machine-bridge-mcp 3.0.0-beta.10 → 3.0.0-beta.11

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.0.0-beta.11 - 2026-07-23
+
+### External-review verification and observability hardening
+
+- Share one portable content-redaction implementation between local and Worker logs. Worker string fields now redact embedded bearer/API tokens, credential URLs, email addresses, private-key headers, and user-home paths even when the field name itself is not sensitive.
+- Prevent caller-supplied local or Worker fields from replacing authoritative `timestamp`, `level`, `component`, `message`, or `event` metadata, and add regression coverage for both value leakage and metadata forgery.
+- Make the automatic execution model explicit in authenticated `server_info` authority snapshots and `machine-mcp doctor`: operations inside effective authority do not use per-operation prompts, and remote owner shell/browser/application actions have the daemon OS user's ambient authority.
+- Extract local-resource reads and SSH-resource registration into `runtime-resource-service.mjs`, reducing `LocalRuntime` from 697 to 653 lines while retaining the existing zero-extra-step browser/application resource path and public result contract.
+- Re-verify review claims against the repository invariants. The default `full` profile, single-maintainer release controls, Node 26/npm 12 baseline, packaged deployment/release helpers, systemd-user support, and cross-platform behavior suites remain intentional; none is weakened or removed merely to reduce surface area or ceremony.
+- Refresh the exact Wrangler runtime from 4.112.0 to 4.113.0 and advance the reviewed npm install-script allowlist to its exact `workerd 1.20260721.1`; a clean install must not depend on an unreviewed or locally cached postinstall.
+
 ## 3.0.0-beta.10 - 2026-07-22
 
 ### Published prerelease activation repair

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.10",
+  "version_name": "3.0.0-beta.11",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/ARCHITECTURE.md

@@ -37,6 +37,7 @@ A canonical workspace receives an independent profile, Worker name, secret set,
 - `runtime-tool-handlers.mjs` owns catalog-to-handler registration;
 - `runtime-relay.mjs` owns relay construction and inbound envelope normalization, while `relay-call-recovery.mjs` owns the bounded disconnect grace, result queue, authoritative resumed-call reconciliation, replay, and expiry cleanup;
 - `runtime-paths.mjs` owns runtime-directory creation, containment checks, and error-path redaction;
+- `runtime-resource-service.mjs` owns registered-resource lookup, bounded binary/UTF-8 reads for browser/application injection, and SSH-resource registration/result projection;
 - `managed-job-lock.mjs`, `managed-job-runner.mjs`, `managed-job-storage.mjs`, and `managed-job-projection.mjs` separate transition ownership, detached runner identity, private persistence/diagnostics, and public result shaping from the managed-job lifecycle;
 - `browser-request-registry.mjs`, `browser-broker-routes.mjs`, `browser-broker-server.mjs`, and `browser-bridge-http.mjs` separate direct request ownership, runtime-client proxy routing, authenticated loopback WebSocket upgrades/listening, and loopback HTTP handling from broker startup and extension handover;
 - managed jobs, local resources, application automation, and browser automation remain separate managers.

