machine-bridge-mcp 3.0.0-beta.11 → 3.0.0-beta.12

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 3.0.0-beta.12 - 2026-07-23
+
+### ChatGPT Streamable HTTP task continuity
+
+- Fix remote `tools/call` handling so an HTTP/SSE connection closing is no longer interpreted as MCP cancellation. Only an explicit session-scoped `notifications/cancelled` request may remove the pending request key and send `cancel_call` to the daemon.
+- Negotiate `text/event-stream` for clients that advertise it, prime the response immediately, send a bounded ten-second keepalive comment while work is active, and deliver the terminal JSON-RPC result as an SSE message. This prevents a long-running local operation from leaving the ChatGPT-to-Worker HTTP path completely idle.
+- Preserve the underlying Durable Object operation with `waitUntil` when the response stream is no longer writable, so transport disposal cannot silently terminate local work. JSON-only clients retain the existing single-response behavior.
+- Replace duplicated relay timing literals with one shared contract. Same-daemon reconnect recovery is extended from thirty seconds to two minutes, and the Worker pauses only the remaining normal call deadline while detached, avoiding both premature expiry during recovery and inflated timeouts while the daemon is healthy.
+- Add deterministic and live Worker regressions for SSE negotiation, immediate priming, keepalives, terminal result delivery, HTTP abort without cancellation, explicit cancellation after disconnect, shared timeout ceilings, and same-instance recovery timing.
+
 ## 3.0.0-beta.11 - 2026-07-23
 
 ### External-review verification and observability hardening

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.11",
+  "version_name": "3.0.0-beta.12",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/ARCHITECTURE.md

@@ -171,10 +171,10 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 7. The MCP client initializes against the sole current protocol version; an obsolete client must upgrade rather than enter a legacy execution path. The Worker returns a stateless HMAC-bound `MCP-Session-Id`, and later request/cancellation correlation is scoped by OAuth token, MCP session, JSON-RPC id type, and id value. Two clients may therefore reuse the same JSON-RPC id concurrently without collision. Sessionless POSTs remain independent and are not inserted into a token-global cancellation index. When the daemon advertises `session_bootstrap`, the Worker requests bounded local instructions and appends them to the initialization result; failure degrades to static instructions.
 8. A new daemon first authenticates as a bounded `probing` socket. The Worker sends a random `relay_probe`; the local runtime returns it through the normal session-bound result-delivery path; only the matching result produces `ready_ack`, promotion to the active daemon, and safe replacement of an incumbent connection.
 9. `tools/list` is derived only from the active end-to-end-verified daemon; without one, only `server_info` is advertised.
-10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, the authenticated client request key, and the incoming HTTP abort signal.
-11. The runtime validates policy and arguments, executes the tool, and returns a bounded result.
-12. If the socket remains ready, the Durable Object accepts the result only from that socket. If it drops, the Worker detaches the pending call for at most thirty seconds and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe. The local runtime preserves the operation and queues a completion over the same interval.
-13. A matching cancellation notification or incoming HTTP client disconnect removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request cancelled while disconnected therefore cannot be revived by a fast reconnect.
+10. `tools/call` receives a random relay call ID and is bound to the current daemon socket, that daemon process's ephemeral instance identifier, and the authenticated client request key. When the client accepts `text/event-stream`, the Worker immediately returns an SSE priming frame, emits bounded keepalive comments while the call runs, and retains the dispatch with Durable Object `waitUntil`; JSON-only clients retain the single terminal response.
+11. The runtime validates policy and arguments, executes the tool, and returns a bounded result. Closing or losing the HTTP response stream only makes that stream unwritable; it is not an MCP cancellation and does not remove the pending request.
+12. If the socket remains ready, the Durable Object accepts the result only from that socket. If it drops, the Worker detaches the pending call for at most two minutes and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe. The local runtime preserves the operation and queues a completion over the same shared interval. The Worker pauses the record's remaining normal deadline while detached and resumes it after same-instance rebinding, so connected calls are not granted an unconditional recovery extension.
+13. Only a matching session-scoped `notifications/cancelled` request removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with explicit cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request explicitly cancelled while disconnected therefore cannot be revived by a fast reconnect.
 14. If same-instance readiness does not return before the grace deadline, the Worker rejects the detached request and the local runtime cancels ordinary calls, terminates their process trees, and discards queued results. A newly started daemon has a different instance identifier and cannot inherit prior calls.
 15. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
@@ -254,7 +254,7 @@ Reconnect uses bounded exponential backoff with jitter. Brief self-healing inter
 
 The Worker stores socket transitions in `DaemonSocketRegistry`: `candidate` before hello, `probing` after authentication, `daemon` only after the end-to-end result probe, and `expired` after terminal failure. Durable Object alarms enforce separate hello, readiness, and steady-state liveness deadlines across hibernation. A healthy incumbent remains active while a replacement is probed; a malformed, silent, incompatible, or identity-mismatched replacement is closed without displacing it. Only a verified candidate receives `ready_ack` and then replaces the old socket. Ready daemons stay live only while inbound traffic refreshes `lastSeenAt`; silent half-open or hibernation-restored sockets are reclaimed instead of advertising `daemon.connected` while tool calls time out.
 
