machine-bridge-mcp 3.0.0-beta.198 → 3.0.0-beta.199

package/CHANGELOG.md

@@ -1,36 +1,118 @@
 # Changelog
 
-## 3.0.0-beta.198 - 2026-10-03
+## 3.0.0-beta.199 - 2026-10-08
 
-- Redact macOS temporary-path aliases and truncated Windows case aliases from managed-job output.
-- Decode sensitive URL parameter names before log redaction; redact complete and truncated private-key bodies.
-- Reject coerced Cloudflare account identifiers and malformed token-validity evidence.
-- Stream deployment-source enumeration with entry, depth, file-count and byte budgets.
-- Persist confirmed Worker upload evidence before endpoint parsing or staging cleanup can fail; reconcile unknown endpoints instead of automatically uploading again.
-- Consolidate duplicate engineering release guidance under the canonical releasing procedure.
-- Drain durable authority revocations in bounded HTTPS batches without losing acknowledgements or invalidating healthy channels; include sequence/envelope overhead in response budgets and atomically persist replay-capacity family eviction with its revocation.
-- Preserve replacement WebSocket connection deadlines when stale events arrive, and settle asynchronous gateway/signature failures through typed responses.
-- Reject malformed revocation/OAuth/DPoP inputs, non-boolean account activation values and inherited enum keys; revalidate current authority and respect pre-existing cancellation before daemon dispatch.
-- Preserve monitor transitions across sequence rollover and bound observability overflow without recursive failure.
-- Bind instruction/skill reads, file rollback, lock recovery, directory traversal, SSH publication and state cleanup to verified identities; validate config paths before reading and preserve unrelated replacements and failure evidence.
-- Keep process, session and runtime ownership through asynchronous settlement and retain candidate daemon ownership after failed shutdown; close late-spawn shutdown races, terminate SSE encoding/projection failures, bound invocation inputs, and give isolated jobs private runtime directories.
-- Fence browser renderer mutations by cancellation/deadline authority, including asynchronous actionability waits and socket replacement.
-- Verify Secure Enclave provenance before native export, signing or deletion; reject oversized signing input before EOF or Keychain access.
-- Sanitize default CLI errors and reject incomplete, failed, inconsistent or scalar-coerced SARIF evidence; prevent conformance credentials from reaching child environments and release proxy readers after disconnect.
-- Implement the declared empty resource-template list, remove stale resource conformance exclusions, and keep unknown-resource errors bounded without reflecting their URI.
-- Apply path-display policy before skill warning sanitization/truncation and preserve dollar signs as literal text in path projections and file edits.
-- Harden generated Worker type recovery with bounded no-follow reads; share strict consumer/deployment audit validation and fixed Worker persistence error classes without copying arbitrary exception names.
-- Wait for the full-access fixture's verified runner exit before deleting job state, restore its environment on shutdown failure, and use the production Swift driver for native provenance tests.
-- Remove arbitrary peer-supplied WebSocket close reasons from debug logs while retaining fixed protocol classifications and outage recovery summaries.
-- Use locked dependency installation in the Windows checkout launcher and fail on setup errors without stale exit-code expansion; share private npm launchers across CI and temporary toolchains so nested lifecycle calls retain the pinned CLI.
-- Correct the public validator's readonly-array declaration and inspect dependencies through one syntax-aware source graph, including escaped paths and declaration files.
-- Share bounded child readiness, capture and exit cleanup across managed-job/process-lock fixtures, with one deadline for preparation and settlement. Prove recovery-lock handoff before corruption assertions and descendant readiness before publication timeout assertions; await runtime teardown and consolidate screenshot rejection setup while retaining distinct cleanup assertions and browser limits.
-- Require both markers in source-order guards and share exact script checks/source reads. Reject event-derived shell expressions with a bounded scan and alternate YAML mappings before dependency-free workflow policy reads.
-- Recheck Git metadata directory identity after opening and traversal, and preserve cancellation during empty-directory opening.
-- Share bounded browser screenshot validation and one observation decode; assert fixture outcomes and clear failed-handshake deadlines.
-- Reject coerced or malformed consumer dependency/SBOM evidence and duplicate graph edges without string normalization.
-- Replace the repeated test-case inventory with a current regression map, and remove repeated overview/release/install instructions while retaining canonical recovery, authority and privacy contracts.
+- Resolve GHSA-wq5f-xc86-pv6w (CVE-2026-96889) by pinning Sharp 0.35.5 in both the source checkout and the isolated Cloudflare deployment toolchain, including their independent dependency locks and lifecycle-script allowlists.
+- Require the installed private toolchain dependency tree and its integrity marker to match the patched Sharp version; reject vulnerable installed versions before deployment tooling is used.
+- Raise the consumer-package Sharp minimum to the first patched version and add vulnerable-version and patched-version regression cases.
+- Fail closed on malformed private toolchain npm versions, dependency-tree metadata and coerced package versions; avoid reflecting raw private npm diagnostics in errors.
+- Preserve fail-closed npm audit, supply-chain verification and OpenSSF Scorecard review gates without adding a vulnerability exception.
+- Remove the obsolete boolean `computer_act.include_post_screenshot` compatibility option; require `post_screenshot=auto|always|never`, reject obsolete inputs, and advance the tool schema generation.
+- Replace destructive state-root removal advice on obsolete persisted schemas with preservation and supported upgrade/backup recovery guidance.
+- Keep managed-job fatal operational diagnostics to a fixed error classification, avoiding arbitrary exception-message disclosure to logs.
+- Extend that fixed-diagnostic boundary through runner startup before the job claim is confirmed, so missing or unreadable initial state cannot expose private paths, raw filesystem errors or exception stacks.
+- Require exact JSON types for persisted process ownership, runner claims, active-child claims, resource transaction locks, leases and waiters; reject string/array coercion before liveness, recovery, cleanup, termination or critical-section decisions.
+- Require exact string credentials, integer ports and string broker endpoints for current browser-pairing state; arrays and numeric-string ports no longer acquire pairing or authentication authority through JavaScript conversion.
+- Remove the retired browser-pairing migration marker from the current persisted model and advance the pairing schema to version 3, while preserving one exact one-way beta.198 stable-state upgrade that retains both credentials and the selected port; pending beta.198 migrations and older, malformed, coercible or extra-field envelopes remain fail closed.
