machine-bridge-mcp 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.0.3 - 2026-07-14
+
+### Code-scanning and supply-chain integrity
+
+- Fix the SARIF gate so results with omitted rule metadata fail closed instead of being silently classified as non-security. Remove stale broad CodeQL exceptions, harden the generic process boundary with a fixed-option non-shell `child_process.spawn` wrapper and behavior regression, and retain only one exact, expiring false-positive record for that intentional authority boundary.
+- Gate OpenSSF Scorecard SARIF before upload. Replace mutable npm bootstrap commands with an exact npm 12.0.1 tarball plus pinned SHA-512 verification, make the source wrapper use `npm ci`, and convert randomized security properties to a deterministic `fast-check` `.js` suite recognized by the pinned Scorecard scanner, and separate the signed Scorecard analysis job from the failing SARIF gate job required by the action's workflow-verification rules.
+- Record only four expiring Scorecard governance/time exceptions that cannot be repaired by source code alone, reject remediable pinning/fuzzing exceptions, and require exact-commit CI, CodeQL, Governance, and Scorecard success before creating a source release.
+
+## 1.0.2 - 2026-07-14
+
+### Deadline and architecture integrity
+
+- Replace wall-clock arithmetic in startup-lock waits, verified daemon takeover/stop, process-session exit waits, managed-job recovery-lock handoff, full-access diagnostics, browser waits, page actionability/stability checks, application-discovery cache freshness, and local/Worker duration metrics with monotonic elapsed time. System clock rollback can no longer extend these bounded state machines, and a forward correction cannot force premature timeout; persisted expiry and retention timestamps remain wall-clock based.
+- Add deterministic clock-fault regressions at the shared deadline primitive, startup-lock production path, and browser-extension production path, and make the deadline suite a mandatory part of `npm run check`.
+- Correct stale architecture claims after the state-schema-6 and named-account releases: remote tokens are bound to named account principals and roles, duplicate JSON-RPC ids are scoped to one signed MCP session, and application-level account isolation is distinguished from OS/browser tenancy. Architecture tests reject a return to the obsolete statements.
+
 ## 1.0.1 - 2026-07-14
 
 ### Startup and release-gate reliability

package/CONTRIBUTING.md

@@ -26,7 +26,7 @@ Before the reviewed code is pushed to `main`:
 4. inspect the complete diff and the npm package manifest;
 5. commit and push the reviewed change to GitHub.
 
-After all required pull-request checks pass, repository automation completes the source release under [AGENTS.md](AGENTS.md): squash-merge through local `gh`, verify the exact `main` push CI, create the annotated version tag, and create or update the matching final GitHub Release. The release operator separately publishes the same version to npm and performs any live machine update. Automation must not publish, deprecate, or unpublish npm packages; install the CLI globally; deploy the Worker; rotate credentials; mutate live deployment state; or start/stop/install/remove the daemon or autostart service without explicit user authorization.
+After all required pull-request checks pass, repository automation completes the source release under [AGENTS.md](AGENTS.md): squash-merge through local `gh`, verify the exact `main` push CI, CodeQL, Governance, and Scorecard runs, create the annotated version tag, and create or update the matching final GitHub Release. The release operator separately publishes the same version to npm and performs any live machine update. Automation must not publish, deprecate, or unpublish npm packages; install the CLI globally; deploy the Worker; rotate credentials; mutate live deployment state; or start/stop/install/remove the daemon or autostart service without explicit user authorization.
 
 After npm publication, the standard machine update is:
 

package/SECURITY.md

@@ -23,7 +23,7 @@ Tests, examples, documentation, release notes, and package metadata are publicat
 
 Removing a value from the current branch does not remove it from Git history, caches, forks, or an already published npm package. Rotate any exposed credential immediately and coordinate destructive history rewriting separately when its risk is justified.
 
-CodeQL is enforced as a security gate, not merely uploaded as advisory output. The workflow parses generated SARIF and rejects every security-tagged result unless `.github/codeql-accepted-findings.json` contains the exact rule and path, a substantive authority-boundary rationale, and a non-expired review date. Rule-wide suppression is not an acceptable substitute.
+CodeQL and OpenSSF Scorecard are enforced as gates, not merely uploaded as advisory output. The shared SARIF gate rejects every security result and fails closed when a result omits the rule metadata needed to prove it non-security. Any exception requires an exact rule/path entry, a substantive rationale, and a non-expired review date; rule-wide suppression is not acceptable. CodeQL has one exact, expiring accepted result for the authorized non-shell direct-process boundary; its fixed option set and metacharacter behavior are tested. Scorecard exceptions are limited to documented governance or time-dependent conditions that repository code cannot truthfully repair, while remediable dependency-pinning and fuzzing findings remain release-blocking.
 
 ## Core trust model
 

package/browser-extension/browser-operations.js

@@ -58,9 +58,10 @@
   
   async function browserWait(params, state) {
     const tab = await resolveTab(params.tabId);
-    const deadline = Date.now() + Math.max(1, Number(params.timeoutMs) || 30000);
+    const timeoutMs = Math.max(1, Number(params.timeoutMs) || 30000);
+    const startedAt = performance.now();
     let last = null;
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= timeoutMs) {
       throwIfCancelled(state);
       const current = await chrome.tabs.get(tab.id);
       const urlMatched = !params.urlContains || String(current.url || "").includes(params.urlContains);

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.0.1"
+  "version_name": "1.0.3"
 }

package/browser-extension/page-automation.js

@@ -310,9 +310,10 @@
   }
 
   async function waitForActionable(selector, actionName, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let lastProblem = "no element matched selector";
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       const element = findOne(selector);
       if (!element && selector?.ref) throw new Error("element reference is stale; inspect the page again");
       if (element) {
@@ -337,9 +338,10 @@
   }
 
   async function waitForStableBox(element, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let previous = boundingBox(element);
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       await delay(50);
       const current = boundingBox(element);
       if (current && previous && boxDistance(previous, current) <= 0.5) return current;
@@ -349,9 +351,10 @@
   }
 
   async function waitForPointerTarget(element, timeoutMs) {
-    const deadline = Date.now() + Math.max(1, timeoutMs);
+    const boundedTimeoutMs = Math.max(1, timeoutMs);
+    const startedAt = performance.now();
     let lastProblem = "element does not receive pointer events";
-    while (Date.now() <= deadline) {
+    while (performance.now() - startedAt <= boundedTimeoutMs) {
       const point = actionTarget(element).point;
       if (!point) lastProblem = "element has no usable viewport box";
       else if (point.x < 0 || point.y < 0 || point.x >= innerWidth || point.y >= innerHeight) lastProblem = "element is outside the viewport";

package/docs/ARCHITECTURE.md

@@ -20,7 +20,7 @@ No transport is treated as a sandbox. Both transports invoke the same local runt
 
 The CLI canonicalizes workspaces, resolves policy profiles, maintains per-workspace state and credentials, serializes startup/deploy/rotation with process-identity locks, deploys the Worker, installs optional platform-native autostart, and starts either remote daemon or stdio mode.
 
