machine-bridge-mcp 1.1.5 → 1.2.1

package/src/local/cli-options.mjs

@@ -11,7 +11,7 @@ const VALUE_OPTIONS = new Set([
 
 const LOG_FORMATS = new Set(["text", "json"]);
 
-const COMMAND_OPTIONS = {
+const COMMAND_OPTIONS = new Map(Object.entries({
   start: new Set([
     "workspace", "stateDir", "workerName", "quiet", "json", "verbose", "logLevel", "logFormat", "rotateSecrets", "forceWorker",
     "daemonOnly", "noAutostart",
@@ -31,17 +31,17 @@ const COMMAND_OPTIONS = {
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
-};
+}));
 
 const SINGLE_WORKSPACE_POSITIONAL_COMMANDS = new Set(["start", "stdio", "status", "doctor", "full-test", "rotate-secrets"]);
-const STATIC_POSITIONAL_RULES = Object.freeze({
-  "client-config": Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" }),
-  uninstall: Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" }),
-});
-const RESOURCE_POSITIONAL_LIMITS = Object.freeze({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 });
-const JOB_POSITIONAL_LIMITS = Object.freeze({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 });
-const ACCOUNT_POSITIONAL_LIMITS = Object.freeze({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 });
-const ACTION_POSITIONAL_RULES = Object.freeze({
+const STATIC_POSITIONAL_RULES = new Map([
+  ["client-config", Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" })],
+  ["uninstall", Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" })],
+]);
+const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
+const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
+const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
     return { max: action === "set" || action === "select" ? 2 : 1, tooMany: `workspace ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
@@ -50,14 +50,14 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
     const action = String(args._[0] || "status");
     return { max: ["install", "status", "stop", "uninstall", "remove"].includes(action) ? 2 : 1, tooMany: `service ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
   },
-  autostart(args) { return ACTION_POSITIONAL_RULES.service(args); },
+  autostart(args) { return ACTION_POSITIONAL_RULES.get("service")(args); },
   resource(args) {
     const action = String(args._[0] || "list");
-    return { max: RESOURCE_POSITIONAL_LIMITS[action] ?? 1, tooMany: `resource ${action} received too many positional arguments` };
+    return { max: RESOURCE_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `resource ${action} received too many positional arguments` };
   },
   account(args) {
     const action = String(args._[0] || "list");
-    return { max: ACCOUNT_POSITIONAL_LIMITS[action] ?? 1, tooMany: `account ${action} received too many positional arguments` };
+    return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
   browser(args) {
     const action = String(args._[0] || "status");
@@ -65,9 +65,9 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
   },
   job(args) {
     const action = String(args._[0] || "list");
-    return { max: JOB_POSITIONAL_LIMITS[action] ?? 1, tooMany: `job ${action} received too many positional arguments` };
+    return { max: JOB_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `job ${action} received too many positional arguments` };
   },
-});
+}));
 
 export function normalizeCommand(argv) {
   if (!argv.length || argv[0].startsWith("--")) return ["start", argv];
@@ -105,7 +105,7 @@ export function parseArgs(argv) {
 }
 
 export function validateCommandOptions(command, args) {
-  const allowed = COMMAND_OPTIONS[command];
+  const allowed = COMMAND_OPTIONS.get(command);
   if (!allowed) return;
   for (const key of Object.keys(args)) {
     if (key === "_" || key === "help" || key === "version") continue;
@@ -144,8 +144,8 @@ function positionalRule(command, args) {
   if (SINGLE_WORKSPACE_POSITIONAL_COMMANDS.has(command)) {
     return { max: 1, tooMany: `${command} accepts at most one positional workspace path`, workspaceConflictAfter: 0 };
   }
-  if (STATIC_POSITIONAL_RULES[command]) return STATIC_POSITIONAL_RULES[command];
-  return ACTION_POSITIONAL_RULES[command]?.(args) || null;
+  if (STATIC_POSITIONAL_RULES.has(command)) return STATIC_POSITIONAL_RULES.get(command);
+  return ACTION_POSITIONAL_RULES.get(command)?.(args) || null;
 }
 function parseBooleanOption(value, key) {
   if (value === "true" || value === "1") return true;

package/src/local/cli-policy.mjs

@@ -37,7 +37,7 @@ function policyState(policy) {
 function selectPolicyBase(args, stored, hasStored) {
   if (args.profile !== undefined) {
     const profile = String(args.profile).trim().toLowerCase();
-    if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+    if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
     return policyProfile(profile, "explicit");
   }
   if (!hasStored) return policyProfile(DEFAULT_POLICY_PROFILE, "default");

