machine-bridge-mcp 2.0.0 → 3.0.0-beta.9

package/scripts/start-release-candidate.mjs

@@ -1,22 +1,29 @@
 #!/usr/bin/env node
 
 import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { defaultStateRoot, expandHome } from "../src/local/state.mjs";
+import { ensureOwnerOnlyDirectorySync } from "../src/local/secure-file.mjs";
+import { createCandidateRuntimePrefix, pruneInactiveCandidateRuntimes } from "./candidate-runtime-store.mjs";
+import { writePrereleaseActivation } from "./prerelease-activation.mjs";
 import { verifyTarball } from "./release-acceptance.mjs";
+import { parseReleaseVersion } from "./release-channel.mjs";
+import { validateCandidateManifest } from "./release-candidate-manifest.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const candidateDirectory = join(root, ".release-candidate");
 const manifestPath = join(candidateDirectory, "manifest.json");
-const installPrefix = join(candidateDirectory, "runtime");
+const foregroundInstallPrefix = join(candidateDirectory, "runtime");
 const npmCli = process.env.npm_execpath;
 
 if (!npmCli) fail("candidate startup must run through npm so npm_execpath is available");
 
 try {
   const manifest = readJson(manifestPath, "release candidate manifest");
-  if (manifest.result !== "pending") throw new Error("release candidate manifest is not pending");
+  validateCandidateManifest(manifest);
   const tarball = join(candidateDirectory, String(manifest.filename || ""));
   verifyTarball(tarball, manifest);
 
@@ -25,8 +32,13 @@ try {
     throw new Error(`candidate startup requires npm 12 or newer; current ${npmVersion}`);
   }
 
-  rmSync(installPrefix, { recursive: true, force: true });
-  mkdirSync(installPrefix, { recursive: true });
+  const activateService = process.argv.includes("--activate-service");
+  const stateRoot = resolve(expandHome(argumentValue("--state-dir") || defaultStateRoot()));
+  const installPrefix = activateService
+    ? createCandidateRuntimePrefix({ stateRoot, version: manifest.package_version, shasum: manifest.shasum })
+    : foregroundInstallPrefix;
+  if (!activateService) rmSync(installPrefix, { recursive: true, force: true });
+  ensureOwnerOnlyDirectorySync(installPrefix);
   runNpm([
     "install",
     "--global",
@@ -53,10 +65,17 @@ try {
   }
 
   if (!allowWorkerDeploy) {
-    throw new Error("foreground candidate startup may update the configured same-name Worker; rerun with --allow-worker-deploy to authorize that live candidate deployment");
+    throw new Error("candidate activation may update the configured same-name Worker; rerun with --allow-worker-deploy to authorize that live candidate deployment");
+  }
+
+  const forwardedArgs = process.argv.slice(2).filter((value) => ![
+    "--install-only", "--allow-worker-deploy", "--activate-service",
+  ].includes(value));
+  if (activateService) {
+    activatePersistentCandidate({ manifest, installedPackage, installPrefix, stateRoot, forwardedArgs });
+    process.exit(0);
   }
 
-  const forwardedArgs = process.argv.slice(2).filter((value) => value !== "--install-only" && value !== "--allow-worker-deploy");
   const cli = join(installedPackage, "bin", "machine-mcp.mjs");
   console.log("Authorized live candidate deployment: startup may update the configured same-name Worker when its version or deployment hash differs.");
   console.log("Starting the exact candidate in the foreground. Leave this process running while the coding agent verifies the Worker, relay, and local runtime end to end.");
@@ -86,6 +105,93 @@ try {
   fail(error?.message || error);
 }
 
