machine-bridge-mcp 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.0.2 - 2026-07-14
+
+### Deadline and architecture integrity
+
+- Replace wall-clock arithmetic in startup-lock waits, verified daemon takeover/stop, process-session exit waits, managed-job recovery-lock handoff, full-access diagnostics, browser waits, page actionability/stability checks, application-discovery cache freshness, and local/Worker duration metrics with monotonic elapsed time. System clock rollback can no longer extend these bounded state machines, and a forward correction cannot force premature timeout; persisted expiry and retention timestamps remain wall-clock based.
+- Add deterministic clock-fault regressions at the shared deadline primitive, startup-lock production path, and browser-extension production path, and make the deadline suite a mandatory part of `npm run check`.
+- Correct stale architecture claims after the state-schema-6 and named-account releases: remote tokens are bound to named account principals and roles, duplicate JSON-RPC ids are scoped to one signed MCP session, and application-level account isolation is distinguished from OS/browser tenancy. Architecture tests reject a return to the obsolete statements.
+
+## 1.0.1 - 2026-07-14
+
+### Startup and release-gate reliability
+
+- Fix two production CLI references that were used without imports: `readdirSync` in the default Worker deployment fingerprint path and `inspectProcessInstance` in secret rotation. The former made a freshly installed 1.0.0 package fail immediately on zero-argument startup even though syntax, package, and cross-platform CI checks were green.
+- Fix the Windows Wrangler execution boundary uncovered by the new startup probe. Runtime code no longer passes `wrangler.cmd` to `spawn(..., { shell: false })`, which fails with `EINVAL` on Node 26; it invokes the dependency's declared JavaScript entrypoint through the current Node executable on every platform. A focused regression and the installed startup probe prevent a return to shell shims.
+- Add an ESLint correctness gate over Node production code, tests, scripts, and the packaged browser extension. Undefined identifiers, redeclarations, duplicate keys, unreachable statements, and non-loop constant conditions now fail `npm run check` before packaging or publication. A configuration self-test injects synthetic undefined Node/browser bindings so retaining a no-op or mis-scoped lint script cannot satisfy the gate.
+- Strengthen `install:test` to install the real `npm pack` tarball into an isolated global prefix and execute the installed CLI with zero arguments from a package-free workspace and isolated state root. A cross-platform fake Wrangler shim provides a controlled external boundary; the test requires state initialization, rejects `ReferenceError`/`is not defined`, and proves that default startup reaches Worker orchestration rather than only supporting `--version`.
+- Make both static lint and the installed zero-argument startup probe mandatory parts of the complete local, prepublish, Linux, macOS, and Windows release gate. Architecture checks prevent either gate from being removed silently and now enforce the existing exact-semver dependency policy instead of leaving it as documentation only.
+
 ## 1.0.0 - 2026-07-14
 
