machine-bridge-mcp 1.2.0 → 1.2.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.2.1 - 2026-07-16
+
+### Fail-closed input contracts and bounded CLI adapters
+
+- Eliminate prototype-chain lookup from externally controlled command, action, account-role, policy-profile, form-field, keyboard, and local-resource keys. Dispatch and enumerations now use `Map`, `Set`, `Object.hasOwn`, or null-prototype records; names such as `constructor` and `__proto__` can no longer become inherited handlers or unauthorized enum members. A malformed current-schema OAuth account role is repaired in place to a disabled reviewer account, its version is advanced, and every existing authorization code and token is revoked so an affected installation remains administrable without granting authority.
+- Make Worker deployment output parsing and health verification share one canonical `workers.dev` origin validator. Wrangler output containing unrelated `/mcp`, `/healthz`, path-bearing, or wrong-name URLs is no longer accepted as deployment evidence and cannot poison the persisted URL or deployment fingerprint.
+- Preserve the exact browser `maxBytes` contract for non-ASCII page source. The DOM serializer now backs off to a complete UTF-8 prefix instead of decoding a split code point into a replacement character whose encoded size exceeds the reported budget; regressions cover emoji and Chinese text at every partial-byte boundary.
+- Replace ordinary browser and service CLI branch trees with named, map-driven adapters. The service adapter is independently injectable and reaches 100% function and over 90% branch coverage; architecture checks are split into module boundaries, repository hygiene, browser/security structure, and release/documentation contracts so source-shape guards remain supplemental to executable behavior tests.
+- Keep local state schema 6, policy revision 5, browser pairing, resources, jobs, and Worker identity unchanged for an in-place upgrade from 1.2.0. Normal startup still converges the versioned Worker and the unpacked extension must be reloaded; no live deployment, credential rotation, daemon replacement, global installation, or npm publication is performed by this source change.
+
 ## 1.2.0 - 2026-07-16
 
 ### Typed evolution boundaries and project governance

package/browser-extension/browser-operations.js

@@ -181,7 +181,7 @@
   function boundedDocumentSource(limit) {
     const maxBytes = Math.max(1, Number(limit) || 1);
     const encoder = new TextEncoder();
-    const decoder = new TextDecoder();
+    const decoder = new TextDecoder("utf-8", { fatal: true });
     const chunks = [];
     const VOID_ELEMENTS = new Set(["area", "base", "br", "col", "embed", "hr", "img", "input", "link", "meta", "param", "source", "track", "wbr"]);
     const MAX_NODES = 100000;
@@ -207,8 +207,14 @@
         returnedBytes += bytes.byteLength;
         return true;
       }
-      chunks.push(decoder.decode(bytes.slice(0, remaining)));
-      returnedBytes = maxBytes;
+      let end = remaining;
+      let prefix = "";
+      while (end > 0) {
+        try { prefix = decoder.decode(bytes.slice(0, end)); break; }
+        catch { end -= 1; }
+      }
+      if (prefix) chunks.push(prefix);
+      returnedBytes += end;
       budgetExhausted = true;
       return false;
     };

package/browser-extension/devtools-input.js

@@ -100,10 +100,10 @@
     let modifiers = 0;
     for (const raw of parts) {
       const name = raw === "Ctrl" ? "Control" : raw === "Cmd" || raw === "Command" ? "Meta" : raw;
-      if (!(name in MODIFIERS)) throw new Error(`unsupported key modifier: ${raw}`);
+      if (!Object.hasOwn(MODIFIERS, name)) throw new Error(`unsupported key modifier: ${raw}`);
       modifiers |= MODIFIERS[name];
     }
-    const known = KEY_DATA[keyName];
+    const known = Object.hasOwn(KEY_DATA, keyName) ? KEY_DATA[keyName] : null;
     if (known) return {
       key: known.key || keyName,
       code: known.code,

package/browser-extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Machine Bridge Browser",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Connects the current Chromium browser profile to the local Machine Bridge runtime for user-authorized automation.",
   "permissions": [
     "tabs",
@@ -30,5 +30,5 @@
   "action": {
     "default_title": "Machine Bridge Browser"
   },
-  "version_name": "1.2.0"
+  "version_name": "1.2.1"
 }

