machine-bridge-mcp 1.2.10 → 1.2.11

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.2.11 - 2026-07-20
+
+### Bounded output continuation and repository backlog gate
+
+- Stop large one-shot process responses from overwhelming MCP hosts. `run_process`, `run_local_command`, and `exec_command` now inline only a bounded stdout/stderr preview, retain up to 1 MiB per stream in a temporary completed process session, and return an `output_session_id` for paged `read_process` continuation. Nonzero exits keep their human error message bounded while preserving structured continuation details.
+- Avoid protocol-level payload duplication by replacing the text mirror of large object results with a compact field summary while retaining the authoritative object in `structuredContent`. The fast/platform/full check runner suppresses successful child noise, preserves bounded head/tail diagnostics on failure, and supports explicit `MBM_CHECK_VERBOSE=1` streaming. Coverage cleanup now retries concurrent late V8 coverage-file writes instead of failing after the thresholds already passed.
+- Resolve the release-acceptance file race by opening no-follow descriptors first, checking descriptor/path identity, and reading acceptance records and tarballs through bounded descriptors. Remove the temporary CodeQL exception and add deterministic path-replacement and symbolic-link regressions.
+- Add a guarded GitHub backlog pre-push check. `npm run github:push` now blocks unrelated open pull requests and open issues not covered by a standard closing keyword in the current branch commits; the current branch PR remains updateable. Add unit and integration coverage for output paging, compact MCP projection, bounded check diagnostics, and backlog enforcement.
+
 ## 1.2.10 - 2026-07-20
 
 ### Relay interruption recovery

package/CONTRIBUTING.md

@@ -44,7 +44,7 @@ Repository-only infrastructure changes, such as a `.github/` workflow update, do
 6. give the repository owner `npm run release:candidate:start -- --allow-worker-deploy`; the owner explicitly authorizes the in-place candidate Worker deployment, starts the exact candidate locally, and leaves it running;
 7. verify the live candidate through Machine Bridge, including Worker version/hash, remote health, relay readiness, exact local version, and representative functionality relevant to the change;
 8. after observed verification succeeds, have the coding agent run the exact `release:accept` command printed by the candidate tool, creating `release-acceptance/v<version>.json`;
-9. commit the acceptance record and push the clean non-`main` branch only with `npm run github:push`.
+9. resolve every open issue and pull request before pushing. The current branch may cover an issue only with a standard closing keyword such as `Closes #47`; unrelated open PRs block the push. Commit the acceptance record and push the clean non-`main` branch only with `npm run github:push`, which paginates and enforces that backlog contract.
 
 Automated checks do not authorize step 8. The coding agent may record acceptance only after it has observed the owner-started candidate operating successfully. Any packaged-file change after acceptance changes the npm tarball hash and requires a regenerated candidate and another observed live verification.
 