 ### Current-only protocol and runtime contract

package/README.md

@@ -489,7 +489,7 @@ npm audit --omit=dev --audit-level=high
 npm pack --dry-run
 ```
 
-`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. GitHub Actions runs the suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline; macOS and package-audit jobs also exercise the documented isolated global installation.
+`npm run check` covers privacy and release-impact gates, architecture/link invariants, generated Worker types, TypeScript, recursively discovered JavaScript syntax, semantic undefined-identifier checks, catalog-to-runtime handler parity, deterministic relay lifecycle and secure-file tests, concurrent lock/atomic-replacement/PID-reuse fixtures, fail-closed service lifecycle tests, descendant process-tree termination, local path/write/state/log/service invariants, Ed25519/RSA generation and key-pair validation, real-machine `full` sandbox acceptance, a clean npm package-manifest/mode/sensitive-artifact check, an isolated installation of the actual packed tarball whose zero-argument CLI startup must reach a controlled Worker-deployment boundary, managed-job integrity/redaction/finally/cancellation/recovery, a live stdio MCP flow, and a live local OAuth/Worker/WebSocket/MCP flow. GitHub Actions runs the complete suite on Linux, macOS, and Windows with the pinned Node 26/npm 12 baseline.
 
 The cross-cutting 0.12.0 review, corrected failure modes, and residual OS-level limits are recorded in [docs/AUDIT.md](docs/AUDIT.md). See also [docs/GETTING_STARTED.md](docs/GETTING_STARTED.md), [docs/MULTI_ACCOUNT.md](docs/MULTI_ACCOUNT.md), [docs/AGENT_CONTEXT.md](docs/AGENT_CONTEXT.md), [docs/LOCAL_AUTOMATION.md](docs/LOCAL_AUTOMATION.md), [docs/MANAGED_JOBS.md](docs/MANAGED_JOBS.md), [docs/TESTING.md](docs/TESTING.md), [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md), [docs/ENGINEERING.md](docs/ENGINEERING.md), [docs/PROJECT_STANDARDS.md](docs/PROJECT_STANDARDS.md), the generated [MCP tool reference](docs/TOOL_REFERENCE.md), and [SECURITY.md](SECURITY.md).
 

package/browser-extension/browser-operations.js

@@ -58,9 +58,10 @@
   
   async function browserWait(params, state) {
     const tab = await resolveTab(params.tabId);
-    const deadline = Date.now() + Math.max(1, Number(params.timeoutMs) || 30000);
+    const timeoutMs = Math.max(1, Number(params.timeoutMs) || 30000);
+    const startedAt = performance.now();
     let last = null;
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= timeoutMs) {
       throwIfCancelled(state);
       const current = await chrome.tabs.get(tab.id);
       const urlMatched = !params.urlContains || String(current.url || "").includes(params.urlContains);

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.0"
+  "version_name": "1.0.2"
 }

package/browser-extension/page-automation.js

@@ -310,9 +310,10 @@
   }
 
   async function waitForActionable(selector, actionName, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let lastProblem = "no element matched selector";
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       const element = findOne(selector);
       if (!element && selector?.ref) throw new Error("element reference is stale; inspect the page again");
       if (element) {
@@ -337,9 +338,10 @@
   }
 
   async function waitForStableBox(element, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let previous = boundingBox(element);
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       await delay(50);
       const current = boundingBox(element);
       if (current && previous && boxDistance(previous, current) <= 0.5) return current;
@@ -349,9 +351,10 @@
   }
 
   async function waitForPointerTarget(element, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let lastProblem = "element does not receive pointer events";
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       const point = actionTarget(element).point;
       if (!point) lastProblem = "element has no usable viewport box";
       else if (point.x < 0 || point.y < 0 || point.x >= innerWidth || point.y >= innerHeight) lastProblem = "element is outside the viewport";

package/docs/ARCHITECTURE.md

@@ -20,7 +20,7 @@ No transport is treated as a sandbox. Both transports invoke the same local runt
 
 The CLI canonicalizes workspaces, resolves policy profiles, maintains per-workspace state and credentials, serializes startup/deploy/rotation with process-identity locks, deploys the Worker, installs optional platform-native autostart, and starts either remote daemon or stdio mode.
 
-A canonical workspace receives an independent profile, Worker name, secret set, resource registry, managed-job directory, daemon/startup locks, and state file. State schema version 5 records policy origin/revision and local resource metadata in addition to the capability fields. `exclusive-file.mjs` owns complete-before-visible exclusive claims and flushed atomic replacement. `process-identity.mjs` owns PID liveness, process start-time comparison, bounded command-line inspection, and PID-reuse classification. `service-lifecycle.mjs` owns the fail-closed stop-daemons-before-remove state machine shared by service removal and full uninstall.
+A canonical workspace receives an independent profile, Worker name, secret set, resource registry, managed-job directory, daemon/startup locks, and state file. State schema version 6 records named accounts, policy origin/revision, and local resource metadata in addition to the capability fields. `exclusive-file.mjs` owns complete-before-visible exclusive claims and flushed atomic replacement. `process-identity.mjs` owns PID liveness, process start-time comparison, bounded command-line inspection, and PID-reuse classification. `service-lifecycle.mjs` owns the fail-closed stop-daemons-before-remove state machine shared by service removal and full uninstall.
 
 ### Local runtime
 
@@ -140,7 +140,7 @@ flowchart LR
   CLI --> S[Autostart provider]
 ```
 
-Remote OAuth currently determines which registered client token may call tools; it does not distinguish independently authorized human principals. Local stdio access relies on the local process and configuration boundary. Policy determines which tools the local daemon and relay advertise. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
+Remote OAuth binds each code and token to a named Machine Bridge account, account version, and role, so accounts are independent application-level authorization principals. The Worker intersects that role with the connected daemon policy, and the local runtime enforces the relayed authorization again. This distinction is not operating-system tenancy: every account still reaches one daemon, workspace, browser profile, and OS user authority. Local stdio access relies on the local process and configuration boundary. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
 
 ## Remote request lifecycle
 
@@ -158,7 +158,7 @@ Remote OAuth currently determines which registered client token may call tools;
 12. A matching cancellation notification removes the pending call, tells the daemon to cancel, and terminates any ordinary child processes bound to it.
 13. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
-Duplicate in-flight JSON-RPC IDs for the same access token are rejected so cancellation cannot ambiguously target multiple calls.
+Duplicate in-flight JSON-RPC IDs are rejected only within the same authenticated MCP session. The request key includes OAuth token identity, the HMAC-bound MCP session, JSON-RPC id type, and id value, so separate initialized clients may safely reuse the same numeric id.
 
 ## Stdio request lifecycle
 
@@ -204,7 +204,7 @@ This is a process-level transaction, not a filesystem-wide atomic transaction ac
 
 The default `full` profile passes the complete parent environment. Isolated environment mode, used by the narrower named profiles unless overridden, creates private runtime HOME, temporary, and cache directories and passes only a small set of path/locale/platform variables. It reduces accidental credential inheritance but cannot prevent explicit access to known filesystem paths, credential stores, network services, or other user resources.
 
