machine-bridge-mcp 1.1.4 → 1.1.5

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.1.5 - 2026-07-16
+
+### Windows autostart and persisted network environment
+
+- Replace the oversized Windows Scheduled Task `/TR` invocation with a short private launcher. The launcher contains the full quoted Node/CLI/workspace argv, routes output to the normal service logs, exits on success, and restarts nonzero daemon exits after five seconds. Register it for current-user logon at `LIMITED` run level, and reject a custom state path when even the short action exceeds Task Scheduler's 262-character boundary.
+- Query Windows task state and last result through fixed PowerShell object properties instead of localized `schtasks` text. Creation, start, stop, and removal are verified against observed state; an installed `Ready` task is no longer reported as active, and localized nonzero stop/delete output cannot create a false failure after the requested state is reached. Default reboot recovery occurs after that Windows user signs in, not before login or as `SYSTEM`.
+- Persist an owner-only allowlist of proxy and custom-CA environment variables for autostart daemons. Session-only PowerShell proxy settings now survive logon/reboot, environment-free later starts do not erase them, explicit case-insensitive replacements remove stale variants, and status/logging expose only configured key names. Unrelated environment secrets, oversized values, and control characters are rejected.
+- Extend Worker idempotency coverage through a real disk-state reload to prove that a successful Wrangler upload followed by health timeout is not repeated by a new process. Clarify that a different canonical `--workspace` intentionally selects a different profile and Worker, and add terminal guidance to rotate any one-time account password exposed in shared output.
+- Refresh the exact `ws` and Wrangler pins. The `ws` patch tightens fragment buffering limits, while Wrangler advances its bundled `workerd`; update the reviewed install-script allowlist to the exact new `workerd` version and retain zero high-severity or production audit findings.
+
 ## 1.1.4 - 2026-07-15
 
