machine-bridge-mcp 3.0.0-beta.21 → 3.0.0-beta.26

package/src/shared/tool-argument-validation.mjs

@@ -0,0 +1,325 @@
+export const JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+
+const SUPPORTED_TYPES = new Set(["null", "boolean", "object", "array", "number", "integer", "string"]);
+const SUPPORTED_KEYWORDS = new Set([
+  "$schema", "type", "enum", "const", "default", "title", "description",
+  "properties", "required", "additionalProperties", "items",
+  "minItems", "maxItems", "minLength", "maxLength", "pattern",
+  "minimum", "maximum", "exclusiveMinimum", "exclusiveMaximum", "multipleOf",
+  "minProperties", "maxProperties", "allOf", "anyOf", "oneOf", "not",
+  "if", "then", "else", "x-mcp-header",
+]);
+const DEFAULT_LIMITS = Object.freeze({
+  maximumDepth: 32, maximumNodes: 4096, maximumIssues: 16, maximumPatternLength: 2048, maximumValidationSteps: 65_536,
+});
+
+export class ToolSchemaContractError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolSchemaContractError";
+  }
+}
+
+export class ToolArgumentValidationError extends Error {
+  constructor(tool, issues) {
+    super(`tool arguments do not match the input schema: ${tool}`);
+    this.name = "ToolArgumentValidationError";
+    this.code = "invalid_request";
+    this.retryable = false;
+    this.details = Object.freeze({
+      tool: String(tool),
+      validation_issues: Object.freeze(issues.map((issue) => Object.freeze({ ...issue }))),
+    });
+  }
+}
+
+export function compileToolArgumentValidators(tools, options = {}) {
+  if (!Array.isArray(tools)) throw new ToolSchemaContractError("tool catalog must be an array");
+  const limits = normalizeLimits(options);
+  const state = { nodes: 0, limits };
+  const validators = new Map();
+  for (const tool of tools) {
+    if (!isRecord(tool) || typeof tool.name !== "string" || !tool.name) {
+      throw new ToolSchemaContractError("tool catalog contains an invalid tool definition");
+    }
+    if (validators.has(tool.name)) throw new ToolSchemaContractError(`duplicate tool schema: ${tool.name}`);
+    const schema = tool.inputSchema ?? { type: "object" };
+    const compiled = compileSchema(schema, `tool ${tool.name}.inputSchema`, 0, state);
+    if (!compiled.types?.includes("object")) {
+      throw new ToolSchemaContractError(`tool ${tool.name} input schema must declare type object`);
+    }
+    validators.set(tool.name, compiled);
+  }
+  return Object.freeze({
+    names: Object.freeze([...validators.keys()]),
+    has(tool) { return validators.has(String(tool)); },
+    validate(tool, value) {
+      const name = String(tool || "");
+      const schema = validators.get(name);
+      if (!schema) return Object.freeze({ known: false, valid: false, issues: Object.freeze([]) });
+      const issues = [];
+      const budget = { remaining: limits.maximumValidationSteps };
+      try { validateNode(schema, value, "", issues, limits.maximumIssues, budget); }
+      catch (error) {
+        if (error !== VALIDATION_BUDGET_EXCEEDED) throw error;
+        pushIssue(issues, "", "validationBudget", "validation exceeded the bounded work budget", limits.maximumIssues);
+      }
+      return Object.freeze({ known: true, valid: issues.length === 0, issues: Object.freeze(issues) });
+    },
+    assert(tool, value) {
+      const result = this.validate(tool, value);
+      if (!result.known) throw new ToolSchemaContractError("unknown tool schema");
+      if (!result.valid) throw new ToolArgumentValidationError(tool, result.issues);
+      return value;
+    },
+  });
+}
+
+function compileSchema(schema, label, depth, state) {
+  if (schema === true) return { boolean: true };
+  if (schema === false) return { boolean: false };
+  if (!isRecord(schema)) throw new ToolSchemaContractError(`${label} must be an object or boolean schema`);
+  if (depth > state.limits.maximumDepth) throw new ToolSchemaContractError(`${label} exceeds maximum schema depth`);
+  state.nodes += 1;
+  if (state.nodes > state.limits.maximumNodes) throw new ToolSchemaContractError("tool catalog exceeds maximum schema node count");
+  for (const key of Object.keys(schema)) {
+    if (!SUPPORTED_KEYWORDS.has(key)) throw new ToolSchemaContractError(`${label} uses unsupported JSON Schema keyword: ${key}`);
+  }
+  validateDialect(schema.$schema, label);
+  const types = compileTypes(schema.type, label);
