machine-bridge-mcp 3.0.0-beta.21 → 3.0.0-beta.22

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 3.0.0-beta.22 - 2026-07-28
+
+### ChatGPT call continuity and terminal delivery
+
+- Add an explicit daemon-result acknowledgement. The local runtime retains every terminal result after WebSocket queueing, replays unacknowledged results after reconnect and on heartbeat, and removes them only after the Worker confirms that the generation-guarded terminal transaction committed. This closes the loss window between local `send()` acceptance and Durable Object persistence that could leave a completed local command as a ghost Worker call.
+- Make durable settlement fail closed. A terminal-storage exception is observable and retryable instead of being reported as a completed call; stale connection generations remain unacknowledged, while duplicate results for an already terminal call are acknowledged idempotently so replay converges.
+- Stop treating one tool deadline as proof that the complete daemon socket is dead. Tool timeout now cancels only that call; the independent 90-second daemon-liveness alarm remains the sole connection-invalidating authority.
+- Bound remote foreground execution to 85 seconds plus five seconds of relay overhead, below the observed hosted-client request ceiling. The local process APIs retain their 600-second schema range, but work expected to exceed the interactive budget must use process sessions or managed jobs rather than one foreground ChatGPT call.
+- Tail-trim background daemon logs every 15 minutes as well as before startup, reusing the existing owner-only, no-follow, single-link, schema-checked, UTF-8 line-safe maintenance path.
+
+### Verification
+
+- Add acknowledgement-loss/replay, persistent-terminal-write failure, stale generation, hosted-client deadline, runtime log-maintenance, and real Wrangler acknowledgement coverage. Type checking, lint, architecture, privacy, structured logging, security properties, SARIF, critical coverage, local self-test, Worker infrastructure, and Worker OAuth/MCP integration pass.
+
 ## 3.0.0-beta.21 - 2026-07-27
 
 ### Relay continuity and stable MCP catalog

package/browser-extension/manifest.json

@@ -30,6 +30,6 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "3.0.0-beta.21",
+  "version_name": "3.0.0-beta.22",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxryYkpZhq8+VAQLHcGS9BAHQcyKX8RHGIpIwvtIVRU/rcOcE0bNdnM0aZJ/h6xWQsGDHlhvjT2+1aJaAn/9k8473BRWajzVXld961CdHYVFVHoce2hHiSJ0xydWrHMMZhAm0mN0UzjEpgZ0tMw209efcZHIvSwuxhteZMRy4kyiVjwFlOf5oXFCxRuCJnPj3AK9CmCf4XgEBuPIJ0TZmjGHOOdBvJmbCNnAWXYEo5/mf7MfCGhV4IJ1hNuhpoNQfOFKMUcw9/v/IpT62XpfXdGYTfGYCmCjC+gntK1spbkr2P4/2+sYMQtLpse71mpSNGXfcf3abU55Vpn+gncSxRQIDAQAB"
 }

package/docs/ARCHITECTURE.md

@@ -175,10 +175,10 @@ Remote OAuth binds each code, access token, and refresh token to a named Machine
 8. A new daemon first authenticates as a bounded `probing` socket. The Worker sends a random `relay_probe`; the local runtime returns it through the normal session-bound result-delivery path; only the matching result produces `ready_ack`, promotion to the active daemon, and safe replacement of an incumbent connection.
 9. `tools/list` is a stable package-and-account-role discovery catalog and declares `listChanged: false`; a brief relay interruption does not mutate it. `server_info.authorization.effective_tools` is the live daemon/account intersection and is the authority diagnostic.
 10. `tools/call` receives a random relay call ID and is bound to the daemon process's ephemeral instance identifier, a random per-WebSocket connection generation, and the authenticated client request key. When the client accepts `text/event-stream`, `BridgeRoom` commits recovery state plus durable call ownership and deadlines before sending the daemon envelope, then returns a bounded descriptor immediately; the outer Worker owns the SSE priming frame, keepalives, and one internal terminal subscription. No unresolved terminal Promise, JavaScript timer, or Durable Object `waitUntil` owns the streamed dispatch. JSON-only clients retain the single terminal response.
-11. The runtime validates policy and arguments, executes the tool, and returns a bounded result. Closing or losing the HTTP response stream only makes that stream unwritable; it is not an MCP cancellation and does not remove the pending request.
-12. If the socket remains ready, the Durable Object accepts the result only from that connection generation. If it drops, the Worker durably detaches the streamed call for at most two minutes and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe and atomically acquired a new connection generation. A delayed result or close event from the old socket cannot settle or detach the rebound call. The local runtime preserves the operation and queues a completion over the same shared interval. The Worker pauses the record's remaining normal deadline while detached and resumes it after same-instance rebinding, so connected calls are not granted an unconditional recovery extension.
-13. Only a matching session-scoped `notifications/cancelled` request removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with explicit cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request explicitly cancelled while disconnected therefore cannot be revived by a fast reconnect.