+- Remove the redundant managed-job result `recovered` compatibility boolean; recovery outcome is represented only by the terminal status enum, and interrupted recovery never replays main steps.
+- Require Git 2.50 or later for reachable-history privacy scanning instead of carrying an older `rev-list` output parser; fail before scanning when the trusted Git version is too old or malformed.
+- Reject non-string OAuth grant types, authorization codes, PKCE verifiers, client identifiers, redirect URIs, resources, scopes and refresh tokens before credential lookup or consumption.
+- Apply the Sharp 0.35.5 minimum independently to consumer CycloneDX validation as well as the installed dependency tree, including malformed and prerelease version rejection.
+- Reject coercible legacy resource-staging publisher PID evidence instead of accepting strings, arrays or booleans as process identities; retain the staging files on malformed ownership.
+- Refuse staging reclamation when the publisher PID encoded in a current-format filename exceeds safe integer bounds, rather than treating invalid process identity as permission to delete.
+- Remove the retired version-2 capability-lease/release-task cleanup compatibility surface from current documentation and state-root removal; unsupported older state is preserved and rejected instead of interpreted by the current runtime.
+- Reject non-string browser extension IDs, origins, and manifest public keys instead of allowing arrays or other values to acquire extension identity through JavaScript string coercion.
+- Treat synchronous security-audit worker transport failures as terminal worker failures, settle all pending audit promises, mark health unavailable, and account for records that could not be persisted instead of leaving queued callers hanging.
+- Stop interpreting retired schema-v1 Worker continuity evidence; unsupported persisted continuity schemas now fail closed to empty current-schema diagnostics instead of partially migrating historical counters.
+- Reject non-string persisted daemon socket roles instead of allowing arrays or other values to pass role validation through JavaScript string coercion.
+- Add a random per-daemon pseudonym correlation epoch to new security-audit events so incident review can identify runtime-key rotation boundaries without creating stable cross-restart principal or target identifiers.
+- Remove the redundant browser-extension `tabs` permission; existing `<all_urls>` host authority already supplies tab metadata for scriptable pages, while restricted browser-internal pages now expose less metadata to the extension.
+- Route npm publication cleanup warnings through the shared release diagnostic sanitizer so a successful publication cannot leak local home paths or credential-shaped values through best-effort cleanup messages.
+- Mark browser-derived page text, accessibility labels, DOM attributes, and screenshots as untrusted data in remote MCP server instructions so webpage prompt injection is not presented as authorization or higher-precedence guidance.
+- Repair the privacy regression fixture so Git-version boundary assertions use Node's strict assertion API instead of the test file's boolean-only helper, restoring coverage-gate execution of the privacy suite.
+- Remove schema-v1 migration rationale from the always-injected MCP server instructions now that the runtime is current-schema-only; historical rationale remains in release history instead of consuming every client context.
+- Reject Git version components outside JavaScript safe-integer bounds so malformed trusted-Git version output cannot satisfy the privacy-history minimum through numeric infinity coercion.
+- Keep promotion-digest npm pack metadata type-exact by rejecting non-string paths and non-integer file modes instead of normalizing coercible values into release evidence.
+- Replace stale fixed beta.1 commands in the release guide with an explicit next-version variable and a soak-confirmation command derived from the current package version, preventing copy/paste of an obsolete prerelease identifier.
+- Reject non-string local account-admin lookup targets instead of allowing arrays or other values to select a privileged account through string coercion.
+- Require persisted resource lease, waiter, transaction-lock, and newly bound child PIDs to be positive safe integers so precision-losing process identities fail as integrity errors instead of being silently reclaimed or bound.
+- Apply the same safe-integer PID boundary to the shared owner-state lock primitive so malformed toolchain and maintenance ownership evidence cannot be reclaimed after precision loss.
+- Preserve an in-flight browser pairing exchange after invalid final challenge, nonce, or proof attempts; the one-time grant is now consumed only after the final HMAC proof succeeds, preventing unauthenticated failures from deleting a legitimate pending exchange.
+- Require service network/TLS environment values to remain native strings on capture and reload so malformed persisted arrays or numbers cannot be coerced into active proxy or certificate configuration.
+- Make shared device-session and daemon-authentication transcript builders type-exact so arrays, numeric strings, or other coercible values cannot acquire signed protocol semantics if a future caller omits its own pre-validation.
+- Keep process-tree ownership snapshots type-exact by accepting only positive safe-integer child PIDs, matching persisted active-child and lock ownership boundaries.
+- Advance security-audit state to schema 3 while retaining one exact, one-way beta.198 schema-1 data migration: prior event objects and hashes remain unchanged under a schema-3 envelope with an explicit legacy-prefix count, while all newly appended events require current pseudonym, operation-correlation, and settlement fields.
+- Split browser operation scalar/response-contract validation into a fixed preloaded extension module and lower the browser-operations responsibility budget, removing its near-limit 1900-line concentration without changing dispatch semantics.
+- Stop reclaiming malformed daemon/startup/maintenance and managed-job lock files by age alone. Current lock publication is complete-before-visible, so malformed owner metadata is now retained as an integrity blocker; only structurally valid owners with provably stale process identity are automatically reclaimed.
+- Keep browser pairing types exact after the URL parsing boundary: the service worker and HMAC bootstrap now require native integer ports, string grants, and numeric clocks instead of accepting coercible arrays or numeric strings.
+- Gate remote non-read-only dispatch on durable security-audit health and a persisted `dispatch_intent`. Intent and terminal records share a runtime-private operation reference; the intent deliberately proves only that the authorized pre-dispatch boundary was reached, so a timeout cannot be misread as proof that the handler started.
+- Make the audit pre-dispatch gate consume an explicit local side-effect classification rather than MCP annotation metadata, and regression-check public `readOnlyHint` values against that security classification so catalog drift cannot silently weaken the gate.
+- Expose whether managed-job recovery attribution is complete without inventing beta.198 history: beta.199 recovery entries must form a contiguous suffix ending at the current attempt count, while prior-version attempt counts with no persisted reason/time remain explicitly `recovery_history_complete=false`.
