machine-bridge-mcp 3.0.0-beta.185 → 3.0.0-beta.191

package/CHANGELOG.md

@@ -1,11 +1,10 @@
 # Changelog
 
-## 3.0.0-beta.185 - 2026-09-11
+## 3.0.0-beta.191 - 2026-09-15
 
-- Preserve interrupted workspace-profile migration after a source-profile rename when Windows exposes the same state root through a different long/short or junction-equivalent path: relocated historical proof canonicalizes only the nearest existing ancestor, still requires the exact historical profile hash plus `state.json` suffix, and rejects a different canonical ancestor.
-- Normalize Windows native-path identity during workspace migration so active locks and relocated historical profile state remain comparable across ordinary drive paths and native namespace-prefixed forms without weakening containment checks.
-- Keep hosted validation compatible with CodeQL by replacing dynamic resolver regular-expression construction with fixed token parsing while retaining the same release-carrier and worktree-selection behavior.
-- Invalidate the stale beta.184 acceptance after the packaged migration repair and advance package, Worker, and browser-extension identity to `3.0.0-beta.185`; fresh activation, deployed OAuth canary evidence, and observed live verification are required before recording acceptance.
+- Keep durable managed-job execution available across in-place Node package-manager upgrades by falling back from a removed daemon `process.execPath` only to the still-executable absolute Node launcher that originally started the daemon; diagnostics expose provenance/availability without local paths.
+- Make macOS sleep diagnosis retain actual timestamped `Sleep` records with a bounded 15-second power-log probe, avoiding the previous five-second timeout and broad filter that could hide evidence explaining relay suspension.
+- Add regressions for stale runtime launcher recovery and sleep-probe boundaries; relay authentication, replay, duplicate-side-effect prevention, and reconnect policy are unchanged.
 
 ## Historical releases
 

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.185",
+  "version_name": "3.0.0-beta.191",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/AUDIT.md

@@ -26,9 +26,10 @@ This file is the current audit summary. Historical findings, closed incidents, a
 - Beta.181 supersedes the activated-but-unaccepted beta.180 candidate after live owner-machine routing exposed two semantic classification defects rather than a relay failure: `非交互工作` and conditional `外部输入或授权` wording could exclude task supervision, while a project token could weak-match an unrelated installed application sharing one lexical fragment. The repair narrows interactive intent to explicit process/input contexts, requires lexical-token evidence for partial application matches, and makes an already-positive task-supervisor continuation contract authoritative for primary route selection. beta.180 relay standby/takeover behavior is unchanged.
 - Beta.182 is the reviewed predecessor candidate that added repository-specific durable routing for known long prerelease commands, extracted reconnect result settlement into a focused policy module while retaining the then-existing per-tool settlement ceiling, and recorded the controlled relay A/B. Its packaged bytes remain associated with beta.182 and are not reused after the independent re-review changed shipped source.
 - Beta.183 supersedes beta.182 after that re-review found package-affecting continuity, routing, privacy, and auditability defects. Repository-specific long workflows now request durable task supervision through project-provided registered-command metadata rather than hard-coded script names in generic routing; explicit read-only/negated/hypothetical/interactive/existing-job wording is kept out of new-job creation, and weak application-name matches require UI-operation intent. Worker reconnect settlement keeps execution/redelivery on the original deadline but grants the verified same-daemon terminal-result owner one fixed non-cumulative 15-second delivery-only extension beyond the original settlement deadline. Managed-job output redaction is byte-first and truncation-boundary safe; saturated retention tolerates a stale active-to-terminal dependency-plan deletion race without weakening genuine active-state fail-closed behavior; multiline static module edges are included in the architecture graph; and public worktree resolution no longer depends on maintainer-home tooling. The beta.182 controlled application-proxy A/B remains evidence only for the induced fault branch and does not identify the cause of spontaneous historical 1006 resets.
+- Beta.186 is the source candidate produced by an independent beta.185 review. The first review confirmed two issues: a zero-wait `read_job` starts with exactly the 10-second managed-read headroom, so any positive reconnect delay made daemon-proven non-delivery ineligible for redelivery; and the output-redaction sink itself accepted an empty literal even though current resource materialization already filters empty patterns. Subsequent hardening reproduced four adjacent boundary defects before acceptance: truncation-tail protection could receive truthy non-string redaction entries; repeated missing acknowledgements could re-enter redelivery policy; `resume_calls_ack.missing_ids` was not bound to the exact resume set emitted on that connection; and shorter protected bytes/paths/literals could partially replace a longer overlapping value and leave its suffix visible. The candidate now uses one literal-pattern filter, processes overlapping protected values longest-first, binds resume acknowledgement to the exact connection-scoped resume set, consumes one semantic acknowledgement while treating only its exact duplicate as idempotent, and records the channel of the one successful same-ID transport redelivery. A different later acknowledgement or out-of-set ID is a protocol error, while a later reconnect that again proves non-delivery returns the existing retryable no-side-effect failure. Low-headroom `read_job` redelivery still becomes `wait_ms: 0`, preserves the original execution deadline, and refuses less than one second of execution budget; fresh dispatch still requires the ordinary 10-second reconciliation headroom. The existing socket protocol-error counter is now driven by real WebSocket and signed-HTTPS ready-channel rejection paths without recording daemon payload values. Here “production protocol rejection paths” means the shipped Worker handler paths that can serve production traffic; it is a source-path reachability claim, not evidence that beta.186 has been deployed to or observed in a production environment. Other report proposals are not treated as defects without stronger evidence: request-stream closure is deliberately cancellation for request-scoped work; the 2-second durable-process initial settlement window is a response-coalescing bound rather than task lifetime and same-response `read_job` continuation remains the orchestration contract; historical macOS relocation already canonicalizes existing realpath ancestors, so platform-wide lowercasing would be unsound on case-sensitive volumes; beta.179 and beta.181 have passed acceptance records and are retained; and disabling fallback-proxy keep-alive is not justified by the current fault-injection evidence alone.
 
