machine-bridge-mcp 1.2.0 → 1.2.2

package/src/local/runtime.mjs

@@ -113,6 +113,8 @@ export class LocalRuntime {
     this.processTracker = new ProcessTracker();
     this.lifecycle = new LifecycleController("local runtime");
     this.observability = new RuntimeObservability();
+    this.activeRelayCalls = new Set();
+    this.suppressedRelayResults = new Map();
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
       onCancel: (record) => {
@@ -121,7 +123,7 @@ export class LocalRuntime {
         this.processTracker.terminateCall(record.id);
         this.logger.event?.("debug", "tool.call.cancel_requested", {
           call_id: shortCallId(record.id), tool: record.tool, origin: record.origin,
-        });
+        }, "Tool call cancellation requested");
       },
       onFinish: (record) => this.processTracker.releaseCall(record.id),
     });
@@ -289,7 +291,7 @@ export class LocalRuntime {
     return this.relay?.send(value) === true;
   }
 
-  async handleMessage(raw) {
+  async handleMessage(raw, relayContext = {}) {
     let message;
     try { message = JSON.parse(raw); } catch {
       this.handleRelayProtocolViolation("invalid_server_json");
@@ -304,7 +306,7 @@ export class LocalRuntime {
       this.handleRelayProtocolViolation("unexpected_server_message_type");
       return;
     }
-    await this.handleRelayToolCall(message);
+    await this.handleRelayToolCall(message, relayContext);
   }
 
   handleRelayControlMessage(message) {
@@ -322,7 +324,7 @@ export class LocalRuntime {
       return true;
     }
     if (message.type === "cancel_call") {
-      if (typeof message.id === "string") this.cancelCall(message.id, "remote cancellation");
+      if (typeof message.id === "string") this.cancelRelayCall(message.id, "caller_cancelled");
       return true;
     }
     return false;
@@ -336,37 +338,65 @@ export class LocalRuntime {
     this.logger.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon");
   }
 
-  async handleRelayToolCall(message) {
+  async handleRelayToolCall(message, relayContext = {}) {
     const envelope = normalizeRelayToolCall(message);
+    const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!envelope.ok) {
-      this.logger.event?.("warn", "relay.tool_call.invalid", { has_call_id: Boolean(envelope.id) });
+      this.logger.warn?.("Received an invalid tool request from the relay; the request was rejected.");
+      this.logger.event?.("debug", "relay.tool_call.invalid", {
+        has_call_id: Boolean(envelope.id),
+      }, "Invalid relay tool request details");
       if (envelope.id) this.deliverRelayToolResult({
         type: "tool_result",
         id: envelope.id,
         ok: false,
         error: { code: "invalid_request", message: "invalid tool_call envelope", retryable: false },
-      });
+      }, relaySessionId);
+      return;
+    }
+    if (this.activeRelayCalls.has(envelope.id)) {
+      this.handleRelayProtocolViolation("duplicate_tool_call_id");
       return;
     }
-    let response;
+    this.activeRelayCalls.add(envelope.id);
     try {
-      const result = await this.executeTool(envelope.tool, envelope.arguments, {
-        callId: envelope.id,
-        origin: "relay",
-        timeoutMs: envelope.timeoutMs,
-        authorization: envelope.authorization,
-      });
-      response = { type: "tool_result", id: envelope.id, ok: true, result };
-    } catch (error) {
-      response = { type: "tool_result", id: envelope.id, ok: false, error: publicError(error) };
+      let response;
+      try {
+        const result = await this.executeTool(envelope.tool, envelope.arguments, {
+          callId: envelope.id,
+          origin: "relay",
+          timeoutMs: envelope.timeoutMs,
+          authorization: envelope.authorization,
+        });
+        response = { type: "tool_result", id: envelope.id, ok: true, result };
+      } catch (error) {
+        response = { type: "tool_result", id: envelope.id, ok: false, error: publicError(error) };
+      }
+      const suppressionReason = this.suppressedRelayResults.get(envelope.id) || "";
+      if (suppressionReason) {
+        this.logger.event?.("debug", "relay.tool_result.discarded", {
+          call_id: shortCallId(envelope.id), reason: suppressionReason,
+        }, "Discarded a tool result because the caller was no longer waiting");
+        return;
+      }
+      this.deliverRelayToolResult(response, relaySessionId);
+    } finally {
+      this.activeRelayCalls.delete(envelope.id);
+      this.suppressedRelayResults.delete(envelope.id);
     }
-    this.deliverRelayToolResult(response);
   }
 