+function activatePersistentCandidate({ manifest, installedPackage, installPrefix, stateRoot, forwardedArgs }) {
+  const releaseVersion = parseReleaseVersion(manifest.package_version);
+  const cli = join(installedPackage, "bin", "machine-mcp.mjs");
+  const args = ["activate", ...withoutManagedFlags(forwardedArgs), "--state-dir", stateRoot, "--json"];
+  const previous = currentGlobalInstallation(manifest.package_name);
+  console.log("Activating the exact prerelease as the persistent login daemon. Portable-root startup does not prompt; a separately provisioned Secure Enclave broker may request one user-presence operation.");
+  const result = spawnSync(process.execPath, [cli, ...args], {
+    cwd: root,
+    env: process.env,
+    encoding: "utf8",
+    timeout: 300_000,
+    windowsHide: true,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`persistent candidate activation failed: ${result.stderr || result.stdout}`);
+  let activation;
+  try { activation = JSON.parse(result.stdout); } catch { throw new Error("persistent candidate activation did not return valid JSON"); }
+  if (
+    activation.ok !== true
+    || activation.version !== manifest.package_version
+    || activation.daemon?.version !== manifest.package_version
+    || activation.worker?.health?.version !== manifest.package_version
+  ) {
+    throw new Error("persistent candidate activation did not converge on the exact candidate version");
+  }
+
+  let recordPath = "";
+  if (releaseVersion.prerelease) {
+    recordPath = writePrereleaseActivation({
+      schema_version: 1,
+      package_name: manifest.package_name,
+      package_version: manifest.package_version,
+      source: "local-candidate",
+      shasum: manifest.shasum,
+      integrity: manifest.integrity,
+      promotion_content_sha256: manifest.promotion_content_sha256,
+      activated_at: new Date().toISOString(),
+      workspace_hash: workspaceHash(activation.workspace),
+      runtime_entry: cli,
+      ...(previous ? { previous } : {}),
+    }, stateRoot);
+  }
+  const removedRuntimes = pruneInactiveCandidateRuntimes({ stateRoot, activePrefix: installPrefix });
+  console.log(`Persistent release candidate activated: ${manifest.package_version}`);
+  if (recordPath) console.log(`Activation record: ${recordPath}`);
+  if (removedRuntimes.length) console.log(`Removed ${removedRuntimes.length} inactive candidate runtime(s).`);
+  console.log("The Worker and login daemon now run the exact candidate. The terminal may close; the coding agent should verify the live deployment through Machine Bridge.");
+  if (previous?.version) console.log(`Rollback baseline retained: globally installed ${previous.version}.`);
+}
+
+function currentGlobalInstallation(packageName) {
+  try {
+    const globalRoot = runNpm(["root", "--global"], root).stdout.trim();
+    const packageRoot = join(globalRoot, packageName);
+    const packagePath = join(packageRoot, "package.json");
+    if (!existsSync(packagePath)) return null;
+    const pkg = readJson(packagePath, "globally installed package");
+    return { version: String(pkg.version || ""), entry: join(packageRoot, "bin", "machine-mcp.mjs") };
+  } catch {
+    return null;
+  }
+}
+
+function withoutManagedFlags(args) {
+  const out = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === "--json" || value.startsWith("--json=")) continue;
+    if (value === "--state-dir") { index += 1; continue; }
+    if (value.startsWith("--state-dir=")) continue;
+    out.push(value);
+  }
+  return out;
+}
+
+function argumentValue(name) {
+  const exact = process.argv.find((value) => value.startsWith(`${name}=`));
+  if (exact) return exact.slice(name.length + 1);
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : "";
+}
+
+function workspaceHash(workspace) {
+  const value = process.platform === "win32" ? String(workspace).toLowerCase() : String(workspace);
+  return createHash("sha256").update(value).digest("hex").slice(0, 24);
+}
+
 function runNpm(args, cwd) {
   const result = spawnSync(process.execPath, [npmCli, ...args], {
     cwd,

package/src/local/account-access.mjs

@@ -1,5 +1,6 @@
 import accessContract from "../shared/access-contract.json" with { type: "json" };
 import { BridgeError } from "./errors.mjs";
+import { buildAuthorityContext } from "./authority-context.mjs";
 import { policyProfile, toolNamesForPolicy, assertToolAllowed } from "./policy.mjs";
 
 export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
@@ -32,6 +33,11 @@ export class AccountAccessGate {
     return normalized;
   }
 
