machine-bridge-mcp 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.12.2 - 2026-07-12
+
+### Cross-platform persistence and browser reliability
+
+- Extend transient Windows atomic replacement from eight short linear retries to sixteen bounded exponential retries with jitter. The implementation continues to use one same-directory atomic rename and never falls back to deleting the destination, while tolerating longer antivirus/indexer/reader sharing windows.
+- Eliminate a broker-test race that could miss the runtime `hello` message between WebSocket `open` and listener registration. Pairing HTTP requests and WebSocket open/message/close waits are now bounded, and failed proxy candidates are terminated so a handshake cannot retain the test process indefinitely.
+
+### CI, release, and supply-chain integrity
+
+- Require a completed successful push-triggered GitHub Actions run for the exact `origin/main` commit before creating or verifying a version tag, GitHub Release, or release asset. A local test pass is necessary but no longer sufficient for publication.
+- Pin all third-party GitHub Actions to immutable commit SHAs, retain Dependabot updates, and enforce the pinning plus the release-CI wiring through architecture and dedicated release-gate tests.
+- Run a reachable-history privacy audit in the package-audit job. The scanner covers historical UTF-8 blob contents, historical paths, and commit messages without printing matched values, while narrowly ignoring the standard public Dependabot signing trailer.
+
+### Regression coverage and audit follow-up
+
+- Add deterministic tests for twelve consecutive transient Windows replacement failures, exponential delay selection, lost browser handshakes, bounded socket waits, portable simulated-Linux launcher paths on Windows, POSIX-versus-Windows daemon-stop semantics, deleted historical credential blobs, public automation trailers, and successful/failed/pending release CI states.
+- Update the architecture, engineering, privacy, testing, release, security, and audit documentation. Record remaining immutable Git-history identity metadata separately from current-tree and active-credential findings.
+
+## 0.12.1 - 2026-07-12
+
+### Real local automation corrections
+
+- Make the fixed macOS JXA helper return JSON as the top-level `osascript` result instead of using `console.log`, which real `osascript` sends to stderr. Empty helper stdout now fails explicitly rather than being interpreted as a successful empty object.
+- Skip recursive macOS menu-bar/menu traversal by default so bounded inspection reaches main-window controls promptly. Add `include_menus` to inspection and actions for explicit menu automation.
+- Normalize hyphens, underscores, dots, and spaces during capability ranking, and strongly boost explicitly named skills and commands. Natural-language references such as `agents progressive disclosure` now select `agents-progressive-disclosure` instead of a generic competing skill.
+
+### Live verification and regression coverage
+
+- Add regression coverage for missing JXA output, menu-recursion forwarding, and punctuation-normalized Skill selection. Add an opt-in real macOS Calculator smoke path and document isolated-profile MV3 browser validation.
+- Validate the source runtime with a temporary real global instruction file, an existing user Skill, a registered direct-argv command, shell execution, Calculator discovery/open/activation/inspection/click, and a real unpacked browser extension controlling a local form through inspect/fill/click/source/screenshot operations. Test files, browser profiles, temporary global configuration, tabs, and application state are removed afterward.
+
 ## 0.12.0 - 2026-07-12
 
 ### Locking, persistence, and process lifecycle

package/SECURITY.md

@@ -19,7 +19,7 @@ Do not include live MCP passwords, daemon secrets, OAuth tokens, Cloudflare cred
 
 ## Repository and documentation privacy
 
-Tests, examples, documentation, release notes, and package metadata are publication surfaces. Use only synthetic hostnames, resource aliases, usernames, paths, and project names. Run `npm run privacy:check` before committing or publishing, and maintain private local identifiers in the ignored `.privacy-denylist`; the scanner never prints matched values. See [Repository privacy hygiene](docs/PRIVACY.md).
+Tests, examples, documentation, release notes, and package metadata are publication surfaces. Use only synthetic hostnames, resource aliases, usernames, paths, and project names. Run `npm run privacy:check` before committing, review `npm run privacy:history` before publishing, and maintain private local identifiers in the ignored `.privacy-denylist`; neither scanner mode prints matched values. See [Repository privacy hygiene](docs/PRIVACY.md).
 
 Removing a value from the current branch does not remove it from Git history, caches, forks, or an already published npm package. Rotate any exposed credential immediately and coordinate destructive history rewriting separately when its risk is justified.
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -29,5 +29,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "0.12.0"
+  "version_name": "0.12.2"
 }

package/docs/AGENT_CONTEXT.md

@@ -189,7 +189,7 @@ No persistent skill or project-context index is trusted as authoritative. `sessi
 
 ## Progressive disclosure and task selection
 
-`agent_context` returns bounded skill metadata. `load_local_skill` returns full instructions only for one selected bundle. `resolve_task_capabilities` tokenizes the current task, ranks skill names/descriptions and command names/descriptions/argv, returns matches with scores, and loads the leading skill only when its relevance threshold is met.
+`agent_context` returns bounded skill metadata. `load_local_skill` returns full instructions only for one selected bundle. `resolve_task_capabilities` tokenizes the current task, ranks skill names/descriptions and command names/descriptions/argv, returns matches with scores, and loads the leading skill only when its relevance threshold is met. Hyphens, underscores, dots, and whitespace are normalized for matching, while an explicitly named skill or registered command receives a strong deterministic boost. Thus a task that says “agents progressive disclosure” can match `agents-progressive-disclosure` without relying on generic description words.
 
 This ranking is deterministic local assistance, not semantic certainty. The model must still evaluate whether the selected skill applies. Machine Bridge does not execute skill scripts implicitly and does not fabricate a dynamically named MCP tool per skill.
 

package/docs/ARCHITECTURE.md

@@ -40,7 +40,7 @@ A canonical workspace receives an independent profile, Worker name, secret set,
 
 `RelayConnection` owns remote WebSocket transport, authenticated `hello_ack` readiness, heartbeat liveness, reconnect backoff, and outage logging. Stdio mode invokes `LocalRuntime` directly without that adapter.
 
-`daemon-process.mjs` owns workspace-daemon inspection and takeover. It distinguishes platform service state from the lock-owning Node process, validates PID and process-start identity, canonicalizes workspace/state paths before comparison, parses bounded process command lines without executing them, and sends `SIGTERM` only to a verified same-workspace `--daemon-only` process. CLI orchestration never treats a missing launchd/systemd job as proof that the process exited.
+`daemon-process.mjs` owns workspace-daemon inspection and takeover. It distinguishes platform service state from the lock-owning Node process, validates PID and process-start identity, canonicalizes workspace/state paths before comparison, parses bounded process command lines without executing them, and sends `SIGTERM` only to a verified same-workspace `--daemon-only` process. POSIX daemons may ignore that signal and reach the bounded non-escalating timeout; Node's Windows signal mapping terminates the verified process directly. CLI orchestration never treats a missing launchd/systemd job as proof that the process exited.
 
