machine-bridge-mcp 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.2.2 - 2026-07-17
+
+### Relay result lifecycle and human-readable diagnostics
+
+- Bind every local `tool_result` to the authenticated relay session that delivered its `tool_call`. A result from a disconnected or replaced socket is discarded instead of being sent over a newer connection, and a caller cancellation marks the eventual local result as intentionally undeliverable. Routine late-result races are debug-only rather than repeated `relay.tool_result.delivery_failed` warnings; an actual synchronous WebSocket send failure still invalidates the ambiguous transport.
+- Propagate MCP HTTP cancellation into the Worker pending-call registry. Incoming request cancellation removes both internal and session request-key indexes, sends a best-effort daemon cancellation, and records the call as cancelled. The Worker deployment now explicitly enables Cloudflare request-signal delivery and passthrough to the Durable Object.
+- Add an `unmatched_results` Worker metric for results that arrive after their pending record was removed. Human log mode uses natural-language event messages and omits the redundant machine event key, while JSON mode retains stable event names and bounded structured fields.
+- Add regression coverage for relay-session replacement, stale-result suppression, request-signal cleanup, human log rendering, compatibility flags, and unmatched-result observability. Local Wrangler integration continues to cover the complete OAuth/MCP/WebSocket flow and explicit MCP cancellation.
+
 ## 1.2.1 - 2026-07-16
 
 ### Fail-closed input contracts and bounded CLI adapters

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.2.1"
+  "version_name": "1.2.2"
 }

package/docs/ARCHITECTURE.md

@@ -34,7 +34,7 @@ A canonical workspace receives an independent profile, Worker name, secret set,
 - `runtime-capabilities.mjs` composes agent, application, and browser capability results;
 - managed jobs, local resources, application automation, and browser automation remain separate managers.
 
-Architecture tests cap the orchestration module and each extracted service independently and reject a return of low-level process, patch, diagnostic, or capability-scoring logic to `LocalRuntime`. `RelayConnection` owns remote WebSocket transport, authenticated `hello_ack` readiness, heartbeat liveness, reconnect backoff, and outage logging. Stdio mode invokes `LocalRuntime` directly without that adapter.
+Architecture tests cap the orchestration module and each extracted service independently and reject a return of low-level process, patch, diagnostic, or capability-scoring logic to `LocalRuntime`. `RelayConnection` owns remote WebSocket transport, authenticated `hello_ack` readiness, heartbeat liveness, reconnect backoff, outage logging, and a monotonically increasing in-memory session generation. Every relayed tool result is bound to the generation that delivered its call; a disconnected generation cannot send a late result over its replacement socket. Stdio mode invokes `LocalRuntime` directly without that adapter.
 
 `daemon-process.mjs` owns workspace-daemon inspection and takeover. It distinguishes platform service state from the lock-owning Node process, validates PID and process-start identity, canonicalizes workspace/state paths before comparison, parses bounded process command lines without executing them, and sends `SIGTERM` only to a verified same-workspace `--daemon-only` process. POSIX daemons may ignore that signal and reach the bounded non-escalating timeout; Node's Windows signal mapping terminates the verified process directly. CLI orchestration never treats a missing launchd/systemd job as proof that the process exited.
 
@@ -105,7 +105,7 @@ All requests for a deployed Worker route to one named Durable Object. It owns:
 
 `BridgeRoom` owns Durable Object routing, MCP dispatch, daemon WebSocket lifecycle, and pending relay calls. `OAuthController` owns OAuth-store pruning, registration throttling, authorization pages/submission, account-admin routing, token exchange, access-token verification, and the serialization queue for OAuth mutations. Worker-internal TypeScript imports use explicit `.ts` specifiers and JSON import attributes, so the same modules are directly executable under the pinned Node runtime for focused state-machine tests as well as bundled by Wrangler.
 
-The Worker verifies OAuth, validates MCP envelopes and optional protocol headers, converts `tools/call` into WebSocket messages, correlates cancellation by access-token hash and JSON-RPC ID, and formats text/structured/image results. It has no local filesystem or process API.
+The Worker verifies OAuth, validates MCP envelopes and optional protocol headers, converts `tools/call` into WebSocket messages, correlates cancellation by access-token hash and JSON-RPC ID, and formats text/structured/image results. Pending calls also bind the incoming request `AbortSignal`: an HTTP client disconnect removes the pending indexes and sends a best-effort daemon cancellation. The deployment contract explicitly enables Cloudflare `enable_request_signal` and `request_signal_passthrough` so the signal reaches the named Durable Object. It has no local filesystem or process API.
 
 The primary OAuth store separates client registrations and named accounts from authorization codes and access-token records. A separate Durable Object key owns refresh-token records so refresh support can be added without rewriting the live primary-store schema. A `client_id` identifies an MCP application and redirect URIs; account records identify the authorized human or service identity. Codes, access tokens, and refresh tokens bind client ID, account ID, account version, role, scope, resource, token version, and expiration. Only hashes of bearer tokens are persisted, and every public-client refresh invalidates the presented refresh token while returning a replacement. The Worker intersects the role with the active daemon policy before advertising or relaying tools, and the local runtime validates the relayed role again. One bridge-specific Durable Object and one local runtime remain the normal topology for a workspace/trust domain; see [MULTI_ACCOUNT.md](MULTI_ACCOUNT.md).
 
