machine-bridge-mcp 1.1.4 → 1.2.0

package/src/local/runtime.mjs

@@ -1,12 +1,11 @@
-import { randomBytes } from "node:crypto";
 import { mkdirSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
-import { lstat, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, realpath, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { RelayConnection } from "./relay-connection.mjs";
 import { ProcessSessionManager } from "./process-sessions.mjs";
 export { MAX_COMMAND_BYTES } from "./process-sessions.mjs";
-import { allToolNames, isCanonicalFullPolicy, MCP_PROTOCOL_VERSION, MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, POLICY_PROFILES, PolicyGate, SERVER_NAME } from "./tools.mjs";
+import { MCP_SUPPORTED_PROTOCOL_VERSIONS, normalizePolicy, PolicyGate, SERVER_NAME } from "./tools.mjs";
 import { publicError } from "./errors.mjs";
 import { ProcessTracker } from "./process-tracker.mjs";
 import { CallRegistry } from "./call-registry.mjs";
@@ -15,7 +14,7 @@ import { ToolExecutor } from "./tool-executor.mjs";
 import { boundedErrorMessage, ProcessExecutionService } from "./process-execution.mjs";
 import { GitService } from "./git-service.mjs";
 import { LifecycleController } from "./lifecycle.mjs";
-import { MAX_WRITE_BYTES, readBoundedFile, sha256, WorkspaceFileService } from "./workspace-file-service.mjs";
+import { MAX_WRITE_BYTES, sha256, WorkspaceFileService } from "./workspace-file-service.mjs";
 export { MAX_WRITE_BYTES, sha256 } from "./workspace-file-service.mjs";
 import { classifyOperationalError } from "./log.mjs";
 import { inspectResourceFile, ManagedJobManager } from "./managed-jobs.mjs";
@@ -29,6 +28,12 @@ import { readBoundedRegularFileSync } from "./secure-file.mjs";
 import { clampInteger } from "./numbers.mjs";
 import { isPlainRecord } from "./records.mjs";
 import { AccountAccessGate, normalizeAccountRole } from "./account-access.mjs";
+import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
+import { diagnoseRuntime as runRuntimeDiagnostics } from "./runtime-diagnostics.mjs";
+import {
+  resolveTaskCapabilities as resolveRuntimeTaskCapabilities,
+  sessionBootstrap as buildRuntimeSessionBootstrap,
+} from "./runtime-capabilities.mjs";
 
 const MAX_WS_MESSAGE_BYTES = 8 * 1024 * 1024;
 const MAX_CONCURRENT_TOOL_CALLS = 16;
@@ -232,53 +237,21 @@ export class LocalRuntime {
   }
 
   runtimeInfo() {
-    return {
-      name: SERVER_NAME,
-      protocol_version: MCP_PROTOCOL_VERSION,
-      supported_protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
-      workspace: this.displayPath(this.workspace),
-      workspace_name: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
+    return buildRuntimeInfo({
+      workspace: this.workspace,
+      displayPath: (value) => this.displayPath(value),
       policy: this.policy,
-      policy_contract: {
-        named_profile_is_canonical: this.policy.profile === "custom" || policyMatchesNamedProfile(this.policy),
-        full_catalog_complete: this.policy.profile === "full" ? isCanonicalFullPolicy(this.policy) && this.tools().length + 1 === allToolNames().length : null,
-        machine_bridge_internal_denials_under_full: this.policy.profile === "full" && isCanonicalFullPolicy(this.policy) ? false : null,
-      },
-      enforcement: {
-        filesystem_scope: this.policy.unrestrictedPaths ? "local-user-accessible" : "workspace",
-        sensitive_filename_filter: false,
-        operating_system_permissions_apply: true,
-        host_policy_is_independent: true,
-      },
-      tool_delivery: {
-        full_profile_scope: "local-daemon-and-relay-advertisement",
-        daemon_advertised_tool_count: this.tools().length + 1,
-        host_exposed_tools_known_to_server: false,
-        host_may_expose_subset: true,
-      },
-      tools: ["server_info", ...this.tools()],
-      observability: {
-        relay_readiness: "authenticated-hello-acknowledged",
-        brief_relay_interruptions: "debug-only",
-        raw_transport_details: "debug-only",
-        per_tool_events: "structured-debug-events",
-        default_logs_include_tool_failures: false,
-        tool_arguments_or_results_logged: false,
-        capability_routing: this.capabilityObserver.snapshot(),
-        tool_calls: this.observability.snapshot(),
-        in_flight_calls: this.callRegistry.snapshot(),
-      },
-      runtime: {
-        environment: this.policy.minimalEnv ? "isolated-minimal" : "full-parent",
-        lifecycle: this.lifecycle.snapshot(),
-        relay: this.relay?.status?.() || null,
-        runtime_dir: this.policy.exposeAbsolutePaths ? this.runtimeDir : "<private-runtime-dir>",
-        processes: this.processTracker.snapshot(),
-        process_sessions: this.processSessionManager.status(),
-        managed_jobs: this.managedJobManager.status(),
-        local_resources: this.managedJobManager.resourceInfo(),
-      },
-    };
+      toolNames: this.tools(),
+      capabilityObserver: this.capabilityObserver,
+      observability: this.observability,
+      callRegistry: this.callRegistry,
+      lifecycle: this.lifecycle,
+      relayStatus: () => this.relay?.status?.() || null,
+      runtimeDir: this.runtimeDir,
+      processTracker: this.processTracker,
+      processSessionManager: this.processSessionManager,
+      managedJobManager: this.managedJobManager,
+    });
   }
 