 ## Residual review requirements
 
 A green fast or full suite is necessary but not sufficient security evidence for publication. Release acceptance still requires the package/install/security gates and any hosted or live boundary evidence required by the changed surface. This summary does not authorize deployment or npm publication.
 
-Beta.181 is the current accepted/live baseline. Beta.182 remains the reviewed but superseded predecessor candidate. Beta.183 is the unaccepted replacement candidate and must pass frozen-tree verification plus exact-candidate owner-machine activation before acceptance. The controlled application-proxy A/B establishes only the induced fault branch; the spontaneous historical upstream reset source remains unassigned within the current privacy-bounded evidence. A future relay reset may still occur; continuity success means bounded warm HTTPS takeover plus durable task ownership, not an impossible no-disconnect guarantee. npm publication remains separately gated.
+Beta.185 is the latest repository acceptance record and remains the accepted prior-byte baseline. Beta.186 is a new local source candidate and must not inherit beta.185 acceptance: frozen-tree verification, packaging/install/security checks, and any exact-candidate live activation evidence required by the changed surface must be produced again before acceptance. The spontaneous historical upstream reset source remains unassigned within the current privacy-bounded evidence; a future relay reset may still occur. npm publication remains separately gated.

package/docs/LOGGING.md

@@ -156,7 +156,7 @@ Each managed job has owner-only runner diagnostic logs. Child-step output is ret
 
 `network_route` describes only Machine Bridge's application-level proxy decision. `system-network-stack` does **not** mean a direct physical path: an operating-system VPN, TUN, packet tunnel, DNS interceptor, or endpoint-security product may still carry the connection. `network_route_scope` therefore remains `application-proxy-selection-only`.
 