 ### Agent context and capability resolver
 
@@ -216,7 +216,7 @@ The Worker also treats a new connection as a bounded candidate until it authenti
 
 ## Persistence
 
-Local state and global config are owner-only, versioned, and size-bounded. Shared persistence primitives write a complete private temporary file, `fsync` it, and either hard-link it for an exclusive claim or atomically replace the destination. Machine-level browser pairing state is owner-only and shared across workspace runtimes through the local broker; its bearer token is not part of workspace state responses. State, managed-job manager, detached runner, browser pairing, and service definitions share the same flushed atomic-replacement primitive plus bounded retry for transient Windows sharing failures.
+Local state and global config are owner-only, versioned, and size-bounded. Shared persistence primitives write a complete private temporary file, `fsync` it, and either hard-link it for an exclusive claim or atomically replace the destination. Machine-level browser pairing state is owner-only and shared across workspace runtimes through the local broker; its bearer token is not part of workspace state responses. State, managed-job manager, detached runner, browser pairing, and service definitions share the same flushed atomic-replacement primitive. Only classified transient Windows sharing failures are retried, using a bounded sixteen-attempt exponential schedule with jitter; the implementation never deletes the destination as a retry fallback, so readers are not intentionally exposed to a missing-file interval.
 
 Process locks contain purpose, workspace, ownership token, lock time, and process start time. Stale removal rechecks device/inode/size/mtime and token so an old observer cannot delete a replacement lock. Recent malformed claims receive a grace period. Startup/state operations wait a bounded interval; daemon and runner identity remain process-lifetime locks. Managed-job transition and recovery locks use the same ownership/snapshot principles and support an atomic runner handoff.
 
@@ -236,6 +236,12 @@ Foreground logging defaults to `info`; autostart uses `warn`. Authenticated read
 
 Cloudflare sampling is size control rather than an audit log. The project intentionally does not claim complete forensic logging. See [LOGGING.md](LOGGING.md).
 
+## Release integrity
+
+Repository-local checks are necessary but cannot prove behavior on every supported operating system. `scripts/github-release.mjs` therefore queries `.github/workflows/ci.yml` for the exact `origin/main` commit and requires the newest push-triggered run to be completed with `success` before it creates or verifies a version tag, GitHub Release, or package asset. Pull-request runs, older successful runs, pending runs, and successful runs for another SHA do not satisfy the gate. The selection policy is isolated in `scripts/release-ci.mjs` and tested independently.
+
+Third-party workflow actions are pinned to immutable commit SHAs. Dependabot proposes reviewed SHA updates, and `architecture:test` rejects a return to movable action tags or removal of the reachable-history package-audit step.
+
 ## Explicit non-goals
 
 - operating-system sandboxing of arbitrary executables;

package/docs/AUDIT.md

@@ -1,6 +1,18 @@
 # Engineering and security audit
 
-This document records the cross-cutting audit performed for version 0.12.0. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+This document records the cross-cutting audit initiated for version 0.12.0 and the 0.12.2 follow-up triggered by real cross-platform CI failures. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+
+## 0.12.2 follow-up findings
+
+The failed `0.12.1` workflow had two independent causes. Windows exhausted the old approximately half-second atomic-replacement retry window while a stress reader repeatedly held the destination open. Linux and macOS lost an immediately emitted browser runtime `hello` between awaiting `open` and registering the message listener, then waited without a deadline until the 20-minute job timeout. The fixes preserve atomic replacement, extend only classified transient retries, pre-register the browser handshake listener, bound all relevant HTTP/WebSocket waits, and terminate failed proxy candidates.
+
+The review also found three governance gaps not represented by the original failure message:
+
+- GitHub Releases could be created from a local pass while the exact cross-platform push CI was failing. Publication now requires successful exact-commit push CI before tagging or release verification.
+- Workflow actions used movable major-version tags. They are now pinned to immutable official commit SHAs, with an executable invariant.
+- Repository privacy checks covered only the current tree. Package audit now scans reachable historical paths, bounded UTF-8 blobs, and commit messages; deleted credential fixtures fail without echoing their values.
+
+No generic active credential pattern was found in the current tree or reachable history after excluding standard public automation trailers. The developer-local denylist does match legacy historical identifiers, and the Git metadata audit found a legacy non-noreply author/committer identity. These are identity/privacy metadata rather than active credentials. Removing them would require a coordinated history rewrite and force-update of affected refs, which is intentionally not performed as an incidental code fix.
 
 ## Scope
 

package/docs/ENGINEERING.md

@@ -9,7 +9,7 @@ This document records project-wide decisions that must survive individual fixes,
 3. **Machine Bridge authority and host authority are separate.** `full` removes Machine Bridge's own policy, path, shell, and environment restrictions. It cannot override an MCP host, connector gateway, operating system, endpoint-security product, cloud IAM, remote authentication, or `sudo`.
 4. **Publication surfaces contain no real environment metadata.** Source, tests, fixtures, examples, release notes, filenames, package contents, tags, and release assets use synthetic identifiers and reserved example domains.
 5. **Secrets are never operational log data.** Tool arguments, command text, stdin, stdout, stderr, file content, OAuth bodies, credentials, and local resource values are not logged.
-6. **A release is one version across all surfaces.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree before a release is considered complete.
+6. **A release is one version with successful cross-platform evidence.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree, and the exact `origin/main` commit must have a completed successful push-triggered GitHub Actions run before a tag or release is created.
 7. **Generic local automation is structured, not arbitrary evaluation.** Browser/application features may expose broad user authority under canonical `full`, but must not accept caller-provided JavaScript, AppleScript, JXA, or extension code.
 8. **Daily-browser integration uses the existing profile.** The supported primary browser path is the packaged authenticated extension and machine-level loopback broker, preserving current tabs/login state; a separate automation profile is not an equivalent replacement.
 9. **Pairing and resource secrets are not conversation or log data.** Tokens and injected local-resource values must not be returned, embedded in URLs, or written to operational logs.
@@ -123,7 +123,7 @@ Every defect fix includes a regression test that fails for the original reason.
 The required matrix includes:
 
 - Linux, macOS, and Windows on the pinned Node/npm baseline;
-- privacy and release-impact gates;
+- current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit release-CI gating;
 - package-manifest and sensitive-artifact inspection;
 - generated type checks and recursively discovered JavaScript/shell syntax checks;
 - concurrent exclusive-lock/atomic-replacement tests, PID-reuse/age tests, and fail-closed service-lifecycle tests;
@@ -134,7 +134,7 @@ The required matrix includes:
 - managed-job integrity, recovery, cancellation, cleanup, and redaction;
 - dependency audit, registry signatures/attestations, SBOM, and Worker dry run.
 
-Cross-platform tests must not depend on shell syntax, case-sensitive Windows paths, Unix-only executable shims, or timing races when a deterministic scheduler can be injected.
+Cross-platform tests must not depend on shell syntax, case-sensitive Windows paths, Unix-only executable shims, or timing races when a deterministic scheduler can be injected. Local success cannot substitute for the required Linux/macOS/Windows push CI result used by the release gate.
 