-14. If same-instance readiness does not return before the grace deadline, the Worker rejects the detached request and the local runtime cancels ordinary calls, terminates their process trees, and discards queued results. A newly started daemon has a different instance identifier and cannot inherit prior calls.
+11. The runtime validates policy and arguments, executes the tool, and produces a bounded result. It retains the terminal envelope after WebSocket queueing and replays it until the Worker returns `tool_result_ack`; queue acceptance is not treated as durable delivery. Closing or losing the HTTP response stream only makes that stream unwritable; it is not an MCP cancellation and does not remove the pending request.
+12. If the socket remains ready, the Durable Object accepts the result only from that connection generation and acknowledges only after transient settlement, committed durable settlement, or an idempotent already-terminal duplicate. A persistence exception is not converted into success, and a stale generation is not acknowledged. If it drops, the Worker durably detaches the streamed call for at most two minutes and accepts completion only after a replacement socket with the same daemon-process identifier has passed the end-to-end readiness probe and atomically acquired a new connection generation. A delayed result or close event from the old socket cannot settle or detach the rebound call. The local runtime preserves the operation and queues a completion over the same shared interval. The Worker pauses the record's remaining normal deadline while detached and resumes it after same-instance rebinding, so connected calls are not granted an unconditional recovery extension.
+13. The terminal store is exactly-once while daemon delivery is at-least-once. Lost acknowledgement causes heartbeat/reconnect replay; the generation guard and idempotent missing-record acknowledgement make replay converge without reviving a completed call. Only a matching session-scoped `notifications/cancelled` request removes the pending indexes and sends best-effort cancellation to a connected daemon. Local completion that races with explicit cancellation is discarded. On every readiness handover, the Worker first sends an authoritative bounded `resume_calls` set; the runtime cancels active calls and queued results absent from that set before accepting `ready_ack`. A request explicitly cancelled while disconnected therefore cannot be revived by a fast reconnect.
+14. A tool deadline cancels only that operation and never infers daemon death from tool duration. The independent daemon-liveness alarm owns socket invalidation. If same-instance readiness does not return before the grace deadline, the Worker rejects the detached request and the local runtime cancels ordinary calls, terminates their process trees, and discards queued results. A newly started daemon has a different instance identifier and cannot inherit prior calls.
 15. `start_job` is different: after durable acceptance, the detached runner is no longer bound to the relay call or socket. Later cancellation uses `cancel_job` or the local CLI.
 
 Duplicate in-flight JSON-RPC IDs are rejected only within the same authenticated MCP session. The request key includes OAuth token identity, the HMAC-bound MCP session, JSON-RPC id type, and id value, so separate initialized clients may safely reuse the same numeric id.

package/docs/AUDIT.md

@@ -1,5 +1,17 @@
 # Security and privacy audit notes
 
+## 2026-07-28 version 3.0.0-beta.22 ChatGPT interruption and full repository audit
+
+The visible symptom combined three different mechanisms that must not be collapsed into one diagnosis. First, historical 11–34 minute relay gaps aligned with macOS clamshell sleep and DarkWake intervals; those records are expected machine suspension, not evidence of an active-use Cloudflare or daemon failure. Second, a controlled foreground command requested 120 seconds but the hosted tool path abandoned it at approximately 100 seconds. Third, the live Worker retained durable `exec_command` records after the local runtime had already completed and removed the corresponding operation. The latter two mechanisms explain active-use ChatGPT interruption and ghost pending-call growth.
+
+The terminal-delivery protocol had a concrete loss window. The local runtime deleted a completed result as soon as `WebSocket.send()` accepted the frame, although that call proves only local queueing. If the connection ended before the Worker committed its generation-guarded terminal storage transaction, the runtime had neither an active operation nor a retained result to replay, while the Worker still owned the durable call. Beta.22 adds `tool_result_ack`: the runtime retains and periodically replays terminal results until acknowledgement; the Worker acknowledges only a transient settlement, a committed durable settlement, or an idempotent already-terminal duplicate. A result from a stale WebSocket generation is never acknowledged. Durable persistence failure now propagates instead of logging and falsely incrementing completion.
+
+The timeout path also crossed responsibility boundaries. A single call timeout used a 45-second socket-silence heuristic to invalidate the complete daemon connection even though daemon liveness already has an independent 90-second alarm and readiness state machine. A slow command could therefore interrupt unrelated reads and make ChatGPT lose every local surface. Beta.22 removes socket invalidation from both transient and durable call expiry; timeout sends best-effort per-call cancellation only. The liveness alarm remains the sole owner of connection invalidation. Because the hosted foreground tool path was observed to stop near 100 seconds, configurable remote operations are capped at 85 seconds plus five seconds for terminal delivery. Longer work belongs in `start_process`/`read_process` or managed jobs, subject to what the MCP host exposes.
+
+The broader review found a separate operations defect not named in the report: active daemon logs were safely trimmed before startup but could grow without another bound during a very long service lifetime. Beta.22 reuses the existing secure in-place trim every 15 minutes. The maintenance path preserves regular-file, no-follow, single-link, owner-only mode, schema, UTF-8, and line-boundary checks; failures log only a coarse class. Static review found no new secret-bearing operational logs, raw command/result logging, unbounded Worker body, public control-plane path, or obsolete transient settlement branch. Intentional migration fixtures remain confined to tests and explicit state upgrade code.
