}
+
+export function createCandidateRuntimePrefix({ stateRoot, version, shasum, random = () => randomBytes(6).toString("hex") }) {
+  const parsed = parseReleaseVersion(version);
+  const digest = String(shasum || "");
+  if (!/^[0-9a-f]{40}$/.test(digest)) throw new Error("candidate runtime package SHA-1 is invalid");
+  const suffix = String(random());
+  if (!/^[0-9a-f]{12}$/.test(suffix)) throw new Error("candidate runtime random suffix is invalid");
+  return join(candidateRuntimeContainer(stateRoot), `v${parsed.raw}-${digest.slice(0, 12)}-${suffix}`);
+}
+
+export function pruneInactiveCandidateRuntimes({ stateRoot, activePrefix, remove = rmSync } = {}) {
+  const container = candidateRuntimeContainer(stateRoot);
+  const active = resolve(String(activePrefix || ""));
+  const activeRelative = relative(container, active);
+  if (!activeRelative || activeRelative === ".." || activeRelative.startsWith(`..${sep}`) || isAbsolute(activeRelative)) {
+    throw new Error("active candidate runtime is outside the runtime container");
+  }
+  if (!existsSync(container)) return [];
+  const removed = [];
+  for (const entry of readdirSync(container, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !RUNTIME_DIRECTORY_PATTERN.test(entry.name)) continue;
+    const candidate = resolve(container, entry.name);
+    if (candidate === active) continue;
+    remove(candidate, { recursive: true, force: true });
+    removed.push(candidate);
+  }
+  return removed;
+}

package/scripts/check-plan.mjs

@@ -2,6 +2,16 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "privacy:check",
   "release-impact:check",
   "release:acceptance:test",
+  "release-channel:test",
+  "release-candidate-manifest:test",
+  "promotion-digest:test",
+  "prerelease-activation:test",
+  "release-soak:test",
+  "published-release:test",
+  "npm-publication-policy:test",
+  "publish-npm:test",
+  "runtime-activation:test",
+  "candidate-runtime-store:test",
   "release-state:test",
   "release-ci:test",
   "network-retry:test",
@@ -11,6 +21,10 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "secure-file:test",
   "worker-secret-file:test",
   "device-auth:test",
+  "device-root-provider:test",
+  "device-key-id-compatibility:test",
+  "dpop:test",
+  "security-audit:test",
   "sarif-security:test",
   "shell:test",
   "architecture:test",
@@ -24,6 +38,7 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "account:test",
   "operation-authorization:test",
   "worker-oauth-controller:test",
+  "worker-security:test",
   "policy-docs:check",
   "tool-docs:check",
   "runtime-infrastructure:test",
@@ -31,6 +46,7 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "runtime-handlers:test",
   "cli-entrypoint:test",
   "cli-service:test",
+  "service-restart:test",
   "lifecycle:test",
   "logging-structure:test",
   "worker-runtime-infrastructure:test",
@@ -42,6 +58,7 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "catalog:test",
   "capability-ranking:test",
   "agent-boundaries:test",
+  "browser-identity:test",
   "browser-command:test",
   "check-plan:test",
 ]);
@@ -56,6 +73,8 @@ export const PLATFORM_ONLY_CHECK_TASKS = Object.freeze([
   "service-lifecycle:test",
   "service-environment:test",
   "service-platform:test",
+  "delegated-sandbox:test",
+  "macos-trust:test",
   "agent-context:test",
   "browser-devtools-input:test",
   "browser-service-worker:test",

package/scripts/check-runner.mjs

@@ -46,7 +46,10 @@ function runTask({ task, npmCli, cwd, env, verbose, spawnProcess }) {
     try {
       child = spawnProcess(process.execPath, [npmCli, "run", "--silent", task], {
         cwd,
-        env: { ...env, NO_COLOR: env.NO_COLOR || "1" },
+        env: {
+          ...env,
+          NO_COLOR: env.NO_COLOR || "1",
+        },
         stdio: verbose ? "inherit" : ["ignore", "pipe", "pipe"],
         windowsHide: true,
         shell: false,

package/scripts/commit-message-check.mjs

@@ -1,5 +1,8 @@
 import { execFileSync } from "node:child_process";
 import process from "node:process";
+import { createTrustedGitResolver } from "../src/local/trusted-git-executable.mjs";
+
+const gitExecutable = createTrustedGitResolver({ workspace: process.cwd() });
 
 const allowedTypes = Object.freeze([
   "feat",
@@ -54,10 +57,10 @@ function readTitles(args) {
   if (rangeIndex !== -1) {
     const range = args[rangeIndex + 1];
     if (!range) throw new Error("--range requires a Git revision range");
-    return execFileSync("git", ["log", "--format=%s", range], { encoding: "utf8" })
+    return execFileSync(gitExecutable(), ["log", "--format=%s", range], { encoding: "utf8" })
       .split(/\r?\n/)
       .filter(Boolean);
   }
 
-  return [execFileSync("git", ["log", "-1", "--format=%s"], { encoding: "utf8" }).trim()];
+  return [execFileSync(gitExecutable(), ["log", "-1", "--format=%s"], { encoding: "utf8" }).trim()];
 }