mcp-pacemaker 2.1.0 → 2.1.2

package/bin/mcp-bridge.mjs

@@ -25,6 +25,7 @@
  */
 import http from 'node:http';
 import https from 'node:https';
+import { isIP } from 'node:net';
 import { spawn, exec, execFile, execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync, existsSync, writeFileSync, appendFileSync, statSync, renameSync, watch } from 'node:fs';
@@ -80,8 +81,8 @@ let PORT = Number(getArg('--port', '8791'));
 const HOST = getArg('--host', '127.0.0.1');
 let upgradeHeld = process.env.MCP_PACEMAKER_UPGRADE_PENDING === '1';
 let upgradeRequests = 0;
+let upgradeCalls = 0;
 let upgradeTraffic = false;
-let upgradeUncertain = false;
 if (PORT === 0 &&
     (!process.connected || !process.env.MCP_PACEMAKER_MANAGED_INSTANCE || HOST !== '127.0.0.1')) {
   throw new Error('Port 0 requires a managed loopback startup with actual-port readiness.');
@@ -188,6 +189,16 @@ const log = (m) => {
   for (const c of logClients) { try { c.write(`data: ${JSON.stringify(line)}\n\n`); } catch { /* gone */ } }
 };
 
+// A crash left no trace: its stack went only to stderr, which nothing captures on Windows (see
+// LOG_FILE). The monitor only records the error. The process still exits as before, and the
+// supervisor restarts it.
+process.on('uncaughtExceptionMonitor', (error, origin) => {
+  try {
+    const detail = error instanceof Error ? error.stack : String(error);
+    appendLog(`[mcp-bridge] ${new Date().toISOString()} fatal ${origin}: ${detail}`);
+  } catch { /* recording must never replace the original error */ }
+});
+
 // Token expiry (seconds) for an http server's cached command/az token, if any — for the dashboard.
 //
 // A bare `audience` is shorthand for an Azure CLI token command. It is expanded in exactly one
@@ -450,6 +461,13 @@ function handlePoolingChange(encodedName, req, res) {
     trace?.record('body-end', { bytes });
     clearTimeout(bodyTimer);
     if (rejected) return;
+    // A body that arrives after an upgrade closed admission must not start config work while
+    // the bridge is being stopped.
+    if (upgradeHeld ||
+        shuttingDown) {
+      reply(503, { error: 'Managed upgrade in progress; no change was submitted.' });
+      return;
+    }
     let body;
     let name;
     try {
@@ -644,6 +662,10 @@ function spawnServer(name, def) {
   child.once('error', () => {
     if (!spawned) serverMetrics.failedSpawn(name);
   });
+  // A child can exit between a write to it and the bridge handling that exit, for example when
+  // a server restarts mid-request. The write then fails with EPIPE, and a pipe 'error' with no
+  // listener crashes the whole bridge. The exit handler still fails the request that was waiting.
+  child.stdin.on('error', (error) => log(`[${name}] stdin write failed: ${error.message}`));
   child.__spawnedAt = Date.now(); // start of the cold-start clock; stopped when initialize lands
   return child;
 }
@@ -2085,7 +2107,69 @@ function proxyHttp(name, def, req, res) {
 }
 
