machine-bridge-mcp 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.0.1 - 2026-07-14
+
+### Startup and release-gate reliability
+
+- Fix two production CLI references that were used without imports: `readdirSync` in the default Worker deployment fingerprint path and `inspectProcessInstance` in secret rotation. The former made a freshly installed 1.0.0 package fail immediately on zero-argument startup even though syntax, package, and cross-platform CI checks were green.
+- Fix the Windows Wrangler execution boundary uncovered by the new startup probe. Runtime code no longer passes `wrangler.cmd` to `spawn(..., { shell: false })`, which fails with `EINVAL` on Node 26; it invokes the dependency's declared JavaScript entrypoint through the current Node executable on every platform. A focused regression and the installed startup probe prevent a return to shell shims.
+- Add an ESLint correctness gate over Node production code, tests, scripts, and the packaged browser extension. Undefined identifiers, redeclarations, duplicate keys, unreachable statements, and non-loop constant conditions now fail `npm run check` before packaging or publication. A configuration self-test injects synthetic undefined Node/browser bindings so retaining a no-op or mis-scoped lint script cannot satisfy the gate.
+- Strengthen `install:test` to install the real `npm pack` tarball into an isolated global prefix and execute the installed CLI with zero arguments from a package-free workspace and isolated state root. A cross-platform fake Wrangler shim provides a controlled external boundary; the test requires state initialization, rejects `ReferenceError`/`is not defined`, and proves that default startup reaches Worker orchestration rather than only supporting `--version`.
+- Make both static lint and the installed zero-argument startup probe mandatory parts of the complete local, prepublish, Linux, macOS, and Windows release gate. Architecture checks prevent either gate from being removed silently and now enforce the existing exact-semver dependency policy instead of leaving it as documentation only.
+
 ## 1.0.0 - 2026-07-14
 
 ### Current-only protocol and runtime contract

package/README.md

@@ -489,7 +489,7 @@ npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 ```
 
-`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. GitHub Actions runs the suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline; macOS and package-audit jobs also exercise the documented isolated global installation.
+`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, semantic undefined-identifier checks, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, an isolated installation of the actual packed tarball whose zero-argument CLI startup must reach a controlled Worker-deployment boundary, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. GitHub Actions runs the complete suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline.
 
 The cross-cutting 0.12.0 review, corrected failure modes, and residual OS-level limits are recorded in [docs/AUDIT.md](docs/AUDIT.md). See also [docs/GETTING_STARTED.md](docs/GETTING_STARTED.md), [docs/MULTI_ACCOUNT.md](docs/MULTI_ACCOUNT.md), [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md), [docs/LOCAL_AUTOMATION.md](docs/LOCAL_AUTOMATION.md), [docs/MANAGED_JOBS.md](docs/MANAGED_JOBS.md), [docs/TESTING.md](docs/TESTING.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), [docs/ENGINEERING.md](docs/ENGINEERING.md), [docs/PROJECT_STANDARDS.md](docs/PROJECT_STANDARDS.md), the generated [MCP tool reference](docs/TOOL_REFERENCE.md), and [SECURITY.md](SECURITY.md).
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.0"
+  "version_name": "1.0.1"
 }

package/docs/AUDIT.md

@@ -3,6 +3,16 @@
 This document records the cross-cutting audit initiated for version 0.12.0, the 0.12.2 cross-platform CI follow-up, and the 0.13.0 architecture/automatic-routing follow-up, the 0.15.0 daily-browser and cross-platform hardening review, and the 0.16.0 runtime-boundary review. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
 
 
+## 2026-07-14 version 1.0.1 installed-startup incident
+
+Version 1.0.0 passed the complete repository suite, three operating-system CI jobs, package manifest inspection, and a real isolated global installation, but the installed CLI failed immediately on the documented zero-argument command with `readdirSync is not defined`. The direct cause was a missing `node:fs` import in a function reached only while hashing Worker deployment inputs. The installation smoke test invoked only `--version`, which loaded the module but did not execute the default startup function body; `node --check` validates syntax, not lexical name resolution inside unexecuted branches. A second scan found another latent missing import, `inspectProcessInstance`, in secret rotation.
+
+The correction uses independent evidence layers. ESLint now rejects undefined bindings across Node production code, scripts, tests, and browser-extension code. The real-tarball installation test still verifies package layout and documented npm options, but now replaces only the isolated package's Wrangler JavaScript entrypoint with a deterministic failing executable and starts the installed CLI with no arguments from a package-free workspace and private temporary state root. Success means the process initializes current state, computes the packaged Worker fingerprint, and reaches the controlled Wrangler boundary without `ReferenceError` or any `is not defined` failure. Existing workerd/WebSocket and runtime integration tests continue from that external boundary through authenticated readiness. Both gates are part of `npm run check`, prepublish validation, and every supported OS matrix job; architecture tests reject their removal.
+
+The first Windows run of the new gate found another real production defect: `runWrangler` selected `wrangler.cmd` and passed it to `spawn` with `shell: false`, which Node 26 rejected with `EINVAL`. Runtime execution now uses the current Node binary plus `node_modules/wrangler/bin/wrangler.js` on every platform. This keeps the shell-disabled execution invariant while avoiding platform command-shim semantics; a focused command-boundary test and the final-artifact startup probe enforce the choice.
+
+The incident establishes a release rule: entrypoint existence, module import, `--help`, or `--version` are not startup evidence. Every user-documented primary command must be executed from the final packed artifact far enough to cross its composition root and reach either a verified ready state or a deliberately controlled external boundary.
+
 ## 2026-07-14 version 1.0 security-boundary audit
 