+  const node = { types };
+  if (Object.hasOwn(schema, "const")) node.constValue = structuredClone(schema.const);
+  if (Object.hasOwn(schema, "enum")) node.enumValues = compileEnum(schema.enum, label);
+  if (schema.pattern !== undefined) {
+    if (typeof schema.pattern !== "string" || schema.pattern.length > state.limits.maximumPatternLength) {
+      throw new ToolSchemaContractError(`${label}.pattern is invalid or too large`);
+    }
+    try { node.pattern = new RegExp(schema.pattern, "u"); }
+    catch { throw new ToolSchemaContractError(`${label}.pattern is not a valid ECMAScript regular expression`); }
+  }
+  for (const key of ["minLength", "maxLength", "minItems", "maxItems", "minProperties", "maxProperties"]) {
+    if (schema[key] !== undefined) node[key] = nonNegativeInteger(schema[key], `${label}.${key}`);
+  }
+  for (const key of ["minimum", "maximum", "exclusiveMinimum", "exclusiveMaximum"]) {
+    if (schema[key] !== undefined) node[key] = finiteNumber(schema[key], `${label}.${key}`);
+  }
+  if (schema.multipleOf !== undefined) {
+    node.multipleOf = finiteNumber(schema.multipleOf, `${label}.multipleOf`);
+    if (node.multipleOf <= 0) throw new ToolSchemaContractError(`${label}.multipleOf must be greater than zero`);
+  }
+  if (schema.properties !== undefined) {
+    if (!isRecord(schema.properties)) throw new ToolSchemaContractError(`${label}.properties must be an object`);
+    node.properties = new Map(Object.entries(schema.properties).map(([key, child]) => [
+      key, compileSchema(child, `${label}.properties.${key}`, depth + 1, state),
+    ]));
+  }
+  if (schema.required !== undefined) {
+    if (!Array.isArray(schema.required) || !schema.required.every((value) => typeof value === "string")) {
+      throw new ToolSchemaContractError(`${label}.required must be an array of strings`);
+    }
+    if (new Set(schema.required).size !== schema.required.length) throw new ToolSchemaContractError(`${label}.required contains duplicates`);
+    node.required = Object.freeze([...schema.required]);
+  }
+  if (schema.additionalProperties !== undefined) {
+    node.additionalProperties = typeof schema.additionalProperties === "boolean"
+      ? schema.additionalProperties
+      : compileSchema(schema.additionalProperties, `${label}.additionalProperties`, depth + 1, state);
+  }
+  if (schema.items !== undefined) node.items = compileSchema(schema.items, `${label}.items`, depth + 1, state);
+  for (const key of ["allOf", "anyOf", "oneOf"]) {
+    if (schema[key] !== undefined) {
+      if (!Array.isArray(schema[key]) || schema[key].length === 0) throw new ToolSchemaContractError(`${label}.${key} must be a non-empty array`);
+      node[key] = schema[key].map((child, index) => compileSchema(child, `${label}.${key}[${index}]`, depth + 1, state));
+    }
+  }
+  for (const key of ["not", "if", "then", "else"]) {
+    if (schema[key] !== undefined) node[key] = compileSchema(schema[key], `${label}.${key}`, depth + 1, state);
+  }
+  return node;
+}
+
+const VALIDATION_BUDGET_EXCEEDED = Object.freeze({ code: "validation_budget_exceeded" });
+
+function validateNode(node, value, instancePath, issues, maximumIssues, budget) {
+  if (issues.length >= maximumIssues) return;
+  if (budget.remaining <= 0) throw VALIDATION_BUDGET_EXCEEDED;
+  budget.remaining -= 1;
+  if (node.boolean === true) return;
+  if (node.boolean === false) return pushIssue(issues, instancePath, "falseSchema", "value is rejected by the schema", maximumIssues);
+  if (node.types && !node.types.some((type) => matchesType(type, value))) {
+    pushIssue(issues, instancePath, "type", `must be ${node.types.join(" or ")}`, maximumIssues);
+    return;
+  }
+  if (node.constValue !== undefined && !jsonEqual(value, node.constValue)) {
+    pushIssue(issues, instancePath, "const", "must equal the declared constant", maximumIssues);
+  }
+  if (node.enumValues && !node.enumValues.some((candidate) => jsonEqual(value, candidate))) {
+    pushIssue(issues, instancePath, "enum", "must equal one of the allowed values", maximumIssues);
+  }
+  if (typeof value === "string") validateString(node, value, instancePath, issues, maximumIssues);
+  if (typeof value === "number") validateNumber(node, value, instancePath, issues, maximumIssues);
+  if (Array.isArray(value)) validateArray(node, value, instancePath, issues, maximumIssues, budget);
