machine-bridge-mcp 1.2.9 → 1.2.10

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.2.10 - 2026-07-20
+
+### Relay interruption recovery
+
+- Preserve an in-flight MCP tool call across a brief daemon WebSocket interruption instead of converting every transient proxy or network reset into an immediate cancellation. The Worker now detaches pending calls for a bounded 30-second grace period and rebinds them only when the same local daemon process instance completes the full authenticated readiness probe on its replacement socket.
+- Keep the local operation running during that grace period and queue a completed result until the relay is ready again. Before `ready_ack`, the Worker sends an authoritative `resume_calls` set so the runtime cancels work whose client disappeared during the outage; results are replayed only for same-instance calls that still have a receiver. A different daemon instance cannot claim them, and an unrecovered outage cancels ordinary calls and process trees when the grace period expires.
+- Add deterministic registry/runtime regressions and a real Worker/OAuth/MCP fault-injection test that starts a tool call, forcibly drops the daemon WebSocket, reconnects the same daemon instance, and proves the original HTTP request completes. Expose the bounded `pending_calls.detached` count for diagnosis, require a validated ephemeral daemon instance identifier in the current-version hello contract, and update architecture, logging, operations, audit, and multi-account documentation.
+
 ## 1.2.9 - 2026-07-18
 
 - Repair cross-platform release infrastructure found by PR CI: the layered check runner now invokes the pinned npm CLI through Node instead of spawning `npm.cmd`, and `release:accept` computes and locally validates the portable Git-content digest through a temporary index so CI can verify accepted package content across merge commits without mutating the maintainer index.

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.2.9",
+  "version": "1.2.10",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.2.9"
+  "version_name": "1.2.10"
 }

package/docs/ARCHITECTURE.md

@@ -35,13 +35,13 @@ A canonical workspace receives an independent profile, Worker name, secret set,
 - `runtime-diagnostics.mjs` owns fixed local probes and their stable interpretation;
 - `runtime-capabilities.mjs` composes agent, application, and browser capability results;
 - `runtime-tool-handlers.mjs` owns catalog-to-handler registration;
-- `runtime-relay.mjs` owns relay construction and inbound envelope normalization;
+- `runtime-relay.mjs` owns relay construction and inbound envelope normalization, while `relay-call-recovery.mjs` owns the bounded disconnect grace, result queue, authoritative resumed-call reconciliation, replay, and expiry cleanup;
 - `runtime-paths.mjs` owns runtime-directory creation, containment checks, and error-path redaction;
 - `managed-job-lock.mjs`, `managed-job-runner.mjs`, `managed-job-storage.mjs`, and `managed-job-projection.mjs` separate transition ownership, detached runner identity, private persistence/diagnostics, and public result shaping from the managed-job lifecycle;
 - `browser-request-registry.mjs`, `browser-broker-routes.mjs`, `browser-broker-server.mjs`, and `browser-bridge-http.mjs` separate direct request ownership, runtime-client proxy routing, authenticated loopback WebSocket upgrades/listening, and loopback HTTP handling from broker startup and extension handover;
 - managed jobs, local resources, application automation, and browser automation remain separate managers.
 
-Architecture tests cap the orchestration module and each extracted service independently and reject a return of low-level process, patch, diagnostic, or capability-scoring logic to `LocalRuntime`. `RelayConnection` owns remote WebSocket transport, `hello_ack` authentication, end-to-end `relay_probe`/`ready_ack` readiness, heartbeat liveness, reconnect backoff, outage logging, and a monotonically increasing in-memory session generation. Every relayed tool result is bound to the generation that delivered its call; a disconnected generation cannot send a late result over its replacement socket. Inbound WebSocket dispatch captures that generation at receive time and passes it to the runtime handler, so a successful local tool execution can publish only on the same generation. Stdio mode invokes `LocalRuntime` directly without that adapter.
+Architecture tests cap the orchestration module and each extracted service independently and reject a return of low-level process, patch, diagnostic, or capability-scoring logic to `LocalRuntime`. `RelayConnection` owns remote WebSocket transport, `hello_ack` authentication, end-to-end `relay_probe`/`ready_ack` readiness, heartbeat liveness, reconnect backoff, outage logging, and a monotonically increasing in-memory transport generation. The generation still protects the pre-ready probe and prevents arbitrary use of a stale socket. Ordinary tool calls additionally bind to an ephemeral identifier generated once per local daemon process. If a ready socket drops, the Worker detaches its pending calls for at most thirty seconds; only a replacement socket that presents the same daemon-process identifier and completes the full readiness probe can reclaim them. The local runtime keeps those calls alive and queues completed results during the same bounded interval, then replays them after readiness. A different process instance, an explicit cancellation, or grace expiry cannot receive those results. Stdio mode invokes `LocalRuntime` directly without that adapter.
 
 `daemon-process.mjs` owns workspace-daemon inspection and takeover. It distinguishes platform service state from the lock-owning Node process, validates PID and process-start identity, canonicalizes workspace/state paths before comparison, parses bounded process command lines without executing them, and accepts lock-backed `--daemon-only` recovery processes that omit repeated path flags. Stop/takeover sends `SIGTERM` only to a verified same-workspace service daemon. If it remains alive after the grace period, the code revalidates PID, process-start identity, command line, entrypoint, daemon mode, workspace, and state root before sending `SIGKILL`; a foreground, replaced-PID, or otherwise unverifiable process remains untouched. CLI orchestration never treats a missing launchd/systemd job as proof that the process exited.
 
@@ -160,11 +160,12 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. A new daemon first authenticates as a bounded `probing` socket. The Worker sends a random `relay_probe`; the local runtime returns it through the normal session-bound result-delivery path; only the matching result produces `ready_ack`, promotion to the active daemon, and safe replacement of an incumbent connection.
 9. `tools/list` is derived only from the active end-to-end-verified daemon; without one, only `server_info` is advertised.
-10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, authenticated client request key, incoming HTTP abort signal, and local relay-session generation.
+10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, the authenticated client request key, and the incoming HTTP abort signal.
 11. The runtime validates policy and arguments, executes the tool, and returns a bounded result.
-12. The Durable Object accepts a result only from the daemon socket that received that call, and the local runtime sends it only through the relay generation that delivered its call.
-13. A matching cancellation notification or incoming HTTP client disconnect removes the pending indexes, tells the daemon to cancel, and terminates ordinary child processes bound to the call. If local completion races with cancellation, the eventual result is discarded rather than treated as a user-visible delivery failure.
-14. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
+12. If the socket remains ready, the Durable Object accepts the result only from that socket. If it drops, the Worker detaches the pending call for at most thirty seconds and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe. The local runtime preserves the operation and queues a completion over the same interval.
+13. A matching cancellation notification or incoming HTTP client disconnect removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request cancelled while disconnected therefore cannot be revived by a fast reconnect.
+14. If same-instance readiness does not return before the grace deadline, the Worker rejects the detached request and the local runtime cancels ordinary calls, terminates their process trees, and discards queued results. A newly started daemon has a different instance identifier and cannot inherit prior calls.
+15. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
 Duplicate in-flight JSON-RPC IDs are rejected only within the same authenticated MCP session. The request key includes OAuth token identity, the HMAC-bound MCP session, JSON-RPC id type, and id value, so separate initialized clients may safely reuse the same numeric id.
 