 ## Documentation rules
 
@@ -177,7 +177,7 @@ A thorough review asks:
 - Are persistent files atomic, owner-only, size-bounded, and symlink-aware?
 - Can browser/app automation be expressed without arbitrary evaluation, and are pairing/resource values absent from results and logs?
 - Can a stale PID, stale socket, duplicate request, partial write, or ambiguous remote response violate integrity?
-- Are package, CI, Worker, service, and release behavior tested on every supported platform?
+- Are package, CI, Worker, service, and release behavior tested on every supported platform, and does publication verify the exact successful push CI run?
 - Does the complete diff contain any real identifier, path, host, account, or credential-shaped value?
 - Does the change require a new npm version and deployment?
 

package/docs/LOCAL_AUTOMATION.md

@@ -83,7 +83,9 @@ Then use `value_resource` for a text field or `resources` for `browser_upload_fi
 - `inspect_local_application` returns a bounded macOS Accessibility tree.
 - `operate_local_application` performs a structured Accessibility action.
 
-macOS UI inspection and actions require Accessibility permission for the Node/Machine Bridge process. Application discovery and opening are available on supported desktop platforms; structured UI inspection currently targets macOS. The application backend uses fixed JXA implementation code. The caller selects only an application, structured selector, action, and optional bounded value; NUL-containing action text is rejected. `include_values` never returns values for secure-text roles or controls whose metadata indicates passwords, tokens, one-time codes, or payment-card secrets.
+macOS UI inspection and actions require Accessibility permission for the Node/Machine Bridge process. Application discovery and opening are available on supported desktop platforms; structured UI inspection currently targets macOS. The application backend uses fixed JXA implementation code and requires a non-empty JSON result from `osascript`; missing or malformed helper output fails explicitly. The caller selects only an application, structured selector, action, and optional bounded value; NUL-containing action text is rejected. `include_values` never returns values for secure-text roles or controls whose metadata indicates passwords, tokens, one-time codes, or payment-card secrets.
+
+Menu-bar and menu subtrees are not recursively expanded by default. This keeps main-window controls within the element/time budget for applications with large localized menu hierarchies. Pass `include_menus: true` to `inspect_local_application` or `operate_local_application` only when the target is a menu item.
 
 ## Capability discovery and automatic selection
 

package/docs/OPERATIONS.md

@@ -61,7 +61,7 @@ Application UI inspection/actions require Accessibility permission for the Node/
 
 `machine-mcp` is a foreground command. It remains attached to the terminal, defaults to `info` logging, and stops on `Ctrl+C`. `machine-mcp service start` launches the installed platform service in the background and returns to the shell; that service uses `warn` logging.
 
-A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd/systemd/task scheduling no longer tracks, including legacy locks without mode/version metadata. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and never escalates a daemon takeover to a forced kill. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
+A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd/systemd/task scheduling no longer tracks, including legacy locks without mode/version metadata. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and does not add a later forced-kill escalation. On POSIX, a daemon that handles and ignores `SIGTERM` therefore reaches the bounded timeout and remains alive. Node maps the supported termination signals to immediate process termination on Windows, so the same verified-daemon stop normally completes rather than exercising the POSIX timeout branch. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
 
 `machine-mcp service status [WORKSPACE]` reports two independent layers: the platform service (`active`) and `workspace_daemon`, plus `effective_active` and `orphaned_workspace_daemon` summary flags. On macOS it is possible for launchd to report inactive while a prior Node process remains alive with parent PID 1; that is an orphan-daemon condition, not proof that the daemon stopped. `service stop` unloads the provider when present and then terminates only a verified service-style workspace daemon. `service uninstall` and full uninstall are ordered fail-closed operations: provider stop → verified daemon stop(s) → definition removal. A failed or ambiguous stop leaves definitions and state intact. If takeover reaches its deadline, run:
 

package/docs/PRIVACY.md

@@ -8,9 +8,14 @@ Run:
 
 ```sh
 npm run privacy:check
+npm run privacy:history
 ```
 
-The check scans tracked and unignored new UTF-8 files and relative names for generic/encrypted/algorithm-specific private-key headers, AWS/GitHub/GitLab/npm/Slack/Google/live-payment/API token forms, JWT-shaped bearer values, embedded-credential URLs, absolute user-home paths, non-example email/`user@host` identifiers, credential-shaped filenames, and locally configured private identifiers. A tracked `.npmrc` is parsed: non-secret repository settings such as `engine-strict=true` are allowed, while authentication/identity keys, environment interpolation, and embedded credentials fail closed. Publication-surface symbolic links are rejected rather than followed. Binary, invalid UTF-8, and files above the bounded scanner limit require explicit manual review instead of being silently skipped. Findings report only file, line, and rule; the matched value is never printed.
+`privacy:check` scans tracked and unignored new UTF-8 files and relative names for generic/encrypted/algorithm-specific private-key headers, AWS/GitHub/GitLab/npm/Slack/Google/live-payment/API token forms, JWT-shaped bearer values, embedded-credential URLs, absolute user-home paths, non-example email/`user@host` identifiers, credential-shaped filenames, and locally configured private identifiers. A tracked `.npmrc` is parsed: non-secret repository settings such as `engine-strict=true` are allowed, while authentication/identity keys, environment interpolation, and embedded credentials fail closed. Publication-surface symbolic links are rejected rather than followed. Binary, invalid UTF-8, and files above the bounded scanner limit require explicit manual review instead of being silently skipped. Findings report only file, line, and rule; the matched value is never printed.
+
+`privacy:history` first runs the same current-tree checks, then scans every reachable historical blob path and bounded UTF-8 blob plus every reachable commit message. It catches values that were committed and later deleted. Standard public Dependabot signing trailers are ignored only in that exact commit-message context; the same non-example address remains disallowed in ordinary files. The local `.privacy-denylist` is also applied to history, so a developer may discover legacy identifiers that CI cannot know. Such a finding is real publication history, but ordinary commits cannot erase it.
+
+Git author and committer identity headers are canonical Git metadata rather than blob or commit-message content and are not automatically rejected. Audit them separately with `git log`; changing historical identity metadata requires a coordinated history rewrite and force-update of affected refs.
 
 Maintain machine-specific names in an ignored owner-only file:
 
@@ -41,13 +46,13 @@ Before committing or publishing:
 
 - inspect the complete staged diff, including tests, snapshots, examples, release notes, and generated metadata;
 - use reserved example domains and neutral aliases;
-- run `npm run privacy:check`, `npm run check`, and `npm pack --dry-run`;
+- run `npm run privacy:check`, review `npm run privacy:history`, run `npm run check`, and inspect `npm pack --dry-run`;
 - treat paths, host aliases, usernames, codenames, real browser URLs/page captures, application names tied to a user, and form data as private metadata even when they are not authentication secrets;
 - keep browser pairing-state files and captured source/screenshots out of fixtures, documentation, support logs, and release assets;
 - review any tracked `.npmrc` as configuration code and never commit authentication, registry identity, environment interpolation, cert/key paths, or credential-bearing URLs;
 - inspect package modes and filenames as well as file contents—an empty `.env`, private-key filename, database, or log is still an inappropriate publication artifact.
 