+  else if (isRecord(value)) validateObject(node, value, instancePath, issues, maximumIssues, budget);
+  validateComposition(node, value, instancePath, issues, maximumIssues, budget);
+}
+
+function validateString(node, value, path, issues, maximumIssues) {
+  if (node.minLength !== undefined || node.maxLength !== undefined) {
+    const length = boundedCodePointLength(value, node.minLength, node.maxLength);
+    if (node.minLength !== undefined && length < node.minLength) pushIssue(issues, path, "minLength", `must contain at least ${node.minLength} characters`, maximumIssues);
+    if (node.maxLength !== undefined && length > node.maxLength) pushIssue(issues, path, "maxLength", `must contain at most ${node.maxLength} characters`, maximumIssues);
+  }
+  if (node.pattern && !node.pattern.test(value)) pushIssue(issues, path, "pattern", "must match the declared pattern", maximumIssues);
+}
+
+function boundedCodePointLength(value, minimum, maximum) {
+  const stopAt = maximum !== undefined ? maximum + 1 : minimum;
+  let length = 0;
+  for (let offset = 0; offset < value.length && (stopAt === undefined || length < stopAt); length += 1) {
+    const point = value.codePointAt(offset);
+    offset += point > 0xFFFF ? 2 : 1;
+  }
+  return length;
+}
+
+function validateNumber(node, value, path, issues, maximumIssues) {
+  if (!Number.isFinite(value)) return pushIssue(issues, path, "type", "must be a finite number", maximumIssues);
+  if (node.minimum !== undefined && value < node.minimum) pushIssue(issues, path, "minimum", `must be at least ${node.minimum}`, maximumIssues);
+  if (node.maximum !== undefined && value > node.maximum) pushIssue(issues, path, "maximum", `must be at most ${node.maximum}`, maximumIssues);
+  if (node.exclusiveMinimum !== undefined && value <= node.exclusiveMinimum) pushIssue(issues, path, "exclusiveMinimum", `must be greater than ${node.exclusiveMinimum}`, maximumIssues);
+  if (node.exclusiveMaximum !== undefined && value >= node.exclusiveMaximum) pushIssue(issues, path, "exclusiveMaximum", `must be less than ${node.exclusiveMaximum}`, maximumIssues);
+  if (node.multipleOf !== undefined && !isMultipleOf(value, node.multipleOf)) pushIssue(issues, path, "multipleOf", `must be a multiple of ${node.multipleOf}`, maximumIssues);
+}
+
+function validateArray(node, value, path, issues, maximumIssues, budget) {
+  if (node.minItems !== undefined && value.length < node.minItems) pushIssue(issues, path, "minItems", `must contain at least ${node.minItems} items`, maximumIssues);
+  if (node.maxItems !== undefined && value.length > node.maxItems) pushIssue(issues, path, "maxItems", `must contain at most ${node.maxItems} items`, maximumIssues);
+  if (node.items) value.forEach((item, index) => validateNode(node.items, item, `${path}/${index}`, issues, maximumIssues, budget));
+}
+
+function validateObject(node, value, path, issues, maximumIssues, budget) {
+  for (const required of node.required ?? []) {
+    if (!Object.hasOwn(value, required)) pushIssue(issues, path, "required", `missing required property ${required}`, maximumIssues);
+  }
+  let propertyCount = 0;
+  for (const key in value) {
+    if (!Object.hasOwn(value, key)) continue;
+    if (budget.remaining <= 0) throw VALIDATION_BUDGET_EXCEEDED;
+    budget.remaining -= 1;
+    propertyCount += 1;
+    const child = node.properties?.get(key);
+    if (child) validateNode(child, value[key], `${path}/${escapePointer(key)}`, issues, maximumIssues, budget);
+    else if (node.additionalProperties === false) pushIssue(issues, `${path}/${escapePointer(key)}`, "additionalProperties", "property is not allowed", maximumIssues);
+    else if (node.additionalProperties && node.additionalProperties !== true) validateNode(node.additionalProperties, value[key], `${path}/${escapePointer(key)}`, issues, maximumIssues, budget);
+  }
+  if (node.minProperties !== undefined && propertyCount < node.minProperties) pushIssue(issues, path, "minProperties", `must contain at least ${node.minProperties} properties`, maximumIssues);
+  if (node.maxProperties !== undefined && propertyCount > node.maxProperties) pushIssue(issues, path, "maxProperties", `must contain at most ${node.maxProperties} properties`, maximumIssues);
+}
+
+function validateComposition(node, value, path, issues, maximumIssues, budget) {
+  if (node.allOf) for (const child of node.allOf) validateNode(child, value, path, issues, maximumIssues, budget);