package/docs/AUDIT.md

@@ -1,5 +1,21 @@
 # Security and privacy audit notes
 
+## 2026-07-23 version 3.0.0-beta.11 external-review verification
+
+The supplied read-only review was rechecked against source, package gates, platform plans, and the repository's explicit product/maintenance invariants rather than accepted as a backlog wholesale. Its central observability concern was correct: Worker field-name redaction was materially weaker than the local logger, so a future event could place a token, email address, credential URL, private-key header, or user-home path in an innocently named string field. The review did not notice a second defect in both structured loggers: sanitized caller fields were spread after core fields and could replace local `timestamp`, `level`, `component`, `message`, or `event` metadata and the corresponding Worker metadata, weakening incident chronology and event identity without executing code.
+
+Beta.11 moves the portable free-form patterns into one shared module used by both runtimes. Local logging retains environment-derived home aliases and path-key suppression; Worker events gain content-aware value redaction without importing Node-only state. Local and Worker core metadata is assigned after caller fields and therefore remains authoritative. Tests cover sensitive-key redaction, sensitive content under a non-sensitive key, user-home aliases, email/token removal, control fields that attempt to forge event metadata, and unchanged safe route fields.
+
+The line-cap warning was also directionally correct. `LocalRuntime` was 697 lines against a 700-line guardrail, but an arbitrary split would only hide coupling. Resource lookup, bounded binary/UTF-8 reads, and SSH resource registration form an independent lifecycle used by browser/application injection and the public generation tool. They now live in `runtime-resource-service.mjs`; `LocalRuntime` remains the composition root and falls to 653 lines. A direct boundary test and an independent architecture/package cap protect the extraction.
+
+Several recommendations were rejected because their premises did not match the current tree or because they would reduce usability without a demonstrated failure mechanism. Linux already has a systemd-user service adapter and detached restart path. macOS and Windows run the complete platform plan, including service, process-lock, sandbox, application, managed-job, filesystem, and full-access behavior tests; Ubuntu alone carries the additional Worker/browser/package integrations. `full-access-test.mjs` is also the implementation behind the supported `machine-mcp full-test` command, not an unused test-only harness. Node 26/npm 12 is an explicitly documented single-baseline policy. Wrangler and the packaged release/deployment helpers support the zero-extra-install first-run and self-contained release state machine; splitting them would add setup and version-skew failure modes for the sole maintainer. Source visibility is not treated as a security boundary. The default canonical `full` profile and absence of per-operation prompts are deliberate usability decisions, so beta.11 makes them harder to misinterpret in diagnostics rather than inserting prompts or narrowing authority.
+
+The review's suggestion to delete or rotate unreadable managed-job state was not adopted. An unreadable record deliberately blocks destructive state removal because automatically moving or deleting a directory that cannot be safely read can discard active recovery material or cross a replacement race. The bounded 50-job admission limit already prevents unbounded job-count growth; terminal readable records retain seven days, staged secrets retain twenty-four hours, and unreadable records require explicit operator inspection. A future quarantine feature would need token/snapshot-safe ownership, byte accounting, and removal semantics before it could improve rather than weaken this contract.
+
+The dependency pass found only the next exact Wrangler patch. Updating to 4.113.0 advanced Miniflare/workerd to the 2026-07-21 build; npm initially blocked the new workerd postinstall because the repository intentionally permits scripts by exact package version. Beta.11 updates that allowlist to `workerd 1.20260721.1`, and clean-install/package/Worker dry-run gates must prove the new pin rather than relying on an existing binary. Registry audit, production-only audit, signatures, and attestations remain separate release evidence.
+
+The second pass found no reason to reduce default authority, require a second reviewer, remove systemd support, broaden compatibility branches, or split the package into separately versioned runtime/deployment products. Remaining residuals are explicit: an authenticated remote owner is intentionally high authority; Cloudflare sampled logs are operational telemetry rather than an audit trail; unknown or transformed secrets can evade regex redaction, so arguments/results remain omitted; browser automation acts inside the real user profile; and OS CPU, memory, syscall, and egress isolation remain external deployment responsibilities. No Worker deployment, daemon/service replacement, global installation, credential rotation, Git push, tag, npm publication, or GitHub Release is implied by this source audit.
+
 ## 2026-07-22 version 3.0.0-beta.7 nested lifecycle PATH audit
 
 Beta.6 passed its automated gates and exact live activation, but the launchd PATH still contained repository `node_modules/.bin` entries and npm's private `node-gyp-bin`. Source, tarball, and isolated runtime inspection proved that the intended sanitizer was packaged. A direct invocation over the installed plist PATH also produced the expected clean value. The remaining variable was the activation process environment.

package/docs/LOGGING.md

@@ -112,6 +112,8 @@ Application discovery and Accessibility operations follow the same rule: permiss
 
 Messages, strings, object depth, object key counts, array item counts, and serialized field payloads are bounded. Control characters and Unicode display controls are neutralized. Fields with secret-like names and path-like keys are recursively redacted. Free-form sanitization covers generic private-key headers, AWS/GitHub/GitLab/npm/Slack/Google/live-payment/API token forms, JWT-shaped values, URLs with embedded credentials, email addresses, and user-home paths.
 
+Local and Worker free-form strings use the same portable value sanitizer. Worker fields are therefore inspected by content even when their key is not secret-shaped. Both structured loggers assign their authoritative metadata after sanitizing caller fields. Local `timestamp`, `level`, `component`, `message`, and `event`, plus Worker `timestamp`, `level`, `component`, and `event`, therefore cannot be forged or replaced by an event payload. Local-only recursive path-key redaction and environment-derived home aliases remain additional protections around the portable rules.
+
 The logger exposes two intentional plain-output boundaries. `safePlain` sanitizes operational guidance and diagnostic text. Raw `plain` output is reserved for explicitly requested credentials or local paths whose display is the command's purpose; callers must not pass external exception text or tool content to it.
 