@@ -234,7 +235,9 @@ A connection-attempt deadline terminates sockets stuck in `CONNECTING`. After op
 
 Reconnect uses bounded exponential backoff with jitter. Brief self-healing interruptions are debug-only. An unresolved outage is promoted to a rate-limited warning after a grace period, and recovery produces one summary. Raw close codes and reason strings remain debug-only.
 
-The Worker stores socket transitions in `DaemonSocketRegistry`: `candidate` before hello, `probing` after authentication, `daemon` only after the end-to-end result probe, and `expired` after terminal failure. Durable Object alarms enforce separate hello, readiness, and steady-state liveness deadlines across hibernation. A healthy incumbent remains active while a replacement is probed; a malformed, silent, or incompatible replacement is closed without displacing it. Only a verified candidate receives `ready_ack` and then replaces the old socket. Ready daemons stay live only while inbound traffic refreshes `lastSeenAt`; silent half-open or hibernation-restored sockets are reclaimed instead of advertising `daemon.connected` while tool calls time out. Pending calls retain their originating socket reference. A stale socket cannot complete or cancel replacement-socket calls. Closing a socket rejects only calls assigned to it. The local relay generation supplies the symmetric boundary: work accepted by an older authenticated connection cannot publish its result through a newer connection even when the call IDs are otherwise well formed.
+The Worker stores socket transitions in `DaemonSocketRegistry`: `candidate` before hello, `probing` after authentication, `daemon` only after the end-to-end result probe, and `expired` after terminal failure. Durable Object alarms enforce separate hello, readiness, and steady-state liveness deadlines across hibernation. A healthy incumbent remains active while a replacement is probed; a malformed, silent, incompatible, or identity-mismatched replacement is closed without displacing it. Only a verified candidate receives `ready_ack` and then replaces the old socket. Ready daemons stay live only while inbound traffic refreshes `lastSeenAt`; silent half-open or hibernation-restored sockets are reclaimed instead of advertising `daemon.connected` while tool calls time out.
+
+Each daemon process generates a random bounded `instance_id` at startup and includes it in every reconnect hello. Pending calls normally retain their assigned socket. On an unexpected socket loss, only those records are detached and a thirty-second timer bounds recovery. A verified socket with the same instance ID rebinds them; another process or socket cannot resolve them. The local runtime mirrors that state machine by preserving active calls and completed-result envelopes until relay readiness returns. Before `ready_ack`, the Worker sends the exact IDs that still have remote waiters; the runtime cancels everything else and only then replays retained results through the verified socket. Grace expiry restores the terminal behavior: reject remote waiters, cancel local ordinary calls, terminate process trees, and discard undeliverable results. This does not make calls durable across daemon restart or machine failure; managed jobs remain the separate durable mechanism.
 
 ## Persistence
 

package/docs/AUDIT.md

@@ -1,5 +1,15 @@
 # Security and privacy audit notes
 
+## 2026-07-20 version 1.2.10 transient-relay recovery audit
+
+Repeated ChatGPT web executions were terminating even though the local daemon and Worker were healthy immediately afterward. The causal defect was not the tool implementation or its configured timeout. A brief WebSocket loss—made more likely when the daemon relay traverses an environment-selected local proxy—was promoted into a terminal request failure at both ends: the Worker rejected every pending call assigned to the closed socket, while the local runtime cancelled all relay-origin calls and killed their ordinary child processes. Automatic WebSocket reconnection restored future traffic but could not recover the request already abandoned by both state machines.
+
+The correction introduces a bounded continuation identity rather than weakening cancellation globally. Every local daemon process creates one random ephemeral `instance_id` and presents it in the current-version hello. On socket loss, the Worker detaches only calls owned by that socket and retains their OAuth/session request indexes for thirty seconds. A replacement socket may rebind them only after presenting the same process identifier and completing the existing end-to-end readiness probe. The local runtime mirrors this interval: active calls continue, completed result envelopes are retained in memory, and readiness triggers replay. A different process instance cannot claim the pending IDs; daemon restart remains terminal rather than pretending to provide durable execution.
+
+The recovery path remains bounded and fail closed. Explicit MCP cancellation and HTTP client abandonment still remove the remote receiver immediately. A connected daemon receives cancellation as before. If cancellation occurs while disconnected, the next same-instance handshake carries an authoritative `resume_calls` set before `ready_ack`; the local runtime cancels any active or completed call absent from that set, so a fast reconnect cannot revive a request whose HTTP receiver disappeared. Timeout remains authoritative. At thirty seconds without same-instance readiness, the Worker rejects detached requests and the runtime cancels calls, discards queued results, and enters the existing persistent-outage reporting path. No tool arguments, commands, paths, outputs, proxy endpoint, or result content are added to logs or durable storage.
+
+Regression evidence covers three layers: deterministic pending-registry detach/rebind/expiry tests; local runtime queue/replay, resumed-call reconciliation, cancellation, and grace behavior; and real workerd OAuth/MCP/WebSocket fault injection that both completes a detached request after same-instance reconnect and proves a request cancelled while detached is excluded from the next `resume_calls` set. Malformed or missing daemon-instance identifiers are rejected as protocol errors. The version remains a current-only Worker/daemon protocol unit and requires normal candidate convergence before live use.
+
 ## 2026-07-18 version 1.2.9 interactive release-handoff correction
 
 The release-integrity mechanism correctly bound acceptance to exact package bytes, but the operational role split was wrong. Documentation and repository guards required the owner to run the acceptance command personally and prohibited the coding agent from recording it. That contradicted the established working process: the owner should perform the one action the agent cannot perform honestly—start the exact candidate on the maintainer machine—while the agent should connect to that candidate, verify its version, readiness, and representative functionality, then record acceptance and complete source release operations.

package/docs/LOGGING.md

@@ -79,7 +79,7 @@ With `--verbose`, the same incident additionally includes bounded structured fie
 
 All per-tool starts, successes, failures, cancellations, timing, and expected late-result disposal are debug-only. The MCP response already reports the outcome to the caller; duplicating routine tool traffic at default levels creates noise and can reveal activity patterns.
 