@@ -152,10 +152,10 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 6. A valid verifier exchanges the one-time code for an expiring access token and refresh token; only their hashes are stored. A refresh request is bound to the original public client, account, scope, resource, and deployment token version, and atomically replaces the refresh token so replay returns `invalid_grant`.
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. `tools/list` is derived from the active daemon handshake; without a daemon, only `server_info` is advertised.
-9. `tools/call` receives a random relay call ID and is bound to the current socket and authenticated client request key.
+9. `tools/call` receives a random relay call ID and is bound to the current daemon socket, authenticated client request key, incoming HTTP abort signal, and local relay-session generation.
 10. The runtime validates policy and arguments, executes the tool, and returns a bounded result.
-11. The Durable Object accepts a result only from the socket that received that call.
-12. A matching cancellation notification removes the pending call, tells the daemon to cancel, and terminates any ordinary child processes bound to it.
+11. The Durable Object accepts a result only from the daemon socket that received that call, and the local runtime sends it only through the relay generation that delivered the call.
+12. A matching cancellation notification or incoming HTTP client disconnect removes the pending indexes, tells the daemon to cancel, and terminates ordinary child processes bound to the call. If local completion races with cancellation, the eventual result is discarded rather than treated as a user-visible delivery failure.
 13. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
 Duplicate in-flight JSON-RPC IDs are rejected only within the same authenticated MCP session. The request key includes OAuth token identity, the HMAC-bound MCP session, JSON-RPC id type, and id value, so separate initialized clients may safely reuse the same numeric id.
@@ -226,7 +226,7 @@ The local `RelayConnection` otherwise treats transport construction, transport o
 
 Reconnect uses bounded exponential backoff with jitter. Brief self-healing interruptions are debug-only. An unresolved outage is promoted to a rate-limited warning after a grace period, and recovery produces one summary. Raw close codes and reason strings remain debug-only.
 
-The Worker also treats a new connection as a bounded candidate until it authenticates and completes `hello`; a Durable Object alarm enforces the deadline across hibernation. Only a completed candidate replaces the old socket. Daemon messages must be valid JSON objects, duplicate `hello` and unknown message types are rejected with explicit protocol errors, and protocol violations close with standard WebSocket status codes. Pending calls retain their originating socket reference. A stale socket cannot complete or cancel replacement-socket calls. Closing a socket rejects only calls assigned to it.
+The Worker also treats a new connection as a bounded candidate until it authenticates and completes `hello`; a Durable Object alarm enforces the deadline across hibernation. Only a completed candidate replaces the old socket. Daemon messages must be valid JSON objects, duplicate `hello` and unknown message types are rejected with explicit protocol errors, and protocol violations close with standard WebSocket status codes. Pending calls retain their originating socket reference. A stale socket cannot complete or cancel replacement-socket calls. Closing a socket rejects only calls assigned to it. The local relay generation supplies the symmetric boundary: work accepted by an older authenticated connection cannot publish its result through a newer connection even when the call IDs are otherwise well formed.
 
 ## Persistence
 

package/docs/AUDIT.md

@@ -1,5 +1,17 @@
 # Engineering and security audit
 
+## 2026-07-17 version 1.2.2 relay-lifecycle and logging audit
+
+The reported warning was the visible symptom of a call-lifecycle mismatch rather than a failed local tool. The Worker could remove a pending call after MCP cancellation, timeout, daemon disconnect, or client abandonment, while the local runtime still completed its asynchronous operation and entered one unconditional result-delivery path. When the original WebSocket had closed, the daemon emitted one `relay.tool_result.delivery_failed` warning per late completion. More seriously, if a replacement relay had already authenticated, the old result could be written to the new socket; the Worker rejected it because its pending record was socket-bound, but the local transport did not enforce the symmetric session boundary.
+
+The correction gives each authenticated local relay connection a monotonically increasing in-memory generation and captures that generation with every incoming call. A result may be sent only through the generation that delivered the call. Explicit cancellation and relay disconnect also mark the eventual local result for disposal. Expected cancellation/disconnect/reconnect races are therefore debug-only `relay.tool_result.discarded` events, while a synchronous send failure on the still-current socket continues to invalidate the ambiguous transport and enter the ordinary outage state machine.
+
+A second defect existed one layer earlier. The Worker already handled MCP `notifications/cancelled`, but an HTTP client that disconnected without sending that notification could leave the pending internal ID and session request-key index until the tool timeout. The pending-call registry now owns AbortSignal registration and cleanup atomically with its timer and indexes. The Worker deployment explicitly enables Cloudflare `enable_request_signal` and `request_signal_passthrough`, which are both required because the public Worker forwards the request into a named Durable Object. A deterministic registry test covers active and already-aborted requests; the complete local workerd suite continues to cover OAuth, explicit MCP cancellation, WebSocket routing, timeout, and socket loss.
+
+Logging was reviewed as a user interface rather than a serialization dump. Human mode now uses the supplied natural-language explanation and omits the redundant stable event identifier; newline-delimited JSON retains that identifier for ingestion. Tool starts, outcomes, cancellation, timing, and late-result disposal remain debug-only. Worker observability adds an `unmatched_results` counter for a result that arrives after its pending record has been removed, preserving anomaly evidence without storing tool arguments, command text, paths, or result content.
+
+The broader pass rechecked architecture boundaries, cancellation and reconnect branches, release/configuration contracts, privacy redaction, package version convergence, TypeScript and checked-JavaScript contracts, lint, Worker integration, and documentation drift. An additional deployment defect was found during fault reproduction: request cancellation support was implemented in code but the required Cloudflare compatibility flags were absent, so the signal could not reach the Durable Object in production. Architecture tests now make both flags non-optional. Version 1.2.2 retains local state schema 6 and policy revision 5; normal startup must converge the Worker and daemon versions, and the unpacked browser extension must be reloaded. No live deployment, credential rotation, global installation, daemon replacement, npm publication, tag, or GitHub Release is performed by this source change.
+
 ## 2026-07-16 version 1.2.1 fail-closed input-contract audit
 