-A canonical workspace receives an independent profile, Worker name, secret set, resource registry, managed-job directory, daemon/startup locks, and state file. State schema version 5 records policy origin/revision and local resource metadata in addition to the capability fields. `exclusive-file.mjs` owns complete-before-visible exclusive claims and flushed atomic replacement. `process-identity.mjs` owns PID liveness, process start-time comparison, bounded command-line inspection, and PID-reuse classification. `service-lifecycle.mjs` owns the fail-closed stop-daemons-before-remove state machine shared by service removal and full uninstall.
+A canonical workspace receives an independent profile, Worker name, secret set, resource registry, managed-job directory, daemon/startup locks, and state file. State schema version 6 records named accounts, policy origin/revision, and local resource metadata in addition to the capability fields. `exclusive-file.mjs` owns complete-before-visible exclusive claims and flushed atomic replacement. `process-identity.mjs` owns PID liveness, process start-time comparison, bounded command-line inspection, and PID-reuse classification. `service-lifecycle.mjs` owns the fail-closed stop-daemons-before-remove state machine shared by service removal and full uninstall.
 
 ### Local runtime
 
@@ -140,7 +140,7 @@ flowchart LR
   CLI --> S[Autostart provider]
 ```
 
-Remote OAuth currently determines which registered client token may call tools; it does not distinguish independently authorized human principals. Local stdio access relies on the local process and configuration boundary. Policy determines which tools the local daemon and relay advertise. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
+Remote OAuth binds each code and token to a named Machine Bridge account, account version, and role, so accounts are independent application-level authorization principals. The Worker intersects that role with the connected daemon policy, and the local runtime enforces the relayed authorization again. This distinction is not operating-system tenancy: every account still reaches one daemon, workspace, browser profile, and OS user authority. Local stdio access relies on the local process and configuration boundary. A connector host can independently present a smaller tool subset to a session; this post-relay filtering is outside the protocol state visible to Machine Bridge. Canonical resolution limits direct filesystem tools. Processes retain local-user authority and can escape workspace constraints through their own code or system calls.
 
 ## Remote request lifecycle
 
@@ -158,7 +158,7 @@ Remote OAuth currently determines which registered client token may call tools;
 12. A matching cancellation notification removes the pending call, tells the daemon to cancel, and terminates any ordinary child processes bound to it.
 13. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
-Duplicate in-flight JSON-RPC IDs for the same access token are rejected so cancellation cannot ambiguously target multiple calls.
+Duplicate in-flight JSON-RPC IDs are rejected only within the same authenticated MCP session. The request key includes OAuth token identity, the HMAC-bound MCP session, JSON-RPC id type, and id value, so separate initialized clients may safely reuse the same numeric id.
 
 ## Stdio request lifecycle
 
@@ -204,7 +204,7 @@ This is a process-level transaction, not a filesystem-wide atomic transaction ac
 
 The default `full` profile passes the complete parent environment. Isolated environment mode, used by the narrower named profiles unless overridden, creates private runtime HOME, temporary, and cache directories and passes only a small set of path/locale/platform variables. It reduces accidental credential inheritance but cannot prevent explicit access to known filesystem paths, credential stores, network services, or other user resources.
 
-One-shot calls have bounded output and timeouts. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
+One-shot calls have bounded output and timeouts. Startup-lock waits, daemon takeover, process-session reads, managed-job recovery handoff, browser/page waits, application-cache freshness, and in-memory duration metrics use monotonic elapsed time, so wall-clock correction cannot extend or prematurely terminate their configured duration. Persisted timestamps and retention/credential expiry continue to use wall time. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
 
 Child processes run in a separate process group where supported. Timeout, cancellation, disconnect, and replacement send termination to process trees, with a referenced forced-escalation timer that remains alive even when the direct child exits before a resistant descendant. Windows uses tree-aware task termination.
 
@@ -260,4 +260,4 @@ Third-party workflow actions are pinned to immutable commit SHAs. Dependabot pro
 - model-level prompt-injection prevention or semantic validation of browser/application actions;
 - universal desktop UI automation beyond the implemented OS Accessibility backend;
 - scripting browser-internal/enterprise-blocked pages or inaccessible cross-origin frames;
-- isolated multi-user tenancy or per-principal authorization in one Worker deployment; multiple OAuth client registrations currently share one workspace authority.
+- operating-system or browser-profile isolation between mutually distrustful account principals in one Worker/daemon deployment; named accounts provide Worker/local authorization and targeted revocation, but all authorized roles still converge on one local OS user and workspace trust domain.

package/docs/AUDIT.md

@@ -1,6 +1,26 @@
 # Engineering and security audit
 
-This document records the cross-cutting audit initiated for version 0.12.0, the 0.12.2 cross-platform CI follow-up, and the 0.13.0 architecture/automatic-routing follow-up, the 0.15.0 daily-browser and cross-platform hardening review, and the 0.16.0 runtime-boundary review. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+This document records the cross-cutting audit initiated for version 0.12.0, its later architecture, browser, lifecycle, authorization, release-gate, and version 1 follow-ups, including the version 1.0.2 elapsed-time review and the version 1.0.3 code-scanning inventory correction. It complements, but does not replace, the continuously enforced contracts in `SECURITY.md`, `docs/ENGINEERING.md`, and the test suite.
+
+
+## 2026-07-14 version 1.0.3 code-scanning and supply-chain gate audit
+
+After npm 1.0.2 and the live Worker/daemon upgrade succeeded, GitHub still reported nine open code-scanning alerts on the exact released `main` commit: one current CodeQL command-boundary result and eight OpenSSF Scorecard results. This disproved the earlier assumption that green CodeQL and Scorecard jobs implied a clean code-scanning inventory. The CodeQL analysis API reported one result, while the repository gate reported zero because the SARIF emitted to the post-analysis step omitted `tool.driver.rules`; the gate treated missing rule metadata as proof that a result was non-security. Scorecard had no gate at all and uploaded every low-score result while the workflow remained successful.
+
+The process boundary now routes through an isolated `node:child_process.spawn` call that copies only four allowed options, enforces final `shell: false`, and has a production-path metacharacter regression. CodeQL 2.26.0 nevertheless classifies the environment-derived executable path as a shell-command sink even though no shell interprets either the executable or argv. After reproducing the complete flow and eliminating ambiguous option propagation, the repository retains one exact rule/path exception with a short expiry rather than broad command-execution suppressions. The SARIF gate now fails closed for every result whose rule metadata is absent. The same gate runs on Scorecard output before upload. Four remediable Scorecard findings are addressed: source bootstrap uses `npm ci`; CI obtains npm 12.0.1 from an exact registry URL, rejects redirects, verifies a pinned SHA-512 SRI, and exposes the verified CLI without a mutable global install; and the randomized security suite now uses deterministic `fast-check` properties in a `.js` file, matching the pinned Scorecard v5.3.0 detector's `*.js`/`*.jsx` scope. The Scorecard action remains in a signed analysis job containing only pinned `uses` steps; a dependent gate job downloads its SARIF, enforces the accepted inventory, and uploads the reviewed result.
+
+Four Scorecard findings remain explicitly reviewed rather than hidden: the repository is younger than ninety days, historical commits predate mandatory CodeQL, only one human maintainer is available for review, and OpenSSF Best Practices enrollment requires external maintainer attestations. Their exact rule/path exceptions carry short expiry dates, while `PinnedDependenciesID` and `FuzzingID` are forbidden from the accepted inventory. Release orchestration now verifies successful push-triggered CI, CodeQL, Governance, and Scorecard runs for the exact `main` commit instead of checking only the CI workflow. This closes the semantic gap between “a workflow ran” and “the security/governance evidence required for release passed.”
+
+
+## 2026-07-14 version 1.0.2 elapsed-time and documentation-integrity audit
+
+The review began from exact released commit `10931c11d7cdab1051018059fc461b73bb5505ff` (tag and npm version 1.0.1), with a clean worktree, zero high-severity npm audit findings, no open issue or pull request, and successful required Linux, macOS, Windows, governance, CodeQL, dependency-review, and Scorecard checks. The threat-model pass separated persisted wall-clock facts—token expiry, file age, retention, alarms, and operator timestamps—from in-memory elapsed durations.
+
+A confirmed lifecycle defect remained across otherwise bounded code paths: startup-lock acquisition, verified daemon takeover/stop, process-session exit waits, managed-job recovery-lock release, full-access diagnostics, and browser/page waits calculated deadlines from `Date.now()`. A backward system-clock correction could extend those state machines beyond their documented maximum, while a forward correction could trigger premature timeout. Application-discovery cache freshness and local/Worker duration metrics had the same clock-domain error, with lower impact. One shared Node monotonic-deadline primitive now owns bounded elapsed waits; browser contexts use their native monotonic `performance.now()`. Persisted timestamps deliberately remain wall-clock based. Deterministic tests freeze or roll back wall time while exercising the real startup-lock and extension wait paths, and the shared helper clamps anomalous backward samples.
+
+The same review confirmed architecture-documentation drift introduced by earlier releases. The document still named state schema 5 after schema 6, described OAuth tokens as lacking independently authorized human principals after named accounts and roles shipped, scoped duplicate request IDs to an entire access token after signed MCP sessions shipped, and listed per-principal authorization as absent. The corrected model distinguishes named application-level account principals and targeted revocation from OS/browser-profile tenancy: all authorized accounts still converge on one daemon, workspace, browser profile, and local OS user. Architecture tests now reject the obsolete statements.
+
+External comparison retained the existing conservative product boundary. Current MCP authorization and security guidance supports exact redirect/resource binding, PKCE S256, server-side authorization, and no token passthrough; the implementation already enforces those controls. Browser projects that expose arbitrary page scripts were not copied because Machine Bridge intentionally restricts callers to packaged structured operations. Remaining limits are explicit: a same-user malicious process, MCP host filtering, browser/OS enforcement, Cloudflare lifecycle behavior, and live deployment state are outside repository-only guarantees.
 
 
 ## 2026-07-14 version 1.0.1 installed-startup incident

package/docs/ENGINEERING.md

@@ -9,7 +9,7 @@ This document records project-wide decisions that must survive individual fixes,
 3. **Machine Bridge authority and host authority are separate.** `full` removes Machine Bridge's own policy, path, shell, and environment restrictions. It cannot override an MCP host, connector gateway, operating system, endpoint-security product, cloud IAM, remote authentication, or `sudo`.
 4. **Publication surfaces contain no real environment metadata.** Source, tests, fixtures, examples, release notes, filenames, package contents, tags, and release assets use synthetic identifiers and reserved example domains.
 5. **Secrets are never operational log data.** Tool arguments, command text, stdin, stdout, stderr, file content, OAuth bodies, credentials, and local resource values are not logged.
-6. **A release is one version with successful cross-platform evidence.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree, and the exact `origin/main` commit must have a completed successful push-triggered GitHub Actions run before a tag or release is created.