-During an outage, remote-owner `diagnose_runtime.runtime.relay` and local stdio `server_info.runtime.relay` expose bounded live fields: outage count/start/duration, attempts, last close category/code, coarse transport error class plus strict allowlisted `last_transport_error_reason`, last disconnect/ready time, prior ready duration, prior ready inbound-silence duration, the thirty-second WSS connect budget, bounded `last_connect_milestones_ms`, transport-probe queue/dispatch/Pong state, second-stage transport-confirmation timing/recovery state, bounded sender backlog bytes, HTTPS fallback active/warming state, `https_fallback_last_takeover_ms`, and next retry timing. `https_fallback_last_takeover_ms` retains the bounded WSS-close-to-verified-HTTPS-ready interval even after WSS later reclaims primary ownership, so a longer WebSocket outage is not misreported as the same duration of whole-bridge unavailability when HTTPS recovered earlier. The fallback status separates `last_success_at` (any successful signed HTTP exchange, including standby) from `last_ready_at` (only verified ready ownership), so a successful standby poll can no longer be misread as a completed failover. Connect milestones are relative durations only and never include hostnames, addresses, DNS answers, certificates, proxy endpoints, or credentials. The current-attempt milestones and separate `last_failed_connect_*` fields are retained independently so a successful retry cannot erase the immediately preceding failed DNS/TCP/TLS/upgrade evidence; `last_transport_error_ready` and `last_transport_error_authenticated` state whether the retained transport error occurred after channel authentication/readiness. Worker-side `daemon.websocket.closed` records only a bounded close code plus `was_clean`; raw peer close reasons are deliberately omitted. An already-dispatched Worker call detached from a failed channel is retained only until the smaller of reconnect grace and that call's original remaining absolute deadline. If it settles without rebinding, the public bounded error distinguishes `original call deadline expired during reconnect` from a true full `reconnect grace expired`; neither diagnostic includes tool arguments, paths, account identity, endpoint data, or result content, and the distinction does not extend the hosted deadline. Resource-coordinator snapshot contention is likewise classified separately from execution failure: when the bounded diagnostic cannot acquire a transaction/staging lock, it reports retryable `unavailable`, `reason=coordinator_busy`, and `snapshot_available=false`. This says the diagnostic snapshot was unavailable under contention; it does not relax admission policy or claim that the underlying host pressure is Green. `outage_duration_ms` is the close-to-ready recovery interval; `last_ready_inbound_silence_ms` is the pre-close interval since the preceding ready transport last proved inbound activity. After recovery, authenticated remote `server_info.daemon.relay_transport` retains the bounded preceding episode supplied during the current connection handshake, including `previous_ready_inbound_silence_ms` and brief interruptions below the default warning threshold. Promotion to a ready socket sets `outage_active=false`, extends the outage duration through actual readiness, preserves the preceding healthy-ready duration and inbound-silence evidence across failed candidates, canonicalizes timestamps, and accepts only enumerated coarse operational error classes; it does not claim that the recovered connection remains in outage. The `local_authority_revocation_retry` category is deliberately not diagnosed as a network failure: a sustained warning directs the operator to local authority, process-session, and managed-job state while the retained Worker revocation retries on reconnection; ordinary transport categories retain network/Worker troubleshooting guidance. On macOS, `diagnose_runtime` may also return a coarse default-route class, `operating_system_interception` boolean, privacy-bounded `runtime.idle_sleep_guard` state (`supported`, `enabled`, `active`, `grace_ms`, `requests_system_sleep_prevention_on_ac`, `last_error_class`), bounded `runtime.system_sleep`, and `runtime.relay_outage_analysis`. The sleep correlation distinguishes direct close-to-ready overlap from `wake_boundary_system_sleep_aftermath`, which requires the same sleep interval to match both the observed wake-adjacent disconnect and the daemon event-loop stall end/duration; a socket close cannot necessarily be observed while JavaScript is suspended. A near-wake reset without that independent stall match remains unassigned. That diagnostic is returned on demand and is not promoted to default logs; interface names, IP addresses, DNS answers, proxy endpoints/credentials, Worker endpoints, tool arguments, and results remain absent. `relay.outage.active` and `relay.outage.recovered` carry the existing safe relay fields.
+During an outage, remote-owner `diagnose_runtime.runtime.relay` and local stdio `server_info.runtime.relay` expose bounded live fields: outage count/start/duration, attempts, last close category/code, coarse transport error class plus strict allowlisted `last_transport_error_reason`, last disconnect/ready time, prior ready duration, prior ready inbound-silence duration, the thirty-second WSS connect budget, bounded `last_connect_milestones_ms`, transport-probe queue/dispatch/Pong state, second-stage transport-confirmation timing/recovery state, bounded sender backlog bytes, HTTPS fallback active/warming state, `https_fallback_last_takeover_ms`, `https_fallback_last_takeover_outage_number`, and next retry timing. `https_fallback_last_takeover_ms` retains the bounded WSS-close-to-verified-HTTPS-ready interval even after WSS later reclaims primary ownership, so a longer WebSocket outage is not misreported as the same duration of whole-bridge unavailability when HTTPS recovered earlier; `https_fallback_last_takeover_outage_number` binds that takeover to the exact WebSocket outage episode. The fallback status separates `last_success_at` (any successful signed HTTP exchange, including standby) from `last_ready_at` (only verified ready ownership), so a successful standby poll can no longer be misread as a completed failover. In addition, each completed episode in `recent_outages` independently records `https_fallback_taken_over` and bounded `https_fallback_takeover_ms` keyed to that outage number, ensuring prior takeovers or intervening no-takeover episodes are not conflated. Connect milestones are relative durations only and never include hostnames, addresses, DNS answers, certificates, proxy endpoints, or credentials. The current-attempt milestones and separate `last_failed_connect_*` fields are retained independently so a successful retry cannot erase the immediately preceding failed DNS/TCP/TLS/upgrade evidence; `last_transport_error_ready` and `last_transport_error_authenticated` state whether the retained transport error occurred after channel authentication/readiness. Worker-side `daemon.websocket.closed` records only a bounded close code plus `was_clean`; raw peer close reasons are deliberately omitted. An already-dispatched Worker call detached from a failed channel is retained only until the smaller of reconnect grace and that call's original remaining absolute deadline. If it settles without rebinding, the public bounded error distinguishes `original call deadline expired during reconnect` from a true full `reconnect grace expired`; neither diagnostic includes tool arguments, paths, account identity, endpoint data, or result content, and the distinction does not extend the hosted deadline. Resource-coordinator snapshot contention is likewise classified separately from execution failure: when the bounded diagnostic cannot acquire a transaction/staging lock, it reports retryable `unavailable`, `reason=coordinator_busy`, and `snapshot_available=false`. This says the diagnostic snapshot was unavailable under contention; it does not relax admission policy or claim that the underlying host pressure is Green. `outage_duration_ms` is the close-to-ready recovery interval; `last_ready_inbound_silence_ms` is the pre-close interval since the preceding ready transport last proved inbound activity. After recovery, authenticated remote `server_info.daemon.relay_transport` retains the bounded preceding episode supplied during the current connection handshake, including `previous_ready_inbound_silence_ms` and brief interruptions below the default warning threshold. Promotion to a ready socket sets `outage_active=false`, extends the outage duration through actual readiness, preserves the preceding healthy-ready duration and inbound-silence evidence across failed candidates, canonicalizes timestamps, and accepts only enumerated coarse operational error classes; it does not claim that the recovered connection remains in outage. The `local_authority_revocation_retry` category is deliberately not diagnosed as a network failure: a sustained warning directs the operator to local authority, process-session, and managed-job state while the retained Worker revocation retries on reconnection; ordinary transport categories retain network/Worker troubleshooting guidance. On macOS, `diagnose_runtime` may also return a coarse default-route class, `operating_system_interception` boolean, privacy-bounded `runtime.idle_sleep_guard` state (`supported`, `enabled`, `active`, `grace_ms`, `requests_system_sleep_prevention_on_ac`, `last_error_class`), bounded `runtime.system_sleep`, and `runtime.relay_outage_analysis`. The sleep correlation distinguishes direct close-to-ready overlap from `wake_boundary_system_sleep_aftermath`, which requires the same sleep interval to match both the observed wake-adjacent disconnect and the daemon event-loop stall end/duration; a socket close cannot necessarily be observed while JavaScript is suspended. A near-wake reset without that independent stall match remains unassigned. That diagnostic is returned on demand and is not promoted to default logs; interface names, IP addresses, DNS answers, proxy endpoints/credentials, Worker endpoints, tool arguments, and results remain absent. `relay.outage.active` and `relay.outage.recovered` carry the existing safe relay fields.
 
 Schema 4 is strict NDJSON. Before daemon startup, both active log files are opened as owner-only regular single-link files. A schema change clears both only after validation and commits the marker only after the transition succeeds. A symlink, multiple-hard-link inode, permission error, or marker-write failure blocks startup rather than mixing formats or repeatedly erasing evidence.
 

package/docs/MANAGED_JOBS.md

@@ -40,7 +40,9 @@ Interpretation:
 | Observation | Likely boundary |
 |---|---|
 | The tool call is rejected before any structured response | MCP host, connector gateway, approval system, or transport |
-| `diagnose_runtime` responds, but `local-process-spawn` fails | Local OS permissions, endpoint security, executable policy, or broken runtime |
+| `runtime-node-executable` reports `source=original_launcher` and `fallback_active=true` | The daemon's concrete Node executable was replaced or removed after startup, but the original absolute Node launcher is still executable. Durable runners continue through that launcher; restart the service to refresh the daemon's concrete runtime identity. |
+| `runtime-node-executable` is available but `local-process-spawn` fails | Local OS permissions, endpoint security, executable policy, or a lower-level process-creation failure |
+| `runtime-node-executable` is unavailable | Neither the daemon's concrete Node executable nor its trusted original absolute Node launcher can be executed; restart Machine Bridge from a valid Node installation |
 | Process spawn passes but `local-shell` fails | Shell configuration or shell-specific local policy |
 | Managed-job storage fails | State-root permissions, disk, filesystem policy, or endpoint security |
 | A job was accepted and later MCP calls are rejected | The detached job continues; inspect it through local CLI |