+  if (node.anyOf && !node.anyOf.some((child) => isValid(child, value, budget))) pushIssue(issues, path, "anyOf", "must match at least one schema", maximumIssues);
+  if (node.oneOf) {
+    const matches = node.oneOf.reduce((count, child) => count + Number(isValid(child, value, budget)), 0);
+    if (matches !== 1) pushIssue(issues, path, "oneOf", "must match exactly one schema", maximumIssues);
+  }
+  if (node.not && isValid(node.not, value, budget)) pushIssue(issues, path, "not", "must not match the excluded schema", maximumIssues);
+  if (node.if) {
+    const branch = isValid(node.if, value, budget) ? node.then : node.else;
+    if (branch) validateNode(branch, value, path, issues, maximumIssues, budget);
+  }
+}
+
+function isValid(node, value, budget) {
+  const issues = [];
+  validateNode(node, value, "", issues, 1, budget);
+  return issues.length === 0;
+}
+
+function compileTypes(value, label) {
+  if (value === undefined) return undefined;
+  const values = Array.isArray(value) ? value : [value];
+  if (values.length === 0 || !values.every((type) => typeof type === "string" && SUPPORTED_TYPES.has(type))) {
+    throw new ToolSchemaContractError(`${label}.type is invalid`);
+  }
+  if (new Set(values).size !== values.length) throw new ToolSchemaContractError(`${label}.type contains duplicates`);
+  return Object.freeze([...values]);
+}
+
+function compileEnum(value, label) {
+  if (!Array.isArray(value) || value.length === 0) throw new ToolSchemaContractError(`${label}.enum must be a non-empty array`);
+  for (let left = 0; left < value.length; left += 1) {
+    for (let right = left + 1; right < value.length; right += 1) {
+      if (jsonEqual(value[left], value[right])) throw new ToolSchemaContractError(`${label}.enum contains duplicate values`);
+    }
+  }
+  return structuredClone(value);
+}
+
+function validateDialect(value, label) {
+  if (value === undefined) return;
+  if (value !== JSON_SCHEMA_2020_12 && value !== `${JSON_SCHEMA_2020_12}#`) {
+    throw new ToolSchemaContractError(`${label} uses an unsupported JSON Schema dialect`);
+  }
+}
+
+function matchesType(type, value) {
+  if (type === "null") return value === null;
+  if (type === "array") return Array.isArray(value);
+  if (type === "object") return isRecord(value);
+  if (type === "integer") return typeof value === "number" && Number.isInteger(value);
+  if (type === "number") return typeof value === "number" && Number.isFinite(value);
+  return typeof value === type;
+}
+
+function jsonEqual(left, right) {
+  if (Object.is(left, right)) return true;
+  if (Array.isArray(left) && Array.isArray(right)) {
+    return left.length === right.length && left.every((value, index) => jsonEqual(value, right[index]));
+  }
+  if (isRecord(left) && isRecord(right)) {
+    const leftKeys = Object.keys(left);
+    const rightKeys = Object.keys(right);
+    return leftKeys.length === rightKeys.length && leftKeys.every((key) => Object.hasOwn(right, key) && jsonEqual(left[key], right[key]));
+  }
+  return false;
+}
+
+function isMultipleOf(value, divisor) {
+  const quotient = value / divisor;
+  return Number.isFinite(quotient) && Math.abs(quotient - Math.round(quotient)) <= Number.EPSILON * Math.max(1, Math.abs(quotient)) * 4;
+}
+
+function pushIssue(issues, instancePath, keyword, message, maximumIssues) {
+  if (issues.length >= maximumIssues) return;
+  issues.push(Object.freeze({ instancePath: instancePath || "", keyword, message }));
+}
+
+function normalizeLimits(value) {
+  const limits = {};
+  for (const [key, fallback] of Object.entries(DEFAULT_LIMITS)) {
+    const candidate = Number(value[key]);
+    limits[key] = Number.isInteger(candidate) && candidate > 0 ? candidate : fallback;
+  }
+  return Object.freeze(limits);
+}
+
+function nonNegativeInteger(value, label) {
+  if (!Number.isInteger(value) || value < 0) throw new ToolSchemaContractError(`${label} must be a non-negative integer`);
+  return value;
+}
+
+function finiteNumber(value, label) {
+  if (typeof value !== "number" || !Number.isFinite(value)) throw new ToolSchemaContractError(`${label} must be a finite number`);
+  return value;
+}
+
+function escapePointer(value) {
+  return String(value).replaceAll("~", "~0").replaceAll("/", "~1");
+}
+
+function isRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}