-One-shot calls have bounded output and timeouts. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
+One-shot calls have bounded output and timeouts. Startup-lock waits, daemon takeover, process-session reads, managed-job recovery handoff, browser/page waits, application-cache freshness, and in-memory duration metrics use monotonic elapsed time, so wall-clock correction cannot extend or prematurely terminate their configured duration. Persisted timestamps and retention/credential expiry continue to use wall time. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
 
 Child processes run in a separate process group where supported. Timeout, cancellation, disconnect, and replacement send termination to process trees, with a referenced forced-escalation timer that remains alive even when the direct child exits before a resistant descendant. Windows uses tree-aware task termination.
 
@@ -260,4 +260,4 @@ Third-party workflow actions are pinned to immutable commit SHAs. Dependabot pro
 - model-level prompt-injection prevention or semantic validation of browser/application actions;
 - universal desktop UI automation beyond the implemented OS Accessibility backend;
 - scripting browser-internal/enterprise-blocked pages or inaccessible cross-origin frames;
-- isolated multi-user tenancy or per-principal authorization in one Worker deployment; multiple OAuth client registrations currently share one workspace authority.
+- operating-system or browser-profile isolation between mutually distrustful account principals in one Worker/daemon deployment; named accounts provide Worker/local authorization and targeted revocation, but all authorized roles still converge on one local OS user and workspace trust domain.

package/docs/AUDIT.md

@@ -1,8 +1,29 @@
 # Engineering and security audit
 
-This document records the cross-cutting audit initiated for version 0.12.0, the 0.12.2 cross-platform CI follow-up, and the 0.13.0 architecture/automatic-routing follow-up, the 0.15.0 daily-browser and cross-platform hardening review, and the 0.16.0 runtime-boundary review. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, plus the version 1.0.2 elapsed-time and documentation-integrity review. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
 
 
+## 2026-07-14 version 1.0.2 elapsed-time and documentation-integrity audit
+
+The review began from exact released commit `10931c11d7cdab1051018059fc461b73bb5505ff` (tag and npm version 1.0.1), with a clean worktree, zero high-severity npm audit findings, no open issue or pull request, and successful required Linux, macOS, Windows, governance, CodeQL, dependency-review, and Scorecard checks. The threat-model pass separated persisted wall-clock facts—token expiry, file age, retention, alarms, and operator timestamps—from in-memory elapsed durations.
+
+A confirmed lifecycle defect remained across otherwise bounded code paths: startup-lock acquisition, verified daemon takeover/stop, process-session exit waits, managed-job recovery-lock release, full-access diagnostics, and browser/page waits calculated deadlines from `Date.now()`. A backward system-clock correction could extend those state machines beyond their documented maximum, while a forward correction could trigger premature timeout. Application-discovery cache freshness and local/Worker duration metrics had the same clock-domain error, with lower impact. One shared Node monotonic-deadline primitive now owns bounded elapsed waits; browser contexts use their native monotonic `performance.now()`. Persisted timestamps deliberately remain wall-clock based. Deterministic tests freeze or roll back wall time while exercising the real startup-lock and extension wait paths, and the shared helper clamps anomalous backward samples.
+
+The same review confirmed architecture-documentation drift introduced by earlier releases. The document still named state schema 5 after schema 6, described OAuth tokens as lacking independently authorized human principals after named accounts and roles shipped, scoped duplicate request IDs to an entire access token after signed MCP sessions shipped, and listed per-principal authorization as absent. The corrected model distinguishes named application-level account principals and targeted revocation from OS/browser-profile tenancy: all authorized accounts still converge on one daemon, workspace, browser profile, and local OS user. Architecture tests now reject the obsolete statements.
+
+External comparison retained the existing conservative product boundary. Current MCP authorization and security guidance supports exact redirect/resource binding, PKCE S256, server-side authorization, and no token passthrough; the implementation already enforces those controls. Browser projects that expose arbitrary page scripts were not copied because Machine Bridge intentionally restricts callers to packaged structured operations. Remaining limits are explicit: a same-user malicious process, MCP host filtering, browser/OS enforcement, Cloudflare lifecycle behavior, and live deployment state are outside repository-only guarantees.
+
+
+## 2026-07-14 version 1.0.1 installed-startup incident
+
+Version 1.0.0 passed the complete repository suite, three operating-system CI jobs, package manifest inspection, and a real isolated global installation, but the installed CLI failed immediately on the documented zero-argument command with `readdirSync is not defined`. The direct cause was a missing `node:fs` import in a function reached only while hashing Worker deployment inputs. The installation smoke test invoked only `--version`, which loaded the module but did not execute the default startup function body; `node --check` validates syntax, not lexical name resolution inside unexecuted branches. A second scan found another latent missing import, `inspectProcessInstance`, in secret rotation.
+
+The correction uses independent evidence layers. ESLint now rejects undefined bindings across Node production code, scripts, tests, and browser-extension code. The real-tarball installation test still verifies package layout and documented npm options, but now replaces only the isolated package's Wrangler JavaScript entrypoint with a deterministic failing executable and starts the installed CLI with no arguments from a package-free workspace and private temporary state root. Success means the process initializes current state, computes the packaged Worker fingerprint, and reaches the controlled Wrangler boundary without `ReferenceError` or any `is not defined` failure. Existing workerd/WebSocket and runtime integration tests continue from that external boundary through authenticated readiness. Both gates are part of `npm run check`, prepublish validation, and every supported OS matrix job; architecture tests reject their removal.
+
+The first Windows run of the new gate found another real production defect: `runWrangler` selected `wrangler.cmd` and passed it to `spawn` with `shell: false`, which Node 26 rejected with `EINVAL`. Runtime execution now uses the current Node binary plus `node_modules/wrangler/bin/wrangler.js` on every platform. This keeps the shell-disabled execution invariant while avoiding platform command-shim semantics; a focused command-boundary test and the final-artifact startup probe enforce the choice.
+
+The incident establishes a release rule: entrypoint existence, module import, `--help`, or `--version` are not startup evidence. Every user-documented primary command must be executed from the final packed artifact far enough to cross its composition root and reach either a verified ready state or a deliberately controlled external boundary.
+
 ## 2026-07-14 version 1.0 security-boundary audit
 