package/docs/OPERATIONS.md

@@ -10,7 +10,7 @@ machine-mcp service status
 
 Routine remote checks should use authenticated `server_info` with `detail: "summary"`; request the default/full projection only when the caller's authority permits and exact effective-tool, OAuth/account, or detailed owner observability is actually needed. Non-owner full responses intentionally retain hidden markers/counts instead of cross-principal activity, resource aliases, stable device-key identity, or daemon-only tool names. Remote `diagnose_runtime` is owner-only because its fixed probes expose machine-wide control-plane activity; narrower roles use `server_info`/`project_overview` for authority-scoped readiness and workspace state. `status` prints redacted profile state and verifies the deployed Worker version. Resource source paths remain redacted. `doctor` checks Node.js, the package-installed Wrangler binary, Cloudflare login, Worker health, the configured policy, the automatic-without-per-operation-prompts authorization model, and the same fixed local filesystem/process/shell/job-storage/resource probes exposed to the remote owner by `diagnose_runtime`. It constructs an isolated local runtime: `diagnosticScope.running_service_process_inspected=false` and `remote_relay_inspected=false` are deliberate, so a green doctor result is not evidence that the launchd/systemd/Scheduled Task daemon retained its Worker WebSocket. Inspect authenticated `server_info.daemon.relay_transport` for the running service relay. Authenticated `server_info.authorization.execution_model` reports the authority contract and identifies whether the account has daemon-OS-user ambient authority. Public `/healthz` output contains only server identity and version; daemon details require an authenticated `server_info` call.
 
-For interruption analysis, prefer one owner `diagnose_runtime` call over a chain of inventory probes. It now includes `runtime.managed_jobs.recent_activity`, `runtime.security_audit.recent_activity`, bounded `runtime.resource_admission.waiters.diagnostics`, `runtime.system_sleep`, `runtime.event_loop_pause_analysis`, and `runtime.relay_outage_analysis`. The audit aggregate contains only counts, bounded tool names, failure totals, calls-per-minute density, and numeric result-pressure fields (`output_bytes_last_15m`, `maximum_output_bytes_last_15m`, `large_result_calls_last_15m`, and `peak_output_bytes_per_minute_last_15m`) derived from the existing content-free hash-chained audit log; it contains no tool arguments or result content. Its `coverage=daemon_reached_relay_tool_calls_only` and `host_side_events_observable=false` fields make the evidence boundary explicit: host-only discovery/control-plane/final-delivery events are not counted. The waiter projection reports only resource-request shape and the current admission reason. On macOS with shell-capable owner diagnostics, the fixed power probe reduces `pmset` history to a small list of sleep start/end/duration/reason classes; it never returns raw power-log lines. `event_loop_pause_analysis.classification=matched_system_sleep` requires both the recorded runtime-stall end time and duration to match one of those bounded operating-system sleep intervals within a fixed tolerance. `relay_outage_analysis` separately compares the most recent completed `recent_outages[0].disconnected_at` -> `recent_outages[0].ready_at` interval with the same bounded sleep history and reports exact overlap duration/ratio; an active outage uses `outage_started_at` instead of the later `last_disconnected_at`. `majority_system_sleep_overlap` means at least half of that observed relay outage occurred while macOS was suspended. A sleeping JavaScript process may be unable to observe the stale socket until wake, so a zero-overlap close-to-ready interval is not automatically awake-network evidence: `wake_boundary_system_sleep_aftermath` is emitted only when the disconnect occurs within the fixed wake tolerance and that same sleep independently matches the event-loop stall in both end time and duration. Either sleep classification makes a retained `connection_reset`/timeout transport aftermath rather than sufficient evidence of a separate network root cause. `no_matching_recent_system_sleep` remains the classification for an awake reset or a merely coincidental near-wake reset without same-sleep stall evidence; it leaves the cause unassigned rather than guessing a VPN, edge, Worker, or host cause. Full relay diagnostics additionally expose `recent_outages`, a newest-first in-memory history capped at eight completed WebSocket reconnect episodes. Each entry contains only bounded outage numbering, first/final disconnect and ready timestamps, duration, close/error classes, previous-ready duration/silence, first-disconnect liveness phase/timing, coarse application-route class, and connection-stage timings. `disconnected_at` is the first outage transition and `last_disconnect_at` is the final failed reconnect transition. A protocol/application Pong that clears a liveness suspicion without rebuilding the WebSocket remains heartbeat evidence and is deliberately absent from `recent_outages`; the array is therefore reconnect history, not a list of every transient transport suspicion. ChatGPT host-turn termination/final-message receipt remains explicitly unobservable.
+For interruption analysis, prefer one owner `diagnose_runtime` call over a chain of inventory probes. It now includes `runtime.managed_jobs.recent_activity`, `runtime.security_audit.recent_activity`, bounded `runtime.resource_admission.waiters.diagnostics`, `runtime.system_sleep`, `runtime.event_loop_pause_analysis`, and `runtime.relay_outage_analysis`. The `runtime-node-executable` check exposes only the executable provenance class and availability booleans, never a local path. `source=original_launcher` means the daemon's concrete Node binary disappeared after startup while the same absolute launcher that started the daemon remains executable; durable child Node processes use that launcher, and a service restart refreshes the concrete runtime identity. The audit aggregate contains only counts, bounded tool names, failure totals, calls-per-minute density, and numeric result-pressure fields (`output_bytes_last_15m`, `maximum_output_bytes_last_15m`, `large_result_calls_last_15m`, and `peak_output_bytes_per_minute_last_15m`) derived from the existing content-free hash-chained audit log; it contains no tool arguments or result content. Its `coverage=daemon_reached_relay_tool_calls_only` and `host_side_events_observable=false` fields make the evidence boundary explicit: host-only discovery/control-plane/final-delivery events are not counted. The waiter projection reports only resource-request shape and the current admission reason. On macOS with shell-capable owner diagnostics, the fixed power probe selects actual timestamped `Sleep` records before applying the bounded tail, then reduces them to a small list of sleep start/end/duration/reason classes; it never returns raw power-log lines. The probe has a bounded 15-second execution budget so normal multi-second `pmset -g log` latency does not erase sleep evidence. If that bounded power-history probe is unavailable or times out, `runtime.system_sleep` remains `supported=true` with `available=false` and an `error_class`, while the `system-sleep-history` check is retained as skipped auxiliary causality evidence. That auxiliary evidence gap does not by itself make `diagnose_runtime.ok=false`; relay readiness, local filesystem/process/shell execution, managed-job storage, resource admission, and registered-resource availability remain health gates. `event_loop_pause_analysis.classification=matched_system_sleep` requires both the recorded runtime-stall end time and duration to match one of those bounded operating-system sleep intervals within a fixed tolerance. `relay_outage_analysis` separately compares the most recent completed `recent_outages[0].disconnected_at` -> `recent_outages[0].ready_at` interval with the same bounded sleep history and reports exact overlap duration/ratio; an active outage uses `outage_started_at` instead of the later `last_disconnected_at`. `majority_system_sleep_overlap` means at least half of that observed relay outage occurred while macOS was suspended. A sleeping JavaScript process may be unable to observe the stale socket until wake, so a zero-overlap close-to-ready interval is not automatically awake-network evidence: `wake_boundary_system_sleep_aftermath` is emitted only when the disconnect occurs within the fixed wake tolerance and that same sleep independently matches the event-loop stall in both end time and duration. Either sleep classification makes a retained `connection_reset`/timeout transport aftermath rather than sufficient evidence of a separate network root cause. `no_matching_recent_system_sleep` remains the classification for an awake reset or a merely coincidental near-wake reset without same-sleep stall evidence; it leaves the cause unassigned rather than guessing a VPN, edge, Worker, or host cause. Full relay diagnostics additionally expose `recent_outages`, a newest-first in-memory history capped at eight completed WebSocket reconnect episodes. Each entry also carries `https_fallback_taken_over` and bounded `https_fallback_takeover_ms`, attributed by the stable WebSocket outage number; a later fallback takeover cannot relabel an earlier or no-takeover episode. The top-level `https_fallback_last_takeover_outage_number` is only a bounded correlation aid for the latest takeover and must not be applied to another outage number. Each entry contains only bounded outage numbering, first/final disconnect and ready timestamps, duration, close/error classes, previous-ready duration/silence, first-disconnect liveness phase/timing, coarse application-route class, and connection-stage timings. `disconnected_at` is the first outage transition and `last_disconnect_at` is the final failed reconnect transition. A protocol/application Pong that clears a liveness suspicion without rebuilding the WebSocket remains heartbeat evidence and is deliberately absent from `recent_outages`; the array is therefore reconnect history, not a list of every transient transport suspicion. ChatGPT host-turn termination/final-message receipt remains explicitly unobservable.
 