 The review began from clean `v1.2.0` with the complete repository gate, dependency audit, Worker dry run, and package checks passing. Hostile-input reproduction nevertheless found one shared JavaScript failure mechanism outside those gates: ordinary objects were being used as external string-key maps. Inherited names such as `constructor` and `__proto__` were therefore accepted as account roles, policy profiles, top-level commands, resource actions, and keyboard-table entries. The CLI variants could exit successfully without performing a command; a Worker account could persist an invalid role and later fail during authority calculation. Adjacent review found the same semantic hazard in form-field aggregation and valid local-resource names.

package/docs/LOGGING.md

@@ -26,6 +26,8 @@ The CLI accepts:
 
 Foreground mode defaults to `info` and human-readable text. Platform autostart services use `warn` with newline-delimited JSON. Foreground operators can select JSON explicitly with `--log-format json`.
 
+Human mode treats the message as the primary interface: it uses a natural-language explanation and includes only bounded diagnostic fields that add meaning. It does not repeat the machine event key. JSON mode retains the stable `event` field for ingestion and correlation. Event identifiers such as `relay.tool_result.discarded` are implementation contracts for structured logs, not text that should be shown as the warning itself.
+
 | Level | Intended events |
 |---|---|
 | `error` | The operation or service cannot continue without intervention |
@@ -73,9 +75,11 @@ Examples:
 
 With `--verbose`, the same incident additionally includes bounded structured fields such as exact seconds, coarse error class, retry delay, and transport close diagnostics.
 
-## Tool events
+## Tool and result-delivery events
+
+All per-tool starts, successes, failures, cancellations, timing, and expected late-result disposal are debug-only. The MCP response already reports the outcome to the caller; duplicating routine tool traffic at default levels creates noise and can reveal activity patterns.
 
-All per-tool starts, successes, failures, cancellations, and timing are debug-only. The MCP response already reports the outcome to the caller; duplicating routine tool traffic at default levels creates noise and can reveal activity patterns.
+A completed local result is bound to the authenticated relay session that delivered its call. If the caller cancelled, the relay disconnected, or a replacement relay session became active, the result is discarded rather than sent to a different session. This is a normal terminal race and does not emit a warning. Debug output records only a shortened call ID and a coarse reason such as `caller_cancelled`, `relay_disconnected`, or `session_ended`. A synchronous send failure on the still-current socket is different: the socket is invalidated because delivery is ambiguous, but the per-call detail remains debug-only while the normal relay-outage state machine decides whether a user-visible warning is warranted.
 
 Debug per-tool fields may include tool name, duration, coarse outcome class, and a shortened random call identifier. The identifier is for correlating adjacent local events and is not a stable audit identifier.
 

package/docs/OPERATIONS.md

@@ -50,7 +50,9 @@ A successful diagnostic result applies only to that probe. An MCP host can still
 
 Machine Bridge supports concurrent calls: the Worker admits up to 32 pending daemon calls and the local runtime admits up to 16 active tool calls. These are capacity limits, not a single global execution queue. Each successful MCP initialization receives a signed `MCP-Session-Id`; JSON-RPC ids and cancellation are scoped to that session, so separate chat windows may reuse the same numeric ids safely even when they share one OAuth account and token.
 
-`server_info.worker.pending_calls` reports `active`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. A nonzero `active` count means work is in flight, not that the bridge is locked. Calls for simple reads and probes should continue while another independent process call runs. A value that remains after the underlying local task completed indicates a transport-delivery defect; version 1 interrupts and reconnects the ambiguous daemon socket so Worker cleanup releases those records. Refreshing a chat page is not the recovery mechanism and should not be required.
+`server_info.worker.pending_calls` reports `active`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. A nonzero `active` count means work is in flight, not that the bridge is locked. Calls for simple reads and probes should continue while another independent process call runs. Explicit MCP cancellation, an incoming HTTP client disconnect, timeout, and daemon-socket closure remove the pending record and its session request key. Local results are bound to the authenticated relay session that originated the call, so a result that finishes after cancellation or reconnection is discarded instead of being sent over a replacement socket. Refreshing a chat page is not the recovery mechanism and should not be required.
+
+`server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 
 ### Relay interruption messages
 
@@ -144,7 +146,7 @@ Uninstall acquires a state-root `maintenance.lock` that blocks new profile/state
 
 ### Lifecycle and pending-call diagnosis
 
-`server_info.runtime.lifecycle` reports `ready`, `starting`, `running`, `failed`, `stopping`, or `stopped`. `runtime.observability.in_flight_calls` and `runtime.observability.processes` distinguish a blocked call from a surviving process. Worker `server_info.worker.pending_calls` reports both the internal-call index and client request-key index; they must return to zero after a terminal result, cancellation, timeout, send failure, or daemon disconnect. Nonzero request-key counts after active calls reach zero indicate a lifecycle defect rather than normal load.
+`server_info.runtime.lifecycle` reports `ready`, `starting`, `running`, `failed`, `stopping`, or `stopped`. `runtime.observability.in_flight_calls` and `runtime.observability.processes` distinguish a blocked call from a surviving process. Worker `server_info.worker.pending_calls` reports both the internal-call index and client request-key index; they must return to zero after a terminal result, explicit cancellation, client disconnect, timeout, send failure, or daemon disconnect. Nonzero request-key counts after active calls reach zero indicate a lifecycle defect rather than normal load. `worker.observability.calls.unmatched_results` is the bounded counter for late results that no longer have a receiver.
 