 The 1.0 review began from a clean `0.18.1` main branch whose complete local suite and required GitHub checks passed. The green status was incomplete evidence: GitHub still contained open CodeQL findings because the workflow uploaded SARIF but did not fail on security results. The review separated real path races and one lifecycle defect from intentional high-authority process boundaries and static-analysis noise.

package/docs/ENGINEERING.md

@@ -110,6 +110,7 @@ A higher branch count is acceptable only when the function is an explicit state
 - Preserve a stable coarse error class for automation and a concise human message for operators.
 - Do not retry an operation merely because it failed; retry only when the error is positively classified as transient and the operation is idempotent or server state is checked after ambiguity.
 - When a remote write may have succeeded before the response was lost, query authoritative state before repeating it.
+- Duration-based deadlines must use a monotonic clock. Wall time remains appropriate for persisted timestamps, credential expiry, retention, and operator-visible dates, but a system clock correction must not extend or prematurely terminate an in-process wait.
 - Timeouts must terminate the relevant process tree. Forced escalation must remain referenced until resistant descendants are handled; do not clear it merely because the direct child exited.
 - Half-open connections need liveness detection, not only periodic writes.
 - Lock reclamation must consider process liveness, process start time, absolute age, ownership token, and file identity to defend against PID reuse and replacement races.
@@ -129,6 +130,8 @@ The required matrix includes:
 - current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit release-CI gating;
 - package-manifest and sensitive-artifact inspection;
 - generated type checks and recursively discovered JavaScript/shell syntax checks;
+- static undefined-identifier/redeclaration checks over all production JavaScript, tests, scripts, and browser-extension code;
+- a real packed-tarball isolated global installation whose zero-argument CLI startup initializes state and reaches a controlled external Worker-deployment boundary; `--version` or import-only smoke tests are insufficient release evidence;
 - concurrent exclusive-lock/atomic-replacement tests, PID-reuse/age tests, and fail-closed service-lifecycle tests;
 - real process-tree timeout/cancellation tests with descendants that ignore graceful termination;
 - local runtime and real `full` acceptance tests;

package/docs/OPERATIONS.md

@@ -73,7 +73,7 @@ Application UI inspection/actions require Accessibility permission for the Node/
 
 `machine-mcp` is a foreground command. It remains attached to the terminal, defaults to `info` logging, and stops on `Ctrl+C`. `machine-mcp service start` launches the installed platform service in the background and returns to the shell; that service uses `warn` logging.
 
-A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd, systemd, or Task Scheduler no longer tracks. Only current lock records containing service mode, version, PID, process start time, entrypoint, workspace, and state root are eligible for takeover. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and does not add a later forced-kill escalation. On POSIX, a daemon that handles and ignores `SIGTERM` therefore reaches the bounded timeout and remains alive. Node maps the supported termination signals to immediate process termination on Windows, so the same verified-daemon stop normally completes rather than exercising the POSIX timeout branch. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
+A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; duration limits use monotonic elapsed time, so NTP or manual wall-clock correction does not lengthen or shorten the wait; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd, systemd, or Task Scheduler no longer tracks. Only current lock records containing service mode, version, PID, process start time, entrypoint, workspace, and state root are eligible for takeover. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and does not add a later forced-kill escalation. On POSIX, a daemon that handles and ignores `SIGTERM` therefore reaches the bounded timeout and remains alive. Node maps the supported termination signals to immediate process termination on Windows, so the same verified-daemon stop normally completes rather than exercising the POSIX timeout branch. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
 
