machine-bridge-mcp 3.0.0-beta.200 → 3.0.0-beta.201

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +11 -13
  2. package/browser-extension/manifest.json +1 -1
  3. package/docs/AUDIT.md +9 -0
  4. package/package.json +9 -8
  5. package/scripts/network-retry.mjs +2 -0
  6. package/src/local/bounded-output.mjs +11 -14
  7. package/src/local/cf-network-integrity.mjs +3 -3
  8. package/src/local/process-output-stream.mjs +5 -7
  9. package/src/local/wrangler-toolchain/package-lock.json +57 -74
  10. package/src/local/wrangler-toolchain/package.json +4 -4
  11. package/src/local/wrangler-toolchain.mjs +4 -4
  12. package/src/worker/index.ts +1 -1
package/CHANGELOG.md CHANGED
@@ -1,19 +1,17 @@
1
1
  # Changelog
2
2
 
3
- ## 3.0.0-beta.200 - 2026-10-09
3
+ ## 3.0.0-beta.201 - 2026-10-17
4
4
 
5
- - Refresh cf, Wrangler, Babel parser, ESLint, globals, Node types, fast-check and ws with synchronized source/private locks and exact native install-script approvals.
6
- - Remove the obsolete cf bundle rewrite and its standalone Undici dependency. Verify the unchanged upstream cf artifact and exercise connector/TLS-option preservation offline before private CLI execution.
7
- - Share one locked toolchain verification lifecycle for cf and Wrangler; deduplicate Miniflare and ws across deployment tooling without expanding the consumer runtime's three direct dependencies.
8
- - Adapt architecture parsing to Babel 8's TypeScript import-type AST so type-only dependency edges remain checked.
9
- - Reject coercible Worker deployment names before toolchain initialization; verify Durable Object and rate-limit binding types and exact rate-limit parameters before deployment callbacks.
10
- - Bound Build Output module count and aggregate bytes, and require every module path to stay within its bundle.
11
- - Preserve build/callback failures alongside private-project cleanup failures, including cleanup after staging permission errors.
12
- - Enforce dependency-node admission before reading values and avoid reflecting unverified package version text in integrity errors.
13
- - Group npm update proposals and monitor the private toolchain manifest, while retaining version, acceptance, audit, signature and release gates.
14
- - Correct the optional verifier configuration: preserve offline sandboxed regressions and run complete native suites with their required loopback, installation, browser and platform access.
15
- - Bind full-verification receipts to deployment configurations, verifier manifests and the Worker type seed; reject stale receipts after content or mode changes.
16
- - Retire the cf compatibility exception and stale transformation documentation; add causal boundary, privacy, budget and cleanup regressions.
5
+ - Stop successful network commands before transient-output classification so application text cannot replay completed side effects.
6
+ - Bound process-output and diagnostic-buffer allocation before copying; retain independent snapshots without holding oversized producer buffers, and remove unreachable overflow handling.
7
+ - Preserve nested npm configuration/engine failure diagnostics while keeping successful verification output concise.
8
+ - Make workflow-policy fault injection independent of historical action commit strings; apply the reviewed grouped Action updates.
9
+ - Reconcile cf 1.0.0-beta.18, Wrangler 4.151.1, ESLint 10.13.0 and Node types 26.6.5 across exact source/private dependency contracts, Miniflare/workerd pins, install-script approvals, network artifact integrity and runtime type generation.
10
+ - Exercise the upstream cf exported network factory directly instead of injecting an internal minifier symbol into a copied module.
11
+ - Record a revision-bound comparison of 37 related projects, adopted improvements and retained compatibility/security boundaries.
12
+
13
+ - Retire expired Scorecard exceptions no longer present in the latest provider report; re-review the three exact CodeQL findings, correct the admin request-body digest rationale, and validate checked-in exception expiry in the fast suite.
14
+ - Preserve explicit native lifecycle contracts after verifying the controller's automatic inference; use a clean worktree to keep unrelated helper languages out of project verification.
17
15
 
18
16
  ## Historical releases
19
17
 
package/browser-extension/manifest.json CHANGED
@@ -29,6 +29,6 @@
29
29
  "action": {
30
30
  "default_title": "Machine Bridge Browser"
31
31
  },
32
- "version_name": "3.0.0-beta.200",
32
+ "version_name": "3.0.0-beta.201",
33
33
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
34
34
  }
package/docs/AUDIT.md CHANGED
@@ -12,6 +12,9 @@ This review is scoped to source contracts, risk-bearing control paths, isolated
12
12
 