   async start() {
@@ -426,18 +399,17 @@ export class LocalRuntime {
   }
 
   async projectOverview(context = {}) {
-    this.throwIfCancelled(context);
-    const top = await this.listDir(".", context).catch(error => ({ error: this.safeErrorMessage(error), entries: [] }));
-    const git = await this.runProcess("git", ["-c", "core.fsmonitor=false", "-C", this.workspace, "rev-parse", "--show-toplevel"], 10_000, true, 512 * 1024, context);
-    return {
-      workspace: this.displayPath(this.workspace),
-      workspaceName: this.policy.exposeAbsolutePaths ? basename(this.workspace) : "workspace",
-      gitRoot: git.code === 0 ? this.displayPath(git.stdout.trim()) : "",
+    return buildProjectOverview({
+      workspace: this.workspace,
+      displayPath: (value) => this.displayPath(value),
       policy: this.policy,
-      tools: ["server_info", ...this.tools()],
-      capabilityRouting: this.capabilityObserver.snapshot(),
-      topLevel: top.entries || [],
-    };
+      toolNames: this.tools(),
+      capabilityObserver: this.capabilityObserver,
+      listTopLevel: (callContext) => this.listDir(".", callContext),
+      runProcess: (...args) => this.runProcess(...args),
+      safeErrorMessage: (error) => this.safeErrorMessage(error),
+      throwIfCancelled: (callContext) => this.throwIfCancelled(callContext),
+    }, context);
   }
 
   listRoots() { return this.workspaceFileService.listRoots(); }
@@ -475,82 +447,15 @@ export class LocalRuntime {
   }
 