 `machine-mcp service status [WORKSPACE]` reports two independent layers: the platform service (`active`) and `workspace_daemon`, plus `effective_active` and `orphaned_workspace_daemon` summary flags. On macOS it is possible for launchd to report inactive while a prior Node process remains alive with parent PID 1; that is an orphan-daemon condition, not proof that the daemon stopped. `service stop` unloads the provider when present and then terminates only a verified service-style workspace daemon. `service uninstall` and full uninstall are ordered fail-closed operations: provider stop → verified daemon stop(s) → definition removal. A failed or ambiguous stop leaves definitions and state intact. If takeover reaches its deadline, run:
 
@@ -219,7 +219,7 @@ Defense-in-depth limits include:
 - local simultaneous tool calls: 16;
 - Worker pending daemon calls: 32;
 - command timeout: 1–600 seconds;
-- process-session read wait: at most 30 seconds;
+- process-session read wait: at most 30 seconds, measured with monotonic elapsed time;
 - direct directory result: 10,000 entries and 4 MiB of path metadata;
 - recursive walk: 200,000 visited entries;
 - managed jobs: 50 retained, seven-day retention;

package/docs/TESTING.md

@@ -20,10 +20,10 @@ The suite includes:
 - recursive syntax validation for every JavaScript file under the shipped/runtime/test roots plus the shell wrapper;
 - shared tool-catalog schema, annotation, and profile-inventory checks;
 - default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, `.agents/skills` and `.codex/skills` compatibility discovery, live project/skill rescanning and fingerprints, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, runtime-keyed routing-telemetry privacy, and execution-profile denial;
-- concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, and bounded startup-lock waiting;
+- concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, bounded startup-lock waiting, and wall-clock rollback injection proving duration deadlines remain monotonic;
 - foreground takeover of active and orphaned background daemons with current service-lock metadata, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
 - fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results;
-- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, installed-application discovery caching, and name-based task matching;
+- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, frozen-wall-clock browser deadline coverage, installed-application discovery caching, and name-based task matching;
 - relay environment-proxy direct/bypass/agent selection, unsupported proxy rejection, fail-fast invalid configuration, and route observability without endpoint or credential disclosure;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;
@@ -110,7 +110,9 @@ Run `npm run privacy:check` before committing and before packaging. Run and revi
 
 ## Package manifest
 
-`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that privacy/engineering guidance, runtime/relay/secure-file/lock/service/browser/app modules, all package-script helpers, the packaged browser extension, contribution discipline, and privacy/release-impact checkers are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, and runs the installed CLI. The test runs on Linux, macOS, and Windows CI.
+`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that privacy/engineering guidance, runtime/relay/secure-file/lock/service/browser/app modules, all package-script helpers, the packaged browser extension, contribution discipline, and privacy/release-impact checkers are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe executes default command normalization, state initialization, deployment fingerprint collection, and Wrangler dispatch without changing a live account; any undefined identifier or earlier crash fails the release. The test is part of `npm run check` and runs on Linux, macOS, and Windows CI.
+
+`npm run lint` uses ESLint as a semantic JavaScript correctness gate rather than a style formatter. It covers the Node CLI/runtime, repository scripts, tests, and packaged browser extension and rejects undefined identifiers in function bodies that `node --check` cannot detect. A dedicated lint-gate self-test proves that both Node and browser configurations reject a synthetic undefined binding while accepting the service-worker `importScripts` global. A focused `shell:test` requires Wrangler to run through the current Node executable and its package JavaScript entrypoint rather than a `.cmd` or shell shim. Architecture tests require `shell:test`, `lint:test`, `lint`, and `install:test` to remain in the complete check pipeline and reject non-exact direct dependency ranges.
 
 The stdio integration test also sends an oversized line, verifies bounded rejection, and confirms that the next valid request is still processed.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -102,7 +102,11 @@
     "tool-docs:check": "node scripts/generate-tool-reference.mjs --check",
     "account:test": "node tests/account-admin-test.mjs",
     "sarif-security:test": "node tests/sarif-security-gate-test.mjs",
-    "security-properties:test": "node tests/security-properties-test.mjs"
+    "security-properties:test": "node tests/security-properties-test.mjs",
+    "lint": "eslint eslint.config.mjs bin src/local scripts tests browser-extension",
+    "lint:test": "node tests/lint-gate-test.mjs",
+    "shell:test": "node tests/shell-test.mjs",
+    "deadline:test": "node tests/monotonic-deadline-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",
@@ -112,6 +116,8 @@
   },
   "devDependencies": {
     "@types/node": "26.1.1",
+    "eslint": "10.7.0",
+    "globals": "17.7.0",
     "typescript": "7.0.2"
   },
   "keywords": [

package/src/local/app-automation.mjs

@@ -1,6 +1,7 @@
 import { opendir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, extname, join } from "node:path";
+import { performance } from "node:perf_hooks";
 import { createToolAuthorizer } from "./policy.mjs";
 
 const MAX_APPLICATIONS = 1000;
@@ -13,7 +14,7 @@ const APP_NAME_PATTERN = /^[^\0\r\n]{1,300}$/;
 const DEFAULT_APPLICATION_CACHE_MS = 30_000;
 