 Stable errors include `policy_denied`, `invalid_request`, `timeout`, `cancelled`, `network_error`, `unavailable`, `limit_exceeded`, and `integrity_error`, with retryability metadata. Diagnose by code first; free-form messages are guidance, not an API contract.
 
@@ -161,7 +163,7 @@ Logging is level-based:
 error  unrecoverable local/transport/service failures
 warn   persistent retryable relay degradation, supersession, and service problems
 info   startup/deploy/connect transitions
-debug  all per-tool starts/successes/failures/cancellations/timing, correlation and reconnect details
+debug  all per-tool starts/successes/failures/cancellations/timing, late-result disposal, correlation and reconnect details
 ```
 
 Foreground mode defaults to `info`; autostart uses `warn`. Use `--verbose` or `--log-level debug` only for diagnosis. `--quiet` is an alias for `--log-level error`.

package/docs/UPGRADING.md

@@ -4,9 +4,11 @@
 
 Machine Bridge does not retain parallel implementations for obsolete MCP protocol dates, policy revisions, state schemas, lock formats, or browser-extension protocols. The supported path is a direct upgrade from the immediately preceding published package while its state already uses the current schema.
 
-Version 1.2.1 keeps local state schema version 6 and policy revision 5 unchanged. Existing 1.2.0 workspaces, named accounts, resource registrations, managed-job history, Worker identity, and browser pairing state are reused without a schema conversion. The package change affects validation and adapter ownership, not the stored authority model.
+Version 1.2.2 keeps local state schema version 6 and policy revision 5 unchanged. Existing 1.2.1 workspaces, named accounts, resource registrations, managed-job history, Worker identity, and browser pairing state are reused without a schema conversion. The package change affects relay call/result lifetime, Worker request cancellation, logging presentation, and observability; it does not alter the stored authority model.
 
-Version 1.2.0 could accept prototype-shaped account roles through malformed administration input. On the first 1.2.1 Worker access, such an account is preserved for recovery but repaired fail-closed: its role becomes `reviewer`, it is disabled, its account version advances, and its authorization codes and tokens are removed. An operator can then assign a valid role, enable the account, and rotate its password through the normal account administration flow. A local policy record with an unknown profile label is normalized to `custom` while retaining its explicit capability fields; an invalid explicit `--profile` is rejected.
+Version 1.2.2 requires the Worker, local daemon, and browser extension to converge on the same package version. Normal startup redeploys the versioned Worker when required. The Worker configuration now enables Cloudflare request-signal delivery and signal passthrough to the Durable Object; an old Worker therefore does not provide the new HTTP-disconnect cancellation path even when the local daemon has already been upgraded.
+
+Version 1.2.0 could accept prototype-shaped account roles through malformed administration input. On the first 1.2.1 or later Worker access, such an account is preserved for recovery but repaired fail-closed: its role becomes `reviewer`, it is disabled, its account version advances, and its authorization codes and tokens are removed. An operator can then assign a valid role, enable the account, and rotate its password through the normal account administration flow. A local policy record with an unknown profile label is normalized to `custom` while retaining its explicit capability fields; an invalid explicit `--profile` is rejected.
 
 A state file from an older unsupported schema is rejected rather than guessed or silently rewritten. Upgrade an old installation through the last release that understands its schema, or initialize a new workspace and re-register resources. Do not edit schema numbers by hand.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/call-registry.mjs

@@ -100,12 +100,18 @@ export class CallRegistry {
     return true;
   }
 
+  /** @param {unknown} origin */
+  idsByOrigin(origin) {
+    const expected = String(origin || "");
+    return [...this.calls.values()]
+      .filter((record) => record.origin === expected)
+      .map((record) => record.id);
+  }
+
   /** @param {unknown} origin @param {unknown} [reason] */
   cancelOrigin(origin, reason = "transport disconnected") {
-    const expected = String(origin || "");
     let cancelled = 0;
-    for (const [id, record] of this.calls) {
-      if (record.origin !== expected) continue;
+    for (const id of this.idsByOrigin(origin)) {
       if (this.cancel(id, reason)) cancelled += 1;
     }
     return cancelled;

package/src/local/log.mjs

@@ -55,7 +55,7 @@ export function createLogger(options = {}) {
     const normalizedLevel = normalizeEventLevel(level);
     const eventName = sanitizeEventName(name);
     const payload = { event: eventName, ...fields };
-    const humanMessage = message || eventName;
+    const humanMessage = message || humanizeEventName(eventName);
     if (options.format === "json") {
       if (LEVEL_RANK[normalizedLevel] < LEVEL_RANK[minimumLevel]) return;
       const entry = sanitizeLogValue({
@@ -77,7 +77,7 @@ export function createLogger(options = {}) {
       error: [stderr, "[error]", COLORS.red],
     };
     const [stream, label, color] = methods[normalizedLevel];
-    write(stream, normalizedLevel, label, color, humanMessage, payload);