 /* --------------------------------- server ---------------------------------- */
+// Browsers can reach a loopback server too. Without these checks any web page could use the
+// bridge, and the credentials it adds, through the user's browser: a cross-site POST runs a tool
+// without a CORS preflight, and DNS rebinding lets the page read the replies. The MCP spec
+// requires servers to check Origin for this reason.
+//
+// - Host: rebinding only works through a DNS name, so only `localhost` and IP addresses pass.
+// - Origin, when sent: the bridge itself (the dashboard) or another page on this machine.
+// - No Origin: clients that are not browsers send none. A browser also leaves it out of a
+//   cross-site GET, such as an image, a frame or a link, which Sec-Fetch-Site still marks. Only
+//   opening the dashboard itself from a link on another site is let through.
+function hostnameOf(urlText) {
+  try {
+    const { hostname } = new URL(urlText);
+    return hostname.startsWith('[') ? hostname.slice(1, -1) : hostname;
+  } catch { return ''; }
+}
+
+function isLoopback(hostname) {
+  const loopbackV4 = isIP(hostname) === 4 &&
+    hostname.startsWith('127.');
+  return hostname === 'localhost' ||
+    hostname === '::1' ||
+    loopbackV4;
+}
+
+function isLocalRequest(req) {
+  if (!req.headers.host) return false;
+  const host = hostnameOf(`http://${req.headers.host}`);
+  const hostIsSafe = host === 'localhost' ||
+    isIP(host) !== 0;
+  if (!hostIsSafe) return false;
+  const origin = req.headers.origin;
+  if (origin !== undefined) {
+    const sameOrigin = origin === `http://${req.headers.host}`;
+    const loopbackPage = isLoopback(hostnameOf(origin));
+    return sameOrigin ||
+      loopbackPage;
+  }
+  const path = req.url.split('?')[0];
+  const dashboardPath = path === '/ui' ||
+    path.startsWith('/ui/');
+  const opensDashboard = dashboardPath &&
+    req.headers['sec-fetch-mode'] === 'navigate' &&
+    req.headers['sec-fetch-dest'] === 'document';
+  const crossSiteFetch = req.headers['sec-fetch-site'] === 'cross-site' &&
+    !opensDashboard;
+  return !crossSiteFetch;
+}
+
+// One line a minute explains a refusal; a page retrying in a loop must not flood the log.
+let lastRefusalLog = 0;
+function noteRefusal(req) {
+  if (Date.now() - lastRefusalLog < 60000) return;
+  lastRefusalLog = Date.now();
+  log(`refused ${req.method} ${req.url} from Host ${req.headers.host ?? 'none'}, Origin ${req.headers.origin ?? 'none'}: not a local request`);
+}
+
 const server = http.createServer((req, res) => {
+  if (!isLocalRequest(req)) {
+    noteRefusal(req);
+    res.writeHead(403).end('forbidden: not a local request');
+    return;
+  }
   const url = new URL(req.url, `http://${req.headers.host}`);
   const [name, kind] = url.pathname.split('/').filter(Boolean);
   const readOnlyStatus = (name === 'status' && !kind) ||
@@ -2096,13 +2180,14 @@ const server = http.createServer((req, res) => {
       return;
     }
     if (!['api', 'ui', '.well-known'].includes(name)) {
+      // A GET is a listening stream that lasts as long as its session; anything else is a call.
+      const call = req.method !== 'GET';
       upgradeRequests++;
+      if (call) upgradeCalls++;
       upgradeTraffic = true;
-      let finished = false;
-      res.once('finish', () => { finished = true; });
       res.once('close', () => {
         upgradeRequests--;
-        if (!finished) upgradeUncertain = true;
+        if (call) upgradeCalls--;
       });
     }
   }
@@ -2208,16 +2293,26 @@ server.listen(PORT, HOST, () => {
 
 function upgradeState() {
   const pooling = poolingConfig.upgradeState();
-  const unsafe = upgradeUncertain ||
-    pooling.unsafe ||
+  const unsafe = pooling.unsafe ||
     hasPoolingTransaction(CONFIG);
+  const calls = upgradeCalls > 0 ||
+    resuming.size > 0 ||
+    tokenInFlight.size > 0;
   const busy = pooling.busy ||
+    calls ||
     upgradeRequests > 0 ||
     sessions.size > 0 ||
-    httpSessions.size > 0 ||
-    resuming.size > 0 ||
-    tokenInFlight.size > 0;
-  return { unsafe, busy, configBusy: pooling.busy, held: upgradeHeld, traffic: upgradeTraffic, port: PORT, version: VERSION, instanceId };
+    httpSessions.size > 0;
+  return { unsafe, busy, calls, configBusy: pooling.busy, held: upgradeHeld, traffic: upgradeTraffic, port: PORT, version: VERSION, instanceId };
+}
+
+// Quiesce waits for calls and config work, never for open sessions. A staged pooling batch
+// still commits on its own timer while admission is held.
+function draining() {
+  const state = upgradeState();
+  return state.unsafe ||
+    state.configBusy ||
+    state.calls;
 }
 