 ### File integrity and contract corrections

package/README.md

@@ -466,7 +466,7 @@ machine-mcp job submit|inspect|approve|list|read|cancel
 machine-mcp uninstall [--keep-worker] [--yes]
 ```
 
-Each canonical workspace has an independent profile, Worker name, credential set, state file, startup lock, and daemon lock.
+Each canonical workspace has an independent profile, Worker name, credential set, state file, startup lock, and daemon lock. Supplying a genuinely different `--workspace` therefore selects or creates a different Worker; junctions and symbolic links are canonicalized before the workspace identity is hashed. Use `machine-mcp workspace show` and `machine-mcp status` before treating two Worker names as duplicates.
 
 ## Autostart
 
@@ -476,7 +476,9 @@ Remote mode supports:
 - Linux `systemd --user`, with best-effort lingering;
 - Windows Scheduled Task at logon.
 
-The service definition contains neither credentials nor a duplicate policy. It loads the selected policy from owner-only local state and uses the documented `full` default if policy state is absent. launchd/systemd definitions persist a sanitized absolute-only PATH captured during installation, including the stable Node/CLI directories, so background `full` mode does not lose Homebrew or other developer command locations. Background services run at log level `warn` with JSON output: relay, protocol, and service problems are retained as bounded structured events, while all per-tool success/failure/cancellation/timing events remain debug-only. Logs are owner-only where supported and bounded by tail trimming.
+The service definition contains neither Worker/account credentials nor a duplicate policy. It loads the selected policy from owner-only local state and uses the documented `full` default if policy state is absent. launchd/systemd definitions persist a sanitized absolute-only PATH captured during installation, including the stable Node/CLI directories, so background `full` mode does not lose Homebrew or other developer command locations. A private, allowlisted service-environment snapshot preserves proxy and custom-CA variables needed by a background daemon; status reports only configured key names, never values. Re-run `machine-mcp service install` after changing those variables. Custom Windows state paths used for autostart must also remain within the Task Scheduler path limit and must not contain a literal `%`.
+
+Windows uses a short private launcher instead of putting the full Node command in Task Scheduler's bounded `/TR` field. The launcher routes output to the normal service logs and restarts a nonzero daemon exit after a delay. The task runs with least privilege when that Windows user signs in. Thus a reboot followed by normal user sign-in needs no command, but the default installation deliberately does not claim pre-login availability and does not store a Windows password or run as `SYSTEM`. Background services run at log level `warn` with JSON output: relay, protocol, and service problems are retained as bounded structured events, while all per-tool success/failure/cancellation/timing events remain debug-only. Logs are owner-only where supported and bounded by tail trimming.
 
 ## Secret rotation
 

package/SECURITY.md

@@ -69,7 +69,7 @@ Repository and user instruction files remain untrusted content from the model's
 
 Automatic `package.*` commands expose only validated script names and fixed package-manager argv; they do not expose script bodies. Executing one still runs repository-controlled package-script code with local-user authority and is not a sandbox or trust upgrade.
 
-Relay proxy selection honors `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`. Only HTTP(S) proxy URLs are accepted. Proxy endpoints, credentials, and authorization headers are not returned through MCP or written to operational logs; status exposes only coarse route state.
+Relay proxy selection honors `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`. Only HTTP(S) proxy URLs are accepted. Autostart installation persists an allowlist of proxy and custom-CA environment values in `service-environment.json` so a background daemon can reproduce the foreground network route; a proxy URL may itself contain credentials, so this file is sensitive local state and must remain protected with the rest of the state root. Proxy endpoints, credentials, certificate paths, and authorization headers are not returned through MCP or written to operational logs; service status exposes only configured environment key names and relay status exposes only coarse route state.
 
 Skill loading is non-executing. `load_local_skill` returns an entrypoint and bounded file inventory; scripts remain inert until a separate process or command tool is called. Symlinked skill directories are followed only after canonical path-policy validation, while symbolic-link `SKILL.md` entrypoints are rejected. Traversal, cycles, content, summaries, and inventory are bounded.
 

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.1.4"
+  "version_name": "1.1.5"
 }

package/docs/ARCHITECTURE.md

@@ -116,7 +116,9 @@ The daemon attachment deliberately omits workspace path/name/hash and process ID
 
 ### Autostart layer
 
-The service layer emits launchd, systemd-user, or Windows Scheduled Task definitions. Credentials are not embedded in service definitions; the daemon loads owner-only state. The exact policy is stored in owner-only state. launchd/systemd definitions contain the workspace/state-root selectors, `warn` plus JSON log settings, and a sanitized absolute-only PATH captured at installation so background `full` mode can resolve the same developer tools without accepting relative PATH entries.
+The service layer emits launchd, systemd-user, or Windows Scheduled Task definitions. Worker/account credentials are not embedded in service definitions; the daemon loads owner-only state. The exact policy is stored in owner-only state. An allowlisted `service-environment.json` separately persists only network-proxy and custom-CA variables needed by a background daemon, because shell-session environment is not inherited reliably by login managers; values are loaded only for `--daemon-only`, never logged, and status exposes key names only. launchd/systemd definitions contain the workspace/state-root selectors, `warn` plus JSON log settings, and a sanitized absolute-only PATH captured at installation so background `full` mode can resolve the same developer tools without accepting relative PATH entries.
+
+The Windows adapter owns a short private restart launcher because Task Scheduler's `/TR` action is substantially smaller than the Windows process command-line limit and the full installed Node/CLI/workspace argv can exceed it. The scheduled action therefore contains only the launcher path. The launcher performs the full quoted invocation, redirects to service logs, and restarts only nonzero exits. A fixed PowerShell object query supplies language-independent `Ready`/`Running` state; provider installation is not equated with process activity. The trigger is least-privilege current-user logon, not boot-time `SYSTEM` execution.
 
 The platform adapters normalize launchd, systemd, and Windows Scheduled Task operations to one `{ok, provider}` result contract. Removal is not a provider-specific sequence: `service-lifecycle.mjs` first stops the provider, then every verified workspace daemon in scope, and only then removes the definition. A failed stop or unverifiable process prevents definition/state deletion.
 

package/docs/AUDIT.md

@@ -1,5 +1,19 @@
 # Engineering and security audit
 
+## 2026-07-16 Windows autostart, restart, and workspace-identity incident
+