+
+Fault-directed tests cover connected and reconnect result retention, lost acknowledgement heartbeat replay, Worker acknowledgement identity, persistent terminal-write failure, stale-generation non-acknowledgement, host-safe timeout bounds, log-maintenance scheduling/failure containment, and the previous cancellation/reconnect matrix. The repository architecture line budget rejected an oversized first draft of the recovery module; the implementation was reduced below the existing boundary rather than weakening the gate.
+
 ## 2026-07-27 version 3.0.0-beta.21 relay-continuity and repository audit
 
 The reported symptom was a temporary loss of every local command surface, including `pwd`, followed by automatic daemon reconnection. Process evidence rejects the premise that the local daemon crashed: launchd retained one daemon PID, one start time, and `runs=1` throughout the observed interval. The failing layer was the relay/Worker connection and result-delivery path. Historical service logs also contain abnormal WebSocket closure and heartbeat-outage intervals that later recovered without a daemon restart. The exact network origin of each `1006` remains unknowable from those logs alone; a system VPN/TUN, proxy route, intermediary, or edge connection can all produce the same transport-level symptom.

package/docs/LOGGING.md

@@ -135,7 +135,7 @@ logs/daemon.out.log
 logs/daemon.err.log
 ```
 
-Existing files are opened without following symbolic links where supported and tail-trimmed on UTF-8/line boundaries before startup. Background services use `warn`, so ordinary tool traffic and brief relay interruptions do not cause sustained growth.
+Existing files are opened without following symbolic links where supported and tail-trimmed on UTF-8/line boundaries before startup. The active background daemon repeats the same secure trim every 15 minutes, so a long-lived process remains bounded even under repeated warning-level failures. Maintenance errors expose only a coarse error class. Background services use `warn`, so ordinary tool traffic and brief relay interruptions do not cause sustained growth.
 
 The log format has an explicit schema marker. If the marker differs from the current format, the daemon clears the active files before startup and writes the current marker. Runtime code recognizes only `daemon.out.log` and `daemon.err.log`; it does not parse or archive other log formats.
 

package/docs/OPERATIONS.md

@@ -65,6 +65,8 @@ A Worker-requested `daemon_transport_error` or `daemon_liveness_timeout` is a re
 
 For Streamable HTTP clients such as ChatGPT that advertise `text/event-stream`, the outer Worker returns an immediate sequence-zero SSE event identifier and a keepalive comment every ten seconds until the terminal sequence-one JSON-RPC result. `BridgeRoom` never owns the long-lived public stream or an unresolved terminal Promise. Stream initiation commits recovery state and then durably attaches the opaque call ID, daemon instance, WebSocket generation, request key, deadlines, and bounded transform metadata before sending work and returning a descriptor. A later WebSocket result, explicit cancellation, operation timeout, send failure, or reconnect-grace expiry writes the terminal result through one generation-checked transaction. One internal hibernatable WebSocket subscription therefore coexists with concurrent `server_info`, recovery, and session-scoped `notifications/cancelled` requests while SSE remains open, without creating a request per poll interval. Caller-supplied internal stream headers are removed at the public boundary. If the client or an intermediary closes the stream, Machine Bridge keeps the bounded operation alive; only `notifications/cancelled` carries cancellation semantics. A compatible host resumes the original stream with authenticated `GET /mcp`, the original `MCP-Session-Id`, and `Last-Event-ID`; it must not repeat the POST. Recovery records are token/session-bound, retained for at most two minutes, limited to 64 streams, and persist at most 1.5 MiB of terminal JSON. Error `-32002` means the online result exceeded the replay budget. Error `-32003` is reserved for a pending stream record that has no durable call owner after restart; a valid persisted call remains pending and recoverable. Error `-32005` means stored replay data failed integrity validation.
 
+The terminal-result protocol is at-least-once from daemon to Worker and exactly-once at the generation-guarded terminal store. The daemon retains a completed result until `tool_result_ack`, replays it after reconnect and on heartbeat, and reconciles it against the authoritative `resume_calls` set. A missing acknowledgement therefore causes bounded duplicate delivery, not a ghost call.
+
 `server_info.worker.observability.calls.unmatched_results` counts results that reached the Worker after their pending record was already removed. A small increase can accompany cancellation or timeout races, especially during mixed-version upgrade convergence; sustained growth together with old pending calls indicates incompatible components or a lifecycle defect. The counter contains no tool arguments or result data.
 
 ### MCP host or connector internal-storage errors
@@ -81,6 +83,10 @@ A brief relay interruption is retried automatically and is visible only with `--
 
 Use `--verbose` only when close codes, close reasons, heartbeat timeouts, and retry delays are needed for diagnosis. A close code of 1006 means the transport ended without a normal close handshake; it does not by itself identify the cause.