package/README.md

@@ -217,7 +217,7 @@ Major groups include:
 
 ```sh
 npm ci
-npm run check:fast       # local feedback: static, unit, architecture, policy, lifecycle
+npm run check:fast       # quiet-success local feedback; set MBM_CHECK_VERBOSE=1 only for live child logs
 npm run check            # complete suite, equivalent to check:full
 npm run worker:dry-run
 npm audit --audit-level=high

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.2.10"
+  "version_name": "1.2.11"
 }

package/docs/ARCHITECTURE.md

@@ -213,7 +213,11 @@ This is a process-level transaction, not a filesystem-wide atomic transaction ac
 
 The default `full` profile passes the complete parent environment. Isolated environment mode, used by the narrower named profiles unless overridden, creates private runtime HOME, temporary, and cache directories and passes only a small set of path/locale/platform variables. It reduces accidental credential inheritance but cannot prevent explicit access to known filesystem paths, credential stores, network services, or other user resources.
 
-`execution-limits.mjs` is the shared source for local tool-call concurrency, one-shot process timeout/stdin/output limits, and process-session count/stdin/output/retention limits. `server_info.runtime.execution_guardrails` reports those enforced limits together with explicit `not-enforced` values for CPU quota, memory quota, and network isolation. One-shot calls have bounded output and timeouts. Startup-lock waits, daemon takeover, process-session reads, managed-job recovery handoff, browser/page waits, application-cache freshness, and in-memory duration metrics use monotonic elapsed time, so wall-clock correction cannot extend or prematurely terminate their configured duration. Persisted timestamps and retention/credential expiry continue to use wall time. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Session IDs are random. Sessions are memory-only and are killed on runtime stop, remote disconnect, or daemon replacement.
+`execution-limits.mjs` is the shared source for local tool-call concurrency, one-shot process timeout/stdin/output limits, and process-session count/stdin/output/retention limits. `server_info.runtime.execution_guardrails` reports those enforced limits together with explicit `not-enforced` values for CPU quota, memory quota, and network isolation. Public one-shot commands inline at most 32 KiB per stream. When either stream exceeds that preview, the runtime keeps up to 1 MiB per stream in a closed in-memory process session for thirty minutes and returns an `output_session_id`; `read_process` then reads monotonic byte-offset pages. The oldest exited session is evicted before an active session is refused, so continuation retention is explicitly best effort rather than durable. The continuation stores command basename and cwd metadata but not argv or shell text. It is memory-only and disappears on runtime stop or daemon replacement.
+
+Large object results use `structuredContent` as the authoritative representation. The human text mirror is complete only below the shared 16 KiB projection threshold; above it, both local stdio and the Worker return the same compact byte-count/field summary instead of serializing the object a second time. `process-result-projection.mjs`, `process-output-stream.mjs`, and the shared result projector keep lifecycle, byte retention, and MCP presentation as separate boundaries.
+
+Startup-lock waits, daemon takeover, process-session reads, managed-job recovery handoff, browser/page waits, application-cache freshness, and in-memory duration metrics use monotonic elapsed time, so wall-clock correction cannot extend or prematurely terminate their configured duration. Persisted timestamps and retention/credential expiry continue to use wall time. Process sessions retain bounded byte buffers with monotonic offsets, accept bounded stdin, support short output/exit waits, and are capped per runtime. Valid UTF-8 is returned as text; byte slices that are not valid UTF-8 also include lossless base64 data. Head/tail previews trim incomplete UTF-8 boundary code points instead of introducing replacement characters. Session IDs are random. Running sessions are killed on runtime stop, remote disconnect, or daemon replacement.
 
 Child processes run in a separate process group where supported. Timeout, cancellation, disconnect, and replacement send termination to process trees, with a referenced forced-escalation timer that remains alive even when the direct child exits before a resistant descendant. Windows uses tree-aware task termination.
 

package/docs/AUDIT.md

@@ -1,5 +1,17 @@
 # Security and privacy audit notes
 
+## 2026-07-20 version 1.2.11 bounded-result and release-file audit
+
+The reported web truncation was not one defect. One-shot command tools retained up to 512 KiB independently for stdout and stderr, returned no continuation handle after dropping their middle, and generic MCP framing serialized object results once as text and again as `structuredContent`. The layered verification runner then inherited every child stream, so a long successful gate could accumulate output even though only its final status mattered. Nonzero process exits also promoted the retained stderr preview into the human error message. These independent amplification points made host-side response truncation frequent and made locally truncated command output unrecoverable.
+
+Version 1.2.11 separates preview, retention, and presentation. Public one-shot commands inline 32 KiB per stream and retain up to 1 MiB per stream in an exited in-memory process session. The response supplies a random `output_session_id` and bounded `read_process` parameters; reads use monotonic offsets, disclose aged-out data, and preserve invalid byte slices with base64. Failed commands keep a bounded message and carry the same continuation only in exposed structured details. Large object results have one authoritative `structuredContent` value and a short shared text projection rather than a second full JSON serialization. UTF-8 head/tail previews no longer split Chinese or emoji code points. Green verification tasks suppress child noise; failures retain bounded head and tail, while explicit verbose mode remains available.
