machine-bridge-mcp 3.0.0-beta.17 → 3.0.0-beta.21

package/src/worker/index.ts

@@ -2,6 +2,8 @@ import { DurableObject } from "cloudflare:workers";
 import serverMetadata from "../shared/server-metadata.json" with { type: "json" };
 import relayContract from "../shared/relay-contract.json" with { type: "json" };
 import { PendingCallRegistrationError, PendingCallRegistry } from "./pending-calls.ts";
+import { PendingAdmissionGate } from "./pending-admission.ts";
+import type { PendingCallOutcome } from "./pending-call-contract.ts";
 import {
   DAEMON_LIVENESS_TIMEOUT_MS,
   DAEMON_READY_TIMEOUT_MS,
@@ -18,11 +20,12 @@ import { authorizeMcpRequest } from "./mcp-access.ts";
 import { handleMcpResumptionRequest } from "./mcp-resumption-http.ts";
 import {
   handleMcpStreamSubscribeRequest, mcpStreamDescriptorResponse, mcpStreamProxyMode,
-  proxyMcpEventStream, sanitizeBridgeRequest,
 } from "./mcp-stream-proxy.ts";
 import { McpResumptionStore, McpStreamLimitError } from "./mcp-resumption.ts";
 import { McpStreamChannel } from "./mcp-stream-channel.ts";
 import { buildServerInfoResult, persistImmediateStreamOutcome, startEventDrivenStreamCall } from "./mcp-stream-dispatch.ts";
+import { DurableStreamCallCoordinator } from "./durable-stream-calls.ts";
+import { handleOuterWorkerFetch } from "./worker-entry.ts";
 import { daemonToolTimeoutMs } from "./tool-timeout.ts";
 import { WorkerObservability } from "./observability.ts";
 import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./errors.ts";
@@ -31,24 +34,23 @@ import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from ".
 import { OAuthController, type AuthorizedToken, type OAuthControllerEnv } from "./oauth-controller.ts";
 import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority.ts";
 import { serverInfoTool, workspaceTools } from "./tool-catalog.ts";
-import { OFFLINE_ACCESS_SCOPE, randomToken } from "./oauth-state.ts";
+import { randomToken } from "./oauth-state.ts";
 import {
   HttpError, applyCors, baseUrl, corsPreflight, json, methodNotAllowed,
   parseJsonRequest, workerErrorClass,
 } from "./http.ts";
-import {
-  durableObjectQuotaResponse, isDurableObjectQuotaError, respondWithoutDurableObject,
-} from "./worker-static-routes.ts";
+import { authorizationServerMetadata } from "./worker-metadata.ts";
 import {
   asObject, isJsonRpcRequest, isJsonRpcResponse, requiredString, rpcError, rpcResult,
   sessionInstructionText, textToolResult, validateProtocolVersionHeader, type JsonRpcRequest,
 } from "./mcp-jsonrpc.ts";
 import {
-  closeWebSocketQuietly, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket,
+  closeWebSocketQuietly, daemonErrorCloseCode, isObjectRecord, rejectDaemonMessage,
+  sendWebSocketQuietly, trySendWebSocket,
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.17";
+const SERVER_VERSION = "3.0.0-beta.21";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -63,6 +65,7 @@ interface BridgeEnv extends OAuthControllerEnv {
   OAUTH_TOKEN_VERSION: string;
   MBM_WORKER_MAX_BODY_BYTES?: string;
   MBM_ALLOWED_ORIGINS?: string;
+  STATEFUL_RATE_LIMITER: RateLimit;
 }
 
 const MCP_INSTRUCTIONS = serverMetadata.instructions.map((value) => String(value)).join("\n");
@@ -74,17 +77,34 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   private readonly daemonRegistry: DaemonSocketRegistry;
   private readonly streamChannel: McpStreamChannel;
   private readonly resumption: McpResumptionStore;
+  private readonly durableCalls: DurableStreamCallCoordinator;
+  private readonly pendingAdmission = new PendingAdmissionGate();
 