-A completed local result is bound to the authenticated relay session that delivered its call. If the caller cancelled, the relay disconnected, or a replacement relay session became active, the result is discarded rather than sent to a different session. This is a normal terminal race and does not emit a warning. Debug output records only a shortened call ID and a coarse reason such as `caller_cancelled`, `relay_disconnected`, or `session_ended`. A synchronous send failure on the still-current socket is different: the socket is invalidated because delivery is ambiguous, but the per-call detail remains debug-only while the normal relay-outage state machine decides whether a user-visible warning is warranted.
+A completed local result is normally sent on the ready relay connection. If that socket disappears, the runtime queues the bounded result envelope during the thirty-second same-daemon reconnect window rather than logging a terminal delivery failure. Debug output records only a shortened call ID and queue/reconnect counts. After the same daemon process completes readiness, replay emits one recovery event; a different process cannot inherit the result. Explicit caller cancellation suppresses eventual delivery. If the relay does not recover before the grace deadline, ordinary calls are cancelled, queued results are discarded, and the existing outage state machine determines whether the persistent failure warrants a warning. Tool arguments, commands, and result content are never logged.
 
 Debug per-tool fields may include tool name, duration, coarse outcome class, and a shortened random call identifier. The identifier is for correlating adjacent local events and is not a stable audit identifier.
 

package/docs/MULTI_ACCOUNT.md

@@ -93,9 +93,9 @@ The first start of a new deployment creates an `owner` account automatically and
 
 ## Concurrency and revocation
 
-Pending calls remain bound to the OAuth access token and JSON-RPC request ID. Duplicate in-flight IDs under one token are rejected. Account revocation blocks new requests immediately; calls already relayed remain subject to ordinary cancellation, deadlines, relay disconnect cleanup, and local role validation.
+Pending calls remain bound to the OAuth access token and JSON-RPC request ID. Duplicate in-flight IDs under one token are rejected. Account revocation blocks new requests immediately; calls already relayed remain subject to ordinary cancellation, deadlines, local role validation, and the bounded same-daemon reconnect state machine. A replacement process cannot inherit a detached call.
 
-Remote relay loss cancels every relay-owned local call and terminates its child process tree. Process promises settle on cancellation even when a child does not emit `close`; process ownership remains tracked until actual exit.
+A relay interruption keeps ordinary relay-owned calls alive only inside the bounded same-daemon reconnect window. Reconciliation or grace expiry cancels calls that no longer have a remote receiver and terminates their child process trees. Process promises settle on cancellation even when a child does not emit `close`; process ownership remains tracked until actual exit.
 
 ## Audit and privacy
 

package/docs/OPERATIONS.md

@@ -51,7 +51,7 @@ A successful diagnostic result applies only to that probe. An MCP host can still
 
 Machine Bridge supports concurrent calls: the Worker admits up to 32 pending daemon calls and the local runtime admits up to 16 active tool calls. These are capacity limits, not a single global execution queue. Each successful MCP initialization receives a signed `MCP-Session-Id`; JSON-RPC ids and cancellation are scoped to that session, so separate chat windows may reuse the same numeric ids safely even when they share one OAuth account and token.
 
-`server_info.worker.pending_calls` reports `active`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. Calls for simple reads and probes should continue while another independent process call runs. Explicit MCP cancellation, an incoming HTTP client disconnect, timeout, and daemon-socket closure remove the pending record and its session request key. Local results are bound to the authenticated relay session that originated the call, so a result that finishes after cancellation or reconnection is discarded instead of being sent over a replacement socket. Refreshing a chat page is not the recovery mechanism and should not be required.
+`server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded thirty-second same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Explicit MCP cancellation, an incoming HTTP client disconnect, and timeout remove the pending record and its session request key. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
 
 `server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 
@@ -147,7 +147,7 @@ Uninstall acquires a state-root `maintenance.lock` that blocks new profile/state
 
 ### Lifecycle and pending-call diagnosis
 
-`server_info.runtime.lifecycle` reports `ready`, `starting`, `running`, `failed`, `stopping`, or `stopped`. `server_info.observability.in_flight_calls` and `server_info.runtime.processes` distinguish a blocked call from a surviving process. `server_info.runtime.execution_guardrails` reports the enforced local concurrency/timeout/stdin/output/session limits and explicitly states that CPU quota, memory quota, and network isolation are not enforced in process. Worker `server_info.worker.pending_calls` reports both the internal-call index and client request-key index; they must return to zero after a terminal result, explicit cancellation, client disconnect, timeout, send failure, or daemon disconnect. Nonzero request-key counts after active calls reach zero indicate a lifecycle defect rather than normal load. `worker.observability.calls.unmatched_results` is the bounded counter for late results that no longer have a receiver.
+`server_info.runtime.lifecycle` reports `ready`, `starting`, `running`, `failed`, `stopping`, or `stopped`. `server_info.observability.in_flight_calls` and `server_info.runtime.processes` distinguish a blocked call from a surviving process. `server_info.runtime.execution_guardrails` reports the enforced local concurrency/timeout/stdin/output/session limits and explicitly states that CPU quota, memory quota, and network isolation are not enforced in process. Worker `server_info.worker.pending_calls` reports the internal-call index, client request-key index, and detached-call count. All three must return to zero after a terminal result, explicit cancellation, client disconnect, timeout, or reconnect-grace expiry. During a brief daemon interruption, `active` and `request_keys` may remain nonzero while `detached` identifies the recoverable subset; after same-instance readiness, `detached` returns to zero without losing those requests. Nonzero request-key counts after active calls reach zero indicate a lifecycle defect rather than normal load. `worker.observability.calls.unmatched_results` is the bounded counter for late results that no longer have a receiver.
 