13
13
  ## Current conclusions
14
14
 
15
+ - **Output budgets include producer backing retention.** Both diagnostic and continuation buffers trim before allocating retained bytes and copy independent snapshots. Allocation/aliasing regressions and partition properties supplement the existing UTF-8 and continuation tests.
16
+ - **Successful settlement terminates retry classification.** Application stdout/stderr cannot cause a successful release command to run again. Failures retain bounded transient classification, while npm pre-lifecycle errors remain observable.
17
+
15
18
  - **Authority remains an intersection, never an accumulation.** Effective MCP authority is bounded by authenticated account role, daemon capability ceiling, and tool-specific policy. Reconnects, retries, stale host schemas, browser focus changes, or recovery metadata do not expand authority.
16
19
  - **Removed protocol behavior stays removed.** Remote HTTP and stdio use the current MCP protocol only. Removed initialization, session, and replay behavior fails closed instead of silently falling back to historical compatibility.
17
20
  - **State publication is atomic, type-exact and identity-sensitive.** Security-sensitive state readers reject symlinks, unexpected hard links, malformed content, permission failures, persistent identity changes, and coercible PID/token/timestamp fields. Persisted strings, arrays, booleans or objects cannot become process, cleanup, lock, lease, waiter or termination authority through JavaScript conversion. Bounded retries are reserved for explicitly classified atomic-publication races; durable state is complete before it becomes visible.
@@ -33,6 +36,12 @@ The prior relay could poll signed HTTPS while WSS was healthy; ready HTTPS polle
33
36
 
34
37
  The checked-in and inspected deployed bridge use SQLite-backed Durable Objects with no Workers KV namespace binding. Repository evidence establishes Worker request and Durable Object persistence amplification, not the origin of an account-wide dashboard item labeled KV. Attribution requires provider counters by UTC day, script, namespace and deployed bindings; another workload may consume a shared allowance. Provider identifiers, account data and request contents stay outside public evidence. Local counts do not establish billing, candidate-bound deployed behavior or completed soak.
35
38
 
39
+ ## Security exception review
40
+
41
+ On 2026-10-17, the retrieved Scorecard report from GitHub Actions run 38581193758 contained only CodeReviewID and CIIBestPracticesID. The expired MaintainedID and SASTID records are removed instead of extended. CodeQL 2.27.2 analysis 1944825726 still reports the three exact accepted rule/file pairs. Their current source was re-reviewed and the expiry is bounded to 2027-01-15. The insufficient-password-hash location is the signed admin request-body digest in accountAdminRequestHeaders, not a password database KDF; its prior rationale is corrected. The other two findings describe the intentional policy-authorized direct-executable boundary with shell=false. No new rule/path exception is introduced.
42
+
43
+ The fast SARIF regression now loads both real checked-in exception documents against a valid completed zero-finding report. Expired metadata fails before the expensive integration suite even when a particular report has no matching finding. These decisions remain exact, time-bounded exceptions; fresh external security checks are still required for the delivered commit.
44
+
36
45
  ## Residual limits
37
46
 
38
47
  - The default full profile is intentionally powerful. It is appropriate only where the daemon OS user is itself an acceptable trust boundary; stronger hostile-code isolation requires a separate OS account or VM/container.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "machine-bridge-mcp",
3
- "version": "3.0.0-beta.200",
3
+ "version": "3.0.0-beta.201",
4
4
  "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -265,7 +265,8 @@
265
265
  "browser-cli-pairing:test": "node tests/browser-cli-pairing-test.mjs",
266
266
  "resource-admission:test": "node tests/resource-admission-test.mjs",
267
267
  "resource-build-root:test": "node tests/resource-build-root-test.mjs",
268
- "cf-network:test": "node tests/cf-network-integrity-test.mjs"
268
+ "cf-network:test": "node tests/cf-network-integrity-test.mjs",
269
+ "output-buffer:test": "node tests/output-buffer-test.mjs"
269
270
  },
270
271
  "dependencies": {
271
272
  "https-proxy-agent": "9.1.0",
@@ -274,13 +275,13 @@
274
275
  },
275
276
  "devDependencies": {
276
277
  "@babel/parser": "8.0.7",
277
- "@types/node": "26.6.4",
278
- "cf": "1.0.0-beta.13",
279
- "eslint": "10.12.0",
278
+ "@types/node": "26.6.5",
279
+ "cf": "1.0.0-beta.18",
280
+ "eslint": "10.13.0",
280
281
  "fast-check": "4.10.2",
281
282
  "globals": "17.13.0",
282
283
  "typescript": "7.0.2",
283
- "wrangler": "4.149.0"
284
+ "wrangler": "4.151.1"
284
285
  },
285
286
  "keywords": [
286
287
  "mcp",
@@ -312,7 +313,7 @@
312
313
  "esbuild@0.28.2": true,
313
314
  "fsevents": false,
314
315
  "sharp@0.35.5": true,
315
- "workerd@1.20261006.1": true
316
+ "workerd@1.20261012.1": true
316
317
  },
317
318
  "packageManager": "npm@12.0.2",
318
319
  "devEngines": {
@@ -330,7 +331,7 @@
330
331
  "overrides": {
331
332
  "sharp": "0.35.5",
332
333
  "brace-expansion": "5.0.12",
333
- "miniflare": "5.20261006.1-alpha",
334
+ "miniflare": "5.20261012.1-beta",
334
335
  "ws": "$ws"
335
336
  }
336
337
  }
package/scripts/network-retry.mjs CHANGED
@@ -35,6 +35,8 @@ export function networkCommandArgs(command, args) {
35
35
  }
36
36
 