 This is defense in depth, not content classification. Unknown, split, transformed, encrypted, or application-specific secret formats can evade pattern matching, which is why tool arguments and outputs are omitted rather than merely filtered.

package/docs/OPERATIONS.md

@@ -8,7 +8,7 @@ machine-mcp doctor
 machine-mcp service status
 ```
 
-`status` prints redacted profile state and verifies the deployed Worker version. Resource source paths remain redacted. `doctor` checks Node.js, the package-installed Wrangler binary, Cloudflare login, Worker health, and the same fixed local filesystem/process/shell/job-storage/resource probes exposed by `diagnose_runtime`. Public `/healthz` output contains only server identity and version; daemon details require an authenticated `server_info` call.
+`status` prints redacted profile state and verifies the deployed Worker version. Resource source paths remain redacted. `doctor` checks Node.js, the package-installed Wrangler binary, Cloudflare login, Worker health, the configured policy, the automatic-without-per-operation-prompts authorization model, and the same fixed local filesystem/process/shell/job-storage/resource probes exposed by `diagnose_runtime`. Authenticated `server_info.authorization.execution_model` reports the same contract and identifies whether the account has daemon-OS-user ambient authority. Public `/healthz` output contains only server identity and version; daemon details require an authenticated `server_info` call.
 
 ### Worker deployment and health convergence
 

package/docs/TESTING.md

@@ -55,7 +55,7 @@ The suite includes:
 - isolated command HOME/temp/cache behavior;
 - one-shot timeout, descendant process-group/tree termination including descendants that ignore graceful shutdown after the direct child has already exited, cancellation, and process-session interaction;
 - layered fixed runtime diagnostics for filesystem, direct process, shell, managed-job storage, and resource availability; machine-readable execution guardrails that must keep CPU, memory, and network isolation marked unenforced unless an actual OS boundary is added;
-- local resource CLI registration, permission checks, dynamic reload, state-path redaction, and content non-disclosure;
+- local resource CLI registration, permission checks, dynamic reload, state-path redaction, content non-disclosure, and the extracted runtime-resource boundary for bounded binary/UTF-8 reads plus generation authorization;
 - real Ed25519 and RSA generation, idempotent reuse, public/private correspondence, mode enforcement, incomplete/mismatched/symlink rejection, and private-content non-disclosure;
 - real-machine canonical-full sandbox acceptance for outside-workspace I/O, direct/shell execution, full environment inheritance, SSH prerequisites, temporary authorized-key writing, and detached cleanup without external state changes;
 - deterministic injected atomic-replace failures, sustained transient Windows sharing contention beyond the old retry budget, bounded exponential delay selection, and repeated Windows full-sandbox runs;
@@ -64,7 +64,7 @@ The suite includes:
 - daemon/startup locking, successfully-read corrupt-JSON recovery, and explicit propagation/preservation of oversized, symbolic-link, permission, and I/O failures;
 - guarded state-root removal, unsafe state-root/workspace overlap rejection before creation, all-profile lock/daemon scanning, strict current-schema validation, corrupt-JSON isolation, and policy-origin persistence;
 - no filename-based sensitive-file denial under unrestricted policy;
-- log redaction, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, service warning-level configuration, JSON-mode parity across event and direct logger methods with timestamp/stream/redaction assertions, current-schema reset, and bounded tail trimming;
+- shared local/Worker free-form log redaction, sensitive content under non-sensitive Worker keys, immutable local/Worker structured metadata, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, service warning-level configuration, JSON-mode parity across event and direct logger methods with timestamp/stream/redaction assertions, current-schema reset, and bounded tail trimming;
 - deterministic relay connection lifecycle coverage for transport construction/error/deadline, pre-handshake `welcome` validation, separate `hello_ack` authentication and `ready_ack` end-to-end readiness, session-bound probe return, pre-ready tool rejection, premature-ready rejection, identity/version mismatch, retryable Worker hello/readiness errors, fatal protocol errors, autonomous outage-reminder backoff, handshake/readiness/heartbeat timeout, brief-outage suppression, sustained-outage escalation, recovery summaries, and supersession;
 - shared no-follow bounded-file reads for normal files, over-limit data, directories, and symbolic links;