 Stable errors include `policy_denied`, `invalid_request`, `timeout`, `cancelled`, `network_error`, `unavailable`, `limit_exceeded`, and `integrity_error`, with retryability metadata. Diagnose by code first; free-form messages are guidance, not an API contract.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.2.9",
+  "version": "1.2.10",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/relay-call-recovery.mjs

@@ -0,0 +1,148 @@
+// @ts-check
+
+/** @typedef {{id?: unknown, [key: string]: unknown}} RelayResult */
+/** @typedef {{event?: (level: string, name: string, fields: Record<string, unknown>, message: string) => void, warn?: (message: string) => void}} RecoveryLogger */
+/** @typedef {{setTimeout: (callback: () => void, delay: number) => any, clearTimeout: (handle: any) => void}} RecoveryScheduler */
+/**
+ * @typedef {{
+ *   logger?: RecoveryLogger,
+ *   send?: (value: RelayResult) => boolean,
+ *   isRecoverable?: () => boolean,
+ *   activeCallIds?: () => Iterable<string>,
+ *   suppressCall?: (callId: string, reason: string) => void,
+ *   cancelOrigin?: (reason: string) => number,
+ *   terminate?: () => void,
+ *   graceMs?: unknown,
+ *   scheduler?: RecoveryScheduler,
+ * }} RelayCallRecoveryOptions
+ */
+
+const DEFAULT_RECONNECT_GRACE_MS = 30_000;
+
+export class RelayCallRecovery {
+  /** @param {RelayCallRecoveryOptions} [options] */
+  constructor(options = {}) {
+    /** @type {RecoveryLogger} */
+    this.logger = options.logger || { warn: (message) => console.warn(message) };
+    this.send = typeof options.send === "function" ? options.send : () => false;
+    this.isRecoverable = typeof options.isRecoverable === "function" ? options.isRecoverable : () => false;
+    this.activeCallIds = typeof options.activeCallIds === "function" ? options.activeCallIds : () => [];
+    this.suppressCall = typeof options.suppressCall === "function" ? options.suppressCall : () => {};
+    this.cancelOrigin = typeof options.cancelOrigin === "function" ? options.cancelOrigin : () => 0;
+    this.terminate = typeof options.terminate === "function" ? options.terminate : () => {};
+    this.graceMs = positiveInteger(options.graceMs, DEFAULT_RECONNECT_GRACE_MS);
+    this.scheduler = options.scheduler || { setTimeout, clearTimeout };
+    /** @type {Map<string, RelayResult>} */
+    this.pendingResults = new Map();
+    /** @type {any} */
+    this.reconnectTimer = null;
+  }
+
+  /** @param {RelayResult} response */
+  deliver(response) {
+    const callId = String(response?.id || "");
+    if (this.send(response)) {
+      if (callId) this.pendingResults.delete(callId);
+      return true;
+    }
+    if (callId && this.isRecoverable()) {
+      this.pendingResults.set(callId, response);
+      this.scheduleExpiry();
+      this.logger.event?.("debug", "relay.tool_result.queued", {
+        call_id: shortCallId(callId), queued_results: this.pendingResults.size,
+      }, "Queued a completed tool result while the relay reconnects");
+      return false;
+    }
+    this.logger.event?.("debug", "relay.tool_result.discarded", {
+      call_id: shortCallId(callId), reason: "transport_unavailable",
+    }, "Discarded a tool result because the relay is no longer recoverable");
+    return false;
+  }
+
+  /** @param {unknown} callId */
+  discard(callId) {
+    return this.pendingResults.delete(String(callId));
+  }
+
+  /** @param {Iterable<string>} resumedCallIds @param {(callId: string) => boolean} cancelCall */
+  reconcile(resumedCallIds, cancelCall) {
+    const resumed = new Set(resumedCallIds);
+    let cancelled = 0;
+    let discarded = 0;
+    for (const callId of this.activeCallIds()) {
+      if (!resumed.has(callId) && cancelCall(callId)) cancelled += 1;
+    }
+    for (const callId of [...this.pendingResults.keys()]) {
+      if (!resumed.has(callId) && this.pendingResults.delete(callId)) discarded += 1;
+    }
+    if (cancelled > 0 || discarded > 0) {
+      this.logger.event?.("debug", "relay.calls.reconciled", { cancelled_calls: cancelled, discarded_results: discarded },
+        "Cancelled relay work that no longer had a waiting client after reconnect");
+    }
+  }
+
+  disconnected() {
+    const activeCalls = [...this.activeCallIds()].length;
+    if (activeCalls === 0 && this.pendingResults.size === 0) return;
+    this.scheduleExpiry();
+    this.logger.event?.("debug", "relay.calls.awaiting_reconnect", {
+      active_calls: activeCalls, queued_results: this.pendingResults.size, grace_ms: this.graceMs,
+    }, "Keeping in-flight tool calls alive during a brief relay interruption");
+  }
+
+  ready() {
+    this.clearTimer();
+    let delivered = 0;
+    for (const [callId, response] of [...this.pendingResults]) {
+      if (!this.send(response)) {
+        this.scheduleExpiry();
+        break;
+      }
+      this.pendingResults.delete(callId);
+      delivered += 1;
+    }
+    if (delivered > 0) {
+      this.logger.event?.("info", "relay.tool_results.replayed", { delivered_results: delivered },
+        "Delivered completed tool results after the relay reconnected");
+    }
+  }
+
+  stop() {
+    this.clearTimer();
+    this.pendingResults.clear();
+  }
+
+  scheduleExpiry() {
+    if (this.reconnectTimer) return;
+    this.reconnectTimer = this.scheduler.setTimeout(() => {
+      this.reconnectTimer = null;
+      for (const callId of this.activeCallIds()) this.suppressCall(callId, "relay_reconnect_timeout");
+      const cancelled = this.cancelOrigin("remote relay reconnect grace expired");
+      const discarded = this.pendingResults.size;
+      this.pendingResults.clear();
+      this.terminate();
+      if (cancelled > 0 || discarded > 0) {
+        this.logger.warn?.(`remote relay did not recover within ${this.graceMs / 1000} seconds; cancelled ${cancelled} call(s) and discarded ${discarded} queued result(s)`);
+      }
+    }, this.graceMs);
+    this.reconnectTimer?.unref?.();
+  }
+
+  clearTimer() {
+    if (!this.reconnectTimer) return;
+    this.scheduler.clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = null;
+  }
+}
+
+/** @param {unknown} value @param {number} fallback */
+function positiveInteger(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
+}
+
+/** @param {unknown} value */
+function shortCallId(value) {
+  const text = String(value || "");
+  return text.length <= 18 ? text : `${text.slice(0, 10)}...${text.slice(-5)}`;
+}