 The 1.0 review began from a clean `0.18.1` main branch whose complete local suite and required GitHub checks passed. The green status was incomplete evidence: GitHub still contained open CodeQL findings because the workflow uploaded SARIF but did not fail on security results. The review separated real path races and one lifecycle defect from intentional high-authority process boundaries and static-analysis noise.

package/docs/ENGINEERING.md

@@ -129,6 +129,8 @@ The required matrix includes:
 - current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit release-CI gating;
 - package-manifest and sensitive-artifact inspection;
 - generated type checks and recursively discovered JavaScript/shell syntax checks;
+- static undefined-identifier/redeclaration checks over all production JavaScript, tests, scripts, and browser-extension code;
+- a real packed-tarball isolated global installation whose zero-argument CLI startup initializes state and reaches a controlled external Worker-deployment boundary; `--version` or import-only smoke tests are insufficient release evidence;
 - concurrent exclusive-lock/atomic-replacement tests, PID-reuse/age tests, and fail-closed service-lifecycle tests;
 - real process-tree timeout/cancellation tests with descendants that ignore graceful termination;
 - local runtime and real `full` acceptance tests;

package/docs/TESTING.md

@@ -110,7 +110,9 @@ Run `npm run privacy:check` before committing and before packaging. Run and revi
 
 ## Package manifest
 
-`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that privacy/engineering guidance, runtime/relay/secure-file/lock/service/browser/app modules, all package-script helpers, the packaged browser extension, contribution discipline, and privacy/release-impact checkers are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, and runs the installed CLI. The test runs on Linux, macOS, and Windows CI.
+`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that privacy/engineering guidance, runtime/relay/secure-file/lock/service/browser/app modules, all package-script helpers, the packaged browser extension, contribution discipline, and privacy/release-impact checkers are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe executes default command normalization, state initialization, deployment fingerprint collection, and Wrangler dispatch without changing a live account; any undefined identifier or earlier crash fails the release. The test is part of `npm run check` and runs on Linux, macOS, and Windows CI.
+
+`npm run lint` uses ESLint as a semantic JavaScript correctness gate rather than a style formatter. It covers the Node CLI/runtime, repository scripts, tests, and packaged browser extension and rejects undefined identifiers in function bodies that `node --check` cannot detect. A dedicated lint-gate self-test proves that both Node and browser configurations reject a synthetic undefined binding while accepting the service-worker `importScripts` global. A focused `shell:test` requires Wrangler to run through the current Node executable and its package JavaScript entrypoint rather than a `.cmd` or shell shim. Architecture tests require `shell:test`, `lint:test`, `lint`, and `install:test` to remain in the complete check pipeline and reject non-exact direct dependency ranges.
 
 The stdio integration test also sends an oversized line, verifies bounded rejection, and confirms that the next valid request is still processed.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -102,7 +102,10 @@
     "tool-docs:check": "node scripts/generate-tool-reference.mjs --check",
     "account:test": "node tests/account-admin-test.mjs",
     "sarif-security:test": "node tests/sarif-security-gate-test.mjs",
-    "security-properties:test": "node tests/security-properties-test.mjs"
+    "security-properties:test": "node tests/security-properties-test.mjs",
+    "lint": "eslint eslint.config.mjs bin src/local scripts tests browser-extension",
+    "lint:test": "node tests/lint-gate-test.mjs",
+    "shell:test": "node tests/shell-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",
@@ -112,6 +115,8 @@
   },
   "devDependencies": {
     "@types/node": "26.1.1",
+    "eslint": "10.7.0",
+    "globals": "17.7.0",
     "typescript": "7.0.2"
   },
   "keywords": [

package/src/local/cli.mjs

@@ -1,10 +1,11 @@
 import { createHmac } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path, { join, resolve } from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalRuntime } from "./runtime.mjs";
 import { acquireDaemonLockWithTakeover, inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { inspectProcessInstance } from "./process-identity.mjs";
 import { runStdioServer } from "./stdio.mjs";
 import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./tools.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";

package/src/local/shell.mjs

@@ -113,13 +113,16 @@ function capturedResult(code, stdout, stderr, extraStderr = "") {
   };
 }
 
-function findWranglerCommand() {
-  const suffix = process.platform === "win32" ? ".cmd" : "";
-  return { cmd: path.join(packageRoot, "node_modules", ".bin", `wrangler${suffix}`), argsPrefix: [] };
+export function wranglerCommand(options = {}) {
+  const root = path.resolve(String(options.packageRoot || packageRoot));
+  const node = path.resolve(String(options.node || process.execPath));
+  const script = path.join(root, "node_modules", "wrangler", "bin", "wrangler.js");
+  if (!existsSync(script)) throw new Error(`Wrangler JavaScript entrypoint is missing: ${script}`);
+  return { cmd: node, argsPrefix: [script] };
 }
 
 export async function runWrangler(args, options = {}) {
-  const wrangler = findWranglerCommand();
+  const wrangler = wranglerCommand();
   const operation = String(args[0] || "");
   const timeoutMs = options.timeoutMs ?? (operation === "login" || operation === "deploy" ? 10 * 60 * 1000 : 2 * 60 * 1000);
   return runExecutable(wrangler.cmd, [...wrangler.argsPrefix, ...args], { cwd: packageRoot, timeoutMs, ...options });

package/src/worker/index.ts

@@ -22,7 +22,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.0";
+const SERVER_VERSION = "1.0.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";