   constructor(ctx: DurableObjectState, env: BridgeEnv) {
     super(ctx, env);
-    this.oauth = new OAuthController(ctx, env, SERVER_NAME, SERVER_VERSION);
+    this.oauth = new OAuthController(
+      ctx, env, SERVER_NAME, SERVER_VERSION,
+      (event) => this.observability.oauthRefreshEvent(event),
+    );
     this.daemonRegistry = new DaemonSocketRegistry(ctx);
     this.streamChannel = new McpStreamChannel(ctx, this.observability);
-    this.resumption = new McpResumptionStore(ctx.storage, {}, (streamId, message) => this.streamChannel.publish(streamId, message));
+    this.resumption = new McpResumptionStore(
+      ctx.storage,
+      {},
+      (streamId, message) => this.streamChannel.publish(streamId, message),
+      (rows) => this.observability.streamStorageRowsWritten(rows),
+    );
+    this.durableCalls = new DurableStreamCallCoordinator(
+      this.resumption.calls,
+      this.daemonRegistry,
+      this.observability,
+      MAX_PENDING_CALLS,
+      (socket, message, closeReason, errorCode) => this.invalidateDaemonSocket(socket, message, closeReason, errorCode),
+    );
   }
 
   async fetch(request: Request): Promise<Response> {
-    await this.pending.expireDue();
+    await this.expireOverdueCalls();
     const base = baseUrl(request);
     const extraOrigins = this.env.MBM_ALLOWED_ORIGINS ?? "";
     let response: Response;
@@ -97,31 +117,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   private async handleRequest(request: Request, base: string): Promise<Response> {
     const url = new URL(request.url);
     try {
-      if (url.pathname === "/") {
-        if (request.method !== "GET") return methodNotAllowed("GET");
-        return json({ ok: true, server: SERVER_NAME, version: SERVER_VERSION, mcp: `${base}/mcp` });
-      }
-      if (url.pathname === "/healthz") {
-        if (request.method !== "GET") return methodNotAllowed("GET");
-        return json({ ok: true, server: SERVER_NAME, version: SERVER_VERSION });
-      }
-      if (url.pathname === "/.well-known/mcp.json") {
-        if (request.method !== "GET") return methodNotAllowed("GET");
-        return json(this.mcpMetadata(base));
-      }
-      if (
-        url.pathname === "/.well-known/oauth-authorization-server" ||
-        url.pathname === "/.well-known/oauth-authorization-server/mcp" ||
-        url.pathname === "/.well-known/openid-configuration" ||
-        url.pathname === "/.well-known/openid-configuration/mcp"
-      ) {
-        if (request.method !== "GET") return methodNotAllowed("GET");
-        return json(this.authorizationServerMetadata(base));
-      }
-      if (url.pathname === "/.well-known/oauth-protected-resource" || url.pathname === "/.well-known/oauth-protected-resource/mcp") {
-        if (request.method !== "GET") return methodNotAllowed("GET");
-        return json(this.protectedResourceMetadata(base));
-      }
       if (url.pathname === "/admin/accounts") return await this.oauth.handleAccountAdmin(request, "accounts");
       if (url.pathname === "/admin/accounts/rotate-password") return await this.oauth.handleAccountAdmin(request, "rotate-password");
       if (url.pathname === "/admin/clients") return await this.oauth.handleClientAdmin(request);
@@ -152,7 +147,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
-    await this.pending.expireDue();
+    await this.expireOverdueCalls();
     if (this.streamChannel.isSubscriber(ws)) {
       this.streamChannel.rejectSubscriberMessage(ws);
       return;
@@ -242,10 +237,16 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const daemonPolicy = sanitizeDaemonPolicy(body.policy);
       const authenticatedAt = new Date().toISOString();
       const probeId = randomToken("probe");
+      const connectionId = socketAttachment.connectionId ?? "";
+      if (!connectionId) {
+        rejectDaemonMessage(ws, "missing_daemon_connection_identity", 1008, "daemon connection identity missing");
+        return;
+      }
       this.daemonRegistry.beginProbe(ws, {
         connectedAt: authenticatedAt,
         probeId,
         instanceId,
+        connectionId,
         policy: daemonPolicy,
         tools: sanitizeDaemonTools(body.tools, daemonPolicy),
       });
@@ -288,9 +289,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         return;
       }
       const daemonInstanceId = readyAttachment.instanceId ?? "";
+      const connectionId = readyAttachment.connectionId ?? "";
+      if (!daemonInstanceId || !connectionId) {
+        await this.invalidateDaemonSocket(ws, "daemon readiness identity is incomplete", "daemon ready timeout", "daemon_ready_timeout");
+        return;
+      }
       const previousSockets = this.daemonRegistry.readyRoleSockets().filter((socket) => socket !== ws);
       const fallbackSocket = previousSockets.find((socket) => this.daemonRegistry.readyAttachment(socket)?.instanceId === daemonInstanceId);
-      const reboundCallIds = this.pending.rebindInstance(daemonInstanceId, ws);
+      const reboundCallIds = [
+        ...this.pending.rebindInstance(daemonInstanceId, ws),
+        ...await this.durableCalls.rebind(daemonInstanceId, connectionId),
+      ];
       if (reboundCallIds.length > 0) {
         this.observability.event("info", "daemon.calls.rebound", { rebound_calls: reboundCallIds.length });
       }
@@ -299,7 +308,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         ws.send(JSON.stringify({ type: "ready_ack", server: SERVER_NAME, version: SERVER_VERSION }));
       } catch {
         await this.invalidateDaemonSocket(ws, "daemon readiness acknowledgement failed", "daemon ready timeout", "daemon_ready_timeout");
-        if (fallbackSocket?.readyState === WebSocket.OPEN) this.pending.rebindInstance(daemonInstanceId, fallbackSocket);
+        if (fallbackSocket?.readyState === WebSocket.OPEN) {
+          this.pending.rebindInstance(daemonInstanceId, fallbackSocket);
+          const fallbackConnectionId = this.daemonRegistry.readyAttachment(fallbackSocket)?.connectionId ?? "";
+          if (fallbackConnectionId) await this.durableCalls.rebind(daemonInstanceId, fallbackConnectionId);
+        }
         await this.scheduleRuntimeAlarm();
         return;
       }
@@ -324,10 +337,17 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
 