 
+Compare outage intervals with operating-system sleep/wake records before classifying them as active network failures. A suspended laptop cannot maintain the relay heartbeat, and a long outage that exactly spans clamshell sleep or DarkWake is expected suspension evidence. It does not justify credential rotation, Worker redeployment, or daemon replacement.
+
+A foreground MCP tool is not a durable job. Hosted clients may impose a request ceiling below the local tool schema; ChatGPT was observed abandoning a foreground call near 100 seconds. Machine Bridge therefore terminates remote foreground execution by 90 seconds including delivery overhead. Use `start_process` plus bounded `read_process`, or a managed job, for work that can exceed 85 seconds. If the host exposes only `exec_command`, split work into independently terminal steps rather than requesting a larger timeout.
+
 The daemon honors `HTTPS_PROXY`/`HTTP_PROXY` and `NO_PROXY` through standard environment-proxy resolution for remote Worker health and relay traffic. `wss:` targets use HTTPS proxy selection and `ws:` targets use HTTP proxy selection. Only HTTP and HTTPS proxy URLs are accepted. Invalid URLs or unsupported protocols fail startup with corrective guidance instead of entering the reconnect loop. `server_info.runtime.relay.network_route` reports `system-network-stack`, `application-http-proxy`, or `invalid-application-proxy-configuration`. This field describes only Machine Bridge application-level proxy selection: an operating-system VPN/TUN may still intercept `system-network-stack` traffic. `network_route_scope`, outage timestamps/durations, close category/code, transport error class, and next retry timing make that distinction explicit; proxy endpoints and credentials are never returned or logged. The browser-broker CLI health probe is a separate loopback-only path: it accepts only canonical `127.0.0.1`, uses direct Node HTTP with no proxy agent, and does not depend on `NO_PROXY`.
 
 ## Browser extension setup and diagnosis
@@ -182,7 +188,7 @@ Windows Task Scheduler limits the `/TR` action text, so the platform adapter wri
 
 The Windows trigger is current-user `ONLOGON` with `LIMITED` run level. After a reboot, signing in to that user is sufficient; no terminal command is required. Pre-login operation is intentionally not provided by the default design because it would require a different service-account/credential boundary. Remote autostart definitions prefer a stable PATH alias that resolves to the currently running Node executable and persist a sanitized absolute-only service `PATH` containing the current Node/package directories, the operator's inherited absolute PATH entries, and platform defaults. When installation runs through npm, all nested run-script prefixes through the final npm private `node-gyp-bin` marker are discarded; paths belonging to inactive candidate runtimes are also removed. This prevents prerelease activation from persisting source-repository shims or the prior runtime that activation subsequently prunes, while an ordinary user-supplied `node_modules/.bin` remains valid. A private allowlisted `service-environment.json` preserves `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, matching lowercase forms, optional `ALL_PROXY`, Node proxy selection, and custom-CA path variables. Existing saved values survive an environment-free reinstall, while explicitly supplied values replace case-insensitive prior variants. Values may include proxy credentials, so the file stays in owner-only state and is never returned or logged; status exposes key names only. Re-run `machine-mcp service install` after changing Node installation families, PATH layout, proxy, or CA configuration. Custom Windows state paths used for autostart must also remain within the Task Scheduler path limit and must not contain a literal `%`.
 
-A service-style `--daemon-only` start that finds the same workspace daemon already running is an idempotent no-op: it exits successfully without repeating warnings or readiness output; explicit policy/secret/change requests still report that changes were not applied. Autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Installed services pass `--log-level warn --log-format json`, so each active line is a bounded JSON event suitable for ingestion. Files are owner-only where supported and tail-trimmed before daemon startup. If the log schema marker does not match the current format, the active files are cleared before startup and the current marker is written. Runtime code reads and maintains only the active filenames.
+A service-style `--daemon-only` start that finds the same workspace daemon already running is an idempotent no-op: it exits successfully without repeating warnings or readiness output; explicit policy/secret/change requests still report that changes were not applied. Autostart logs are stored under the state root in `logs/daemon.out.log` and `logs/daemon.err.log`. Installed services pass `--log-level warn --log-format json`, so each active line is a bounded JSON event suitable for ingestion. Files are owner-only where supported and tail-trimmed before daemon startup and every 15 minutes while the background daemon remains active. Runtime maintenance reuses the same no-follow, regular-file, single-link, `0600`, schema, UTF-8, and line-boundary checks. If the log schema marker does not match the current format, the active files are cleared before startup and the current marker is written. Runtime code reads and maintains only the active filenames.