+  authority(authorization, daemonPolicy, origin = "relay") {
+    const role = origin === "relay" ? normalizeAccountRole(authorization?.role) : "owner";
+    return buildAuthorityContext({ authorization: { ...authorization, role }, daemonPolicy, origin });
+  }
+
   names(role) {
     return accountRoleToolNames(role);
   }

package/src/local/account-admin.mjs

@@ -1,6 +1,7 @@
-import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { ADMIN_AUTH_SCHEME, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { ACCOUNT_ROLES, normalizeAccountRole } from "./account-access.mjs";
+import { encodeDeviceSessionCertificate, signWithDeviceSessionIdentity, validateDeviceSessionIdentity } from "./device-identity.mjs";
 import { BridgeError } from "./errors.mjs";
 
 const REQUEST_TIMEOUT_MS = 15_000;
@@ -10,15 +11,18 @@ export function generateAccountPassword() {
 }
 
 export class AccountAdminClient {
-  constructor({ workerUrl, adminSecret, fetchImpl = fetch }) {
+  constructor({ workerUrl, sessionIdentity, fetchImpl = fetch }) {
     this.workerUrl = normalizeWorkerUrl(workerUrl);
-    if (typeof adminSecret !== "string" || adminSecret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
-    this.adminSecret = adminSecret;
+    this.sessionIdentity = validateDeviceSessionIdentity(sessionIdentity);
     this.fetchImpl = fetchImpl;
   }
 
-  list() {
-    return this.request("GET", "/admin/accounts");
+  list() { return this.request("GET", "/admin/accounts"); }
+  listClients() { return this.request("GET", "/admin/clients"); }
+
+  removeClient({ clientId }) {
+    if (!/^mcp_client_[A-Za-z0-9_-]{43}$/.test(String(clientId || ""))) throw new BridgeError("invalid_request", "OAuth client id is invalid");
+    return this.request("DELETE", "/admin/clients", { client_id: clientId });
   }
 
   create({ name, role, password, displayName = "" }) {
@@ -61,7 +65,7 @@ export class AccountAdminClient {
   async request(method, pathname, body) {
     const serializedBody = body === undefined ? "" : JSON.stringify(body);
     const headers = accountAdminRequestHeaders({
-      secret: this.adminSecret,
+      sessionIdentity: this.sessionIdentity,
       origin: this.workerUrl,
       method,
       pathname,
@@ -89,25 +93,39 @@ export class AccountAdminClient {
   }
 }
 
-
-export function accountAdminRequestHeaders({ secret, origin, method, pathname, body = "", now = Date.now(), nonce = randomBytes(24).toString("base64url") }) {
-  if (typeof secret !== "string" || secret.length < 24) throw new BridgeError("invalid_request", "account administration secret is missing");
+export function accountAdminRequestHeaders({
+  sessionIdentity,
+  origin,
+  method,
+  pathname,
+  body = "",
+  now = Date.now(),
+  nonce = randomBytes(24).toString("base64url"),
+}) {
+  validateDeviceSessionIdentity(sessionIdentity, now);
   const issuedAt = Math.floor(Number(now) / 1000);
   const bodyHash = createHash("sha256").update(String(body)).digest("hex");
-  const transcript = adminAuthTranscript({ origin, method: String(method).toUpperCase(), pathname, bodyHash, issuedAt, nonce });
-  const signature = createHmac("sha256", secret).update(transcript).digest("base64url");
+  const transcript = adminAuthTranscript({
+    origin,
+    method: String(method).toUpperCase(),
+    pathname,
+    bodyHash,
+    keyId: sessionIdentity.keyId,
+    issuedAt,
+    nonce,
+  });
   return {
     "X-Bridge-Admin-Scheme": ADMIN_AUTH_SCHEME,
     "X-Bridge-Admin-Time": String(issuedAt),
     "X-Bridge-Admin-Nonce": nonce,
     "X-Bridge-Admin-Body-SHA256": bodyHash,
-    "X-Bridge-Admin-Signature": signature,
+    "X-Bridge-Admin-Key": sessionIdentity.keyId,
+    "X-Bridge-Admin-Signature": signWithDeviceSessionIdentity(sessionIdentity, transcript),
+    "X-Bridge-Device-Certificate": encodeDeviceSessionCertificate(sessionIdentity),
   };
 }
 