 let upgradeControlBusy = false;
@@ -2231,26 +2326,26 @@ process.on('message', async (message) => {
   try {
     if (message.action === 'quiesce') {
       upgradeHeld = true;
+      // Admission is closed now. Calls in progress and config work get up to eight seconds;
+      // calls still running at the restart end with their sessions. Config work that is still
+      // unfinished blocks the upgrade, because an upgrade must never change servers.json.
       const deadline = Date.now() + Math.min(8000, Math.max(0, message.timeoutMs ?? 8000));
-      while (upgradeState().busy &&
-          !upgradeState().unsafe &&
+      while (draining() &&
           Date.now() < deadline) {
         await new Promise(resolveWait => setTimeout(resolveWait, 25));
       }
       const state = upgradeState();
-      if (state.busy ||
-          state.unsafe) {
-        throw new Error('Active work or unresolved config transaction blocks upgrade. Settle work and retry; nothing was replayed.');
+      if (state.unsafe ||
+          state.configBusy) {
+        throw new Error('Unfinished config work blocks upgrade. Let it finish and retry; nothing was replayed.');
       }
     } else if (message.action === 'activate' ||
         message.action === 'resume') {
       if (upgradeState().unsafe) throw new Error('Unresolved config transaction prevents admission.');
       if (message.action === 'activate') {
-        const files = new PoolingFiles(CONFIG);
-        const sessions = existsSync(RESUME_FILE) ? files.inspect(RESUME_FILE) : null;
-        if (!isDeepStrictEqual(files.inspect(CONFIG), message.expectedAuthority) ||
-            !isDeepStrictEqual(sessions, message.expectedSessionState)) {
-          throw new Error('Configuration or persisted session state changed before admission; the bridge remains held.');
+        // Session records may change while the old version runs; only the config must match.
+        if (!isDeepStrictEqual(new PoolingFiles(CONFIG).inspect(CONFIG), message.expectedAuthority)) {
+          throw new Error('Configuration changed before admission; the bridge remains held.');
         }
       } else {
         await poolingConfig.reloadSaved('upgrade resumed');

package/bin/prewarm.mjs

@@ -1,23 +1,45 @@
 import { readFile } from 'node:fs/promises';
+import { request } from 'node:http';
 import { dirname, join } from 'node:path';
+import { text as readText } from 'node:stream/consumers';
 import { fileURLToPath } from 'node:url';
 import { canonicalPort } from './cli-selection.mjs';
 
+const REQUEST_TIMEOUT_MS = 10_000;
+
+// node:http, not fetch: on Windows, Node 23, 24 before 24.20.0, 25, and 26 before 26.7.0 can abort
+// with a libuv assertion when the CLI exits soon after fetch (nodejs/node#56645).
+async function sendRequest(port, path, { method = 'GET', headers = {}, body } = {}) {
+  const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+  try {
+    const response = await new Promise((resolve, reject) => {
+      const outgoing = request({ hostname: '127.0.0.1', port, path, method, headers, signal }, resolve);
+      outgoing.on('error', reject);
+      outgoing.end(body);
+    });
+    return { status: response.statusCode, text: await readText(response) };
+  } catch (error) {
+    if (signal.aborted) {
+      const advice = method === 'GET' ? '' : ' The change may still apply; reread settings before retrying.';
+      throw new Error(`Bridge on :${port} did not answer within ${REQUEST_TIMEOUT_MS / 1000}s.${advice}`);
+    }
+    throw error;
+  }
+}
+
 async function jsonRequest(port, path, options = {}) {
-  const response = await fetch(`http://127.0.0.1:${port}${path}`, {
-    ...options,
-    signal: AbortSignal.timeout(10_000),
-  });
+  const response = await sendRequest(port, path, options);
   if (response.status === 401) {
     throw new Error('Admin nonce was rejected. Check --config points to the running bridge, then retry.');
   }
   let result;
   try {
-    result = await response.json();
+    result = JSON.parse(response.text);
   } catch {
     throw new Error(`Bridge on :${port} returned a non-JSON response (${response.status})`);
   }
-  if (!response.ok) {
+  const succeeded = response.status >= 200 && response.status <= 299;
+  if (!succeeded) {
     throw new Error(result.error || `Bridge on :${port} rejected the request (${response.status})`);
   }
   return { status: response.status, body: result };