+- Keep daemon relay targets type-exact from persisted/runtime configuration through WebSocket and HTTPS fallback: non-string Worker URLs are rejected rather than being coerced into authenticated network origins, and malformed HTTP relay URLs use one fixed error classification.
+- Apply the same exact-string Worker origin/name boundary to deployment health verification so malformed persisted arrays cannot be normalized into healthy Worker identity evidence.
+- Keep current security-audit hashes, pseudonym epochs, timestamps, and numeric counters type-exact; arrays and numeric strings no longer become valid-looking audit evidence through regular-expression or numeric coercion.
+- Tighten both current and beta.198 audit readers to the actual writer image: canonical ISO timestamps, bounded token/text forms, and non-negative safe-integer duration/byte counters. Hash-consistent values that no supported writer could emit are rejected as integrity failures.
+- Reject precision-losing process IDs in resource ancestry sampling and lease accounting so malformed `ps`/PowerShell evidence cannot collapse distinct PIDs into one JavaScript number.
+- Retire pre-beta.198 temporary Worker-secret filename compatibility. Cleanup now recognizes only the current PID + creation-time + process-start-time + 12-hex nonce shape; obsolete lookalike secret files are retained as explicit integrity blockers instead of being weakly attributed or silently ignored.
+- Keep local device-root/session authentication primitives type-exact: public roots now pass shared canonical P-256 validation, authentication clocks require native finite numbers, and session-signing transcripts require native strings rather than coercible values.
+- Preserve security-audit evidence types end to end: the daemon no longer coerces injected audit clocks before persistence, and recent-activity projection no longer normalizes string/array timestamps or byte counters into valid-looking evidence.
+- Keep managed-job retention timestamps type-exact before destructive maintenance: malformed staged `created_at` values no longer gain expiry authority through string coercion, and terminal retention ordering only parses native timestamp strings.
+- Make account-administration authentication transcripts and local request construction type-exact: origin/method/path/hash/key/nonce fields no longer accept coercible values, signed body bytes must already be a string, and display names are rejected rather than stringified.
+- Require daemon candidate/readiness/liveness timestamps to be native canonical ISO strings before they can establish freshness or alarm deadlines; JavaScript-coercible arrays and alternate timestamp spellings no longer become liveness evidence.
+- Document the existing `file:` browser-automation privacy boundary explicitly: when Chromium file-URL access is enabled, local file-backed tabs are data-bearing automation surfaces rather than ordinary harmless tab metadata.
+- Add an explicit offline `machine-mcp browser reset` revocation path. It serializes through state maintenance, refuses active runtime/job ownership, rechecks that the loopback broker is stopped, and atomically rotates both broker HMAC credentials without exposing their replacements.
+- Correct the browser-pairing storage model in the threat/automation docs: authoritative broker credentials remain in owner-only Machine Bridge state, while the extension stores its extension-token copy in Chromium local extension storage for restart persistence and may retain an unusable stale copy after local state reset.
+- Keep the macOS Secure Enclave broker boundary type-exact: configured/provisioned broker paths and signing transcripts now require native strings, preventing coercible arrays or objects from acquiring trust-broker path or signature semantics.
+- Redact browser pairing grants and managed-job recovery/control credentials by URL parameter name at the final logging boundary, including extension/runtime token parameters, while leaving harmless names such as `grant_type` intact.
+- Keep browser pairing grant and launch clocks/ports type-exact and internally consistent: native safe integers are required, one wall-clock sample governs each bootstrap transition, and grant creation rejects timestamps that cannot produce the protocol's canonical 13-digit expiry.
+- Tighten process-identity evidence to the current writer/probe image: snapshot PIDs must be safe integers, snapshot start times must already be numeric, and persisted owner timestamps must be canonical ISO strings rather than merely parseable dates.
+- When browser history-state cleanup fails on the ephemeral pairing page, replace the current location with the token-free `/pair` URL before stopping; pairing still fails closed, but the short-lived grant no longer remains indefinitely in the visible fragment/history entry.
+- Clear pairing bootstrap material from the content-script closure immediately after successful or ordinary failed pairing; retain it only for the explicit short-lived manual-repair branch that still needs the same grant.
+- On POSIX, synchronize the security-audit parent directory after atomic state replacement before acknowledging a batch, so a pre-dispatch intent is not reported persisted solely because the temporary file contents reached storage before the rename metadata.
+- Require the signed DPoP `htm` claim to match the normalized expected HTTP method exactly instead of uppercasing the proof claim, aligning the verifier with RFC 9449-style exact method binding and mature OAuth implementations.
+- Clarify incident diagnostics so recent audit `pending/unknown` effect-settlement counts are not mistaken for a live termination queue; current process termination remains a separate runtime snapshot.
+- Restore the local CLI browser-pairing launcher helper after compatibility-copy cleanup removed its imports while leaving the default dependency reference in place; CLI startup and `--version` no longer fail before argument dispatch.
+- Update the page-automation VM regression harness for browser-global Web Crypto and automation API version 6, keeping the production document epoch on `crypto.randomUUID()` instead of weakening it for Node test contexts.
+- Remove stale version-2 lease and schema-1 migration rationale from current architecture, operations, and release guidance now that those compatibility readers and surfaces are no longer supported.
+- Expand the privacy publication scan beyond Git-visible files to every literal `package.json#files` tree, closing a gap where Git-ignored files such as `src/local/*.local` were still included by `npm pack` but escaped the privacy gate.
+- Require canonical current account roles in every persisted OAuth authority record and remove the online bad-role repair branch; malformed or non-canonical role state now fails the current-schema boundary instead of being rewritten at runtime.
+- Remove the unreachable local-admin external-launch helper and its process-spawn/browser-launch dependencies, leaving the current pairing launch path owned only by the browser pairing service.
+- Reject prototype-shaped or otherwise malformed account IDs before indexing the persisted account table, and require runtime tool-handler dispatch to use own properties only.
+- Extend the publication privacy gate across npm's implicit README/LICENSE/package/main/bin/man surfaces, closing a second gap where a Git-ignored root README could still be auto-included by `npm pack`.