package/src/local/cli-service.mjs

@@ -0,0 +1,132 @@
+import process from "node:process";
+import * as defaultService from "./service.mjs";
+import { inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
+import { serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadState, resolveWorkspace, selectedWorkspace } from "./state.mjs";
+
+const SERVICE_ACTION_HANDLERS = new Map([
+  ["status", serviceStatusAction],
+  ["install", serviceInstallAction],
+  ["start", serviceStartAction],
+  ["stop", serviceStopAction],
+  ["uninstall", serviceUninstallAction],
+  ["remove", serviceUninstallAction],
+]);
+
+export function createServiceCommand(dependencies) {
+  const context = {
+    chooseWorkspace: requiredFunction(dependencies.chooseWorkspace, "chooseWorkspace"),
+    stateRootFromArgs: requiredFunction(dependencies.stateRootFromArgs, "stateRootFromArgs"),
+    structuredLogger: requiredFunction(dependencies.structuredLogger, "structuredLogger"),
+    service: dependencies.service || defaultService,
+    inspectWorkspaceDaemon: dependencies.inspectWorkspaceDaemon || inspectWorkspaceDaemon,
+    stopWorkspaceServiceDaemon: dependencies.stopWorkspaceServiceDaemon || stopWorkspaceServiceDaemon,
+    stopAndRemoveAutostart: dependencies.stopAndRemoveAutostart || stopAndRemoveAutostart,
+    serviceEnvironmentSummary: dependencies.serviceEnvironmentSummary || serviceEnvironmentSummary,
+    loadState: dependencies.loadState || loadState,
+    resolveWorkspace: dependencies.resolveWorkspace || resolveWorkspace,
+    selectedWorkspace: dependencies.selectedWorkspace || selectedWorkspace,
+    entryScript: dependencies.entryScript || process.argv[1],
+    setExitCode: dependencies.setExitCode || setProcessExitCode,
+    print: dependencies.print || printLine,
+  };
+  return (args) => serviceCommand(args, context);
+}
+
+async function serviceCommand(args, context) {
+  const action = String(args._[0] || "status").toLowerCase();
+  const handler = SERVICE_ACTION_HANDLERS.get(action);
+  if (!handler) throw new Error(`Unknown service action: ${action}`);
+  const stateRoot = context.stateRootFromArgs(args);
+  return handler({ args, stateRoot, service: context.service, context });
+}
+
+async function serviceStatusAction({ args, stateRoot, service, context }) {
+  const status = await service.autostartStatus();
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state ? context.inspectWorkspaceDaemon(state) : null;
+  printServiceResult({
+    ...status,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+    service_environment: context.serviceEnvironmentSummary(stateRoot),
+    effective_active: Boolean(status.active || workspaceDaemon?.alive),
+    orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
+  }, context, false);
+}
+
+async function serviceInstallAction({ args, stateRoot, service, context }) {
+  const workspaceArgs = { ...args, _: args._.slice(1) };
+  const workspace = await context.chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
+  const state = context.loadState(workspace, { stateDir: stateRoot });
+  if (!state.worker?.url) {
+    throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
+  }
+  const result = await service.installAutostart({
+    workspace,
+    stateRoot,
+    entryScript: context.entryScript,
+    logger: context.structuredLogger(Boolean(args.quiet)),
+  });
+  printServiceResult(result, context);
+}
+
+async function serviceStartAction({ args, service, context }) {
+  const result = await service.startAutostart({ logger: context.structuredLogger(Boolean(args.quiet)) });
+  printServiceResult(result, context);
+}
+
+async function serviceStopAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const provider = await service.stopAutostart({ logger });
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state
+    ? await context.stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
+    : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
+  printServiceResult({
+    ...provider,
+    ok: provider?.ok !== false && workspaceDaemon.ok,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+  }, context);
+}
+
+async function serviceUninstallAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const state = optionalServiceState(args, stateRoot, context);
+  const lifecycle = await context.stopAndRemoveAutostart({
+    states: state ? [state] : [],
+    stateRoot,
+    logger,
+    reason: "service uninstall",
+    stopAutostart: service.stopAutostart,
+    uninstallAutostart: service.uninstallAutostart,
+    stopWorkspaceServiceDaemon: context.stopWorkspaceServiceDaemon,
+  });
+  printServiceResult({
+    ...lifecycle,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: lifecycle.workspace_daemons[0] || null,
+    autostart_removed: lifecycle.removed,
+  }, context);
+}
+
+function optionalServiceState(args, stateRoot, context) {
+  const requested = args.workspace || args._[1] || context.selectedWorkspace(stateRoot);
+  if (!requested || requested === true) return null;
+  return context.loadState(context.resolveWorkspace(String(requested)), { stateDir: stateRoot });
+}
+
+function printServiceResult(result, context, updateExitCode = true) {
+  context.print(JSON.stringify(result, null, 2));
+  if (updateExitCode && result?.ok === false) context.setExitCode(1);
+}
+
+function requiredFunction(value, name) {
+  if (typeof value !== "function") throw new TypeError(`service command requires ${name}`);
+  return value;
+}
+
+function setProcessExitCode(value) { process.exitCode = value; }
+function printLine(value) { console.log(value); }

