machine-bridge-mcp 3.0.0-beta.28 → 3.0.0-beta.29

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 3.0.0-beta.29 - 2026-08-01
+
+### Bounded security-audit throughput and retention
+
+- Reuse one verified security-audit state inside the dedicated audit worker instead of rereading, reparsing, and rehashing the complete retained chain for every batch. The cache is invalidated by file identity, size, modification time, or metadata-change time, so another process or external alteration still forces full verification before a write.
+- Bound retention by both 4,096 events and 4 MiB. Oversized-but-valid event histories now evict the oldest events, advance the chain anchor, and remain verifiable instead of permanently failing before the advertised event limit. Runtime diagnostics expose the byte ceiling explicitly.
+- Fix an owner-state-lock race where a contender observed `EEXIST` just before the holder released the lock and then misclassified the now-missing file as malformed. Missing, invalid, and valid-owner states are now distinct, preserving fail-closed handling for actual corruption while allowing normal retry.
+- Add regressions for cached-state tamper invalidation, byte-driven retention, cross-worker sequence preservation, and the lock release/acquire window. Keep audit state construction in a focused module rather than raising the existing architecture budget.
+- Mark Worker observability counters as current-isolate metrics and state explicitly that durable calls can cross isolate lifetimes, so completed/failed counts are not misread as algebraically closed process-lifetime totals.
+
 ## 3.0.0-beta.28 - 2026-07-31
 
 ### Verified service restart semantics

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.28",
+  "version_name": "3.0.0-beta.29",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AUDIT.md

@@ -1,5 +1,19 @@
 # Security and privacy audit notes
 
+## 2026-08-01 version 3.0.0-beta.29 security-audit storage review
+
+Review of the live 4,096-event audit chain found that moving persistence to a worker thread removed daemon event-loop blocking but did not remove storage amplification. Each sparse batch still read roughly 3 MiB, parsed the complete document, recalculated every SHA-256 link, serialized the complete state, atomically replaced it, and called `fsync`. On the inspected machine, a cold full-chain verification took approximately 1.3 seconds. The previous implementation therefore could accumulate audit work at ordinary interactive call rates even though tool-result delivery itself remained asynchronous.
+
+Beta.29 gives each audit worker a verified storage session. The first access performs the complete bounded read and chain verification. Subsequent writes reuse that state only while the on-disk regular-file identity, size, modification time, and metadata-change time remain unchanged. A cross-process writer or external alteration changes that identity and forces a fresh secure read and full hash-chain verification under the owner-state lock. The cache never turns an unverifiable file into an accepted state, and a failed write does not advance the cached state. In the same environment, cached single-record writes fell to roughly 39–264 milliseconds; the remaining cost is full-file serialization, atomic replacement, and `fsync`, not repeated chain verification. A segmented append/checkpoint format remains a possible future optimization if sustained high-rate audit throughput becomes a product requirement.
+
+The review also proved that the former retention contract was internally inconsistent. Every event field could be within its legal bound while 4,096 events exceeded the separate 4 MiB file ceiling. The storage layer then rejected the write and left the audit backend unhealthy before reaching its advertised count limit. Retention is now the intersection of the event and byte limits: event encodings are measured exactly, the oldest prefix is removed until both bounds hold, and the anchor advances to the last removed hash so the retained suffix verifies independently. Diagnostics expose `maximum_bytes` alongside the event maximum.
+
+Faster writes exposed a pre-existing lock race. After exclusive creation failed with `EEXIST`, a holder could release the lock before the contender read it. The contender treated both `ENOENT` and malformed content as corruption. The lock reader now returns distinct missing, invalid, and valid-owner states; only missing retries, while malformed state continues to fail closed. Cross-worker audit tests exercise this release/acquire window and verify continuous sequence numbers with no lost events.
+
+The live review also showed isolate-local event counters that could appear inconsistent with the persistent pending-call snapshot after an isolate restart. That is not durable-call loss: a persisted call may start in one isolate and complete in a later isolate. Beta.29 adds an explicit machine-readable `metric_scope` declaring the current-isolate lifetime and non-closed counter algebra; the persistent pending-call snapshot remains authoritative for active ownership.
+
+This source review does not activate beta.29, replace the running beta.28 daemon, deploy the Worker, modify live audit or legacy authorization files, publish npm, create a tag, or record acceptance.
+
 ## 2026-07-31 version 3.0.0-beta.27 control-plane resilience audit
 
 A host-pressure incident exposed a causal chain that ordinary timeout tests had not covered: a metadata-heavy directory deletion exceeded its foreground deadline; subsequent minimal calls were delayed; and the daemon later classified the relay as unresponsive. Review of production diagnostics and the exact installed source showed that host filesystem/endpoint-security load was the trigger, but Machine Bridge amplified it. Timeout/cancellation performed synchronous process-table snapshots on the daemon thread, every remote call synchronously reread, rehashed, rewrote, and `fsync`ed the complete bounded audit file before returning a result, the process could remain alive after the timeout response, and heartbeat policy could not distinguish remote silence from a locally stalled event loop. Existing tests proved that `cancel_call` was sent and the Promise rejected; they did not prove post-timeout control-plane availability or completed process drain.

package/docs/LOGGING.md

@@ -12,7 +12,7 @@ Logs should answer:
 4. Is an infrastructure, protocol, deployment, or local service problem requiring action?
 5. When debug logging is explicitly enabled, which bounded implementation event should be correlated?
 