+The reported transcript combined two distinct questions that the previous Worker fix did not answer. The first ordinary `machine-mcp` invocation addressed the remembered workspace, while the next command explicitly supplied another `--workspace`. Machine Bridge intentionally assigns one profile and one Worker to each canonical workspace, so that sequence is not by itself evidence that a retry duplicated the same resource. The existing deployment code did persist successful Wrangler evidence before health verification, but its regression reused one in-memory object. The new test performs an actual atomic state write, reconstructs state from disk as a new process would, repeats an ambiguous timeout, and proves Wrangler deploy is still called exactly once. Documentation now requires comparing canonical workspace, profile, Worker name, and URL before deleting any apparent duplicate.
+
+The Windows autostart warning was a separate confirmed defect. The adapter placed the complete Node executable, globally installed CLI entrypoint, workspace, state root, and logging arguments in `schtasks /TR`. Representative installed paths exceed Task Scheduler's 262-character action-path boundary, so task creation could fail consistently even though foreground relay startup succeeded. The generic startup warning discarded the provider reason, and `service status` compounded diagnosis by equating a successful task query with a running task. Stop and removal also depended on English fragments in `schtasks` output, which is invalid on non-English Windows.
+
+Windows now stores the long invocation in a private state-root launcher and registers only that short launcher path. The launcher uses bounded fixed arguments, redirects to the standard service logs, exits after a successful daemon exit, and restarts a nonzero exit after five seconds. Registration uses the current user and `LIMITED` run level. Creation, start, stop, and removal are accepted only after fixed PowerShell object queries observe the actual Task Scheduler state and last result, so localized text is not a control signal and an installed `Ready` task is no longer reported as active. Tests reproduce an inline action above 262 characters, verify the replacement action is below the limit, exercise running/completed states, and inject localized nonzero command output.
+
+A third lifecycle gap explained why a foreground connection repaired by PowerShell `$env:` variables could fail after reboot. Login managers do not preserve that terminal's process environment. Autostart installation now snapshots only an explicit proxy/custom-CA allowlist into private local state; `--daemon-only` fills missing runtime variables from that snapshot. A later environment-free startup preserves the snapshot, case-insensitive replacements remove stale Windows variants, explicit empty values can clear settings, and status/logging reveal only key names. Tests prove unrelated secret variables are excluded and values are bounded and control-character safe. A proxy URL may contain credentials, so the snapshot is treated as sensitive state rather than a service-definition or log field.
+
+The resulting reboot contract is intentionally narrower than “available before anyone logs in.” The Windows task is `ONLOGON`: after the configured user signs in, no terminal action is required and the launcher self-recovers nonzero daemon exits. Pre-login operation would require a materially different Windows service account, stored-credential, or `SYSTEM` boundary and is not silently introduced. The audit also identified the exposed one-time owner password in the supplied screenshot as compromised operational output; CLI guidance now warns against sharing credential-bearing terminal output, but the affected account must be rotated by the operator because repository changes cannot revoke a displayed live credential.
+
+Dependency review found no npm audit findings in either the complete or production graph. Two exact patch pins were stale: `ws` contained a fragment-limit correction and Wrangler carried a newer `workerd` plus unrelated tooling changes. Both pins were updated, the exact install-script allowlist was advanced to the reviewed `workerd` build, and the full packaging/install/Worker suites remain the acceptance boundary rather than treating “latest” as sufficient evidence.
+
 ## 2026-07-15 Windows Worker deployment convergence incident
 
 A Windows report showed Wrangler creating a Worker successfully, followed by `Worker deployment did not become healthy at the expected version: timeout`. Re-running startup, and then changing the name to a suffixed `-r2` variant, left multiple Workers in the Cloudflare account. The causal defect was not Worker creation itself: Wrangler and the long-lived relay already followed standard proxy routing, while the independent health verifier used a direct global `fetch`. On networks where outbound HTTPS required an environment proxy, deployment could succeed and health verification could time out.

package/docs/LOGGING.md

@@ -39,6 +39,8 @@ Wrangler upload and `/healthz` verification are logged as separate state transit
 
 Health routing records only `direct` or `proxy` at debug level. Proxy URLs, credentials, request headers, Worker secrets, and raw response bodies are never fields. Repeated per-attempt health failures remain debug-only; the terminal startup error contains one user-readable classification and corrective commands.
 
+Autostart installation and daemon startup may report the names of allowlisted proxy/custom-CA environment variables that were saved or loaded. Their values, source environment, proxy endpoints, embedded credentials, and certificate paths are prohibited log fields. Windows task failures use stable reasons such as `task_create_failed` or `task_status_unavailable`; localized command output is retained only in an explicitly requested service-command result, not repeated in default startup warnings.
+
 ## Relay connection event policy
 
 A TCP/WebSocket `open` event is only transport availability. The daemon is reported as connected only after the Worker returns `hello_ack` for the authenticated `hello` message.

package/docs/OPERATIONS.md

@@ -16,7 +16,7 @@ Wrangler upload and public health verification are two separate observations. On
 
 Automatic redeployment is limited to bounded health evidence that the recorded endpoint is genuinely stale: a persistent package-version mismatch, an unexpected Machine Bridge identity, or a persistent `404`/`410`. Unreachability is not proof of absence. `--force-worker` remains the explicit override when an operator deliberately wants an upload despite matching state.
 
-Each workspace has one stable Worker name. A command that supplies a different `--worker-name` after initialization is rejected unless `--force-worker` is present. A name such as `mbm-example-r2` is a separate Cloudflare Worker, not a revision of `mbm-example`. If an older release already created duplicates, first run `machine-mcp status` and verify the active URL/name, then remove only the confirmed unused Workers in the Cloudflare dashboard or with Wrangler. Source upgrades do not delete ambiguous live deployments automatically.
+Each canonical workspace has one stable Worker name. A command that supplies a different `--worker-name` after initialization is rejected unless `--force-worker` is present. A name such as `mbm-example-r2` is a separate Cloudflare Worker, not a revision of `mbm-example`. A different `--workspace` is also a separate identity by design; Windows junctions and symbolic links are resolved before hashing. A transcript that runs `machine-mcp` and later runs `machine-mcp --workspace OTHER_PATH` does not by itself prove a same-workspace duplicate. Compare `machine-mcp workspace show`, `machine-mcp status`, the canonical workspace path, and the recorded Worker URL first. If an older release already created duplicates, remove only the confirmed unused Workers in the Cloudflare dashboard or with Wrangler. Source upgrades do not delete ambiguous live deployments automatically.
 
 For a health timeout on Windows or a managed network:
 
@@ -26,7 +26,7 @@ machine-mcp doctor
 machine-mcp --verbose
 ```
 