   async diagnoseRuntime(context = {}) {
-    this.throwIfCancelled(context);
-    const checks = [];
-    checks.push({
-      layer: "mcp-host-to-daemon",
-      ok: true,
-      detail: "This diagnostic request reached the local Machine Bridge runtime.",
-    });
-    checks.push({
-      layer: "machine-bridge-policy",
-      ok: this.policy.execMode === "direct" || this.policy.execMode === "shell",
-      detail: `profile=${this.policy.profile}; exec_mode=${this.policy.execMode}; unrestricted_paths=${this.policy.unrestrictedPaths}`,
-    });
-
-    const probe = join(this.runtimeDir, `.diagnostic-${process.pid}-${randomBytes(6).toString("hex")}`);
-    try {
-      await writeFile(probe, "ok\n", { mode: 0o600, flag: "wx" });
-      const { buffer } = await readBoundedFile(probe, 64, "diagnostic file");
-      checks.push({ layer: "local-filesystem", ok: buffer.toString("utf8") === "ok\n", error_class: null });
-    } catch (error) {
-      checks.push({ layer: "local-filesystem", ok: false, error_class: classifyOperationalError(error) });
-    } finally {
-      await rm(probe, { force: true }).catch(() => {});
-    }
-
-    if (this.policy.execMode === "direct" || this.policy.execMode === "shell") {
-      const direct = await this.runProcess(
-        process.execPath,
-        ["-e", "process.stdout.write('ok')"],
-        5000,
-        true,
-        1024,
-        context,
-        this.workspace,
-      ).catch((error) => ({ code: 127, stdout: "", stderr: "", error_class: classifyOperationalError(error) }));
-      checks.push({
-        layer: "local-process-spawn",
-        ok: direct.code === 0 && direct.stdout === "ok",
-        error_class: direct.error_class || (direct.code === 0 ? null : classifyOperationalError(direct.stderr || direct.stdout || "execution failed")),
-      });
-    } else {
-      checks.push({ layer: "local-process-spawn", ok: false, skipped: true, error_class: "policy_denied" });
-    }
-
-    if (this.policy.execMode === "shell") {
-      const result = await this.processExecutionService.probeShell(context)
-        .catch((error) => ({ code: 127, error_class: classifyOperationalError(error) }));
-      checks.push({
-        layer: "local-shell",
-        ok: result.code === 0,
-        error_class: result.error_class || (result.code === 0 ? null : classifyOperationalError(result.stderr || result.stdout || "execution failed")),
-      });
-    } else {
-      checks.push({ layer: "local-shell", ok: false, skipped: true, error_class: "policy_denied" });
-    }
-
-    const storage = this.managedJobManager.diagnoseStorage();
-    checks.push({ layer: "managed-job-storage", ...storage });
-    const resources = this.managedJobManager.listResources();
-    checks.push({
-      layer: "local-resource-registry",
-      ok: resources.resources.every((resource) => resource.available),
-      registered: resources.count,
-      unavailable: resources.resources.filter((resource) => !resource.available).map((resource) => ({ name: resource.name, error_class: resource.error_class })),
-    });
-
-    return {
-      request_reached_local_runtime: true,
-      interpretation: {
-        tool_call_blocked_before_response: "host/platform or connector gateway",
-        diagnostic_reached_daemon_but_spawn_failed: "local OS, endpoint security, shell configuration, or Machine Bridge policy",
-        managed_job_accepted_then_later_tools_blocked: "job continues independently; inspect with local CLI or a later read_job call",
-      },
+    return runRuntimeDiagnostics({
       policy: this.policy,
-      checks,
-      ok: checks.filter((check) => !check.skipped).every((check) => check.ok),
-    };
+      runtimeDir: this.runtimeDir,
+      workspace: this.workspace,
+      runProcess: (...args) => this.runProcess(...args),
+      probeShell: (callContext) => this.processExecutionService.probeShell(callContext),
+      managedJobManager: this.managedJobManager,
+      throwIfCancelled: (callContext) => this.throwIfCancelled(callContext),
+    }, context);
   }
 
   async generateSshKeyResource(args = {}, context = {}) {
@@ -588,43 +493,22 @@ export class LocalRuntime {
     };
   }
 
-
   async sessionBootstrap(args = {}, context = {}) {
-    const bootstrap = await this.agentContextManager.sessionBootstrap(args, context);
-    bootstrap.local_automation = {
-      applications: this.appAutomationManager.capabilities(),
-      browser: this.policy.profile === "full" ? {
-        existing_profile: true,
-        extension_bridge: true,
-        status_tool: "browser_status",
-      } : null,
-    };
-    this.capabilityObserver.recordBootstrap(bootstrap);
-    return bootstrap;
+    return buildRuntimeSessionBootstrap({
+      agentContextManager: this.agentContextManager,
+      appAutomationManager: this.appAutomationManager,
+      capabilityObserver: this.capabilityObserver,
+      policy: this.policy,
+    }, args, context);
   }
 