package/src/local/cli.mjs

@@ -3,13 +3,14 @@ import { join, resolve } from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalRuntime } from "./runtime.mjs";
-import { acquireDaemonLockWithTakeover, inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { acquireDaemonLockWithTakeover, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
 import { inspectProcessInstance } from "./process-identity.mjs";
 import { runStdioServer } from "./stdio.mjs";
 import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./tools.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { createServiceCommand } from "./cli-service.mjs";
 import { generateAccountPassword } from "./account-admin.mjs";
 import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
 export { resolvePolicy } from "./cli-policy.mjs";
@@ -18,7 +19,7 @@ import { classifyOperationalError, createLogger, sanitizeLogText } from "./log.m
 import { runExecutable, runWrangler } from "./shell.mjs";
 import { runFullAccessTest } from "./full-access-test.mjs";
 import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
-import { loadServiceEnvironment, serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadServiceEnvironment } from "./service-environment.mjs";
 import { ensureWorkerDeployment } from "./worker-deployment.mjs";
 import { workerHealth } from "./worker-health.mjs";
 export { workerHealthUserReason } from "./worker-health.mjs";
@@ -48,24 +49,25 @@ import {
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
-
-const COMMAND_HANDLERS = Object.freeze({
-  start: startCommand,
-  stdio: stdioCommand,
-  "client-config": clientConfigCommand,
-  status: statusCommand,
-  doctor: doctorCommand,
-  "full-test": fullTestCommand,
-  workspace: workspaceCommand,
-  service: serviceCommand,
-  autostart: serviceCommand,
-  "rotate-secrets": rotateSecretsCommand,
-  resource: localAdminCommands.resourceCommand,
-  account: accountCommand,
-  browser: localAdminCommands.browserCommand,
-  job: localAdminCommands.jobCommand,
-  uninstall: uninstallCommand,
-});
+const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
+
+const COMMAND_HANDLERS = new Map([
+  ["start", startCommand],
+  ["stdio", stdioCommand],
+  ["client-config", clientConfigCommand],
+  ["status", statusCommand],
+  ["doctor", doctorCommand],
+  ["full-test", fullTestCommand],
+  ["workspace", workspaceCommand],
+  ["service", serviceCommand],
+  ["autostart", serviceCommand],
+  ["rotate-secrets", rotateSecretsCommand],
+  ["resource", localAdminCommands.resourceCommand],
+  ["account", accountCommand],
+  ["browser", localAdminCommands.browserCommand],
+  ["job", localAdminCommands.jobCommand],
+  ["uninstall", uninstallCommand],
+]);
 
 export async function main(argv = process.argv.slice(2)) {
   const [command, rest] = normalizeCommand(argv);
@@ -75,7 +77,7 @@ export async function main(argv = process.argv.slice(2)) {
   validateCommandOptions(command, args);
   validatePositionals(command, args);
   validateLoggingOptions(args);
-  const handler = COMMAND_HANDLERS[command];
+  const handler = COMMAND_HANDLERS.get(command);
   if (handler) return handler(args);
   console.error(`Unknown command: ${command}`);
   usage();
@@ -250,7 +252,7 @@ async function startRemoteRuntime({ args, workspace, state, daemonLock, logger }
   let runtime = null;
   try {
     const readiness = await prepareRemoteState({ args, workspace, state, logger });
-    runtime = createRemoteRuntime({ args, workspace, state, daemonLock, logger });
+    runtime = createRemoteRuntime({ args, workspace, state, daemonLock });
     await runtime.start();
     reportRemoteReady(args, state, readiness);
     keepProcessAlive({ daemon: runtime, lock: daemonLock, logger });
@@ -295,7 +297,7 @@ async function ensureInitialOwnerAccount(state) {
   return { ...created.account, password };
 }
 