 
 Logging is level-based:
 
@@ -280,7 +286,7 @@ Defense-in-depth limits include:
 - process stdin write: 64 KiB per call;
 - local simultaneous tool calls: 16;
 - Worker pending daemon calls: 32;
-- command timeout: 1–600 seconds;
+- local command timeout schema: 1–600 seconds; remote foreground relay execution is capped at 85 seconds plus five seconds of terminal-delivery overhead;
 - process-session read wait: at most 30 seconds, measured with monotonic elapsed time;
 - direct directory result: 10,000 entries and 4 MiB of path metadata;
 - recursive walk: 200,000 visited entries;

package/docs/TESTING.md

@@ -161,6 +161,6 @@ The stdio integration test also sends an oversized line, verifies bounded reject
 
 `npm run mcp-resumption:test` directly exercises stream cursor parsing, OAuth-token/MCP-session isolation, immediate pending/terminal polls, active and completed replay, orphaned-stream restart ambiguity, persisted-call restart recovery, strict call-record validation, request-key uniqueness, operation/reconnect deadlines, repeated detach/rebind retention extension, stale-generation rejection, prototype-safe aggregation, exactly-once completion, result-size fallback, SHA-256 tamper detection, transient persistence failure, expiry, capacity, completed-record eviction, the four-row plain-stream budget, and the fixed six-row durable-call lifecycle budget.
 
-`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/subscribe adaptation, fixed request budgets, bounded transient subscription retries, outer metadata/404/invalid-method bypass, stateful burst limiting, structured and duplicate-suppressed gateway failures, coalesced alarm writes, sequence-zero/sequence-one framing, subscription-error closure, subscriber replacement, non-daemon socket isolation, and the shared two-minute/64-stream/1.5-MiB contract. It models the production durable-call boundary: initiation persists ownership without retaining a terminal Promise, later success or daemon rejection settles once, send failure cleans the record, capacity fails closed, and same-instance reconnect moves ownership to a new generation while rejecting the stale one. Deadline tests prove both JSON-only timer/sweep behavior and persisted-call alarm expiry without leaking request keys. A direct runtime-alarm coordinator test verifies the earliest transient-or-durable deadline, alarm removal when no deadline remains, event-entry expiry before rescheduling, and bounded reporting when Durable Object alarm storage fails. The same suite also proves that direct same-instance handover preserves the remaining timeout budget. `npm run worker:integration-test` performs the real Wrangler path: the role-filtered catalog remains stable before, during, and after daemon availability changes; execution still fails closed without a ready daemon; an open SSE stream coexists with concurrent `server_info` and explicit cancellation; verified same-instance replacement transfers an in-flight call before incumbent close; disconnect/recovery remains token/session isolated; and sequence-one acknowledgement is not delivered twice. Managed-job integration treats `__proto__`, `constructor`, `toString`, and `valueOf` environment/resource-map keys as ordinary own data while retaining duplicate-key rejection. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, Promise-valued recovery state, or return of the obsolete transient `registerEvent` branch. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.
+`npm run worker-runtime-infrastructure:test` verifies outer-Worker stream ownership, stripping of caller-supplied internal headers, bounded descriptor/subscribe adaptation, fixed request budgets, bounded transient subscription retries, outer metadata/404/invalid-method bypass, stateful burst limiting, structured and duplicate-suppressed gateway failures, coalesced alarm writes, sequence-zero/sequence-one framing, subscription-error closure, subscriber replacement, non-daemon socket isolation, and the shared two-minute/64-stream/1.5-MiB contract. It models the production durable-call boundary: initiation persists ownership without retaining a terminal Promise, later success or daemon rejection settles once, send failure cleans the record, capacity fails closed, and same-instance reconnect moves ownership to a new generation while rejecting the stale one. Deadline tests prove both JSON-only timer/sweep behavior and persisted-call alarm expiry without leaking request keys. A direct runtime-alarm coordinator test verifies the earliest transient-or-durable deadline, alarm removal when no deadline remains, event-entry expiry before rescheduling, and bounded reporting when Durable Object alarm storage fails. The same suite also proves that direct same-instance handover preserves the remaining timeout budget. It additionally proves terminal-result retention until Worker acknowledgement, heartbeat replay after acknowledgement loss, stale-generation non-acknowledgement, propagation of durable terminal-write failure without false completion, and the 85-second interactive execution plus five-second delivery budget. Local infrastructure coverage verifies periodic secure autostart-log trimming and contains maintenance failure without leaking exception text. `npm run worker:integration-test` performs the real Wrangler path: the role-filtered catalog remains stable before, during, and after daemon availability changes; execution still fails closed without a ready daemon; an open SSE stream coexists with concurrent `server_info` and explicit cancellation; verified same-instance replacement transfers an in-flight call before incumbent close; disconnect/recovery remains token/session isolated; and sequence-one acknowledgement is not delivered twice. Managed-job integration treats `__proto__`, `constructor`, `toString`, and `valueOf` environment/resource-map keys as ordinary own data while retaining duplicate-key rejection. Static architecture checks forbid a stream-initiation `dispatchJsonRpc` Promise, `resumption.attach`, Durable Object `waitUntil`, Promise-valued recovery state, or return of the obsolete transient `registerEvent` branch. The parser accumulates complete SSE events and does not assume network chunk boundaries. CORS coverage requires both `DPoP` and `Last-Event-ID`.