-export function accountRoleNames() {
-  return Object.keys(ACCOUNT_ROLES);
-}
+export function accountRoleNames() { return Object.keys(ACCOUNT_ROLES); }
 
 function normalizeWorkerUrl(value) {
   const url = new URL(String(value || ""));

package/src/local/agent-context.mjs

@@ -29,9 +29,10 @@ const MAX_INSTRUCTION_FILE_BYTES = 512 * 1024;
 const MAX_INSTRUCTION_FILES = 64;
 
 export class AgentContextManager {
-  constructor({ workspace, policy, displayPath, resolveExistingPath, throwIfCancelled = () => {}, home = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "" }) {
+  constructor({ workspace, policy, policyForContext = null, displayPath, resolveExistingPath, throwIfCancelled = () => {}, home = process.env.HOME || process.env.USERPROFILE || "", codexHome = process.env.CODEX_HOME || "" }) {
     this.workspace = resolve(workspace);
     this.policy = policy || {};
+    this.policyForContext = typeof policyForContext === "function" ? policyForContext : () => this.policy;
     this.displayPath = displayPath;
     this.resolveExistingPath = resolveExistingPath;
     this.throwIfCancelled = throwIfCancelled;
@@ -44,23 +45,23 @@ export class AgentContextManager {
     const includeContent = args.include_instruction_content !== false;
     const skillLimit = clampInteger(args.max_skills, 100, 1, MAX_SKILL_RESULTS);
     const discoveredSkills = await this.discoverSkills(state, { maxResults: MAX_SKILL_RESULTS }, context);
-    const contextSkills = contextSkillSummaries(discoveredSkills.skills, this.displayPath, skillLimit, MAX_CONTEXT_SKILL_SUMMARY_CHARS);
+    const contextSkills = contextSkillSummaries(discoveredSkills.skills, (value) => this.displayPath(value, context), skillLimit, MAX_CONTEXT_SKILL_SUMMARY_CHARS);
     const result = {
-      target: this.displayPath(state.target),
-      scope_root: this.displayPath(state.scopeRoot),
+      target: this.displayPath(state.target, context),
+      scope_root: this.displayPath(state.scopeRoot, context),
       precedence: "built-in defaults, automatic project facts, user-global guidance, then scope root to target directory; explicit files loaded later have higher precedence",
-      config_files: state.configFiles.map((file) => this.displayPath(file)),
+      config_files: state.configFiles.map((file) => this.displayPath(file, context)),
       builtin_instructions: publicVirtualInstruction(state.builtinInstructions, includeContent),
       automatic_project_context: publicVirtualInstruction(state.automaticProjectContext, includeContent),
       model_instructions_file: state.modelInstructions ? {
-        path: this.displayPath(state.modelInstructions.path),
+        path: this.displayPath(state.modelInstructions.path, context),
         bytes: state.modelInstructions.bytes,
         sha256: state.modelInstructions.sha256,
         ...(includeContent ? { content: state.modelInstructions.content } : {}),
       } : null,
       instruction_files: state.instructions.map((item) => ({
         scope: item.scope,
-        path: this.displayPath(item.path),
+        path: this.displayPath(item.path, context),
         bytes: item.bytes,
         sha256: item.sha256,
         precedence: item.precedence,
@@ -68,9 +69,9 @@ export class AgentContextManager {
       })),
       skills: contextSkills.skills,
       skills_truncated: discoveredSkills.truncated || contextSkills.truncated,
-      skill_warnings: publicSkillWarnings(discoveredSkills.warnings, this.displayPath),
+      skill_warnings: publicSkillWarnings(discoveredSkills.warnings, (value) => this.displayPath(value, context)),
       instructions_truncated: state.instructionsTruncated,
-      commands: publicCommands(state.commands, this.displayPath),
+      commands: publicCommands(state.commands, (value) => this.displayPath(value, context)),
       guidance: [
         "Apply built-in instructions and automatic project context as lower-precedence defaults; explicit global/project instruction files loaded later take precedence.",
         "Treat instruction_files as authoritative workspace guidance in the returned precedence order.",
@@ -78,7 +79,7 @@ export class AgentContextManager {
         "Prefer run_local_command for registered repeatable commands. Use run_process or exec_command only when no registered command fits and policy permits it.",
       ],
     };
-    if (includeContent) result.effective_instructions = renderEffectiveInstructions(effectiveInstructionItems(state), this.displayPath);
+    if (includeContent) result.effective_instructions = renderEffectiveInstructions(effectiveInstructionItems(state), (value) => this.displayPath(value, context));
     return result;
   }
 