+    write(stream, normalizedLevel, label, color, humanMessage, fields);
   };
 
   return {
@@ -189,6 +189,14 @@ function normalizeEventLevel(value) {
   return Object.prototype.hasOwnProperty.call(LEVEL_RANK, level) ? level : "info";
 }
 
+function humanizeEventName(value) {
+  const words = String(value || "event")
+    .replace(/[._-]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : "Event";
+}
+
 function sanitizeEventName(value) {
   const name = String(value || "event").toLowerCase().replace(/[^a-z0-9._-]/g, "_").slice(0, 128);
   return name || "event";

package/src/local/relay-connection.mjs

@@ -73,6 +73,8 @@ export class RelayConnection {
     this.connectedOnce = null;
     this.connectedOnceResolve = null;
     this.connectedOnceReject = null;
+    this.sessionGeneration = 0;
+    this.activeSessionId = 0;
   }
 
   status() {
@@ -82,9 +84,14 @@ export class RelayConnection {
       network_route: this.networkRoute,
       reconnect_attempt: this.reconnectAttempt,
       outage_active: this.outageStartedAt > 0,
+      session_generation: this.sessionGeneration,
     };
   }
 
+  currentSessionId() {
+    return this.ready ? this.activeSessionId : 0;
+  }
+
   start() {
     if (!this.closed && this.connectedOnce) return this.connectedOnce;
     this.closed = false;
@@ -99,6 +106,7 @@ export class RelayConnection {
   stop() {
     this.closed = true;
     this.ready = false;
+    this.activeSessionId = 0;
     this.clearTimer("heartbeatTimer", "clearInterval");
     this.clearTimer("connectTimer", "clearTimeout");
     this.clearTimer("handshakeTimer", "clearTimeout");
@@ -118,6 +126,15 @@ export class RelayConnection {
     return this.sendOnSocket(this.socket, value);
   }
 
+  sendForSession(value, expectedSessionId) {
+    const sessionId = Number(expectedSessionId) || 0;
+    if (!sessionId || sessionId !== this.activeSessionId) return { ok: false, reason: "session_ended" };
+    if (!this.ready || !this.isSocketOpen(this.socket)) return { ok: false, reason: "transport_unavailable" };
+    return this.sendOnSocket(this.socket, value)
+      ? { ok: true, reason: "sent" }
+      : { ok: false, reason: "send_failed" };
+  }
+
   interrupt(category = "relay_transport_error") {
     if (this.closed || !this.socket) return false;
     this.pendingCloseCategory = String(category || "relay_transport_error");
@@ -148,6 +165,8 @@ export class RelayConnection {
       return false;
     }
     this.ready = true;
+    this.sessionGeneration += 1;
+    this.activeSessionId = this.sessionGeneration;
     this.clearTimer("handshakeTimer", "clearTimeout");
     this.connectedAt = this.now();
     this.lastInboundAt = this.connectedAt;
@@ -268,6 +287,7 @@ export class RelayConnection {
       const wasReady = this.ready;
       this.socket = null;
       this.ready = false;
+      this.activeSessionId = 0;
       this.clearTimer("connectTimer", "clearTimeout");
       this.clearTimer("heartbeatTimer", "clearInterval");
       this.clearTimer("handshakeTimer", "clearTimeout");
@@ -329,6 +349,7 @@ export class RelayConnection {
     const socket = this.socket;
     this.closed = true;
     this.ready = false;
+    this.activeSessionId = 0;
     this.socket = null;
     this.clearTimer("connectTimer", "clearTimeout");
     this.clearTimer("heartbeatTimer", "clearInterval");

package/src/local/runtime.mjs

@@ -113,6 +113,8 @@ export class LocalRuntime {
     this.processTracker = new ProcessTracker();
     this.lifecycle = new LifecycleController("local runtime");
     this.observability = new RuntimeObservability();
+    this.activeRelayCalls = new Set();
+    this.suppressedRelayResults = new Map();
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
       onCancel: (record) => {
@@ -121,7 +123,7 @@ export class LocalRuntime {
         this.processTracker.terminateCall(record.id);
         this.logger.event?.("debug", "tool.call.cancel_requested", {
           call_id: shortCallId(record.id), tool: record.tool, origin: record.origin,
-        });
+        }, "Tool call cancellation requested");
       },
       onFinish: (record) => this.processTracker.releaseCall(record.id),
     });
@@ -289,7 +291,7 @@ export class LocalRuntime {
     return this.relay?.send(value) === true;
   }
 
-  async handleMessage(raw) {
+  async handleMessage(raw, relayContext = {}) {
     let message;
     try { message = JSON.parse(raw); } catch {
       this.handleRelayProtocolViolation("invalid_server_json");
@@ -304,7 +306,7 @@ export class LocalRuntime {
       this.handleRelayProtocolViolation("unexpected_server_message_type");
       return;
     }
-    await this.handleRelayToolCall(message);
+    await this.handleRelayToolCall(message, relayContext);
   }
 
   handleRelayControlMessage(message) {
@@ -322,7 +324,7 @@ export class LocalRuntime {
       return true;
     }
     if (message.type === "cancel_call") {
-      if (typeof message.id === "string") this.cancelCall(message.id, "remote cancellation");
+      if (typeof message.id === "string") this.cancelRelayCall(message.id, "caller_cancelled");
       return true;
     }
     return false;
@@ -336,37 +338,65 @@ export class LocalRuntime {
     this.logger.error?.("remote relay protocol error; upgrade and redeploy both components, then restart the daemon");
   }
 
-  async handleRelayToolCall(message) {
+  async handleRelayToolCall(message, relayContext = {}) {
     const envelope = normalizeRelayToolCall(message);
+    const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!envelope.ok) {