-  deliverRelayToolResult(response) {
-    if (this.send(response)) return true;
-    this.logger.event?.("warn", "relay.tool_result.delivery_failed", { call_id: shortCallId(response?.id) });
-    this.relay?.interrupt?.("relay_transport_error");
+  deliverRelayToolResult(response, relaySessionId = 0) {
+    const outcome = this.relay?.sendForSession?.(response, relaySessionId)
+      || (this.send(response) ? { ok: true, reason: "sent" } : { ok: false, reason: "transport_unavailable" });
+    if (outcome.ok) return true;
+    const reason = String(outcome.reason || "transport_unavailable");
+    this.logger.event?.("debug", "relay.tool_result.discarded", {
+      call_id: shortCallId(response?.id), reason,
+    }, reason === "send_failed"
+      ? "Could not send a tool result because the relay transport failed"
+      : "Discarded a tool result because its relay session had ended");
+    if (reason === "send_failed") this.relay?.interrupt?.("relay_transport_error");
     return false;
   }
 
@@ -379,11 +409,19 @@ export class LocalRuntime {
     return this.callRegistry.cancel(callId, reason);
   }
 
+  cancelRelayCall(callId, suppressionReason = "caller_cancelled") {
+    const id = String(callId);
+    if (this.activeRelayCalls.has(id)) this.suppressedRelayResults.set(id, suppressionReason);
+    return this.cancelCall(id, "remote cancellation");
+  }
+
   handleRelayDisconnect() {
+    for (const callId of this.activeRelayCalls) this.suppressedRelayResults.set(callId, "relay_disconnected");
     const cancelled = this.callRegistry.cancelOrigin("relay", "remote relay disconnected");
     this.terminateActiveProcesses("SIGTERM", true);
     if (cancelled > 0) {
-      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled });
+      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled },
+        "Cancelled in-flight tool calls after the relay connection ended");
     }
   }
 
@@ -513,7 +551,7 @@ export class LocalRuntime {
 
   readLocalResourceBinary(name) {
     const registry = this.managedJobManager.currentResources();
-    const resource = registry[name];
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
     if (!resource) throw new Error(`unknown local resource: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
     if (inspected.size > 1024 * 1024) throw new Error("local resource exceeds 1 MiB browser injection limit");
@@ -669,7 +707,7 @@ function createRelayConnection(runtime, { workerUrl, secret, expectedVersion, on
       policy: runtime.policy,
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
     }),
-    onMessage: (data) => handleRelayData(runtime, data),
+    onMessage: (data, relayContext) => handleRelayData(runtime, data, relayContext),
     onDisconnect: () => runtime.handleRelayDisconnect(),
     onSuperseded: () => {
       runtime.terminateActiveProcesses("SIGKILL");
@@ -684,13 +722,13 @@ function createRelayConnection(runtime, { workerUrl, secret, expectedVersion, on
   });
 }
 
-function handleRelayData(runtime, data) {
+function handleRelayData(runtime, data, relayContext = {}) {
   const raw = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
   if (Buffer.byteLength(raw) > MAX_WS_MESSAGE_BYTES) {
     runtime.handleRelayProtocolViolation("server_message_too_large");
     return;
   }
-  return runtime.handleMessage(raw);
+  return runtime.handleMessage(raw, relayContext);
 }
 