@@ -86,11 +87,11 @@ export class AgentContextManager {
     const state = await this.discoverState(args.path || ".", context);
     const fingerprint = capabilityFingerprint(state, []);
     return {
-      target: this.displayPath(state.target),
-      instructions: renderEffectiveInstructions(effectiveInstructionItems(state), this.displayPath),
+      target: this.displayPath(state.target, context),
+      instructions: renderEffectiveInstructions(effectiveInstructionItems(state), (value) => this.displayPath(value, context)),
       builtin_instructions: publicVirtualInstruction(state.builtinInstructions, false),
       automatic_project_context: publicVirtualInstruction(state.automaticProjectContext, false),
-      model_instructions_file: state.modelInstructions ? this.displayPath(state.modelInstructions.path) : null,
+      model_instructions_file: state.modelInstructions ? this.displayPath(state.modelInstructions.path, context) : null,
       capability_refresh: {
         strategy: "resolve_task_capabilities-rescans-on-every-call",
         instruction_and_command_fingerprint: fingerprint,
@@ -125,7 +126,7 @@ export class AgentContextManager {
     let selectedSkill = null;
     if (selected && args.include_selected_skill !== false) {
       const content = await readRegularUtf8(selected.entrypoint, MAX_SKILL_ENTRY_BYTES, "skill entrypoint");
-      selectedSkill = { ...publicSkill(selected, this.displayPath), instructions: content.text };
+      selectedSkill = { ...publicSkill(selected, (value) => this.displayPath(value, context)), instructions: content.text };
     }
     const recommendedTools = recommendTools(task, {
       commandsAvailable: state.commands.size > 0,
@@ -135,20 +136,20 @@ export class AgentContextManager {
     const refresh = capabilityFingerprint(state, discovered.skills);
     return {
       task,
-      target: this.displayPath(state.target),
-      effective_instructions: renderEffectiveInstructions(effectiveInstructionItems(state), this.displayPath),
+      target: this.displayPath(state.target, context),
+      effective_instructions: renderEffectiveInstructions(effectiveInstructionItems(state), (value) => this.displayPath(value, context)),
       builtin_instructions: publicVirtualInstruction(state.builtinInstructions, false),
       automatic_project_context: publicVirtualInstruction(state.automaticProjectContext, false),
-      model_instructions_file: state.modelInstructions ? this.displayPath(state.modelInstructions.path) : null,
-      instruction_files: state.instructions.map((item) => ({ path: this.displayPath(item.path), scope: item.scope, bytes: item.bytes, sha256: item.sha256, precedence: item.precedence })),
+      model_instructions_file: state.modelInstructions ? this.displayPath(state.modelInstructions.path, context) : null,
+      instruction_files: state.instructions.map((item) => ({ path: this.displayPath(item.path, context), scope: item.scope, bytes: item.bytes, sha256: item.sha256, precedence: item.precedence })),
       instructions_truncated: state.instructionsTruncated,
       refresh: { strategy: "rescan-on-every-call", fingerprint: refresh, generated_at: new Date().toISOString() },
       selected_skill: selectedSkill,
-      skill_matches: skillMatches.map(({ skill, score }) => ({ ...publicSkill(skill, this.displayPath), score })),
-      command_matches: commandMatches.map(({ command, score }) => ({ ...publicCommands(new Map([[command.name, command]]), this.displayPath)[0], score })),
+      skill_matches: skillMatches.map(({ skill, score }) => ({ ...publicSkill(skill, (value) => this.displayPath(value, context)), score })),