 - owner-only directory enforcement rejecting final symlinks, failing closed on POSIX chmod errors, verifying `0700`, and retaining Windows portability; Worker temporary-secret lifecycle coverage for process-start-bound names, valid stale-owner reclamation, ambiguous-owner retention, `0600` mode, deletion failures, and simultaneous deployment/cleanup failures;
@@ -146,7 +146,7 @@ Run `npm run privacy:check` before committing and before packaging. Run and revi
 
 ## Package manifest
 
-`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that required runtime, script, browser-extension, privacy, governance, and release files are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe exercises startup without mutating a live account. Package testing is full-plan-only; installation smoke runs in the Ubuntu full plan, the macOS/Windows platform plan, and package audit.
+`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that required runtime, script, browser-extension, privacy, governance, and release files are present. Exact runtime install-script approvals are version-bound, so a Wrangler/workerd refresh must also update the reviewed allowlist and pass a clean npm install without blocked-script warnings. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe exercises startup without mutating a live account. Package testing is full-plan-only; installation smoke runs in the Ubuntu full plan, the macOS/Windows platform plan, and package audit.
 
 `npm run lint` uses ESLint as a semantic JavaScript correctness gate rather than a style formatter. It covers the Node CLI/runtime, repository scripts, tests, and packaged browser extension and rejects undefined identifiers in function bodies that `node --check` cannot detect. A dedicated lint-gate self-test proves that both Node and browser configurations reject a synthetic undefined binding while accepting the service-worker `importScripts` global. A focused `shell:test` requires Wrangler to run through the current Node executable and its package JavaScript entrypoint rather than a `.cmd` or shell shim. Architecture tests require `shell:test`, `lint:test`, `lint`, and `install:test` to remain in the complete check pipeline and reject non-exact direct dependency ranges.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.10",
+  "version": "3.0.0-beta.11",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -168,7 +168,7 @@
   "dependencies": {
     "https-proxy-agent": "9.1.0",
     "proxy-from-env": "2.1.0",
-    "wrangler": "4.112.0",
+    "wrangler": "4.113.0",
     "ws": "8.21.1"
   },
   "devDependencies": {
@@ -207,8 +207,8 @@
   "allowScripts": {
     "esbuild@0.28.1": true,
     "fsevents": false,
-    "workerd@1.20260714.1": true,
-    "sharp@0.35.3": true
+    "sharp@0.35.3": true,
+    "workerd@1.20260721.1": true
   },
   "packageManager": "npm@12.0.1",
   "devEngines": {

package/src/local/cli.mjs

@@ -519,6 +519,13 @@ async function doctorCommand(args) {
   const state = loadState(workspace, { stateDir: args.stateDir });
   state.policy = resolvePolicy({}, state.policy);
   checks.push({ name: "policy", ok: true, detail: formatPolicySummary(state.policy) });
+  checks.push({
+    name: "authorization-model",
+    ok: true,
+    detail: state.policy.profile === "full"
+      ? "local owner operations execute automatically without per-operation prompts; shell, browser, and application automation use the daemon OS user's ambient authority"
+      : "operations allowed by the selected local policy execute automatically without per-operation prompts",
+  });
   if (state.policy.profile === "full") {
     try {
       assertCanonicalFullPolicy(state.policy);

package/src/local/log.mjs

@@ -1,6 +1,7 @@
 import process from "node:process";
 import os from "node:os";
 import { errorCode } from "./errors.mjs";
+import { sanitizePortableLogText } from "../shared/log-redaction.mjs";
 
 const COLORS = {
   reset: "\x1b[0m",
@@ -18,20 +19,6 @@ const MAX_LOG_OBJECT_KEYS = 48;
 const LEVEL_RANK = Object.freeze({ debug: 10, info: 20, success: 20, warn: 30, error: 40 });
 const SENSITIVE_KEY = /(authorization|cookie|password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)/i;
 const LOCAL_PATH_KEY = /(path|paths|cwd|workspace|directory|(?:^|[_-])dir(?:$|[_-])|root|home)/i;
-const SECRET_VALUE = /\b(?:account_admin|account_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
-const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
-const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
-const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
-const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g;
-const GITLAB_TOKEN = /\bglpat-[A-Za-z0-9_-]{20,}\b/g;
-const NPM_TOKEN = /\bnpm_[A-Za-z0-9]{30,}\b/g;
-const SLACK_TOKEN = /\bxox[aboprs]-[A-Za-z0-9-]{10,}\b/g;
-const GOOGLE_API_KEY = /\bAIza[A-Za-z0-9_-]{30,}\b/g;
-const PAYMENT_API_KEY = /\b(?:sk|rk|pk)_live_[A-Za-z0-9]{16,}\b/g;