package/bin/service-control.mjs

@@ -138,10 +138,15 @@ export async function controlManagedService({ root, config, port }, action, expe
     id: record.id, token: record.token, action,
     expectedAuthority: expected.authority, expectedSessionState: expected.sessionState,
   });
-  if (response.id !== record.id ||
-      response.ok !== true ||
-      response.instanceId !== record.instanceId ||
-      response.version !== record.version ||
-      response.port !== port) throw new Error(response.error || 'Managed bridge identity/admission could not be verified.');
+  const identified = response.id === record.id &&
+    response.instanceId === record.instanceId &&
+    response.version === record.version &&
+    response.port === port;
+  if (!identified ||
+      response.ok !== true) {
+    // Only a refusal from the identified bridge is definite; anything else leaves the outcome unknown.
+    throw Object.assign(new Error(response.error || 'Managed bridge identity/admission could not be verified.'),
+      { refused: identified && response.ok === false });
+  }
   return response;
 }

package/bin/upgrade-capability.json

@@ -4,5 +4,6 @@
   "admission": true,
   "cli": true,
   "legacyRestartProtocol": 1,
-  "accountWorkerProtocol": 1
+  "accountWorkerProtocol": 1,
+  "dependencyLock": 1
 }

package/bin/upgrade-dependencies.mjs

@@ -1,6 +1,6 @@
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join, relative } from 'node:path';
 import { isDeepStrictEqual, promisify } from 'node:util';
 import semver from 'semver';
@@ -8,6 +8,7 @@ import { npmCliPath } from './update-check.mjs';
 import { PoolingFiles } from './pooling-files.mjs';
 
 const execute = promisify(execFile);
+const PUBLIC_REGISTRY = 'https://registry.npmjs.org/';
 const policies = [
   'registry', 'replace-registry-host', 'offline', 'prefer-offline', 'strict-ssl', 'ca', 'cafile',
   'proxy', 'https-proxy', 'noproxy', 'local-address', 'min-release-age', 'min-release-age-exclude',
@@ -47,9 +48,12 @@ export function validateDependencyLock(root) {
     if (!path.startsWith('node_modules/') ||
         path.split('/').some(part => !part || part === '.' || part === '..') ||
         entry.link ||
-        semver.valid(entry.version) !== entry.version ||
-        typeof entry.integrity !== 'string' ||
-        !entry.integrity.startsWith('sha512-')) throw new Error('Unverifiable target dependency lock entry.');
+        semver.valid(entry.version) !== entry.version) throw new Error('Unverifiable target dependency lock entry.');
+    if (typeof entry.integrity !== 'string' ||
+        !entry.integrity.startsWith('sha512-')) {
+      const found = typeof entry.integrity === 'string' ? entry.integrity.split('-')[0] : 'no';
+      throw new Error(`Unverifiable target dependency lock entry: ${path}@${entry.version} has ${found} integrity from the registry; SHA-512 is required.`);
+    }
     const integrity = Buffer.from(entry.integrity.slice(7), 'base64');
     if (integrity.length !== 64 ||
         `sha512-${integrity.toString('base64')}` !== entry.integrity) throw new Error('Invalid dependency archive integrity.');
@@ -62,6 +66,51 @@ export function validateDependencyLock(root) {
   return lock;
 }
 