package/src/local/relay-connection.mjs

@@ -31,6 +31,7 @@ export class RelayConnection {
     this.expectedVersion = String(options.expectedVersion || "");
     this.onMessage = typeof options.onMessage === "function" ? options.onMessage : () => {};
     this.onDisconnect = typeof options.onDisconnect === "function" ? options.onDisconnect : () => {};
+    this.onReady = typeof options.onReady === "function" ? options.onReady : () => {};
     this.onSuperseded = typeof options.onSuperseded === "function" ? options.onSuperseded : () => {};
     this.onFatal = typeof options.onFatal === "function" ? options.onFatal : () => {};
     this.WebSocketClass = options.WebSocketClass || WebSocket;
@@ -230,8 +231,12 @@ export class RelayConnection {
       }
     }
 
+    const reconnected = this.hasConnected;
     this.hasConnected = true;
     this.resetOutage();
+    try { this.onReady({ reconnected, sessionId: this.activeSessionId }); } catch (error) {
+      this.logger.error?.("relay ready callback failed", { error_class: classifyOperationalError(error) });
+    }
     if (this.connectedOnceResolve) {
       this.connectedOnceResolve(true);
       this.connectedOnceResolve = null;

package/src/local/runtime-relay.mjs

@@ -18,12 +18,14 @@ export function createRuntimeRelayConnection(runtime, { workerUrl, secret, expec
     expectedVersion: String(expectedVersion || ""),
     helloMessage: () => ({
       type: "hello",
+      instance_id: runtime.relayInstanceId,
       tools: runtime.tools(),
       policy: runtime.policy,
       protocol_versions: MCP_SUPPORTED_PROTOCOL_VERSIONS,
     }),
     onMessage: (data, relayContext) => handleRelayData(runtime, data, relayContext),
     onDisconnect: () => runtime.handleRelayDisconnect(),
+    onReady: () => runtime.handleRelayReady(),
     onSuperseded: () => {
       runtime.terminateActiveProcesses("SIGKILL");
       runtime.processSessionManager.clear();
@@ -37,6 +39,20 @@ export function createRuntimeRelayConnection(runtime, { workerUrl, secret, expec
   });
 }
 
+export function normalizeRelayResumeCalls(message) {
+  if (!Array.isArray(message?.ids) || message.ids.length > 32) return { ok: false, ids: [] };
+  const ids = [];
+  const seen = new Set();
+  for (const value of message.ids) {
+    if (typeof value !== "string" || !/^call_[A-Za-z0-9_-]{8,240}$/.test(value) || seen.has(value)) {
+      return { ok: false, ids: [] };
+    }
+    seen.add(value);
+    ids.push(value);
+  }
+  return { ok: true, ids };
+}
+
 export function normalizeRelayToolCall(message) {
   const id = typeof message.id === "string" && message.id.length <= 256 ? message.id : "";
   const tool = typeof message.tool === "string" && message.tool.length <= 128 ? message.tool : "";

package/src/local/runtime.mjs

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { realpathSync, rmSync } from "node:fs";
 import { lstat, realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
@@ -30,7 +31,8 @@ import { AccountAccessGate } from "./account-access.mjs";
 import { buildProjectOverview, buildRuntimeInfo } from "./runtime-reporting.mjs";
 import { diagnoseRuntime as runRuntimeDiagnostics } from "./runtime-diagnostics.mjs";
 import { bindRuntimeToolHandlers, runtimeToolHandlerNames as registeredRuntimeToolHandlerNames } from "./runtime-tool-handlers.mjs";
-import { createRuntimeRelayConnection, normalizeRelayToolCall } from "./runtime-relay.mjs";
+import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelayToolCall } from "./runtime-relay.mjs";
+import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage, stateRootFromProfileStatePath } from "./runtime-paths.mjs";
 import {
   resolveTaskCapabilities as resolveRuntimeTaskCapabilities,
@@ -59,8 +61,10 @@ export class LocalRuntime {
     this.processTracker = new ProcessTracker();
     this.lifecycle = new LifecycleController("local runtime");
     this.observability = new RuntimeObservability();
+    this.relayInstanceId = `daemon_${randomBytes(18).toString("base64url")}`;
     this.activeRelayCalls = new Set();
     this.suppressedRelayResults = new Map();
+    this.relayResumeSessionId = 0;
     this.callRegistry = new CallRegistry({
       maximum: MAX_CONCURRENT_TOOL_CALLS,
       onCancel: (record) => {
@@ -171,10 +175,16 @@ export class LocalRuntime {
       slowMs: SLOW_TOOL_CALL_MS,
     });
     this.relay = createRuntimeRelayConnection(this, {
-      workerUrl: remoteWorkerUrl,
-      secret: remoteSecret,
-      expectedVersion: expectedRelayVersion,
-      onFatal,
+      workerUrl: remoteWorkerUrl, secret: remoteSecret, expectedVersion: expectedRelayVersion, onFatal,
+    });
+    this.relayCallRecovery = new RelayCallRecovery({
+      logger: this.logger,
+      send: (value) => this.send(value),
+      isRecoverable: () => Boolean(this.relay && !this.relay.status?.().closed),
+      activeCallIds: () => this.activeRelayCalls,
+      suppressCall: (callId, reason) => this.suppressedRelayResults.set(callId, reason),
+      cancelOrigin: (reason) => this.callRegistry.cancelOrigin("relay", reason),
+      terminate: () => this.terminateActiveProcesses("SIGTERM", true),
     });
   }
 
@@ -219,6 +229,7 @@ export class LocalRuntime {
     if (!this.lifecycle.beginStop()) return;
     try {
       this.relay?.stop();
+      this.relayCallRecovery.stop();
       this.callRegistry.cancelAll("runtime stopped");
       this.terminateActiveProcesses("SIGKILL");
       this.processSessionManager.clear();
@@ -243,7 +254,7 @@ export class LocalRuntime {
       this.handleRelayProtocolViolation("invalid_server_message");
       return;
     }
-    if (this.handleRelayControlMessage(message)) return;
+    if (this.handleRelayControlMessage(message, relayContext)) return;
     if (message.type === "relay_probe") {
       if (isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("unexpected_relay_probe");
       this.handleRelayProbe(message, relayContext);
@@ -251,20 +262,38 @@ export class LocalRuntime {
     }
     if (message.type !== "tool_call") return this.handleRelayProtocolViolation("unexpected_server_message_type");
     if (!isRelayReadyContext(relayContext, this.relay)) return this.handleRelayProtocolViolation("tool_call_before_ready");
-    await this.handleRelayToolCall(message, relayContext);
+    await this.handleRelayToolCall(message);
   }
 