+6. **A release is one version with successful cross-platform evidence.** Package metadata, Worker version, browser-extension version/name, Git tag, GitHub Release, npm version, documentation, and deployed health version must agree, and the exact `origin/main` commit must have completed successful push-triggered CI, CodeQL, Governance, and OpenSSF Scorecard runs before a tag or release is created.
 7. **Generic local automation is structured, not arbitrary evaluation.** Browser/application features may expose broad user authority under canonical `full`, but must not accept caller-provided JavaScript, AppleScript, JXA, or extension code.
 8. **Daily-browser integration uses the existing profile.** The supported primary browser path is the packaged authenticated extension and machine-level loopback broker, preserving current tabs/login state; a separate automation profile is not an equivalent replacement.
 9. **Pairing and resource secrets are not conversation or log data.** Tokens and injected local-resource values must not be returned, embedded in URLs, or written to operational logs.
@@ -17,7 +17,7 @@ This document records project-wide decisions that must survive individual fixes,
 11. **Service and state removal are fail-closed state machines.** Stop the platform provider and every verified daemon before removing definitions or recursive state. An unreadable lock, failed stop, active job, or ambiguous identity retains state for diagnosis.
 12. **Read failure is not empty state.** Permission, type, symbolic-link, size, encoding, and I/O errors must propagate. Corrupt backup/reconstruction applies only after a successful read proves that JSON content is invalid.
 13. **The public protocol contract is current-only.** Shared metadata advertises only the current MCP protocol version. Compatibility code for obsolete protocol dates, lock formats, or state schemas is not retained in the final runtime; upgrade safety comes from explicit version negotiation, fail-closed state validation, and bounded operator convergence.
-14. **Security analysis is a failing gate.** CodeQL execution alone is not success. Generated SARIF must contain no unaccepted security result; an intentional authority boundary requires an exact rule/path record with a substantive rationale and an expiry date.
+14. **Security analysis is a failing gate.** CodeQL or Scorecard execution alone is not success. Generated SARIF must contain no unaccepted result, and missing rule metadata fails closed rather than being interpreted as non-security. An intentional or externally constrained finding requires an exact rule/path record with a substantive rationale and an expiry date.
 
 A proposed change that conflicts with an invariant requires an explicit owner decision and corresponding documentation update. It must not be hidden inside an unrelated refactor.
 
@@ -110,6 +110,7 @@ A higher branch count is acceptable only when the function is an explicit state
 - Preserve a stable coarse error class for automation and a concise human message for operators.
 - Do not retry an operation merely because it failed; retry only when the error is positively classified as transient and the operation is idempotent or server state is checked after ambiguity.
 - When a remote write may have succeeded before the response was lost, query authoritative state before repeating it.
+- Duration-based deadlines must use a monotonic clock. Wall time remains appropriate for persisted timestamps, credential expiry, retention, and operator-visible dates, but a system clock correction must not extend or prematurely terminate an in-process wait.
 - Timeouts must terminate the relevant process tree. Forced escalation must remain referenced until resistant descendants are handled; do not clear it merely because the direct child exited.
 - Half-open connections need liveness detection, not only periodic writes.
 - Lock reclamation must consider process liveness, process start time, absolute age, ownership token, and file identity to defend against PID reuse and replacement races.
@@ -126,7 +127,7 @@ Every defect fix includes a regression test that fails for the original reason.
 The required matrix includes:
 
 - Linux, macOS, and Windows on the pinned Node/npm baseline;
-- current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit release-CI gating;
+- current-tree and reachable-history privacy gates, release-impact enforcement, and exact-commit CI/CodeQL/Governance/Scorecard release gating;
 - package-manifest and sensitive-artifact inspection;
 - generated type checks and recursively discovered JavaScript/shell syntax checks;
 - static undefined-identifier/redeclaration checks over all production JavaScript, tests, scripts, and browser-extension code;
@@ -184,7 +185,7 @@ A thorough review asks:
 - Are persistent files atomic, owner-only, size-bounded, and symlink-aware?
 - Can browser/app automation be expressed without arbitrary evaluation, and are pairing/resource values absent from results and logs?
 - Can a stale PID, stale socket, duplicate request, partial write, or ambiguous remote response violate integrity?
-- Are package, CI, Worker, service, and release behavior tested on every supported platform, and does publication verify the exact successful push CI run?
+- Are package, CI, Worker, service, and release behavior tested on every supported platform, and does publication verify every required exact-commit push workflow?
 - Does the complete diff contain any real identifier, path, host, account, or credential-shaped value?
 - Does the change require a new npm version and deployment?
 

package/docs/OPERATIONS.md

@@ -73,7 +73,7 @@ Application UI inspection/actions require Accessibility permission for the Node/
 
 `machine-mcp` is a foreground command. It remains attached to the terminal, defaults to `info` logging, and stops on `Ctrl+C`. `machine-mcp service start` launches the installed platform service in the background and returns to the shell; that service uses `warn` logging.
 
-A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd, systemd, or Task Scheduler no longer tracks. Only current lock records containing service mode, version, PID, process start time, entrypoint, workspace, and state root are eligible for takeover. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and does not add a later forced-kill escalation. On POSIX, a daemon that handles and ignores `SIGTERM` therefore reaches the bounded timeout and remains alive. Node maps the supported termination signals to immediate process termination on Windows, so the same verified-daemon stop normally completes rather than exercising the POSIX timeout branch. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
+A global npm install changes the CLI files on disk but does not replace an already running Node process. Startup and other state-changing CLI operations use a token/process-identity lock and wait up to 30 seconds for a normal concurrent startup to finish; duration limits use monotonic elapsed time, so NTP or manual wall-clock correction does not lengthen or shorten the wait; a short launchd/systemd overlap is therefore serialized rather than reported immediately as an error. On a normal foreground start, Machine Bridge unloads the platform service and then independently examines the workspace daemon lock. This second path handles a detached/orphan `--daemon-only` process that launchd, systemd, or Task Scheduler no longer tracks. Only current lock records containing service mode, version, PID, process start time, entrypoint, workspace, and state root are eligible for takeover. Before sending `SIGTERM`, Machine Bridge verifies PID and process start time plus the live command line, entrypoint, canonical workspace, canonical state root, and daemon-only flag. It waits up to 15 seconds for both the PID and lock to disappear and does not add a later forced-kill escalation. On POSIX, a daemon that handles and ignores `SIGTERM` therefore reaches the bounded timeout and remains alive. Node maps the supported termination signals to immediate process termination on Windows, so the same verified-daemon stop normally completes rather than exercising the POSIX timeout branch. A foreground or unverifiable process is left untouched; stop a foreground instance with `Ctrl+C`.
 
 `machine-mcp service status [WORKSPACE]` reports two independent layers: the platform service (`active`) and `workspace_daemon`, plus `effective_active` and `orphaned_workspace_daemon` summary flags. On macOS it is possible for launchd to report inactive while a prior Node process remains alive with parent PID 1; that is an orphan-daemon condition, not proof that the daemon stopped. `service stop` unloads the provider when present and then terminates only a verified service-style workspace daemon. `service uninstall` and full uninstall are ordered fail-closed operations: provider stop → verified daemon stop(s) → definition removal. A failed or ambiguous stop leaves definitions and state intact. If takeover reaches its deadline, run:
 
@@ -219,7 +219,7 @@ Defense-in-depth limits include:
 - local simultaneous tool calls: 16;
 - Worker pending daemon calls: 32;
 - command timeout: 1–600 seconds;
-- process-session read wait: at most 30 seconds;
+- process-session read wait: at most 30 seconds, measured with monotonic elapsed time;
 - direct directory result: 10,000 entries and 4 MiB of path metadata;
 - recursive walk: 200,000 visited entries;
 - managed jobs: 50 retained, seven-day retention;

package/docs/PROJECT_STANDARDS.md

@@ -114,9 +114,9 @@ Flaky tests are defects. A retry may diagnose environmental instability but may
 
 - GitHub workflow permissions default to read-only and are expanded per job only when required.
 - Third-party Actions are pinned to immutable commit SHAs and reviewed when Dependabot updates them.
-- npm dependencies use exact versions and a committed lockfile. Registry signatures and attestations are verified in CI.
-- Dependency review blocks newly introduced vulnerable dependencies. CodeQL performs JavaScript/TypeScript and workflow analysis. OpenSSF Scorecard periodically audits repository supply-chain posture.
-- CI generates and validates a CycloneDX SBOM. Release artifacts must be reproducible from a reviewed commit and tied to successful exact-commit CI evidence.
+- npm dependencies use exact versions and a committed lockfile. Source bootstrap uses `npm ci`; the CI npm baseline itself is downloaded from an exact URL and verified against a pinned SHA-512 SRI before use. Registry signatures and attestations are verified in CI.
+- Dependency review blocks newly introduced vulnerable dependencies. CodeQL performs JavaScript/TypeScript and workflow analysis. OpenSSF Scorecard audits supply-chain posture, and both SARIF streams are failing gates with exact, expiring exceptions rather than advisory-only uploads.
+- CI generates and validates a CycloneDX SBOM. Release artifacts must be reproducible from a reviewed commit and tied to successful exact-commit CI, CodeQL, Governance, and Scorecard evidence.
 - Secret scanning and push protection are enabled. Repository examples use synthetic identities and reserved domains; reachable history is scanned before release.
 - Long-lived publication tokens should be replaced by npm trusted publishing with GitHub OIDC. Until that external registry configuration is completed, release credentials remain an explicit operator responsibility and must never be stored in the repository.
 - Security reports follow [SECURITY.md](../SECURITY.md), not public issue templates.

package/docs/TESTING.md

@@ -20,10 +20,10 @@ The suite includes:
 - recursive syntax validation for every JavaScript file under the shipped/runtime/test roots plus the shell wrapper;
 - shared tool-catalog schema, annotation, and profile-inventory checks;
 - default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, `.agents/skills` and `.codex/skills` compatibility discovery, live project/skill rescanning and fingerprints, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, runtime-keyed routing-telemetry privacy, and execution-profile denial;
-- concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, and bounded startup-lock waiting;
+- concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, bounded startup-lock waiting, and wall-clock rollback injection proving duration deadlines remain monotonic;
 - foreground takeover of active and orphaned background daemons with current service-lock metadata, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
 - fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results;
-- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, installed-application discovery caching, and name-based task matching;
+- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, frozen-wall-clock browser deadline coverage, installed-application discovery caching, and name-based task matching;
 - relay environment-proxy direct/bypass/agent selection, unsupported proxy rejection, fail-fast invalid configuration, and route observability without endpoint or credential disclosure;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;
@@ -89,7 +89,7 @@ npm run version:check
 npm run release-impact:check
 ```
 
-GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI explicitly disables setup-node's automatic package-manager cache and upgrades npm from the runner temporary directory before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job scans reachable Git history, audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. Separate pinned workflows validate governance titles, review dependency changes, run CodeQL over JavaScript/TypeScript and GitHub Actions, fail on unaccepted security-tagged SARIF results, and publish OpenSSF Scorecard results. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Third-party Actions are pinned to immutable 40-character commit SHAs; architecture tests reject movable tags, and Dependabot monitors both action and dependency updates.
+GitHub Actions executes the main suite on Linux, macOS, and Windows using the pinned Node 26/npm 12 baseline. Because Node 26 currently bundles npm 11, CI downloads the exact npm 12.0.1 tarball from the canonical registry, rejects redirects, verifies its recorded SHA-512 SRI, and exposes that verified CLI through `GITHUB_PATH` before any project-local npm command can trigger strict `devEngines`. Checkout fetches version tags so the release-impact gate can compare the branch with the latest release. A separate package-audit job scans reachable Git history, audits both the complete dependency graph and the production-only graph, verifies registry signatures and attestations, validates a CycloneDX SBOM written under the runner temporary directory, exercises the documented isolated global installation, then performs a dry-run package build. Separate pinned workflows validate governance titles, review dependency changes, run CodeQL over JavaScript/TypeScript and GitHub Actions, and run OpenSSF Scorecard. The SARIF gate fails closed when rule metadata is absent, CodeQL permits only one exact, expiring non-shell process-boundary result, and Scorecard permits only exact reviewed governance/time-dependent findings; new dependency-pinning, fuzzing, or other supply-chain results fail before upload. Scorecard's signed analysis job contains only pinned `uses` steps, while a dependent gate job downloads the SARIF, enforces the accepted inventory, and uploads it to code scanning. Security property tests use a `.js` `fast-check` suite with deterministic seeds because the pinned Scorecard scanner recognizes JavaScript property testing only in `*.js`/`*.jsx`. The macOS matrix job also runs the installation smoke test because Wrangler's optional `fsevents` resolution is platform-specific. Third-party Actions are pinned to immutable 40-character commit SHAs; architecture tests reject movable tags, and Dependabot monitors both action and dependency updates. Source release creation additionally requires successful push-triggered CI, CodeQL, Governance, and Scorecard runs for the exact `main` commit.
 