-The scanner is heuristic. It cannot identify every personal or organizational name, split/transformed/encrypted value, image, archive, binary fixture, custom credential format, or data already present in Git history. Passing it is a gate, not proof that a publication contains no private data.
+The scanner is heuristic. It cannot identify every personal or organizational name, split/transformed/encrypted value, image, archive, binary fixture, custom credential format, unreachable/pruned object, reflog-only object, fork/cache copy, or Git identity header. Passing current-tree and reachable-history checks is a gate, not proof that every publication copy contains no private data.
 
 ## Incident response
 

package/docs/RELEASING.md

@@ -2,7 +2,7 @@
 
 The release invariant is:
 
-- `main` points to the release commit.
+- `main` points to the release commit, and the exact commit has a completed successful push-triggered `.github/workflows/ci.yml` run.
 - `v<package version>` points to that same commit locally and on GitHub.
 - A final GitHub Release exists for the tag.
 - The GitHub Release contains the npm tarball generated from that commit.
@@ -21,8 +21,8 @@ The release invariant is:
    ```
 
 2. Add the matching dated `CHANGELOG.md` section.
-3. Run `npm run release-impact:check`, `npm run privacy:check`, `npm run check`, both dependency audits, `npm audit signatures`, and generate a CycloneDX `npm sbom`.
-4. Inspect the complete diff and `npm pack --dry-run`, including packaged file modes and every helper referenced by package scripts, then commit and push all release changes to `main`.
+3. Run `npm run release-impact:check`, `npm run privacy:check`, review `npm run privacy:history`, run `npm run check`, both dependency audits, `npm audit signatures`, and generate a CycloneDX `npm sbom`.
+4. Inspect the complete diff and `npm pack --dry-run`, including packaged file modes and every helper referenced by package scripts, then commit and push all release changes to `main`. Wait for the push-triggered Linux/macOS/Windows and package-audit checks to complete successfully.
 
 A privacy/security documentation correction is not “docs only” for release purposes. It requires a replacement npm version and, when appropriate, deprecation or unpublication of the affected version.
 
@@ -34,7 +34,7 @@ From a clean `main` worktree:
 npm run release:publish
 ```
 
-The command validates the project, including repository privacy checks, fast-forwards `origin/main`, creates or verifies the annotated version tag, pushes it, builds the npm tarball, creates or updates the GitHub Release, uploads the tarball, and verifies the resulting state. Read-only GitHub operations, Git pushes, and idempotent release updates use bounded retries only for classified transient network failures; ambiguous Release creation responses are resolved by querying server state before continuing.
+The command validates the project, including repository privacy checks, fast-forwards `origin/main` when needed, then requires the latest push-triggered CI run for that exact commit to be completed successfully before it creates or verifies the annotated version tag. It then pushes the tag, builds the npm tarball, creates or updates the GitHub Release, uploads the tarball, and verifies the resulting state. Read-only GitHub operations, Git pushes, and idempotent release updates use bounded retries only for classified transient network failures; ambiguous Release creation responses are resolved by querying server state before continuing.
 
 To verify without changing anything:
 
@@ -64,4 +64,4 @@ The npm lifecycle repeats the full project checks and the GitHub synchronization
 - An authenticated GitHub CLI session with repository release permission.
 - An npm account that owns the package or has maintainer permission.
 
-GitHub Actions is intentionally not required by this release path. This avoids coupling releases to an OAuth token with the separate `workflow` scope while retaining fail-closed synchronization.
+GitHub Actions is a required publication boundary. The authenticated GitHub CLI must be able to read Actions runs, and a missing, pending, cancelled, skipped, or failed exact-commit push run blocks both `release:publish` and `release:check`. This prevents a machine-specific local pass from publishing a version that fails another supported platform.

package/docs/TESTING.md

@@ -13,15 +13,15 @@ The repository requires Node.js 26 and npm 12. `.node-version`, `.nvmrc`, `packa
 The suite includes:
 
 - release-impact enforcement requiring a new package version and CHANGELOG section for release-relevant changes;
-- release-state diagnostics distinguishing missing local/remote version tags from tags that point to the wrong commit, including the required publication order;
+- release-state diagnostics distinguishing missing local/remote version tags from tags that point to the wrong commit, plus a release-CI gate that rejects missing, pending, failed, pull-request-only, stale, or wrong-commit runs;
 - generated Cloudflare Worker types and strict TypeScript checking, including unused-local and unused-parameter rejection;
 - recursive syntax validation for every JavaScript file under the shipped/runtime/test roots plus the shell wrapper;
 - shared tool-catalog schema, annotation, and profile-inventory checks;
 - default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, live project/skill rescanning and fingerprints, automatic task ranking/loading, command override/removal, direct argv handling, timeout ceilings, and execution-profile denial;
 - concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, and bounded startup-lock waiting;
-- foreground takeover of active and orphaned background daemons, legacy lock identification from canonicalized process arguments, foreground-process protection, actual-PID exit waiting, non-forcing timeout guidance, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts;
+- foreground takeover of active and orphaned background daemons, legacy lock identification from canonicalized process arguments, foreground-process protection, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts;
 - fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results;
-- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, and broker result redaction;
+- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, and bounded socket/HTTP waits;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;
 - atomic create/update, optimistic hash, exact edit, and patch transaction tests;
@@ -36,7 +36,7 @@ The suite includes:
 - local resource CLI registration, permission checks, dynamic reload, state-path redaction, and content non-disclosure;
 - real Ed25519 and RSA generation, idempotent reuse, public/private correspondence, mode enforcement, incomplete/mismatched/symlink rejection, and private-content non-disclosure;
 - real-machine canonical-full sandbox acceptance for outside-workspace I/O, direct/shell execution, full environment inheritance, SSH prerequisites, temporary authorized-key writing, and detached cleanup without external state changes;
-- deterministic injected atomic-replace failures and repeated Windows full-sandbox runs to catch transient file-sharing races;
+- deterministic injected atomic-replace failures, sustained transient Windows sharing contention beyond the old retry budget, bounded exponential delay selection, and repeated Windows full-sandbox runs;
 - canonical named-profile repair and full-only tool exposure parity between local and Worker policy filters;
 - managed-job staging/local approval/cancel-before-start, detachment, job-scoped temporary files, resource hash verification/redaction, discard capture, finally execution, descendant-tree escalation, token/snapshot-safe transition locks, runner process identity, plan scrubbing, PID-reuse-safe dead-runner recovery, and legacy PID-file compatibility;
 - daemon/startup locking, successfully-read corrupt-JSON recovery, and explicit propagation/preservation of oversized, symbolic-link, permission, and I/O failures;
@@ -49,9 +49,22 @@ The suite includes:
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
 - live local Worker OAuth registration, consent, PKCE, token replay rejection, throttling, CORS, protocol negotiation, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure.
 
+## Opt-in live desktop and browser validation
+
+The normal suite uses deterministic mocks for macOS Accessibility and an authenticated in-process extension peer for browser routing. Before a release that changes local UI automation, run the macOS live smoke test on a machine where the invoking Node/terminal process has Accessibility permission:
+
+```sh
+npm run app-automation:live-test
+```
+
+It opens Calculator, activates it through the fixed JXA helper, verifies structured JSON output, inspects main-window Accessibility controls with menu recursion disabled, clicks the `One` control, and quits the application. It is intentionally excluded from CI because macOS TCC permission and a graphical login session are host state.
+
+For browser changes, perform an isolated-profile smoke test with the packaged unpacked extension: pair it to a temporary source runtime, navigate a local no-store page, inspect controls, fill multiple fields, click a button, verify the live DOM, and capture a screenshot. A Playwright persistent Chromium context is an acceptable harness because it loads the real MV3 service worker while keeping the user's daily browser profile untouched.
+
 ## Additional release checks
 