-  handleRelayControlMessage(message) {
+  handleRelayControlMessage(message, relayContext = {}) {
     if (message.type === "welcome") {
       this.relay?.observeWelcome(message);
       return true;
     }
     if (message.type === "hello_ack") {
+      this.relayResumeSessionId = 0;
       this.relay?.acknowledge(message);
       return true;
     }
+    if (message.type === "resume_calls") {
+      const sessionId = Number(relayContext.sessionId) || 0;
+      const resume = normalizeRelayResumeCalls(message);
+      if (!resume.ok || !sessionId || relayContext.authenticated !== true || relayContext.ready === true) {
+        this.handleRelayProtocolViolation("invalid_resume_calls");
+        return true;
+      }
+      this.reconcileRelayCalls(resume.ids);
+      this.relayResumeSessionId = sessionId;
+      return true;
+    }
     if (message.type === "ready_ack") {
+      const sessionId = Number(relayContext.sessionId) || 0;
+      if (!sessionId || sessionId !== this.relayResumeSessionId) {
+        this.handleRelayProtocolViolation("resume_calls_required");
+        return true;
+      }
       this.relay?.confirmReady(message);
+      this.relayResumeSessionId = 0;
       return true;
     }
     if (message.type === "pong") return true;
@@ -291,12 +320,12 @@ export class LocalRuntime {
     const id = typeof message?.id === "string" && /^probe_[A-Za-z0-9_-]{8,240}$/.test(message.id) ? message.id : "";
     const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!id || !relaySessionId) return this.handleRelayProtocolViolation("invalid_relay_probe");
-    this.deliverRelayToolResult({ type: "relay_probe_result", id }, relaySessionId);
+    const outcome = this.relay?.sendForSession?.({ type: "relay_probe_result", id }, relaySessionId);
+    if (!outcome?.ok) this.handleRelayProtocolViolation("relay_probe_delivery_failed");
   }
 
-  async handleRelayToolCall(message, relayContext = {}) {
+  async handleRelayToolCall(message) {
     const envelope = normalizeRelayToolCall(message);
-    const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!envelope.ok) {
       this.logger.warn?.("Received an invalid tool request from the relay; the request was rejected.");
       this.logger.event?.("debug", "relay.tool_call.invalid", {
@@ -307,7 +336,7 @@ export class LocalRuntime {
         id: envelope.id,
         ok: false,
         error: { code: "invalid_request", message: "invalid tool_call envelope", retryable: false },
-      }, relaySessionId);
+      });
       return;
     }
     if (this.activeRelayCalls.has(envelope.id)) {
@@ -335,31 +364,15 @@ export class LocalRuntime {
         }, "Discarded a tool result because the caller was no longer waiting");
         return;
       }
-      this.deliverRelayToolResult(response, relaySessionId);
+      this.deliverRelayToolResult(response);
     } finally {
       this.activeRelayCalls.delete(envelope.id);
       this.suppressedRelayResults.delete(envelope.id);
     }
   }
 
-  deliverRelayToolResult(response, relaySessionId = 0) {
-    const sessionId = Number(relaySessionId) || 0;
-    const outcome = this.relay?.sendForSession
-      ? this.relay.sendForSession(response, sessionId)
-      : (this.send(response) ? { ok: true, reason: "sent" } : { ok: false, reason: "transport_unavailable" });
-    if (outcome?.ok) return true;
-    const reason = String(outcome?.reason || "transport_unavailable");
-    const missingSession = reason === "session_ended" && sessionId <= 0;
-    this.logger.event?.(missingSession ? "error" : "debug", "relay.tool_result.discarded", {
-      call_id: shortCallId(response?.id), reason, relay_session_id: sessionId,
-      active_session_id: Number(this.relay?.currentSessionId?.() || 0),
-    }, missingSession
-      ? "Discarded a tool result because the relay session id was missing from the inbound tool_call context"
-      : reason === "send_failed"
-        ? "Could not send a tool result because the relay transport failed"
-        : "Discarded a tool result because its relay session had ended");
-    if (reason === "send_failed") this.relay?.interrupt?.("relay_transport_error");
-    return false;
+  deliverRelayToolResult(response) {
+    return this.relayCallRecovery.deliver(response);
   }
 
   finishCall(callId) {
@@ -373,18 +386,25 @@ export class LocalRuntime {
 
   cancelRelayCall(callId, suppressionReason = "caller_cancelled") {
     const id = String(callId);
+    const discardedResult = this.relayCallRecovery.discard(id);
     if (this.activeRelayCalls.has(id)) this.suppressedRelayResults.set(id, suppressionReason);
-    return this.cancelCall(id, "remote cancellation");
+    return this.cancelCall(id, "remote cancellation") || discardedResult;
+  }
+
+  reconcileRelayCalls(resumedCallIds) {
+    this.relayCallRecovery.reconcile(
+      resumedCallIds,
+      (callId) => this.cancelRelayCall(callId, "caller_no_longer_waiting"),
+    );
   }
 
   handleRelayDisconnect() {
-    for (const callId of this.activeRelayCalls) this.suppressedRelayResults.set(callId, "relay_disconnected");
-    const cancelled = this.callRegistry.cancelOrigin("relay", "remote relay disconnected");
-    this.terminateActiveProcesses("SIGTERM", true);
-    if (cancelled > 0) {
-      this.logger.event?.("debug", "relay.calls.cancelled_on_disconnect", { cancelled_calls: cancelled },
-        "Cancelled in-flight tool calls after the relay connection ended");
-    }
+    this.relayResumeSessionId = 0;
+    this.relayCallRecovery.disconnected();
+  }
+
+  handleRelayReady() {
+    this.relayCallRecovery.ready();
   }
 
   async executeTool(tool, args, context = {}) {

package/src/worker/daemon-sockets.ts

@@ -7,6 +7,7 @@ export interface DaemonAttachment {
   connectedAt: string;
   lastSeenAt?: string;
   probeId?: string;
+  instanceId?: string;
   policy?: DaemonPolicy;
   tools?: string[];
 }
@@ -29,6 +30,7 @@ export class DaemonSocketRegistry {
       connectedAt: sanitizeMetadataText(candidate.connectedAt, 64) ?? "",
       lastSeenAt: sanitizeMetadataText(candidate.lastSeenAt, 64),
       probeId: sanitizeProbeId(candidate.probeId),
+      instanceId: sanitizeDaemonInstanceId(candidate.instanceId),
       policy,
       tools: sanitizeDaemonTools(candidate.tools, policy),
     };
@@ -54,12 +56,13 @@ export class DaemonSocketRegistry {
     socket.serializeAttachment({ role: "candidate", connectedAt } satisfies DaemonAttachment);
   }
 