-Each daemon process generates a random bounded `instance_id` at startup and includes it in every reconnect hello. Pending calls normally retain their assigned socket. On an unexpected socket loss, only those records are detached and a thirty-second timer bounds recovery. A verified socket with the same instance ID rebinds them; another process or socket cannot resolve them. The local runtime mirrors that state machine by preserving active calls and completed-result envelopes until relay readiness returns. Before `ready_ack`, the Worker sends the exact IDs that still have remote waiters; the runtime cancels everything else and only then replays retained results through the verified socket. Grace expiry restores the terminal behavior: reject remote waiters, cancel local ordinary calls, terminate process trees, and discard undeliverable results. This does not make calls durable across daemon restart or machine failure; managed jobs remain the separate durable mechanism.
+Each daemon process generates a random bounded `instance_id` at startup and includes it in every reconnect hello. Pending calls normally retain their assigned socket. On an unexpected socket loss, only those records are detached and the shared two-minute relay contract bounds recovery. A verified socket with the same instance ID rebinds them; another process or socket cannot resolve them. The local runtime mirrors that state machine by preserving active calls and completed-result envelopes until relay readiness returns. Before `ready_ack`, the Worker sends the exact IDs that still have remote waiters; the runtime cancels everything else and only then replays retained results through the verified socket. Grace expiry restores the terminal behavior: reject remote waiters, cancel local ordinary calls, terminate process trees, and discard undeliverable results. The shared execution envelope remains independent of reconnect grace. Worker operation countdown is paused while detached and resumed on same-instance rebinding, so a healthy unresponsive daemon still fails on the normal deadline while a recoverable disconnected call is not expired by two competing timers. This does not make calls durable across daemon restart or machine failure; managed jobs remain the separate durable mechanism.
 
 ## Persistence
 

package/docs/AUDIT.md

@@ -1,5 +1,17 @@
 # Security and privacy audit notes
 
+## 2026-07-23 version 3.0.0-beta.12 ChatGPT task-continuity audit
+
+The reported symptom was not evidence that the model simply chose to stop. Live beta.11 inspection found a healthy single launchd daemon and matching Worker, but the Worker could retain an orphaned active call after the ChatGPT turn had already ended. The service log independently recorded repeated relay outages with the same daemon process still alive, including an incident where the existing thirty-second recovery deadline cancelled an active call. A routine source search also lost its result through the same path during this audit. These observations separate process health from request continuity: the daemon can keep running while either the ChatGPT-to-Worker HTTP request or the Worker-to-daemon WebSocket disappears.
+
+The Worker contained a protocol defect at the first boundary. Every remote tool call was returned as one buffered JSON response only after local completion, leaving a long-running request with no response bytes. It also propagated the HTTP request abort signal into the pending-call registry and sent `cancel_call` when that signal fired. An intermediary reclaiming an idle HTTP request was therefore indistinguishable from an explicit user cancellation. This directly explains the visible behavior: the current turn ends without a terminal tool result, while a later “continue” message starts a new model turn that can resume the broader task from conversation state.
+
+Beta.12 separates transport disposal from MCP cancellation. A client advertising `text/event-stream` receives an immediate SSE priming frame, ten-second keepalive comments, and one terminal JSON-RPC message. The Durable Object registers the completion with `waitUntil`; closing the response stream only stops writes and its heartbeat timer. The pending request remains indexed until a daemon result, timeout, reconnect-grace expiry, or a session-scoped `notifications/cancelled` request. JSON-only clients remain supported, but their HTTP disconnect likewise no longer cancels the underlying MCP request.
+
+The second failure mechanism was a timing-contract mismatch. Worker detachment and local result retention each used independent thirty-second literals, while observed routed-network outages regularly exceeded that interval. Beta.12 moves heartbeat, reconnect, execution, overhead, and maximum-call values into one packaged shared contract. Same-instance recovery is two minutes. The Worker pauses the remaining operation deadline only while a record is detached, then resumes it after same-instance rebinding; healthy connected calls retain their original timeout. The local relay accepts the same bounded execution envelope. This is bounded continuation, not durable execution across daemon restart or machine failure. Managed jobs remain the durable mechanism for work that must survive those boundaries.
+
+Regressions exercise content negotiation including `q=0`, immediate stream priming before the daemon replies, keepalive framing, terminal result projection, response-stream cancellation without operation cancellation, real HTTP abort with retained pending/request-key indexes, subsequent explicit cancellation targeting the original daemon call, Worker/local timeout-envelope parity and detached-deadline pause/resume, and the existing same-instance socket-rebind state machine. No beta.12 Worker deployment, daemon/service replacement, global installation, acceptance record, Git push, tag, npm publication, or GitHub Release is implied by this source correction.
+
 ## 2026-07-23 version 3.0.0-beta.11 external-review verification
 