package/src/shared/tool-catalog.json

@@ -2,7 +2,7 @@
   {
     "name": "server_info",
     "title": "Server information",
-    "description": "Return authenticated account authority, effective policy/tools, daemon capability ceiling, runtime metadata, and protocol status. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.",
+    "description": "Return live authorization, effective tools, daemon/relay health, runtime state, and protocol status. Use this for authority or connectivity diagnosis, not for repository inventory. Treat authorization.effective_policy and authorization.effective_tools as authoritative; daemon.policy is only a ceiling.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -18,7 +18,7 @@
   {
     "name": "project_overview",
     "title": "Project overview",
-    "description": "Summarize the connected workspace and repository. Remote responses report the authenticated account effective policy/tools at policy and tools, with the daemon capability ceiling preserved separately as daemonPolicy and daemonTools.",
+    "description": "Summarize the connected workspace, repository root, top-level entries, and project-facing runtime context. Use this for repository inventory, not as the primary live relay-health check. Remote responses report authenticated-account effective policy/tools separately from the daemon capability ceiling.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -34,7 +34,7 @@
   {
     "name": "session_bootstrap",
     "title": "Load session bootstrap",
-    "description": "Load built-in working agreements, bounded automatic project facts, user-global and root workspace instructions, and capability refresh metadata for MCP session initialization.",
+    "description": "Load built-in working agreements, bounded automatic project facts, user-global and root workspace instructions, and capability refresh metadata. Modern clients call it explicitly; legacy initialize clients receive the same bounded guidance through the compatibility adapter.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -57,7 +57,7 @@
   {
     "name": "resolve_task_capabilities",
     "title": "Resolve task capabilities",
-    "description": "Rescan built-in and automatic project context, local instruction files, skills, explicit and automatic package commands, installed applications, and browser capability metadata; rank the capabilities relevant to the current task and optionally load the best skill.",
+    "description": "Rescan task-relevant instructions, skills, registered commands, installed applications, browser metadata, and the effective tool catalog. Return bounded set-level execution routes, ranked tools, routing ambiguity, and an optional selected skill. Pass known_refresh_fingerprint to omit unchanged static instructions while recomputing task-specific ranking. The result is advisory: direct Bash and every other policy-allowed tool remain available.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -88,6 +88,12 @@
         "include_selected_skill": {
           "type": "boolean",
           "default": true
+        },
+        "known_refresh_fingerprint": {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$",
+          "maxLength": 64,
+          "description": "Previous refresh fingerprint. When it still matches, unchanged static instructions are omitted while task-specific ranking is recomputed."
         }
       },
       "required": [
@@ -356,7 +362,7 @@
   {
     "name": "browser_list_tabs",
     "title": "List browser tabs",
-    "description": "List tabs from the paired user's existing Chromium browser profile.",
+    "description": "Read the tab inventory from the paired existing Chromium profile without creating, activating, or closing a tab. Use browser_manage_tabs for tab mutations.",
     "availability": "full",
     "annotations": {
       "readOnlyHint": true,
@@ -388,7 +394,7 @@
   {
     "name": "browser_manage_tabs",
     "title": "Manage browser tabs",
-    "description": "Create, activate, or close tabs in the paired existing browser profile.",
+    "description": "Create, activate, or close tabs in the paired existing Chromium profile. Use browser_list_tabs when only a read-only tab inventory is needed.",
     "availability": "full",
     "annotations": {
       "readOnlyHint": false,
@@ -437,7 +443,7 @@
   {
     "name": "browser_get_source",
     "title": "Read browser page source",