-Run these commands from the same environment used for startup so `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` are identical. Debug logs expose only the selected route and classified error; they never print a proxy endpoint or credentials.
+Run these commands from the same environment used for startup so `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` are identical. After the foreground connection succeeds, run `machine-mcp service install` from that same PowerShell session. Installation stores only an allowlisted proxy/custom-CA environment snapshot in private local state so the logon task does not lose session-only `$env:` settings after reboot. A later start with no proxy variables does not erase the saved snapshot; set a variable explicitly to an empty value and reinstall to clear it. `machine-mcp service status` reports only the saved key names. Debug logs expose only the selected route and classified error; they never print a proxy endpoint or credentials.
 
 ### Blocking-layer decision table
 
@@ -149,7 +149,11 @@ Uninstall acquires a state-root `maintenance.lock` that blocks new profile/state
 Stable errors include `policy_denied`, `invalid_request`, `timeout`, `cancelled`, `network_error`, `unavailable`, `limit_exceeded`, and `integrity_error`, with retryability metadata. Diagnose by code first; free-form messages are guidance, not an API contract.
 
 
-Windows Scheduled Task command lines use CRT-compatible quoting, including trailing backslashes and drive-root paths. Remote autostart definitions prefer a stable PATH alias that resolves to the currently running Node executable and persist a sanitized absolute-only service `PATH` containing the Node/CLI directories, the installer's absolute PATH entries, and platform defaults. This avoids versioned Homebrew-style paths becoming invalid after upgrades and prevents launchd/systemd from falling back to a minimal system-only PATH. Re-run `machine-mcp service install` after changing Node installation families or PATH layout. A service-style `--daemon-only` start that finds the same workspace daemon already running is an idempotent no-op: it exits successfully without repeating warnings or readiness output; explicit policy/secret/change requests still report that changes were not applied. Autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Installed services pass `--log-level warn --log-format json`, so each active line is a bounded JSON event suitable for ingestion. Files are owner-only where supported and tail-trimmed before daemon startup. If the log schema marker does not match the current format, the active files are cleared before startup and the current marker is written. Runtime code reads and maintains only the active filenames.
+Windows Task Scheduler limits the `/TR` action text, so the platform adapter writes a short private `service-launcher.cmd` under the state root rather than embedding the full Node, package, workspace, state, and logging argv in the task action. The launcher uses CRT-compatible argument quoting, sends stdout/stderr to the normal service logs, exits on a successful daemon exit, and restarts a nonzero exit after five seconds. Task creation is accepted only after a separate state query observes the task. Start, stop, and removal likewise query the Task Scheduler state through fixed PowerShell object properties instead of parsing localized `schtasks` messages; an installed `Ready` task is not mislabeled as currently running.
+
+The Windows trigger is current-user `ONLOGON` with `LIMITED` run level. After a reboot, signing in to that user is sufficient; no terminal command is required. Pre-login operation is intentionally not provided by the default design because it would require a different service-account/credential boundary. Remote autostart definitions prefer a stable PATH alias that resolves to the currently running Node executable and persist a sanitized absolute-only service `PATH` containing the Node/CLI directories, the installer's absolute PATH entries, and platform defaults. A private allowlisted `service-environment.json` preserves `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, matching lowercase forms, optional `ALL_PROXY`, Node proxy selection, and custom-CA path variables. Existing saved values survive an environment-free reinstall, while explicitly supplied values replace case-insensitive prior variants. Values may include proxy credentials, so the file stays in owner-only state and is never returned or logged; status exposes key names only. Re-run `machine-mcp service install` after changing Node installation families, PATH layout, proxy, or CA configuration. Custom Windows state paths used for autostart must also remain within the Task Scheduler path limit and must not contain a literal `%`.
+
+A service-style `--daemon-only` start that finds the same workspace daemon already running is an idempotent no-op: it exits successfully without repeating warnings or readiness output; explicit policy/secret/change requests still report that changes were not applied. Autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Installed services pass `--log-level warn --log-format json`, so each active line is a bounded JSON event suitable for ingestion. Files are owner-only where supported and tail-trimmed before daemon startup. If the log schema marker does not match the current format, the active files are cleared before startup and the current marker is written. Runtime code reads and maintains only the active filenames.
 