37
37
  export function isTransientNetworkFailure(result) {
38
+ // Output is application data after successful settlement, never a reason to replay it.
39
+ if (result?.status === 0 && !result.error && !result.signal) return false;
38
40
  if (result?.error) {
39
41
  const code = String(result.error.code || "");
40
42
  if (["ECONNRESET", "ETIMEDOUT", "EAI_AGAIN", "ENETUNREACH", "ECONNREFUSED"].includes(code)) return true;
package/src/local/bounded-output.mjs CHANGED
@@ -16,25 +16,22 @@ export class BoundedOutput {
16
16
  if (!bytes.length) return;
17
17
  this.totalBytes += bytes.length;
18
18
 
19
- if (this.full) {
20
- const combined = Buffer.concat([this.full, bytes]);
21
- if (combined.length <= this.maximum) {
22
- this.full = combined;
23
- return;
24
- }
25
- this.full = null;
26
- this.head = combined.subarray(0, this.headLimit);
27
- this.tail = this.tailLimit ? combined.subarray(Math.max(this.headLimit, combined.length - this.tailLimit)) : Buffer.alloc(0);
19
+ if (this.full && this.full.length + bytes.length <= this.maximum) {
20
+ this.full = Buffer.concat([this.full, bytes]);
28
21
  return;
29
22
  }
30
23
 
31
- if (this.head.length < this.headLimit) {
32
- const missing = this.headLimit - this.head.length;
33
- this.head = Buffer.concat([this.head, bytes.subarray(0, missing)]);
24
+ const previous = this.full || this.tail;
25
+ if (this.full) {
26
+ const missing = Math.max(0, this.headLimit - this.full.length);
27
+ this.head = Buffer.concat([this.full.subarray(0, this.headLimit), bytes.subarray(0, missing)]);
28
+ this.full = null;
34
29
  }
35
30
  if (this.tailLimit) {
36
- const combinedTail = Buffer.concat([this.tail, bytes]);
37
- this.tail = combinedTail.subarray(Math.max(0, combinedTail.length - this.tailLimit));
31
+ // Copy only retained bytes; subarray alone keeps the entire producer chunk alive.
32
+ const tail = bytes.subarray(Math.max(0, bytes.length - this.tailLimit));
33
+ const retained = Math.min(previous.length, this.tailLimit - tail.length);
34
+ this.tail = Buffer.concat([previous.subarray(previous.length - retained), tail]);
38
35
  }
39
36
  }
40
37
 
package/src/local/cf-network-integrity.mjs CHANGED
@@ -5,10 +5,10 @@ import { readBoundedRegularFileSync } from "./secure-file.mjs";
5
5
  import { privateToolchainIntegrityError, throwOperationalOrIntegrity } from "./private-toolchain-integrity.mjs";
6
6
 
7
7
  export const CF_NETWORK_ARTIFACT = Object.freeze({
8
- version: "1.0.0-beta.13",
8
+ version: "1.0.0-beta.18",
9
9
  bundledUndici: "7.30.0",
10
- bundle: "dist/dist-BHEmAAHr.mjs",
11
- sha256: "44d51802036f7c7d936c2f467386c435e8487fd4cef61b2ace3c5ad53efbed57",
10
+ bundle: "dist/dist-DZRTPMMA.mjs",
11
+ sha256: "d77810cfe122299f2e5c22edb1e93f6f85a306b7bda0bc26aafda8c5b525f9c9",
12
12
  });
13
13
  const MAX_BUNDLE_BYTES = 2 * 1024 * 1024;
14
14
 