-const JWT_VALUE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
-const URL_CREDENTIALS = /https?:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@[^\s/"'<>]+/gi;
-const API_SECRET = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g;
-const PRIVATE_KEY_HEADER = /-----BEGIN\s+(?:(?:OPENSSH|RSA|EC|DSA)\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/g;
 const HOME_PATHS = [...new Set([process.env.HOME, process.env.USERPROFILE, safeHomeDirectory()].filter(value => typeof value === "string" && value.length > 1))]
   .sort((left, right) => right.length - left.length);
 
@@ -49,11 +36,11 @@ export function createLogger(options = {}) {
     const sanitizedMessage = sanitizeLogText(message, MAX_LOG_MESSAGE_CHARS);
     if (options.format === "json") {
       const entry = sanitizeLogValue({
+        ...(fields && typeof fields === "object" ? fields : {}),
         timestamp: new Date().toISOString(),
         level: level === "success" ? "info" : level,
         component,
         message: sanitizedMessage,
-        ...(fields && typeof fields === "object" ? fields : {}),
       });
       stream.write(`${JSON.stringify(entry)}\n`);
       return;
@@ -66,16 +53,16 @@ export function createLogger(options = {}) {
   const event = (level, name, fields = {}, message = "") => {
     const normalizedLevel = normalizeEventLevel(level);
     const eventName = sanitizeEventName(name);
-    const payload = { event: eventName, ...fields };
+    const payload = { ...fields, event: eventName };
     const humanMessage = message || humanizeEventName(eventName);
     if (options.format === "json") {
       if (LEVEL_RANK[normalizedLevel] < LEVEL_RANK[minimumLevel]) return;
       const entry = sanitizeLogValue({
+        ...payload,
         timestamp: new Date().toISOString(),
         level: normalizedLevel === "success" ? "info" : normalizedLevel,
         component,
         message: sanitizeLogText(humanMessage, MAX_LOG_MESSAGE_CHARS),
-        ...payload,
       });
       const target = normalizedLevel === "info" || normalizedLevel === "success" ? stdout : stderr;
       target.write(`${JSON.stringify(entry)}\n`);
@@ -158,33 +145,7 @@ function sanitizeLogValue(value, key = "", seen = new WeakSet(), depth = 0) {
 }
 
 export function sanitizeLogText(value, maxChars = MAX_LOG_MESSAGE_CHARS) {
-  let raw;
-  try { raw = String(value ?? ""); } catch { raw = "<unprintable>"; }
-  let sanitized = raw
-    .replace(SECRET_VALUE, "<redacted-secret>")
-    .replace(BEARER_VALUE, "Bearer <redacted>")
-    .replace(AWS_ACCESS_KEY, "<redacted-cloud-key>")
-    .replace(GITHUB_TOKEN, "<redacted-access-token>")
-    .replace(GITLAB_TOKEN, "<redacted-access-token>")
-    .replace(NPM_TOKEN, "<redacted-access-token>")
-    .replace(SLACK_TOKEN, "<redacted-access-token>")
-    .replace(GOOGLE_API_KEY, "<redacted-cloud-key>")
-    .replace(PAYMENT_API_KEY, "<redacted-api-secret>")
-    .replace(JWT_VALUE, "<redacted-bearer-token>")
-    .replace(URL_CREDENTIALS, "<redacted-credential-url>")
-    .replace(API_SECRET, "<redacted-api-secret>")
-    .replace(PRIVATE_KEY_HEADER, "<redacted-private-key-header>")
-    .replace(EMAIL_VALUE, "<redacted-email>");
-  for (const home of HOME_PATHS) sanitized = sanitized.split(home).join("<home>");
-  sanitized = sanitized
-    .replace(/\/(?:Users|home)\/[^/\s"'<>]+(?=\/|$)/g, "<home>")
-    .replace(/\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?=\\|$)/g, "<home>")
-    .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
-    .replace(/[\r\n\t]/g, match => match === "\t" ? "\\t" : "\\n")
-    .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "?");
-  if (!Number.isFinite(Number(maxChars)) || Number(maxChars) <= 0) return "";
-  const limit = Math.max(16, Number(maxChars));
-  return sanitized.length > limit ? `${sanitized.slice(0, limit - 1)}…` : sanitized;
+  return sanitizePortableLogText(value, { maxChars, homePaths: HOME_PATHS });
 }
 
 function safeHomeDirectory() {

package/src/local/runtime-resource-service.mjs

@@ -0,0 +1,77 @@
+import { resolve } from "node:path";
+import { inspectResourceFile } from "./managed-job-plan.mjs";
+import { generateRegisteredSshKey } from "./resource-operations.mjs";
+import { expandHome } from "./state.mjs";
+import { stateRootFromProfileStatePath } from "./runtime-paths.mjs";
+import { readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const MAX_BROWSER_RESOURCE_BYTES = 1024 * 1024;
+
+export class RuntimeResourceService {
+  constructor({ workspace, resourceStatePath = "", currentResources, authorizeTool }) {
+    this.workspace = resolve(workspace);
+    this.resourceStatePath = resourceStatePath ? resolve(resourceStatePath) : "";
+    this.currentResources = currentResources;
+    this.authorizeTool = authorizeTool;
+  }
+
+  readBinary(name) {
+    const registry = this.currentResources();