-Logs are not a command history or content transcript. The local security audit provides a bounded SHA-256 hash chain over coarse operation metadata without recording command text, paths, contents, form values, or output. Audit inputs are projected to an allowlist before crossing to a dedicated Worker thread; chain verification, batching, atomic replacement, and `fsync` never delay tool-result delivery on the daemon event loop. Remote `diagnose_runtime.runtime.security_audit` reports worker readiness, queue depth/capacity, dropped records, retained entries, and chain health; local stdio exposes the same snapshot as `server_info.security_audit`. Before the Worker reports readiness, health is explicitly `audit_initializing`; the daemon thread does not synchronously read the chain. The queue is not a write-ahead log: a process or operating-system crash before persistence can lose queued events, and `dropped_records` counts only failures observed during the current process lifetime. The chain detects local alteration but is not a remote immutable ledger and is not a substitute for OS isolation.
+Logs are not a command history or content transcript. The local security audit provides a SHA-256 hash chain over coarse operation metadata without recording command text, paths, contents, form values, or output. Retention is bounded by both 4,096 events and 4 MiB; byte-driven eviction advances the chain anchor so the retained suffix remains verifiable, and diagnostics expose both ceilings. Audit inputs are projected to an allowlist before crossing to a dedicated Worker thread; batching, atomic replacement, and `fsync` never delay tool-result delivery on the daemon event loop. The audit worker verifies the complete chain on first access and reuses that state only while the regular-file identity and timestamps remain unchanged. Cross-process writes or external alteration force a secure reread and complete verification before another write. Remote `diagnose_runtime.runtime.security_audit` reports worker readiness, queue depth/capacity, dropped records, retained entries, event/byte limits, and chain health; local stdio exposes the same snapshot as `server_info.security_audit`. Before the Worker reports readiness, health is explicitly `audit_initializing`; the daemon thread does not synchronously read the chain. The queue is not a write-ahead log: a process or operating-system crash before persistence can lose queued events, and `dropped_records` counts only failures observed during the current process lifetime. The chain detects local alteration but is not a remote immutable ledger and is not a substitute for OS isolation.
 
 ## Levels
 
@@ -67,7 +67,7 @@ Brief network interruptions are expected on laptop network changes, Worker deplo
 
 A WebSocket close code such as `1006` means the transport ended without a normal close handshake. It is useful for debug diagnosis but not useful as the default user message. It is not evidence that the daemon process restarted. Worker `daemon_transport_error` / `daemon_liveness_timeout` messages and their 1012 close frames are likewise retryable connection conditions, not upgrade instructions. Only an unknown/incompatible Worker error, authentication failure, or identity/version mismatch may produce the fatal protocol/configuration log and daemon exit. Default logs therefore describe the affected layer, duration, classification, and recovery behavior rather than printing raw close envelopes.
 
-Streamed-call diagnostics are deliberately coarse. Modern request-scoped stream ownership is memory-only; legacy MCP `2025-11-25` may additionally report aggregate persistent active/detached counts, oldest age, tool-name counts, alarm mutations, unmatched-result counts, and whether a legacy call is transient or durable. Logs and `server_info` must not include tool arguments, terminal results, command text, request keys, account identifiers, raw call IDs, raw connection generations, mirrored parameter values, private paths, or subscriber payloads. A stale-generation result is counted as unmatched rather than logged with its envelope.
+Streamed-call diagnostics are deliberately coarse. Modern request-scoped stream ownership is memory-only; legacy MCP `2025-11-25` may additionally report aggregate persistent active/detached counts, oldest age, tool-name counts, alarm mutations, unmatched-result counts, and whether a legacy call is transient or durable. Worker event counters are scoped to the current isolate and say so in `metric_scope`; persisted durable calls can begin in one isolate and complete in another, so `started`, `completed`, and `failed` are not algebraically closed process-lifetime totals. The persistent pending-call snapshot is authoritative for current ownership. Logs and `server_info` must not include tool arguments, terminal results, command text, request keys, account identifiers, raw call IDs, raw connection generations, mirrored parameter values, private paths, or subscriber payloads. A stale-generation result is counted as unmatched rather than logged with its envelope.
 