+// From 2.1.1 a target ships the SHA-512 lock it was released and tested with. npm ci then
+// verifies every archive against it, so registry metadata (SHA-1 on some mirrors) and newer
+// in-range releases cannot change the staged dependency set.
+export function bundledDependencyLock(root) {
+  const capabilityPath = join(root, 'bin', 'upgrade-capability.json');
+  if (!existsSync(capabilityPath)) return null;
+  const capability = JSON.parse(readFileSync(capabilityPath, 'utf8'));
+  if (capability.dependencyLock !== 1) return null;
+  const path = join(root, 'bin', 'dependency-lock.json');
+  const stat = existsSync(path) ? lstatSync(path) : null;
+  if (!stat?.isFile() ||
+      stat.size === 0) throw new Error('Target declares a bundled dependency lock but does not contain it.');
+  return readFileSync(path);
+}
+
+// npm points public-registry lock URLs at the configured registry itself, unless
+// replace-registry-host is "never" or names only another host or URL prefix.
+export function npmMapsPublicRegistry(setting) {
+  const value = String(setting ?? 'npmjs');
+  return ['npmjs', 'always'].includes(value) ||
+    value.includes('registry.npmjs.org');
+}
+
+// The bundled lock names the public registry. When npm will not map those URLs, point each
+// entry at the registry that resolving it would have used: its scope's registry, else the
+// configured one. Integrity covers the archive bytes, not the URL.
+export function registryLock(bytes, registry, scopes = {}) {
+  const lock = JSON.parse(bytes.toString('utf8'));
+  let changed = false;
+  for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+    const publicEntry = path &&
+      typeof entry.resolved === 'string' &&
+      entry.resolved.startsWith(PUBLIC_REGISTRY);
+    if (!publicEntry) continue;
+    const name = path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length);
+    const target = (name.startsWith('@') ? scopes[name.split('/')[0]] : undefined) ?? registry;
+    if (!target) continue;
+    const base = target.endsWith('/') ? target : `${target}/`;
+    if (base === PUBLIC_REGISTRY) continue;
+    entry.resolved = base + entry.resolved.slice(PUBLIC_REGISTRY.length);
+    changed = true;
+  }
+  return changed ? Buffer.from(`${JSON.stringify(lock, null, 2)}\n`) : bytes;
+}
+
 export async function stageCliDependencies(root, { registry, cache, run = execute } = {}) {
   const cli = npmCliPath();
   const call = async (args, options = {}) => {
@@ -91,12 +140,19 @@ export async function stageCliDependencies(root, { registry, cache, run = execut
   const projectConfig = join(prefix, '.npmrc');
   const stagedConfig = join(root, '.npmrc');
   if (existsSync(stagedConfig)) throw new Error('Unexpected target npm configuration.');
+  const bundled = bundledDependencyLock(root);
+  if (bundled &&
+      existsSync(join(root, 'package-lock.json'))) throw new Error('Unexpected target dependency lock.');
+  const scopes = Object.fromEntries(Object.entries(configuration)
+    .filter(([key, value]) => typeof value === 'string' &&
+      /^@[^:/]+:registry$/.test(key))
+    .map(([key, value]) => [key.slice(0, -':registry'.length), value]));
+  const manifest = readFileSync(join(root, 'package.json'));
   if (existsSync(projectConfig)) {
     const files = new PoolingFiles(projectConfig);
     const identity = files.inspect(projectConfig);
     files.stage(stagedConfig, projectConfig, identity, readFileSync(projectConfig));
   }
-  const manifest = readFileSync(join(root, 'package.json'));
   const args = ['--ignore-scripts', '--omit=dev', '--no-audit', '--no-fund', '--bin-links=false',
     '--cache', cache, '--registry', registry];
   try {
@@ -108,7 +164,12 @@ export async function stageCliDependencies(root, { registry, cache, run = execut
         throw new Error('Effective npm policy changed in dependency staging; no dependency resolution was attempted.');
       }
     }
-    await call(['install', '--package-lock-only', ...args], { cwd: root, env });
+    if (bundled) {
+      const staged = npmMapsPublicRegistry(configuration['replace-registry-host'])
+        ? bundled
+        : registryLock(bundled, registry, scopes);
+      writeFileSync(join(root, 'package-lock.json'), staged, { flag: 'wx' });
+    } else await call(['install', '--package-lock-only', ...args], { cwd: root, env });
     validateDependencyLock(root);
     const lock = readFileSync(join(root, 'package-lock.json'));
     await call(['ci', ...args], { cwd: root, env });