     await this.touchDaemonSocket(ws);
-    const matched = body.ok === false
-      ? await this.pending.reject(body.id, daemonToolError(body.error), ws)
-      : await this.pending.resolve(body.id, ws, body.result);
+    const outcome: PendingCallOutcome = body.ok === false
+      ? { ok: false, error: daemonToolError(body.error) }
+      : { ok: true, value: body.result };
+    let matched = outcome.ok
+      ? await this.pending.resolve(body.id, ws, outcome.value)
+      : await this.pending.reject(body.id, outcome.error, ws);
+    if (!matched && socketAttachment.connectionId) {
+      matched = await this.durableCalls.settle(body.id, socketAttachment.connectionId, outcome);
+    }
     if (!matched) this.observability.unmatchedResult();
+    else await this.scheduleRuntimeAlarm();
   }
 
   async webSocketClose(ws: WebSocket): Promise<void> {
@@ -390,20 +410,21 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     if (body.method === "tools/call" && acceptsEventStream(request)) {
       if (proxyMode !== "prepare") return json(rpcError(body.id, -32603, "MCP stream proxy is unavailable"), 500);
       if (body.id === undefined || body.id === null) return json(rpcError(null, -32600, "tools/call requires a non-null request id"), 400);
+      const requestId = body.id;
       const streamId = randomToken("stream");
       try {
         await this.resumption.begin({
           streamId,
           tokenKey: access.authorized.tokenKey,
           sessionId,
-          requestId: body.id,
+          requestId,
         });
       } catch (error) {
         if (error instanceof McpStreamLimitError) {
-          return json(rpcError(body.id, -32004, error.message), 429);
+          return json(rpcError(requestId, -32004, error.message), 429);
         }
         this.observability.event("error", "mcp.stream.begin.failed", { error_class: workerErrorClass(error) });
-        return json(rpcError(body.id, -32603, "Resumable stream storage is unavailable"), 503);
+        return json(rpcError(requestId, -32603, "Resumable stream storage is unavailable"), 503);
       }
 