-      this.logger.event?.("warn", "relay.tool_call.invalid", { has_call_id: Boolean(envelope.id) });
+      this.logger.warn?.("Received an invalid tool request from the relay; the request was rejected.");
+      this.logger.event?.("debug", "relay.tool_call.invalid", {
+        has_call_id: Boolean(envelope.id),
+      }, "Invalid relay tool request details");
       if (envelope.id) this.deliverRelayToolResult({
         type: "tool_result",
         id: envelope.id,
         ok: false,
         error: { code: "invalid_request", message: "invalid tool_call envelope", retryable: false },
-      });
+      }, relaySessionId);
+      return;
+    }
+    if (this.activeRelayCalls.has(envelope.id)) {
+      this.handleRelayProtocolViolation("duplicate_tool_call_id");
       return;
     }
-    let response;
+    this.activeRelayCalls.add(envelope.id);
     try {
-      const result = await this.executeTool(envelope.tool, envelope.arguments, {
-        callId: envelope.id,
-        origin: "relay",
-        timeoutMs: envelope.timeoutMs,
-        authorization: envelope.authorization,
-      });
-      response = { type: "tool_result", id: envelope.id, ok: true, result };
-    } catch (error) {
-      response = { type: "tool_result", id: envelope.id, ok: false, error: publicError(error) };
+      let response;
+      try {
+        const result = await this.executeTool(envelope.tool, envelope.arguments, {
+          callId: envelope.id,
+          origin: "relay",
+          timeoutMs: envelope.timeoutMs,
+          authorization: envelope.authorization,
+        });
+        response = { type: "tool_result", id: envelope.id, ok: true, result };
+      } catch (error) {
+        response = { type: "tool_result", id: envelope.id, ok: false, error: publicError(error) };
+      }
+      const suppressionReason = this.suppressedRelayResults.get(envelope.id) || "";
+      if (suppressionReason) {
+        this.logger.event?.("debug", "relay.tool_result.discarded", {
+          call_id: shortCallId(envelope.id), reason: suppressionReason,
+        }, "Discarded a tool result because the caller was no longer waiting");
+        return;
+      }
+      this.deliverRelayToolResult(response, relaySessionId);
+    } finally {
+      this.activeRelayCalls.delete(envelope.id);
+      this.suppressedRelayResults.delete(envelope.id);
     }
-    this.deliverRelayToolResult(response);
   }
 
-  deliverRelayToolResult(response) {
-    if (this.send(response)) return true;
-    this.logger.event?.("warn", "relay.tool_result.delivery_failed", { call_id: shortCallId(response?.id) });
-    this.relay?.interrupt?.("relay_transport_error");
+  deliverRelayToolResult(response, relaySessionId = 0) {
+    const outcome = this.relay?.sendForSession?.(response, relaySessionId)
+      || (this.send(response) ? { ok: true, reason: "sent" } : { ok: false, reason: "transport_unavailable" });
+    if (outcome.ok) return true;
+    const reason = String(outcome.reason || "transport_unavailable");
+    this.logger.event?.("debug", "relay.tool_result.discarded", {
+      call_id: shortCallId(response?.id), reason,
+    }, reason === "send_failed"
+      ? "Could not send a tool result because the relay transport failed"
+      : "Discarded a tool result because its relay session had ended");
+    if (reason === "send_failed") this.relay?.interrupt?.("relay_transport_error");
     return false;
   }
 
@@ -379,11 +409,19 @@ export class LocalRuntime {
     return this.callRegistry.cancel(callId, reason);
   }
 
+  cancelRelayCall(callId, suppressionReason = "caller_cancelled") {
+    const id = String(callId);
+    if (this.activeRelayCalls.has(id)) this.suppressedRelayResults.set(id, suppressionReason);
+    return this.cancelCall(id, "remote cancellation");
+  }
+
   handleRelayDisconnect() {
+    for (const callId of this.activeRelayCalls) this.suppressedRelayResults.set(callId, "relay_disconnected");
     const cancelled = this.callRegistry.cancelOrigin("relay", "remote relay disconnected");
     this.terminateActiveProcesses("SIGTERM", true);
     if (cancelled > 0) {
-      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled });
+      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled },
+        "Cancelled in-flight tool calls after the relay connection ended");
     }
   }
 
@@ -669,7 +707,7 @@ function createRelayConnection(runtime, { workerUrl, secret, expectedVersion, on
       policy: runtime.policy,
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
     }),
-    onMessage: (data) => handleRelayData(runtime, data),
+    onMessage: (data, relayContext) => handleRelayData(runtime, data, relayContext),
     onDisconnect: () => runtime.handleRelayDisconnect(),
     onSuperseded: () => {
       runtime.terminateActiveProcesses("SIGKILL");
@@ -684,13 +722,13 @@ function createRelayConnection(runtime, { workerUrl, secret, expectedVersion, on
   });
 }
 
-function handleRelayData(runtime, data) {
+function handleRelayData(runtime, data, relayContext = {}) {
   const raw = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
   if (Buffer.byteLength(raw) > MAX_WS_MESSAGE_BYTES) {
     runtime.handleRelayProtocolViolation("server_message_too_large");
     return;
   }
-  return runtime.handleMessage(raw);
+  return runtime.handleMessage(raw, relayContext);
 }
 
 function normalizeRelayToolCall(message) {

package/src/local/tool-executor.mjs

@@ -67,7 +67,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       call_id: shortCallId(operation.context.callId),
       tool: operation.tool,
       origin: operation.context.origin,
-    });