 
 Beta.21 closeout requires a fresh pass of the complete 63-task fast plan and 91-task full plan after the final relay error-classification changes; an earlier green run cannot be reused as terminal evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "3.0.0-beta.21",
+  "version": "3.0.0-beta.22",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",

package/src/local/autostart-log-maintenance.mjs

@@ -0,0 +1,36 @@
+// @ts-check
+
+import { trimAutostartLogs } from "./service.mjs";
+
+const DEFAULT_MAINTENANCE_INTERVAL_MS = 15 * 60 * 1000;
+
+/**
+ * Keep long-lived background-service logs within the same bounds enforced at
+ * startup. The injected scheduler/trim hooks keep the lifecycle deterministic
+ * in tests without weakening the production file-safety checks.
+ *
+ * @param {string} stateRoot
+ * @param {{
+ *   intervalMs?: number,
+ *   trim?: (stateRoot: string) => void,
+ *   onError?: (error: unknown) => void,
+ *   scheduler?: {setInterval: (callback: () => void, delay: number) => any},
+ * }} [options]
+ */
+export function startAutostartLogMaintenance(stateRoot, options = {}) {
+  const intervalMs = positiveInteger(options.intervalMs, DEFAULT_MAINTENANCE_INTERVAL_MS);
+  const trim = typeof options.trim === "function" ? options.trim : trimAutostartLogs;
+  const onError = typeof options.onError === "function" ? options.onError : () => {};
+  const scheduler = options.scheduler || { setInterval };
+  const maintain = () => {
+    try { trim(stateRoot); } catch (error) { onError(error); }
+  };
+  const timer = scheduler.setInterval(maintain, intervalMs);
+  timer?.unref?.();
+  return { intervalMs, maintain };
+}
+
+function positiveInteger(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
+}

package/src/local/cli.mjs

@@ -287,6 +287,16 @@ async function startRemoteRuntime({ args, workspace, state, daemonLock, logger }
     runtime = createRemoteRuntime({ args, workspace, state, daemonLock, deviceSessionIdentity: readiness.deviceSessionIdentity });
     await runtime.start();
     reportRemoteReady(args, state, readiness, logger);
+    if (args.daemonOnly) {
+      const { startAutostartLogMaintenance } = await import("./autostart-log-maintenance.mjs");
+      startAutostartLogMaintenance(state.paths.stateRoot, {
+        onError(error) {
+          logger.event?.("warn", "service.log_maintenance.failed", {
+            error_class: classifyOperationalError(error),
+          }, "Background log maintenance failed");
+        },
+      });
+    }
     keepProcessAlive({ daemon: runtime, lock: daemonLock, logger });
   } catch (error) {
     try { runtime?.stop?.(); } catch {}

package/src/local/relay-call-recovery.mjs

@@ -43,28 +43,36 @@ export class RelayCallRecovery {
   /** @param {RelayResult} response */
   deliver(response) {
     const callId = String(response?.id || "");
-    if (this.send(response)) {
-      if (callId) this.pendingResults.delete(callId);
-      return true;
-    }
-    if (callId && this.isRecoverable()) {
-      this.pendingResults.set(callId, response);
-      this.scheduleExpiry();
-      this.logger.event?.("debug", "relay.tool_result.queued", {
-        call_id: shortCallId(callId), queued_results: this.pendingResults.size,
-      }, "Queued a completed tool result while the relay reconnects");
+    if (!callId) return this.send(response);
+    if (!this.isRecoverable()) {
+      this.logger.event?.("debug", "relay.tool_result.discarded", {
+        call_id: shortCallId(callId), reason: "transport_unavailable",
+      }, "Discarded a tool result because the relay is no longer recoverable");
       return false;
     }
-    this.logger.event?.("debug", "relay.tool_result.discarded", {
-      call_id: shortCallId(callId), reason: "transport_unavailable",
-    }, "Discarded a tool result because the relay is no longer recoverable");
+
+    // Retain sent results until the Worker commits and acknowledges them.