-  beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; policy: DaemonPolicy; tools: string[] }): void {
+  beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; policy: DaemonPolicy; tools: string[] }): void {
     socket.serializeAttachment({
       role: "probing",
       connectedAt: values.connectedAt,
       lastSeenAt: values.connectedAt,
       probeId: values.probeId,
+      instanceId: values.instanceId,
       policy: values.policy,
       tools: values.tools,
     } satisfies DaemonAttachment);
@@ -89,6 +92,7 @@ export class DaemonSocketRegistry {
       role: "expired",
       connectedAt: attachment.connectedAt,
       lastSeenAt: attachment.lastSeenAt,
+      instanceId: attachment.instanceId,
     } satisfies DaemonAttachment);
   }
 
@@ -105,3 +109,8 @@ function sanitizeProbeId(value: unknown): string | undefined {
   if (typeof value !== "string" || !/^probe_[A-Za-z0-9_-]{8,240}$/.test(value)) return undefined;
   return value;
 }
+
+function sanitizeDaemonInstanceId(value: unknown): string | undefined {
+  if (typeof value !== "string" || !/^daemon_[A-Za-z0-9_-]{16,96}$/.test(value)) return undefined;
+  return value;
+}

package/src/worker/index.ts

@@ -34,13 +34,14 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.9";
+const SERVER_VERSION = "1.2.10";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
 const MAX_PENDING_CALLS = 32;
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
+const DAEMON_RECONNECT_GRACE_MS = 30_000;
 
 interface BridgeEnv extends OAuthControllerEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
@@ -179,11 +180,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         return;
       }
       const daemonPolicy = sanitizeDaemonPolicy(body.policy);
+      const instanceId = daemonInstanceId(body.instance_id);
+      if (!instanceId) {
+        rejectDaemonMessage(ws, "invalid_daemon_instance", 1002, "daemon instance id required");
+        return;
+      }
       const authenticatedAt = new Date().toISOString();
       const probeId = randomToken("probe");
       this.daemonRegistry.beginProbe(ws, {
         connectedAt: authenticatedAt,
         probeId,
+        instanceId,
         policy: daemonPolicy,
         tools: sanitizeDaemonTools(body.tools, daemonPolicy),
       });
@@ -218,11 +225,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         return;
       }
       const readyAt = new Date().toISOString();
-      if (!this.daemonRegistry.promote(ws, readyAt)) {
+      const readyAttachment = this.daemonRegistry.promote(ws, readyAt);
+      if (!readyAttachment) {
         rejectDaemonMessage(ws, "invalid_relay_readiness_state", 1002, "invalid daemon readiness state");
         return;
       }
+      const reboundCallIds = this.pending.rebindInstance(readyAttachment.instanceId ?? "", ws);
+      if (reboundCallIds.length > 0) {
+        this.observability.event("info", "daemon.calls.rebound", { rebound_calls: reboundCallIds.length });
+      }
       try {
+        ws.send(JSON.stringify({ type: "resume_calls", ids: reboundCallIds }));
         ws.send(JSON.stringify({ type: "ready_ack", server: SERVER_NAME, version: SERVER_VERSION }));
       } catch {
         this.invalidateDaemonSocket(ws, "daemon readiness acknowledgement failed", "daemon ready timeout", "daemon_ready_timeout");
@@ -263,7 +276,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async cleanupDaemonSocket(ws: WebSocket, message: string): Promise<void> {
     this.observability.socketDisconnected();
-    this.pending.rejectSocket(ws, () => new WorkerToolError("unavailable", message, true));
+    this.detachDaemonSocketCalls(ws, message);
     await this.scheduleSocketAlarms();
   }
 
@@ -428,6 +441,9 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     this.reclaimStaleDaemonSockets();
     const socket = this.daemonRegistry.readySockets()[0];
     if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
+    const daemonAttachment = this.daemonRegistry.readyAttachment(socket);
+    const daemonInstanceId = daemonAttachment?.instanceId ?? "";
+    if (!daemonInstanceId) throw new WorkerToolError("unavailable", "local daemon connection is missing its instance identity", true);
     const id = randomToken("call");
     const timeoutMs = daemonToolTimeoutMs(name, args);
     let result: Promise<unknown>;
@@ -435,20 +451,23 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       result = this.pending.register({
         id,
         socket,
+        daemonInstanceId,
         clientRequestKey: requestKey,
         tool: name,
         timeoutMs,
         onTimeout: (record) => {
-          sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
-          const silentForMs = Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(record.socket));
-          if (!Number.isFinite(silentForMs) || silentForMs > 45_000) {
+          if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+          const silentForMs = record.socket
+            ? Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(record.socket))
+            : 0;
+          if (record.socket && (!Number.isFinite(silentForMs) || silentForMs > 45_000)) {
             this.invalidateDaemonSocket(record.socket, "daemon became unresponsive", "daemon liveness timeout");
           }
           return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
         },
         signal,
         onAbort: (record) => {
-          sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+          if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
           return new WorkerToolError("cancelled", "MCP client stopped waiting for the tool result");
         },
       });
@@ -482,7 +501,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   private cancelClientRequest(requestKey?: string): void {
     if (!requestKey) return;
     this.pending.cancelRequest(requestKey, (record) => {
-      sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
+      if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
       return new WorkerToolError("cancelled", "tool call cancelled by client");
     });
   }
@@ -542,12 +561,24 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     closeReason: string,
     errorCode = "daemon_liveness_timeout",
   ): void {
+    this.detachDaemonSocketCalls(ws, message);
     this.daemonRegistry.expire(ws);
-    this.pending.rejectSocket(ws, () => new WorkerToolError("unavailable", message, true));
     sendWebSocketQuietly(ws, { type: "error", error: errorCode });
     closeWebSocketQuietly(ws, 1008, closeReason);
   }
 