 The supplied read-only review was rechecked against source, package gates, platform plans, and the repository's explicit product/maintenance invariants rather than accepted as a backlog wholesale. Its central observability concern was correct: Worker field-name redaction was materially weaker than the local logger, so a future event could place a token, email address, credential URL, private-key header, or user-home path in an innocently named string field. The review did not notice a second defect in both structured loggers: sanitized caller fields were spread after core fields and could replace local `timestamp`, `level`, `component`, `message`, or `event` metadata and the corresponding Worker metadata, weakening incident chronology and event identity without executing code.

package/docs/LOGGING.md

@@ -82,7 +82,7 @@ All per-tool starts, successes, failures, cancellations, timing, and expected la
 
 The layered repository check runner follows the same noise rule. Green child-task output is discarded after the child exits; only task name and elapsed time are printed. Failed tasks expose bounded head/tail stdout and stderr diagnostics. `MBM_CHECK_VERBOSE=1` is an explicit operator choice to stream raw child output and is not used by default or CI.
 
-A completed local result is normally sent on the ready relay connection. If that socket disappears, the runtime queues the bounded result envelope during the thirty-second same-daemon reconnect window rather than logging a terminal delivery failure. Debug output records only a shortened call ID and queue/reconnect counts. After the same daemon process completes readiness, replay emits one recovery event; a different process cannot inherit the result. Explicit caller cancellation suppresses eventual delivery. If the relay does not recover before the grace deadline, ordinary calls are cancelled, queued results are discarded, and the existing outage state machine determines whether the persistent failure warrants a warning. Tool arguments, commands, and result content are never logged.
+A completed local result is normally sent on the ready relay connection. If that socket disappears, the runtime queues the bounded result envelope during the shared two-minute same-daemon reconnect window rather than logging a terminal delivery failure. Debug output records only a shortened call ID and queue/reconnect counts. After the same daemon process completes readiness, replay emits one recovery event; a different process cannot inherit the result. Explicit MCP cancellation suppresses eventual delivery; loss of the HTTP/SSE response stream does not. If the relay does not recover before the grace deadline, ordinary calls are cancelled, queued results are discarded, and the existing outage state machine determines whether the persistent failure warrants a warning. Tool arguments, commands, and result content are never logged.
 
 Debug per-tool fields may include tool name, duration, coarse outcome class, and a shortened random call identifier. The identifier is for correlating adjacent local events and is not a stable audit identifier. Authorization failures expose a random approval ID, scope, and expiry to the caller; daemon logs still omit normalized targets and request arguments.
 

package/docs/OPERATIONS.md

@@ -51,7 +51,9 @@ A successful diagnostic result applies only to that probe. An MCP host can still
 
 Machine Bridge supports concurrent calls: the Worker admits up to 32 pending daemon calls and the local runtime admits up to 16 active tool calls. These are capacity limits, not a single global execution queue. Each successful MCP initialization receives a signed `MCP-Session-Id`; JSON-RPC ids and cancellation are scoped to that session, so separate chat windows may reuse the same numeric ids safely even when they share one OAuth account and token.
 
-`server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded thirty-second same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Explicit MCP cancellation, an incoming HTTP client disconnect, and timeout remove the pending record and its session request key. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
+`server_info.worker.pending_calls` reports `active`, `detached`, `request_keys`, `maximum`, `oldest_ms`, and `by_tool`. `worker.sockets_live` separately reports `authenticated`, `probing`, `ready`, and `candidates`; only `ready` sockets contribute to `daemon.connected` and tool advertisement. A nonzero `active` count means work is in flight, not that the bridge is locked. `detached > 0` means a daemon socket was lost and those requests are inside the bounded two-minute same-instance reconnect window. Calls for simple reads and probes should continue while another independent process call runs. Only explicit session-scoped MCP cancellation, timeout, or reconnect-grace expiry removes the pending record and its request key; an HTTP response disconnect is not cancellation. A daemon-socket closure detaches only calls assigned to that socket; the same daemon process can reclaim them after completing readiness, while another process cannot. Grace expiry rejects the request and cancels the local ordinary operation. Refreshing a chat page is not the recovery mechanism and should not be required.
+
+For Streamable HTTP clients such as ChatGPT that advertise `text/event-stream`, remote tool calls return an immediate SSE frame and a keepalive comment every ten seconds until the terminal JSON-RPC result. This keeps a long call from presenting as an idle HTTP response. If the client or an intermediary nevertheless closes that stream, Machine Bridge keeps the bounded operation alive; only `notifications/cancelled` carries cancellation semantics. A completed result cannot be delivered back onto a stream that no longer exists, so the host may still need a later model turn to inspect resulting workspace state, but the bridge no longer kills the local operation merely because the response transport disappeared.
 