 `runtime.idle_sleep_guard` carries coarse activity/grace/release timestamps plus `mode`, `requests_idle_sleep_prevention`, `requests_system_sleep_prevention_on_ac`, `assertion_generation`, `restart_count`, `recovery_pending`, and bounded current/last unprotected duration. These fields are diagnostic ownership evidence only. The default `activity` mode is backward compatible: authorized relay activity holds `/usr/bin/caffeinate -i -s -w <owner-pid>` through execution and the fixed thirty-minute inactivity grace. In `activity` and `ac-continuous`, that grace begins only after the last owned daemon-side activity settles; a new authorized activity cancels a pending release and receives the full grace after it later settles. `machine-mcp idle-sleep set ac-continuous` adds a daemon-lifetime `/usr/bin/caffeinate -s -w <daemon-pid>` assertion while keeping the normal activity assertion, so idle-sleep prevention on battery remains activity-scoped. `machine-mcp idle-sleep set continuous` instead holds `/usr/bin/caffeinate -i -s -w <daemon-pid>` for the daemon lifetime and does not arm inactivity grace; restart the daemon/service after changing the persisted mode. Every assertion uses fixed 1/5/30-second recovery after unexpected child exit or setup failure, while explicit release/shutdown cancels recovery. The `-s` request is effective only on AC power; `continuous` adds `-i` specifically to request Idle Sleep prevention on battery as well. None of these modes claims to defeat explicit sleep, lid-close policy, power loss, or operating-system behavior outside the documented assertion contracts. Remote account managed-job runners retain their separate runner-owned assertion and now inherit the same bounded child self-healing.
 