 ## Test design rules
 

package/mbm

@@ -4,6 +4,6 @@ DIR=$(CDPATH= cd "$(dirname "$0")" && pwd)
 cd "$DIR"
 if [ ! -d node_modules ] || [ ! -x node_modules/.bin/wrangler ]; then
   echo "Installing local dependencies..."
-  npm install
+  npm ci
 fi
 exec node bin/machine-mcp.mjs "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -102,10 +102,11 @@
     "tool-docs:check": "node scripts/generate-tool-reference.mjs --check",
     "account:test": "node tests/account-admin-test.mjs",
     "sarif-security:test": "node tests/sarif-security-gate-test.mjs",
-    "security-properties:test": "node tests/security-properties-test.mjs",
+    "security-properties:test": "node tests/security-properties-test.js",
     "lint": "eslint eslint.config.mjs bin src/local scripts tests browser-extension",
     "lint:test": "node tests/lint-gate-test.mjs",
-    "shell:test": "node tests/shell-test.mjs"
+    "shell:test": "node tests/shell-test.mjs",
+    "deadline:test": "node tests/monotonic-deadline-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",
@@ -116,6 +117,7 @@
   "devDependencies": {
     "@types/node": "26.1.1",
     "eslint": "10.7.0",
+    "fast-check": "4.9.0",
     "globals": "17.7.0",
     "typescript": "7.0.2"
   },

package/scripts/github-release.mjs

@@ -10,7 +10,7 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { runNetworkCommand } from "./network-retry.mjs";
-import { requireSuccessfulCiRun } from "./release-ci.mjs";
+import { requireSuccessfulWorkflowRun } from "./release-ci.mjs";
 import { tagSyncError } from "./release-state.mjs";
 import { fileURLToPath } from "node:url";
 
@@ -126,28 +126,38 @@ function remoteTagCommit(tag) {
 }
 
 function assertSuccessfulCi(head) {
-  const text = outputNetwork("gh", [
-    "run",
-    "list",
-    "--workflow",
-    ".github/workflows/ci.yml",
-    "--commit",
-    head,
-    "--event",
-    "push",
-    "--limit",
-    "20",
-    "--json",
-    "databaseId,status,conclusion,headSha,event,createdAt,url",
-  ]);
-  let runs;
-  try { runs = JSON.parse(text); }
-  catch { fail("GitHub Actions did not return valid JSON"); }
-  let run;
-  try { run = requireSuccessfulCiRun(runs, head); }
-  catch (error) { fail(String(error?.message || error)); }
-  console.log(`GitHub Actions CI succeeded for ${head} (run ${run.databaseId}).`);
-  return run;
+  const required = [
+    [".github/workflows/ci.yml", "CI"],
+    [".github/workflows/codeql.yml", "CodeQL"],
+    [".github/workflows/governance.yml", "Governance"],
+    [".github/workflows/scorecard.yml", "OpenSSF Scorecard"],
+  ];
+  const verified = [];
+  for (const [workflow, name] of required) {
+    const text = outputNetwork("gh", [
+      "run",
+      "list",
+      "--workflow",
+      workflow,
+      "--commit",
+      head,
+      "--event",
+      "push",
+      "--limit",
+      "20",
+      "--json",
+      "databaseId,status,conclusion,headSha,event,createdAt,url",
+    ]);
+    let runs;
+    try { runs = JSON.parse(text); }
+    catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    let run;
+    try { run = requireSuccessfulWorkflowRun(runs, head, name); }
+    catch (error) { fail(String(error?.message || error)); }
+    console.log(`GitHub Actions ${name} succeeded for ${head} (run ${run.databaseId}).`);
+    verified.push(run);
+  }
+  return verified;
 }
 
 function releaseInfo(tag) {

package/scripts/prepare-pinned-npm.mjs

@@ -0,0 +1,97 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const NPM_VERSION = "12.0.1";
+const NPM_TARBALL_URL = "https://registry.npmjs.org/npm/-/npm-12.0.1.tgz";
+const NPM_TARBALL_INTEGRITY = "sha512-L5T9i/YAQWQWqTS/xZxJkei/9zcu99hCeE4qi41IyBVV7mRQad3qc2JfuOktwmH+qwGI/V2rbCL+/UYxb1+RQA==";
+const MAX_TARBALL_BYTES = 20 * 1024 * 1024;
+
+const githubPath = process.env.GITHUB_PATH;
+if (!githubPath) throw new Error("GITHUB_PATH is required; this bootstrap is intended for GitHub Actions");
+
+const root = mkdtempSync(join(process.env.RUNNER_TEMP || tmpdir(), "mbm-npm-bootstrap-"));
+try {
+  const archive = join(root, `npm-${NPM_VERSION}.tgz`);
+  const extracted = join(root, "extracted");
+  const bin = join(root, "bin");
+  mkdirSync(extracted, { recursive: true });
+  mkdirSync(bin, { recursive: true });
+
+  const response = await fetch(NPM_TARBALL_URL, { redirect: "error" });
+  if (!response.ok) throw new Error(`failed to download pinned npm tarball: HTTP ${response.status}`);
+  const declaredBytes = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredBytes) && declaredBytes > MAX_TARBALL_BYTES) throw new Error("pinned npm tarball exceeds 20 MiB");
+  const bytes = await readBoundedBody(response, MAX_TARBALL_BYTES);
+  verifyIntegrity(bytes, NPM_TARBALL_INTEGRITY);
+  writeFileSync(archive, bytes, { mode: 0o600 });
+
+  run("tar", ["-xzf", archive, "-C", extracted]);
+  const cli = join(extracted, "package", "bin", "npm-cli.js");
+  const version = run(process.execPath, [cli, "--version"], { capture: true }).trim();
+  if (version !== NPM_VERSION) throw new Error(`pinned npm tarball reported ${version}, expected ${NPM_VERSION}`);
+
+  const posixWrapper = join(bin, "npm");
+  writeFileSync(posixWrapper, `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(cli)} "$@"\n`, { mode: 0o755 });
+  chmodSync(posixWrapper, 0o755);
+  writeFileSync(join(bin, "npm.cmd"), `@echo off\r\n"${cmdQuote(process.execPath)}" "${cmdQuote(cli)}" %*\r\n`);
+  writeFileSync(githubPath, `${bin}\n`, { flag: "a" });
+  console.log(`Prepared integrity-verified npm ${NPM_VERSION} at ${bin}`);
+} catch (error) {
+  rmSync(root, { recursive: true, force: true });
+  throw error;
+}
+
+
+async function readBoundedBody(response, maximumBytes) {
+  if (!response.body) throw new Error("pinned npm tarball response has no body");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maximumBytes) throw new Error("pinned npm tarball exceeds 20 MiB");
+      chunks.push(Buffer.from(value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, total);
+}
+
+function verifyIntegrity(bytes, integrity) {
+  const match = /^sha512-(.+)$/.exec(integrity);
+  if (!match) throw new Error("pinned npm integrity must be SHA-512 SRI");
+  const actual = createHash("sha512").update(bytes).digest();
+  const expected = Buffer.from(match[1], "base64");
+  if (actual.length !== expected.length || !actual.equals(expected)) throw new Error("pinned npm tarball failed SHA-512 verification");
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: options.capture ? "utf8" : undefined,
+    stdio: options.capture ? ["ignore", "pipe", "pipe"] : "inherit",
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = options.capture ? String(result.stderr || result.stdout || "").trim() : "";
+    throw new Error(`${command} exited ${result.status}${detail ? `: ${detail}` : ""}`);
+  }
+  return options.capture ? String(result.stdout || "") : "";
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'\\''`)}'`;
+}
+
+function cmdQuote(value) {
+  const text = String(value);
+  if (/[\0\r\n"%&|<>^!]/.test(text)) throw new Error("Windows wrapper path contains an unsupported character");
+  return text;
+}