 `server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 

package/docs/TESTING.md

@@ -80,7 +80,7 @@ The suite includes:
 - P-256 root generation, root-certified ephemeral session issuance, macOS trust-broker build/signature checks, signed WebSocket preflight, one-time transactional nonce consumption, challenge transcript binding, wrong-root/session/tamper/expiry/replay rejection, and prevention of unauthenticated candidate churn;
 - request-scoped effective authority and catalog-wide risk review; non-escalatable reviewer/editor/operator ceilings; authenticated-owner direct execution; control-plane root denial; external and sensitive path composition; persistence-target rejection; symbolic-link ancestor and patch-move canonicalization; owner-only browser/application/data-export and persistent-plan effects; account/client/refresh-family ownership of processes, output sessions, and jobs; delegated sandbox fail-closed behavior; legacy-lease non-consumption; and malformed-record rejection;
 - root-certified ephemeral P-256 account-administration requests with origin/method/path/body/key/time/nonce binding, transactional one-time nonce consumption, removal of the long-lived administration secret, certificate/signature/body tamper rejection, nonce replay rejection, and malformed nonce-state fail-closed behavior;
-- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, fifteen-minute access tokens, trusted single-account client binding, optional DPoP proof and token-family binding, unsupported critical-header rejection, proof-verification non-consumption, post-authorization replay consumption, invalid-grant cache-exhaustion resistance, independent client revocation, refresh-family idle/absolute limits, bounded consumed-token/revoked-family replay state, record-level schema validation, access/refresh rotation, stale refresh replay rejection with whole-family access/refresh revocation, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, candidate/probing/ready transitions, invalid readiness-result rejection, incumbent preservation until verified handover, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
+- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, fifteen-minute access tokens, trusted single-account client binding, optional DPoP proof and token-family binding, unsupported critical-header rejection, proof-verification non-consumption, post-authorization replay consumption, invalid-grant cache-exhaustion resistance, independent client revocation, refresh-family idle/absolute limits, bounded consumed-token/revoked-family replay state, record-level schema validation, access/refresh rotation, stale refresh replay rejection with whole-family access/refresh revocation, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, SSE content negotiation including `q=0`, immediate stream priming, keepalive and terminal-event framing, HTTP abort without implicit cancellation, explicit cancellation after response disconnect, shared Worker/local timeout ceilings, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, candidate/probing/ready transitions, invalid readiness-result rejection, incumbent preservation until verified handover, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
 - a real headless-Chrome OAuth navigation regression with four cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback blocks the regional redirect, allowing the registered and regional callbacks blocks the final Copilot Studio redirect, and the complete policy preserves `code` and `state` through all three cross-origin hops. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.11",
+  "version": "3.0.0-beta.12",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/relay-call-recovery.mjs

@@ -1,5 +1,7 @@
 // @ts-check
 
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
+
 /** @typedef {{id?: unknown, [key: string]: unknown}} RelayResult */
 /** @typedef {{event?: (level: string, name: string, fields: Record<string, unknown>, message: string) => void, warn?: (message: string) => void}} RecoveryLogger */
 /** @typedef {{setTimeout: (callback: () => void, delay: number) => any, clearTimeout: (handle: any) => void}} RecoveryScheduler */
@@ -17,7 +19,7 @@
  * }} RelayCallRecoveryOptions
  */
 