+      command_matches: commandMatches.map(({ command, score }) => ({ ...publicCommands(new Map([[command.name, command]]), (value) => this.displayPath(value, context))[0], score })),
       recommended_tools: recommendedTools,
       host_semantics: "Machine Bridge can discover, rank, and load capabilities automatically. The MCP host remains responsible for deciding whether to call the recommended tools.",
-      warnings: publicSkillWarnings(discovered.warnings, this.displayPath),
+      warnings: publicSkillWarnings(discovered.warnings, (value) => this.displayPath(value, context)),
       truncated: discovered.truncated,
     };
   }
@@ -171,11 +172,11 @@ export class AgentContextManager {
       maxResults: clampInteger(args.max_results, 100, 1, MAX_SKILL_RESULTS),
     }, context);
     return {
-      target: this.displayPath(state.target),
-      scope_root: this.displayPath(state.scopeRoot),
-      skill_roots: state.skillRoots.map((root) => this.displayPath(root)),
-      skills: result.skills.map((skill) => publicSkill(skill, this.displayPath)),
-      warnings: publicSkillWarnings(result.warnings, this.displayPath),
+      target: this.displayPath(state.target, context),
+      scope_root: this.displayPath(state.scopeRoot, context),
+      skill_roots: state.skillRoots.map((root) => this.displayPath(root, context)),
+      skills: result.skills.map((skill) => publicSkill(skill, (value) => this.displayPath(value, context))),
+      warnings: publicSkillWarnings(result.warnings, (value) => this.displayPath(value, context)),
       truncated: result.truncated,
     };
   }
@@ -184,14 +185,14 @@ export class AgentContextManager {
     const requested = requiredString(args.skill, "skill");
     const state = await this.discoverState(args.path || ".", context);
     const result = await this.discoverSkills(state, { maxResults: MAX_SKILL_RESULTS }, context);
-    const matches = result.skills.filter((skill) => skill.id === requested || skill.name === requested || this.displayPath(skill.entrypoint) === requested);
+    const matches = result.skills.filter((skill) => skill.id === requested || skill.name === requested || this.displayPath(skill.entrypoint, context) === requested);
     if (!matches.length) throw new Error(`local skill not found: ${requested}`);
     if (matches.length > 1) throw new Error(`local skill name is ambiguous; use its id: ${requested}`);
     const skill = matches[0];
     const content = await readRegularUtf8(skill.entrypoint, MAX_SKILL_ENTRY_BYTES, "skill entrypoint");
     const inventory = await listSkillFiles(skill.directory, clampInteger(args.max_files, 200, 1, MAX_SKILL_FILES), context, this.throwIfCancelled);
     return {
-      skill: publicSkill(skill, this.displayPath),
+      skill: publicSkill(skill, (value) => this.displayPath(value, context)),
       instructions: content.text,
       files: inventory.files,
       files_truncated: inventory.truncated,
@@ -202,9 +203,9 @@ export class AgentContextManager {
   async listLocalCommands(args = {}, context = {}) {
     const state = await this.discoverState(args.path || ".", context);
     return {
-      target: this.displayPath(state.target),
-      scope_root: this.displayPath(state.scopeRoot),
-      commands: publicCommands(state.commands, this.displayPath),
+      target: this.displayPath(state.target, context),
+      scope_root: this.displayPath(state.scopeRoot, context),
+      commands: publicCommands(state.commands, (value) => this.displayPath(value, context)),
     };
   }
 