 export class AppAutomationManager {
-  constructor({ policy, authorizeTool = null, displayPath, runProcess, readResourceText, throwIfCancelled = () => {}, platform = process.platform, home = homedir(), applicationRoots = null, applicationCacheMs = DEFAULT_APPLICATION_CACHE_MS, now = () => Date.now() }) {
+  constructor({ policy, authorizeTool = null, displayPath, runProcess, readResourceText, throwIfCancelled = () => {}, platform = process.platform, home = homedir(), applicationRoots = null, applicationCacheMs = DEFAULT_APPLICATION_CACHE_MS, now = () => performance.now() }) {
     this.policy = policy || {};
     this.authorizeTool = createToolAuthorizer(this.policy, authorizeTool);
     this.displayPath = displayPath;

package/src/local/call-registry.mjs

@@ -1,10 +1,11 @@
 import { randomBytes } from "node:crypto";
+import { performance } from "node:perf_hooks";
 import { BridgeError } from "./errors.mjs";
 
 export class CallRegistry {
   constructor(options = {}) {
     this.maximum = positiveInteger(options.maximum, 16);
-    this.now = typeof options.now === "function" ? options.now : Date.now;
+    this.now = typeof options.now === "function" ? options.now : () => performance.now();
     this.scheduler = options.scheduler || { setTimeout, clearTimeout };
     this.onCancel = typeof options.onCancel === "function" ? options.onCancel : () => {};
     this.onFinish = typeof options.onFinish === "function" ? options.onFinish : () => {};

package/src/local/cli.mjs

@@ -1,10 +1,11 @@
 import { createHmac } from "node:crypto";
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import path, { join, resolve } from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalRuntime } from "./runtime.mjs";
 import { acquireDaemonLockWithTakeover, inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { inspectProcessInstance } from "./process-identity.mjs";
 import { runStdioServer } from "./stdio.mjs";
 import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./tools.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";

package/src/local/daemon-process.mjs

@@ -6,6 +6,7 @@ import {
   readDaemonLockOwner,
   resolveWorkspace,
 } from "./state.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { inspectProcessInstance, isPidAlive, processCommandLine, splitProcessCommandLine } from "./process-identity.mjs";
 
 const DEFAULT_TAKEOVER_TIMEOUT_MS = 15_000;
@@ -33,7 +34,7 @@ export async function acquireDaemonLockWithTakeover(state, options = {}) {
 
   // A terminated daemon can release its token immediately before the filesystem
   // makes the lock removal visible to this process. Retry only this handoff.
-  const handoffDeadline = Date.now() + Math.min(timeoutMs, 1_000);
+  const handoffDeadline = createMonotonicDeadline(Math.min(timeoutMs, 1_000));
   do {
     lock = acquireDaemonLock(state, ownerMetadata);
     if (lock.acquired) {
@@ -41,8 +42,8 @@ export async function acquireDaemonLockWithTakeover(state, options = {}) {
       return lock;
     }
     if (lock.owner?.pid && isPidAlive(lock.owner.pid)) return lock;
-    await sleep(Math.min(pollMs, Math.max(1, handoffDeadline - Date.now())));
-  } while (Date.now() < handoffDeadline);
+    await sleep(Math.min(pollMs, Math.max(1, handoffDeadline.remainingMs())));
+  } while (!handoffDeadline.expired());
   return lock;
 }
 
@@ -50,7 +51,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
   const timeoutMs = boundedPositiveInt(options.timeoutMs, DEFAULT_TAKEOVER_TIMEOUT_MS);
   const pollMs = boundedPositiveInt(options.pollMs, DEFAULT_TAKEOVER_POLL_MS);
   const logger = options.logger || { info() {}, warn() {} };
-  const deadline = Date.now() + timeoutMs;
+  const deadline = createMonotonicDeadline(timeoutMs);
   const signalled = new Set();
   let owner = options.owner || readDaemonLockOwner(daemonLockPathForState(state));
   let verified = false;
@@ -96,7 +97,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
     const currentOwnerAlive = Boolean(owner?.pid && isPidAlive(owner.pid));
     if (!currentOwnerAlive && liveSignalled.length === 0) break;
 
-    if (Date.now() >= deadline) {
+    if (deadline.expired()) {
       logger.warn?.(`detached background daemon did not stop within ${Math.ceil(timeoutMs / 1000)} seconds`);
       const remainingPid = Number(owner?.pid) || liveSignalled[0] || null;
       return {
@@ -111,7 +112,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
         version: typeof lastOwner?.version === "string" ? lastOwner.version : "unknown",
       };
     }
-    await sleep(Math.min(pollMs, Math.max(1, deadline - Date.now())));
+    await sleep(Math.min(pollMs, Math.max(1, deadline.remainingMs())));
     owner = readDaemonLockOwner(daemonLockPathForState(state));
   }
 