 function normalizeRelayToolCall(message) {

package/src/local/tool-executor.mjs

@@ -67,7 +67,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       call_id: shortCallId(operation.context.callId),
       tool: operation.tool,
       origin: operation.context.origin,
-    });
+    }, "Tool call started");
     try {
       const result = await next(operation);
       const durationMs = performance.now() - started;
@@ -75,7 +75,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       observability.finish(operation.tool, { status: "completed", durationMs, slow });
       logger.event?.("debug", slow ? "tool.call.slow" : "tool.call.completed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin, duration_ms: durationMs,
-      });
+      }, slow ? "Tool call completed slowly" : "Tool call completed");
       return result;
     } catch (error) {
       const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args) });
@@ -86,7 +86,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       logger.event?.("debug", "tool.call.failed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin,
         duration_ms: durationMs, error_code: code, retryable: normalized.retryable,
-      });
+      }, "Tool call failed");
       throw normalized;
     }
   };

package/src/local/worker-deployment.mjs

@@ -5,6 +5,7 @@ import { runWrangler } from "./shell.mjs";
 import { packageRoot, saveState } from "./state.mjs";
 import { withWorkerSecretsFile } from "./worker-secret-file.mjs";
 import {
+  normalizeWorkerOrigin,
   retryWorkerHealth,
   workerHealthRequiresRedeploy,
   workerHealthUserReason,
@@ -52,7 +53,7 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
     "--secrets-file", secretFile,
   ], { capture: true }));
 
-  const detectedUrl = extractWorkerUrl(deploy.stdout) || extractWorkerUrl(deploy.stderr);
+  const detectedUrl = extractWorkerUrl(deploy.stdout, state.worker.name) || extractWorkerUrl(deploy.stderr, state.worker.name);
   const recordedUrl = workerUrlMatchesName(state.worker.url, state.worker.name) ? state.worker.url : "";
   const workerUrl = detectedUrl || recordedUrl;
   if (!workerUrl) {
@@ -93,20 +94,24 @@ export function workerDeploymentFingerprint(state, options = {}) {
   return fingerprint.digest("hex");
 }
 
-export function extractWorkerUrl(text = "") {
-  const matches = [...String(text).matchAll(/https:\/\/[^\s"'<>]+\.workers\.dev[^\s"'<>]*/g)];
-  if (matches.length) return matches.at(-1)[0].replace(/[),.]+$/, "");
-  const anyHttps = [...String(text).matchAll(/https:\/\/[^\s"'<>]+/g)];
-  return anyHttps.find(match => /workers\.dev|\/healthz|\/mcp/.test(match[0]))?.[0]?.replace(/[),.]+$/, "") || "";
+export function extractWorkerUrl(text = "", workerName = "") {
+  const candidates = [...String(text).matchAll(/https:\/\/[^\s"'<>]+/g)]
+    .map((match) => match[0].replace(/[),.;:!?]+$/, ""));
+  for (const candidate of candidates.reverse()) {
+    try {
+      return normalizeWorkerOrigin(candidate, workerName);
+    } catch {
+      // Wrangler output may contain unrelated links; only a canonical matching workers.dev origin is deployment evidence.
+    }
+  }
+  return "";
 }
 
 export function workerUrlMatchesName(workerUrl, workerName) {
   if (!workerUrl || !workerName) return false;
   try {
-    const url = new URL(String(workerUrl));
-    return url.protocol === "https:"
-      && url.hostname.endsWith(".workers.dev")
-      && url.hostname.startsWith(`${String(workerName)}.`);
+    normalizeWorkerOrigin(workerUrl, workerName);
+    return true;
   } catch {
     return false;
   }

package/src/local/worker-health.mjs

@@ -53,8 +53,8 @@ export async function retryWorkerHealth(workerUrl, expectedVersion, attempts, op
   return last;
 }
 
-export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
-  const base = new URL(`${String(workerUrl).replace(/\/+$/, "")}/`);
+export function normalizeWorkerOrigin(workerUrl, expectedWorkerName = "") {
+  const base = new URL(String(workerUrl));
   const hostname = base.hostname.toLowerCase();
   const expectedName = String(expectedWorkerName || "").toLowerCase();
   if (base.protocol !== "https:" || base.port || base.username || base.password || base.search || base.hash || base.pathname !== "/") {
@@ -64,7 +64,11 @@ export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
   if (expectedName && (!WORKER_NAME.test(expectedName) || hostname.split(".")[0] !== expectedName)) {
     throw new Error("Worker URL hostname does not match the recorded Worker name");
   }
-  return `https://${hostname}/healthz`;
+  return `https://${hostname}`;
+}
+
+export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
+  return `${normalizeWorkerOrigin(workerUrl, expectedWorkerName)}/healthz`;
 }
 