package/bin/upgrade-package.mjs

@@ -97,6 +97,8 @@ export function unpackUpgrade(bytes, version, destination, nodeVersion = process
       capability.portZero !== true ||
       capability.admission !== true ||
       capability.cli !== true) throw new Error('Target does not support managed readiness/admission/port allocation/CLI dispatch.');
+  if (capability.dependencyLock === 1 &&
+      !files.get('bin/dependency-lock.json')?.bytes.length) throw new Error('Target declares a bundled dependency lock but does not contain it.');
   for (const file of files.values()) {
     if (![0o644, 0o755].includes(file.mode)) throw new Error('Unexpected package file mode.');
   }

package/bin/windows-legacy/LegacyProcessBroker.build.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "binary": "LegacyProcessBroker.exe",
-  "binarySha256": "0d4579af8e4e6ec2c762d924a68586ab719589b3dd4da22e916fb17ee1b6da0b",
+  "binarySha256": "64323058e9c0437409522b6cca6d1a47c32e125980b83a07021932d1d5a317ef",
   "inputs": {
     "targetFramework": ".NETFramework,Version=v4.6.2",
     "platform": "AnyCPU",
@@ -27,8 +27,8 @@
     "sourceEncoding": "UTF-8 without BOM, LF line endings",
     "sourceSha256": {
       "AssemblyInfo.cs": "09f672607b66aff39c457899d270688972e440aafaa43b2cb56c1a2367576356",
-      "LegacyNative.cs": "274b9494d249cc4eb3710181047e094f17bf23b0d9301d777be0d517aebb6710",
-      "LegacyProcessBroker.cs": "9d086ab312398aee9462ba85b85e590b551a33e91bd22ecdf21168194ec1a9c4"
+      "LegacyNative.cs": "28f496cba02ebfbbe07102bc70133198b40846838c0189e0bfcdb91d2e0a95c6",
+      "LegacyProcessBroker.cs": "2edd5f77787498d5323185e00b663084e140c9aec6ebca3921d66078bbc66c2a"
     },
     "buildScriptSha256": "2ffa31155f6aa8f6b4239facb0f062df167a01ac7a7ce6d9ae0be60e60fd0201",
     "referenceSha256": {

package/bin/windows-legacy/src/LegacyNative.cs

@@ -202,6 +202,14 @@ internal sealed class LegacyNative
         catch { /* Diagnostic metadata must never replace the original failure. */ }
     }
 