@@ -171,7 +171,7 @@ npm --version
 machine-mcp --verbose
 ```
 
-The published runtime package does not install Wrangler or Miniflare into its global dependency tree. On the first start or deployment, Machine Bridge first constructs a private hardened npm 12.0.2 from exact integrity-pinned npm, undici 6.28.0, and brace-expansion 5.0.9 registry tarballs, then uses that CLI to install the exact private Wrangler toolchain under its owner-only state root. It audits the resulting production tree and verifies registry signatures before contacting Cloudflare. This requires npm registry access and may add one bounded setup step; do not manually edit either private toolchain directory. Candidate installation, published global installation, GitHub Release publication checks, and npm publication also create temporary hardened/private staging sessions. Published installation preserves the global prefix selected by the owner's npm. GitHub and npm artifacts must match the accepted candidate digest/hash evidence before service mutation. Permission, I/O, quota, memory, retry, stale-handle, storage, read-only-filesystem, or timeout errors are not treated as an empty/corrupt tree and must be corrected without deleting the state root.
+The published runtime package does not install Wrangler or Miniflare into its global dependency tree. On the first start or deployment, Machine Bridge first constructs a private hardened npm 12.0.2 from exact integrity-pinned npm, undici 6.28.0, and brace-expansion 5.0.9 registry tarballs, then uses that CLI to install the exact private Wrangler toolchain under its owner-only state root. It audits the resulting production tree and verifies registry signatures before contacting Cloudflare. This requires npm registry access and may add one bounded setup step; do not manually edit either private toolchain directory. Candidate installation, published global installation, GitHub Release publication checks, and npm publication also create temporary hardened/private staging sessions. Published installation preserves the global prefix selected by the owner's npm. GitHub and npm artifacts must match the accepted candidate digest/hash evidence before service mutation. GitHub release publication after merge does not reinstall the source dependency tree or repeat local `check:full`: it first fetches `origin/main`, requires local `HEAD` to equal that exact commit, and requires every configured push-triggered provider workflow for that commit to have succeeded. It then uses the hardened npm session to recheck synchronized versions and rematerialize the accepted candidate bytes/promotion digest. Immediately before any tag or GitHub Release mutation it fetches `origin/main` again and requires the same CI-verified commit; publication aborts if main moved. Remote asset SHA-256 reconciliation remains mandatory after upload. Permission, I/O, quota, memory, retry, stale-handle, storage, read-only-filesystem, or timeout errors are not treated as an empty/corrupt tree and must be corrected without deleting the state root.
 
 ### Ambiguous publication outcome
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.185",
+  "version": "3.0.0-beta.191",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -108,6 +108,7 @@
     "stdio:integration-test": "node tests/stdio-integration-test.mjs",
     "catalog:test": "node tests/catalog-test.mjs",
     "tool-arguments:test": "node tests/tool-argument-validation-test.mjs",
+    "managed-job-output-redaction:test": "node tests/managed-job-output-redaction-test.mjs",
     "managed-jobs:test": "node tests/managed-jobs-test.mjs",
     "ssh-key:test": "node tests/ssh-key-test.mjs",
     "full-access:test": "node tests/full-access-test.mjs",

package/scripts/github-release.mjs

@@ -10,13 +10,12 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { runNetworkCommand } from "./network-retry.mjs";
-import { requireSuccessfulWorkflowRun } from "./release-ci.mjs";
+import { waitForSuccessfulWorkflowRun } from "./release-ci.mjs";
 import { tagSyncError } from "./release-state.mjs";
 import { verifyCurrentReleaseAcceptance } from "./release-acceptance.mjs";
 import { stageAcceptedCandidateTarball } from "./accepted-candidate-tarball.mjs";
 import { createHardenedNpmSession } from "./hardened-npm-session.mjs";
 import { nestedNpmEnvironment } from "../src/local/npm-environment.mjs";
-import { sourceDependencyTreeInstallArguments, sourceDependencyTreeInstallTimeoutMs } from "./source-dependency-tree.mjs";
 import { runExecutable } from "../src/local/shell.mjs";
 import { resolveTrustedGitExecutable } from "../src/local/trusted-git-executable.mjs";
 import { resolveTrustedGithubCli } from "../src/local/trusted-github-cli.mjs";
@@ -30,6 +29,8 @@ import { fileURLToPath } from "node:url";
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const git = resolveTrustedGitExecutable({ workspace: root });
 const gh = resolveTrustedGithubCli({ workspace: root });
+const RELEASE_CI_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
+const RELEASE_CI_POLL_INTERVAL_MS = 15_000;
 process.chdir(root);
 
 function fail(message) {
@@ -92,17 +93,6 @@ async function runNpmScript(npmCli, task) {
   });
 }
 
-async function installSourceDependencyTree(npmCli) {
-  await runExecutable(process.execPath, [npmCli, ...sourceDependencyTreeInstallArguments(root)], {
-    cwd: root,
-    capture: true,
-    env: nestedNpmEnvironment(process.env),
-    timeoutMs: sourceDependencyTreeInstallTimeoutMs,
-    hardTimeout: true,
-    maxOutputBytes: 8 * 1024 * 1024,
-  });
-  ensureClean();
-}
 
 function packageMetadata() {
   const data = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
@@ -158,7 +148,7 @@ function remoteTagCommit(tag) {
   return (peeled ?? direct)?.[0] ?? null;
 }
 
-function assertSuccessfulCi(head) {
+async function waitForSuccessfulCi(head) {
   const required = [
     [".github/workflows/ci.yml", "CI"],
     [".github/workflows/codeql.yml", "CodeQL"],
@@ -166,34 +156,32 @@ function assertSuccessfulCi(head) {
     [".github/workflows/scorecard.yml", "OpenSSF Scorecard"],
     [".github/workflows/workflow-policy.yml", "Workflow Policy Gate"],
   ];
+  const deadlineMs = performance.now() + RELEASE_CI_WAIT_TIMEOUT_MS;
   const verified = [];