package/src/local/process-output-stream.mjs CHANGED
@@ -23,13 +23,11 @@ export class ProcessOutputStream {
23
23
  const input = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ""));
24
24
  if (!input.length) return;
25
25
  this.totalBytes += input.length;
26
- let combined = this.buffer.length ? Buffer.concat([this.buffer, input]) : Buffer.from(input);
27
- if (combined.length > this.maximumBytes) {
28
- const dropped = combined.length - this.maximumBytes;
29
- combined = combined.subarray(dropped);
30
- this.baseOffset += dropped;
31
- }
32
- this.buffer = combined;
26
+ // Trim before copying: a small subarray can otherwise retain a huge backing allocation.
27
+ const tail = input.subarray(Math.max(0, input.length - this.maximumBytes));
28
+ const retained = Math.min(this.buffer.length, this.maximumBytes - tail.length);
29
+ this.buffer = Buffer.concat([this.buffer.subarray(this.buffer.length - retained), tail]);
30
+ this.baseOffset = this.totalBytes - this.buffer.length;
33
31
  }
34
32
 
35
33
  /** @param {unknown} requestedOffset @param {unknown} maximumBytes */
package/src/local/wrangler-toolchain/package-lock.json CHANGED
@@ -8,8 +8,8 @@
8
8
  "name": "machine-bridge-mcp-wrangler-toolchain",
9
9
  "version": "1.0.0",
10
10
  "dependencies": {
11
- "cf": "1.0.0-beta.13",
12
- "wrangler": "4.149.0"
11
+ "cf": "1.0.0-beta.18",
12
+ "wrangler": "4.151.1"
13
13
  },
14
14
  "engines": {
15
15
  "node": ">=26.0.0",
@@ -17,30 +17,21 @@
17
17
  }
18
18
  },
19
19
  "node_modules/@cloudflare/build-output-utils": {
20
- "version": "0.8.6",
21
- "resolved": "https://registry.npmjs.org/@cloudflare/build-output-utils/-/build-output-utils-0.8.6.tgz",
22
- "integrity": "sha512-Ku4UL7tUX9kpto9AisUg2jPNS4yXC6lMy8DMMKdDquArNjxpqDJfkW68WSlA8yfrLSFO3fgxMWW47rtxv/GHgQ==",
20
+ "version": "0.9.3",
21
+ "resolved": "https://registry.npmjs.org/@cloudflare/build-output-utils/-/build-output-utils-0.9.3.tgz",
22
+ "integrity": "sha512-0MgvIq6UxbRWLwB2QJU7qjLqpPkfygOebN3UiENhdp+z6zpRKrNnwkms2ynadmxCOh3sL2v+SI0/pNXxgXdteA==",
23
23
  "license": "MIT",
24
24
  "dependencies": {
25
- "@cloudflare/config": "0.24.0"
26
- }
27
- },
28
- "node_modules/@cloudflare/codemods": {
29
- "version": "0.4.1",
30
- "resolved": "https://registry.npmjs.org/@cloudflare/codemods/-/codemods-0.4.1.tgz",
31
- "integrity": "sha512-DSRpLpM0J8vD7oLKvViS6NMlMVnc6F38JXCrVy0q3KouSS5I71do1QRvGwtJjVHVOULPWlxy/DvA6cIIz3481g==",
32
- "license": "MIT OR Apache-2.0",
33
- "bin": {
34
- "cloudflare-codemods": "dist/bin.mjs"
25
+ "@cloudflare/config": "0.27.0"
35
26
  }
36
27
  },
37
28
  "node_modules/@cloudflare/config": {
38
- "version": "0.24.0",
39
- "resolved": "https://registry.npmjs.org/@cloudflare/config/-/config-0.24.0.tgz",
40
- "integrity": "sha512-DBKkL2fFfHIL0cdjXOoWybNzBxD5xAvuebu0nfcBphWeUiWKnSUYu8JMaboKzmAJRp6V1RGtPAdfdtXMHueqAA==",
29
+ "version": "0.27.0",
30
+ "resolved": "https://registry.npmjs.org/@cloudflare/config/-/config-0.27.0.tgz",
31
+ "integrity": "sha512-wNnL0z4lj5Gm2fze5qXTOvRPbUOi4jlMmwPk7ArCUakI5oVxgjfl3Rhnfd/Mmzo3g86x/ofH75yPIhsa5msqdQ==",
41
32
  "license": "MIT",
42
33
  "dependencies": {
43
- "zod": "4.4.3"
34
+ "zod": "4.6.5"
44
35
  }
45
36
  },
46
37
  "node_modules/@cloudflare/kv-asset-handler": {
@@ -53,13 +44,13 @@
53
44
  }
54
45
  },
55
46
  "node_modules/@cloudflare/runtime-types": {
56
- "version": "0.1.8",
57