 export function isRetryableWorkerHealthError(value) {

package/src/worker/access.ts

@@ -11,16 +11,17 @@ const toolAvailability = new Map((toolCatalog as Array<{ name: string; availabil
 
 export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
 export const ACCOUNT_ROLES = Object.freeze(Object.keys(roles));
+export const DEFAULT_ACCOUNT_ROLE = String(accessContract.defaultRole) as AccountRole;
 export const OWNER_ACCOUNT_ROLE = String(accessContract.ownerRole) as AccountRole;
 
 export function normalizeAccountRole(value: unknown): AccountRole | null {
   const role = String(value ?? "").trim().toLowerCase();
-  return role in roles ? role as AccountRole : null;
+  return Object.hasOwn(roles, role) ? role as AccountRole : null;
 }
 
 export function accountRolePolicy(role: AccountRole): DaemonPolicy {
-  const profileName = roles[role]?.profile;
-  const profile = profiles[profileName];
+  const profileName = Object.hasOwn(roles, role) ? roles[role].profile : undefined;
+  const profile = profileName && Object.hasOwn(profiles, profileName) ? profiles[profileName] : undefined;
   if (!profile) throw new Error(`account role references an unknown policy profile: ${role}`);
   return {
     profile: String(profile.profile),

package/src/worker/http.ts

@@ -218,9 +218,9 @@ export function searchParamsEntries(params: URLSearchParams): Array<[string, str
 }
 
 export function searchParamsObject(params: URLSearchParams): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
+  const out = Object.create(null) as Record<string, unknown>;
   params.forEach((value, key) => {
-    if (out[key] === undefined) out[key] = value;
+    if (!Object.hasOwn(out, key)) out[key] = value;
     else if (Array.isArray(out[key])) (out[key] as string[]).push(value);
     else out[key] = [out[key] as string, value];
   });

package/src/worker/index.ts

@@ -17,7 +17,7 @@ import {
 } from "./http.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.0";
+const SERVER_VERSION = "1.2.2";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -220,8 +220,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       return;
     }
 
-    if (body.ok === false) this.pending.reject(body.id, daemonToolError(body.error), ws);
-    else this.pending.resolve(body.id, ws, body.result);
+    const matched = body.ok === false
+      ? this.pending.reject(body.id, daemonToolError(body.error), ws)
+      : this.pending.resolve(body.id, ws, body.result);
+    if (!matched) this.observability.unmatchedResult();
   }
 
   async webSocketClose(ws: WebSocket): Promise<void> {
@@ -269,19 +271,31 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
     const session = await resolveMcpSession(request, body.method, this.oauth.identityKey(), authorized.tokenKey);
     if (session.kind === "invalid") return json(rpcError(body.id, -32001, "MCP session not found"), 404);
-    const response = await this.dispatchJsonRpc(body, base, authorized, session.kind === "active" ? session.sessionId : "");
+    const response = await this.dispatchJsonRpc(
+      body,
+      base,
+      authorized,
+      session.kind === "active" ? session.sessionId : "",
+      request.signal,
+    );
     if (response === null) return new Response(null, { status: 202 });
     return session.kind === "initialize" ? json(response, 200, { "mcp-session-id": session.sessionId }) : json(response);
   }
 