-const DEFAULT_RECONNECT_GRACE_MS = 30_000;
+const DEFAULT_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs;
 
 export class RelayCallRecovery {
   /** @param {RelayCallRecoveryOptions} [options] */

package/src/local/runtime-relay.mjs

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { RelayConnection } from "./relay-connection.mjs";
 import { createDaemonAuthentication, createDaemonPreflightHeaders, createDeviceSessionIdentity, validateDeviceSessionIdentity } from "./device-identity.mjs";
 import { MCP_SUPPORTED_PROTOCOL_VERSIONS, SERVER_NAME } from "./tools.mjs";
@@ -72,7 +73,7 @@ export function normalizeRelayToolCall(message) {
     tool,
     arguments: argumentsValue,
     authorization,
-    timeoutMs: clampInteger(message.timeout_ms, 60_000, 1000, 610_000),
+    timeoutMs: clampInteger(message.timeout_ms, 60_000, 1000, relayContract.maximumRelayToolTimeoutMs),
   };
 }
 

package/src/shared/relay-contract.json

@@ -0,0 +1,7 @@
+{
+  "reconnectGraceMs": 120000,
+  "streamHeartbeatMs": 10000,
+  "maximumExecutionTimeoutMs": 600000,
+  "toolCallOverheadMs": 5000,
+  "maximumRelayToolTimeoutMs": 610000
+}

package/src/worker/index.ts

@@ -1,5 +1,6 @@
 import { DurableObject } from "cloudflare:workers";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { PendingCallRegistrationError, PendingCallRegistry } from "./pending-calls.ts";
 import {
   DAEMON_HELLO_TIMEOUT_MS,
@@ -13,6 +14,7 @@ import {
 import { DaemonSocketRegistry } from "./daemon-sockets.ts";
 import { consumeDaemonPreflightNonce, createDaemonChallenge, verifyDaemonAuthentication, verifyDaemonPreflight } from "./daemon-auth.ts";
 import { mcpClientRequestKey, resolveMcpSession } from "./mcp-session.ts";
+import { acceptsEventStream, streamJsonRpcResponse } from "./mcp-stream.ts";
 import { daemonToolTimeoutMs } from "./tool-timeout.ts";
 import { WorkerObservability } from "./observability.ts";
 import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./errors.ts";
@@ -36,14 +38,14 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.11";
+const SERVER_VERSION = "3.0.0-beta.12";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
 const MAX_BODY_BYTES = 16 * 1024 * 1024;
 const MAX_PENDING_CALLS = 32;
 const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
-const DAEMON_RECONNECT_GRACE_MS = 30_000;
+const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs;
 
 interface BridgeEnv extends OAuthControllerEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
@@ -363,13 +365,23 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
     const session = await resolveMcpSession(request, body.method, this.oauth.identityKey(), authorized.tokenKey);
     if (session.kind === "invalid") return json(rpcError(body.id, -32001, "MCP session not found"), 404);
-    const response = await this.dispatchJsonRpc(
+    const dispatch = this.dispatchJsonRpc(
       body,
       base,
       authorized,
       session.kind === "active" ? session.sessionId : "",
-      request.signal,
     );
+    if (body.method === "tools/call") {
+      this.ctx.waitUntil(dispatch.then(() => undefined, () => undefined));
+      if (acceptsEventStream(request)) {
+        const streamed = dispatch.catch((error) => {
+          this.observability.event("error", "mcp.stream.dispatch.failed", { error_class: workerErrorClass(error) });
+          return rpcError(body.id, -32603, "Internal error");
+        });
+        return streamJsonRpcResponse(streamed);
+      }
+    }
+    const response = await dispatch;
     if (response === null) return new Response(null, { status: 202 });
     return session.kind === "initialize" ? json(response, 200, { "mcp-session-id": session.sessionId }) : json(response);
   }
@@ -379,7 +391,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     base: string,
     authorized: AuthorizedToken,
     sessionId: string,
-    signal?: AbortSignal,
   ): Promise<Record<string, unknown> | null> {
     if (request.method === "initialize") {
       const requested = asObject(request.params).protocolVersion;
@@ -387,7 +398,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         ? requested
         : MCP_PROTOCOL_VERSION;
       const bootstrap = this.daemonToolEnabled("session_bootstrap")
-        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized, undefined, signal).catch(() => null)
+        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized).catch(() => null)
         : null;
       const localInstructions = sessionInstructionText(bootstrap);
       return rpcResult(request.id, {
@@ -422,7 +433,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           base,
           authorized,
           mcpClientRequestKey(authorized.tokenKey, sessionId, request.id),
-          signal,
         );
         return rpcResult(request.id, textToolResult(result));
       } catch (error) {
@@ -437,7 +447,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     base: string,
     authorized: AuthorizedToken,
     requestKey?: string,
-    signal?: AbortSignal,
   ): Promise<unknown> {
     if (name === "server_info") {
       const { daemon, tools, authorization } = this.authorityContext(authorized);
@@ -478,7 +487,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (workspaceTools.some((tool) => tool.name === name)) {
       if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
-      const result = await this.callDaemonTool(name, args, authorized, requestKey, signal);
+      const result = await this.callDaemonTool(name, args, authorized, requestKey);
       return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
         accountVersion: authorized.accountVersion, role: authorized.role }) : result;
     }
@@ -489,7 +498,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     args: Record<string, unknown>,
     authorized: AuthorizedToken,
     requestKey?: string,
-    signal?: AbortSignal,
   ): Promise<unknown> {
     this.reclaimStaleDaemonSockets();
     const socket = this.daemonRegistry.readySockets()[0];
@@ -518,11 +526,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
           }
           return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
         },
-        signal,
-        onAbort: (record) => {
-          if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
-          return new WorkerToolError("cancelled", "MCP client stopped waiting for the tool result");
-        },
       });
     } catch (error) {
       if (error instanceof PendingCallRegistrationError) {
@@ -531,9 +534,8 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       throw error;
     }
     this.observability.callStarted(name);
-    if (!signal?.aborted) {
-      try {
-        socket.send(JSON.stringify({
+    try {
+      socket.send(JSON.stringify({
           type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
           authorization: {
             account_id: authorized.accountId,
@@ -542,11 +544,10 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
             family_id: authorized.familyId,
             role: authorized.role,
           },
-        }));
-      } catch {
-        this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
-        this.invalidateDaemonSocket(socket, "failed to send daemon tool call", "daemon send failed");
-      }
+      }));
+    } catch {
+      this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
+      this.invalidateDaemonSocket(socket, "failed to send daemon tool call", "daemon send failed");
     }
     try {
       const value = await result;