+
+The only open security issue concerned `lstat` followed by path-based reads of release acceptance JSON and candidate tarballs. Both now open with no-follow semantics, validate the descriptor as a regular file, compare descriptor and path identity, enforce a pre-allocation size ceiling, and read through the descriptor. Deterministic tests replace the path after open and prove the descriptor remains authoritative; symlink records and tarballs fail closed. The temporary CodeQL file-race exception is removed. The guarded push path now also paginates the complete GitHub issue/PR backlog and refuses unrelated open PRs or issues not closed by the current branch, making repository backlog completion an executable release condition rather than a conversational promise.
+
+Repeated full-gate execution also exposed a separate test-infrastructure race: V8 could finish writing a coverage file just after the last fixture process exited, causing recursive cleanup to fail with `ENOTEMPTY` even though every threshold passed. Coverage cleanup now uses bounded retry/backoff, the contract is architecture-tested, and three consecutive coverage runs pass.
+
+Privacy review found no new durable output store. Continuation bytes live only in the daemon heap, share the existing eight-session/30-minute bounds, are omitted from logs and acceptance records, and disappear on runtime stop. Complete and production dependency audits remain at zero vulnerabilities; registry signatures, attestations, package file modes, generated references, and reachable Git history privacy checks are independently verified.
+
 ## 2026-07-20 version 1.2.10 transient-relay recovery audit
 
 Repeated ChatGPT web executions were terminating even though the local daemon and Worker were healthy immediately afterward. The causal defect was not the tool implementation or its configured timeout. A brief WebSocket loss—made more likely when the daemon relay traverses an environment-selected local proxy—was promoted into a terminal request failure at both ends: the Worker rejected every pending call assigned to the closed socket, while the local runtime cancelled all relay-origin calls and killed their ordinary child processes. Automatic WebSocket reconnection restored future traffic but could not recover the request already abandoned by both state machines.

package/docs/LOGGING.md

@@ -77,7 +77,9 @@ With `--verbose`, the same incident additionally includes bounded structured fie
 
 ## Tool and result-delivery events
 
-All per-tool starts, successes, failures, cancellations, timing, and expected late-result disposal are debug-only. The MCP response already reports the outcome to the caller; duplicating routine tool traffic at default levels creates noise and can reveal activity patterns.
+All per-tool starts, successes, failures, cancellations, timing, and expected late-result disposal are debug-only. The MCP response already reports the outcome to the caller; duplicating routine tool traffic at default levels creates noise and can reveal activity patterns. Completed one-shot output continuations are not written to daemon logs or disk; their bounded stdout/stderr remains only in the daemon process-session memory and expires with normal session retention.
+
+The layered repository check runner follows the same noise rule. Green child-task output is discarded after the child exits; only task name and elapsed time are printed. Failed tasks expose bounded head/tail stdout and stderr diagnostics. `MBM_CHECK_VERBOSE=1` is an explicit operator choice to stream raw child output and is not used by default or CI.
 
 A completed local result is normally sent on the ready relay connection. If that socket disappears, the runtime queues the bounded result envelope during the thirty-second same-daemon reconnect window rather than logging a terminal delivery failure. Debug output records only a shortened call ID and queue/reconnect counts. After the same daemon process completes readiness, replay emits one recovery event; a different process cannot inherit the result. Explicit caller cancellation suppresses eventual delivery. If the relay does not recover before the grace deadline, ordinary calls are cancelled, queued results are discarded, and the existing outage state machine determines whether the persistent failure warrants a warning. Tool arguments, commands, and result content are never logged.
 

package/docs/OPERATIONS.md

@@ -248,8 +248,9 @@ Defense-in-depth limits include:
 - text writes and patch envelopes: 5 MiB;
 - images: 4 MiB before base64 encoding;
 - shell/argv envelope: 64 KiB;
-- captured one-shot output: 512 KiB per stream by default;
-- process-session retained output: 1 MiB per stream, with lossless base64 fallback for non-UTF-8 slices;
+- public one-shot output preview: 32 KiB per stream; larger output returns an `output_session_id` and remains readable through `read_process`;
+- internal bounded subprocess capture: 512 KiB per stream by default;
+- running or completed process-session retained output: 1 MiB per stream for up to 30 minutes, best effort subject to the eight-session capacity, with monotonic offsets and lossless base64 fallback for non-UTF-8 slices;
 - process sessions: 8 retained per runtime;
 - process stdin write: 64 KiB per call;
 - local simultaneous tool calls: 16;

package/docs/RELEASING.md

@@ -73,7 +73,7 @@ Commit the candidate changes and acceptance record, then push the branch only th
 npm run github:push
 ```
 