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
+    if (!resource) throw new Error(`unknown local resource: ${name}`);
+    const inspected = inspectResourceFile(resource.path, {
+      allowInsecurePermissions: resource.allowInsecurePermissions === true,
+    });
+    if (inspected.size > MAX_BROWSER_RESOURCE_BYTES) {
+      throw new Error("local resource exceeds 1 MiB browser injection limit");
+    }
+    return {
+      buffer: readBoundedRegularFileSync(resource.path, MAX_BROWSER_RESOURCE_BYTES),
+      path: resource.path,
+      size: inspected.size,
+    };
+  }
+
+  readText(name) {
+    const { buffer } = this.readBinary(name);
+    try {
+      return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+    } catch {
+      throw new Error(`local resource is not valid UTF-8 text: ${name}`);
+    }
+  }
+
+  async generateSshKey(args = {}) {
+    this.authorizeTool("generate_ssh_key_resource");
+    if (!this.resourceStatePath) throw new Error("local resource state is unavailable in this runtime");
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
+    const target = args.path
+      ? resolve(expandHome(String(args.path)))
+      : resolve(home, ".ssh", `machine-mcp-${args.name}-ed25519`);
+    const key = await generateRegisteredSshKey({
+      workspace: this.workspace,
+      stateDir: stateRootFromProfileStatePath(this.resourceStatePath),
+      name: args.name,
+      targetPath: target,
+      comment: args.comment || `machine-mcp:${args.name}`,
+    });
+    const exposePaths = args.expose_paths === true;
+    return {
+      name: key.name,
+      created: key.created,
+      registered: key.registered,
+      fingerprint: key.fingerprint,
+      key_type: key.keyType,
+      private_mode: key.privateMode,
+      public_mode: key.publicMode,
+      private_key_content_exposed: key.privateKeyContentExposed,
+      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
+      paths_exposed: exposePaths,
+      ...(exposePaths ? {
+        private_key_path: resolve(key.privateKeyPath),
+        public_key_path: resolve(key.publicKeyPath),
+      } : {}),
+    };
+  }
+}

package/src/local/runtime.mjs

@@ -19,14 +19,11 @@ import { LifecycleController } from "./lifecycle.mjs";
 import { MAX_WRITE_BYTES, sha256, WorkspaceFileService } from "./workspace-file-service.mjs";
 export { MAX_WRITE_BYTES, sha256 } from "./workspace-file-service.mjs";
 import { classifyOperationalError } from "./log.mjs";
-import { inspectResourceFile, ManagedJobManager } from "./managed-jobs.mjs";
-import { generateRegisteredSshKey } from "./resource-operations.mjs";
-import { expandHome } from "./state.mjs";
+import { ManagedJobManager } from "./managed-jobs.mjs";
 import { AgentContextManager } from "./agent-context.mjs";
 import { AppAutomationManager } from "./app-automation.mjs";
 import { BrowserBridgeManager } from "./browser-bridge.mjs";
 import { CapabilityObserver } from "./capability-observer.mjs";
-import { readBoundedRegularFileSync } from "./secure-file.mjs";
 import { isPlainRecord } from "./records.mjs";
 import { AccountAccessGate } from "./account-access.mjs";
 import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
@@ -38,7 +35,8 @@ import { delegatedProcessIsolationStatus } from "./delegated-process-sandbox.mjs
 import { policyForContext } from "./authority-context.mjs";
 import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelayToolCall } from "./runtime-relay.mjs";
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
-import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage, stateRootFromProfileStatePath } from "./runtime-paths.mjs";
+import { RuntimeResourceService } from "./runtime-resource-service.mjs";
+import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage } from "./runtime-paths.mjs";
 import {
   resolveTaskCapabilities as resolveRuntimeTaskCapabilities,
   sessionBootstrap as buildRuntimeSessionBootstrap,
@@ -155,9 +153,15 @@ export class LocalRuntime {
       gitExecutable: () => this.resolveGitExecutable(),
       maximumBytes: MAX_WRITE_BYTES,
     });
+    this.runtimeResourceService = new RuntimeResourceService({
+      workspace: this.workspace,
+      resourceStatePath: this.resourceStatePath,
+      currentResources: () => this.managedJobManager.currentResources(),
+      authorizeTool: (tool) => this.policyGate.assert(tool),
+    });
     const runProcess = (cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin) => this.runProcess(cmd, argv, timeoutMs, allowFailure, maxOutputBytes, context, cwd, stdin);
-    const readResourceText = (name) => this.readLocalResourceText(name);
-    const readResourceBinary = (name) => this.readLocalResourceBinary(name);
+    const readResourceText = (name) => this.runtimeResourceService.readText(name);
+    const readResourceBinary = (name) => this.runtimeResourceService.readBinary(name);