 Logging is level-based:
 

package/docs/TESTING.md

@@ -22,10 +22,11 @@ The suite includes:
 - default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, `.agents/skills` and `.codex/skills` compatibility discovery, live project/skill rescanning and fingerprints, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, runtime-keyed routing-telemetry privacy, and execution-profile denial;
 - concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, bounded startup-lock waiting, and wall-clock rollback injection proving duration deadlines remain monotonic;
 - foreground takeover of active and orphaned background daemons with current service-lock metadata, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
-- fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results;
+- fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results; Windows coverage reproduces an inline `/TR` command above 262 characters, proves the short launcher action remains bounded, verifies least-privilege logon registration, restart/log routing, language-independent `Ready`/`Running` observation, and state-observed stop/removal despite localized nonzero command output;
+- private service-environment capture/load coverage for exact allowlisting, value bounds and control-character rejection, non-proxy secret exclusion, runtime-value precedence, Windows case-insensitive replacement, explicit empty-value clearing, and preservation across a later environment-free startup;
 - machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, frozen-wall-clock browser deadline coverage, installed-application discovery caching, and name-based task matching;
 - Worker health direct/proxy routing through a real local HTTP CONNECT proxy, `NO_PROXY` bypass, exact `workers.dev` origin/name validation, redirect rejection, body/deadline bounds, error classification, bounded propagation retry, and invalid proxy fail-fast behavior without endpoint or credential disclosure;
-- Worker deployment ambiguity/idempotency: a successful Wrangler result followed by health timeout persists the fingerprint, a second start performs no upload, definitive stale-version evidence redeploys under the same name, accidental name changes are rejected, forced replacements clear current endpoint state, and prior names remain in uninstall inventory;
+- Worker deployment ambiguity/idempotency: a successful Wrangler result followed by health timeout persists the fingerprint, a second start performs no upload, an actual process restart and disk-state reload still performs no upload, definitive stale-version evidence redeploys under the same name, accidental name changes are rejected, forced replacements clear current endpoint state, and prior names remain in uninstall inventory;
 - relay environment-proxy direct/bypass/agent selection, unsupported proxy rejection, fail-fast invalid configuration, and route observability without endpoint or credential disclosure;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run worker-deployment:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test && npm run oauth-browser:test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run worker-deployment:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-environment:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test && npm run oauth-browser:test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -79,6 +79,7 @@
     "app-automation:test": "node tests/app-automation-test.mjs",
     "process-lock:test": "node tests/process-lock-test.mjs",
     "service-lifecycle:test": "node tests/service-lifecycle-test.mjs",
+    "service-environment:test": "node tests/service-environment-test.mjs",
     "app-automation:live-test": "node tests/app-automation-test.mjs --live-macos",
     "browser-command:test": "node tests/browser-command-test.mjs",
     "browser-devtools-input:test": "node tests/browser-devtools-input-test.mjs",
@@ -113,8 +114,8 @@
   "dependencies": {
     "https-proxy-agent": "9.1.0",
     "proxy-from-env": "2.1.0",
-    "wrangler": "4.110.0",
-    "ws": "8.21.0"
+    "wrangler": "4.111.0",
+    "ws": "8.21.1"
   },
   "devDependencies": {
     "@types/node": "26.1.1",
@@ -152,7 +153,7 @@
   "allowScripts": {
     "esbuild@0.28.1": true,
     "sharp@0.34.5": true,
-    "workerd@1.20260708.1": true,
+    "workerd@1.20260710.1": true,
     "fsevents": false
   },
   "packageManager": "npm@12.0.1",

package/src/local/cli-account-admin.mjs

@@ -73,7 +73,7 @@ function printAccountResult(action, result) {
   if (result.account) console.log(`${result.account.name}: ${result.account.role}; ${result.account.active ? "active" : "disabled"}`);
   if (result.password) {
     process.stdout.write(`Password: ${result.password}\n`);
-    console.log("Save this password now; it is not stored locally or shown again.");
+    console.log("Save this password now; it is not stored locally or shown again. Do not share this terminal output.");
   }
   if (result.removed) console.log("Account removed.");
 }

package/src/local/cli.mjs

@@ -18,6 +18,7 @@ import { classifyOperationalError, createLogger, sanitizeLogText } from "./log.m
 import { runExecutable, runWrangler } from "./shell.mjs";
 import { runFullAccessTest } from "./full-access-test.mjs";
 import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
+import { loadServiceEnvironment, serviceEnvironmentSummary } from "./service-environment.mjs";
 import { ensureWorkerDeployment } from "./worker-deployment.mjs";
 import { workerHealth } from "./worker-health.mjs";
 export { workerHealthUserReason } from "./worker-health.mjs";
@@ -168,6 +169,10 @@ async function startCommand(args) {
   const logger = createLogger({ level: args.json ? "error" : effectiveLogLevel(args), format: effectiveLogFormat(args), component: "cli" });
   const workspace = await chooseWorkspace(args, { promptOnFirstRun: true, save: true, allowPositional: true });
   const state = loadState(workspace, { stateDir: args.stateDir });
+  if (args.daemonOnly) {
+    const serviceEnvironment = loadServiceEnvironment(state.paths.stateRoot);
+    logger.debug?.("Loaded persisted service network environment", { keys: serviceEnvironment.keys });
+  }
   const startupLock = await acquireStartupLockWithWait(state, { operation: "start", logger });
 