-The command requires a clean non-`main` branch, verifies that the acceptance record is tracked, rebuilds the npm package, compares both hashes, and only then executes a non-force push of the current branch. Direct pushes to `main` remain prohibited. Any packaged-file change after acceptance invalidates the hash and blocks the next push until the owner retests a regenerated candidate.
+The command requires a clean non-`main` branch, fetches `origin/main`, paginates all open GitHub issues and pull requests, and refuses to push while an unrelated PR remains open or an issue is not covered by a standard closing keyword in `origin/main..HEAD`. An already-open PR for the current branch is allowed so it can be updated. The command then verifies that the acceptance record is tracked, rebuilds the npm package, compares both hashes, and only then executes a non-force push of the current branch. Direct pushes to `main` remain prohibited. Any packaged-file change after acceptance invalidates the hash and blocks the next push until the owner retests a regenerated candidate.
 
 Open a pull request, satisfy the required checks, and squash-merge. Pull-request CI repeats the acceptance verification. A content-preserving squash changes the Git commit but not the package bytes, so the accepted hash remains valid.
 

package/docs/TESTING.md

@@ -12,12 +12,16 @@ npm run check           # complete suite; equivalent to check:full
 
 The explicit task lists live in `scripts/check-plan.mjs`. The fast plan retains static analysis, policy, architecture, contracts, and focused unit behavior. The platform plan adds process, service, browser/application, state, managed-job, cryptographic, and real-machine behavior tests needed on macOS and Windows. The full-only plan adds coverage, browser-broker integration, package/install, stdio, Worker/OAuth, and real-browser navigation suites. `npm run check` remains the authoritative complete gate.
 
+Successful child-task stdout/stderr is intentionally suppressed so a long green plan does not overwhelm an MCP response or hide the final status behind host truncation. Progress and timing remain visible. A failed task returns bounded head/tail diagnostics for both streams. Set `MBM_CHECK_VERBOSE=1` only when an operator explicitly needs live child output; verbose mode can be large and should be run through a process session when used remotely.
+
 The repository requires Node.js 26 and npm 12. `.node-version`, `.nvmrc`, `packageManager`, `devEngines`, and strict engine checks keep local and CI execution on the same baseline.
 
 The suite includes:
 
 - package-impact classification derived from the npm package manifest, allowing repository-only GitHub workflow maintenance without weakening version requirements for shipped content;
-- interactive candidate acceptance hashing, including owner-authorized in-place Worker deployment plus owner-started candidate verification, exact tarball SHA-1/SHA-512 matching, acceptance-record exclusion from the package, legacy 1.2.8 marker compatibility, and invalidation after any packaged-byte change;
+- interactive candidate acceptance hashing, including owner-authorized in-place Worker deployment plus owner-started candidate verification, exact tarball SHA-1/SHA-512 matching, descriptor-first no-follow reads, path-identity/symlink regressions, acceptance-record exclusion from the package, legacy 1.2.8 marker compatibility, and invalidation after any packaged-byte change;
+- one-shot process output preview/continuation, completed-session paging, bounded nonzero-exit details, UTF-8-safe head/tail diagnostics, compact local/Worker MCP text mirrors, and quiet-success/bounded-failure verification-runner behavior;
+- GitHub backlog enforcement that paginates all open issues and pull requests, permits only the current branch PR, and requires standard closing keywords for every open issue before a guarded push;
 - release-impact enforcement requiring a new package version and CHANGELOG section for release-relevant changes;
 - release-state diagnostics distinguishing missing local/remote version tags from tags that point to the wrong commit, plus a release-CI gate that rejects missing, pending, failed, pull-request-only, stale, or wrong-commit runs;
 - generated Cloudflare Worker types under ignored `.wrangler/` state and strict TypeScript checking, including unused-local and unused-parameter rejection; packaging rejects generated declarations;

package/docs/TOOL_REFERENCE.md

@@ -1455,7 +1455,7 @@ List effective direct-argv commands from project manifests and safe automatic pa
 
 **Run registered local command**
 
-Run an effective manifest or automatic package-script command through its fixed argv, cwd, timeout ceiling, and extra-argument policy.
+Run an effective manifest or automatic package-script command through its fixed argv, cwd, timeout ceiling, and extra-argument policy. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.
 
 | Contract field | Value |
 |---|---|
@@ -1988,7 +1988,7 @@ Return bounded metadata and patch output for one revision without running reposi
 
 **Run process directly**
 
-Execute an argv array without a command shell. This avoids shell parsing but does not sandbox the executable or code it launches.
+Execute an argv array without a command shell. This avoids shell parsing but does not sandbox the executable or code it launches. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.
 
 | Contract field | Value |
 |---|---|
@@ -2074,7 +2074,7 @@ Start a direct argv process without a shell and retain bounded stdout, stderr, a
 
 **Read process session**
 
-Read bounded stdout and stderr deltas from a server-managed process session, optionally waiting briefly for new output.
+Read bounded stdout and stderr deltas from a running process session or a recently completed one-shot command continuation, optionally waiting briefly for new output.
 
 | Contract field | Value |
 |---|---|
@@ -2796,7 +2796,7 @@ Request cancellation of a detached managed job. The runner terminates the active
 
 **Execute shell command**
 
-Execute a shell command with workspace cwd. This is not a sandbox and has the operating-system authority of the local user.
+Execute a shell command with workspace cwd. This is not a sandbox and has the operating-system authority of the local user. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.
 