 Examples:
 

package/docs/TESTING.md

@@ -112,7 +112,7 @@ It opens Calculator, activates it through the fixed JXA helper, verifies structu
 For deterministic release validation, perform an isolated-profile smoke test with the packaged unpacked extension; a Playwright persistent Chromium context is acceptable only as that isolated harness. When the requirement is specifically to prove control of the user's ordinary browser, the user must load the same unpacked directory into that known daily Chromium profile; status can verify the extension version/protocol and that Machine Bridge did not launch a browser, but cannot infer profile identity. Then use a localhost no-store fixture in a newly created tab. Do not enumerate, read, or mutate unrelated existing tabs. In both modes, inspect and reuse refs, exercise waits/forms/trusted input/open Shadow DOM/screenshots, verify final live DOM, and close the fixture tab.
 
 
-`npm run control-plane-resilience:test` is the focused accident-regression gate. It exercises synchronous/asynchronous audit failures, persistent-state corruption and retention anchoring, POSIX/Windows process-tree fallbacks, escalation-supervisor exception isolation, mixed transient/durable Worker capacity, and the shared 30+2 / 14+2 control-plane admission contract. It is part of the fast plan rather than coverage-only evidence.
+`npm run control-plane-resilience:test` is the focused accident-regression gate. It exercises synchronous/asynchronous audit failures, cached-state invalidation after external alteration, count- and byte-bounded retention anchoring, POSIX/Windows process-tree fallbacks, escalation-supervisor exception isolation, mixed transient/durable Worker capacity, and the shared 30+2 / 14+2 control-plane admission contract. `npm run security-audit:test` additionally runs two independent audit workers against one owner-only state file and requires continuous sequence numbers with no lost events, covering the lock release/acquire race. Both are part of the fast plan rather than coverage-only evidence.
 
 - control-plane resilience under host pressure: local event-loop stalls versus genuine relay silence, fresh-heartbeat recovery grace, asynchronous process-group identity capture before `SIGTERM`, bounded post-signal revalidation, draining-process visibility after result settlement, two reserved diagnostic slots at both Worker and local layers under mixed transient/durable ordinary-call saturation, non-blocking audit dispatch, batched Worker persistence, queue/drop health, warning suppression, and privacy-safe audit projection;
 - relay outage diagnostics and recovery: application-proxy versus OS-network scope, timestamped close/outage/recovery fields, fifteen-second maximum reconnect delay, heartbeat timeout, same-instance call continuation, Worker pong/welcome send failure, and `diagnose_runtime` relay history;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.28",
+  "version": "3.0.0-beta.29",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/scripts/coverage-check.mjs

@@ -78,6 +78,7 @@ try {
     "src/local/security-audit-dispatch.mjs": [100, 70],
     "src/local/security-audit-warning.mjs": [100, 75],
     "src/local/security-audit-storage.mjs": [85, 60],
+    "src/local/security-audit-state.mjs": [90, 65],
     "src/local/delegated-process-sandbox.mjs": [80, 45],
     "src/shared/device-session-auth.mjs": [100, null],
     "src/shared/mcp-protocol.mjs": [90, 70],

package/src/local/owner-state-lock.mjs

@@ -1,5 +1,4 @@
 import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
 import path from "node:path";
 import { createExclusiveFileSync, removeOwnedJsonFileSync } from "./exclusive-file.mjs";
 import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
@@ -32,8 +31,12 @@ export async function withOwnerStateLock(root, callback, options = {}) {
       break;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
-      const existing = readLockOwner(lockPath, purpose);
-      if (!existing) throw new Error(`${label} lock is malformed; inspect the owner-only state directory`);
+      const inspected = readLockOwner(lockPath, purpose);
+      if (inspected.kind === "missing") continue;
+      if (inspected.kind === "invalid") {
+        throw new Error(`${label} lock is malformed; inspect the owner-only state directory`);
+      }
+      const existing = inspected.owner;
       const identity = inspectProcessInstance(existing, { maxAgeMs });
       if (identity.reclaimable) {
         if (removeOwnedJsonFileSync(lockPath, { token: existing.token, purpose }, { maxBytes: MAX_LOCK_BYTES })) continue;
@@ -71,16 +74,19 @@ function lockOwner(purpose) {
 }
 