+  private detachDaemonSocketCalls(ws: WebSocket, message: string): number {
+    const attachment = this.daemonRegistry.attachment(ws);
+    if (!attachment?.instanceId) {
+      return this.pending.rejectSocket(ws, () => new WorkerToolError("unavailable", message, true));
+    }
+    return this.pending.detachSocket(
+      ws,
+      DAEMON_RECONNECT_GRACE_MS,
+      () => new WorkerToolError("unavailable", `${message}; reconnect grace expired`, true),
+    );
+  }
+
   private reclaimStaleDaemonSockets(now = Date.now()): void {
     for (const socket of this.daemonRegistry.readyRoleSockets()) {
       const deadline = daemonLivenessDeadlineMs(this.daemonRegistry.readyAttachment(socket));
@@ -697,3 +728,8 @@ export default {
     return stub.fetch(request);
   },
 } satisfies ExportedHandler<BridgeEnv>;
+
+function daemonInstanceId(value: unknown): string {
+  if (typeof value !== "string" || !/^daemon_[A-Za-z0-9_-]{16,96}$/.test(value)) return "";
+  return value;
+}

package/src/worker/pending-call-contract.ts

@@ -0,0 +1,26 @@
+export interface PendingCallRecord {
+  id: string;
+  socket?: WebSocket;
+  daemonInstanceId?: string;
+  reconnectTimeout?: ReturnType<typeof setTimeout>;
+  clientRequestKey?: string;
+  tool: string;
+  startedAt: number;
+  timeout: ReturnType<typeof setTimeout>;
+  resolve: (value: unknown) => void;
+  reject: (error: Error) => void;
+  signal?: AbortSignal;
+  abortHandler?: () => void;
+}
+
+export interface RegisterPendingCall {
+  id: string;
+  socket: WebSocket;
+  daemonInstanceId?: string;
+  clientRequestKey?: string;
+  tool: string;
+  timeoutMs: number;
+  onTimeout: (record: PendingCallRecord) => Error;
+  signal?: AbortSignal;
+  onAbort?: (record: PendingCallRecord) => Error;
+}

package/src/worker/pending-calls.ts

@@ -1,3 +1,5 @@
+import type { PendingCallRecord, RegisterPendingCall } from "./pending-call-contract.ts";
+
 export class PendingCallRegistrationError extends Error {
   readonly code: "conflict" | "limit_exceeded";
   readonly retryable: boolean;
@@ -10,30 +12,6 @@ export class PendingCallRegistrationError extends Error {
   }
 }
 
-export interface PendingCallRecord {
-  id: string;
-  socket: WebSocket;
-  clientRequestKey?: string;
-  tool: string;
-  startedAt: number;
-  timeout: ReturnType<typeof setTimeout>;
-  resolve: (value: unknown) => void;
-  reject: (error: Error) => void;
-  signal?: AbortSignal;
-  abortHandler?: () => void;
-}
-
-interface RegisterPendingCall {
-  id: string;
-  socket: WebSocket;
-  clientRequestKey?: string;
-  tool: string;
-  timeoutMs: number;
-  onTimeout: (record: PendingCallRecord) => Error;
-  signal?: AbortSignal;
-  onAbort?: (record: PendingCallRecord) => Error;
-}
-
 export class PendingCallRegistry {
   private readonly maximum: number;
   private readonly byId = new Map<string, PendingCallRecord>();
@@ -78,6 +56,7 @@ export class PendingCallRegistry {
       const record: PendingCallRecord = {
         id: input.id,
         socket: input.socket,
+        daemonInstanceId: input.daemonInstanceId,
         clientRequestKey: input.clientRequestKey,
         tool: String(input.tool || "unknown"),
         startedAt,
@@ -126,16 +105,52 @@ export class PendingCallRegistry {
     return ids.length;
   }
 
-  snapshot(): { active: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
+  detachSocket(
+    socket: WebSocket,
+    graceMs: number,
+    createError: (record: PendingCallRecord) => Error,
+  ): number {
+    const records = [...this.byId.values()].filter((record) => record.socket === socket);
+    const delay = Math.max(1, Math.floor(Number(graceMs) || 1));
+    for (const record of records) {
+      record.socket = undefined;
+      if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
+      record.reconnectTimeout = setTimeout(() => {
+        const current = this.byId.get(record.id);
+        if (!current || current.socket) return;
+        const expired = this.take(record.id);
+        if (expired) expired.reject(createError(expired));
+      }, delay);
+    }
+    return records.length;
+  }
+
+  rebindInstance(daemonInstanceId: string, socket: WebSocket): string[] {
+    if (!daemonInstanceId) return [];
+    const rebound: string[] = [];
+    for (const record of this.byId.values()) {
+      if (record.socket || record.daemonInstanceId !== daemonInstanceId) continue;
+      if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
+      record.reconnectTimeout = undefined;
+      record.socket = socket;
+      rebound.push(record.id);
+    }
+    return rebound;
+  }
+
+  snapshot(): { active: number; detached: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
     const now = performance.now();
     const byTool: Record<string, number> = {};
+    let detached = 0;
     let oldestMs = 0;
     for (const record of this.byId.values()) {
       byTool[record.tool] = (byTool[record.tool] || 0) + 1;
+      if (!record.socket) detached += 1;
       oldestMs = Math.max(oldestMs, now - record.startedAt);
     }
     return {
       active: this.byId.size,
+      detached,
       request_keys: this.byRequestKey.size,
       maximum: this.maximum,
       oldest_ms: oldestMs,
@@ -147,6 +162,7 @@ export class PendingCallRegistry {
     const record = this.byId.get(id);
     if (!record) return undefined;
     clearTimeout(record.timeout);
+    if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
     if (record.signal && record.abortHandler) record.signal.removeEventListener("abort", record.abortHandler);
     this.byId.delete(id);
     if (record.clientRequestKey && this.byRequestKey.get(record.clientRequestKey) === id) {

package/tsconfig.local.json

@@ -24,6 +24,7 @@
     "src/local/call-registry.mjs",
     "src/local/policy.mjs",
     "src/local/runtime-paths.mjs",
+    "src/local/relay-call-recovery.mjs",
     "src/local/agent-context-projection.mjs",
     "src/local/agent-skill-discovery.mjs",
     "src/local/agent-text-file.mjs",