     this.appAutomationManager = new AppAutomationManager({
       ...applicationAutomation,
       policy: this.policy,
@@ -518,37 +522,7 @@ export class LocalRuntime {
 
   async generateSshKeyResource(args = {}, context = {}) {
     this.throwIfCancelled(context);
-    this.policyGate.assert("generate_ssh_key_resource");
-    if (!this.resourceStatePath) throw new Error("local resource state is unavailable in this runtime");
-    const home = process.env.HOME || process.env.USERPROFILE;
-    if (!home) throw new Error("HOME or USERPROFILE is required to choose a default SSH key path");
-    const target = args.path
-      ? resolve(expandHome(String(args.path)))
-      : resolve(home, ".ssh", `machine-mcp-${args.name}-ed25519`);
-    const key = await generateRegisteredSshKey({
-      workspace: this.workspace,
-      stateDir: stateRootFromProfileStatePath(this.resourceStatePath),
-      name: args.name,
-      targetPath: target,
-      comment: args.comment || `machine-mcp:${args.name}`,
-    });
-    const exposePaths = args.expose_paths === true;
-    return {
-      name: key.name,
-      created: key.created,
-      registered: key.registered,
-      fingerprint: key.fingerprint,
-      key_type: key.keyType,
-      private_mode: key.privateMode,
-      public_mode: key.publicMode,
-      private_key_content_exposed: key.privateKeyContentExposed,
-      available_to_new_jobs_immediately: key.availableToNewJobsImmediately,
-      paths_exposed: exposePaths,
-      ...(exposePaths ? {
-        private_key_path: resolve(key.privateKeyPath),
-        public_key_path: resolve(key.publicKeyPath),
-      } : {}),
-    };
+    return this.runtimeResourceService.generateSshKey(args);
   }
 
   async sessionBootstrap(args = {}, context = {}) {
@@ -569,24 +543,6 @@ export class LocalRuntime {
     }, args, context);
   }
 
-  readLocalResourceBinary(name) {
-    const registry = this.managedJobManager.currentResources();
-    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
-    if (!resource) throw new Error(`unknown local resource: ${name}`);
-    const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
-    if (inspected.size > 1024 * 1024) throw new Error("local resource exceeds 1 MiB browser injection limit");
-    return { buffer: readBoundedRegularFileSync(resource.path, 1024 * 1024), path: resource.path, size: inspected.size };
-  }
-
-  readLocalResourceText(name) {
-    const { buffer } = this.readLocalResourceBinary(name);
-    try {
-      return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
-    } catch {
-      throw new Error(`local resource is not valid UTF-8 text: ${name}`);
-    }
-  }
-
   runDirectProcess(args, context = {}) {
     return this.processExecutionService.runDirect(args, context);
   }

package/src/shared/log-redaction.d.mts

@@ -0,0 +1,9 @@
+export type PortableLogSanitizationOptions = {
+  maxChars: number;
+  homePaths?: string[];
+};
+
+export function sanitizePortableLogText(
+  value: unknown,
+  options: PortableLogSanitizationOptions,
+): string;

package/src/shared/log-redaction.mjs

@@ -0,0 +1,51 @@
+const SECRET_VALUE = /\b(?:account_admin|account_password|daemon_secret|token_version|mcp_at|mcp_code)_[A-Za-z0-9_-]+\b/g;
+const BEARER_VALUE = /\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/gi;
+const EMAIL_VALUE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const AWS_ACCESS_KEY = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
+const GITHUB_TOKEN = /\bgh[pousr]_[A-Za-z0-9_]{30,}\b/g;
+const GITLAB_TOKEN = /\bglpat-[A-Za-z0-9_-]{20,}\b/g;
+const NPM_TOKEN = /\bnpm_[A-Za-z0-9]{30,}\b/g;
+const SLACK_TOKEN = /\bxox[aboprs]-[A-Za-z0-9-]{10,}\b/g;
+const GOOGLE_API_KEY = /\bAIza[A-Za-z0-9_-]{30,}\b/g;
+const PAYMENT_API_KEY = /\b(?:sk|rk|pk)_live_[A-Za-z0-9]{16,}\b/g;
+const JWT_VALUE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+const URL_CREDENTIALS = /https?:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@[^\s/"'<>]+/gi;
+const API_SECRET = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g;
+const PRIVATE_KEY_HEADER = /-----BEGIN\s+(?:(?:OPENSSH|RSA|EC|DSA)\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/g;
+
+export function sanitizePortableLogText(value, options = {}) {
+  let raw;
+  try { raw = String(value ?? ""); } catch { raw = "<unprintable>"; }
+  let sanitized = raw
+    .replace(SECRET_VALUE, "<redacted-secret>")
+    .replace(BEARER_VALUE, "Bearer <redacted>")
+    .replace(AWS_ACCESS_KEY, "<redacted-cloud-key>")
+    .replace(GITHUB_TOKEN, "<redacted-access-token>")
+    .replace(GITLAB_TOKEN, "<redacted-access-token>")
+    .replace(NPM_TOKEN, "<redacted-access-token>")
+    .replace(SLACK_TOKEN, "<redacted-access-token>")
+    .replace(GOOGLE_API_KEY, "<redacted-cloud-key>")
+    .replace(PAYMENT_API_KEY, "<redacted-api-secret>")
+    .replace(JWT_VALUE, "<redacted-bearer-token>")