 function readLockOwner(file, purpose) {
-  if (!existsSync(file)) return null;
   let parsed;
-  try { parsed = JSON.parse(readBoundedRegularFileSync(file, MAX_LOCK_BYTES, "owner-state lock").toString("utf8")); } catch { return null; }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-  if (!Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
-  if (!/^[a-f0-9]{32}$/.test(String(parsed.token || ""))) return null;
-  if (parsed.purpose !== purpose) return null;
-  if (!Number.isFinite(Date.parse(String(parsed.startedAt || "")))) return null;
-  if (!Number.isFinite(Date.parse(String(parsed.processStartedAt || "")))) return null;
-  return parsed;
+  try {
+    parsed = JSON.parse(readBoundedRegularFileSync(file, MAX_LOCK_BYTES, "owner-state lock").toString("utf8"));
+  } catch (error) {
+    return error?.code === "ENOENT" ? { kind: "missing" } : { kind: "invalid" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return { kind: "invalid" };
+  if (!Number.isInteger(parsed.pid) || parsed.pid <= 0) return { kind: "invalid" };
+  if (!/^[a-f0-9]{32}$/.test(String(parsed.token || ""))) return { kind: "invalid" };
+  if (parsed.purpose !== purpose) return { kind: "invalid" };
+  if (!Number.isFinite(Date.parse(String(parsed.startedAt || "")))) return { kind: "invalid" };
+  if (!Number.isFinite(Date.parse(String(parsed.processStartedAt || "")))) return { kind: "invalid" };
+  return { kind: "owner", owner: parsed };
 }
 
 function boundedIdentifier(value, fallback) {

package/src/local/security-audit-log.mjs

@@ -1,5 +1,7 @@
 import { Worker } from "node:worker_threads";
 import {
+  SECURITY_AUDIT_MAX_BYTES,
+  SECURITY_AUDIT_MAX_EVENTS,
   auditFilePath,
   unhealthyAuditSnapshot,
 } from "./security-audit-storage.mjs";
@@ -153,7 +155,7 @@ export class SecurityAuditLog {
 
 function initializingSnapshot() {
   return {
-    enabled: true, healthy: false, retained: 0, maximum: 4096,
+    enabled: true, healthy: false, retained: 0, maximum: SECURITY_AUDIT_MAX_EVENTS, maximum_bytes: SECURITY_AUDIT_MAX_BYTES,
     last_event_at: null, last_error_class: "audit_initializing",
     content_logged: false, chain_verified: false,
   };
@@ -164,7 +166,8 @@ function disabledSnapshot() {
     enabled: false,
     healthy: true,
     retained: 0,
-    maximum: 4096,
+    maximum: SECURITY_AUDIT_MAX_EVENTS,
+    maximum_bytes: SECURITY_AUDIT_MAX_BYTES,
     last_event_at: null,
     last_error_class: null,
     content_logged: false,