- "resolved": "https://registry.npmjs.org/@cloudflare/runtime-types/-/runtime-types-0.1.8.tgz",
58
- "integrity": "sha512-gYeU3d/eRGWveJSwaAVU0bQ40xgxgfMVgioib7PnUGEYxKGHfFGc85lkNG7gyYoZnsYuPBYOH4umr+H+F4+apg==",
47
+ "version": "0.1.12",
48
+ "resolved": "https://registry.npmjs.org/@cloudflare/runtime-types/-/runtime-types-0.1.12.tgz",
49
+ "integrity": "sha512-eYF5teHQ+Jss4sbSVINM5tNPHxo/kJ2gKcMs7omyy7gO9PEkgUbGPZCYl06SxbBWTcJFF2vrX4epB775QTE4BQ==",
59
50
  "license": "MIT",
60
51
  "dependencies": {
61
- "miniflare": "5.20261006.0-alpha",
62
- "workerd": "1.20261006.1"
52
+ "miniflare": "5.20261012.1-beta",
53
+ "workerd": "1.20261012.1"
63
54
  }
64
55
  },
65
56
  "node_modules/@cloudflare/unenv-preset": {
@@ -78,9 +69,9 @@
78
69
  }
79
70
  },
80
71
  "node_modules/@cloudflare/workerd-darwin-64": {
81
- "version": "1.20261006.1",
82
- "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20261006.1.tgz",
83
- "integrity": "sha512-lCX6avJO2It9AyDEYitjmOtJRVp/xmaW0TziyoLAnfxlzozyyRbSFfIIMMCiDx/sTP1++E4VLbV+7BHSD33f0Q==",
72
+ "version": "1.20261012.1",
73
+ "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-64/-/workerd-darwin-64-1.20261012.1.tgz",
74
+ "integrity": "sha512-dkTL9aY3V4D40b+jBpGPCistWUPFQ/M61wlWi6i1o8MvHFFgEw7EQkcaYEv6Yd3bkPDD/3TFT4hRsMb2xVZSwQ==",
84
75
  "cpu": [
85
76
  "x64"
86
77
  ],
@@ -94,9 +85,9 @@
94
85
  }
95
86
  },
96
87
  "node_modules/@cloudflare/workerd-darwin-arm64": {
97
- "version": "1.20261006.1",
98
- "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20261006.1.tgz",
99
- "integrity": "sha512-PyFGjOaldtppnLuKsdkoYWXfLVpDjuf8u+uoykX+1Xvxo2EPmCVViq0iDKm+U7c7PRno85ehS3/MPVXyk2HwHw==",
88
+ "version": "1.20261012.1",
89
+ "resolved": "https://registry.npmjs.org/@cloudflare/workerd-darwin-arm64/-/workerd-darwin-arm64-1.20261012.1.tgz",
90
+ "integrity": "sha512-2/nVGcKXjNNI+DhxKSepTKvFng9H7aN2WXv6Zu67iqgI6JrxypNt5kTPv4ZHosxrcfyKMci/2RfN7GIrN0BitQ==",
100
91
  "cpu": [
101
92
  "arm64"
102
93
  ],
@@ -110,9 +101,9 @@
110
101
  }
111
102
  },
112
103
  "node_modules/@cloudflare/workerd-linux-64": {
113
- "version": "1.20261006.1",
114
- "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20261006.1.tgz",
115
- "integrity": "sha512-Ntf9S8eesmVufdjaT2kzWlz6Ng9XGYTc6cHQVRKAg59lFufwsIabGeMT6U4KkrpEeSIxgHq8aPtuLbZXE19tCA==",
104
+ "version": "1.20261012.1",
105
+ "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-64/-/workerd-linux-64-1.20261012.1.tgz",
106
+ "integrity": "sha512-uMe7ONHnLxStD1Ye0YFHBO36uj4cStv5P53rW+5GVWXFT8BRjqVixlH0IqCAHe1Pmcwyd1+7fVoGde89MZSCJg==",
116
107
  "cpu": [
117
108
  "x64"
118
109
  ],
@@ -126,9 +117,9 @@
126
117
  }
127
118
  },
128
119
  "node_modules/@cloudflare/workerd-linux-arm64": {
129
- "version": "1.20261006.1",
130
- "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20261006.1.tgz",
131
- "integrity": "sha512-JyeDBymVWw5tVRebSsVE8ojDYxd6UlZrAseHU8G+NpIyd5wF61tXlF/axLeCUqu0pOhBFHb8I5QKi0jwrCK41Q==",
120
+ "version": "1.20261012.1",
121
+ "resolved": "https://registry.npmjs.org/@cloudflare/workerd-linux-arm64/-/workerd-linux-arm64-1.20261012.1.tgz",
122
+ "integrity": "sha512-I0VMdcXk7ygG5vYDce0ePTBFdnBXC0i9WiBY5mWiv0iTinbfea6/rHqSQ7B1UMpjgrYVs9E0m4bZ9ufsk5GCFA==",
132
123
  "cpu": [
133
124
  "arm64"
134
125
  ],
@@ -142,9 +133,9 @@
142
133
  }
143
134
  },
144
135
  "node_modules/@cloudflare/workerd-windows-64": {
145
- "version": "1.20261006.1",
146