   async resolveTaskCapabilities(args = {}, context = {}) {
-    const result = await this.agentContextManager.resolveTaskCapabilities(args, context);
-    const task = String(args.task || "");
-    if (this.policy.profile === "full") {
-      const applications = await this.appAutomationManager.listApplications({ query: "", max_results: 500 }, context).catch(() => ({ applications: [] }));
-      const lower = task.toLowerCase();
-      result.application_matches = applications.applications
-        .map((application) => ({ application, score: applicationMatchScore(lower, application) }))
-        .filter((item) => item.score > 0)
-        .sort((left, right) => right.score - left.score || left.application.name.localeCompare(right.application.name))
-        .slice(0, 20)
-        .map(({ application, score }) => ({ ...application, score }));
-    } else {
-      result.application_matches = [];
-    }
-    if (result.application_matches.length) {
-      result.recommended_tools = [...new Set([...result.recommended_tools, "list_local_applications", "open_local_application", "inspect_local_application", "operate_local_application"])];
-    }
-    result.browser_backend = this.policy.profile === "full" ? { tool: "browser_status", existing_profile: true, extension_bridge: true } : null;
-    result.routing_observability = "Call server_info or project_overview to verify that bootstrap and task capability resolution reached the local runtime.";
-    this.capabilityObserver.recordResolution(task, result);
-    return result;
+    return resolveRuntimeTaskCapabilities({
+      agentContextManager: this.agentContextManager,
+      appAutomationManager: this.appAutomationManager,
+      capabilityObserver: this.capabilityObserver,
+      policy: this.policy,
+    }, args, context);
   }
 
   readLocalResourceBinary(name) {
@@ -749,25 +633,6 @@ export class LocalRuntime {
   }
 }
 
-function applicationMatchScore(task, application) {
-  const name = String(application.name || "").toLowerCase();
-  const id = String(application.id || "").toLowerCase();
-  if (!name) return 0;
-  if (task.includes(name)) return 10 + Math.min(name.length, 20);
-  const words = name.split(/[^\p{L}\p{N}]+/u).filter((word) => word.length >= 2);
-  return words.reduce((score, word) => score + (task.includes(word) ? 2 : 0), id && task.includes(id) ? 5 : 0);
-}
-
-function policyMatchesNamedProfile(policy) {
-  const named = POLICY_PROFILES[policy.profile];
-  if (!named) return false;
-  return policy.allowWrite === named.allowWrite
-    && policy.execMode === named.execMode
-    && policy.unrestrictedPaths === named.unrestrictedPaths
-    && policy.minimalEnv === named.minimalEnv
-    && policy.exposeAbsolutePaths === named.exposeAbsolutePaths;
-}
-
 function stateRootFromProfileStatePath(statePath) {
   const absolute = resolve(statePath);
   if (basename(absolute) !== "state.json") throw new Error("local resource state path is invalid");
@@ -854,8 +719,6 @@ function normalizeRelayAuthorization(value) {
   return Object.freeze({ account_id: accountId, account_version: accountVersion, role });
 }
 
-
-
 function collectToolPathCandidates(error, toolArgs, workspace) {
   const candidates = new Set();
   for (const value of [error?.path, error?.dest]) if (typeof value === "string" && value) candidates.add(value);

package/src/local/service-convergence.mjs

@@ -16,5 +16,5 @@ export async function waitForInactiveStatus(
 }
 
 function delay(milliseconds) {
-  return new Promise(resolve => setTimeout(resolve, milliseconds));
+  return new Promise(resolve => { setTimeout(resolve, milliseconds); });
 }