package/src/local/security-audit-state.mjs

@@ -0,0 +1,139 @@
+import { createHash, randomBytes } from "node:crypto";
+
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+
+export function decodeAndVerifyAuditState(buffer, schemaVersion, maximumEvents) {
+  let state;
+  try { state = JSON.parse(buffer.toString("utf8")); } catch (error) {
+    throw new Error("security audit state is not valid JSON", { cause: error });
+  }
+  validateState(state, schemaVersion, maximumEvents);
+  let previous = state.anchor;
+  for (const event of state.events) {
+    if (event.previous_hash !== previous || event.hash !== eventHash(event)) {
+      throw new Error("security audit hash chain verification failed");
+    }
+    previous = event.hash;
+  }
+  return state;
+}
+
+export function emptyAuditState(schemaVersion) {
+  return {
+    schemaVersion,
+    identity_salt: randomBytes(32).toString("hex"),
+    anchor: randomBytes(32).toString("hex"),
+    next_sequence: 1,
+    events: [],
+  };
+}
+
+export function copyAuditState(state) {
+  return { ...state, events: [...state.events] };
+}
+
+export function appendAuditRecords(state, records) {
+  for (const record of records) state.events.push(buildEvent(record?.input || {}, state, record?.nowMs));
+}
+
+export function boundedAuditStateContent(state, maximumEvents, maximumBytes) {
+  const events = state.events;
+  const eventBytes = events.map((event) => Buffer.byteLength(JSON.stringify(event)));
+  let start = Math.max(0, events.length - maximumEvents);
+  let retained = events.length - start;
+  let bytes = Buffer.byteLength(`${JSON.stringify({ ...state, events: [] })}\n`);
+  for (let index = start; index < events.length; index += 1) bytes += eventBytes[index];
+  if (retained > 1) bytes += retained - 1;
+
+  while (bytes > maximumBytes && start < events.length) {
+    bytes -= eventBytes[start];
+    if (retained > 1) bytes -= 1;
+    start += 1;
+    retained -= 1;
+  }
+  if (start > 0) state.anchor = events[start - 1].hash;
+  state.events = events.slice(start);
+
+  const content = `${JSON.stringify(state)}\n`;
+  if (Buffer.byteLength(content) > maximumBytes) throw new Error("security audit state exceeds its size limit");
+  return content;
+}
+
+function buildEvent(input, state, nowMs) {
+  const timestamp = new Date(Number(nowMs)).toISOString();
+  if (!Number.isFinite(Date.parse(timestamp))) throw new Error("security audit timestamp is invalid");
+  const principal = input.principal && typeof input.principal === "object" ? input.principal : {};
+  const event = {
+    sequence: state.next_sequence,
+    timestamp,
+    outcome: boundedToken(input.outcome, "unknown"),
+    tool: boundedToken(input.tool, "unknown"),
+    risk_category: boundedText(input.riskCategory, "ordinary operation", 160),
+    target_hash: HASH_PATTERN.test(String(input.targetHash || "")) ? String(input.targetHash) : null,
+    account_ref: principal.accountId ? privateReference(state.identity_salt, principal.accountId) : null,
+    client_ref: principal.clientId ? privateReference(state.identity_salt, principal.clientId) : null,
+    family_ref: principal.familyId ? privateReference(state.identity_salt, principal.familyId) : null,
+    account_version: Number.isSafeInteger(principal.accountVersion) ? principal.accountVersion : null,
+    role: boundedToken(principal.role, principal.kind === "local" ? "local" : "unknown"),
+    duration_ms: boundedNumber(input.durationMs),
+    input_bytes: boundedNumber(input.inputBytes),
+    output_bytes: boundedNumber(input.outputBytes),
+    error_code: input.errorCode ? boundedToken(input.errorCode, "unknown") : null,
+    previous_hash: state.events.at(-1)?.hash || state.anchor,
+  };
+  const completed = { ...event, hash: eventHash(event) };
+  state.next_sequence += 1;
+  return completed;
+}
+
+function validateState(state, schemaVersion, maximumEvents) {
+  if (!plainRecord(state) || state.schemaVersion !== schemaVersion) throw new Error("security audit state schema is invalid");
+  if (!HASH_PATTERN.test(state.identity_salt) || !HASH_PATTERN.test(state.anchor)) {
+    throw new Error("security audit state identity is invalid");
+  }
+  if (!Number.isSafeInteger(state.next_sequence) || state.next_sequence < 1) {
+    throw new Error("security audit sequence is invalid");
+  }
+  if (!Array.isArray(state.events) || state.events.length > maximumEvents || !state.events.every(validEvent)) {
+    throw new Error("security audit events are invalid");
+  }
+  if (state.events.length && state.next_sequence <= state.events.at(-1).sequence) {
+    throw new Error("security audit sequence did not advance");
+  }
+}
+
+function validEvent(event) {
+  return plainRecord(event)
+    && Number.isSafeInteger(event.sequence) && event.sequence > 0
+    && Number.isFinite(Date.parse(String(event.timestamp || "")))
+    && typeof event.outcome === "string" && typeof event.tool === "string" && typeof event.risk_category === "string"
+    && (event.target_hash === null || HASH_PATTERN.test(event.target_hash))
+    && ["account_ref", "client_ref", "family_ref"].every((key) => event[key] === null || HASH_PATTERN.test(event[key]))
+    && (event.account_version === null || Number.isSafeInteger(event.account_version))
+    && typeof event.role === "string"
+    && Number.isFinite(event.duration_ms) && Number.isFinite(event.input_bytes) && Number.isFinite(event.output_bytes)
+    && (event.error_code === null || typeof event.error_code === "string")
+    && HASH_PATTERN.test(event.previous_hash) && HASH_PATTERN.test(event.hash);
+}
+
+function eventHash(event) {
+  const value = { ...event };
+  delete value.hash;
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
+function privateReference(salt, value) {
+  return createHash("sha256").update(salt).update("\0").update(String(value)).digest("hex");
+}
+
+function boundedToken(value, fallback) {
+  return String(value || fallback).replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 128) || fallback;
+}
+function boundedText(value, fallback, maximum) {
+  return String(value || fallback).replace(/[\r\n\t\u0000-\u001f\u007f]/g, " ").trim().slice(0, maximum) || fallback;
+}
+function boundedNumber(value) {
+  const number = Number(value);
+  return Number.isFinite(number) && number >= 0 ? Math.min(Math.floor(number), Number.MAX_SAFE_INTEGER) : 0;
+}
+function plainRecord(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value); }

package/src/local/security-audit-storage.mjs

@@ -1,83 +1,80 @@
-import { createHash, randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
+import { lstatSync } from "node:fs";
 import path from "node:path";
 import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
-import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
 import { withOwnerStateLock } from "./owner-state-lock.mjs";
+import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileWithInfoSync } from "./secure-file.mjs";
+import {
+  appendAuditRecords,
+  boundedAuditStateContent,
+  copyAuditState,
+  decodeAndVerifyAuditState,
+  emptyAuditState,
+} from "./security-audit-state.mjs";
 