   for (const [workflow, name] of required) {
-    const text = outputNetwork(gh, [
-      "run",
-      "list",
-      "--workflow",
-      workflow,
-      "--commit",
-      head,
-      "--event",
-      "push",
-      "--limit",
-      "20",
-      "--json",
-      "databaseId,status,conclusion,headSha,event,createdAt,url",
-    ]);
-    let runs;
-    try { runs = JSON.parse(text); }
-    catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    const loadRuns = () => {
+      const text = outputNetwork(gh, [
+        "run", "list", "--workflow", workflow, "--commit", head, "--event", "push",
+        "--limit", "20", "--json", "databaseId,status,conclusion,headSha,event,createdAt,url",
+      ]);
+      try { return JSON.parse(text); }
+      catch { fail(`GitHub Actions did not return valid JSON for ${name}`); }
+    };
     let run;
-    try { run = requireSuccessfulWorkflowRun(runs, head, name); }
-    catch (error) { fail(String(error?.message || error)); }
+    try {
+      run = await waitForSuccessfulWorkflowRun(loadRuns, head, name, {
+        deadlineMs,
+        pollIntervalMs: RELEASE_CI_POLL_INTERVAL_MS,
+        now: () => performance.now(),
+      });
+    } catch (error) {
+      fail(String(error?.message || error));
+    }
     console.log(`GitHub Actions ${name} succeeded for ${head} (run ${run.databaseId}).`);
     verified.push(run);
   }
   return verified;
 }
-
 function releaseInfo(tag) {
   const args = ["api", githubReleaseByTagEndpoint(tag)];
   const result = runNetwork(gh, args, { capture: true, allowFailure: true });
@@ -230,7 +218,7 @@ async function assertCoreSync({ requireReleaseAsset }) {
   if (head !== originMain) {
     fail(`HEAD ${head} does not match origin/main ${originMain}`);
   }
-  assertSuccessfulCi(head);
+  await waitForSuccessfulCi(head);
 
   const localCommit = localTagCommit(tag);
   const localTagError = tagSyncError({ scope: "local", tag, head, commit: localCommit });
@@ -349,13 +337,14 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
     fail(`CHANGELOG.md has no section for ${pkg.version}`);
   }
 
+  const releaseHead = exactReleaseHead();
+  await waitForSuccessfulCi(releaseHead);
+
   const npmSession = await createHardenedNpmSession();
   let acceptance;
   let candidate = null;
   let verificationError = null;
   try {
-    await installSourceDependencyTree(npmSession.cli);
-    await runNpmScript(npmSession.cli, "check");
     await runNpmScript(npmSession.cli, "version:check");
     ensureClean();
     acceptance = assertLocalAcceptance(npmSession.cli);
@@ -382,24 +371,19 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
   let primaryError = null;
   let releaseVerified = false;
   try {
-    const head = output(git, ["rev-parse", "HEAD"]);
-    const originMain = output(git, ["rev-parse", "origin/main"]);
-    if (head !== originMain) {
-      fail("HEAD does not match origin/main; local acceptance must be committed, pushed through npm run github:push, reviewed, and merged before release publication");
-    }
-    assertSuccessfulCi(head);
+    revalidateReleaseHead(releaseHead);
 
     const existingLocal = localTagCommit(tag);
-    if (existingLocal && existingLocal !== head) {
-      fail(`local ${tag} points to ${existingLocal}, not ${head}`);
+    if (existingLocal && existingLocal !== releaseHead) {
+      fail(`local ${tag} points to ${existingLocal}, not ${releaseHead}`);
     }
     if (!existingLocal) {
       run(git, ["tag", "-a", tag, "-m", `Release ${pkg.version}`]);
     }
 
     const existingRemote = remoteTagCommit(tag);
-    if (existingRemote && existingRemote !== head) {
-      fail(`remote ${tag} points to ${existingRemote}, not ${head}`);
+    if (existingRemote && existingRemote !== releaseHead) {
+      fail(`remote ${tag} points to ${existingRemote}, not ${releaseHead}`);
     }
     if (!existingRemote) {
       runNetwork(git, ["push", "origin", tag]);
@@ -442,6 +426,24 @@ async function publishCurrent({ prereleaseMode = false } = {}) {
   await assertCoreSync({ requireReleaseAsset: true });
 }
 
+function exactReleaseHead() {
+  const head = output(git, ["rev-parse", "HEAD"]);
+  const originMain = output(git, ["rev-parse", "origin/main"]);
+  if (head !== originMain) {
+    fail(`HEAD ${head} does not match origin/main ${originMain}; merge the accepted candidate before release publication`);
+  }
+  return head;
+}
+
+function revalidateReleaseHead(expectedHead) {
+  ensureClean();
+  fetchRemote();
+  const currentHead = exactReleaseHead();
+  if (currentHead !== expectedHead) {
+    fail(`release source moved from verified main ${expectedHead} to ${currentHead}; restart publication against the new exact main`);
+  }
+}
+
 function assertStableSoak(npmCli = process.env.npm_execpath) {
   try {
     const result = verifyCurrentStableSoak(root, { npmCli });

package/scripts/release-ci.mjs

@@ -1,6 +1,62 @@
+import { performance } from "node:perf_hooks";
+
+const DEFAULT_WORKFLOW_POLL_INTERVAL_MS = 15_000;
+const DEFAULT_WORKFLOW_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
+
 export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
+  const run = latestPushWorkflowRun(runs, head, workflowName);
+  if (run.status !== "completed") {
+    throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
+  }
+  if (run.conclusion !== "success") {
+    throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
+  }
+  return run;
+}
+
+export async function waitForSuccessfulWorkflowRun(loadRuns, head, workflowName = "CI", options = {}) {
+  if (typeof loadRuns !== "function") throw new Error("GitHub Actions run loader must be a function");
+  validateReleaseHead(head);
+  const now = typeof options.now === "function" ? options.now : () => performance.now();
+  const wait = typeof options.wait === "function" ? options.wait : defaultWorkflowWait;
+  const pollIntervalMs = positiveFinite(options.pollIntervalMs, DEFAULT_WORKFLOW_POLL_INTERVAL_MS, "workflow poll interval");
+  const deadlineMs = options.deadlineMs === undefined
+    ? now() + DEFAULT_WORKFLOW_WAIT_TIMEOUT_MS
+    : finiteDeadline(options.deadlineMs);
+  let observed = null;
+  for (;;) {
+    if (now() >= deadlineMs) throw workflowWaitTimeout(workflowName, head, observed);