package/src/local/service-environment.mjs

@@ -0,0 +1,129 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import { readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const SERVICE_ENVIRONMENT_SCHEMA = 1;
+const MAX_SERVICE_ENVIRONMENT_BYTES = 64 * 1024;
+const MAX_ENVIRONMENT_VALUE_BYTES = 16 * 1024;
+const SERVICE_ENVIRONMENT_FILE = "service-environment.json";
+
+export const SERVICE_NETWORK_ENVIRONMENT_KEYS = Object.freeze([
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "NO_PROXY",
+  "ALL_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "no_proxy",
+  "all_proxy",
+  "NODE_USE_ENV_PROXY",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+]);
+
+export function serviceEnvironmentPath(stateRoot) {
+  return path.join(path.resolve(String(stateRoot)), SERVICE_ENVIRONMENT_FILE);
+}
+
+export function captureServiceEnvironment(environment = process.env) {
+  const captured = {};
+  for (const key of SERVICE_NETWORK_ENVIRONMENT_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(environment, key)) continue;
+    const value = environment[key];
+    if (value === undefined || value === null) continue;
+    captured[key] = validateEnvironmentValue(key, value);
+  }
+  return captured;
+}
+
+export function writeServiceEnvironment(stateRoot, environment = process.env) {
+  const file = serviceEnvironmentPath(stateRoot);
+  const previous = existsSync(file) ? parseServiceEnvironment(file).environment : {};
+  const captured = captureServiceEnvironment(environment);
+  const merged = { ...previous };
+  for (const [key, value] of Object.entries(captured)) {
+    for (const existing of Object.keys(merged)) {
+      if (existing.toLowerCase() === key.toLowerCase()) delete merged[existing];
+    }
+    merged[key] = value;
+  }
+  const payload = {
+    schemaVersion: SERVICE_ENVIRONMENT_SCHEMA,
+    environment: merged,
+    updatedAt: new Date().toISOString(),
+  };
+  const content = `${JSON.stringify(payload, null, 2)}\n`;
+  if (Buffer.byteLength(content) > MAX_SERVICE_ENVIRONMENT_BYTES) {
+    throw new Error("service network environment exceeds the persistence limit");
+  }
+  replaceFileAtomicallySync(file, content, { mode: 0o600 });
+  return { path: file, keys: Object.keys(payload.environment).sort() };
+}
+
+export function loadServiceEnvironment(stateRoot, targetEnvironment = process.env, options = {}) {
+  const file = serviceEnvironmentPath(stateRoot);
+  if (!existsSync(file)) return { path: file, keys: [], loaded: false };
+  const payload = parseServiceEnvironment(file);
+  const platform = String(options.platform || process.platform);
+  const loaded = [];
+  for (const [key, rawValue] of Object.entries(payload.environment)) {
+    if (!SERVICE_NETWORK_ENVIRONMENT_KEYS.includes(key)) continue;
+    if (hasEnvironmentKey(targetEnvironment, key, platform)) continue;
+    targetEnvironment[key] = validateEnvironmentValue(key, rawValue);
+    loaded.push(key);
+  }
+  return { path: file, keys: loaded.sort(), loaded: true };
+}
+
+export function serviceEnvironmentSummary(stateRoot) {
+  const file = serviceEnvironmentPath(stateRoot);
+  if (!existsSync(file)) return { configured: false, keys: [] };
+  const payload = parseServiceEnvironment(file);
+  return { configured: true, keys: Object.keys(payload.environment).sort() };
+}
+
+function parseServiceEnvironment(file) {
+  const content = readBoundedRegularFileSync(file, MAX_SERVICE_ENVIRONMENT_BYTES, "service environment file");
+  let payload;
+  try {
+    payload = JSON.parse(content.toString("utf8"));
+  } catch (error) {
+    throw new Error("service environment file is not valid JSON", { cause: error });
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("service environment file must contain an object");
+  }
+  if (payload.schemaVersion !== SERVICE_ENVIRONMENT_SCHEMA) {
+    throw new Error("service environment schema is obsolete; reinstall autostart");
+  }
+  if (!payload.environment || typeof payload.environment !== "object" || Array.isArray(payload.environment)) {
+    throw new Error("service environment file has an invalid environment map");
+  }
+  for (const [key, value] of Object.entries(payload.environment)) {
+    if (!SERVICE_NETWORK_ENVIRONMENT_KEYS.includes(key)) {
+      throw new Error("service environment file contains an unsupported key");
+    }
+    validateEnvironmentValue(key, value);
+  }
+  return payload;
+}
+
+function validateEnvironmentValue(key, value) {
+  const text = String(value);
+  if (text.includes("\0") || /[\r\n]/.test(text)) {
+    throw new Error(`service environment value ${key} contains a prohibited control character`);
+  }
+  if (Buffer.byteLength(text) > MAX_ENVIRONMENT_VALUE_BYTES) {
+    throw new Error(`service environment value ${key} exceeds the size limit`);
+  }
+  return text;
+}
+
+function hasEnvironmentKey(environment, key, platform) {
+  if (Object.prototype.hasOwnProperty.call(environment, key)) return true;
+  if (platform !== "win32") return false;
+  const wanted = key.toLowerCase();
+  return Object.keys(environment).some(existing => existing.toLowerCase() === wanted);
+}