 export const SECURITY_AUDIT_SCHEMA_VERSION = 1;
 export const SECURITY_AUDIT_MAX_EVENTS = 4096;
 export const SECURITY_AUDIT_MAX_BYTES = 4 * 1024 * 1024;
-const HASH_PATTERN = /^[a-f0-9]{64}$/;
 
 export function auditFilePath(root) {
   return path.join(path.resolve(root), "security-audit.json");
 }
 
 export function readVerifiedAuditState(root) {
-  const file = auditFilePath(root);
-  if (!existsSync(file)) return emptyState();
-  const raw = readBoundedRegularFileSync(file, SECURITY_AUDIT_MAX_BYTES, "security audit state");
-  let state;
-  try { state = JSON.parse(raw.toString("utf8")); } catch (error) {
-    throw new Error("security audit state is not valid JSON", { cause: error });
-  }
-  validateState(state);
-  let previous = state.anchor;
-  for (const event of state.events) {
-    if (event.previous_hash !== previous || event.hash !== eventHash(event)) {
-      throw new Error("security audit hash chain verification failed");
-    }
-    previous = event.hash;
-  }
-  return state;
+  return readVerifiedAuditStateWithIdentity(root).state;
 }
 
-export async function recordAuditBatch(root, records) {
-  if (!Array.isArray(records) || records.length === 0) {
-    const state = readVerifiedAuditState(root);
-    return auditSnapshotFromState(state);
-  }
-  return withOwnerStateLock(root, async () => {
-    const state = readVerifiedAuditState(root);
-    for (const record of records) {
-      const event = buildEvent(record?.input || {}, state, record?.nowMs);
-      state.events.push(event);
-      while (state.events.length > SECURITY_AUDIT_MAX_EVENTS) {
-        const removed = state.events.shift();
-        state.anchor = removed.hash;
-      }
-    }
-    writeState(auditFilePath(root), state);
-    return auditSnapshotFromState(state);
-  }, {
-    purpose: "security-audit", fileName: "security-audit.lock", label: "security audit",
+export function createAuditStorageSession(root) {
+  const directory = path.resolve(root);
+  const file = auditFilePath(directory);
+  let cachedState = null;
+  let cachedIdentity;
+
+  const loadVerifiedState = () => {
+    const observedIdentity = inspectAuditFile(file);
+    if (cachedState && sameFileIdentity(cachedIdentity, observedIdentity)) return cachedState;
+    const loaded = readVerifiedAuditStateWithIdentity(directory);
+    cachedState = loaded.state;
+    cachedIdentity = loaded.identity;
+    return cachedState;
+  };
+
+  return Object.freeze({
+    snapshot: () => auditSnapshotFromState(loadVerifiedState()),
+    async recordBatch(records) {
+      if (!Array.isArray(records) || records.length === 0) return auditSnapshotFromState(loadVerifiedState());
+      return withOwnerStateLock(directory, async () => {
+        const state = copyAuditState(loadVerifiedState());
+        appendAuditRecords(state, records);
+        const content = boundedAuditStateContent(state, SECURITY_AUDIT_MAX_EVENTS, SECURITY_AUDIT_MAX_BYTES);
+        cachedIdentity = writeState(file, content);
+        cachedState = state;
+        return auditSnapshotFromState(state);
+      }, {
+        purpose: "security-audit", fileName: "security-audit.lock", label: "security audit",
+      });
+    },
   });
 }
 
+export async function recordAuditBatch(root, records) {
+  return createAuditStorageSession(root).recordBatch(records);
+}
+
 export function auditSnapshotFromState(state) {
   return {
-    enabled: true,
-    healthy: true,
-    retained: state.events.length,
-    maximum: SECURITY_AUDIT_MAX_EVENTS,
+    enabled: true, healthy: true, retained: state.events.length,
+    maximum: SECURITY_AUDIT_MAX_EVENTS, maximum_bytes: SECURITY_AUDIT_MAX_BYTES,
     last_event_at: state.events.at(-1)?.timestamp || null,
-    last_error_class: null,
-    content_logged: false,
-    chain_verified: true,
+    last_error_class: null, content_logged: false, chain_verified: true,
   };
 }
 
 export function unhealthyAuditSnapshot(error) {
   return {
-    enabled: true,
-    healthy: false,
-    retained: 0,
-    maximum: SECURITY_AUDIT_MAX_EVENTS,
-    last_event_at: null,
-    last_error_class: auditErrorClass(error),
-    content_logged: false,
-    chain_verified: false,
+    enabled: true, healthy: false, retained: 0,
+    maximum: SECURITY_AUDIT_MAX_EVENTS, maximum_bytes: SECURITY_AUDIT_MAX_BYTES,
+    last_event_at: null, last_error_class: auditErrorClass(error),
+    content_logged: false, chain_verified: false,
   };
 }
 