-  private async dispatchJsonRpc(request: JsonRpcRequest, base: string, authorized: AuthorizedToken, sessionId: string): Promise<Record<string, unknown> | null> {
+  private async dispatchJsonRpc(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    sessionId: string,
+    signal?: AbortSignal,
+  ): Promise<Record<string, unknown> | null> {
     if (request.method === "initialize") {
       const requested = asObject(request.params).protocolVersion;
       const protocolVersion = typeof requested === "string" && MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(requested as typeof MCP_SUPPORTED_PROTOCOL_VERSIONS[number])
         ? requested
         : MCP_PROTOCOL_VERSION;
       const bootstrap = this.daemonToolEnabled("session_bootstrap")
-        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized).catch(() => null)
+        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized, undefined, signal).catch(() => null)
         : null;
       const localInstructions = sessionInstructionText(bootstrap);
       return rpcResult(request.id, {
@@ -310,7 +324,14 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const name = requiredString(params, "name");
       const args = asObject(params.arguments);
       try {
-        const result = await this.callTool(name, args, base, authorized, mcpClientRequestKey(authorized.tokenKey, sessionId, request.id));
+        const result = await this.callTool(
+          name,
+          args,
+          base,
+          authorized,
+          mcpClientRequestKey(authorized.tokenKey, sessionId, request.id),
+          signal,
+        );
         return rpcResult(request.id, textToolResult(result));
       } catch (error) {
         return rpcResult(request.id, textToolResult({ error: publicWorkerToolError(error) }, true));
@@ -318,7 +339,14 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     return rpcError(request.id, -32601, `Method not found: ${request.method}`);
   }
-  private async callTool(name: string, args: Record<string, unknown>, base: string, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
+  private async callTool(
+    name: string,
+    args: Record<string, unknown>,
+    base: string,
+    authorized: AuthorizedToken,
+    requestKey?: string,
+    signal?: AbortSignal,
+  ): Promise<unknown> {
     if (name === "server_info") {
       const { daemon, tools, authorization } = this.authorityContext(authorized);
       return {
@@ -351,13 +379,19 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (workspaceTools.some((tool) => tool.name === name)) {
       if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
-      const result = await this.callDaemonTool(name, args, authorized, requestKey);
+      const result = await this.callDaemonTool(name, args, authorized, requestKey, signal);
       return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
         accountVersion: authorized.accountVersion, role: authorized.role }) : result;
     }
     throw new Error(`unknown tool: ${name}`);
   }
-  private async callDaemonTool(name: string, args: Record<string, unknown>, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
+  private async callDaemonTool(
+    name: string,
+    args: Record<string, unknown>,
+    authorized: AuthorizedToken,
+    requestKey?: string,
+    signal?: AbortSignal,
+  ): Promise<unknown> {
     const socket = this.daemonSockets()[0];
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
     const id = randomToken("call");
@@ -374,6 +408,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
           return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
         },
+        signal,
+        onAbort: (record) => {
+          sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+          return new WorkerToolError("cancelled", "MCP client stopped waiting for the tool result");
+        },
       });
     } catch (error) {
       if (error instanceof PendingCallRegistrationError) {
@@ -382,13 +421,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       throw error;
     }
     this.observability.callStarted(name);
-    try {
-      socket.send(JSON.stringify({
-        type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
-        authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
-      }));
-    } catch {
-      this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
+    if (!signal?.aborted) {
+      try {
+        socket.send(JSON.stringify({
+          type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
+          authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
+        }));
+      } catch {
+        this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
+      }
     }
     try {
       const value = await result;

package/src/worker/oauth-controller.ts

@@ -1,4 +1,4 @@
-import { type AccountRole } from "./access.ts";
+import { DEFAULT_ACCOUNT_ROLE, normalizeAccountRole, type AccountRole } from "./access.ts";
 import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin.ts";
 import { exchangeOAuthToken } from "./oauth-tokens.ts";
 import {
@@ -50,12 +50,21 @@ export class OAuthController {
   private async oauthStore(): Promise<OAuthStore> {
     const raw = await this.ctx.storage.get<unknown>("oauth");
     if (raw !== undefined && !isCurrentOAuthStore(raw)) {
-      throw new HttpError(503, "oauth_state_schema_mismatch", "OAuth state requires the one-time multi-account upgrade");
+      throw new HttpError(503, "oauth_state_schema_mismatch", "OAuth state does not match the current schema");
     }
     const store = isCurrentOAuthStore(raw) ? raw : emptyOAuthStore();
     let changed = false;
     const now = Math.floor(Date.now() / 1000);
 