   try {
@@ -395,7 +400,7 @@ function printMcpConnection(state, { quiet = false, verbose = false, initialOwne
   logger.success("Remote MCP bridge is ready");
   logger.plain(`  MCP Server URL: ${state.worker.mcpServerUrl}`);
   if (initialOwner) {
-    logger.warn("Initial owner account created; save the password now because it is not stored locally or shown again.");
+    logger.warn("Initial owner account created; save the password now because it is not stored locally or shown again. Do not share this terminal output; rotate the password immediately if it has been exposed.");
     logger.plain(`  Account: ${initialOwner.name}`);
     logger.plain(`  Password: ${initialOwner.password}`);
   } else {
@@ -544,8 +549,9 @@ async function serviceCommand(args) {
       ...status,
       workspace: state?.workspace?.path || null,
       workspace_daemon: workspaceDaemon,
+      service_environment: serviceEnvironmentSummary(stateRoot),
       effective_active: Boolean(status.active || workspaceDaemon?.alive),
-      orphaned_workspace_daemon: Boolean(!status.active && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
+      orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
     }, null, 2));
     return;
   }
@@ -620,7 +626,10 @@ async function installAutostartBestEffort({ workspace, stateRoot, entryScript, l
     const { installAutostart } = await import("./service.mjs");
     const result = await installAutostart({ workspace, stateRoot, entryScript, logger: structuredLogger(true) });
     if (result?.ok) logger.info("Autostart installed for future logins", { provider: result.provider });
-    else logger.warn("Autostart installation reported a problem; run `machine-mcp service status` for details");
+    else logger.warn("Autostart installation reported a problem; run `machine-mcp service status` for details", {
+      provider: result?.provider || "unknown",
+      reason: result?.reason || "installation_failed",
+    });
   } catch (error) {
     logger.warn("Autostart installation skipped", { error_class: classifyOperationalError(error) });
   }

package/src/local/service-environment.mjs

@@ -0,0 +1,129 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const SERVICE_ENVIRONMENT_SCHEMA = 1;
+const MAX_SERVICE_ENVIRONMENT_BYTES = 64 * 1024;
+const MAX_ENVIRONMENT_VALUE_BYTES = 16 * 1024;
+const SERVICE_ENVIRONMENT_FILE = "service-environment.json";
+
+export const SERVICE_NETWORK_ENVIRONMENT_KEYS = Object.freeze([
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "all_proxy",
+  "NODE_USE_ENV_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+]);
+
+export function serviceEnvironmentPath(stateRoot) {
+  return path.join(path.resolve(String(stateRoot)), SERVICE_ENVIRONMENT_FILE);
+}
+
+export function captureServiceEnvironment(environment = process.env) {
+  const captured = {};
+  for (const key of SERVICE_NETWORK_ENVIRONMENT_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(environment, key)) continue;
+    const value = environment[key];
+    if (value === undefined || value === null) continue;
+    captured[key] = validateEnvironmentValue(key, value);
+  }
+  return captured;
+}
+
+export function writeServiceEnvironment(stateRoot, environment = process.env) {
+  const file = serviceEnvironmentPath(stateRoot);
+  const previous = existsSync(file) ? parseServiceEnvironment(file).environment : {};
+  const captured = captureServiceEnvironment(environment);
+  const merged = { ...previous };
+  for (const [key, value] of Object.entries(captured)) {
+    for (const existing of Object.keys(merged)) {
+      if (existing.toLowerCase() === key.toLowerCase()) delete merged[existing];
+    }
+    merged[key] = value;
+  }
+  const payload = {
+    schemaVersion: SERVICE_ENVIRONMENT_SCHEMA,
+    environment: merged,
+    updatedAt: new Date().toISOString(),
+  };
+  const content = `${JSON.stringify(payload, null, 2)}\n`;
+  if (Buffer.byteLength(content) > MAX_SERVICE_ENVIRONMENT_BYTES) {
+    throw new Error("service network environment exceeds the persistence limit");
+  }
+  replaceFileAtomicallySync(file, content, { mode: 0o600 });
+  return { path: file, keys: Object.keys(payload.environment).sort() };
+}
+
+export function loadServiceEnvironment(stateRoot, targetEnvironment = process.env, options = {}) {
+  const file = serviceEnvironmentPath(stateRoot);
+  if (!existsSync(file)) return { path: file, keys: [], loaded: false };
+  const payload = parseServiceEnvironment(file);
+  const platform = String(options.platform || process.platform);
+  const loaded = [];
+  for (const [key, rawValue] of Object.entries(payload.environment)) {
+    if (!SERVICE_NETWORK_ENVIRONMENT_KEYS.includes(key)) continue;
+    if (hasEnvironmentKey(targetEnvironment, key, platform)) continue;
+    targetEnvironment[key] = validateEnvironmentValue(key, rawValue);
+    loaded.push(key);
+  }
+  return { path: file, keys: loaded.sort(), loaded: true };
+}
+
+export function serviceEnvironmentSummary(stateRoot) {
+  const file = serviceEnvironmentPath(stateRoot);
+  if (!existsSync(file)) return { configured: false, keys: [] };
+  const payload = parseServiceEnvironment(file);
+  return { configured: true, keys: Object.keys(payload.environment).sort() };
+}
+
+function parseServiceEnvironment(file) {
+  const content = readBoundedRegularFileSync(file, MAX_SERVICE_ENVIRONMENT_BYTES, "service environment file");
+  let payload;
+  try {
+    payload = JSON.parse(content.toString("utf8"));
+  } catch (error) {
+    throw new Error("service environment file is not valid JSON", { cause: error });
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("service environment file must contain an object");
+  }
+  if (payload.schemaVersion !== SERVICE_ENVIRONMENT_SCHEMA) {
+    throw new Error("service environment schema is obsolete; reinstall autostart");
+  }
+  if (!payload.environment || typeof payload.environment !== "object" || Array.isArray(payload.environment)) {
+    throw new Error("service environment file has an invalid environment map");
+  }
+  for (const [key, value] of Object.entries(payload.environment)) {
+    if (!SERVICE_NETWORK_ENVIRONMENT_KEYS.includes(key)) {
+      throw new Error("service environment file contains an unsupported key");
+    }
+    validateEnvironmentValue(key, value);
+  }
+  return payload;
+}
+
+function validateEnvironmentValue(key, value) {
+  const text = String(value);
+  if (text.includes("\0") || /[\r\n]/.test(text)) {
+    throw new Error(`service environment value ${key} contains a prohibited control character`);
+  }
+  if (Buffer.byteLength(text) > MAX_ENVIRONMENT_VALUE_BYTES) {
+    throw new Error(`service environment value ${key} exceeds the size limit`);
+  }
+  return text;
+}
+
+function hasEnvironmentKey(environment, key, platform) {
+  if (Object.prototype.hasOwnProperty.call(environment, key)) return true;
+  if (platform !== "win32") return false;
+  const wanted = key.toLowerCase();
+  return Object.keys(environment).some(existing => existing.toLowerCase() === wanted);
+}