package/src/worker/mcp-stream.ts

@@ -0,0 +1,106 @@
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
+
+const DEFAULT_HEARTBEAT_MS = relayContract.streamHeartbeatMs;
+
+type JsonRpcMessage = Record<string, unknown> | null;
+type IntervalHandle = ReturnType<typeof setInterval>;
+
+type StreamScheduler = {
+  setInterval: (callback: () => void, delay: number) => IntervalHandle;
+  clearInterval: (handle: IntervalHandle) => void;
+};
+
+type StreamResponseOptions = {
+  heartbeatMs?: number;
+  streamId?: string;
+  scheduler?: StreamScheduler;
+  keepAlive?: (promise: Promise<void>) => void;
+};
+
+export function acceptsEventStream(request: Pick<Request, "headers">): boolean {
+  const accept = request.headers.get("accept") ?? "";
+  return accept.split(",").some((entry) => {
+    const [mediaType, ...parameters] = entry.split(";").map((value) => value.trim().toLowerCase());
+    if (mediaType !== "text/event-stream") return false;
+    const quality = parameters.find((value) => value.startsWith("q="));
+    if (!quality) return true;
+    const parsed = Number(quality.slice(2));
+    return Number.isFinite(parsed) && parsed > 0;
+  });
+}
+
+export function streamJsonRpcResponse(
+  result: Promise<JsonRpcMessage>,
+  options: StreamResponseOptions = {},
+): Response {
+  const encoder = new TextEncoder();
+  const heartbeatMs = positiveInteger(options.heartbeatMs, DEFAULT_HEARTBEAT_MS);
+  const streamId = options.streamId || `stream_${crypto.randomUUID()}`;
+  const scheduler = options.scheduler ?? { setInterval, clearInterval };
+  let interval: IntervalHandle | undefined;
+  let writable = true;
+
+  const completion = result.then(() => undefined, () => undefined);
+  options.keepAlive?.(completion);
+
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      const enqueue = (value: string): boolean => {
+        if (!writable) return false;
+        try {
+          controller.enqueue(encoder.encode(value));
+          return true;
+        } catch {
+          writable = false;
+          return false;
+        }
+      };
+      const stop = () => {
+        if (interval !== undefined) scheduler.clearInterval(interval);
+        interval = undefined;
+      };
+      const close = () => {
+        stop();
+        if (!writable) return;
+        writable = false;
+        try { controller.close(); } catch { /* Client disconnect is not MCP cancellation. */ }
+      };
+
+      enqueue(": connected\n\n");
+      interval = scheduler.setInterval(() => {
+        enqueue(": keepalive\n\n");
+      }, heartbeatMs);
+
+      void result.then(
+        (message) => {
+          if (message !== null) {
+            enqueue(`id: ${streamId}:1\nevent: message\ndata: ${JSON.stringify(message)}\n\n`);
+          }
+          close();
+        },
+        () => close(),
+      );
+    },
+    cancel() {
+      writable = false;
+      if (interval !== undefined) scheduler.clearInterval(interval);
+      interval = undefined;
+      // Streamable HTTP disconnect is not cancellation. The operation remains
+      // alive through keepAlive and can only be cancelled by MCP notification.
+    },
+  });
+
+  return new Response(body, {
+    status: 200,
+    headers: {
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-store, no-transform",
+      "x-content-type-options": "nosniff",
+    },
+  });
+}
+
+function positiveInteger(value: unknown, fallback: number): number {
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : fallback;
+}