+    }, "Tool call started");
     try {
       const result = await next(operation);
       const durationMs = performance.now() - started;
@@ -75,7 +75,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       observability.finish(operation.tool, { status: "completed", durationMs, slow });
       logger.event?.("debug", slow ? "tool.call.slow" : "tool.call.completed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin, duration_ms: durationMs,
-      });
+      }, slow ? "Tool call completed slowly" : "Tool call completed");
       return result;
     } catch (error) {
       const normalized = normalizeBridgeError(error, { safeMessage: () => safeMessage(error, operation.args) });
@@ -86,7 +86,7 @@ function observabilityMiddleware(observability, logger, safeMessage, slowMs) {
       logger.event?.("debug", "tool.call.failed", {
         call_id: shortCallId(operation.context.callId), tool: operation.tool, origin: operation.context.origin,
         duration_ms: durationMs, error_code: code, retryable: normalized.retryable,
-      });
+      }, "Tool call failed");
       throw normalized;
     }
   };

package/src/worker/index.ts

@@ -17,7 +17,7 @@ import {
 } from "./http.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.1";
+const SERVER_VERSION = "1.2.2";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";
@@ -220,8 +220,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       return;
     }
 
-    if (body.ok === false) this.pending.reject(body.id, daemonToolError(body.error), ws);
-    else this.pending.resolve(body.id, ws, body.result);
+    const matched = body.ok === false
+      ? this.pending.reject(body.id, daemonToolError(body.error), ws)
+      : this.pending.resolve(body.id, ws, body.result);
+    if (!matched) this.observability.unmatchedResult();
   }
 
   async webSocketClose(ws: WebSocket): Promise<void> {
@@ -269,19 +271,31 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
     const session = await resolveMcpSession(request, body.method, this.oauth.identityKey(), authorized.tokenKey);
     if (session.kind === "invalid") return json(rpcError(body.id, -32001, "MCP session not found"), 404);
-    const response = await this.dispatchJsonRpc(body, base, authorized, session.kind === "active" ? session.sessionId : "");
+    const response = await this.dispatchJsonRpc(
+      body,
+      base,
+      authorized,
+      session.kind === "active" ? session.sessionId : "",
+      request.signal,
+    );
     if (response === null) return new Response(null, { status: 202 });
     return session.kind === "initialize" ? json(response, 200, { "mcp-session-id": session.sessionId }) : json(response);
   }
 
-  private async dispatchJsonRpc(request: JsonRpcRequest, base: string, authorized: AuthorizedToken, sessionId: string): Promise<Record<string, unknown> | null> {
+  private async dispatchJsonRpc(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    sessionId: string,
+    signal?: AbortSignal,
+  ): Promise<Record<string, unknown> | null> {
     if (request.method === "initialize") {
       const requested = asObject(request.params).protocolVersion;
       const protocolVersion = typeof requested === "string" && MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(requested as typeof MCP_SUPPORTED_PROTOCOL_VERSIONS[number])
         ? requested
         : MCP_PROTOCOL_VERSION;
       const bootstrap = this.daemonToolEnabled("session_bootstrap")
-        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized).catch(() => null)
+        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized, undefined, signal).catch(() => null)
         : null;
       const localInstructions = sessionInstructionText(bootstrap);
       return rpcResult(request.id, {
@@ -310,7 +324,14 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const name = requiredString(params, "name");
       const args = asObject(params.arguments);
       try {
-        const result = await this.callTool(name, args, base, authorized, mcpClientRequestKey(authorized.tokenKey, sessionId, request.id));
+        const result = await this.callTool(
+          name,
+          args,
+          base,
+          authorized,
+          mcpClientRequestKey(authorized.tokenKey, sessionId, request.id),
+          signal,
+        );
         return rpcResult(request.id, textToolResult(result));
       } catch (error) {
         return rpcResult(request.id, textToolResult({ error: publicWorkerToolError(error) }, true));
@@ -318,7 +339,14 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     return rpcError(request.id, -32601, `Method not found: ${request.method}`);
   }
-  private async callTool(name: string, args: Record<string, unknown>, base: string, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
+  private async callTool(
+    name: string,
+    args: Record<string, unknown>,
+    base: string,
+    authorized: AuthorizedToken,
+    requestKey?: string,
+    signal?: AbortSignal,
+  ): Promise<unknown> {
     if (name === "server_info") {
       const { daemon, tools, authorization } = this.authorityContext(authorized);
       return {
@@ -351,13 +379,19 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (workspaceTools.some((tool) => tool.name === name)) {
       if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
-      const result = await this.callDaemonTool(name, args, authorized, requestKey);
+      const result = await this.callDaemonTool(name, args, authorized, requestKey, signal);
       return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