 | Contract field | Value |
 |---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -129,7 +129,11 @@
     "check-plan:test": "node tests/check-plan-test.mjs",
     "check:platform": "node scripts/run-checks.mjs platform",
     "release": "node scripts/github-release.mjs --publish",
-    "release:candidate:start": "node scripts/start-release-candidate.mjs"
+    "release:candidate:start": "node scripts/start-release-candidate.mjs",
+    "check-runner:test": "node tests/check-runner-test.mjs",
+    "process-output:test": "node tests/process-output-continuation-test.mjs",
+    "github-backlog:test": "node tests/github-backlog-test.mjs",
+    "github:backlog": "node scripts/github-backlog.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",

package/scripts/check-plan.mjs

@@ -5,6 +5,9 @@ export const FAST_CHECK_TASKS = Object.freeze([
   "release-state:test",
   "release-ci:test",
   "network-retry:test",
+  "check-runner:test",
+  "process-output:test",
+  "github-backlog:test",
   "secure-file:test",
   "worker-secret-file:test",
   "sarif-security:test",

package/scripts/check-runner.mjs

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
+import { BoundedOutput } from "../src/local/bounded-output.mjs";
+
+const FAILURE_OUTPUT_BYTES_PER_STREAM = 64 * 1024;
+
+export async function runVerificationPlan(options) {
+  const {
+    mode,
+    tasks,
+    npmCli,
+    cwd = process.cwd(),
+    env = process.env,
+    verbose = false,
+    stdout = process.stdout,
+    stderr = process.stderr,
+    spawnProcess = spawn,
+  } = options;
+  if (!npmCli) throw new Error("check runner must run through npm so npm_execpath is available");
+  const planStartedAt = performance.now();
+  stdout.write(`running ${mode} verification plan (${tasks.length} tasks)\n`);
+  for (const [index, task] of tasks.entries()) {
+    const taskStartedAt = performance.now();
+    stdout.write(`\n[${index + 1}/${tasks.length}] npm run ${task}\n`);
+    const result = await runTask({ task, npmCli, cwd, env, verbose, spawnProcess });
+    const elapsedSeconds = ((performance.now() - taskStartedAt) / 1000).toFixed(1);
+    if (result.error) throw result.error;
+    if (result.code !== 0) {
+      stderr.write(`verification task failed after ${elapsedSeconds}s: ${task}\n`);
+      emitFailureDiagnostics(result, stderr);
+      const error = new Error(`verification task failed: ${task}`);
+      error.exitCode = result.code || 1;
+      throw error;
+    }
+    stdout.write(`completed ${task} in ${elapsedSeconds}s\n`);
+  }
+  const totalSeconds = ((performance.now() - planStartedAt) / 1000).toFixed(1);
+  stdout.write(`\n${mode} verification plan passed in ${totalSeconds}s\n`);
+}
+
+function runTask({ task, npmCli, cwd, env, verbose, spawnProcess }) {
+  return new Promise((resolvePromise) => {
+    const stdout = verbose ? null : new BoundedOutput(FAILURE_OUTPUT_BYTES_PER_STREAM);
+    const stderr = verbose ? null : new BoundedOutput(FAILURE_OUTPUT_BYTES_PER_STREAM);
+    let child;
+    try {
+      child = spawnProcess(process.execPath, [npmCli, "run", "--silent", task], {
+        cwd,
+        env: { ...env, NO_COLOR: env.NO_COLOR || "1" },
+        stdio: verbose ? "inherit" : ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        shell: false,
+      });
+    } catch (error) {
+      resolvePromise({ code: 1, error, stdout, stderr });
+      return;
+    }
+    child.stdout?.on?.("data", (chunk) => stdout?.append(chunk));
+    child.stderr?.on?.("data", (chunk) => stderr?.append(chunk));
+    child.once("error", (error) => resolvePromise({ code: 1, error, stdout, stderr }));
+    child.once("close", (code) => resolvePromise({ code: Number.isInteger(code) ? code : 1, stdout, stderr }));
+  });
+}
+
+function emitFailureDiagnostics(result, output) {
+  const stdoutText = result.stdout?.text?.() || "";
+  const stderrText = result.stderr?.text?.() || "";
+  if (stdoutText) output.write(`\n--- task stdout ---\n${ensureNewline(stdoutText)}`);
+  if (stderrText) output.write(`\n--- task stderr ---\n${ensureNewline(stderrText)}`);
+  if (!stdoutText && !stderrText) output.write("task produced no captured output\n");
+}
+
+function ensureNewline(value) {
+  return value.endsWith("\n") ? value : `${value}\n`;
+}