+- Document the residual same-user ancestor-directory race for ordinary workspace file mutations instead of overstating path canonicalization as an atomic cross-platform directory-handle boundary.
+- Document that the owner-only autostart network snapshot can persist embedded proxy authentication and private certificate paths even though those values are excluded from status output and logs.
+- Reject malformed hosted managed-job dependency IDs before capability verification instead of string-coercing array or other non-string values and deferring rejection to the daemon plan parser.
+- Keep OAuth, admin, and daemon edge throttling bound to the caller network identity even when an attacker adds arbitrary Authorization headers; credential-scoped rate-limit buckets are now reserved for the MCP endpoint that actually authenticates with those credentials.
+- Clarify the local-resource confidentiality boundary: browser/application mutation results do not echo injected resource content, while the destination receives it and later explicit value/source/screenshot observations may expose content the destination now holds.
+- Keep security-audit evidence type-exact: malformed non-string target hashes, principal identifiers, roles, tools, outcomes, and risk categories now fall back to null/unknown evidence instead of being string-coerced into valid-looking audit records.
+- Enforce exact string types for browser pairing grants, challenges, proofs, and credentials, and require an integer pairing port instead of accepting equivalent values through JavaScript coercion.
+- Enforce exact string types for resource-request family and contention identities so malformed persisted/request metadata cannot cross the coordinator contract through JavaScript coercion.
+- Require exact string resource names and resource-file paths in managed-job planning, keeping resource aliases and persisted plan evidence type-exact with the rest of the job schema.
+- Keep MCP subscription and pending-read per-account capacity keys type-exact instead of normalizing non-string runtime values into account identities.
+- Correct multi-account protocol documentation so removed initialization-era requests are described as rejected, not as a compatibility path.
+- Validate relay account/client/family identity again at the in-flight call attribution boundary instead of coercing malformed principals into revocation metadata.
+- Reject unknown in-flight principal kinds instead of misattributing them as local calls, preserving fail-closed revocation and interruption attribution.
+- Persist at most three privacy-bounded managed-job recovery attribution records with fixed interruption reasons and exact timestamps, expose them with the strict recovery-attempt count, and reject coercible or malformed recovery metadata instead of using it to drive automatic relaunch.
+- Require exact current Worker deployment identity types and formats for Worker names, OAuth token-version secrets, historical Worker names, and deployment fingerprints; arrays and other coercible values no longer become valid deployment identity through string conversion.
+- Require runtime package entry, expected package identity, platform selector, and packaged manifest version to have their exact string types before service activation provenance is accepted; malformed manifest arrays can no longer stringify into a valid release version.
+- Rename the fail-closed cached-schema helper from “compatibility” to “guidance” to make explicit that stale host schemas receive refresh instructions but never regain retired execution semantics.
+- Remove the unused asynchronous `auditWarning` request-context mutation; audit persistence failures remain reported through the bounded security-audit failure reporter instead of writing dead state after a response may already have settled.
+- Remove documentation and result-shape accommodation for older browser extensions: the current handshake already requires the exact packaged extension and `computer_observation_v1`, and missing tab-metadata verification evidence now projects as unverified rather than a legacy tri-state.
+- Remove the unwritten legacy `operation-authorization.lock` scan/migration path and parse the current `security-audit.lock` with its actual owner-state contract, restoring live PID attribution in state inventory.
+- Make the current OAuth store contract genuinely current-only: reject one-character legacy account names and clients missing the current DCR registration identity/revision instead of keeping them authorization-readable, and remove stale-registration status from the admin projection.
+- Fail a managed-job step immediately when a still-live spawned child has no verifiable process-start identity; the runner terminates that child instead of allowing an active claim that crash recovery could only classify as ambiguous.
+- Extend private Wrangler toolchain reuse verification to the executable install-script dependencies `esbuild` and `workerd`, and bump the audit marker schema so existing cached installs are revalidated under the stronger contract.
+- Remove the obsolete browser setup note for migrating older local-candidate extension paths; current setup documents only the stable unpacked-extension path.
+- Split managed-job recovery history accounting out of general state validation so recovery attribution has a dedicated bounded module instead of expanding the core status validator beyond its responsibility boundary.
+- Reject multiply linked package files while computing the promotion digest so an alternate hard-link path cannot mutate candidate content behind the verified package path.
+- Centralize Worker-name and OAuth token-version validation in one current identity contract instead of duplicating security-sensitive regular expressions across state, deployment fingerprinting, health checks, and state inventory.
+- Retain temporary Worker-secret files when filename ownership PID/timestamp evidence exceeds safe-integer bounds instead of treating malformed process identity as reclaimable stale state; legacy secret cleanup remains only to remove credential residue safely.
+- Validate tool arguments after tool/role authority gating but before relay operation risk/path authorization, so malformed remote inputs cannot trigger local path classification or other operation-level inspection before schema rejection.
+- Require hardened-npm artifact descriptors and explicit proxy/NO_PROXY overrides to use native string/integer types, preventing coercible arrays or numeric strings from becoming supply-chain identity or network-routing configuration.
+- Extend managed-job resource-output defense-in-depth redaction to exact Base64URL encodings, while documenting that arbitrary transformed or application-specific representations still require `capture_output: "discard"` when credentials may be echoed.
+- Record a privacy-safe error class when a successfully delivered transient-process result cannot clear its stronger pending-recovery marker, preserving the user result while making temporary quota/retention over-protection diagnosable.
+- Keep runtime shutdown on the ownership-checked process-tree supervisor: forced drain now uses zero-additional-grace supervised escalation, preserves already-pending ownership checks, and waits for retained descendant-escalation settlement instead of replacing it with an unverified direct group `SIGKILL`.
 