         accountVersion: authorized.accountVersion, role: authorized.role }) : result;
     }
     throw new Error(`unknown tool: ${name}`);
   }
-  private async callDaemonTool(name: string, args: Record<string, unknown>, authorized: AuthorizedToken, requestKey?: string): Promise<unknown> {
+  private async callDaemonTool(
+    name: string,
+    args: Record<string, unknown>,
+    authorized: AuthorizedToken,
+    requestKey?: string,
+    signal?: AbortSignal,
+  ): Promise<unknown> {
     const socket = this.daemonSockets()[0];
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
     const id = randomToken("call");
@@ -374,6 +408,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
           return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
         },
+        signal,
+        onAbort: (record) => {
+          sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+          return new WorkerToolError("cancelled", "MCP client stopped waiting for the tool result");
+        },
       });
     } catch (error) {
       if (error instanceof PendingCallRegistrationError) {
@@ -382,13 +421,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       throw error;
     }
     this.observability.callStarted(name);
-    try {
-      socket.send(JSON.stringify({
-        type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
-        authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
-      }));
-    } catch {
-      this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
+    if (!signal?.aborted) {
+      try {
+        socket.send(JSON.stringify({
+          type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
+          authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
+        }));
+      } catch {
+        this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
+      }
     }
     try {
       const value = await result;

package/src/worker/observability.ts

@@ -5,7 +5,7 @@ const SENSITIVE_FIELD = /(?:authorization|cookie|credential|password|secret|toke
 export class WorkerObservability {
   private readonly startedAt = performance.now();
   private readonly requests = { total: 0, successful: 0, client_error: 0, server_error: 0 };
-  private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0 };
+  private readonly calls = { started: 0, completed: 0, failed: 0, cancelled: 0, timed_out: 0, unmatched_results: 0 };
   private readonly sockets = { candidates: 0, authenticated: 0, disconnected: 0, protocol_errors: 0 };
   private readonly errors = new Map<string, number>();
   private readonly tools = new Map<string, { started: number; completed: number; failed: number; active: number }>();
@@ -39,6 +39,8 @@ export class WorkerObservability {
     this.incrementError(code);
   }
 
+  unmatchedResult(): void { this.calls.unmatched_results += 1; }
+
   socketCandidate(): void { this.sockets.candidates += 1; }
   socketAuthenticated(): void { this.sockets.authenticated += 1; }
   socketDisconnected(): void { this.sockets.disconnected += 1; }

package/src/worker/pending-calls.ts

@@ -19,6 +19,8 @@ export interface PendingCallRecord {
   timeout: ReturnType<typeof setTimeout>;
   resolve: (value: unknown) => void;
   reject: (error: Error) => void;
+  signal?: AbortSignal;
+  abortHandler?: () => void;
 }
 
 interface RegisterPendingCall {
@@ -28,6 +30,8 @@ interface RegisterPendingCall {
   tool: string;
   timeoutMs: number;
   onTimeout: (record: PendingCallRecord) => Error;
+  signal?: AbortSignal;
+  onAbort?: (record: PendingCallRecord) => Error;
 }
 
 export class PendingCallRegistry {
@@ -63,6 +67,14 @@ export class PendingCallRegistry {
         catch { error = new Error("pending daemon call timed out"); }
         reject(error instanceof Error ? error : new Error("pending daemon call timed out"));
       }, input.timeoutMs);
+      const abortHandler = () => {
+        const record = this.take(input.id);
+        if (!record) return;
+        let error: unknown;
+        try { error = input.onAbort?.(record); }
+        catch { error = new Error("pending daemon call was cancelled"); }
+        reject(error instanceof Error ? error : new Error("pending daemon call was cancelled"));
+      };
       const record: PendingCallRecord = {
         id: input.id,
         socket: input.socket,
@@ -72,9 +84,13 @@ export class PendingCallRegistry {
         timeout,
         resolve,
         reject,
+        signal: input.signal,
+        abortHandler: input.signal ? abortHandler : undefined,
       };
       this.byId.set(input.id, record);
       if (input.clientRequestKey) this.byRequestKey.set(input.clientRequestKey, input.id);
+      if (input.signal?.aborted) abortHandler();
+      else input.signal?.addEventListener("abort", abortHandler, { once: true });
     });
   }
 
@@ -131,6 +147,7 @@ export class PendingCallRegistry {
     const record = this.byId.get(id);
     if (!record) return undefined;
     clearTimeout(record.timeout);
+    if (record.signal && record.abortHandler) record.signal.removeEventListener("abort", record.abortHandler);
     this.byId.delete(id);
     if (record.clientRequestKey && this.byRequestKey.get(record.clientRequestKey) === id) {
       this.byRequestKey.delete(record.clientRequestKey);

package/wrangler.jsonc

@@ -3,7 +3,7 @@
   "name": "machine-bridge-mcp",
   "main": "src/worker/index.ts",
   "compatibility_date": "2026-07-11",
-  "compatibility_flags": ["nodejs_compat"],
+  "compatibility_flags": ["nodejs_compat", "enable_request_signal", "request_signal_passthrough"],
   "workers_dev": true,
   "durable_objects": {
     "bindings": [