 ```sh
+npm run privacy:history
 npm run worker:dry-run
 npm audit --audit-level=high
 npm audit --omit=dev --audit-level=high
@@ -62,7 +75,7 @@ npm run version:check
 npm run release-impact:check
 ```
 
-GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI explicitly disables setup-node's automatic package-manager cache and upgrades npm from the runner temporary directory before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Dependency and GitHub Actions updates are monitored by Dependabot.
+GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI explicitly disables setup-node's automatic package-manager cache and upgrades npm from the runner temporary directory before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job scans reachable Git history, audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Third-party Actions are pinned to immutable 40-character commit SHAs; architecture tests reject movable tags, and Dependabot monitors both action and dependency updates.
 
 ## Test design rules
 
@@ -79,7 +92,7 @@ GitHub Actions executes the main suite on Linux, macOS, and Windows using the pi
 
 ## Privacy hygiene
 
-Run `npm run privacy:check` before committing and before packaging. Developers should maintain an ignored owner-only `.privacy-denylist` for machine aliases, usernames, internal codenames, and other private identifiers that a generic scanner cannot know. See [Repository privacy hygiene](PRIVACY.md).
+Run `npm run privacy:check` before committing and before packaging. Run and review `npm run privacy:history` before release; local denylist findings may require an explicit owner decision because ordinary commits cannot remove public history. Developers should maintain an ignored owner-only `.privacy-denylist` for machine aliases, usernames, internal codenames, and other private identifiers that a generic scanner cannot know. See [Repository privacy hygiene](PRIVACY.md).
 
 ## Package manifest
 
@@ -89,4 +102,4 @@ The stdio integration test also sends an oversized line, verifies bounded reject
 
 ## Architecture and documentation regression checks
 
-`npm run architecture:test` rejects local-module dependency cycles, missing static or dynamic relative imports, package scripts that reference missing files, drift from the recursive syntax scanner, incomplete executable package directories, inconsistent installation guidance, obsolete `LocalDaemon`/`daemon.mjs` naming, broken relative Markdown links, invisible ASCII control bytes in repository text, removal of the owner-required default-`full` engineering invariant, and accidental publication of `.project-local/` notes.
+`npm run architecture:test` rejects movable GitHub Action references and loss of the CI history scan, release-gate script drift, local-module dependency cycles, missing static or dynamic relative imports, package scripts that reference missing files, drift from the recursive syntax scanner, incomplete executable package directories, inconsistent installation guidance, obsolete `LocalDaemon`/`daemon.mjs` naming, broken relative Markdown links, invisible ASCII control bytes in repository text, removal of the owner-required default-`full` engineering invariant, and accidental publication of `.project-local/` notes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -42,7 +42,7 @@
     "worker:types": "wrangler types src/worker/worker-configuration.d.ts",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run catalog:test && npm run agent-context:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run architecture:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run catalog:test && npm run agent-context:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -55,6 +55,7 @@
     "full-access:test": "node tests/full-access-test.mjs",
     "atomic-fs:test": "node tests/atomic-fs-test.mjs",
     "privacy:check": "node scripts/privacy-check.mjs",
+    "privacy:history": "node scripts/privacy-check.mjs --history",
     "package:test": "node tests/package-test.mjs",
     "release-impact:check": "node scripts/release-impact-check.mjs",
     "release-impact:test": "node tests/release-impact-test.mjs",
@@ -65,11 +66,13 @@
     "secure-file:test": "node tests/secure-file-test.mjs",
     "architecture:test": "node tests/architecture-test.mjs",
     "release-state:test": "node tests/release-state-test.mjs",
+    "release-ci:test": "node tests/release-ci-test.mjs",
     "agent-context:test": "node tests/agent-context-test.mjs",
     "browser-bridge:test": "node tests/browser-bridge-test.mjs",
     "app-automation:test": "node tests/app-automation-test.mjs",
     "process-lock:test": "node tests/process-lock-test.mjs",
-    "service-lifecycle:test": "node tests/service-lifecycle-test.mjs"
+    "service-lifecycle:test": "node tests/service-lifecycle-test.mjs",
+    "app-automation:live-test": "node tests/app-automation-test.mjs --live-macos"
   },
   "dependencies": {
     "wrangler": "4.110.0",

package/scripts/github-release.mjs

@@ -10,6 +10,7 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { runNetworkCommand } from "./network-retry.mjs";
+import { requireSuccessfulCiRun } from "./release-ci.mjs";
 import { tagSyncError } from "./release-state.mjs";
 import { fileURLToPath } from "node:url";
 
@@ -124,6 +125,31 @@ function remoteTagCommit(tag) {
   return (peeled ?? direct)?.[0] ?? null;
 }
 
+function assertSuccessfulCi(head) {
+  const text = outputNetwork("gh", [
+    "run",
+    "list",
+    "--workflow",
+    ".github/workflows/ci.yml",
+    "--commit",
+    head,
+    "--event",
+    "push",
+    "--limit",
+    "20",
+    "--json",
+    "databaseId,status,conclusion,headSha,event,createdAt,url",
+  ]);
+  let runs;
+  try { runs = JSON.parse(text); }
+  catch { fail("GitHub Actions did not return valid JSON"); }
+  let run;
+  try { run = requireSuccessfulCiRun(runs, head); }
+  catch (error) { fail(String(error?.message || error)); }
+  console.log(`GitHub Actions CI succeeded for ${head} (run ${run.databaseId}).`);
+  return run;
+}
+
 function releaseInfo(tag) {
   const result = runNetwork(
     "gh",
@@ -148,6 +174,7 @@ function assertCoreSync({ requireReleaseAsset }) {
   if (head !== originMain) {
     fail(`HEAD ${head} does not match origin/main ${originMain}`);
   }
+  assertSuccessfulCi(head);
 
   const localCommit = localTagCommit(tag);
   const localTagError = tagSyncError({ scope: "local", tag, head, commit: localCommit });
@@ -275,6 +302,7 @@ function publishCurrent() {
     }
     runNetwork("git", ["push", "origin", "HEAD:main"]);
   }
+  assertSuccessfulCi(head);
 
   const existingLocal = localTagCommit(tag);
   if (existingLocal && existingLocal !== head) {

package/scripts/privacy-check.mjs

@@ -5,6 +5,11 @@ import { fileURLToPath } from "node:url";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const selfPath = "scripts/privacy-check.mjs";