-function createRemoteRuntime({ args, workspace, state, daemonLock, logger }) {
+function createRemoteRuntime({ args, workspace, state, daemonLock }) {
   return new LocalRuntime({
     workerUrl: state.worker.url,
     secret: state.worker.daemonSecret,
@@ -352,7 +354,7 @@ async function clientConfigCommand(args) {
   const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: false, save: false, allowPositional: false });
   const requested = String(args.client || args._[0] || "all").trim().toLowerCase();
   const profile = String(args.profile || "full").trim().toLowerCase();
-  if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+  if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
   if (!["all", "claude", "cursor", "codex", "generic"].includes(requested)) throw new Error("client must be all, claude, cursor, codex, or generic");
   const command = process.execPath;
   const argsList = [resolve(process.argv[1]), "stdio", "--workspace", workspace, "--profile", profile];
@@ -537,90 +539,6 @@ async function rotateSecretsCommand(args) {
   }
 }
 
-async function serviceCommand(args) {
-  const action = String(args._[0] || "status");
-  const stateRoot = stateRootFromArgs(args);
-  const { installAutostart, uninstallAutostart, autostartStatus, startAutostart, stopAutostart } = await import("./service.mjs");
-  if (action === "status") {
-    const status = await autostartStatus({ logger: structuredLogger(Boolean(args.quiet)) });
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state ? inspectWorkspaceDaemon(state) : null;
-    console.log(JSON.stringify({
-      ...status,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-      service_environment: serviceEnvironmentSummary(stateRoot),
-      effective_active: Boolean(status.active || workspaceDaemon?.alive),
-      orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
-    }, null, 2));
-    return;
-  }
-  if (action === "install") {
-    const workspaceArgs = { ...args, _: args._.slice(1) };
-    const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
-    const state = loadState(workspace, { stateDir: stateRoot });
-    if (!state.worker?.url) {
-      throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
-    }
-    const result = await installAutostart({ workspace, stateRoot, entryScript: process.argv[1], logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "start") {
-    const result = await startAutostart({ logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "stop") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const provider = await stopAutostart({ logger });
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state
-      ? await stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
-      : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
-    const result = {
-      ...provider,
-      ok: provider?.ok !== false && workspaceDaemon.ok,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-    };
-    console.log(JSON.stringify(result, null, 2));
-    if (!result.ok) process.exitCode = 1;
-    return;
-  }
-  if (action === "uninstall" || action === "remove") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const state = optionalServiceState(args, stateRoot);
-    const lifecycle = await stopAndRemoveAutostart({
-      states: state ? [state] : [],
-      stateRoot,
-      logger,
-      reason: "service uninstall",
-      stopAutostart,
-      uninstallAutostart,
-      stopWorkspaceServiceDaemon,
-    });
-    const output = {
-      ...lifecycle,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: lifecycle.workspace_daemons[0] || null,
-      autostart_removed: lifecycle.removed,
-    };
-    console.log(JSON.stringify(output, null, 2));
-    if (!output.ok) process.exitCode = 1;
-    return;
-  }
-  throw new Error(`Unknown service action: ${action}`);
-}
-
-function optionalServiceState(args, stateRoot) {
-  const requested = args.workspace || args._[1] || selectedWorkspace(stateRoot);
-  if (!requested || requested === true) return null;
-  return loadState(resolveWorkspace(String(requested)), { stateDir: stateRoot });
-}
-
 async function installAutostartBestEffort({ workspace, stateRoot, entryScript, logger }) {
   try {
     const { installAutostart } = await import("./service.mjs");
@@ -878,5 +796,5 @@ function version() {
 }
 
 function sleep(ms) {
-  return new Promise(resolvePromise => setTimeout(resolvePromise, ms));
+  return new Promise(resolvePromise => { setTimeout(resolvePromise, ms); });
 }