- "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20261006.1.tgz",
147
- "integrity": "sha512-nWP0URNqOBN9fa/gZ7eh/w051DwjOXN8j4lDZDYVXyQPsux6sV3DfyYZT+CjR/rt9nKBSmJT9QE9/bWT18+84w==",
136
+ "version": "1.20261012.1",
137
+ "resolved": "https://registry.npmjs.org/@cloudflare/workerd-windows-64/-/workerd-windows-64-1.20261012.1.tgz",
138
+ "integrity": "sha512-c5hQvNx574UEoknaCFvMa/NdLrrYiALNbe6sx1okW8uOiRYWxrFuA8WpXFnBJ5XJypm0TEAHYaUTGv3rRLpY7Q==",
148
139
  "cpu": [
149
140
  "x64"
150
141
  ],
@@ -1219,18 +1210,16 @@
1219
1210
  "license": "MIT"
1220
1211
  },
1221
1212
  "node_modules/cf": {
1222
- "version": "1.0.0-beta.13",
1223
- "resolved": "https://registry.npmjs.org/cf/-/cf-1.0.0-beta.13.tgz",
1224
- "integrity": "sha512-dCjpzCJvjudIu8IQbXCJfy9diFoyHU84D/30K4lJp7jUaBgvjJypsMFzLqvUFOuwhF1ggR/igsLqXyehAOR2FQ==",
1213
+ "version": "1.0.0-beta.18",
1214
+ "resolved": "https://registry.npmjs.org/cf/-/cf-1.0.0-beta.18.tgz",
1215
+ "integrity": "sha512-SG9NqB6xEZf/WZm6+E2v0OIY5JA0b9DUgl1VOOlF0D5Y+Nk5PyhHonJOd6K2/g6f261h+Z0FwTEK69c9bfIq4g==",
1225
1216
  "license": "MIT OR Apache-2.0",
1226
1217
  "dependencies": {
1227
- "@cloudflare/build-output-utils": "0.8.6",
1228
- "@cloudflare/codemods": "0.4.1",
1229
- "@cloudflare/config": "0.24.0",
1230
- "@cloudflare/runtime-types": "0.1.8",
1218
+ "@cloudflare/build-output-utils": "0.9.3",
1219
+ "@cloudflare/config": "0.27.0",
1220
+ "@cloudflare/runtime-types": "0.1.12",
1231
1221
  "blake3-wasm": "2.1.5",
1232
- "miniflare": "5.20261006.0-alpha",
1233
- "minisearch": "7.2.0"
1222
+ "miniflare": "5.20261012.1-beta"
1234
1223
  },
1235
1224
  "bin": {
1236
1225
  "cf": "bin/cf",
@@ -1336,15 +1325,15 @@
1336
1325
  }
1337
1326
  },
1338
1327
  "node_modules/miniflare": {
1339
- "version": "5.20261006.1-alpha",
1340
- "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20261006.1-alpha.tgz",
1341
- "integrity": "sha512-6ylv8tamkrspDI2R/cAYfv+YWmfGNdXe76Pi9TauEUWsFVXn3LNF9Yk8oduzf1a+TYsSRYTqlOE7+nGGRsMHdw==",
1328
+ "version": "5.20261012.1-beta",
1329
+ "resolved": "https://registry.npmjs.org/miniflare/-/miniflare-5.20261012.1-beta.tgz",
1330
+ "integrity": "sha512-8Canhy6g9+vAhqMc0o80YphqYIwpiA3aAp8aX+uDXU7J/qbUeoZzcII9c2V1P4uT/eHD4SB93qet1o1bRY3BuQ==",
1342
1331
  "license": "MIT",
1343
1332
  "dependencies": {
1344
1333
  "@cspotcode/source-map-support": "0.8.1",
1345
1334
  "sharp": "0.35.5",
1346
1335
  "undici": "7.29.1",
1347
- "workerd": "1.20261006.1",
1336
+ "workerd": "1.20261012.1",
1348
1337
  "ws": "8.21.0",
1349
1338
  "youch": "4.1.0-beta.10"
1350
1339
  },
@@ -1352,12 +1341,6 @@
1352
1341
  "node": ">=22.0.0"
1353
1342
  }
1354
1343
  },
1355
- "node_modules/minisearch": {
1356
- "version": "7.2.0",
1357
- "resolved": "https://registry.npmjs.org/minisearch/-/minisearch-7.2.0.tgz",
1358
- "integrity": "sha512-dqT2XBYUOZOiC5t2HRnwADjhNS2cecp9u+TJRiJ1Qp/f5qjkeT5APcGPjHw+bz89Ms8Jp+cG4AlE+QZ/QnDglg==",
1359
- "license": "MIT"
1360
- },
1361
1344
  "node_modules/path-to-regexp": {
1362
1345
  "version": "6.3.0",
1363
1346
  "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
@@ -1469,9 +1452,9 @@
1469
1452
  }
1470
1453
  },
1471
1454
  "node_modules/workerd": {
1472
- "version": "1.20261006.1",
1473
- "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20261006.1.tgz",
1474
- "integrity": "sha512-8MadBuffZ5NdpLwZjUmsqT5QlaKXq4gjgT6wzcKeynZTICNXyePhc+5QVoKiK7+MMhFTLNrRO2KXLlpk8Q6BkA==",