+    // A fixed reason the broker can report; the WMI exception text itself is never relayed.
+    internal Exception QueryTimeout(Exception error)
+    {
+        var timeout = new InvalidOperationException("Argument query timed out", error);
+        TagApi(timeout, LegacyFailureApi.WmiQuery);
+        return timeout;
+    }
+
     internal void TagFailure(Exception error, LegacyFailureStage substage, int? pid = null,
         long? creationTime = null, int? actualParentPid = null, int? expectedParentPid = null,
         string expectedParentCreationTime = null, bool? alive = null, bool? parentAlive = null,
@@ -376,7 +384,7 @@ internal sealed class LegacySnapshot
                 if (pid == 0 ||
                     pid > int.MaxValue) throw new InvalidOperationException("Snapshot identity unavailable");
                 result.Add((int)pid);
-                if (result.Count > 512) throw new InvalidOperationException("Child bound");
+                if (result.Count > 2048) throw new InvalidOperationException("Child bound");
             }
         }
         return result;
@@ -472,6 +480,8 @@ internal sealed class LegacyArgumentQueries : IDisposable
     private readonly Action check;
     private readonly List<LegacyQueryWorker> workers = new List<LegacyQueryWorker>();
     private volatile bool cancelled;
+    // The first real worker failure. Later workers only observe cancellation, which must not hide it.
+    private Exception primary;
     private int count;
     private int maximum;
     private bool disposed;
@@ -505,10 +515,13 @@ internal sealed class LegacyArgumentQueries : IDisposable
                     workers[index].Queue.Add(batch);
                 }
                 foreach (var batch in wave)
-                    while (!batch.Done.Wait(25)) Check();
+                    while (!batch.Done.Wait(25)) CheckPrimary();
+                var failure = Volatile.Read(ref primary);
                 foreach (var batch in wave)
-                    if (batch.Error != null) throw batch.Error;
-                Check();
+                    if (failure == null &&
+                        batch.Error != null) failure = batch.Error;
+                if (failure != null) throw failure;
+                CheckPrimary();
                 if (capture)
                 {
                     foreach (var batch in wave)
@@ -548,7 +561,7 @@ internal sealed class LegacyArgumentQueries : IDisposable
                     native.TagApi(error, LegacyFailureApi.WmiConnect);
                     native.TagFailure(error, LegacyFailureStage.ArgumentConnect);
                     worker.Error = error;
-                    cancelled = true;
+                    Fail(error);
                 }
                 finally { worker.Ready.Set(); }
                 foreach (var batch in worker.Queue.GetConsumingEnumerable())
@@ -561,9 +574,11 @@ internal sealed class LegacyArgumentQueries : IDisposable
                     }
                     catch (Exception error)
                     {
-                        native.TagFailure(error, LegacyFailureStage.ArgumentQuery);
-                        batch.Error = error;
-                        cancelled = true;
+                        var failure = TimedOut(error) ? native.QueryTimeout(error) : error;
+                        native.TagFailure(failure, LegacyFailureStage.ArgumentQuery);
+                        batch.Error = failure;
+                        if (IsCancellation(failure)) cancelled = true;
+                        else Fail(failure);
                     }
                     finally { batch.Done.Set(); }
                 }
@@ -574,7 +589,7 @@ internal sealed class LegacyArgumentQueries : IDisposable
         }
         foreach (var worker in workers)
         {
-            while (!worker.Ready.Wait(25)) Check();
+            while (!worker.Ready.Wait(25)) CheckPrimary();
             if (worker.Error != null) throw worker.Error;
         }
     }
@@ -592,7 +607,10 @@ internal sealed class LegacyArgumentQueries : IDisposable
             clauses.Add("ProcessId=" + process.Info.pid.ToString(CultureInfo.InvariantCulture));
         }
         var seen = new HashSet<int>();
-        var options = new EnumerationOptions { Timeout = TimeSpan.FromSeconds(2), ReturnImmediately = false };
+        // Loaded hosts with ~1000 processes measured close to 1 s per query, so 2 s failed under contention.
+        // The caller's phase watchdog still bounds the whole capture, so a timeout late in a long
+        // capture can surface as that bound rather than as "Argument query timed out".
+        var options = new EnumerationOptions { Timeout = TimeSpan.FromSeconds(8), ReturnImmediately = false };
         using (var search = new ManagementObjectSearcher(scope, new ObjectQuery(
             "SELECT ProcessId,CreationDate,CommandLine FROM Win32_Process WHERE " + string.Join(" OR ", clauses)), options))
         using (var rows = QueryRows(search, native))
@@ -663,10 +681,41 @@ internal sealed class LegacyArgumentQueries : IDisposable
 
     private void Check()
     {
-        if (cancelled) throw new InvalidOperationException("Argument query cancelled");
+        if (cancelled)
+        {
+            var cancellation = new InvalidOperationException("Argument query cancelled");
+            cancellation.Data["LegacyQueryCancelled"] = true;
+            throw cancellation;
+        }
         check();
     }
 
+    // Main thread only: report the first real worker failure rather than the cancellation it caused.
+    private void CheckPrimary()
+    {
+        var failure = Volatile.Read(ref primary);
+        if (failure != null) throw failure;
+        Check();
+    }
+
+    private void Fail(Exception error)
+    {
+        Interlocked.CompareExchange(ref primary, error, null);
+        cancelled = true;
+    }
+
+    private static bool IsCancellation(Exception error)
+    {
+        return error.Data.Contains("LegacyQueryCancelled");
+    }
+
+    private static bool TimedOut(Exception error)
+    {
+        var management = error as ManagementException;
+        return management != null &&
+            management.ErrorCode == ManagementStatus.Timedout;
+    }
+
     public void Dispose()
     {
         if (disposed) return;