       const params = asObject(body.params);
@@ -412,38 +433,40 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       try {
         if (name === "server_info") {
           await persistImmediateStreamOutcome({
-            resumption: this.resumption, observability: this.observability, streamId, requestId: body.id,
-            outcome: { ok: true, value: this.serverInfoResult(base, access.authorized) },
+            resumption: this.resumption, observability: this.observability, streamId, requestId,
+            outcome: { ok: true, value: await this.serverInfoResult(base, access.authorized) },
           });
         } else {
           if (!workspaceTools.some((tool) => tool.name === name)) throw new Error(`unknown tool: ${name}`);
-          if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
           if (!accountRoleAllowsTool(access.authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
           this.reclaimStaleDaemonSockets();
           const socket = this.daemonRegistry.readySockets()[0];
           if (!socket) throw new WorkerToolError("unavailable", "local daemon is not connected; keep the CLI start command running", true);
-          const daemonInstanceId = this.daemonRegistry.readyAttachment(socket)?.instanceId ?? "";
-          if (!daemonInstanceId) throw new WorkerToolError("unavailable", "local daemon connection is missing its instance identity", true);
-          await startEventDrivenStreamCall({
-            pending: this.pending, resumption: this.resumption, observability: this.observability,
-            streamId, requestId: body.id, clientRequestKey: mcpClientRequestKey(access.authorized.tokenKey, sessionId, body.id),
-            tool: name, arguments: args, socket, daemonInstanceId, timeoutMs: daemonToolTimeoutMs(name, args),
+          const attachment = this.daemonRegistry.readyAttachment(socket);
+          const daemonInstanceId = attachment?.instanceId ?? "";
+          const connectionId = attachment?.connectionId ?? "";
+          if (!daemonInstanceId || !connectionId) throw new WorkerToolError("unavailable", "local daemon connection is missing its relay identity", true);
+          if (!attachment?.tools?.includes(name)) throw new WorkerToolError("authorization_denied", `tool disabled by local daemon policy: ${name}`);
+          await this.pendingAdmission.run(() => startEventDrivenStreamCall({
+            resumption: this.resumption, observability: this.observability,
+            streamId, requestId, clientRequestKey: mcpClientRequestKey(access.authorized.tokenKey, sessionId, requestId),
+            tool: name, arguments: args, socket, daemonInstanceId, connectionId, timeoutMs: daemonToolTimeoutMs(name, args),
+            transientActiveCount: this.pending.size, maximumPendingCalls: MAX_PENDING_CALLS,
             authorization: {
               account_id: access.authorized.accountId, account_version: access.authorized.accountVersion,
               client_id: access.authorized.clientId, family_id: access.authorized.familyId, role: access.authorized.role,
             },
-            onTimeout: (record) => this.daemonCallTimeout(record, name),
+            transform: name === "project_overview" ? {
+              kind: "project_overview", account_id: access.authorized.accountId,
+              account_version: access.authorized.accountVersion, role: access.authorized.role,
+            } : undefined,
             onSendFailure: () => this.invalidateDaemonSocket(socket, "failed to send daemon tool call", "daemon send failed"),
-            transformResult: name === "project_overview"
-              ? (value) => decorateProjectOverview(value, { accountId: access.authorized.accountId,
-                accountVersion: access.authorized.accountVersion, role: access.authorized.role })
-              : undefined,
-          });
+          }));
           await this.scheduleRuntimeAlarm();
         }
       } catch (error) {
         await persistImmediateStreamOutcome({
-          resumption: this.resumption, observability: this.observability, streamId, requestId: body.id,
+          resumption: this.resumption, observability: this.observability, streamId, requestId,
           outcome: { ok: false, error: error instanceof Error ? error : new Error("streamed tool call failed") },
         });
       }
@@ -466,9 +489,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       const protocolVersion = typeof requested === "string" && MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(requested as typeof MCP_SUPPORTED_PROTOCOL_VERSIONS[number])
         ? requested
         : MCP_PROTOCOL_VERSION;
-      const bootstrap = this.daemonToolEnabled("session_bootstrap")
-        ? await this.callDaemonTool("session_bootstrap", { path: "." }, authorized).catch(() => null)
-        : null;
+      let bootstrap = null;
+      if (this.daemonToolEnabled("session_bootstrap")) {
+        try {
+          bootstrap = await this.callDaemonTool("session_bootstrap", { path: "." }, authorized);
+        } catch {
+          // Initialization remains usable without optional local instructions, but the degradation is observable.
+          this.observability.recordError("session_bootstrap_failed");
+        }
+      }
       const localInstructions = sessionInstructionText(bootstrap);
       return rpcResult(request.id, {
         protocolVersion,
@@ -510,12 +539,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     }
     return rpcError(request.id, -32601, `Method not found: ${request.method}`);
   }
-  private serverInfoResult(base: string, authorized: AuthorizedToken): Record<string, unknown> {
-    const { daemon, tools, authorization } = this.authorityContext(authorized);
+  private async serverInfoResult(base: string, authorized: AuthorizedToken): Promise<Record<string, unknown>> {
+    const { daemon, effectiveTools, advertisedTools, authorization } = this.authorityContext(authorized);
     return buildServerInfoResult({
       serverName: SERVER_NAME, serverVersion: SERVER_VERSION, base,
-      oauth: this.authorizationServerMetadata(base), authorization, daemon, tools,
-      pending: this.pending, daemonRegistry: this.daemonRegistry, observability: this.observability,
+      oauth: authorizationServerMetadata(base, SERVER_NAME), authorization, daemon,
+      effectiveTools, advertisedTools, pendingSnapshot: await this.durableCalls.snapshot(this.pending.snapshot()),
+      daemonRegistry: this.daemonRegistry, observability: this.observability,
     });
   }
   private async callTool(
@@ -527,7 +557,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   ): Promise<unknown> {
     if (name === "server_info") return this.serverInfoResult(base, authorized);
     if (workspaceTools.some((tool) => tool.name === name)) {
-      if (!this.daemonToolEnabled(name)) throw new Error(`tool disabled by local daemon policy: ${name}`);
       if (!accountRoleAllowsTool(authorized.role, name)) throw new WorkerToolError("authorization_denied", "tool is not allowed for this account role");
       const result = await this.callDaemonTool(name, args, authorized, requestKey);
       return name === "project_overview" ? decorateProjectOverview(result, { accountId: authorized.accountId,
@@ -547,18 +576,25 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const daemonAttachment = this.daemonRegistry.readyAttachment(socket);
     const daemonInstanceId = daemonAttachment?.instanceId ?? "";
     if (!daemonInstanceId) throw new WorkerToolError("unavailable", "local daemon connection is missing its instance identity", true);
+    if (!daemonAttachment?.tools?.includes(name)) throw new WorkerToolError("authorization_denied", `tool disabled by local daemon policy: ${name}`);
     const id = randomToken("call");
     const timeoutMs = daemonToolTimeoutMs(name, args);
-    let result: Promise<unknown>;
+    let result!: Promise<unknown>;
     try {
-      result = this.pending.register({
-        id,
-        socket,
-        daemonInstanceId,
-        clientRequestKey: requestKey,
-        tool: name,
-        timeoutMs,
-        onTimeout: (record) => this.daemonCallTimeout(record, name),
+      await this.pendingAdmission.run(async () => {
+        const durableActive = await this.resumption.calls.activeCount();
+        if (this.pending.size + durableActive >= MAX_PENDING_CALLS) {
+          throw new WorkerToolError("limit_exceeded", "too many concurrent daemon tool calls", true);
+        }
+        result = this.pending.register({
+          id,
+          socket,
+          daemonInstanceId,
+          clientRequestKey: requestKey,
+          tool: name,
+          timeoutMs,
+          onTimeout: (record) => this.daemonCallTimeout(record, name),
+        });
       });
     } catch (error) {
       if (error instanceof PendingCallRegistrationError) {
@@ -603,10 +639,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async cancelClientRequest(requestKey?: string): Promise<void> {
     if (!requestKey) return;
-    await this.pending.cancelRequest(requestKey, (record) => {
+    const cancelledTransient = await this.pending.cancelRequest(requestKey, (record) => {
       if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
       return new WorkerToolError("cancelled", "tool call cancelled by client");
     });
+    if (cancelledTransient) {
+      await this.scheduleRuntimeAlarm();
+      return;
+    }
+    if (await this.durableCalls.cancel(requestKey)) await this.scheduleRuntimeAlarm();
   }
   private async acceptDaemonWebSocket(request: Request): Promise<Response> {
     if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return new Response("Expected Upgrade: websocket", { status: 426 });
@@ -632,7 +673,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const [client, server] = Object.values(pair) as [WebSocket, WebSocket];
     this.ctx.acceptWebSocket(server);
     this.observability.socketCandidate();
-    this.daemonRegistry.beginCandidate(server, challenge, preflight);
+    this.daemonRegistry.beginCandidate(server, challenge, preflight, randomToken("connection"));
     await this.scheduleRuntimeAlarm();
     const welcomed = trySendWebSocket(server, {
       type: "welcome",
@@ -655,16 +696,20 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
 