@@ -85,113 +82,51 @@ export function auditErrorClass(error) {
   return String(error?.code || error?.name || "audit_error").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80);
 }
 
-function buildEvent(input, state, nowMs) {
-  const timestamp = new Date(Number(nowMs)).toISOString();
-  if (!Number.isFinite(Date.parse(timestamp))) throw new Error("security audit timestamp is invalid");
-  const principal = input.principal && typeof input.principal === "object" ? input.principal : {};
-  const event = {
-    sequence: state.next_sequence,
-    timestamp,
-    outcome: boundedToken(input.outcome, "unknown"),
-    tool: boundedToken(input.tool, "unknown"),
-    risk_category: boundedText(input.riskCategory, "ordinary operation", 160),
-    target_hash: HASH_PATTERN.test(String(input.targetHash || "")) ? String(input.targetHash) : null,
-    account_ref: principal.accountId ? privateReference(state.identity_salt, principal.accountId) : null,
-    client_ref: principal.clientId ? privateReference(state.identity_salt, principal.clientId) : null,
-    family_ref: principal.familyId ? privateReference(state.identity_salt, principal.familyId) : null,
-    account_version: Number.isSafeInteger(principal.accountVersion) ? principal.accountVersion : null,
-    role: boundedToken(principal.role, principal.kind === "local" ? "local" : "unknown"),
-    duration_ms: boundedNumber(input.durationMs),
-    input_bytes: boundedNumber(input.inputBytes),
-    output_bytes: boundedNumber(input.outputBytes),
-    error_code: input.errorCode ? boundedToken(input.errorCode, "unknown") : null,
-    previous_hash: state.events.at(-1)?.hash || state.anchor,
-  };
-  const completed = { ...event, hash: eventHash(event) };
-  state.next_sequence += 1;
-  return completed;
-}
-
-function emptyState() {
+function readVerifiedAuditStateWithIdentity(root) {
+  const file = auditFilePath(root);
+  let loaded;
+  try {
+    loaded = readBoundedRegularFileWithInfoSync(file, SECURITY_AUDIT_MAX_BYTES, "security audit state", {
+      verifyPathIdentity: true,
+      rejectMultipleLinks: true,
+    });
+  } catch (error) {
+    if (error?.code === "ENOENT") return { state: emptyAuditState(SECURITY_AUDIT_SCHEMA_VERSION), identity: null };
+    throw error;
+  }
   return {
-    schemaVersion: SECURITY_AUDIT_SCHEMA_VERSION,
-    identity_salt: randomBytes(32).toString("hex"),
-    anchor: randomBytes(32).toString("hex"),
-    next_sequence: 1,
-    events: [],
+    state: decodeAndVerifyAuditState(loaded.buffer, SECURITY_AUDIT_SCHEMA_VERSION, SECURITY_AUDIT_MAX_EVENTS),
+    identity: fileIdentity(loaded.info),
   };
 }
 
-function validateState(state) {
-  if (!plainRecord(state) || state.schemaVersion !== SECURITY_AUDIT_SCHEMA_VERSION) {
-    throw new Error("security audit state schema is invalid");
-  }
-  if (!HASH_PATTERN.test(state.identity_salt) || !HASH_PATTERN.test(state.anchor)) {
-    throw new Error("security audit state identity is invalid");
-  }
-  if (!Number.isSafeInteger(state.next_sequence) || state.next_sequence < 1) {
-    throw new Error("security audit sequence is invalid");
-  }
-  if (!Array.isArray(state.events)
-      || state.events.length > SECURITY_AUDIT_MAX_EVENTS
-      || !state.events.every(validEvent)) {
-    throw new Error("security audit events are invalid");
-  }
-  if (state.events.length && state.next_sequence <= state.events.at(-1).sequence) {
-    throw new Error("security audit sequence did not advance");
-  }
-}
-
-function validEvent(event) {
-  return plainRecord(event)
-    && Number.isSafeInteger(event.sequence)
-    && event.sequence > 0
-    && Number.isFinite(Date.parse(String(event.timestamp || "")))
-    && typeof event.outcome === "string"
-    && typeof event.tool === "string"
-    && typeof event.risk_category === "string"
-    && (event.target_hash === null || HASH_PATTERN.test(event.target_hash))
-    && ["account_ref", "client_ref", "family_ref"].every((key) => event[key] === null || HASH_PATTERN.test(event[key]))
-    && (event.account_version === null || Number.isSafeInteger(event.account_version))
-    && typeof event.role === "string"
-    && Number.isFinite(event.duration_ms)
-    && Number.isFinite(event.input_bytes)
-    && Number.isFinite(event.output_bytes)
-    && (event.error_code === null || typeof event.error_code === "string")
-    && HASH_PATTERN.test(event.previous_hash)
-    && HASH_PATTERN.test(event.hash);
-}
-
-function eventHash(event) {
-  const value = { ...event };
-  delete value.hash;
-  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
-}
-
-function privateReference(salt, value) {
-  return createHash("sha256").update(salt).update("\0").update(String(value)).digest("hex");
-}
-
-function writeState(file, state) {
+function writeState(file, content) {
   ensureOwnerOnlyDirectorySync(path.dirname(file));
-  const content = `${JSON.stringify(state)}\n`;
-  if (Buffer.byteLength(content) > SECURITY_AUDIT_MAX_BYTES) {
-    throw new Error("security audit state exceeds its size limit");
-  }
   replaceFileAtomicallySync(file, content, { mode: 0o600 });
+  return inspectAuditFile(file);
 }
 