+    for (const account of Object.values(store.accounts)) {
+      if (normalizeAccountRole(account.role)) continue;
+      account.role = DEFAULT_ACCOUNT_ROLE;
+      account.active = false;
+      account.version = Number.isInteger(account.version) && account.version > 0 ? account.version + 1 : 1;
+      account.updated_at = now;
+      changed = true;
+    }
+
     for (const [code, value] of Object.entries(store.codes)) {
       const account = store.accounts[value.account_id];
       if (value.expires_at <= now || !account || !account.active || account.version !== value.account_version || account.role !== value.role) {

package/src/worker/observability.ts

@@ -5,7 +5,7 @@ const SENSITIVE_FIELD = /(?:authorization|cookie|credential|password|secret|toke
 export class WorkerObservability {
   private readonly startedAt = performance.now();
   private readonly requests = { total: 0, successful: 0, client_error: 0, server_error: 0 };
-  private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0 };
+  private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0, unmatched_results: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, disconnected: 0, protocol_errors: 0 };
   private readonly errors = new Map<string, number>();
   private readonly tools = new Map<string, { started: number; completed: number; failed: number; active: number }>();
@@ -39,6 +39,8 @@ export class WorkerObservability {
     this.incrementError(code);
   }
 
+  unmatchedResult(): void { this.calls.unmatched_results += 1; }
+
   socketCandidate(): void { this.sockets.candidates += 1; }
   socketAuthenticated(): void { this.sockets.authenticated += 1; }
   socketDisconnected(): void { this.sockets.disconnected += 1; }

package/src/worker/pending-calls.ts

@@ -19,6 +19,8 @@ export interface PendingCallRecord {
   timeout: ReturnType<typeof setTimeout>;
   resolve: (value: unknown) => void;
   reject: (error: Error) => void;
+  signal?: AbortSignal;
+  abortHandler?: () => void;
 }
 
 interface RegisterPendingCall {
@@ -28,6 +30,8 @@ interface RegisterPendingCall {
   tool: string;
   timeoutMs: number;
   onTimeout: (record: PendingCallRecord) => Error;
+  signal?: AbortSignal;
+  onAbort?: (record: PendingCallRecord) => Error;
 }
 
 export class PendingCallRegistry {
@@ -63,6 +67,14 @@ export class PendingCallRegistry {
         catch { error = new Error("pending daemon call timed out"); }
         reject(error instanceof Error ? error : new Error("pending daemon call timed out"));
       }, input.timeoutMs);
+      const abortHandler = () => {
+        const record = this.take(input.id);
+        if (!record) return;
+        let error: unknown;
+        try { error = input.onAbort?.(record); }
+        catch { error = new Error("pending daemon call was cancelled"); }
+        reject(error instanceof Error ? error : new Error("pending daemon call was cancelled"));
+      };
       const record: PendingCallRecord = {
         id: input.id,
         socket: input.socket,
@@ -72,9 +84,13 @@ export class PendingCallRegistry {
         timeout,
         resolve,
         reject,
+        signal: input.signal,
+        abortHandler: input.signal ? abortHandler : undefined,
       };
       this.byId.set(input.id, record);
       if (input.clientRequestKey) this.byRequestKey.set(input.clientRequestKey, input.id);
+      if (input.signal?.aborted) abortHandler();
+      else input.signal?.addEventListener("abort", abortHandler, { once: true });
     });
   }
 
@@ -131,6 +147,7 @@ export class PendingCallRegistry {
     const record = this.byId.get(id);
     if (!record) return undefined;
     clearTimeout(record.timeout);
+    if (record.signal && record.abortHandler) record.signal.removeEventListener("abort", record.abortHandler);
     this.byId.delete(id);
     if (record.clientRequestKey && this.byRequestKey.get(record.clientRequestKey) === id) {
       this.byRequestKey.delete(record.clientRequestKey);

package/wrangler.jsonc

@@ -3,7 +3,7 @@
   "name": "machine-bridge-mcp",
   "main": "src/worker/index.ts",
   "compatibility_date": "2026-07-11",
-  "compatibility_flags": ["nodejs_compat"],
+  "compatibility_flags": ["nodejs_compat", "enable_request_signal", "request_signal_passthrough"],
   "workers_dev": true,
   "durable_objects": {
     "bindings": [