package/src/local/full-access-test.mjs

@@ -2,6 +2,7 @@ import { chmod, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import process from "node:process";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { LocalRuntime } from "./runtime.mjs";
 import { generateSshKeyPair } from "./ssh-key.mjs";
 import { runExecutable } from "./shell.mjs";
@@ -178,8 +179,8 @@ export async function runFullAccessTest({ workspace, policy = policyProfile("ful
 }
 
 async function waitForJob(manager, jobId, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
+  const deadline = createMonotonicDeadline(timeoutMs);
+  while (!deadline.expired()) {
     const value = manager.read({ job_id: jobId });
     if (TERMINAL_JOB_STATES.has(value.status)) return value;
     await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));

package/src/local/job-runner.mjs

@@ -2,9 +2,11 @@ import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
+import { performance } from "node:perf_hooks";
 import { executionEnv } from "./shell.mjs";
 import { terminateProcessTree } from "./process-sessions.mjs";
 import { createExclusiveFileSync, removeOwnedJsonFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { currentProcessStartTimeMs } from "./process-identity.mjs";
 import { readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -66,8 +68,8 @@ try {
 async function releaseRecoveryClaim() {
   if (!/^[a-f0-9]{32}$/.test(recoveryLockToken)) throw new Error("recovery runner is missing its ownership token");
   const file = join(jobDir, "recovery.lock");
-  const deadline = Date.now() + 5000;
-  while (Date.now() < deadline) {
+  const deadline = createMonotonicDeadline(5000);
+  while (!deadline.expired()) {
     if (removeOwnedJsonFileSync(file, { pid: process.pid, token: recoveryLockToken })) return;
     await new Promise((resolvePromise) => setTimeout(resolvePromise, 10));
   }
@@ -224,7 +226,7 @@ async function runStep(step, index, phase, plan, resourceContext, cancellationAw
     : step.stdin === null || step.stdin === undefined
       ? null
       : Buffer.from(step.stdin, "utf8");
-  const started = Date.now();
+  const started = performance.now();
   const raw = await spawnStep(argv, {
     cwd: step.cwd,
     env,
@@ -242,7 +244,7 @@ async function runStep(step, index, phase, plan, resourceContext, cancellationAw
     code: raw.code,
     signal: raw.signal,
     timed_out: raw.timedOut,
-    duration_ms: Date.now() - started,
+    duration_ms: performance.now() - started,
     stdout: step.capture_output === "discard" ? "" : redactOutput(raw.stdout, resourceContext),
     stderr: step.capture_output === "discard" ? "" : redactOutput(raw.stderr, resourceContext),
     output_discarded: step.capture_output === "discard",

package/src/local/monotonic-deadline.mjs

@@ -0,0 +1,30 @@
+import { performance } from "node:perf_hooks";
+
+export function createMonotonicDeadline(timeoutMs, now = () => performance.now()) {
+  const durationMs = Number(timeoutMs);
+  if (!Number.isFinite(durationMs) || durationMs < 0) throw new TypeError("timeoutMs must be a finite non-negative number");
+  let lastSample = readSample(now);
+  const startedAt = lastSample;
+
+  function elapsedMs() {
+    const sample = readSample(now);
+    if (sample > lastSample) lastSample = sample;
+    return Math.max(0, lastSample - startedAt);
+  }
+
+  return Object.freeze({
+    expired() {
+      return elapsedMs() >= durationMs;
+    },
+    remainingMs() {
+      return Math.max(0, durationMs - elapsedMs());
+    },
+    elapsedMs,
+  });
+}
+
+function readSample(now) {
+  const value = Number(now());
+  if (!Number.isFinite(value)) throw new TypeError("monotonic clock returned a non-finite value");
+  return value;
+}

package/src/local/process-sessions.mjs

@@ -3,6 +3,7 @@ import { randomBytes } from "node:crypto";
 import { basename } from "node:path";
 import { executionEnv } from "./shell.mjs";
 import { createToolAuthorizer } from "./policy.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { clampInteger } from "./numbers.mjs";
 
 export const MAX_COMMAND_BYTES = 64 * 1024;
@@ -120,10 +121,10 @@ export class ProcessSessionManager {
     this.throwIfCancelled(context);
     const waitForExit = args.wait_for_exit === true;
     if (waitMs > 0 && session.closedAt === null) {
-      const deadline = Date.now() + waitMs;
+      const deadline = createMonotonicDeadline(waitMs);
       if (waitForExit) {
-        while (session.closedAt === null && Date.now() < deadline) {
-          await waitForSessionChange(session, Math.max(1, deadline - Date.now()), () => this.throwIfCancelled(context));
+        while (session.closedAt === null && !deadline.expired()) {
+          await waitForSessionChange(session, Math.max(1, deadline.remainingMs()), () => this.throwIfCancelled(context));
         }
       } else if (!sessionHasOutputAfter(session, stdoutOffset, stderrOffset)) {
         await waitForSessionChange(session, waitMs, () => this.throwIfCancelled(context));

package/src/local/shell.mjs

@@ -113,13 +113,16 @@ function capturedResult(code, stdout, stderr, extraStderr = "") {
   };
 }
 