package/scripts/release-ci.mjs

@@ -1,18 +1,23 @@
-export function requireSuccessfulCiRun(runs, head) {
+export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
   if (!Array.isArray(runs)) throw new Error("GitHub Actions response is not an array");
   if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+  const label = String(workflowName || "workflow");
   const matching = runs
     .filter((run) => run && run.headSha === head && run.event === "push")
     .sort((left, right) => String(right.createdAt || "").localeCompare(String(left.createdAt || "")));
   const run = matching[0];
   if (!run) {
-    throw new Error(`no push-triggered CI run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
+    throw new Error(`no push-triggered ${label} run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
   }
   if (run.status !== "completed") {
-    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
+    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
   }
   if (run.conclusion !== "success") {
-    throw new Error(`CI run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun CI before release`);
+    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
   }
   return run;
 }
+
+export function requireSuccessfulCiRun(runs, head) {
+  return requireSuccessfulWorkflowRun(runs, head, "CI");
+}

package/scripts/sarif-security-gate.mjs

@@ -12,7 +12,7 @@ if (!targets.length) throw new Error("usage: node scripts/sarif-security-gate.mj
 
 const accepted = loadAcceptedFindings(allowlistPath);
 const sarifFiles = targets.flatMap((target) => collectSarifFiles(resolve(target)));
-if (!sarifFiles.length) throw new Error("CodeQL security gate received no SARIF files");
+if (!sarifFiles.length) throw new Error("SARIF gate received no SARIF files");
 
 const blocked = [];
 const acknowledged = [];
@@ -22,28 +22,30 @@ for (const file of sarifFiles) {
 }
 
 for (const finding of acknowledged) {
-  process.stderr.write(`accepted CodeQL finding: ${finding.ruleId} at ${finding.path} (${finding.reason}; expires ${finding.expires})\n`);
+  process.stderr.write(`accepted SARIF finding: ${finding.ruleId} at ${finding.path} (${finding.reason}; expires ${finding.expires})\n`);
 }
 if (blocked.length) {
   for (const finding of blocked.slice(0, 100)) {
     process.stderr.write(`${finding.path}:${finding.line}: ${finding.ruleId}: ${finding.message}\n`);
   }
-  if (blocked.length > 100) process.stderr.write(`... ${blocked.length - 100} additional security findings omitted\n`);
-  throw new Error(`CodeQL security gate rejected ${blocked.length} unaccepted security finding(s)`);
+  if (blocked.length > 100) process.stderr.write(`... ${blocked.length - 100} additional SARIF findings omitted\n`);
+  throw new Error(`SARIF gate rejected ${blocked.length} unaccepted SARIF finding(s)`);
 }
-process.stderr.write(`CodeQL security gate ok (${sarifFiles.length} SARIF file(s); ${acknowledged.length} explicitly accepted finding(s))\n`);
+process.stderr.write(`SARIF gate ok (${sarifFiles.length} SARIF file(s); ${acknowledged.length} explicitly accepted finding(s))\n`);
 
 function inspectRun(run, file, allowlist, blockedFindings, acceptedFindings) {
   const rules = new Map();
   for (const rule of run.tool?.driver?.rules || []) rules.set(rule.id, rule);
   for (const result of run.results || []) {
-    const ruleId = String(result.ruleId || "");
-    const rule = rules.get(ruleId) || {};
-    if (!isSecurityRule(rule)) continue;
+    const ruleId = String(result.ruleId || "<unknown-rule>");
+    const rule = rules.get(ruleId);
+    // CodeQL's post-upload SARIF can omit rule metadata even when results exist.
+    // Missing metadata must fail closed because the result cannot be proven non-security.
+    if (rule && !isSecurityRule(rule)) continue;
     const location = primaryLocation(result);
     const path = normalizeSarifPath(location.path, run, file);
     const line = Number(location.line) || 1;
-    const message = boundedMessage(result.message?.text || result.message?.markdown || rule.shortDescription?.text || "security finding");
+    const message = boundedMessage(result.message?.text || result.message?.markdown || rule?.shortDescription?.text || "SARIF finding");
     const exception = allowlist.get(`${ruleId}\0${path}`);
     if (exception) acceptedFindings.push({ ruleId, path, ...exception });
     else blockedFindings.push({ ruleId, path, line, message });
@@ -101,7 +103,7 @@ function loadAcceptedFindings(file) {
     }
     if (expires < today) throw new Error(`accepted CodeQL finding expired: ${ruleId} at ${path}`);
     const key = `${ruleId}\0${path}`;
-    if (entries.has(key)) throw new Error(`duplicate accepted CodeQL finding: ${ruleId} at ${path}`);
+    if (entries.has(key)) throw new Error(`duplicate accepted SARIF finding: ${ruleId} at ${path}`);
     entries.set(key, { reason, expires });
   }
   return entries;

package/src/local/app-automation.mjs

@@ -1,6 +1,7 @@
 import { opendir, realpath } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, extname, join } from "node:path";
+import { performance } from "node:perf_hooks";
 import { createToolAuthorizer } from "./policy.mjs";
 
 const MAX_APPLICATIONS = 1000;
@@ -13,7 +14,7 @@ const APP_NAME_PATTERN = /^[^\0\r\n]{1,300}$/;
 const DEFAULT_APPLICATION_CACHE_MS = 30_000;
 