-    "description": "Read bounded serialized current DOM HTML from the active or selected browser tab. max_bytes is one aggregate budget across at most 64 accessible frames, with explicit frame, node, and byte truncation metadata.",
+    "description": "Read bounded raw serialized DOM HTML from the active or selected tab when source markup is required. Use browser_inspect_page for semantic elements, actionability, reusable refs, and structured interaction planning. max_bytes is one aggregate budget across at most 64 accessible frames.",
     "availability": "full",
     "annotations": {
       "readOnlyHint": true,
@@ -479,7 +485,7 @@
   {
     "name": "browser_inspect_page",
     "title": "Inspect browser page",
-    "description": "Inspect a bounded snapshot-version-2 semantic representation across at most 64 accessible frames, with one aggregate element budget, bounded reusable refs, actionability state, bounded page-controlled metadata, and explicit scan/frame truncation.",
+    "description": "Inspect a bounded semantic/actionability snapshot with reusable element refs for structured browser decisions and actions. This is not raw page source; use browser_get_source when serialized DOM HTML is required. The aggregate element budget spans at most 64 accessible frames.",
     "availability": "full",
     "annotations": {
       "readOnlyHint": true,
@@ -1103,7 +1109,7 @@
   {
     "name": "agent_context",
     "title": "Load agent context",
-    "description": "Discover built-in defaults, bounded automatic project facts, Codex-compatible global/root-to-target instruction precedence, progressively disclosed local skills, explicit commands, and safe automatic package-script command aliases for a target path.",
+    "description": "Discover the instruction, skill, and registered-command inventory for a target path, including precedence and provenance. Use this when the caller needs the context itself; use resolve_task_capabilities when it needs task-specific ranking and execution-route advice.",
     "availability": "always",
     "annotations": {
       "readOnlyHint": true,
@@ -1230,7 +1236,7 @@
   {
     "name": "run_local_command",
     "title": "Run registered local command",
-    "description": "Run an effective manifest or automatic package-script command through its fixed argv, cwd, timeout ceiling, and extra-argument policy. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
+    "description": "Prefer this when the repository already defines the desired operation as a registered command or package script. It runs the fixed argv/cwd/timeout contract without shell reinterpretation; use exec_command for ad hoc pipelines or run_process for an unregistered executable argv. Large output is retained for read_process.",
     "availability": "direct-exec",
     "annotations": {
       "readOnlyHint": false,
@@ -1665,7 +1671,7 @@
   {
     "name": "run_process",
     "title": "Run process directly",
-    "description": "Execute an argv array without a command shell. This avoids shell parsing but does not sandbox the executable or code it launches. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
+    "description": "Run an explicit executable plus argv when no shell syntax is needed and no registered command fits. This avoids quoting, globbing, pipelines, and redirection, but it is not a sandbox; use exec_command when Bash composition is the convenient choice. Large output is retained for read_process.",
     "availability": "direct-exec",
     "annotations": {
       "readOnlyHint": false,
@@ -2382,7 +2388,7 @@
   {
     "name": "exec_command",
     "title": "Execute shell command",
-    "description": "Execute a shell command with workspace cwd. This is not a sandbox and has the operating-system authority of the local user. Large stdout/stderr is previewed inline and retained temporarily for paged read_process continuation.",
+    "description": "Run Bash-compatible shell composition in the workspace: pipelines, redirection, globbing, conditionals, or compact multi-command probes. This is the convenient general escape hatch, not a sandbox, and has the local user's operating-system authority. Prefer run_local_command for an existing fixed project command and run_process when no shell syntax is needed. Large output is retained for read_process.",
     "availability": "shell-exec",
     "annotations": {
       "readOnlyHint": false,