   private allTools(role: AccountRole): Array<Record<string, unknown>> {
-    const advertised = accountRoleToolNames(role, this.daemonAdvertisedTools());
+    const advertised = accountRoleToolNames(role, workspaceTools.map((tool) => tool.name));
     const localTools = workspaceTools.filter((tool) => advertised.has(tool.name));
     return [serverInfoTool, ...localTools].map((tool) => structuredClone(tool));
   }
+  private effectiveToolNames(role: AccountRole): string[] {
+    return ["server_info", ...accountRoleToolNames(role, this.daemonAdvertisedTools())];
+  }
   private authorityContext(authorized: AuthorizedToken) {
     const daemon = describeDaemonCeiling(this.daemonStatus(true));
-    const tools = this.allTools(authorized.role).map((tool) => String(tool.name));
+    const advertisedTools = this.allTools(authorized.role).map((tool) => String(tool.name));
+    const effectiveTools = this.effectiveToolNames(authorized.role);
     const authorization = accountAuthoritySnapshot({ accountId: authorized.accountId, accountVersion: authorized.accountVersion,
-      role: authorized.role, daemonPolicy: daemon.policy, effectiveTools: tools });
-    return { daemon, tools, authorization };
+      role: authorized.role, daemonPolicy: daemon.policy, effectiveTools });
+    return { daemon, effectiveTools, advertisedTools, authorization };
   }
   private daemonToolEnabled(name: string): boolean {
     return this.daemonAdvertisedTools().has(name);
@@ -692,20 +737,22 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const cleanup = this.detachDaemonSocketCalls(ws, message);
     this.daemonRegistry.expire(ws);
     sendWebSocketQuietly(ws, { type: "error", error: errorCode });
-    closeWebSocketQuietly(ws, 1008, closeReason);
+    closeWebSocketQuietly(ws, daemonErrorCloseCode(errorCode), closeReason);
     await cleanup;
   }
 
