Skip to content

machine-bridge-mcp v1.0.0

Choose a tag to compare

View all tags
@YuLeiFuYun YuLeiFuYun released this 14 Jul 06:12
v1.0.0
da95046
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Current-only protocol and runtime contract

  • Declare only MCP protocol 2025-11-25 across shared metadata, stdio, the local runtime, daemon handshakes, and the Cloudflare Worker. Older protocol dates are no longer advertised as supported; clients must negotiate the current protocol before invoking tools.
  • Add stateless, HMAC-bound MCP-Session-Id issuance. Concurrent chat windows using the same OAuth token now have independent JSON-RPC request-id and cancellation domains; sessionless independent POST requests no longer share a token-wide request-id lock.
  • Make terminal relay delivery fail closed: when a completed daemon call cannot return its tool_result, the daemon interrupts the ambiguous socket so Worker socket cleanup releases pending calls immediately instead of retaining a phantom active call until its long timeout.
  • Remove numeric-only managed-job lock interpretation and the remaining dead compatibility branches, unused imports, unreachable conditions, and stale orchestration variables. Current JSON ownership records with process start identity and random tokens are the only accepted lock contract.
  • Keep the current local state schema intact so an existing 0.18.x state root upgrades in place. The source upgrade remains operationally bounded: install the new package, run one normal machine-mcp startup to converge Worker and daemon versions, then reload the unpacked browser extension.

Descriptor-first file and process security

  • Centralize regular-file opens behind a no-follow descriptor primitive that validates the opened object, applies permissions through the descriptor, and performs bounded reads without a separate path check. State, privacy scanning, service logs, managed-job diagnostics, and owner-only files now use this boundary.
  • Inspect SSH key pairs from private, bounded snapshots copied into a private temporary directory. Fingerprinting and public/private correspondence no longer operate on mutable caller paths, and the original files are revalidated by identity and constant-time byte comparison before success is returned.
  • Fix managed-job recovery handoff so the recovery runner must remove recovery.lock with the exact handed-off PID and ownership token. It can no longer delete a replacement claim by path alone.
  • Separate the internal runExecutable argv boundary from explicit shell execution, bound executable/argv sizes, reject NUL bytes, and retain shell: false for direct execution. Worker deployment consistency now uses an HMAC fingerprint keyed by deployment secrets rather than an ordinary digest over secret values.

Enforced security evidence

  • Extend classified Windows atomic-replacement retries from 16 to 32 bounded attempts after hosted Windows runners reproduced an EPERM sharing window beyond the previous budget. The algorithm still uses one same-directory atomic rename, exponential backoff with jitter, and no delete-destination fallback.

  • Move the repository's local GitHub control-plane prohibition into shared MCP initialization and built-in working agreements so it is visible before project-specific task execution. If local Machine Bridge git/gh access is unavailable, automation must stop rather than fall back to a hosted GitHub connector or ChatGPT plugin. Align ENGINEERING.md and CONTRIBUTING.md with the source-release ownership contract.

  • Fail closed when owner-only directories are symlinks, non-directories, cannot be restricted to 0700 on POSIX, or remain group/other-accessible. Extract Worker deployment secret-file lifecycle from the CLI, bind temporary names to process-start identity, delete only positively reclaimable stale files, and surface cleanup failures instead of silently retaining management secrets.

  • Apply the same private-directory boundary to browser pairing, fail managed-job launch when existing diagnostic logs cannot be safely trimmed, and roll back POSIX file/patch commits when exact mode application fails. State-root removal now blocks on unreadable, malformed, symbolic-link, oversized, or otherwise unverifiable config/profile/daemon records instead of treating them as absent.

  • Remove the unused local error factory and default-role constant and make internal-only protocol, pairing, instruction, file, and OAuth helpers non-exported, reducing dead and misleading module surface.

  • Add a SARIF security gate to the required CodeQL workflow. Any new security-tagged result fails the required check; intentional high-authority process boundaries require an exact rule/path exception with a substantive rationale and expiry date.

  • Add deterministic property tests over hostile browser-protocol bytes, policy combinations, argv values, and shell-metacharacter arguments. Add production-path service command coverage and remove test-only filesystem check/use patterns that obscured CodeQL results.

  • Preserve the complete cross-platform, Worker, stdio, browser, lifecycle, atomic-file, process-tree, package, privacy-history, dependency, and release-integrity suite as the release gate.

Assets 3
Loading