 ## Historical releases
 
-Historical prerelease entries remain available from Git tags and repository release records. From a source checkout, inspect the changelog shipped by a prior release with `git show v<version>:CHANGELOG.md`. This current file intentionally describes only the active candidate and the history location.
+Historical prerelease entries remain available from Git tags and repository history. From a source checkout, inspect the changelog of a prior revision with `git show <revision>:CHANGELOG.md`. This current file intentionally describes only the active candidate and the history location.

package/README.md

@@ -25,7 +25,7 @@ Support boundaries are defined in [SUPPORT.md](SUPPORT.md). Contribution, conduc
 - bounded file, patch, Git, process, diagnostic, application, browser, and managed-job tools;
 - account roles whose authority is intersected with the connected daemon policy;
 - root-certified ephemeral daemon sessions, trusted OAuth client binding, refresh-family ownership, and non-escalatable account roles;
-- structured, privacy-conscious lifecycle events, a worker-thread-isolated tamper-evident audit chain, and stable error codes;
+- structured, privacy-conscious lifecycle events, a worker-thread-isolated self-verifying audit hash chain with documented same-user rewrite limits, and stable error codes;
 - control-plane resilience through end-to-end reserved diagnostic capacity, event-loop-aware relay liveness, and explicit draining-process accounting;
 - fail-closed state, lock, release, package, and supply-chain checks.
 
@@ -221,7 +221,7 @@ On macOS, authorized remote activity uses a bounded idle-sleep assertion so ordi
 
 When `run_process` or `exec_command` returns a child exit code and bounded stdout/stderr, the local process did run. For nested tools such as `ssh`, a remote forced-command usage message or command allowlist is therefore evidence from the target-side authorization layer, not evidence that Machine Bridge blocked process execution. Diagnose and change the narrowest failing layer instead of widening the `full` profile, which already removes Machine Bridge's own shell and path restrictions.
 
-Credentials and files can be registered by alias without returning their contents through MCP:
+Credentials and files can be registered by alias so the injection operation does not place their contents in MCP arguments or echo them in its result:
 
 ```sh
 machine-mcp resource add maintenance-key ~/.ssh/example_maintenance_ed25519
@@ -230,6 +230,7 @@ machine-mcp job submit plan.json
 ```
 
 See [docs/MANAGED_JOBS.md](docs/MANAGED_JOBS.md) for integrity checks, recovery, redaction, cleanup, and residual risks.
+For browser or application injection, the destination receives the content by design and can copy, render, or transmit it; later observations of that destination can therefore expose content it now holds.
 
 ## Operations
 
@@ -243,7 +244,7 @@ machine-mcp workspace show|set|reset
 machine-mcp idle-sleep show|set MODE
 machine-mcp service status|install|start|stop|uninstall
 machine-mcp account list|clients|revoke-client|add|role|enable|disable|rotate-password|remove
-machine-mcp browser status|setup|pair|path
+machine-mcp browser status|setup|pair|reset|path
 machine-mcp resource add|list|check|remove
 machine-mcp job submit|inspect|list|read|cancel
 machine-mcp rotate-secrets

package/SECURITY.md

@@ -71,7 +71,7 @@ The roles are:
 - `operator`: workspace-confined mutation and direct process execution;
 - `owner`: complete bridge authority within the daemon policy ceiling.
 
-No approval ID, refresh token, reconnect, client registration, or legacy lease can expand a role. Out-of-role operations fail with `authorization_denied`.
+No approval ID, refresh token, reconnect, or client registration can expand a role. Out-of-role operations fail with `authorization_denied`.
 
 The Worker filters the stable discovery catalog by account role. Discovery is not authorization: each call is separately intersected with the current end-to-end-ready daemon capability ceiling, and the local runtime independently recomputes the role and policy boundary before dispatch. Account disablement, role change, password rotation, account removal, client revocation, token-version rotation, and refresh-family replay invalidate the appropriate credentials.
 
@@ -189,7 +189,7 @@ After trusted input dispatch begins, an ambiguous failure is reported as unknown
 
 Computer Use screenshots share the ordinary MCP result-size boundary. When an image would make an observation result too large, the image is omitted before the snapshot ID is published and pixel-action authority is disabled. When a post-action image would overflow the same boundary, it is removed from the returned/stored post snapshot while the already-established mutation settlement and bounded continuation handle are preserved; the result never turns that dispatched action into a generic retryable size failure. Semantic state may still be returned. The experimental macOS background visual backend is disabled unless explicitly configured and successfully probed; Accessibility, Automation, Screen Recording, and the operating system remain independent enforcement boundaries.
 