package/scripts/coverage-check.mjs

@@ -115,7 +115,7 @@ try {
   if (failures.length) throw new Error(`coverage thresholds failed:\n- ${failures.join("\n- ")}`);
   console.log("critical-module coverage thresholds passed");
 } finally {
-  rmSync(coverageDir, { recursive: true, force: true });
+  rmSync(coverageDir, { recursive: true, force: true, maxRetries: 8, retryDelay: 50 });
 }
 
 function collectCoverage(directory) {

package/scripts/github-backlog.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+export function closingIssueNumbers(messages) {
+  const numbers = new Set();
+  const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?[ \t]+#(\d+)\b/gi;
+  for (const match of String(messages || "").matchAll(pattern)) numbers.add(Number(match[1]));
+  return numbers;
+}
+
+export function backlogBlockers({ issues = [], pullRequests = [], branch = "", commitMessages = "" }) {
+  const closing = closingIssueNumbers(commitMessages);
+  const issueBlockers = issues.filter((issue) => !closing.has(Number(issue.number)));
+  const pullRequestBlockers = pullRequests.filter((pull) => !(
+    String(pull.headRefName || "") === branch
+    && pull.headRepository
+    && pull.headRepository === pull.baseRepository
+  ));
+  return { issueBlockers, pullRequestBlockers, closing: [...closing].sort((left, right) => left - right) };
+}
+
+export function assertGitHubBacklogReady(options = {}) {
+  const run = options.run || runCommand;
+  const cwd = options.cwd || root;
+  const branch = options.branch || output(run, "git", ["branch", "--show-current"], cwd);
+  if (!branch) throw new Error("cannot inspect GitHub backlog from a detached HEAD");
+  const commitMessages = output(run, "git", ["log", "--format=%B%x00", "origin/main..HEAD"], cwd);
+  const issueRows = pagedJson(output(run, "gh", [
+    "api", "--paginate", "--slurp", "repos/{owner}/{repo}/issues?state=open&per_page=100",
+  ], cwd), "open GitHub issues");
+  const pullRows = pagedJson(output(run, "gh", [
+    "api", "--paginate", "--slurp", "repos/{owner}/{repo}/pulls?state=open&per_page=100",
+  ], cwd), "open GitHub pull requests");
+  const issues = issueRows
+    .filter((item) => !item.pull_request)
+    .map((item) => ({ number: item.number, title: item.title, url: item.html_url }));
+  const pullRequests = pullRows.map((item) => ({
+    number: item.number,
+    title: item.title,
+    headRefName: item.head?.ref,
+    headRepository: item.head?.repo?.full_name,
+    baseRepository: item.base?.repo?.full_name,
+    url: item.html_url,
+  }));
+  const blockers = backlogBlockers({ issues, pullRequests, branch, commitMessages });
+  if (!blockers.issueBlockers.length && !blockers.pullRequestBlockers.length) {
+    const covered = blockers.closing.length ? `; closing issue(s): ${blockers.closing.map((number) => `#${number}`).join(", ")}` : "";
+    return { branch, issues, pullRequests, ...blockers, message: `GitHub backlog gate passed${covered}.` };
+  }
+  throw new Error(formatBlockers(blockers, branch));
+}
+
+function formatBlockers(blockers, branch) {
+  const lines = ["GitHub backlog is not ready for another push."];
+  if (blockers.issueBlockers.length) {
+    lines.push("Open issues not closed by a commit in origin/main..HEAD:");
+    for (const issue of blockers.issueBlockers) lines.push(`- #${issue.number} ${boundedTitle(issue.title)}${issue.url ? ` (${issue.url})` : ""}`);
+  }
+  if (blockers.pullRequestBlockers.length) {
+    lines.push(`Open pull requests other than the current branch (${branch}):`);
+    for (const pull of blockers.pullRequestBlockers) lines.push(`- #${pull.number} ${boundedTitle(pull.title)} [${pull.headRefName || "unknown branch"}]${pull.url ? ` (${pull.url})` : ""}`);
+  }
+  lines.push("Resolve or close every blocker before pushing. The current branch may cover an issue with a standard closing keyword such as 'Closes #47'.");
+  return lines.join("\n");
+}
+
+function boundedTitle(value) {
+  return String(value || "untitled").replace(/[\r\n]+/g, " ").slice(0, 200);
+}
+
+function pagedJson(text, label) {
+  let pages;
+  try { pages = JSON.parse(text || "[]"); }
+  catch (error) { throw new Error(`${label} response was not valid JSON: ${error.message}`); }
+  if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) {
+    throw new Error(`${label} response was not a slurped page array`);
+  }
+  return pages.flat();
+}
+
+function output(run, command, args, cwd) {
+  const result = run(command, args, cwd);
+  return String(result.stdout || "").trim();
+}
+
+function runCommand(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    env: process.env,
+    stdio: "pipe",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || "").trim();
+    throw new Error(`${command} ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const result = assertGitHubBacklogReady();
+    console.log(result.message);
+  } catch (error) {
+    console.error(`GitHub backlog gate failed: ${error?.message || error}`);
+    process.exit(1);
+  }
+}