package/src/worker/durable-stream-calls.ts

@@ -1,4 +1,3 @@
-import { daemonLastSeenMs } from "./daemon-liveness.ts";
 import type { DaemonSocketRegistry } from "./daemon-sockets.ts";
 import { publicWorkerToolError, WorkerToolError } from "./errors.ts";
 import { workerErrorClass } from "./http.ts";
@@ -9,13 +8,6 @@ import { transformDurableStreamOutcome } from "./durable-stream-result.ts";
 import type { WorkerObservability } from "./observability.ts";
 import { sendWebSocketQuietly } from "./websocket-protocol.ts";
 
-type InvalidateDaemonSocket = (
-  socket: WebSocket,
-  message: string,
-  closeReason: string,
-  errorCode?: string,
-) => Promise<void>;
-
 type TransientPendingSnapshot = {
   active: number;
   detached: number;
@@ -29,20 +21,17 @@ export class DurableStreamCallCoordinator {
   private readonly daemonRegistry: DaemonSocketRegistry;
   private readonly observability: WorkerObservability;
   private readonly maximumPendingCalls: number;
-  private readonly invalidateDaemonSocket: InvalidateDaemonSocket;
 
   constructor(
     calls: McpPendingCallStore,
     daemonRegistry: DaemonSocketRegistry,
     observability: WorkerObservability,
     maximumPendingCalls: number,
-    invalidateDaemonSocket: InvalidateDaemonSocket,
   ) {
     this.calls = calls;
     this.daemonRegistry = daemonRegistry;
     this.observability = observability;
     this.maximumPendingCalls = maximumPendingCalls;
-    this.invalidateDaemonSocket = invalidateDaemonSocket;
   }
 
   async snapshot(transient: TransientPendingSnapshot): Promise<Record<string, unknown>> {
@@ -66,9 +55,10 @@ export class DurableStreamCallCoordinator {
     connectionId: string,
     outcome: PendingCallOutcome,
     knownCall?: PendingStreamCallView,
-  ): Promise<boolean> {
+  ): Promise<"committed" | "missing" | "stale"> {
     const call = knownCall ?? await this.calls.get(callId);
-    if (!call || call.connection_id !== connectionId) return false;
+    if (!call) return "missing";
+    if (call.connection_id !== connectionId) return "stale";
     const normalized = transformDurableStreamOutcome(call, outcome);
     const code = normalized.ok ? "" : publicWorkerToolError(normalized.error).code;
     try {
@@ -77,23 +67,21 @@ export class DurableStreamCallCoordinator {
         connectionId,
         streamTerminalMessage(call.requestId, normalized),
       );
-      if (!completed) return false;
+      if (!completed) {
+        const current = await this.calls.get(callId);
+        return current ? "stale" : "missing";
+      }
     } catch (error) {
       this.observability.event("error", "mcp.stream.persist.failed", { error_class: workerErrorClass(error) });
+      throw error;
     }
     this.observability.callFinished(call.tool, code);
-    return true;
+    return "committed";
   }
 
   async expire(call: PendingStreamCallView): Promise<void> {
     const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
-    if (socket) {
-      sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
-      const silentForMs = Date.now() - daemonLastSeenMs(this.daemonRegistry.readyAttachment(socket));
-      if (!Number.isFinite(silentForMs) || silentForMs > 45_000) {
-        void this.invalidateDaemonSocket(socket, "daemon became unresponsive", "daemon liveness timeout");
-      }
-    }
+    if (socket) sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
     const error = call.state === "attached"
       ? new WorkerToolError("timeout", `daemon tool timed out: ${call.tool}`, true)
       : new WorkerToolError("unavailable", "daemon disconnected; reconnect grace expired", true);
@@ -111,12 +99,12 @@ export class DurableStreamCallCoordinator {
     if (!call) return false;
     const socket = call.state === "attached" ? this.daemonRegistry.socketForConnectionId(call.connection_id) : undefined;
     if (socket) sendWebSocketQuietly(socket, { type: "cancel_call", id: call.call_id });
-    return this.settle(
+    return (await this.settle(
       call.call_id,
       call.connection_id,
       { ok: false, error: new WorkerToolError("cancelled", "tool call cancelled by client") },
       call,
-    );
+    )) === "committed";
   }
 
   detach(connectionId: string, graceMs: number): Promise<number> {

package/src/worker/http.ts

@@ -235,17 +235,30 @@ export function normalizeRedirectUri(value: string): string | null {
   }
 }
 