-Local resources may be injected without returning their bytes through MCP, but the destination page or application still receives them. Screenshots and page source can themselves contain secrets. In particular, raw serialized HTML may contain hidden bootstrap/session/account/authentication values that are not visible in the rendered page; `browser_get_source` therefore should be used only when raw markup is required, with semantic inspection preferred for routine browser work.
+Local resources may be injected without placing their bytes in the mutating MCP arguments or echoing them in that mutation result, but the destination page or application still receives them. Once delivered, the destination can copy, render, or transmit the value; a later explicit value inspection, screenshot, page source read, or other observation may therefore expose content the destination now holds. In particular, raw serialized HTML may contain hidden bootstrap/session/account/authentication values that are not visible in the rendered page; `browser_get_source` therefore should be used only when raw markup is required, and `browser_inspect_page` should normally keep `include_values=false`.
 
 ## Network egress boundaries
 

package/SUPPORT.md

@@ -4,6 +4,8 @@
 
 The supported runtime is the pinned Node.js 26 and npm 12 baseline on current GitHub-hosted Linux, macOS, and Windows environments. Older Node/npm releases and obsolete MCP protocol versions are not compatibility targets.
 
+Source-release privacy tooling requires Git 2.50 or later. The reachable-history scanner intentionally relies on the machine-parsable NUL-delimited `git rev-list` object format introduced in Git 2.50 and does not carry an older-output compatibility parser.
+
 The project supports the current package version and a direct upgrade from the immediately preceding published version when both use the current local state and policy schemas. See [Upgrading](docs/UPGRADING.md).
 
 ## Where to ask

package/browser-extension/broker-auth.js

@@ -6,7 +6,7 @@
   const BROKER_AUTH_REQUEST_VALUE = "machine-bridge-browser-v2";
 
   async function extensionProtocol(endpoint, token) {
-    if (!TOKEN.test(String(token || ""))) throw new Error("browser pairing token is invalid");
+    if (typeof token !== "string" || !TOKEN.test(token)) throw new Error("browser pairing token is invalid");
     const parsed = parseEndpoint(endpoint);
     if (!parsed) throw new Error("browser broker endpoint is invalid");
     const clientChallenge = randomBase64Url(24);
@@ -27,8 +27,9 @@
   }
 
   function parseEndpoint(value) {
+    if (typeof value !== "string") return null;
     let parsed;
-    try { parsed = new URL(String(value || "")); } catch { return null; }
+    try { parsed = new URL(value); } catch { return null; }
     const port = Number(parsed.port);
     if (parsed.protocol !== "ws:" || parsed.hostname !== "127.0.0.1" || parsed.pathname !== "/extension"
         || parsed.username || parsed.password || parsed.search || parsed.hash
@@ -40,8 +41,9 @@
     return parsed ? `http://127.0.0.1:${parsed.port}/pair` : "";
   }
   function parsePairingPage(value) {
+    if (typeof value !== "string") return null;
     let parsed;
-    try { parsed = new URL(String(value || "")); } catch { return null; }
+    try { parsed = new URL(value); } catch { return null; }
     const port = Number(parsed.port);
     if (parsed.protocol !== "http:" || parsed.hostname !== "127.0.0.1" || parsed.pathname !== "/pair"
         || parsed.username || parsed.password || parsed.search || parsed.hash

package/browser-extension/browser-operation-contract.js

@@ -0,0 +1,92 @@
+(() => {
+  if (globalThis.__machineBridgeBrowserOperationContract) return;
+  const MUTATING_METHODS = new Set([
+    "manage_tabs", "point_action", "backend_node_action", "action", "fill_form", "upload_files", "screenshot",
+  ]);
+  const MUTATION_RESULT_SETTLEMENT_UNKNOWN = "browser mutation may have completed; the action outcome is unknown because its result could not be delivered. Inspect browser state before retrying.";
+  function exactFiniteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? (Object.is(value, -0) ? 0 : value) : null;
+  }
+  function exactPositiveFiniteNumber(value) {
+    const number = exactFiniteNumber(value);
+    return number !== null && number > 0 ? number : null;
+  }
+  function exactNormalizedCoordinate(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value < 1
+      ? (Object.is(value, -0) ? 0 : value) : null;
+  }
+  function exactPositiveInteger(value) { return Number.isSafeInteger(value) && value > 0 ? value : null; }
+  function exactNonNegativeInteger(value) { return Number.isSafeInteger(value) && value >= 0 ? value : null; }
+  function exactBoolean(value, label, fallback) {
+    if (value === undefined) return fallback;
+    if (typeof value !== "boolean") throw new Error(`${label} must be boolean before dispatch`);
+    return value;
+  }
+  function exactBoundedInteger(value, label, fallback, min, max) {
+    if (value === undefined) return fallback;
+    if (!Number.isSafeInteger(value) || value < min || value > max) throw new Error(`${label} is invalid before dispatch`);
+    return value;
+  }
+  function exactImageFormat(value, label, fallback = "png") {
+    if (value === undefined) return fallback;
+    if (typeof value !== "string" || !["png", "jpeg"].includes(value)) throw new Error(`${label} is invalid before dispatch`);
+    return value;
+  }
+  function exactOptionalSha256(value, label) {
+    if (value === undefined || value === "") return "";
+    if (typeof value !== "string" || !/^[A-Fa-f0-9]{64}$/.test(value)) throw new Error(`${label} is invalid before dispatch`);
+    return value.toLowerCase();
+  }
+  function exactOptionalText(value, label, maxLength) {
+    if (value === undefined || value === "") return "";
+    if (typeof value !== "string" || value.includes("\0") || value.length > maxLength) throw new Error(`${label} is invalid before dispatch`);
+    return value;
+  }
+  function exactOptionalAuthorityString(value, maxLength) {
+    if (value === undefined || value === "") return "";
+    if (typeof value !== "string" || value.length > maxLength || value.includes("\0")) {
+      throw new Error("snapshot authority string is invalid before dispatch");
+    }
+    return value;
+  }
+  function requiredSnapshotAuthorityString(value, label, maxLength) {
+    const text = exactOptionalAuthorityString(value, maxLength);
+    if (!text) throw new Error(`${label} is required before dispatch`);
+    return text;
+  }
+  function requiredSnapshotViewport(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("visual snapshot viewport is required before dispatch");
+    const output = {};
+    for (const key of ["width", "height", "scale"]) {
+      const number = exactPositiveFiniteNumber(value[key]);
+      if (number === null) throw new Error(`visual snapshot viewport ${key} is invalid before dispatch`);
+      output[key] = number;
+    }
+    return output;
+  }
+  function methodMayMutate(method) { return typeof method === "string" && MUTATING_METHODS.has(method); }
+  function responsePayload({ id, ok, result, error = "", method = "", maxBytes }) {
+    const mutatingSuccess = ok === true && methodMayMutate(method);
+    let payload;
+    try { payload = JSON.stringify({ type: "response", id, ok, ...(ok ? { result } : { error }) }); }
+    catch {
+      payload = JSON.stringify({ type: "response", id, ok: false,
+        error: mutatingSuccess ? MUTATION_RESULT_SETTLEMENT_UNKNOWN : "browser result could not be serialized" });
+    }
+    const resultLimit = Number.isSafeInteger(maxBytes) && maxBytes > 0 ? maxBytes : 0;
+    if (resultLimit === 0 || new TextEncoder().encode(payload).byteLength > resultLimit) {
+      payload = JSON.stringify({ type: "response", id, ok: false,
+        error: mutatingSuccess ? MUTATION_RESULT_SETTLEMENT_UNKNOWN : "browser result exceeds maximum size" });
+    }
+    return payload;
+  }
+  Object.defineProperty(globalThis, "__machineBridgeBrowserOperationContract", {
+    value: Object.freeze({
+      exactFiniteNumber, exactPositiveFiniteNumber, exactNormalizedCoordinate, exactPositiveInteger,
+      exactNonNegativeInteger, exactBoolean, exactBoundedInteger, exactImageFormat, exactOptionalSha256,
+      exactOptionalText, requiredSnapshotAuthorityString, requiredSnapshotViewport,
+      exactOptionalAuthorityString, methodMayMutate, responsePayload,
+    }),
+    configurable: false,
+  });
+})();