-function findWranglerCommand() {
-  const suffix = process.platform === "win32" ? ".cmd" : "";
-  return { cmd: path.join(packageRoot, "node_modules", ".bin", `wrangler${suffix}`), argsPrefix: [] };
+export function wranglerCommand(options = {}) {
+  const root = path.resolve(String(options.packageRoot || packageRoot));
+  const node = path.resolve(String(options.node || process.execPath));
+  const script = path.join(root, "node_modules", "wrangler", "bin", "wrangler.js");
+  if (!existsSync(script)) throw new Error(`Wrangler JavaScript entrypoint is missing: ${script}`);
+  return { cmd: node, argsPrefix: [script] };
 }
 
 export async function runWrangler(args, options = {}) {
-  const wrangler = findWranglerCommand();
+  const wrangler = wranglerCommand();
   const operation = String(args[0] || "");
   const timeoutMs = options.timeoutMs ?? (operation === "login" || operation === "deploy" ? 10 * 60 * 1000 : 2 * 60 * 1000);
   return runExecutable(wrangler.cmd, [...wrangler.argsPrefix, ...args], { cwd: packageRoot, timeoutMs, ...options });

package/src/local/state.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
 import { replaceFileSync } from "./atomic-fs.mjs";
 import { createExclusiveFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -266,9 +267,9 @@ export async function acquireStartupLockWithWait(state, options = {}) {
   if (lock.acquired) return lock;
   const ownerPid = lock.owner?.pid ? `pid ${lock.owner.pid}` : "another process";
   logger.info?.(`waiting for ${ownerPid} to finish the current startup/state operation`);
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline - Date.now()))));
+  const deadline = createMonotonicDeadline(timeoutMs);
+  while (!deadline.expired()) {
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline.remainingMs()))));
     lock = acquireStartupLock(state, metadata);
     if (lock.acquired) {
       logger.info?.("the previous startup/state operation finished; continuing");

package/src/local/tool-executor.mjs

@@ -1,3 +1,4 @@
+import { performance } from "node:perf_hooks";
 import { errorCode, normalizeBridgeError } from "./errors.mjs";
 
 export class ToolExecutor {
@@ -60,7 +61,7 @@ function lifecycleMiddleware(callRegistry) {
 
 function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
   return async (operation, next) => {
-    const started = Date.now();
+    const started = performance.now();
     observability.start(operation.tool);
     logger.event?.("debug", "tool.call.started", {
       call_id: shortCallId(operation.context.callId),
@@ -69,7 +70,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
     });
     try {
       const result = await next(operation);
-      const durationMs = Date.now() - started;
+      const durationMs = performance.now() - started;
       const slow = durationMs >= slowMs;
       observability.finish(operation.tool, { status: "completed", durationMs, slow });
       logger.event?.("debug", slow ? "tool.call.slow" : "tool.call.completed", {
@@ -78,7 +79,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       return result;
     } catch (error) {
       const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args) });
-      const durationMs = Date.now() - started;
+      const durationMs = performance.now() - started;
       const code = errorCode(normalized);
       const status = code === "cancelled" ? "cancelled" : code === "timeout" ? "timeout" : "failed";
       observability.finish(operation.tool, { status, durationMs, errorCode: code, slow: durationMs >= slowMs });

package/src/worker/index.ts

@@ -22,7 +22,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.0";
+const SERVER_VERSION = "1.0.2";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";

package/src/worker/observability.ts

@@ -3,7 +3,7 @@ const MAX_TOOLS = 128;
 const SENSITIVE_FIELD = /(?:authorization|cookie|credential|password|secret|token|verifier|private[_-]?key)/i;
 
 export class WorkerObservability {
-  private readonly startedAt = Date.now();
+  private readonly startedAt = performance.now();
   private readonly requests = { total: 0, successful: 0, client_error: 0, server_error: 0 };
   private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, disconnected: 0, protocol_errors: 0 };
@@ -49,7 +49,7 @@ export class WorkerObservability {
 
   snapshot(): Record<string, unknown> {
     return {
-      uptime_ms: Math.max(0, Date.now() - this.startedAt),
+      uptime_ms: Math.max(0, performance.now() - this.startedAt),
       requests: { ...this.requests },
       calls: { ...this.calls },
       sockets: { ...this.sockets },

package/src/worker/pending-calls.ts

@@ -53,7 +53,7 @@ export class PendingCallRegistry {
     if (input.clientRequestKey && this.byRequestKey.has(input.clientRequestKey)) {
       throw new PendingCallRegistrationError("conflict", "duplicate in-flight JSON-RPC request id within this MCP session");
     }
-    const startedAt = Date.now();
+    const startedAt = performance.now();
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         const record = this.take(input.id);
@@ -111,7 +111,7 @@ export class PendingCallRegistry {
   }
 
   snapshot(): { active: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
-    const now = Date.now();
+    const now = performance.now();
     const byTool: Record<string, number> = {};
     let oldestMs = 0;
     for (const record of this.byId.values()) {