+    this.pendingResults.set(callId, response);
+    const sent = this.send(response);
+    if (sent) {
+      this.logger.event?.("debug", "relay.tool_result.awaiting_ack", {
+        call_id: shortCallId(callId), unacknowledged_results: this.pendingResults.size,
+      }, "Delivered a tool result and retained it until Worker acknowledgement");
+      return true;
+    }
+
+    this.scheduleExpiry();
+    this.logger.event?.("debug", "relay.tool_result.queued", {
+      call_id: shortCallId(callId), queued_results: this.pendingResults.size,
+    }, "Queued a completed tool result while the relay reconnects");
     return false;
   }
 
   /** @param {unknown} callId */
-  discard(callId) {
-    return this.pendingResults.delete(String(callId));
-  }
+  acknowledge(callId) { return this.pendingResults.delete(String(callId)); }
+
+  /** @param {unknown} callId */
+  discard(callId) { return this.pendingResults.delete(String(callId)); }
 
   /** @param {Iterable<string>} resumedCallIds @param {(callId: string) => boolean} cancelCall */
   reconcile(resumedCallIds, cancelCall) {
@@ -94,18 +102,29 @@ export class RelayCallRecovery {
 
   ready() {
     this.clearTimer();
+    this.retryUnacknowledged("reconnected");
+  }
+
+  pulse() {
+    this.retryUnacknowledged("heartbeat");
+  }
+
+  /** @param {string} reason */
+  retryUnacknowledged(reason) {
     let delivered = 0;
-    for (const [callId, response] of [...this.pendingResults]) {
+    for (const response of this.pendingResults.values()) {
       if (!this.send(response)) {
         this.scheduleExpiry();
         break;
       }
-      this.pendingResults.delete(callId);
       delivered += 1;
     }
     if (delivered > 0) {
-      this.logger.event?.("info", "relay.tool_results.replayed", { delivered_results: delivered },
-        "Delivered completed tool results after the relay reconnected");
+      this.logger.event?.(reason === "reconnected" ? "info" : "debug", "relay.tool_results.replayed", {
+        delivered_results: delivered,
+        reason,
+        unacknowledged_results: this.pendingResults.size,
+      }, "Replayed completed tool results awaiting Worker acknowledgement");
     }
   }
 
@@ -122,7 +141,7 @@ export class RelayCallRecovery {
       const cancelled = this.cancelOrigin("remote relay reconnect grace expired");
       const discarded = this.pendingResults.size;
       this.pendingResults.clear();
-      this.terminate();
+      if (cancelled > 0) this.terminate();
       if (cancelled > 0 || discarded > 0) {
         this.logger.warn?.(`remote relay did not recover within ${this.graceMs / 1000} seconds; cancelled ${cancelled} call(s) and discarded ${discarded} queued result(s)`);
       }

package/src/local/runtime.mjs

@@ -334,7 +334,20 @@ export class LocalRuntime {
       this.relayResumeSessionId = 0;
       return true;
     }
-    if (message.type === "pong") return true;
+    if (message.type === "pong") {
+      this.relayCallRecovery.pulse();
+      return true;
+    }
+    if (message.type === "tool_result_ack") {
+      if (!isRelayReadyContext(relayContext, this.relay)
+          || typeof message.id !== "string"
+          || !/^call_[A-Za-z0-9_-]{8,240}$/.test(message.id)) {
+        this.handleRelayProtocolViolation("invalid_tool_result_ack");
+        return true;
+      }
+      this.relayCallRecovery.acknowledge(message.id);
+      return true;
+    }
     if (message.type === "error") {
       this.relay?.handleServerError(message);
       return true;

package/src/shared/relay-contract.json

@@ -2,6 +2,7 @@
   "reconnectGraceMs": 120000,
   "streamHeartbeatMs": 10000,
   "maximumExecutionTimeoutMs": 600000,
+  "maximumInteractiveExecutionTimeoutMs": 85000,
   "toolCallOverheadMs": 5000,
   "maximumRelayToolTimeoutMs": 610000,
   "streamResumeRetentionMs": 120000,

package/src/worker/durable-stream-calls.ts

@@ -1,4 +1,3 @@
-import { daemonLastSeenMs } from "./daemon-liveness.ts";
 import type { DaemonSocketRegistry } from "./daemon-sockets.ts";
 import { publicWorkerToolError, WorkerToolError } from "./errors.ts";
 import { workerErrorClass } from "./http.ts";
@@ -9,13 +8,6 @@ import { transformDurableStreamOutcome } from "./durable-stream-result.ts";
 import type { WorkerObservability } from "./observability.ts";
 import { sendWebSocketQuietly } from "./websocket-protocol.ts";
 
-type InvalidateDaemonSocket = (
-  socket: WebSocket,
-  message: string,
-  closeReason: string,
-  errorCode?: string,
-) => Promise<void>;
-
 type TransientPendingSnapshot = {
   active: number;
   detached: number;
@@ -29,20 +21,17 @@ export class DurableStreamCallCoordinator {
   private readonly daemonRegistry: DaemonSocketRegistry;
   private readonly observability: WorkerObservability;
   private readonly maximumPendingCalls: number;
-  private readonly invalidateDaemonSocket: InvalidateDaemonSocket;
 
   constructor(
     calls: McpPendingCallStore,
     daemonRegistry: DaemonSocketRegistry,
     observability: WorkerObservability,
     maximumPendingCalls: number,
-    invalidateDaemonSocket: InvalidateDaemonSocket,
   ) {
     this.calls = calls;
     this.daemonRegistry = daemonRegistry;
     this.observability = observability;
     this.maximumPendingCalls = maximumPendingCalls;
-    this.invalidateDaemonSocket = invalidateDaemonSocket;
   }
 
   async snapshot(transient: TransientPendingSnapshot): Promise<Record<string, unknown>> {
@@ -66,9 +55,10 @@ export class DurableStreamCallCoordinator {