 export class AppAutomationManager {
-  constructor({ policy, authorizeTool = null, displayPath, runProcess, readResourceText, throwIfCancelled = () => {}, platform = process.platform, home = homedir(), applicationRoots = null, applicationCacheMs = DEFAULT_APPLICATION_CACHE_MS, now = () => Date.now() }) {
+  constructor({ policy, authorizeTool = null, displayPath, runProcess, readResourceText, throwIfCancelled = () => {}, platform = process.platform, home = homedir(), applicationRoots = null, applicationCacheMs = DEFAULT_APPLICATION_CACHE_MS, now = () => performance.now() }) {
     this.policy = policy || {};
     this.authorizeTool = createToolAuthorizer(this.policy, authorizeTool);
     this.displayPath = displayPath;

package/src/local/call-registry.mjs

@@ -1,10 +1,11 @@
 import { randomBytes } from "node:crypto";
+import { performance } from "node:perf_hooks";
 import { BridgeError } from "./errors.mjs";
 
 export class CallRegistry {
   constructor(options = {}) {
     this.maximum = positiveInteger(options.maximum, 16);
-    this.now = typeof options.now === "function" ? options.now : Date.now;
+    this.now = typeof options.now === "function" ? options.now : () => performance.now();
     this.scheduler = options.scheduler || { setTimeout, clearTimeout };
     this.onCancel = typeof options.onCancel === "function" ? options.onCancel : () => {};
     this.onFinish = typeof options.onFinish === "function" ? options.onFinish : () => {};

package/src/local/daemon-process.mjs

@@ -6,6 +6,7 @@ import {
   readDaemonLockOwner,
   resolveWorkspace,
 } from "./state.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { inspectProcessInstance, isPidAlive, processCommandLine, splitProcessCommandLine } from "./process-identity.mjs";
 
 const DEFAULT_TAKEOVER_TIMEOUT_MS = 15_000;
@@ -33,7 +34,7 @@ export async function acquireDaemonLockWithTakeover(state, options = {}) {
 
   // A terminated daemon can release its token immediately before the filesystem
   // makes the lock removal visible to this process. Retry only this handoff.
-  const handoffDeadline = Date.now() + Math.min(timeoutMs, 1_000);
+  const handoffDeadline = createMonotonicDeadline(Math.min(timeoutMs, 1_000));
   do {
     lock = acquireDaemonLock(state, ownerMetadata);
     if (lock.acquired) {
@@ -41,8 +42,8 @@ export async function acquireDaemonLockWithTakeover(state, options = {}) {
       return lock;
     }
     if (lock.owner?.pid && isPidAlive(lock.owner.pid)) return lock;
-    await sleep(Math.min(pollMs, Math.max(1, handoffDeadline - Date.now())));
-  } while (Date.now() < handoffDeadline);
+    await sleep(Math.min(pollMs, Math.max(1, handoffDeadline.remainingMs())));
+  } while (!handoffDeadline.expired());
   return lock;
 }
 
@@ -50,7 +51,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
   const timeoutMs = boundedPositiveInt(options.timeoutMs, DEFAULT_TAKEOVER_TIMEOUT_MS);
   const pollMs = boundedPositiveInt(options.pollMs, DEFAULT_TAKEOVER_POLL_MS);
   const logger = options.logger || { info() {}, warn() {} };
-  const deadline = Date.now() + timeoutMs;
+  const deadline = createMonotonicDeadline(timeoutMs);
   const signalled = new Set();
   let owner = options.owner || readDaemonLockOwner(daemonLockPathForState(state));
   let verified = false;
@@ -96,7 +97,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
     const currentOwnerAlive = Boolean(owner?.pid && isPidAlive(owner.pid));
     if (!currentOwnerAlive && liveSignalled.length === 0) break;
 
-    if (Date.now() >= deadline) {
+    if (deadline.expired()) {
       logger.warn?.(`detached background daemon did not stop within ${Math.ceil(timeoutMs / 1000)} seconds`);
       const remainingPid = Number(owner?.pid) || liveSignalled[0] || null;
       return {
@@ -111,7 +112,7 @@ export async function stopWorkspaceServiceDaemon(state, options = {}) {
         version: typeof lastOwner?.version === "string" ? lastOwner.version : "unknown",
       };
     }
-    await sleep(Math.min(pollMs, Math.max(1, deadline - Date.now())));
+    await sleep(Math.min(pollMs, Math.max(1, deadline.remainingMs())));
     owner = readDaemonLockOwner(daemonLockPathForState(state));
   }
 

package/src/local/full-access-test.mjs

@@ -2,6 +2,7 @@ import { chmod, mkdtemp, readFile, realpath, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import process from "node:process";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { LocalRuntime } from "./runtime.mjs";
 import { generateSshKeyPair } from "./ssh-key.mjs";
 import { runExecutable } from "./shell.mjs";
@@ -178,8 +179,8 @@ export async function runFullAccessTest({ workspace, policy = policyProfile("ful
 }
 
 async function waitForJob(manager, jobId, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
+  const deadline = createMonotonicDeadline(timeoutMs);
+  while (!deadline.expired()) {
     const value = manager.read({ job_id: jobId });
     if (TERMINAL_JOB_STATES.has(value.status)) return value;
     await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));

package/src/local/job-runner.mjs

@@ -2,9 +2,11 @@ import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
+import { performance } from "node:perf_hooks";
 import { executionEnv } from "./shell.mjs";
 import { terminateProcessTree } from "./process-sessions.mjs";
 import { createExclusiveFileSync, removeOwnedJsonFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { currentProcessStartTimeMs } from "./process-identity.mjs";
 import { readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -66,8 +68,8 @@ try {
 async function releaseRecoveryClaim() {
   if (!/^[a-f0-9]{32}$/.test(recoveryLockToken)) throw new Error("recovery runner is missing its ownership token");
   const file = join(jobDir, "recovery.lock");
-  const deadline = Date.now() + 5000;
-  while (Date.now() < deadline) {
+  const deadline = createMonotonicDeadline(5000);
+  while (!deadline.expired()) {
     if (removeOwnedJsonFileSync(file, { pid: process.pid, token: recoveryLockToken })) return;
     await new Promise((resolvePromise) => setTimeout(resolvePromise, 10));
   }
@@ -224,7 +226,7 @@ async function runStep(step, index, phase, plan, resourceContext, cancellationAw
     : step.stdin === null || step.stdin === undefined
       ? null
       : Buffer.from(step.stdin, "utf8");
-  const started = Date.now();
+  const started = performance.now();
   const raw = await spawnStep(argv, {
     cwd: step.cwd,
     env,
@@ -242,7 +244,7 @@ async function runStep(step, index, phase, plan, resourceContext, cancellationAw
     code: raw.code,
     signal: raw.signal,
     timed_out: raw.timedOut,
-    duration_ms: Date.now() - started,
+    duration_ms: performance.now() - started,
     stdout: step.capture_output === "discard" ? "" : redactOutput(raw.stdout, resourceContext),
     stderr: step.capture_output === "discard" ? "" : redactOutput(raw.stderr, resourceContext),
     output_discarded: step.capture_output === "discard",

package/src/local/monotonic-deadline.mjs

@@ -0,0 +1,30 @@
+import { performance } from "node:perf_hooks";
+
+export function createMonotonicDeadline(timeoutMs, now = () => performance.now()) {
+  const durationMs = Number(timeoutMs);
+  if (!Number.isFinite(durationMs) || durationMs < 0) throw new TypeError("timeoutMs must be a finite non-negative number");
+  let lastSample = readSample(now);
+  const startedAt = lastSample;
+
+  function elapsedMs() {
+    const sample = readSample(now);
+    if (sample > lastSample) lastSample = sample;
+    return Math.max(0, lastSample - startedAt);
+  }
+
+  return Object.freeze({
+    expired() {
+      return elapsedMs() >= durationMs;
+    },
+    remainingMs() {
+      return Math.max(0, durationMs - elapsedMs());
+    },
+    elapsedMs,
+  });
+}
+
+function readSample(now) {
+  const value = Number(now());
+  if (!Number.isFinite(value)) throw new TypeError("monotonic clock returned a non-finite value");
+  return value;
+}

package/src/local/process-execution.mjs

@@ -9,8 +9,20 @@ import { clampInteger } from "./numbers.mjs";
 const MAX_STDIN_BYTES = 1024 * 1024;
 const DEFAULT_OUTPUT_BYTES = 512 * 1024;
 