package/src/local/service.mjs

@@ -6,9 +6,17 @@ import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";
 import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { openRegularFileSync, readBoundedRegularFileSync } from "./secure-file.mjs";
 import { waitForInactiveStatus } from "./service-convergence.mjs";
+import { writeServiceEnvironment } from "./service-environment.mjs";
+import {
+  installWindowsTask,
+  startWindowsTask,
+  statusWindowsTask,
+  stopWindowsTask,
+  uninstallWindowsTask,
+} from "./windows-service.mjs";
+export { windowsCommandLineArgument } from "./windows-service.mjs";
 
 const LABEL = "dev.machine-bridge-mcp.daemon";
-const WINDOWS_TASK = "MachineBridgeMCP";
 const SERVICE_COMMAND_OUTPUT_BYTES = 64 * 1024;
 const AUTOSTART_LOG_SCHEMA_VERSION = 3;
 
@@ -26,41 +34,38 @@ export function runServiceCommand(command, args, execute = runExecutable) {
 
 export async function installAutostart({ workspace, stateRoot, entryScript, logger = console }) {
   const spec = serviceSpec({ workspace, stateRoot, entryScript });
-  if (process.platform === "darwin") return installLaunchd(spec, logger);
-  if (process.platform === "win32") return installWindowsTask(spec, logger);
-  return installSystemd(spec, logger);
+  const serviceEnvironment = writeServiceEnvironment(spec.stateRoot);
+  let result;
+  if (process.platform === "darwin") result = await installLaunchd(spec, logger);
+  else if (process.platform === "win32") result = await installWindowsTask(spec, logger, { run: serviceRun });
+  else result = await installSystemd(spec, logger);
+  return { ...result, service_environment: serviceEnvironment };
 }
 
 export async function uninstallAutostart({ stateRoot, logger = console } = {}) {
   if (process.platform === "darwin") return uninstallLaunchd(logger);
-  if (process.platform === "win32") return uninstallWindowsTask(logger);
+  if (process.platform === "win32") return uninstallWindowsTask(logger, { run: serviceRun, stateRoot });
   return uninstallSystemd(logger);
 }
 
 export async function autostartStatus({ logger = console } = {}) {
   if (process.platform === "darwin") return statusLaunchd();
-  if (process.platform === "win32") return statusWindowsTask();
+  if (process.platform === "win32") return statusWindowsTask({ run: serviceRun });
   return statusSystemd();
 }
 
 export async function startAutostart({ logger = console } = {}) {
   if (process.platform === "darwin") return startLaunchd(logger);
-  if (process.platform === "win32") {
-    return normalizeServiceCommandResult("schtasks", await serviceRun("schtasks", ["/Run", "/TN", WINDOWS_TASK]));
-  }
+  if (process.platform === "win32") return startWindowsTask(logger, { run: serviceRun });
   return normalizeServiceCommandResult("systemd", await serviceRun("systemctl", ["--user", "start", "machine-bridge-mcp.service"]));
 }
 
 export async function stopAutostart({ logger = console } = {}) {
   if (process.platform === "darwin") return stopLaunchd(logger);
-  if (process.platform === "win32") {
-    return normalizeServiceCommandResult("schtasks", await serviceRun("schtasks", ["/End", "/TN", WINDOWS_TASK]), { allowAlreadyStopped: true });
-  }
+  if (process.platform === "win32") return stopWindowsTask(logger, { run: serviceRun });
   return normalizeServiceCommandResult("systemd", await serviceRun("systemctl", ["--user", "stop", "machine-bridge-mcp.service"]), { allowAlreadyStopped: true });
 }
 
-
-
 export function normalizeServiceCommandResult(provider, result, { allowAlreadyStopped = false } = {}) {
   const detail = `${result?.stdout || ""}
 ${result?.stderr || ""}`;
@@ -136,7 +141,7 @@ function serviceSpec({ workspace, stateRoot, entryScript }) {
   ensureOwnerOnlyDir(root);
   ensureOwnerOnlyDir(logs);
   for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) ensurePrivateLogFile(file);
-  return {
+  const spec = {
     workspace,
     stateRoot: root,
     entryScript: resolvedEntryScript,
@@ -145,6 +150,7 @@ function serviceSpec({ workspace, stateRoot, entryScript }) {
     stdout: path.join(logs, "daemon.out.log"),
     stderr: path.join(logs, "daemon.err.log"),
   };
+  return { ...spec, daemonArgs: daemonArgs(spec) };
 }
 
 export function stableNodeExecutable(options = {}) {
@@ -413,43 +419,6 @@ WantedBy=default.target
 `;
 }
 
-async function installWindowsTask(spec, logger) {
-  const command = windowsCommand(spec);
-  const result = await serviceRun("schtasks", ["/Create", "/TN", WINDOWS_TASK, "/SC", "ONLOGON", "/TR", command, "/F"]);
-  const ok = result.code === 0;
-  if (ok) logger.info?.("Windows Scheduled Task installed for logon");
-  else logger.warn?.("Windows Scheduled Task installation failed");
-  return { ok, provider: "schtasks", task: WINDOWS_TASK, result };
-}
-
-async function uninstallWindowsTask(logger) {
-  const end = await serviceRun("schtasks", ["/End", "/TN", WINDOWS_TASK]);
-  const result = await serviceRun("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
-  const missing = /cannot find|not exist|not found/i.test(`${result.stdout}
-${result.stderr}`);
-  const ok = result.code === 0 || missing;
-  if (ok) logger.info?.("Windows Scheduled Task removed");
-  else logger.warn?.("Windows Scheduled Task removal failed");
-  return { ok, provider: "schtasks", task: WINDOWS_TASK, end, result };
-}
-
-async function statusWindowsTask() {
-  const result = await serviceRun("schtasks", ["/Query", "/TN", WINDOWS_TASK, "/FO", "LIST"]);
-  return { ok: result.code === 0, provider: "schtasks", installed: result.code === 0, task: WINDOWS_TASK, active: result.code === 0, detail: result.stdout || result.stderr };
-}
-
-function windowsCommand(spec) {
-  return [spec.node, ...daemonArgs(spec)].map(windowsCommandLineArgument).join(" ");
-}
-
-export function windowsCommandLineArgument(value) {
-  const text = String(value);
-  if (text.includes("\0")) throw new Error("Windows command-line argument contains a NUL byte");
-  const escapedQuotes = text.replace(/(\\*)"/g, (_match, slashes) => `${slashes}${slashes}\\"`);
-  const escapedTrailingSlashes = escapedQuotes.replace(/(\\+)$/, (slashes) => `${slashes}${slashes}`);
-  return `"${escapedTrailingSlashes}"`;
-}
-
 export function systemdQuote(value) {
   const escaped = String(value)
     .replaceAll("\\", "\\\\")