1455
+ "version": "1.20261012.1",
1456
+ "resolved": "https://registry.npmjs.org/workerd/-/workerd-1.20261012.1.tgz",
1457
+ "integrity": "sha512-tEHoMPsMga0seVjxfsR8Pd3f8IRqYwkq++dTUKI5Gdgj6zuSDluYwisydq+dn90SsIACwBquJUQ1nBpcOqaWTA==",
1475
1458
  "hasInstallScript": true,
1476
1459
  "license": "Apache-2.0",
1477
1460
  "bin": {
@@ -1481,27 +1464,27 @@
1481
1464
  "node": ">=16"
1482
1465
  },
1483
1466
  "optionalDependencies": {
1484
- "@cloudflare/workerd-darwin-64": "1.20261006.1",
1485
- "@cloudflare/workerd-darwin-arm64": "1.20261006.1",
1486
- "@cloudflare/workerd-linux-64": "1.20261006.1",
1487
- "@cloudflare/workerd-linux-arm64": "1.20261006.1",
1488
- "@cloudflare/workerd-windows-64": "1.20261006.1"
1467
+ "@cloudflare/workerd-darwin-64": "1.20261012.1",
1468
+ "@cloudflare/workerd-darwin-arm64": "1.20261012.1",
1469
+ "@cloudflare/workerd-linux-64": "1.20261012.1",
1470
+ "@cloudflare/workerd-linux-arm64": "1.20261012.1",
1471
+ "@cloudflare/workerd-windows-64": "1.20261012.1"
1489
1472
  }
1490
1473
  },
1491
1474
  "node_modules/wrangler": {
1492
- "version": "4.149.0",
1493
- "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.149.0.tgz",
1494
- "integrity": "sha512-OzK7xmB5r5iLKb3cIT3783g13fe6T7xyeKu9LEdUyl+DKAM2KP/jkjnE0OUhyw+mB/XJM9ycjgF3MWm8PR9amg==",
1475
+ "version": "4.151.1",
1476
+ "resolved": "https://registry.npmjs.org/wrangler/-/wrangler-4.151.1.tgz",
1477
+ "integrity": "sha512-OAsa9UAHZshM6mq2PXcVoyxXgWThAanZMBc/IirtqEWd/BauRtmUKzAniOu/pU0pd3pxKuMZ2vsbF4eo6RiNDA==",
1495
1478
  "license": "MIT OR Apache-2.0",
1496
1479
  "dependencies": {
1497
1480
  "@cloudflare/kv-asset-handler": "0.5.0",
1498
1481
  "@cloudflare/unenv-preset": "2.16.2",
1499
1482
  "blake3-wasm": "2.1.5",
1500
1483
  "esbuild": "0.28.2",
1501
- "miniflare": "5.20261006.1-alpha",
1484
+ "miniflare": "5.20261012.1-beta",
1502
1485
  "path-to-regexp": "6.3.0",
1503
1486
  "unenv": "2.0.0-rc.24",
1504
- "workerd": "1.20261006.1"
1487
+ "workerd": "1.20261012.1"
1505
1488
  },
1506
1489
  "bin": {
1507
1490
  "cf-wrangler": "bin/cf-wrangler.js",
@@ -1568,9 +1551,9 @@
1568
1551
  }
1569
1552
  },
1570
1553
  "node_modules/zod": {
1571
- "version": "4.4.3",
1572
- "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
1573
- "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
1554
+ "version": "4.6.5",
1555
+ "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
1556
+ "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
1574
1557
  "license": "MIT",
1575
1558
  "funding": {
1576
1559
  "url": "https://github.com/sponsors/colinhacks"
package/src/local/wrangler-toolchain/package.json CHANGED
@@ -8,18 +8,18 @@
8
8
  "npm": ">=12.0.0"
9
9
  },
10
10
  "dependencies": {
11
- "cf": "1.0.0-beta.13",
12
- "wrangler": "4.149.0"
11
+ "cf": "1.0.0-beta.18",
12
+ "wrangler": "4.151.1"
13
13
  },
14
14
  "overrides": {
15
15
  "sharp": "0.35.5",
16
- "miniflare": "5.20261006.1-alpha",
16
+ "miniflare": "5.20261012.1-beta",
17
17
  "ws": "8.22.0"
18
18
  },
19
19
  "allowScripts": {
20
20
  "esbuild@0.28.2": true,
21
21
  "fsevents": false,
22
22
  "sharp@0.35.5": true,
23
- "workerd@1.20261006.1": true
23
+ "workerd@1.20261012.1": true
24
24
  }
25
25
  }
package/src/local/wrangler-toolchain.mjs CHANGED
@@ -161,18 +161,18 @@ async function runNpm(npmCli, args, cwd, runCommand, options, timeoutMs, allowFa
161
161
  }
162
162
 