package/src/worker/pending-call-contract.ts

@@ -6,7 +6,10 @@ export interface PendingCallRecord {
   clientRequestKey?: string;
   tool: string;
   startedAt: number;
-  timeout: ReturnType<typeof setTimeout>;
+  timeout?: ReturnType<typeof setTimeout>;
+  deadlineAt: number;
+  remainingTimeoutMs: number;
+  onTimeout: (record: PendingCallRecord) => Error;
   resolve: (value: unknown) => void;
   reject: (error: Error) => void;
   signal?: AbortSignal;

package/src/worker/pending-call-deadlines.ts

@@ -0,0 +1,57 @@
+import type { PendingCallRecord } from "./pending-call-contract.ts";
+
+type TimerHandle = ReturnType<typeof setTimeout>;
+export type PendingCallDeadlineOptions = {
+  now?: () => number;
+  scheduler?: {
+    setTimeout: (callback: () => void, delay: number) => TimerHandle;
+    clearTimeout: (handle: TimerHandle) => void;
+  };
+};
+
+export class PendingCallDeadlines {
+  private readonly clock: () => number;
+  private readonly scheduler: Required<PendingCallDeadlineOptions>["scheduler"];
+
+  constructor(options: PendingCallDeadlineOptions = {}) {
+    this.clock = options.now ?? (() => performance.now());
+    this.scheduler = options.scheduler ?? { setTimeout, clearTimeout };
+  }
+
+  now(): number {
+    return this.clock();
+  }
+
+  armOperation(record: PendingCallRecord, delayMs: number, expire: (id: string) => void): void {
+    if (record.timeout) this.scheduler.clearTimeout(record.timeout);
+    const delay = positiveDelay(delayMs);
+    record.remainingTimeoutMs = delay;
+    record.deadlineAt = this.clock() + delay;
+    record.timeout = this.scheduler.setTimeout(() => expire(record.id), delay);
+  }
+
+  pauseOperation(record: PendingCallRecord): void {
+    record.remainingTimeoutMs = Math.max(1, Math.ceil(record.deadlineAt - this.clock()));
+    if (record.timeout) this.scheduler.clearTimeout(record.timeout);
+    record.timeout = undefined;
+  }
+
+  armReconnect(record: PendingCallRecord, delayMs: number, expire: (id: string) => void): void {
+    if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
+    record.reconnectTimeout = this.scheduler.setTimeout(() => expire(record.id), positiveDelay(delayMs));
+  }
+
+  clearReconnect(record: PendingCallRecord): void {
+    if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
+    record.reconnectTimeout = undefined;
+  }
+
+  clear(record: PendingCallRecord): void {
+    if (record.timeout) this.scheduler.clearTimeout(record.timeout);
+    if (record.reconnectTimeout) this.scheduler.clearTimeout(record.reconnectTimeout);
+  }
+}
+
+function positiveDelay(value: unknown): number {
+  return Math.max(1, Math.floor(Number(value) || 1));
+}

package/src/worker/pending-calls.ts

@@ -1,4 +1,5 @@
 import type { PendingCallRecord, RegisterPendingCall } from "./pending-call-contract.ts";
+import { PendingCallDeadlines, type PendingCallDeadlineOptions } from "./pending-call-deadlines.ts";
 
 export class PendingCallRegistrationError extends Error {
   readonly code: "conflict" | "limit_exceeded";
@@ -16,11 +17,12 @@ export class PendingCallRegistry {
   private readonly maximum: number;
   private readonly byId = new Map<string, PendingCallRecord>();
   private readonly byRequestKey = new Map<string, string>();
+  private readonly deadlines: PendingCallDeadlines;
 