+    const runs = await loadRuns();
+    let run = null;
+    try {
+      run = latestPushWorkflowRun(runs, head, workflowName);
+    } catch (error) {
+      if (!isMissingWorkflowRun(error, workflowName, head)) throw error;
+    }
+    if (run) {
+      observed = run;
+      if (run.status === "completed") {
+        if (run.conclusion !== "success") {
+          throw new Error(`${workflowName} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
+        }
+        return run;
+      }
+    } else {
+      observed = null;
+    }
+    const remainingMs = deadlineMs - now();
+    if (!(remainingMs > 0)) throw workflowWaitTimeout(workflowName, head, observed);
+    await wait(Math.min(pollIntervalMs, remainingMs));
+  }
+}
+
+export function requireSuccessfulCiRun(runs, head) {
+  return requireSuccessfulWorkflowRun(runs, head, "CI");
+}
+
+function latestPushWorkflowRun(runs, head, workflowName) {
   if (!Array.isArray(runs)) throw new Error("GitHub Actions response is not an array");
-  if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+  validateReleaseHead(head);
   const label = String(workflowName || "workflow");
   const matching = runs
     .filter((run) => run && run.headSha === head && run.event === "push")
@@ -9,15 +65,38 @@ export function requireSuccessfulWorkflowRun(runs, head, workflowName = "CI") {
   if (!run) {
     throw new Error(`no push-triggered ${label} run exists for release commit ${head}; wait for GitHub Actions to register the run and retry`);
   }
-  if (run.status !== "completed") {
-    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} is ${run.status || "unknown"}; wait for completion and retry`);
-  }
-  if (run.conclusion !== "success") {
-    throw new Error(`${label} run ${run.databaseId || "unknown"} for release commit ${head} concluded ${run.conclusion || "unknown"}; fix or rerun the workflow before release`);
-  }
   return run;
 }
 
-export function requireSuccessfulCiRun(runs, head) {
-  return requireSuccessfulWorkflowRun(runs, head, "CI");
+function validateReleaseHead(head) {
+  if (!/^[0-9a-f]{40,64}$/i.test(String(head || ""))) throw new Error("release commit SHA is invalid");
+}
+
+function positiveFinite(value, fallback, label) {
+  if (value === undefined) return fallback;
+  const number = Number(value);
+  if (!Number.isFinite(number) || number <= 0) throw new Error(`${label} must be a positive finite number`);
+  return number;
+}
+
+function finiteDeadline(value) {
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new Error("workflow wait deadline must be finite");
+  return number;
+}
+
+function isMissingWorkflowRun(error, workflowName, head) {
+  return String(error?.message || error).startsWith(`no push-triggered ${String(workflowName || "workflow")} run exists for release commit ${head};`);
+}
+
+function workflowWaitTimeout(workflowName, head, run) {
+  const label = String(workflowName || "workflow");
+  const state = run
+    ? `latest run ${run.databaseId || "unknown"} remained ${run.status || "unknown"}`
+    : "no exact-commit push run was registered";
+  return new Error(`${label} did not succeed for release commit ${head} before the finite CI wait deadline; ${state}`);
+}
+
+function defaultWorkflowWait(ms) {
+  return new Promise((resolvePromise) => { setTimeout(resolvePromise, ms); });
 }

package/src/local/agent-context.mjs

@@ -256,7 +256,30 @@ export class AgentContextManager {
     };
   }
 
-  async discoverState(inputPath, context = {}) {
+  async managedJobCommandForLocalInvocation(args = {}, context = {}) {
+    const command = await this.resolveLocalCommand(args, context);
+    return command.executionMode === "managed_job" ? managedJobCommandSummary(command) : null;
+  }
+
+  async managedJobCommandForDirectInvocation(args = {}, context = {}) {
+    const argv = args.argv;
+    if (!Array.isArray(argv) || argv.length === 0 || argv.some((value) => typeof value !== "string")) return null;
+    const state = await this.discoverState(args.cwd || ".", context, { includeUserGlobalContext: false });
+    if (state.target !== state.targetDir) return null;
+    for (const command of state.commands.values()) {
+      if (command.executionMode !== "managed_job" || !sameArgv(command.argv, argv)) continue;
+      let commandCwd;
+      try { commandCwd = await realpath(command.cwd); }
+      catch (error) {
+        if (error?.code === "ENOENT" || error?.code === "ENOTDIR") continue;
+        throw error;
+      }
+      if (commandCwd === state.target) return managedJobCommandSummary(command);
+    }
+    return null;
+  }
+
+  async discoverState(inputPath, context = {}, options = {}) {
     this.throwIfCancelled(context);
     const effectivePolicy = this.policyForContext(context);
     this.workspace = await realpath(this.workspace);
@@ -269,14 +292,14 @@ export class AgentContextManager {
       unrestricted: effectivePolicy.unrestrictedPaths === true,
     });
     const directories = directoriesBetween(scopeRoot, targetDir);
-    const userGlobalContextAllowed = allowsUserGlobalContext(context, effectivePolicy);
+    const userGlobalContextAllowed = options.includeUserGlobalContext !== false && allowsUserGlobalContext(context, effectivePolicy);
     const state = {
       target,
       targetDir,
       scopeRoot,
       instructionFiles: [...DEFAULT_INSTRUCTION_FILES],
       instructionMaxBytes: DEFAULT_INSTRUCTION_MAX_BYTES,
-      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, effectivePolicy.unrestrictedPaths === true),
+      skillRoots: defaultSkillRoots(directories, this.home, this.codexHome, userGlobalContextAllowed && effectivePolicy.unrestrictedPaths === true),
       commands: new Map(),
       builtinInstructionsEnabled: true,
       automaticProjectContextEnabled: true,
@@ -428,6 +451,14 @@ export class AgentContextManager {
   }
 }
 
+function sameArgv(left, right) {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+function managedJobCommandSummary(command) {
+  return Object.freeze({ name: command.name, managedJobTimeoutSeconds: command.managedJobTimeoutSeconds });
+}
+
 async function findScopeRoot({ targetDir, workspace, unrestricted }) {
   const target = await realpath(targetDir);
   const canonicalWorkspace = await realpath(workspace);