package/src/local/daemon-process.mjs

@@ -209,5 +209,5 @@ function boundedPositiveInt(value, fallback) {
 }
 
 function sleep(ms) {
-  return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+  return new Promise((resolvePromise) => { setTimeout(resolvePromise, ms); });
 }

package/src/local/full-access-test.mjs

@@ -183,7 +183,7 @@ async function waitForJob(manager, jobId, timeoutMs) {
   while (!deadline.expired()) {
     const value = manager.read({ job_id: jobId });
     if (TERMINAL_JOB_STATES.has(value.status)) return value;
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, 50));
+    await new Promise((resolvePromise) => { setTimeout(resolvePromise, 50); });
   }
   throw new Error("full access managed-job test timed out");
 }

package/src/local/job-runner.mjs

@@ -71,7 +71,7 @@ async function releaseRecoveryClaim() {
   const deadline = createMonotonicDeadline(5000);
   while (!deadline.expired()) {
     if (removeOwnedJsonFileSync(file, { pid: process.pid, token: recoveryLockToken })) return;
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, 10));
+    await new Promise((resolvePromise) => { setTimeout(resolvePromise, 10); });
   }
   throw new Error("recovery runner could not verify ownership of the recovery lock");
 }
@@ -257,7 +257,10 @@ async function runStep(step, index, phase, plan, resourceContext, cancellationAw
 
 function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captureOutput, captureBudget }) {
   return new Promise((resolvePromise, rejectPromise) => {
-    if (cancellationAware && isCancellationRequested()) return rejectPromise(new JobCancelledError());
+    if (cancellationAware && isCancellationRequested()) {
+      rejectPromise(new JobCancelledError());
+      return;
+    }
     const child = spawn(argv[0], argv.slice(1), {
       cwd,
       env,
@@ -300,7 +303,10 @@ function spawnStep(argv, { cwd, env, input, timeoutMs, cancellationAware, captur
     });
     child.on("error", (error) => finish(() => rejectPromise(error)));
     child.on("close", (code, signal) => finish(() => {
-      if (cancellationAware && isCancellationRequested()) return rejectPromise(new JobCancelledError());
+      if (cancellationAware && isCancellationRequested()) {
+        rejectPromise(new JobCancelledError());
+        return;
+      }
       resolvePromise({
         code: Number.isInteger(code) ? code : 1,
         signal: signal ? String(signal) : null,

package/src/local/managed-job-plan.mjs

@@ -156,10 +156,10 @@ function referencedResources(steps, registry) {
     }
   }
   if (names.size > MAX_RESOURCES) throw new Error(`job references more than ${MAX_RESOURCES} local resources`);
-  const out = {};
+  const out = Object.create(null);
   let totalBytes = 0;
   for (const name of names) {
-    const resource = registry[name];
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
     if (!resource) throw new Error(`unknown local resource: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true, includeHash: true });
     totalBytes += inspected.size;
@@ -174,7 +174,7 @@ function referencedResources(steps, registry) {
 }
 
 export function normalizeResourceRegistry(resources) {
-  const out = {};
+  const out = Object.create(null);
   if (!resources || typeof resources !== "object" || Array.isArray(resources)) return out;
   for (const [rawName, rawValue] of Object.entries(resources).slice(0, MAX_RESOURCES)) {
     const name = validateResourceName(rawName);

package/src/local/monotonic-deadline.mjs

@@ -1,5 +1,11 @@
+// @ts-check
+
 import { performance } from "node:perf_hooks";
 
+/**
+ * @param {number} timeoutMs
+ * @param {() => number} [now]
+ */
 export function createMonotonicDeadline(timeoutMs, now = () => performance.now()) {
   const durationMs = Number(timeoutMs);
   if (!Number.isFinite(durationMs) || durationMs < 0) throw new TypeError("timeoutMs must be a finite non-negative number");
@@ -23,6 +29,7 @@ export function createMonotonicDeadline(timeoutMs, now = () => performance.now()
   });
 }
 
+/** @param {() => number} now */
 function readSample(now) {
   const value = Number(now());
   if (!Number.isFinite(value)) throw new TypeError("monotonic clock returned a non-finite value");

package/src/local/numbers.mjs

@@ -1,3 +1,11 @@
+// @ts-check
+
+/**
+ * @param {unknown} value
+ * @param {number} fallback
+ * @param {number} minimum
+ * @param {number} maximum
+ */
 export function clampInteger(value, fallback, minimum, maximum) {
   const parsed = typeof value === "number"
     ? value