163
163
  function validateTemplate(manifest, lock) {
164
- if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.149.0"
164
+ if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.151.1"
165
165
  || manifest.dependencies?.cf !== CF_NETWORK_ARTIFACT.version
166
166
  || Object.keys(manifest.dependencies).length !== 2) {
167
167
  throw new Error("Cloudflare toolchain manifest lost its exact private dependencies");
168
168
  }
169
169
  if (manifest.overrides?.sharp !== "0.35.5"
170
- || manifest.overrides?.miniflare !== "5.20261006.1-alpha"
170
+ || manifest.overrides?.miniflare !== "5.20261012.1-beta"
171
171
  || manifest.overrides?.ws !== "8.22.0"
172
172
  || Object.keys(manifest.overrides).length !== 3) {
173
173
  throw new Error("Cloudflare toolchain manifest lost its security and deduplication overrides");
174
174
  }
175
- const expectedScripts = { "esbuild@0.28.2": true, fsevents: false, "sharp@0.35.5": true, "workerd@1.20261006.1": true };
175
+ const expectedScripts = { "esbuild@0.28.2": true, fsevents: false, "sharp@0.35.5": true, "workerd@1.20261012.1": true };
176
176
  if (JSON.stringify(manifest.allowScripts) !== JSON.stringify(expectedScripts)) {
177
177
  throw new Error("Cloudflare toolchain manifest lost its exact install-script policy");
178
178
  }
@@ -189,7 +189,7 @@ function validateTemplate(manifest, lock) {
189
189
  }
190
190
  if (lock.packages?.["node_modules/undici"]?.version !== "7.29.1"
191
191
  || lock.packages?.["node_modules/esbuild"]?.version !== "0.28.2"
192
- || lock.packages?.["node_modules/workerd"]?.version !== "1.20261006.1") {
192
+ || lock.packages?.["node_modules/workerd"]?.version !== "1.20261012.1") {
193
193
  throw new Error("Cloudflare toolchain lockfile lost an installed dependency pin");
194
194
  }
195
195
  }
package/src/worker/index.ts CHANGED
@@ -57,7 +57,7 @@ import { hostedManagedJobDaemonArguments, projectHostedManagedJobResult } from "
57
57
  import { cancelManagedJobMonitorClaimsIfAvailable, claimManagedJobMonitor, hasManagedJobMonitorClaimIfAvailable, ManagedJobMonitorClaimStore } from "./mcp-job-monitor-claims.ts";
58
58
  import { JOB_MONITOR_CLAIM_TOOL, JOB_MONITOR_READ_TOOL, JOB_MONITOR_RENDER_TOOL, managedJobMonitorReadDaemonArguments, projectManagedJobMonitorStatus, renderManagedJobMonitor } from "./mcp-job-monitor-tools.ts";
59
59
  import { closeWebSocketQuietly, daemonErrorCloseCode, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket } from "./websocket-protocol.ts";
60
- const SERVER_VERSION = "3.0.0-beta.200";
60
+ const SERVER_VERSION = "3.0.0-beta.201";
61
61
  const MCP_SERVER_INFO = mcpServerInfo(SERVER_VERSION);
62
62
  const MAX_DAEMON_MESSAGE_BYTES = 8 * 1024 * 1024;
63
63
  const DAEMON_RECONNECT_GRACE_MS = relayContract.reconnectGraceMs; const NEW_CALL_RECONNECT_GRACE_MS = relayContract.newCallReconnectGraceMs;