   private async detachDaemonSocketCalls(ws: WebSocket, message: string): Promise<number> {
     const attachment = this.daemonRegistry.attachment(ws);
-    if (!attachment?.instanceId) {
+    if (!attachment?.instanceId || !attachment.connectionId) {
       return await this.pending.rejectSocket(ws, () => new WorkerToolError("unavailable", message, true));
     }
-    return this.pending.detachSocket(
+    const transient = this.pending.detachSocket(
       ws,
       DAEMON_RECONNECT_GRACE_MS,
       () => new WorkerToolError("unavailable", `${message}; reconnect grace expired`, true),
     );
+    const durable = await this.durableCalls.detach(attachment.connectionId, DAEMON_RECONNECT_GRACE_MS);
+    return transient + durable;
   }
 
   private reclaimStaleDaemonSockets(now = Date.now()): void {
@@ -720,6 +767,11 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     await processRuntimeAlarm(this.runtimeAlarmContext());
   }
 
+  private async expireOverdueCalls(): Promise<void> {
+    await this.pending.expireDue();
+    await this.durableCalls.expireDue();
+  }
+
   private async scheduleRuntimeAlarm(): Promise<void> {
     await scheduleRuntimeAlarm(this.runtimeAlarmContext());
   }
@@ -728,12 +780,15 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     return {
       storage: this.ctx.storage,
       pending: this.pending,
+      durableCalls: this.resumption.calls,
+      expireDurableCall: (call: import("./mcp-pending-call-store.ts").PendingStreamCallView) => this.durableCalls.expire(call),
       daemonRegistry: this.daemonRegistry,
       invalidateDaemonSocket: (socket: WebSocket, message: string, closeReason: string, errorCode?: string) =>
         this.invalidateDaemonSocket(socket, message, closeReason, errorCode),
       onScheduleError: (error: unknown) => this.observability.event(
         "error", "runtime.alarm.schedule.failed", { error_class: workerErrorClass(error) },
       ),
+      onAlarmMutation: (action: "set" | "delete" | "noop") => this.observability.runtimeAlarmMutation(action),
     };
   }
 