-export function corsPreflight(request: Request, base: string, configured: string): Response {
+export function mcpOriginRejection(request: Request, base: string, configured: string): Response | null {
+  const origin = request.headers.get("Origin") ?? "";
+  if (!origin || isConfiguredOrSameOrigin(origin, base, configured)) return null;
+  return json({ error: "origin_not_allowed" }, 403);
+}
+
+export function corsPreflight(
+  request: Request, base: string, configured: string, allowedParameterHeaders: ReadonlySet<string> = EMPTY_CORS_HEADER_SET,
+): Response {
   const origin = request.headers.get("Origin") ?? "";
   if (!isConfiguredOrSameOrigin(origin, base, configured)) return json({ error: "origin_not_allowed" }, 403);
   const requestedMethod = (request.headers.get("Access-Control-Request-Method") ?? "").toUpperCase();
   if (requestedMethod && !["GET", "POST"].includes(requestedMethod)) return methodNotAllowed("GET, POST, OPTIONS");
+  const requestedHeaders = requestedCorsHeaders(request);
+  if (!requestedHeaders) return json({ error: "cors_header_invalid" }, 400);
+  const rejected = requestedHeaders.filter((name) => !isAllowedMcpCorsHeader(name, allowedParameterHeaders));
+  if (rejected.length > 0) return json({ error: "cors_header_not_allowed" }, 403);
+  const allowedHeaders = [...new Set([...DEFAULT_MCP_CORS_HEADERS, ...requestedHeaders])];
   return new Response(null, {
     status: 204,
     headers: {
       "access-control-allow-origin": origin,
       "access-control-allow-methods": "GET, POST, OPTIONS",
-      "access-control-allow-headers": "authorization, content-type, dpop, last-event-id, mcp-protocol-version, mcp-session-id",
+      "access-control-allow-headers": allowedHeaders.join(", "),
       "access-control-max-age": "600",
       "cache-control": "no-store",
       "vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
@@ -253,6 +266,27 @@ export function corsPreflight(request: Request, base: string, configured: string
   });
 }
 
+const DEFAULT_MCP_CORS_HEADERS = Object.freeze([
+  "authorization", "content-type", "dpop", "mcp-protocol-version", "mcp-method", "mcp-name",
+  "mcp-session-id", "last-event-id", "traceparent", "tracestate", "baggage",
+]);
+const EMPTY_CORS_HEADER_SET: ReadonlySet<string> = new Set();
+const CORS_HEADER_NAME = /^[!#$%&'*+.^_`|~0-9a-z-]+$/;
+const MAX_CORS_REQUEST_HEADER_BYTES = 8192;
+const MAX_CORS_REQUEST_HEADERS = 64;
+
+function requestedCorsHeaders(request: Request): string[] | null {
+  const raw = request.headers.get("Access-Control-Request-Headers") ?? "";
+  if (new TextEncoder().encode(raw).byteLength > MAX_CORS_REQUEST_HEADER_BYTES) return null;
+  const values = [...new Set(raw.split(",").map((value) => value.trim().toLowerCase()).filter(Boolean))];
+  if (values.length > MAX_CORS_REQUEST_HEADERS || values.some((name) => !CORS_HEADER_NAME.test(name))) return null;
+  return values;
+}
+
+function isAllowedMcpCorsHeader(name: string, allowedParameterHeaders: ReadonlySet<string>): boolean {
+  return DEFAULT_MCP_CORS_HEADERS.includes(name) || allowedParameterHeaders.has(name);
+}
+
 export function applyCors(response: Response, request: Request, base: string, configured: string): Response {
   if (response.status === 101) return response;
   const origin = request.headers.get("Origin") ?? "";