+const requestedOptions = new Set(process.argv.slice(2));
+for (const option of requestedOptions) {
+  if (option !== "--history") throw new Error(`unknown privacy-check option: ${option}`);
+}
+const scanHistory = requestedOptions.has("--history");
 const candidates = collectCandidateFiles(root);
 const denylist = loadDenylist(path.join(root, ".privacy-denylist"));
 const findings = [];
@@ -47,6 +52,8 @@ for (const relativePath of candidates) {
   scanDenylist(relativePath, text, denylist, findings);
 }
 
+const historySummaryCounts = scanHistory ? scanReachableHistory(root, denylist, findings) : { blobs: 0, commits: 0 };
+
 if (findings.length) {
   for (const finding of findings.slice(0, 100)) {
     process.stderr.write(`${redactReportPath(finding.path, denylist)}:${finding.line}: ${finding.rule}\n`);
@@ -56,7 +63,8 @@ if (findings.length) {
   process.exit(1);
 }
 
-process.stderr.write(`privacy check ok (${candidates.length} tracked/unignored files; ${denylist.length} local denylist entries)\n`);
+const historySummary = scanHistory ? `; ${historySummaryCounts.blobs} reachable history blobs; ${historySummaryCounts.commits} commit messages` : "";
+process.stderr.write(`privacy check ok (${candidates.length} tracked/unignored files; ${denylist.length} local denylist entries${historySummary})\n`);
 
 function collectCandidateFiles(directory) {
   try {
@@ -87,6 +95,136 @@ function collectCandidateFiles(directory) {
   }
 }
 
+function scanReachableHistory(directory, entries, out) {
+  let listing;
+  try {
+    listing = execFileSync("git", ["-C", directory, "rev-list", "--objects", "--all", "-z"], {
+      encoding: "buffer",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch {
+    throw new Error("privacy history scan could not enumerate reachable Git objects");
+  }
+  let records;
+  try { records = new TextDecoder("utf-8", { fatal: true }).decode(listing).split("\0").filter(Boolean); }
+  catch { throw new Error("privacy history scan encountered a non-UTF-8 Git object path"); }
+  const objectPaths = new Map();
+  let objectHash = "";
+  for (const record of records) {
+    if (/^[0-9a-f]{40,64}$/.test(record)) {
+      objectHash = record;
+      continue;
+    }
+    if (!record.startsWith("path=") || !objectHash) {
+      objectHash = "";
+      continue;
+    }
+    const relativePath = record.slice(5);
+    if (relativePath && !relativePath.includes("\0")) {
+      if (!objectPaths.has(objectHash)) objectPaths.set(objectHash, new Set());
+      objectPaths.get(objectHash).add(relativePath);
+    }
+    objectHash = "";
+  }
+  const hashes = [...objectPaths.keys()];
+  let metadata;
+  try {
+    metadata = execFileSync("git", ["-C", directory, "cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"], {
+      input: `${hashes.join("\n")}\n`,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"],
+    }).trim().split(/\r?\n/);
+  } catch {
+    throw new Error("privacy history scan could not classify reachable Git objects");
+  }
+  const blobSizes = new Map();
+  for (const line of metadata) {
+    const match = /^([0-9a-f]{40,64}) blob ([0-9]+)$/.exec(line);
+    if (match) blobSizes.set(match[1], Number(match[2]));
+  }
+  let scanned = 0;
+  for (const [hash, paths] of objectPaths) {
+    if (!blobSizes.has(hash)) continue;
+    const relativePaths = [...paths].sort();
+    const reportPath = relativePaths[0] || "unknown";
+    const contentPath = relativePaths.find((relativePath) => relativePath !== selfPath) || reportPath;
+    for (const relativePath of relativePaths) {
+      if (relativePath === ".privacy-denylist") continue;
+      const historicalPath = `history/${hash.slice(0, 12)}/${relativePath}`;
+      scanDenylistPath(historicalPath, entries, out);
+      scanSensitivePath(historicalPath, out);
+    }
+    if (blobSizes.get(hash) > 5 * 1024 * 1024) {
+      out.push({ path: `history/${hash.slice(0, 12)}/${reportPath}`, line: 1, rule: "historical file exceeds privacy scanner size limit and requires manual review" });
+      continue;
+    }
+    let buffer;
+    try {
+      buffer = execFileSync("git", ["-C", directory, "cat-file", "blob", hash], {
+        encoding: "buffer",
+        maxBuffer: 6 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch {
+      out.push({ path: `history/${hash.slice(0, 12)}/${reportPath}`, line: 1, rule: "historical file content could not be read" });
+      continue;
+    }
+    scanned += 1;
+    const historicalPath = `history/${hash.slice(0, 12)}/${contentPath}`;
+    if (buffer.includes(0)) {
+      out.push({ path: historicalPath, line: 1, rule: "binary file in reachable Git history requires manual review" });
+      continue;
+    }
+    let historicalText;
+    try { historicalText = new TextDecoder("utf-8", { fatal: true }).decode(buffer); }
+    catch {
+      out.push({ path: historicalPath, line: 1, rule: "non-UTF-8 file in reachable Git history requires manual review" });
+      continue;
+    }
+    if (contentPath !== selfPath) scanBuiltIn(historicalPath, historicalText, out);
+    if (relativePaths.some((relativePath) => path.basename(relativePath).toLowerCase() === ".npmrc")) scanNpmrc(historicalPath, historicalText, out);
+    scanDenylist(historicalPath, historicalText, entries, out);
+  }
+  const commitCount = scanReachableCommitMessages(directory, entries, out);
+  return { blobs: scanned, commits: commitCount };
+}
+
+function scanReachableCommitMessages(directory, entries, out) {
+  let output;
+  try {
+    output = execFileSync("git", ["-C", directory, "log", "--all", "--format=%H%x00%B%x00"], {
+      encoding: "buffer",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch {
+    throw new Error("privacy history scan could not read reachable commit messages");
+  }
+  let records;
+  try { records = new TextDecoder("utf-8", { fatal: true }).decode(output).split("\0"); }
+  catch { throw new Error("privacy history scan encountered a non-UTF-8 commit message"); }
+  let count = 0;
+  for (let index = 0; index + 1 < records.length; index += 2) {
+    const hash = records[index].trim();
+    const message = records[index + 1];
+    if (!/^[0-9a-f]{40,64}$/.test(hash)) continue;
+    const reportPath = `history/commit/${hash.slice(0, 12)}/message`;
+    const scannedMessage = removeKnownPublicAutomationTrailers(message);
+    scanBuiltIn(reportPath, scannedMessage, out);
+    scanDenylist(reportPath, scannedMessage, entries, out);
+    count += 1;
+  }
+  return count;
+}
+
+function removeKnownPublicAutomationTrailers(message) {
+  return String(message).split(/\r?\n/).filter((line) => {
+    return !/^(?:Signed-off-by|Co-authored-by):\s+dependabot\[bot\]\s+<[^>\s]+@github\.com>\s*$/i.test(line);
+  }).join("\n");
+}
+
 function redactReportPath(relativePath, entries) {
   let shown = String(relativePath);