package/browser-extension/browser-operations.js

@@ -2,111 +2,16 @@
   if (globalThis.__machineBridgeBrowserOperations) return;
 
   const MAX_ACCESSIBLE_FRAMES = 64;
-  const PAGE_AUTOMATION_VERSION = 5;
+  const PAGE_AUTOMATION_VERSION = 6;
   const rendererRequests = new Map();
   const MAX_RENDERER_REQUESTS = 64;
-  const MUTATING_METHODS = new Set([
-    "manage_tabs", "point_action", "backend_node_action", "action", "fill_form", "upload_files", "screenshot",
-  ]);
-  const MUTATION_RESULT_SETTLEMENT_UNKNOWN = "browser mutation may have completed; the action outcome is unknown because its result could not be delivered. Inspect browser state before retrying.";
-
-  function exactFiniteNumber(value) {
-    return typeof value === "number" && Number.isFinite(value) ? (Object.is(value, -0) ? 0 : value) : null;
-  }
-
-  function exactPositiveFiniteNumber(value) {
-    const number = exactFiniteNumber(value);
-    return number !== null && number > 0 ? number : null;
-  }
-
-  function exactNormalizedCoordinate(value) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 0 && value < 1
-      ? (Object.is(value, -0) ? 0 : value)
-      : null;
-  }
-
-  function exactPositiveInteger(value) {
-    return Number.isSafeInteger(value) && value > 0 ? value : null;
-  }
-
-  function exactNonNegativeInteger(value) {
-    return Number.isSafeInteger(value) && value >= 0 ? value : null;
-  }
-
-  function exactBoolean(value, label, fallback) {
-    if (value === undefined) return fallback;
-    if (typeof value !== "boolean") throw new Error(`${label} must be boolean before dispatch`);
-    return value;
-  }
-
-  function exactBoundedInteger(value, label, fallback, min, max) {
-    if (value === undefined) return fallback;
-    if (!Number.isSafeInteger(value) || value < min || value > max) throw new Error(`${label} is invalid before dispatch`);
-    return value;
-  }
-
-  function exactImageFormat(value, label, fallback = "png") {
-    if (value === undefined) return fallback;
-    if (typeof value !== "string" || !["png", "jpeg"].includes(value)) throw new Error(`${label} is invalid before dispatch`);
-    return value;
-  }
-
-  function exactOptionalSha256(value, label) {
-    if (value === undefined || value === "") return "";
-    if (typeof value !== "string" || !/^[A-Fa-f0-9]{64}$/.test(value)) throw new Error(`${label} is invalid before dispatch`);
-    return value.toLowerCase();
-  }
-
-  function exactOptionalText(value, label, maxLength) {
-    if (value === undefined || value === "") return "";
-    if (typeof value !== "string" || value.includes("\0") || value.length > maxLength) throw new Error(`${label} is invalid before dispatch`);
-    return value;
-  }
-
-  function requiredSnapshotAuthorityString(value, label, maxLength) {
-    const text = exactOptionalAuthorityString(value, maxLength);
-    if (!text) throw new Error(`${label} is required before dispatch`);
-    return text;
-  }
-
-  function requiredSnapshotViewport(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("visual snapshot viewport is required before dispatch");
-    const output = {};
-    for (const key of ["width", "height", "scale"]) {
-      const number = exactPositiveFiniteNumber(value[key]);
-      if (number === null) throw new Error(`visual snapshot viewport ${key} is invalid before dispatch`);
-      output[key] = number;
-    }
-    return output;
-  }
-
-  function exactOptionalAuthorityString(value, maxLength) {
-    if (value === undefined || value === "") return "";
-    if (typeof value !== "string" || value.length > maxLength || value.includes("\0")) {
-      throw new Error("snapshot authority string is invalid before dispatch");
-    }
-    return value;
-  }
-
-  function methodMayMutate(method) {
-    return typeof method === "string" && MUTATING_METHODS.has(method);
-  }
-
-  function responsePayload({ id, ok, result, error = "", method = "", maxBytes }) {
-    const mutatingSuccess = ok === true && methodMayMutate(method);
-    let payload;
-    try { payload = JSON.stringify({ type: "response", id, ok, ...(ok ? { result } : { error }) }); }
-    catch {
-      payload = JSON.stringify({ type: "response", id, ok: false,
-        error: mutatingSuccess ? MUTATION_RESULT_SETTLEMENT_UNKNOWN : "browser result could not be serialized" });
-    }
-    const resultLimit = Number.isSafeInteger(maxBytes) && maxBytes > 0 ? maxBytes : 0;
-    if (resultLimit === 0 || new TextEncoder().encode(payload).byteLength > resultLimit) {
-      payload = JSON.stringify({ type: "response", id, ok: false,
-        error: mutatingSuccess ? MUTATION_RESULT_SETTLEMENT_UNKNOWN : "browser result exceeds maximum size" });
-    }
-    return payload;
-  }
+  const {
+    exactFiniteNumber, exactPositiveFiniteNumber, exactNormalizedCoordinate, exactPositiveInteger,
+    exactNonNegativeInteger, exactBoolean, exactBoundedInteger, exactImageFormat, exactOptionalSha256,
+    exactOptionalText, requiredSnapshotAuthorityString, requiredSnapshotViewport,
+    exactOptionalAuthorityString, methodMayMutate, responsePayload,
+  } = globalThis.__machineBridgeBrowserOperationContract || {};
+  if (typeof responsePayload !== "function") throw new Error("browser operation contract is unavailable");
 