-function boundedToken(value, fallback) {
-  const text = String(value || fallback).replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 128);
-  return text || fallback;
-}
-function boundedText(value, fallback, maximum) {
-  return String(value || fallback).replace(/[\r\n\t\u0000-\u001f\u007f]/g, " ").trim().slice(0, maximum) || fallback;
+function inspectAuditFile(file) {
+  let info;
+  try { info = lstatSync(file); } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+  if (info.isSymbolicLink() || !info.isFile()) throw new Error("security audit state must be a regular file and not a symbolic link");
+  if (Number(info.nlink) > 1) throw new Error("security audit state must not have multiple hard links");
+  return fileIdentity(info);
 }
-function boundedNumber(value) {
-  const number = Number(value);
-  return Number.isFinite(number) && number >= 0 ? Math.min(Math.floor(number), Number.MAX_SAFE_INTEGER) : 0;
+
+function fileIdentity(info) {
+  return {
+    dev: Number(info.dev), ino: Number(info.ino), size: Number(info.size),
+    mtime_ms: Number(info.mtimeMs), ctime_ms: Number(info.ctimeMs),
+  };
 }
-function plainRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+
+function sameFileIdentity(left, right) {
+  if (left === null || right === null) return left === right;
+  return Boolean(left && right)
+    && left.dev === right.dev && left.ino === right.ino && left.size === right.size
+    && left.mtime_ms === right.mtime_ms && left.ctime_ms === right.ctime_ms;
 }

package/src/local/security-audit-worker.mjs

@@ -1,22 +1,21 @@
 import { parentPort, workerData } from "node:worker_threads";
 import {
   auditErrorClass,
-  auditSnapshotFromState,
-  readVerifiedAuditState,
-  recordAuditBatch,
+  createAuditStorageSession,
   unhealthyAuditSnapshot,
 } from "./security-audit-storage.mjs";
 
 const root = String(workerData?.root || "");
 const MAX_BATCH = 128;
 const BATCH_DELAY_MS = 5;
+const storage = createAuditStorageSession(root);
 const pending = [];
 let timer = null;
 let draining = false;
 let closeRequested = false;
 
 try {
-  parentPort.postMessage({ type: "ready", snapshot: auditSnapshotFromState(readVerifiedAuditState(root)) });
+  parentPort.postMessage({ type: "ready", snapshot: storage.snapshot() });
 } catch (error) {
   parentPort.postMessage({ type: "ready", snapshot: unhealthyAuditSnapshot(error) });
 }
@@ -63,7 +62,7 @@ async function drain() {
       }
       if (records.length > 0) {
         try {
-          const snapshot = await recordAuditBatch(root, records.map(({ input, nowMs }) => ({ input, nowMs })));
+          const snapshot = await storage.recordBatch(records.map(({ input, nowMs }) => ({ input, nowMs })));
           parentPort.postMessage({
             type: "record_batch_result", ids: records.map((item) => item.id), recorded: true, snapshot,
           });

package/src/worker/index.ts

@@ -61,7 +61,7 @@ import {
   sendWebSocketQuietly, trySendWebSocket,
 } from "./websocket-protocol.ts";
 
-const SERVER_VERSION = "3.0.0-beta.28";
+const SERVER_VERSION = "3.0.0-beta.29";
 const MCP_SERVER_INFO = mcpServerInfo(SERVER_VERSION);
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
 const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs;

package/src/worker/observability.ts

@@ -88,6 +88,11 @@ export class WorkerObservability {
   snapshot(): Record<string, unknown> {
     return {
       uptime_ms: Math.max(0, performance.now() - this.startedAt),
+      metric_scope: {
+        lifecycle: "current_worker_isolate",
+        durable_calls_may_cross_isolates: true,
+        counters_may_not_balance: true,
+      },
       requests: { ...this.requests },
       calls: { ...this.calls },
       sockets: { ...this.sockets },