+function spawnDirectProcess(command, args, options) {
+  // Keep the production child_process API call structurally separate from the
+  // injectable test seam and enforce non-shell execution at the final boundary.
+  return spawn(command, args, {
+    cwd: options.cwd,
+    env: options.env,
+    detached: options.detached,
+    windowsHide: options.windowsHide,
+    shell: false,
+  });
+}
+
 export class ProcessExecutionService {
-  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled, spawnProcess = spawn, terminateProcess = terminateProcessTreeWithEscalation }) {
+  constructor({ workspace, policy, policyGate, runtimeDir, processTracker, resolveExistingPath, resolveLocalCommand, displayPath, throwIfCancelled, spawnProcess = spawnDirectProcess, terminateProcess = terminateProcessTreeWithEscalation }) {
     this.workspace = workspace;
     this.policy = policy;
     this.policyGate = policyGate;
@@ -80,6 +92,7 @@ export class ProcessExecutionService {
           env: executionEnv(this.workspace, { fullEnv: this.policy.minimalEnv === false, runtimeDir: this.runtimeDir }),
           detached: process.platform !== "win32",
           windowsHide: true,
+          shell: false,
         });
       } catch (error) {
         rejectPromise(error);

package/src/local/process-sessions.mjs

@@ -3,6 +3,7 @@ import { randomBytes } from "node:crypto";
 import { basename } from "node:path";
 import { executionEnv } from "./shell.mjs";
 import { createToolAuthorizer } from "./policy.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { clampInteger } from "./numbers.mjs";
 
 export const MAX_COMMAND_BYTES = 64 * 1024;
@@ -120,10 +121,10 @@ export class ProcessSessionManager {
     this.throwIfCancelled(context);
     const waitForExit = args.wait_for_exit === true;
     if (waitMs > 0 && session.closedAt === null) {
-      const deadline = Date.now() + waitMs;
+      const deadline = createMonotonicDeadline(waitMs);
       if (waitForExit) {
-        while (session.closedAt === null && Date.now() < deadline) {
-          await waitForSessionChange(session, Math.max(1, deadline - Date.now()), () => this.throwIfCancelled(context));
+        while (session.closedAt === null && !deadline.expired()) {
+          await waitForSessionChange(session, Math.max(1, deadline.remainingMs()), () => this.throwIfCancelled(context));
         }
       } else if (!sessionHasOutputAfter(session, stdoutOffset, stderrOffset)) {
         await waitForSessionChange(session, waitMs, () => this.throwIfCancelled(context));

package/src/local/state.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
 import { replaceFileSync } from "./atomic-fs.mjs";
 import { createExclusiveFileSync, replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { createMonotonicDeadline } from "./monotonic-deadline.mjs";
 import { currentProcessStartTimeMs, inspectProcessInstance } from "./process-identity.mjs";
 import { chmodRegularFileSync, ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
 
@@ -266,9 +267,9 @@ export async function acquireStartupLockWithWait(state, options = {}) {
   if (lock.acquired) return lock;
   const ownerPid = lock.owner?.pid ? `pid ${lock.owner.pid}` : "another process";
   logger.info?.(`waiting for ${ownerPid} to finish the current startup/state operation`);
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline - Date.now()))));
+  const deadline = createMonotonicDeadline(timeoutMs);
+  while (!deadline.expired()) {
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline.remainingMs()))));
     lock = acquireStartupLock(state, metadata);
     if (lock.acquired) {
       logger.info?.("the previous startup/state operation finished; continuing");

package/src/local/tool-executor.mjs

@@ -1,3 +1,4 @@
+import { performance } from "node:perf_hooks";
 import { errorCode, normalizeBridgeError } from "./errors.mjs";
 
 export class ToolExecutor {
@@ -60,7 +61,7 @@ function lifecycleMiddleware(callRegistry) {
 
 function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
   return async (operation, next) => {
-    const started = Date.now();
+    const started = performance.now();
     observability.start(operation.tool);
     logger.event?.("debug", "tool.call.started", {
       call_id: shortCallId(operation.context.callId),
@@ -69,7 +70,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
     });
     try {
       const result = await next(operation);
-      const durationMs = Date.now() - started;
+      const durationMs = performance.now() - started;
       const slow = durationMs >= slowMs;
       observability.finish(operation.tool, { status: "completed", durationMs, slow });
       logger.event?.("debug", slow ? "tool.call.slow" : "tool.call.completed", {
@@ -78,7 +79,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       return result;
     } catch (error) {
       const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args) });
-      const durationMs = Date.now() - started;
+      const durationMs = performance.now() - started;
       const code = errorCode(normalized);
       const status = code === "cancelled" ? "cancelled" : code === "timeout" ? "timeout" : "failed";
       observability.finish(operation.tool, { status, durationMs, errorCode: code, slow: durationMs >= slowMs });

package/src/worker/index.ts

@@ -22,7 +22,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.0.1";
+const SERVER_VERSION = "1.0.3";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";

package/src/worker/observability.ts

@@ -3,7 +3,7 @@ const MAX_TOOLS = 128;
 const SENSITIVE_FIELD = /(?:authorization|cookie|credential|password|secret|token|verifier|private[_-]?key)/i;
 
 export class WorkerObservability {
-  private readonly startedAt = Date.now();
+  private readonly startedAt = performance.now();
   private readonly requests = { total: 0, successful: 0, client_error: 0, server_error: 0 };
   private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, disconnected: 0, protocol_errors: 0 };
@@ -49,7 +49,7 @@ export class WorkerObservability {
 
   snapshot(): Record<string, unknown> {
     return {
-      uptime_ms: Math.max(0, Date.now() - this.startedAt),
+      uptime_ms: Math.max(0, performance.now() - this.startedAt),
       requests: { ...this.requests },
       calls: { ...this.calls },
       sockets: { ...this.sockets },

package/src/worker/pending-calls.ts

@@ -53,7 +53,7 @@ export class PendingCallRegistry {
     if (input.clientRequestKey && this.byRequestKey.has(input.clientRequestKey)) {
       throw new PendingCallRegistrationError("conflict", "duplicate in-flight JSON-RPC request id within this MCP session");
     }
-    const startedAt = Date.now();
+    const startedAt = performance.now();
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         const record = this.take(input.id);
@@ -111,7 +111,7 @@ export class PendingCallRegistry {
   }
 
   snapshot(): { active: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
-    const now = Date.now();
+    const now = performance.now();
     const byTool: Record<string, number> = {};
     let oldestMs = 0;
     for (const record of this.byId.values()) {