   for (const entry of entries) {
@@ -112,7 +250,6 @@ function scanBuiltIn(relativePath, text, out) {
     ["live payment API key", /\b(?:sk|rk|pk)_live_[A-Za-z0-9]{16,}\b/g],
     ["API secret token", /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
     ["JWT-like bearer token", /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g],
-    ["URL with embedded credentials", /https?:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@[^\s/"'<>]+/gi],
     ["absolute macOS/Linux home path", /(?:^|[\s"'=(:,])\/(?:Users|home)\/([^/\s"'<>]+)\//gm],
     ["absolute Windows home path", /(?:^|[\s"'=(:,])\b[A-Za-z]:\\Users\\([^\\\s"'<>]+)\\/gm],
   ];
@@ -122,6 +259,11 @@ function scanBuiltIn(relativePath, text, out) {
       out.push({ path: relativePath, line: lineNumber(text, match.index || 0), rule });
     }
   }
+  const credentialUrl = /https?:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@([^\s/"'<>]+)/gi;
+  for (const match of text.matchAll(credentialUrl)) {
+    if (isReservedExampleHost(stripHostPort(match[1]))) continue;
+    out.push({ path: relativePath, line: lineNumber(text, match.index || 0), rule: "URL with embedded credentials" });
+  }
   const emailLike = /\b[A-Z0-9._%+-]+@([A-Z0-9.-]+\.[A-Z]{2,})\b/gi;
   for (const match of text.matchAll(emailLike)) {
     if (isReservedExampleHost(match[1]) || String(match[1]).toLowerCase().endsWith(".noreply.github.com")) continue;
@@ -215,6 +357,12 @@ function hasNearbySshContext(text, offset) {
   return /\b(?:ssh|scp|sftp)\b/i.test(text.slice(start, end));
 }
 
+function stripHostPort(host) {
+  const value = String(host || "");
+  if (value.startsWith("[")) return value.slice(1, value.indexOf("]") > 0 ? value.indexOf("]") : undefined);
+  return value.replace(/:[0-9]+$/, "");
+}
+
 function isReservedExampleHost(host) {
   const value = String(host || "").toLowerCase().replace(/\.$/, "");
   return value === "localhost"

package/scripts/release-ci.mjs

@@ -0,0 +1,18 @@
+export function requireSuccessfulCiRun(runs, head) {
+  if (!Array.isArray(runs)) throw new Error("GitHub Actions response is not an array");
+  if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+  const matching = runs
+    .filter((run) => run && run.headSha === head && run.event === "push")
+    .sort((left, right) => String(right.createdAt || "").localeCompare(String(left.createdAt || "")));
+  const run = matching[0];
+  if (!run) {
+    throw new Error(`no push-triggered CI run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
+  }
+  if (run.status !== "completed") {
+    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
+  }
+  if (run.conclusion !== "success") {
+    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun CI before release`);
+  }
+  return run;
+}

package/src/local/agent-context.mjs

@@ -112,12 +112,12 @@ export class AgentContextManager {
     const discovered = await this.discoverSkills(state, { maxResults: MAX_SKILL_RESULTS }, context);
     const maxSkills = clampInt(args.max_skills, 10, 1, 50);
     const skillMatches = discovered.skills
-      .map((skill) => ({ skill, score: relevanceScore(task, `${skill.name} ${skill.description}`) }))
+      .map((skill) => ({ skill, score: relevanceScore(task, `${skill.name} ${skill.description}`, skill.name) }))
       .filter((item) => item.score > 0)
       .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name))
       .slice(0, maxSkills);
     const commandMatches = [...state.commands.values()]
-      .map((command) => ({ command, score: relevanceScore(task, `${command.name} ${command.description} ${command.argv.join(" ")}`) }))
+      .map((command) => ({ command, score: relevanceScore(task, `${command.name} ${command.description} ${command.argv.join(" ")}`, command.name) }))
       .filter((item) => item.score > 0)
       .sort((a, b) => b.score - a.score || a.command.name.localeCompare(b.command.name))
       .slice(0, 20);
@@ -718,7 +718,7 @@ function capabilityFingerprint(state, skills) {
   }));
 }
 
-function relevanceScore(task, candidate) {
+function relevanceScore(task, candidate, identity = "") {
   const taskTokens = tokenize(task);
   const candidateTokens = tokenize(candidate);
   if (!taskTokens.size || !candidateTokens.size) return 0;
@@ -726,18 +726,31 @@ function relevanceScore(task, candidate) {
   for (const token of taskTokens) {
     if (candidateTokens.has(token)) score += token.length >= 6 ? 2 : 1;
   }
-  const taskLower = task.toLowerCase();
-  const candidateLower = candidate.toLowerCase();
-  if (candidateLower.includes(taskLower) || taskLower.includes(candidateLower)) score += 4;
+  const taskComparable = comparableText(task);
+  const candidateComparable = comparableText(candidate);
+  const identityComparable = comparableText(identity);
+  if (candidateComparable.includes(taskComparable) || taskComparable.includes(candidateComparable)) score += 4;
+  if (identityComparable.length >= 3 && ` ${taskComparable} `.includes(` ${identityComparable} `)) score += 12;
   return score;
 }
 
+function comparableText(value) {
+  return String(value || "")
+    .toLowerCase()
+    .replace(/[^a-z0-9\p{Script=Han}]+/gu, " ")
+    .trim()
+    .replace(/\s+/g, " ");
+}
+
 function tokenize(value) {
   const text = String(value || "").toLowerCase();
   const tokens = new Set();
   for (const raw of text.match(/[a-z0-9_][a-z0-9_.-]{1,}/g) || []) {
     const token = raw.replace(/^[.-]+|[.-]+$/g, "");
     if (token.length >= 2 && !TOKEN_STOP_WORDS.has(token)) tokens.add(token);
+    for (const part of token.split(/[._-]+/)) {
+      if (part.length >= 2 && !TOKEN_STOP_WORDS.has(part)) tokens.add(part);
+    }
   }
   for (const sequence of text.match(/[\p{Script=Han}]{1,}/gu) || []) {
     if (!TOKEN_STOP_WORDS.has(sequence)) tokens.add(sequence);

package/src/local/app-automation.mjs

@@ -109,6 +109,7 @@ export class AppAutomationManager {
       maxDepth: clampInt(args.max_depth, 6, 1, MAX_UI_DEPTH),
       maxElements: clampInt(args.max_elements, 200, 1, MAX_UI_ELEMENTS),
       includeValues: args.include_values === true,
+      includeMenus: args.include_menus === true,
     };
     const result = await this.runJxa(payload, clampInt(args.timeout_seconds, 30, 1, 120), context);
     return {
@@ -143,6 +144,7 @@ export class AppAutomationManager {
       value,
       maxDepth: clampInt(args.max_depth, 8, 1, MAX_UI_DEPTH),
       maxElements: MAX_UI_ELEMENTS,
+      includeMenus: args.include_menus === true,
     };
     const result = await this.runJxa(payload, clampInt(args.timeout_seconds, 30, 1, 120), context);
     return {
@@ -168,9 +170,11 @@ export class AppAutomationManager {
       undefined,
       input,
     );
+    const output = result.stdout.trim();
+    if (!output) throw new Error("macOS accessibility helper returned no JSON output");
     let parsed;