package/src/local/service.mjs

@@ -6,9 +6,17 @@ import { ensureOwnerOnlyDir, expandHome } from "./state.mjs";
 import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
 import { openRegularFileSync, readBoundedRegularFileSync } from "./secure-file.mjs";
 import { waitForInactiveStatus } from "./service-convergence.mjs";
+import { writeServiceEnvironment } from "./service-environment.mjs";
+import {
+  installWindowsTask,
+  startWindowsTask,
+  statusWindowsTask,
+  stopWindowsTask,
+  uninstallWindowsTask,
+} from "./windows-service.mjs";
+export { windowsCommandLineArgument } from "./windows-service.mjs";
 
 const LABEL = "dev.machine-bridge-mcp.daemon";
-const WINDOWS_TASK = "MachineBridgeMCP";
 const SERVICE_COMMAND_OUTPUT_BYTES = 64 * 1024;
 const AUTOSTART_LOG_SCHEMA_VERSION = 3;
 
@@ -26,41 +34,38 @@ export function runServiceCommand(command, args, execute = runExecutable) {
 
 export async function installAutostart({ workspace, stateRoot, entryScript, logger = console }) {
   const spec = serviceSpec({ workspace, stateRoot, entryScript });
-  if (process.platform === "darwin") return installLaunchd(spec, logger);
-  if (process.platform === "win32") return installWindowsTask(spec, logger);
-  return installSystemd(spec, logger);
+  const serviceEnvironment = writeServiceEnvironment(spec.stateRoot);
+  let result;
+  if (process.platform === "darwin") result = await installLaunchd(spec, logger);
+  else if (process.platform === "win32") result = await installWindowsTask(spec, logger, { run: serviceRun });
+  else result = await installSystemd(spec, logger);
+  return { ...result, service_environment: serviceEnvironment };
 }
 
 export async function uninstallAutostart({ stateRoot, logger = console } = {}) {
   if (process.platform === "darwin") return uninstallLaunchd(logger);
-  if (process.platform === "win32") return uninstallWindowsTask(logger);
+  if (process.platform === "win32") return uninstallWindowsTask(logger, { run: serviceRun, stateRoot });
   return uninstallSystemd(logger);
 }
 
-export async function autostartStatus({ logger = console } = {}) {
+export async function autostartStatus() {
   if (process.platform === "darwin") return statusLaunchd();
-  if (process.platform === "win32") return statusWindowsTask();
+  if (process.platform === "win32") return statusWindowsTask({ run: serviceRun });
   return statusSystemd();
 }
 
 export async function startAutostart({ logger = console } = {}) {
   if (process.platform === "darwin") return startLaunchd(logger);
-  if (process.platform === "win32") {
-    return normalizeServiceCommandResult("schtasks", await serviceRun("schtasks", ["/Run", "/TN", WINDOWS_TASK]));
-  }
+  if (process.platform === "win32") return startWindowsTask(logger, { run: serviceRun });
   return normalizeServiceCommandResult("systemd", await serviceRun("systemctl", ["--user", "start", "machine-bridge-mcp.service"]));
 }
 
 export async function stopAutostart({ logger = console } = {}) {
   if (process.platform === "darwin") return stopLaunchd(logger);
-  if (process.platform === "win32") {
-    return normalizeServiceCommandResult("schtasks", await serviceRun("schtasks", ["/End", "/TN", WINDOWS_TASK]), { allowAlreadyStopped: true });
-  }
+  if (process.platform === "win32") return stopWindowsTask(logger, { run: serviceRun });
   return normalizeServiceCommandResult("systemd", await serviceRun("systemctl", ["--user", "stop", "machine-bridge-mcp.service"]), { allowAlreadyStopped: true });
 }
 