   async function dispatch(method, params, state) {
     if (method === "list_tabs") return listTabs(params);

package/browser-extension/manifest.json

@@ -4,7 +4,6 @@
   "version": "3.0.0",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
-    "tabs",
     "debugger",
     "scripting",
     "storage",
@@ -30,6 +29,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.198",
+  "version_name": "3.0.0-beta.199",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/browser-extension/page-automation.js

@@ -1,5 +1,5 @@
 (() => {
-  const PAGE_AUTOMATION_VERSION = 5;
+  const PAGE_AUTOMATION_VERSION = 6;
   if (globalThis.__machineBridgePageAutomation?.version === PAGE_AUTOMATION_VERSION) return;
 
   const INTERACTIVE_SELECTOR = "a,button,input,select,textarea,[role],[contenteditable]:not([contenteditable='false']),summary";
@@ -19,7 +19,7 @@
   const SNAPSHOT_IDENTITY_FIELDS = new Set([
     "tag", "type", "role", "name", "id", "field_name", "label", "placeholder", "href", "sensitive", "in_shadow_dom",
   ]);
-  const DOCUMENT_EPOCH = `doc_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 14)}`;
+  const DOCUMENT_EPOCH = `doc_${Date.now().toString(36)}_${crypto.randomUUID()}`;
   const elementRefs = new WeakMap();
   const refElements = new Map();
   let nextRef = 1;

package/browser-extension/pairing-bootstrap.js

@@ -5,18 +5,17 @@
   async function bootstrapPairing(port, grant, now = Date.now()) {
     const auth = globalThis.__machineBridgeBrokerAuth?.internal;
     if (!auth) throw new Error("browser broker authentication module is unavailable");
-    const normalizedPort = Number(port);
-    const match = GRANT.exec(String(grant || ""));
-    const current = Number(now);
-    if (!Number.isInteger(normalizedPort) || normalizedPort < 1024 || normalizedPort > 65535 || !match || !Number.isFinite(current)) {
+    const match = typeof grant === "string" ? GRANT.exec(grant) : null;
+    if (!Number.isSafeInteger(port) || port < 1024 || port > 65535 || !match
+        || typeof now !== "number" || !Number.isFinite(now)) {
       throw new Error("browser pairing bootstrap is invalid");
     }
     const expiresAt = Number(match[1]);
-    if (expiresAt < current || expiresAt - current > PAIRING_GRANT_TTL_MS) throw new Error("browser pairing bootstrap expired");
+    if (expiresAt < now || expiresAt - now > PAIRING_GRANT_TTL_MS) throw new Error("browser pairing bootstrap expired");
     const grantId = `${match[1]}.${match[2]}`;
     const secret = match[3];
     const clientChallenge = auth.randomBase64Url(24);
-    const authUrl = new URL(`http://127.0.0.1:${normalizedPort}/pair-auth`);
+    const authUrl = new URL(`http://127.0.0.1:${port}/pair-auth`);
     authUrl.searchParams.set("grant", grantId);
     authUrl.searchParams.set("challenge", clientChallenge);
     const initProof = await auth.hmac(secret, `machine-bridge-browser-pair-init-v2\0${grantId}\0${clientChallenge}`);
@@ -35,7 +34,7 @@
     if (second.status !== 204) throw new Error("browser pairing broker authentication failed");
     const token = String(second.headers.get("x-machine-bridge-extension-token") || "");
     if (!auth.tokenPattern.test(token)) throw new Error("browser pairing broker returned an invalid extension credential");
-    return { endpoint: `ws://127.0.0.1:${normalizedPort}/extension`, token };
+    return { endpoint: `ws://127.0.0.1:${port}/extension`, token };
   }
 
   globalThis.__machineBridgePairingBootstrap = Object.freeze({ bootstrapPairing });