@@ -760,42 +815,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     };
   }
 
-  private mcpMetadata(base: string): Record<string, unknown> {
-    return {
-      name: SERVER_NAME,
-      version: SERVER_VERSION,
-      protocolVersion: MCP_PROTOCOL_VERSION,
-      protocolVersions: [...MCP_SUPPORTED_PROTOCOL_VERSIONS],
-      transport: { type: "streamable-http", url: `${base}/mcp` },
-      auth: { type: "oauth", authorization_servers: [base] },
-    };
-  }
-
-  private authorizationServerMetadata(base: string): Record<string, unknown> {
-    return {
-      issuer: base,
-      authorization_endpoint: `${base}/oauth/authorize`,
-      token_endpoint: `${base}/oauth/token`,
-      registration_endpoint: `${base}/oauth/register`,
-      response_types_supported: ["code"],
-      grant_types_supported: ["authorization_code", "refresh_token"],
-      token_endpoint_auth_methods_supported: ["none"],
-      dpop_signing_alg_values_supported: ["ES256"],
-      code_challenge_methods_supported: ["S256"],
-      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
-    };
-  }
-
-  private protectedResourceMetadata(base: string): Record<string, unknown> {
-    return {
-      resource: `${base}/mcp`,
-      authorization_servers: [base],
-      scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
-      bearer_methods_supported: ["header"],
-      resource_name: SERVER_NAME,
-    };
-  }
-
   private bodyLimitBytes(): number {
     const parsed = Number.parseInt(this.env.MBM_WORKER_MAX_BODY_BYTES ?? "", 10);
     if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_BODY_BYTES;
@@ -804,30 +823,8 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 }
 
 export default {
-  async fetch(request: Request, env: BridgeEnv, ctx: ExecutionContext): Promise<Response> {
-    const extraOrigins = env.MBM_ALLOWED_ORIGINS ?? "";
-    const staticResponse = respondWithoutDurableObject(
-      request,
-      { server: SERVER_NAME, version: SERVER_VERSION },
-      extraOrigins,
-    );
-    if (staticResponse) return staticResponse;
-
-    try {
-      const stub = env.BRIDGE.getByName("default");
-      const streamed = await proxyMcpEventStream({
-        request,
-        bridge: stub,
-        extraOrigins,
-        ctx,
-      });
-      return streamed ?? stub.fetch(sanitizeBridgeRequest(request));
-    } catch (error) {
-      // Free-tier DO request exhaustion must not look like an opaque Worker crash.
-      if (isDurableObjectQuotaError(error)) return durableObjectQuotaResponse(request, extraOrigins);
-      throw error;
-    }
-  },
+  fetch: (request: Request, env: BridgeEnv, ctx: ExecutionContext) =>
+    handleOuterWorkerFetch(request, env, ctx, { server: SERVER_NAME, version: SERVER_VERSION }),
 } satisfies ExportedHandler<BridgeEnv>;
 
 function daemonInstanceId(value: unknown): string {

package/src/worker/mcp-pending-call-expiry.ts

@@ -0,0 +1,20 @@
+export function positiveDelay(value: unknown): number {
+  return Math.max(1, Math.floor(Number(value) || 1));
+}
+
+export function extendAttachedCallExpiry(
+  currentExpiry: number,
+  operationDeadline: number,
+  terminalRetentionMs: number,
+): number {
+  return Math.max(currentExpiry, operationDeadline + terminalRetentionMs);
+}
+
+export function extendDetachedCallExpiry(
+  currentExpiry: number,
+  reconnectDeadline: number,
+  remainingOperationMs: number,
+  terminalRetentionMs: number,
+): number {
+  return Math.max(currentExpiry, reconnectDeadline + remainingOperationMs + terminalRetentionMs);
+}