package/scripts/github-push.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
+import { assertGitHubBacklogReady } from "./github-backlog.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -13,6 +14,9 @@ try {
   const branch = output("git", ["branch", "--show-current"]);
   if (!branch) throw new Error("cannot push from a detached HEAD");
   if (branch === "main") throw new Error("direct pushes to main are prohibited; push a reviewed branch and merge through a pull request");
+  run("git", ["fetch", "origin", "main", "--prune"]);
+  const backlog = assertGitHubBacklogReady({ cwd: root, branch });
+  console.log(backlog.message);
 
   const acceptance = verifyCurrentReleaseAcceptance(root);
   if (acceptance.required) {

package/scripts/release-acceptance.mjs

@@ -1,6 +1,5 @@
 import { createHash } from "node:crypto";
 import {
-  lstatSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -8,6 +7,7 @@ import {
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { readBoundedRegularFileSync } from "../src/local/secure-file.mjs";
 
 export const ACCEPTANCE_SCHEMA_VERSION = 1;
 export const ACCEPTANCE_POLICY_VERSION = "1.2.8";
@@ -15,6 +15,7 @@ export const AGENT_VERIFIED_ACCEPTANCE_VERSION = "1.2.9";
 export const ACCEPTANCE_CONFIRMATION = "owner-started-agent-verified-local-candidate";
 export const LEGACY_ACCEPTANCE_CONFIRMATION = "repository-owner-local-test";
 const MAX_ACCEPTANCE_BYTES = 64 * 1024;
+const MAX_RELEASE_TARBALL_BYTES = 64 * 1024 * 1024;
 
 export function requiresLocalAcceptance(version) {
   return compareVersions(parseVersion(version), parseVersion(ACCEPTANCE_POLICY_VERSION)) >= 0;
@@ -76,20 +77,25 @@ export function packProject(root, destination) {
 
 export function readAcceptance(root, version) {
   const path = acceptancePath(root, version);
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isFile()) {
-    throw new Error(`release acceptance record must be a regular file: ${path}`);
-  }
-  if (stat.size > MAX_ACCEPTANCE_BYTES) {
-    throw new Error(`release acceptance record exceeds ${MAX_ACCEPTANCE_BYTES} bytes`);
+  let bytes;
+  try {
+    bytes = readBoundedRegularFileSync(
+      path, MAX_ACCEPTANCE_BYTES, "release acceptance record",
+      { verifyPathIdentity: true },
+    );
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (message.includes("exceeds")) throw new Error(`release acceptance record exceeds ${MAX_ACCEPTANCE_BYTES} bytes`);
+    if (message.includes("regular file") || message.includes("symbolic link") || message.includes("identity changed")) {
+      throw new Error(`release acceptance record must be a regular file: ${path}`);
+    }
+    throw error;
   }
-  let value;
   try {
-    value = JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(bytes.toString("utf8"));
   } catch (error) {
     throw new Error(`release acceptance record is not valid JSON: ${error.message}`);
   }
-  return value;
 }
 
 export function verifyAcceptanceRecord(record, metadata) {
@@ -134,9 +140,19 @@ export function verifyCurrentReleaseAcceptance(root) {
 }
 
 export function verifyTarball(path, metadata) {
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("release candidate tarball is not a regular file");
-  const bytes = readFileSync(path);
+  let bytes;
+  try {
+    bytes = readBoundedRegularFileSync(
+      path, MAX_RELEASE_TARBALL_BYTES, "release candidate tarball",
+      { verifyPathIdentity: true },
+    );
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (message.includes("regular file") || message.includes("symbolic link") || message.includes("identity changed")) {
+      throw new Error("release candidate tarball is not a regular file");
+    }
+    throw error;
+  }
   const shasum = createHash("sha1").update(bytes).digest("hex");
   const integrity = `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
   if (shasum !== metadata.shasum || integrity !== metadata.integrity) {

package/scripts/run-checks.mjs

@@ -1,29 +1,19 @@
-import { spawnSync } from "node:child_process";
-import { performance } from "node:perf_hooks";
 import { checkTasks } from "./check-plan.mjs";
+import { runVerificationPlan } from "./check-runner.mjs";
 
 const mode = process.argv[2] || "full";
 const tasks = checkTasks(mode);
-const npmCli = process.env.npm_execpath;
-if (!npmCli) throw new Error("check runner must run through npm so npm_execpath is available");
-const planStartedAt = performance.now();
 