-
-
 export function normalizeServiceCommandResult(provider, result, { allowAlreadyStopped = false } = {}) {
   const detail = `${result?.stdout || ""}
 ${result?.stderr || ""}`;
@@ -136,7 +141,7 @@ function serviceSpec({ workspace, stateRoot, entryScript }) {
   ensureOwnerOnlyDir(root);
   ensureOwnerOnlyDir(logs);
   for (const file of [path.join(logs, "daemon.out.log"), path.join(logs, "daemon.err.log")]) ensurePrivateLogFile(file);
-  return {
+  const spec = {
     workspace,
     stateRoot: root,
     entryScript: resolvedEntryScript,
@@ -145,6 +150,7 @@ function serviceSpec({ workspace, stateRoot, entryScript }) {
     stdout: path.join(logs, "daemon.out.log"),
     stderr: path.join(logs, "daemon.err.log"),
   };
+  return { ...spec, daemonArgs: daemonArgs(spec) };
 }
 
 export function stableNodeExecutable(options = {}) {
@@ -413,43 +419,6 @@ WantedBy=default.target
 `;
 }
 
-async function installWindowsTask(spec, logger) {
-  const command = windowsCommand(spec);
-  const result = await serviceRun("schtasks", ["/Create", "/TN", WINDOWS_TASK, "/SC", "ONLOGON", "/TR", command, "/F"]);
-  const ok = result.code === 0;
-  if (ok) logger.info?.("Windows Scheduled Task installed for logon");
-  else logger.warn?.("Windows Scheduled Task installation failed");
-  return { ok, provider: "schtasks", task: WINDOWS_TASK, result };
-}
-
-async function uninstallWindowsTask(logger) {
-  const end = await serviceRun("schtasks", ["/End", "/TN", WINDOWS_TASK]);
-  const result = await serviceRun("schtasks", ["/Delete", "/TN", WINDOWS_TASK, "/F"]);
-  const missing = /cannot find|not exist|not found/i.test(`${result.stdout}
-${result.stderr}`);
-  const ok = result.code === 0 || missing;
-  if (ok) logger.info?.("Windows Scheduled Task removed");
-  else logger.warn?.("Windows Scheduled Task removal failed");
-  return { ok, provider: "schtasks", task: WINDOWS_TASK, end, result };
-}
-
-async function statusWindowsTask() {
-  const result = await serviceRun("schtasks", ["/Query", "/TN", WINDOWS_TASK, "/FO", "LIST"]);
-  return { ok: result.code === 0, provider: "schtasks", installed: result.code === 0, task: WINDOWS_TASK, active: result.code === 0, detail: result.stdout || result.stderr };
-}
-
-function windowsCommand(spec) {
-  return [spec.node, ...daemonArgs(spec)].map(windowsCommandLineArgument).join(" ");
-}
-
-export function windowsCommandLineArgument(value) {
-  const text = String(value);
-  if (text.includes("\0")) throw new Error("Windows command-line argument contains a NUL byte");
-  const escapedQuotes = text.replace(/(\\*)"/g, (_match, slashes) => `${slashes}${slashes}\\"`);
-  const escapedTrailingSlashes = escapedQuotes.replace(/(\\+)$/, (slashes) => `${slashes}${slashes}`);
-  return `"${escapedTrailingSlashes}"`;
-}
-
 export function systemdQuote(value) {
   const escaped = String(value)
     .replaceAll("\\", "\\\\")

package/src/local/state.mjs

@@ -279,7 +279,7 @@ export async function acquireStartupLockWithWait(state, options = {}) {
   logger.info?.(`waiting for ${ownerPid} to finish the current startup/state operation`);
   const deadline = createMonotonicDeadline(timeoutMs);
   while (!deadline.expired()) {
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline.remainingMs()))));
+    await new Promise((resolvePromise) => { setTimeout(resolvePromise, Math.min(pollMs, Math.max(1, deadline.remainingMs()))); });
     lock = acquireStartupLock(state, metadata);
     if (lock.acquired) {
       logger.info?.("the previous startup/state operation finished; continuing");
@@ -497,7 +497,7 @@ function assertValidStateMarker(marker) {
 }
 
 function hasOnlyStateEntries(entries) {
-  const allowed = new Set([STATE_MARKER, "config.json", "browser-bridge.json", "maintenance.lock", "profiles", "logs"]);
+  const allowed = new Set([STATE_MARKER, "config.json", "browser-bridge.json", "maintenance.lock", "profiles", "logs", "service-environment.json", "service-launcher.cmd"]);
   return entries.every((entry) => allowed.has(entry) || /^config\.json\.corrupt-\d+(?:-[a-f0-9]{8})?$/.test(entry));
 }