package/src/worker/mcp-pending-call-inspection.ts

@@ -0,0 +1,33 @@
+import type { StreamIndexEntry } from "./mcp-resumption-records.ts";
+
+export type PendingStreamCallSnapshot = {
+  active: number;
+  detached: number;
+  request_keys: number;
+  maximum: number;
+  oldest_ms: number;
+  by_tool: Record<string, number>;
+};
+
+export function activePendingCallCount(entries: StreamIndexEntry[]): number {
+  return entries.filter((entry) => entry.call).length;
+}
+
+export function pendingCallSnapshot(
+  entries: StreamIndexEntry[],
+  now: number,
+  maximum: number,
+): PendingStreamCallSnapshot {
+  const calls = entries.flatMap((entry) => entry.call ? [entry.call] : []);
+  const byTool = Object.create(null) as Record<string, number>;
+  let detached = 0;
+  let oldestMs = 0;
+  let requestKeys = 0;
+  for (const call of calls) {
+    byTool[call.tool] = (byTool[call.tool] ?? 0) + 1;
+    detached += Number(call.state === "detached");
+    requestKeys += Number(Boolean(call.client_request_key));
+    oldestMs = Math.max(oldestMs, now - call.started_at);
+  }
+  return { active: calls.length, detached, request_keys: requestKeys, maximum, oldest_ms: oldestMs, by_tool: byTool };
+}

package/src/worker/mcp-pending-call-records.ts

@@ -0,0 +1,58 @@
+export type PendingStreamTransform = {
+  kind: "project_overview";
+  account_id: string;
+  account_version: number;
+  role: "owner" | "operator" | "editor" | "reviewer";
+};
+
+export type PendingStreamCall = {
+  call_id: string;
+  daemon_instance_id: string;
+  connection_id: string;
+  client_request_key?: string;
+  tool: string;
+  state: "attached" | "detached";
+  started_at: number;
+  operation_deadline_at: number;
+  remaining_timeout_ms: number;
+  reconnect_deadline_at?: number;
+  transform?: PendingStreamTransform;
+};
+
+const CALL_ID_PATTERN = /^call_[A-Za-z0-9_-]{43}$/;
+const CONNECTION_ID_PATTERN = /^connection_[A-Za-z0-9_-]{43}$/;
+const DAEMON_INSTANCE_PATTERN = /^daemon_[A-Za-z0-9_-]{16,96}$/;
+
+export function validPendingStreamCall(value: unknown): value is PendingStreamCall {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const call = value as Partial<PendingStreamCall>;
+  const transform = call.transform;
+  const validTransform = transform === undefined || (
+    transform.kind === "project_overview"
+    && typeof transform.account_id === "string"
+    && transform.account_id.length > 0
+    && transform.account_id.length <= 160
+    && Number.isSafeInteger(transform.account_version)
+    && transform.account_version! >= 1
+    && ["owner", "operator", "editor", "reviewer"].includes(String(transform.role))
+  );
+  return typeof call.call_id === "string" && CALL_ID_PATTERN.test(call.call_id)
+    && typeof call.daemon_instance_id === "string" && DAEMON_INSTANCE_PATTERN.test(call.daemon_instance_id)
+    && typeof call.connection_id === "string" && CONNECTION_ID_PATTERN.test(call.connection_id)
+    && (call.client_request_key === undefined || (
+      typeof call.client_request_key === "string"
+      && call.client_request_key.length > 0
+      && call.client_request_key.length <= 1024
+    ))
+    && typeof call.tool === "string" && call.tool.length > 0 && call.tool.length <= 128
+    && (call.state === "attached" || call.state === "detached")
+    && Number.isSafeInteger(call.started_at) && call.started_at! >= 0
+    && Number.isSafeInteger(call.operation_deadline_at) && call.operation_deadline_at! > call.started_at!
+    && Number.isSafeInteger(call.remaining_timeout_ms) && call.remaining_timeout_ms! >= 1
+    && (call.reconnect_deadline_at === undefined || (
+      Number.isSafeInteger(call.reconnect_deadline_at)
+      && call.reconnect_deadline_at! >= call.started_at!
+    ))
+    && (call.state === "attached" ? call.reconnect_deadline_at === undefined : call.reconnect_deadline_at !== undefined)
+    && validTransform;
+}