-console.log(`running ${mode} verification plan (${tasks.length} tasks)`);
-for (const [index, task] of tasks.entries()) {
-  const taskStartedAt = performance.now();
-  console.log(`\n[${index + 1}/${tasks.length}] npm run ${task}`);
-  const result = spawnSync(process.execPath, [npmCli, "run", task], {
-    cwd: process.cwd(),
-    env: process.env,
-    stdio: "inherit",
+try {
+  await runVerificationPlan({
+    mode,
+    tasks,
+    npmCli: process.env.npm_execpath,
+    verbose: process.env.MBM_CHECK_VERBOSE === "1",
   });
-  const elapsedSeconds = ((performance.now() - taskStartedAt) / 1000).toFixed(1);
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    console.error(`verification task failed after ${elapsedSeconds}s: ${task}`);
-    process.exit(result.status || 1);
+} catch (error) {
+  if (error?.message && !String(error.message).startsWith("verification task failed:")) {
+    console.error(error.message);
   }
-  console.log(`completed ${task} in ${elapsedSeconds}s`);
+  process.exit(Number(error?.exitCode) || 1);
 }
-const totalSeconds = ((performance.now() - planStartedAt) / 1000).toFixed(1);
-console.log(`\n${mode} verification plan passed in ${totalSeconds}s`);

package/src/local/bounded-output.mjs

@@ -39,12 +39,29 @@ export class BoundedOutput {
   }
 
   get truncatedBytes() {
-    return Math.max(0, this.totalBytes - this.maximum);
+    if (this.full) return 0;
+    const head = decodeUtf8Boundary(this.head, "head");
+    const tail = decodeUtf8Boundary(this.tail, "tail");
+    return Math.max(0, this.totalBytes - head.bytes - tail.bytes);
   }
 
   text() {
     if (this.full) return this.full.toString("utf8");
-    const marker = `\n\n[truncated ${this.truncatedBytes} bytes; preserved beginning and end]\n\n`;
-    return `${this.head.toString("utf8")}${marker}${this.tail.toString("utf8")}`;
+    const head = decodeUtf8Boundary(this.head, "head");
+    const tail = decodeUtf8Boundary(this.tail, "tail");
+    const omitted = Math.max(0, this.totalBytes - head.bytes - tail.bytes);
+    const marker = `\n\n[truncated ${omitted} bytes; preserved beginning and end]\n\n`;
+    return `${head.text}${marker}${tail.text}`;
   }
 }
+
+function decodeUtf8Boundary(buffer, side) {
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  for (let trim = 0; trim <= Math.min(3, buffer.length); trim += 1) {
+    const slice = side === "head"
+      ? buffer.subarray(0, buffer.length - trim)
+      : buffer.subarray(trim);
+    try { return { text: decoder.decode(slice), bytes: slice.length }; } catch { /* try the next code-point boundary */ }
+  }
+  return { text: new TextDecoder("utf-8").decode(buffer), bytes: buffer.length };
+}

package/src/local/errors.mjs

@@ -54,6 +54,7 @@ export function publicError(error, options = {}) {
     code: normalized.code,
     message: normalized.expose ? normalized.message : defaultMessage(normalized.code),
     retryable: normalized.retryable,
+    ...(normalized.expose && normalized.details ? { details: normalized.details } : {}),
   };
 }
 
@@ -61,7 +62,10 @@ export function remoteBridgeError(value, fallbackMessage = "remote operation fai
   if (isRecord(value)) {
     const code = normalizeErrorCode(value.code);
     const message = typeof value.message === "string" && value.message ? value.message : fallbackMessage;
-    return new BridgeError(code, message, { retryable: value.retryable === true });
+    return new BridgeError(code, message, {
+      retryable: value.retryable === true,
+      details: isRecord(value.details) ? value.details : undefined,
+    });
   }
   return new BridgeError("execution_failed", fallbackMessage);
 }