     connectionId: string,
     outcome: PendingCallOutcome,
     knownCall?: PendingStreamCallView,
-  ): Promise<boolean> {
+  ): Promise<"committed" | "missing" | "stale"> {
     const call = knownCall ?? await this.calls.get(callId);
-    if (!call || call.connection_id !== connectionId) return false;
+    if (!call) return "missing";
+    if (call.connection_id !== connectionId) return "stale";
     const normalized = transformDurableStreamOutcome(call, outcome);
     const code = normalized.ok ? "" : publicWorkerToolError(normalized.error).code;
     try {
@@ -77,23 +67,21 @@ export class DurableStreamCallCoordinator {
         connectionId,
         streamTerminalMessage(call.requestId, normalized),
       );
-      if (!completed) return false;
+      if (!completed) {
+        const current = await this.calls.get(callId);
+        return current ? "stale" : "missing";
+      }
     } catch (error) {
       this.observability.event("error", "mcp.stream.persist.failed", { error_class: workerErrorClass(error) });
+      throw error;
     }
     this.observability.callFinished(call.tool, code);
-    return true;
+    return "committed";
   }
 
   async expire(call: PendingStreamCallView): Promise<void> {
     const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
-    if (socket) {
-      sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
-      const silentForMs = Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(socket));
-      if (!Number.isFinite(silentForMs) || silentForMs > 45_000) {
-        void this.invalidateDaemonSocket(socket, "daemon became unresponsive", "daemon liveness timeout");
-      }
-    }
+    if (socket) sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
     const error = call.state === "attached"
       ? new WorkerToolError("timeout", `daemon tool timed out: ${call.tool}`, true)
       : new WorkerToolError("unavailable", "daemon disconnected; reconnect grace expired", true);
@@ -111,12 +99,12 @@ export class DurableStreamCallCoordinator {
     if (!call) return false;
     const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
     if (socket) sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
-    return this.settle(
+    return (await this.settle(
       call.call_id,
       call.connection_id,
       { ok: false, error: new WorkerToolError("cancelled", "tool call cancelled by client") },
       call,
-    );
+    )) === "committed";
   }
 
   detach(connectionId: string, graceMs: number): Promise<number> {

package/src/worker/index.ts

@@ -7,7 +7,6 @@ import type { PendingCallOutcome } from "./pending-call-contract.ts";
 import {
   DAEMON_LIVENESS_TIMEOUT_MS,
   DAEMON_READY_TIMEOUT_MS,
-  daemonLastSeenMs,
   daemonLivenessDeadlineMs,
   isFreshDaemonCandidate,
 } from "./daemon-liveness.ts";
@@ -50,7 +49,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "3.0.0-beta.21";
+const SERVER_VERSION = "3.0.0-beta.22";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -99,7 +98,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       this.daemonRegistry,
       this.observability,
       MAX_PENDING_CALLS,
-      (socket, message, closeReason, errorCode) => this.invalidateDaemonSocket(socket, message, closeReason, errorCode),
     );
   }
 
@@ -343,9 +341,13 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     let matched = outcome.ok
       ? await this.pending.resolve(body.id, ws, outcome.value)
       : await this.pending.reject(body.id, outcome.error, ws);
+    let acknowledge = Boolean(matched);
     if (!matched && socketAttachment.connectionId) {
-      matched = await this.durableCalls.settle(body.id, socketAttachment.connectionId, outcome);
+      const settlement = await this.durableCalls.settle(body.id, socketAttachment.connectionId, outcome);
+      matched = settlement === "committed";
+      acknowledge = settlement !== "stale";
     }
+    if (acknowledge) trySendWebSocket(ws, { type: "tool_result_ack", id: body.id });
     if (!matched) this.observability.unmatchedResult();
     else await this.scheduleRuntimeAlarm();
   }
@@ -630,10 +632,6 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
   }
   private daemonCallTimeout(record: import("./pending-call-contract.ts").PendingCallRecord, name: string): Error {
     if (record.socket) sendWebSocketQuietly(record.socket, { type: "cancel_call", id: record.id });
-    const silentForMs = record.socket ? Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(record.socket)) : 0;
-    if (record.socket && (!Number.isFinite(silentForMs) || silentForMs > 45_000)) {
-      void this.invalidateDaemonSocket(record.socket, "daemon became unresponsive", "daemon liveness timeout");
-    }
     return new WorkerToolError("timeout", `daemon tool timed out: ${name}`, true);
   }
 

package/src/worker/tool-timeout.ts

@@ -10,7 +10,11 @@ export function daemonToolTimeoutMs(name: string, args: Record<string, unknown>)
   ]);
   if (!configurable.has(name)) return 60_000;
   const seconds = clampNumber(args.timeout_seconds, name === "browser_fill_form" ? 60 : 120, 1, 600);
-  const executionMs = Math.min(seconds * 1000, relayContract.maximumExecutionTimeoutMs);
+  const executionMs = Math.min(
+    seconds * 1000,
+    relayContract.maximumExecutionTimeoutMs,
+    relayContract.maximumInteractiveExecutionTimeoutMs,
+  );
   return Math.min(executionMs + relayContract.toolCallOverheadMs, relayContract.maximumRelayToolTimeoutMs);
 }