+    .replace(URL_CREDENTIALS, "<redacted-credential-url>")
+    .replace(API_SECRET, "<redacted-api-secret>")
+    .replace(PRIVATE_KEY_HEADER, "<redacted-private-key-header>")
+    .replace(EMAIL_VALUE, "<redacted-email>");
+
+  const homePaths = Array.isArray(options.homePaths) ? options.homePaths : [];
+  for (const home of [...new Set(homePaths.filter(item => typeof item === "string" && item.length > 1))]
+    .sort((left, right) => right.length - left.length)) {
+    sanitized = sanitized.split(home).join("<home>");
+  }
+  sanitized = sanitized
+    .replace(/\/(?:Users|home)\/[^/\s"'<>]+(?=\/|$)/g, "<home>")
+    .replace(/\b[A-Za-z]:\\Users\\[^\\\s"'<>]+(?=\\|$)/g, "<home>")
+    .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g, "")
+    .replace(/[\r\n\t]/g, match => match === "\t" ? "\\t" : "\\n")
+    .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "?");
+
+  const numericLimit = Number(options.maxChars);
+  if (!Number.isFinite(numericLimit) || numericLimit <= 0) return "";
+  const limit = Math.max(16, numericLimit);
+  return sanitized.length > limit ? `${sanitized.slice(0, limit - 1)}…` : sanitized;
+}

package/src/worker/authority.ts

@@ -31,6 +31,12 @@ type AccountAuthority = {
     daemon_policy: string;
     host_filtering: string;
   };
+  execution_model: {
+    within_effective_authority: "automatic_without_per_operation_prompt";
+    owner_ambient_authority: "daemon_os_user" | "not_owner";
+    generic_control_plane_paths: "denied_even_for_owner";
+    mutually_untrusted_execution_requires: "external_os_isolation";
+  };
   summary: string;
 };
 
@@ -78,9 +84,15 @@ export function accountAuthoritySnapshot(input: AccountIdentity & {
       daemon_policy: "daemon.policy is only the local daemon capability ceiling; it is not the authenticated account permission",
       host_filtering: "the MCP host may expose a smaller subset than effective_tools, and Machine Bridge cannot observe that post-relay subset",
     },
+    execution_model: {
+      within_effective_authority: "automatic_without_per_operation_prompt",
+      owner_ambient_authority: input.role === "owner" ? "daemon_os_user" : "not_owner",
+      generic_control_plane_paths: "denied_even_for_owner",
+      mutually_untrusted_execution_requires: "external_os_isolation",
+    },
     summary: input.daemonPolicy
-      ? `Authenticated account role ${input.role} has effective profile ${effectiveProfile}. daemon.policy.profile=${daemonProfile} is only the daemon capability ceiling, not this account's permission.`
-      : `Authenticated account role ${input.role} is configured for profile ${accountPolicy.profile}, but no daemon is connected; only Worker-local tools are currently available.`,
+      ? `Authenticated account role ${input.role} has effective profile ${effectiveProfile}. daemon.policy.profile=${daemonProfile} is only the daemon capability ceiling, not this account's permission. Operations within effective authority execute automatically without a per-operation prompt${input.role === "owner" ? "; owner shell, browser, and application automation can act with the daemon OS user's ambient authority" : ""}.`
+      : `Authenticated account role ${input.role} is configured for profile ${accountPolicy.profile}, but no daemon is connected; only Worker-local tools are currently available. Operations within effective authority execute automatically without a per-operation prompt.`,
   };
 }
 

package/src/worker/index.ts

@@ -36,7 +36,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.10";
+const SERVER_VERSION = "3.0.0-beta.11";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;

package/src/worker/observability.ts

@@ -1,3 +1,5 @@
+import { sanitizePortableLogText } from "../shared/log-redaction.mjs";
+
 const MAX_ERROR_CODES = 64;
 const MAX_TOOLS = 128;
 const SENSITIVE_FIELD = /(?:authorization|cookie|credential|password|secret|token|verifier|private[_-]?key)/i;
@@ -63,11 +65,11 @@ export class WorkerObservability {
 
   event(level: "info" | "warn" | "error", event: string, fields: Record<string, unknown> = {}): void {
     const entry = {
+      ...sanitizeFields(fields),
       timestamp: new Date().toISOString(),
       level,
       component: "worker",
       event: sanitizeName(event),
-      ...sanitizeFields(fields),
     };
     const text = JSON.stringify(entry);
     if (level === "error") console.error(text);
@@ -108,7 +110,7 @@ function sanitizeFields(fields: Record<string, unknown>): Record<string, unknown
       continue;
     }
     if (typeof value === "boolean" || typeof value === "number" || value === null) out[safeKey] = value;
-    else if (typeof value === "string") out[safeKey] = value.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 256);
+    else if (typeof value === "string") out[safeKey] = sanitizePortableLogText(value, { maxChars: 256 });
   }
   return out;
 }