@@ -227,14 +228,15 @@ export class AgentContextManager {
 
   async discoverState(inputPath, context = {}) {
     this.throwIfCancelled(context);
+    const effectivePolicy = this.policyForContext(context);
     this.workspace = await realpath(this.workspace);
-    const target = await realpath(await this.resolveExistingPath(inputPath));
+    const target = await realpath(await this.resolveExistingPath(inputPath, context));
     const targetInfo = await stat(target);
     const targetDir = targetInfo.isDirectory() ? target : dirname(target);
     const scopeRoot = await findScopeRoot({
       targetDir,
       workspace: this.workspace,
-      unrestricted: this.policy.unrestrictedPaths === true,
+      unrestricted: effectivePolicy.unrestrictedPaths === true,
     });
     const directories = directoriesBetween(scopeRoot, targetDir);
     const state = {
@@ -243,7 +245,7 @@ export class AgentContextManager {
       scopeRoot,
       instructionFiles: [...DEFAULT_INSTRUCTION_FILES],
       instructionMaxBytes: DEFAULT_INSTRUCTION_MAX_BYTES,
-      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, this.policy.unrestrictedPaths === true),
+      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, effectivePolicy.unrestrictedPaths === true),
       commands: new Map(),
       builtinInstructionsEnabled: true,
       automaticProjectContextEnabled: true,
@@ -264,7 +266,7 @@ export class AgentContextManager {
       const globalConfig = join(this.home, GLOBAL_CONFIG_RELATIVE_PATH);
       const config = await readOptionalConfig(globalConfig, this.home, false);
       if (config) {
-        if (this.policy.unrestrictedPaths === true) this.applyConfig(state, config, globalConfig, this.home, { global: true });
+        if (effectivePolicy.unrestrictedPaths === true) this.applyConfig(state, config, globalConfig, this.home, { global: true, unrestricted: true });
         else {
           state.configFiles.push(globalConfig);
           if (config.builtinInstructions !== null) state.builtinInstructionsEnabled = config.builtinInstructions;
@@ -284,20 +286,20 @@ export class AgentContextManager {
 
     if (this.home) {
       if (state.modelInstructionsFile) await this.collectModelInstructions(state, context);
-      if (this.policy.unrestrictedPaths === true && this.codexHome) await this.collectDirectoryInstruction(state, this.codexHome, context, "global");
+      if (effectivePolicy.unrestrictedPaths === true && this.codexHome) await this.collectDirectoryInstruction(state, this.codexHome, context, "global");
     }
 
     for (const directory of directories) {
       this.throwIfCancelled(context);
       const configPath = join(directory, CONFIG_RELATIVE_PATH);
       const config = await readOptionalConfig(configPath, directory, true);
-      if (config) this.applyConfig(state, config, configPath, directory, { global: false });
+      if (config) this.applyConfig(state, config, configPath, directory, { global: false, unrestricted: effectivePolicy.unrestrictedPaths === true });
       await this.collectDirectoryInstruction(state, directory, context, "project");
     }
     return state;
   }
 