     try {
-      parsed = JSON.parse(result.stdout.trim() || "{}");
+      parsed = JSON.parse(output);
     } catch {
       throw new Error("macOS accessibility helper returned invalid JSON");
     }
@@ -337,7 +341,7 @@ function describe(element, index, includeValues) {
   return item;
 }
 function childrenOf(element) { return safe(() => element.uiElements(), []); }
-function flatten(root, maxDepth, maxElements, includeValues) {
+function flatten(root, maxDepth, maxElements, includeValues, includeMenus) {
   const output = [];
   const elements = [];
   const stack = [{ element: root, depth: 0 }];
@@ -346,10 +350,12 @@ function flatten(root, maxDepth, maxElements, includeValues) {
     const children = childrenOf(current.element);
     for (let i = children.length - 1; i >= 0; i--) {
       const child = children[i];
+      const item = describe(child, output.length, includeValues);
       elements.push(child);
-      output.push(describe(child, output.length, includeValues));
+      output.push(item);
       if (output.length >= maxElements) break;
-      if (current.depth + 1 < maxDepth) stack.push({ element: child, depth: current.depth + 1 });
+      const isMenuTree = String(item.role || '').startsWith('AXMenu');
+      if (current.depth + 1 < maxDepth && (includeMenus || !isMenuTree)) stack.push({ element: child, depth: current.depth + 1 });
     }
   }
   return { output, elements, truncated: stack.length > 0 || output.length >= maxElements };
@@ -366,14 +372,14 @@ function main() {
   const process = se.applicationProcesses.byName(payload.application);
   if (!safe(() => process.exists(), false)) throw new Error('application process not found or Accessibility access denied');
   if (payload.operation === 'inspect') {
-    const flattened = flatten(process, payload.maxDepth, payload.maxElements, payload.includeValues === true);
-    return { frontmost: safe(() => process.frontmost(), false), elements: flattened.output, truncated: flattened.truncated };
+    const flattened = flatten(process, payload.maxDepth, payload.maxElements, payload.includeValues === true, payload.includeMenus === true);
+    return { frontmost: safe(() => process.frontmost(), false), elements: flattened.output, truncated: flattened.truncated, menus_included: payload.includeMenus === true };
   }
   if (payload.action === 'activate') {
     process.frontmost = true;
     return { ok: true, matched: 1 };
   }
-  const flattened = flatten(process, payload.maxDepth, payload.maxElements, true);
+  const flattened = flatten(process, payload.maxDepth, payload.maxElements, true, payload.includeMenus === true);
   const matchesList = [];
   for (let i = 0; i < flattened.output.length; i++) if (matches(flattened.output[i], payload.selector)) matchesList.push(i);
   const chosen = payload.selector.index !== undefined ? matchesList[payload.selector.index] : matchesList[0];
@@ -398,5 +404,5 @@ function main() {
   }
   return { ok: true, matched: matchesList.length, selected_index: chosen, element: describe(element, chosen, false) };
 }
-try { console.log(JSON.stringify(main())); } catch (error) { console.log(JSON.stringify({ error: String(error.message || error) })); }
+(() => { try { return JSON.stringify(main()); } catch (error) { return JSON.stringify({ error: String(error.message || error) }); } })()
 `;

package/src/local/atomic-fs.mjs

@@ -5,8 +5,11 @@ const WAIT_BUFFER = new Int32Array(new SharedArrayBuffer(4));
 
 export function replaceFileSync(source, target, options = {}) {
   const rename = typeof options.rename === "function" ? options.rename : renameSync;
-  const attempts = clampInteger(options.attempts, 8, 1, 32);
+  const sleep = typeof options.sleep === "function" ? options.sleep : sleepSync;
+  const random = typeof options.random === "function" ? options.random : Math.random;
+  const attempts = clampInteger(options.attempts, 16, 1, 64);
   const baseDelayMs = clampInteger(options.baseDelayMs, 15, 0, 1000);
+  const maxDelayMs = Math.max(baseDelayMs, clampInteger(options.maxDelayMs, 250, 0, 2000));
   let lastError;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     try {
@@ -15,7 +18,7 @@ export function replaceFileSync(source, target, options = {}) {
     } catch (error) {
       lastError = error;
       if (!isTransientReplaceError(error) || attempt === attempts) throw error;
-      sleepSync(Math.min(baseDelayMs * attempt, 250));
+      sleep(retryDelayMs(attempt, baseDelayMs, maxDelayMs, random));
     }
   }
   throw lastError || new Error("atomic file replacement failed");
@@ -25,6 +28,15 @@ export function isTransientReplaceError(error) {
   return TRANSIENT_REPLACE_ERRORS.has(String(error?.code || ""));
 }
 
+function retryDelayMs(attempt, baseDelayMs, maxDelayMs, random) {
+  if (baseDelayMs <= 0 || maxDelayMs <= 0) return 0;
+  const exponential = Math.min(baseDelayMs * (2 ** Math.min(attempt - 1, 5)), maxDelayMs);
+  const randomValue = Number(random());
+  const normalizedRandom = Number.isFinite(randomValue) ? Math.min(Math.max(randomValue, 0), 1) : 0;
+  const jitter = Math.floor(exponential * 0.5 * normalizedRandom);
+  return Math.min(exponential + jitter, maxDelayMs);
+}
+
 function sleepSync(milliseconds) {
   if (milliseconds <= 0) return;
   Atomics.wait(WAIT_BUFFER, 0, 0, milliseconds);

package/src/local/browser-bridge.mjs

@@ -355,7 +355,9 @@ export class BrowserBridgeManager {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        if (!ok) try { ws.close(); } catch {}
+        if (!ok) {
+          try { ws.terminate(); } catch { try { ws.close(); } catch {} }
+        }
         resolvePromise(ok);
       };
       ws.on("message", (data) => {

package/src/shared/tool-catalog.json

@@ -200,6 +200,11 @@
           "type": "boolean",
           "default": false
         },
+        "include_menus": {
+          "type": "boolean",
+          "default": false,
+          "description": "Include and recursively inspect the application menu hierarchy. Disabled by default so main-window controls are reached quickly."
+        },
         "timeout_seconds": {
           "type": "integer",
           "minimum": 1,
@@ -286,6 +291,11 @@
           "type": "string",
           "pattern": "^[a-z][a-z0-9._-]{0,63}$"
         },
+        "include_menus": {
+          "type": "boolean",
+          "default": false,
+          "description": "Include menu-bar and menu subtrees when matching the action selector."
+        },
         "max_depth": {
           "type": "integer",
           "minimum": 1,

package/src/worker/index.ts

@@ -3,7 +3,7 @@ import toolCatalog from "../shared/tool-catalog.json";
 import serverMetadata from "../shared/server-metadata.json";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "0.12.0";
+const SERVER_VERSION = "0.12.2";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";