package/src/local/state.mjs

@@ -497,7 +497,7 @@ function assertValidStateMarker(marker) {
 }
 
 function hasOnlyStateEntries(entries) {
-  const allowed = new Set([STATE_MARKER, "config.json", "browser-bridge.json", "maintenance.lock", "profiles", "logs"]);
+  const allowed = new Set([STATE_MARKER, "config.json", "browser-bridge.json", "maintenance.lock", "profiles", "logs", "service-environment.json", "service-launcher.cmd"]);
   return entries.every((entry) => allowed.has(entry) || /^config\.json\.corrupt-\d+(?:-[a-f0-9]{8})?$/.test(entry));
 }
 

package/src/local/windows-service.mjs

@@ -0,0 +1,248 @@
+import path from "node:path";
+import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { waitForInactiveStatus } from "./service-convergence.mjs";
+
+export const WINDOWS_TASK = "MachineBridgeMCP";
+const WINDOWS_LAUNCHER = "service-launcher.cmd";
+const WINDOWS_TASK_COMMAND_MAX_CHARS = 262;
+const WINDOWS_STATUS_SCRIPT = [
+  "$task = Get-ScheduledTask -TaskName 'MachineBridgeMCP' -ErrorAction SilentlyContinue;",
+  "if ($null -eq $task) { exit 3 };",
+  "$info = Get-ScheduledTaskInfo -TaskName 'MachineBridgeMCP' -ErrorAction Stop;",
+  "$payload = [ordered]@{ state = $task.State.ToString(); last_result = [Int64]$info.LastTaskResult; last_run_time = $info.LastRunTime.ToUniversalTime().ToString('o') };",
+  "[Console]::Out.Write(($payload | ConvertTo-Json -Compress))",
+].join(" ");
+
+export async function installWindowsTask(spec, logger = console, options = {}) {
+  const run = requiredRun(options.run);
+  const taskAction = windowsTaskAction(windowsLauncherPath(spec.stateRoot));
+  const launcher = writeWindowsLauncher(spec);
+  const create = await run("schtasks", [
+    "/Create",
+    "/TN", WINDOWS_TASK,
+    "/SC", "ONLOGON",
+    "/TR", taskAction,
+    "/RL", "LIMITED",
+    "/F",
+  ]);
+  const status = await waitForWindowsStatus(value => value.installed === true, { ...options, run });
+  const ok = create?.code === 0 && status.installed === true;
+  if (ok) logger.info?.("Windows Scheduled Task installed for user logon");
+  else logger.warn?.("Windows Scheduled Task installation failed", { reason: windowsServiceFailureReason(create, status) });
+  return {
+    ok,
+    provider: "schtasks",
+    task: WINDOWS_TASK,
+    trigger: "user_logon",
+    launcher: launcher.path,
+    launcher_restarts_on_failure: true,
+    create,
+    status,
+    reason: ok ? "installed" : windowsServiceFailureReason(create, status),
+  };
+}
+
+export async function startWindowsTask(logger = console, options = {}) {
+  const run = requiredRun(options.run);
+  const before = await statusWindowsTask({ ...options, run });
+  if (before.installed === null) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "task_status_unavailable", status: before };
+  if (before.installed === false) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "not_installed", status: before };
+  const command = await run("schtasks", ["/Run", "/TN", WINDOWS_TASK]);
+  const after = await waitForWindowsStatus(
+    status => status.active === true || completedSince(before, status),
+    { ...options, run },
+  );
+  const completed = completedSince(before, after);
+  const ok = after.active === true || completed;
+  if (ok) logger.info?.("Windows Scheduled Task started");
+  else logger.warn?.("Windows Scheduled Task did not reach a running or successful completed state");
+  return {
+    ok,
+    provider: "schtasks",
+    task: WINDOWS_TASK,
+    command,
+    status: after,
+    reason: after.active === true ? "started" : completed ? "completed" : "start_not_observed",
+  };
+}
+
+export async function stopWindowsTask(logger = console, options = {}) {
+  const run = requiredRun(options.run);
+  const before = await statusWindowsTask({ ...options, run });
+  if (before.installed === null) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, reason: "task_status_unavailable", status: before };
+  if (before.installed === false || before.active === false) {
+    return {
+      ok: true,
+      provider: "schtasks",
+      task: WINDOWS_TASK,
+      installed: before.installed,
+      active_before: false,
+      active: false,
+      already_stopped: true,
+      reason: before.installed ? "already_stopped" : "not_installed",
+      status: before,
+    };
+  }
+  const command = await run("schtasks", ["/End", "/TN", WINDOWS_TASK]);
+  const after = await waitForInactiveStatus(
+    () => statusWindowsTask({ ...options, run }),
+    windowsStatusWaitOptions(options),
+  );
+  const ok = after?.active === false;
+  if (ok) logger.info?.("Windows Scheduled Task stopped");
+  else logger.warn?.("Windows Scheduled Task is still active after the stop request");
+  return {
+    ok,
+    provider: "schtasks",
+    task: WINDOWS_TASK,
+    installed: after?.installed !== false,
+    active_before: true,
+    active: after?.active !== false,
+    already_stopped: false,
+    command,
+    status: after,
+    reason: ok ? "stopped" : "stop_not_observed",
+  };
+}
+
+export async function uninstallWindowsTask(logger = console, options = {}) {
+  const run = requiredRun(options.run);
+  const stopped = await stopWindowsTask(logger, { ...options, run });
+  if (!stopped.ok) return { ok: false, provider: "schtasks", task: WINDOWS_TASK, stop: stopped, reason: "stop_failed" };
+  const command = await run("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
+  const status = await waitForWindowsStatus(
+    value => value.installed === false,
+    { ...options, run },
+  );
+  const ok = status.installed === false;
+  if (ok) logger.info?.("Windows Scheduled Task removed");
+  else logger.warn?.("Windows Scheduled Task removal could not be verified");
+  return { ok, provider: "schtasks", task: WINDOWS_TASK, stop: stopped, command, status, reason: ok ? "removed" : "removal_not_observed" };
+}
+
+export async function statusWindowsTask(options = {}) {
+  const run = requiredRun(options.run);
+  const powershell = String(options.powershell || "powershell.exe");
+  const result = await run(powershell, ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_STATUS_SCRIPT]);
+  if (result?.code === 3) {
+    return { ok: false, provider: "schtasks", task: WINDOWS_TASK, installed: false, active: false, state: "missing" };
+  }
+  if (result?.code !== 0) {
+    return { ok: false, provider: "schtasks", task: WINDOWS_TASK, installed: null, active: null, state: "unknown", query: result };
+  }
+  let payload;
+  try { payload = JSON.parse(String(result.stdout || "")); } catch {
+    return { ok: false, provider: "schtasks", task: WINDOWS_TASK, installed: null, active: null, state: "unknown", query: result };
+  }
+  const state = String(payload?.state || "").trim().toLowerCase();
+  const lastResult = Number(payload?.last_result);
+  const lastRunTime = typeof payload?.last_run_time === "string" ? payload.last_run_time : null;
+  const active = state === "running";
+  return {
+    ok: true,
+    provider: "schtasks",
+    task: WINDOWS_TASK,
+    installed: true,
+    active,
+    state: state || "unknown",
+    last_result: Number.isFinite(lastResult) ? lastResult : null,
+    last_run_time: lastRunTime,
+  };
+}
+
+export function windowsLauncherPath(stateRoot) {
+  return path.join(path.resolve(String(stateRoot)), WINDOWS_LAUNCHER);
+}
+
+export function writeWindowsLauncher(spec) {
+  const launcherPath = windowsLauncherPath(spec.stateRoot);
+  const content = windowsLauncherContent(spec);
+  replaceFileAtomicallySync(launcherPath, content, { mode: 0o600 });
+  return { path: launcherPath, content };
+}
+
+export function windowsLauncherContent(spec) {
+  const command = [spec.node, ...(spec.daemonArgs || [])].map(windowsBatchArgument).join(" ");
+  const stdout = windowsBatchArgument(spec.stdout);
+  const stderr = windowsBatchArgument(spec.stderr);
+  return [
+    "@echo off",
+    "setlocal DisableDelayedExpansion",
+    ":restart",
+    `${command} 1>>${stdout} 2>>${stderr}`,
+    'set "mbm_exit=%ERRORLEVEL%"',
+    'if "%mbm_exit%"=="0" exit /b 0',
+    '"%SystemRoot%\\System32\\timeout.exe" /t 5 /nobreak >nul 2>&1',
+    "goto restart",
+    "",
+  ].join("\r\n");
+}
+
+export function windowsTaskAction(launcherPath) {
+  const action = String(launcherPath);
+  if (action.includes("\0") || /[\r\n]/.test(action)) throw new Error("Windows autostart launcher path contains a prohibited control character");
+  if (!path.isAbsolute(action) && !path.win32.isAbsolute(action)) throw new Error("Windows autostart launcher path must be absolute");
+  if (action.includes("%")) throw new Error("Windows autostart launcher path must not contain a percent sign because Task Scheduler may expand it as an environment variable");
+  if (action.length > WINDOWS_TASK_COMMAND_MAX_CHARS) {
+    throw new Error(`Windows autostart action exceeds the ${WINDOWS_TASK_COMMAND_MAX_CHARS}-character Task Scheduler limit; use the default state directory or a shorter --state-dir`);
+  }
+  return action;
+}
+
+export function windowsCommandLineArgument(value) {
+  const text = String(value);
+  if (text.includes("\0")) throw new Error("Windows command-line argument contains a NUL byte");
+  if (/[\r\n]/.test(text)) throw new Error("Windows command-line argument contains a line break");
+  const escapedQuotes = text.replace(/(\\*)"/g, (_match, slashes) => `${slashes}${slashes}\\"`);
+  const escapedTrailingSlashes = escapedQuotes.replace(/(\\+)$/, slashes => `${slashes}${slashes}`);
+  return `"${escapedTrailingSlashes}"`;
+}
+
+export function windowsBatchArgument(value) {
+  return windowsCommandLineArgument(value).replaceAll("%", "%%");
+}
+
+function completedSince(before, after) {
+  return after?.installed === true
+    && after.active === false
+    && after.last_result === 0
+    && Boolean(after.last_run_time)
+    && after.last_run_time !== before?.last_run_time;
+}
+
+function windowsServiceFailureReason(command, status) {
+  if (command?.code !== 0) return "task_create_failed";
+  if (status?.installed === false) return "task_not_found_after_create";
+  if (status?.installed === null) return "task_status_unavailable";
+  return "task_installation_unverified";
+}
+
+async function waitForWindowsStatus(predicate, options) {
+  const attempts = boundedPositiveInteger(options.statusAttempts, 10);
+  const delayMs = boundedPositiveInteger(options.statusDelayMs, 100);
+  const sleep = typeof options.sleep === "function" ? options.sleep : milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds));
+  let status = await statusWindowsTask(options);
+  for (let index = 1; index < attempts && !predicate(status); index += 1) {
+    await sleep(delayMs);
+    status = await statusWindowsTask(options);
+  }
+  return status;
+}
+
+function windowsStatusWaitOptions(options) {
+  return {
+    attempts: boundedPositiveInteger(options.statusAttempts, 10),
+    delayMs: boundedPositiveInteger(options.statusDelayMs, 100),
+    sleep: typeof options.sleep === "function" ? options.sleep : undefined,
+  };
+}
+
+function requiredRun(run) {
+  if (typeof run !== "function") throw new Error("Windows service command runner is required");
+  return run;
+}
+
+function boundedPositiveInteger(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
+}

package/src/worker/index.ts

@@ -24,7 +24,7 @@ import {
 } from "./http";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.1.4";
+const SERVER_VERSION = "1.1.5";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";