-  applyConfig(state, config, configPath, baseDir, { global = false } = {}) {
+  applyConfig(state, config, configPath, baseDir, { global = false, unrestricted = false } = {}) {
     state.configFiles.push(configPath);
     if (config.builtinInstructions !== null) {
       if (!global) throw new Error(`builtin_instructions is only allowed in the global agent config: ${configPath}`);
@@ -317,14 +319,14 @@ export class AgentContextManager {
       if (state.instructionBytes >= state.instructionMaxBytes) state.instructionsTruncated = true;
     }
     if (config.skillRoots) {
-      state.skillRoots = config.skillRoots.map((value) => resolveConfiguredPath(value, baseDir, this.home, this.workspace, this.policy.unrestrictedPaths === true));
+      state.skillRoots = config.skillRoots.map((value) => resolveConfiguredPath(value, baseDir, this.home, this.workspace, unrestricted));
     }
     for (const [name, definition] of config.commands) {
       if (definition === null) {
         state.commands.delete(name);
         continue;
       }
-      const cwd = resolveConfiguredPath(definition.cwd, baseDir, this.home, this.workspace, this.policy.unrestrictedPaths === true);
+      const cwd = resolveConfiguredPath(definition.cwd, baseDir, this.home, this.workspace, unrestricted);
       state.commands.set(name, {
         name,
         description: definition.description,
@@ -379,13 +381,14 @@ export class AgentContextManager {
   }
 
   async discoverSkills(state, options = {}, context = {}) {
+    const effectivePolicy = this.policyForContext(context);
     return discoverLocalSkills({
       skillRoots: state.skillRoots,
       query: String(options.query || ""),
       maxResults: clampInteger(options.maxResults, 100, 1, MAX_SKILL_RESULTS),
       workspace: this.workspace,
-      unrestricted: this.policy.unrestrictedPaths === true,
-      displayPath: this.displayPath,
+      unrestricted: effectivePolicy.unrestrictedPaths === true,
+      displayPath: (value) => this.displayPath(value, context),
       context,
       throwIfCancelled: this.throwIfCancelled,
     });

package/src/local/app-automation.mjs

@@ -102,9 +102,9 @@ export class AppAutomationManager {
       if (target) argv.push(target);
       command = { cmd: "open", argv };
     } else if (this.platform === "win32") {
-      const escaped = resolvedApplication.replace(/'/g, "''");
-      const targetFragment = target ? ` -ArgumentList '${target.replace(/'/g, "''")}'` : "";
-      command = { cmd: "powershell.exe", argv: ["-NoProfile", "-NonInteractive", "-Command", `Start-Process -FilePath '${escaped}'${targetFragment}`] };
+      const fileLiteral = powershellSingleQuotedLiteral(resolvedApplication);
+      const targetFragment = target ? ` -ArgumentList ${powershellSingleQuotedLiteral(target)}` : "";
+      command = { cmd: "powershell.exe", argv: ["-NoProfile", "-NonInteractive", "-Command", `Start-Process -FilePath ${fileLiteral}${targetFragment}`] };
     } else if (resolvedApplication.toLowerCase().endsWith(".desktop")) {
       command = { cmd: "gio", argv: ["launch", resolvedApplication, ...(target ? [target] : [])] };
     } else {
@@ -113,7 +113,8 @@ export class AppAutomationManager {
         : { cmd: resolvedApplication, argv: [] };
     }
     const result = await this.runProcess(command.cmd, command.argv, clampInt(args.timeout_seconds, 30, 1, 120) * 1000, false, 256 * 1024, context, undefined, null);
-    return { application, resolved_application: resolvedApplication, target, platform: this.platform, ...result };
+    const publicResolvedApplication = /[\\/]/.test(resolvedApplication) ? this.displayPath(resolvedApplication) : resolvedApplication;
+    return { application, resolved_application: publicResolvedApplication, target, platform: this.platform, ...result };
   }
 
   async inspectApplication(args = {}, context = {}) {
@@ -417,3 +418,7 @@ function main() {
 }
 (() => { try { return JSON.stringify(main()); } catch (error) { return JSON.stringify({ error: String(error.message || error) }); } })()
 `;
+
+export function powershellSingleQuotedLiteral(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}