-  constructor(maximum: number) {
+  constructor(maximum: number, options: PendingCallDeadlineOptions = {}) {
     this.maximum = maximum;
+    this.deadlines = new PendingCallDeadlines(options);
   }
-
   get size(): number {
     return this.byId.size;
   }
@@ -35,16 +37,9 @@ export class PendingCallRegistry {
     if (input.clientRequestKey && this.byRequestKey.has(input.clientRequestKey)) {
       throw new PendingCallRegistrationError("conflict", "duplicate in-flight JSON-RPC request id within this MCP session");
     }
-    const startedAt = performance.now();
+    const startedAt = this.deadlines.now();
+    const timeoutMs = Math.max(1, Math.floor(Number(input.timeoutMs) || 1));
     return new Promise((resolve, reject) => {
-      const timeout = setTimeout(() => {
-        const record = this.take(input.id);
-        if (!record) return;
-        let error: unknown;
-        try { error = input.onTimeout(record); }
-        catch { error = new Error("pending daemon call timed out"); }
-        reject(error instanceof Error ? error : new Error("pending daemon call timed out"));
-      }, input.timeoutMs);
       const abortHandler = () => {
         const record = this.take(input.id);
         if (!record) return;
@@ -60,7 +55,9 @@ export class PendingCallRegistry {
         clientRequestKey: input.clientRequestKey,
         tool: String(input.tool || "unknown"),
         startedAt,
-        timeout,
+        deadlineAt: startedAt + timeoutMs,
+        remainingTimeoutMs: timeoutMs,
+        onTimeout: input.onTimeout,
         resolve,
         reject,
         signal: input.signal,
@@ -68,6 +65,7 @@ export class PendingCallRegistry {
       };
       this.byId.set(input.id, record);
       if (input.clientRequestKey) this.byRequestKey.set(input.clientRequestKey, input.id);
+      this.deadlines.armOperation(record, timeoutMs, (id) => this.expireOperation(id));
       if (input.signal?.aborted) abortHandler();
       else input.signal?.addEventListener("abort", abortHandler, { once: true });
     });
@@ -114,13 +112,13 @@ export class PendingCallRegistry {
     const delay = Math.max(1, Math.floor(Number(graceMs) || 1));
     for (const record of records) {
       record.socket = undefined;
-      if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
-      record.reconnectTimeout = setTimeout(() => {
-        const current = this.byId.get(record.id);
+      this.deadlines.pauseOperation(record);
+      this.deadlines.armReconnect(record, delay, (id) => {
+        const current = this.byId.get(id);
         if (!current || current.socket) return;
-        const expired = this.take(record.id);
+        const expired = this.take(id);
         if (expired) expired.reject(createError(expired));
-      }, delay);
+      });
     }
     return records.length;
   }
@@ -130,16 +128,16 @@ export class PendingCallRegistry {
     const rebound: string[] = [];
     for (const record of this.byId.values()) {
       if (record.socket || record.daemonInstanceId !== daemonInstanceId) continue;
-      if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
-      record.reconnectTimeout = undefined;
+      this.deadlines.clearReconnect(record);
       record.socket = socket;
+      this.deadlines.armOperation(record, record.remainingTimeoutMs, (id) => this.expireOperation(id));
       rebound.push(record.id);
     }
     return rebound;
   }
 
   snapshot(): { active: number; detached: number; request_keys: number; maximum: number; oldest_ms: number; by_tool: Record<string, number> } {
-    const now = performance.now();
+    const now = this.deadlines.now();
     const byTool: Record<string, number> = {};
     let detached = 0;
     let oldestMs = 0;
@@ -158,11 +156,19 @@ export class PendingCallRegistry {
     };
   }
 
+  private expireOperation(id: string): void {
+    const record = this.take(id);
+    if (!record) return;
+    let error: unknown;
+    try { error = record.onTimeout(record); }
+    catch { error = new Error("pending daemon call timed out"); }
+    record.reject(error instanceof Error ? error : new Error("pending daemon call timed out"));
+  }
+
   private take(id: string): PendingCallRecord | undefined {
     const record = this.byId.get(id);
     if (!record) return undefined;
-    clearTimeout(record.timeout);
-    if (record.reconnectTimeout) clearTimeout(record.reconnectTimeout);
+    this.deadlines.clear(record);
     if (record.signal && record.abortHandler) record.signal.removeEventListener("abort", record.abortHandler);
     this.byId.delete(id);
     if (record.clientRequestKey && this.byRequestKey.get(record.clientRequestKey) === id) {

package/src/worker/tool-timeout.ts

@@ -1,3 +1,5 @@
+import relayContract from "../shared/relay-contract.json" with { type: "json" };
+
 export function daemonToolTimeoutMs(name: string, args: Record<string, unknown>): number {
   if (name === "session_bootstrap") return 10_000;
   const configurable = new Set([
@@ -8,7 +10,8 @@ export function daemonToolTimeoutMs(name: string, args: Record<string, unknown>)
   ]);
   if (!configurable.has(name)) return 60_000;
   const seconds = clampNumber(args.timeout_seconds, name === "browser_fill_form" ? 60 : 120, 1, 600);
-  return Math.min((seconds + 5) * 1000, 610_000);
+  const executionMs = Math.min(seconds * 1000, relayContract.maximumExecutionTimeoutMs);
+  return Math.min(executionMs + relayContract.toolCallOverheadMs, relayContract.maximumRelayToolTimeoutMs);
 }
 
 function clampNumber(value: unknown, fallback: number, min: number, max: number): number {