package/docs/AUDIT.md

@@ -1,5 +1,19 @@
 # Engineering and security audit
 
+## 2026-07-16 version 1.2.1 fail-closed input-contract audit
+
+The review began from clean `v1.2.0` with the complete repository gate, dependency audit, Worker dry run, and package checks passing. Hostile-input reproduction nevertheless found one shared JavaScript failure mechanism outside those gates: ordinary objects were being used as external string-key maps. Inherited names such as `constructor` and `__proto__` were therefore accepted as account roles, policy profiles, top-level commands, resource actions, and keyboard-table entries. The CLI variants could exit successfully without performing a command; a Worker account could persist an invalid role and later fail during authority calculation. Adjacent review found the same semantic hazard in form-field aggregation and valid local-resource names.
+
+The correction removes prototype-chain semantics rather than blacklisting a few names. Command/action dispatch and role registries use `Map` or exact own-key membership; profile and availability contracts use explicit sets/own-key checks; URL-encoded bodies and normalized resource registries use null-prototype records. Regression tests exercise the standard prototype property names at every affected public boundary. A malformed role already persisted under the unchanged current OAuth schema is repaired in place to a disabled `reviewer`, its version advances, and all codes/tokens are pruned. This preserves an operator-recoverable account record while ensuring the upgrade cannot retain or expand authority.
+
+The deployment review found a separate validation split: Wrangler output parsing accepted any HTTPS URL containing `/mcp` or `/healthz`, while the health verifier later required an exact root `workers.dev` origin matching the Worker name. Because successful upload evidence is intentionally saved before secondary verification, unrelated output could persist a URL/fingerprint pair that later starts would refuse to verify. Parsing and verification now share one canonical origin function; nonmatching, path-bearing, credential-bearing, ported, queried, or fragmented candidates are ignored and cannot mutate state.
+
+The browser source limit had an encoding-level off-by-contract defect. Truncating raw UTF-8 bytes inside a code point and decoding non-fatally produced `U+FFFD`, whose re-encoded size could exceed both the returned count and caller budget. The serializer now backs off to the longest valid prefix and reports its actual encoded byte count. Emoji and Chinese fixtures cover every partial boundary and aggregate source budgeting.
+
+Ordinary CLI branching was also brought back into the repository's own architecture standard. Browser actions were split into named handlers; service status/install/start/stop/uninstall/remove moved to an independently injectable adapter with complete action coverage and over ninety percent branch coverage. The former 580-line architecture test was separated into module boundaries, repository hygiene, browser/security structure, and release/documentation contracts. Source-string checks remain useful drift alarms, but the security and lifecycle claims above are enforced by executable behavior and fault-path tests.
+
+Version 1.2.1 retains local state schema 6 and policy revision 5. Existing 1.2.0 state upgrades in place; the versioned Worker is converged by normal startup and the unpacked extension must be reloaded. Historical changelog and audit records remain as history, while obsolete runtime fallback semantics and stale migration wording were removed.
+
 ## 2026-07-16 version 1.2 trustworthy-evolution audit
 
 The review began from clean released commit `58d54c21a0ac37f8e5f82a6f895738508efad0c6` (`v1.1.5`). The complete local gate, exact-commit Linux/macOS/Windows CI, CodeQL, Governance, and OpenSSF Scorecard were green; dependency audits reported zero vulnerabilities; and the GitHub Release asset, npm registry tarball, and a fresh local pack were byte-identical. That evidence ruled out an immediate release-integrity incident but did not answer whether the project could continue evolving safely: the main Worker, runtime, Agent-context, and browser-broker modules were all above ninety-seven percent of their own architecture limits, while high-authority local JavaScript had almost no static shape checking and several critical Worker modules had no branch floor.

package/docs/ENGINEERING.md

@@ -55,6 +55,7 @@ Rules:
 - Every protocol control message emitted by one side must be explicitly accepted, rejected, or version-gated by the other side, with an end-to-end contract test covering the message name and semantics.
 - State transitions are explicit; readiness is not inferred from a lower-level event. For example, an open WebSocket is not an authenticated relay until `hello_ack` is received.
 - Every externally controlled input is bounded before expensive allocation, traversal, parsing, storage, or execution.
+- Externally controlled string keys must not use prototype-chain membership or truthiness on ordinary objects. Use `Map`, `Set`, `Object.hasOwn`, or null-prototype records for command dispatch, enums, ACLs, form fields, registries, and other key-addressed contracts.
 - Repository text must not contain invisible ASCII controls other than tab, CR, and LF; architecture tests enforce this even when JavaScript syntax remains valid.
 - Persistent mutations use owner-only files, bounded no-follow reads, flushed atomic replacement, and integrity checks appropriate to the data.
 - Exclusive locks use the shared complete-before-visible hard-link claim. Reclamation requires process identity plus a matching file snapshot/token; do not unlink a path merely because an earlier read looked stale.
@@ -122,6 +123,8 @@ A higher branch count is acceptable only when the function is an explicit state
 
 Every defect fix includes a regression test that fails for the original reason. Prefer two layers when applicable:
 
+Prototype-shaped strings such as `constructor`, `__proto__`, `hasOwnProperty`, `toString`, and `valueOf` are mandatory negative or ordinary-data cases for any new externally indexed object boundary. Byte-bounded text tests must include non-ASCII input and assert the encoded result size, not only JavaScript string length.
+
 1. a deterministic test of the extracted policy or lifecycle;
 2. an integration test proving the adapter uses it correctly.
 

package/docs/PROJECT_STANDARDS.md

@@ -64,6 +64,7 @@ The architectural dependency direction in [ENGINEERING.md](ENGINEERING.md) is no
 - **High cohesion and low coupling:** one source file or function owns one coherent responsibility and reason to change; collaboration occurs through narrow explicit contracts rather than cross-layer reach-through.
 - **KISS:** prefer the simplest explicit implementation that satisfies current requirements. Do not introduce factories, registries, inheritance, generic frameworks, or configuration layers without an observed variation that needs them.
 - **DRY:** extract repeated business rules, validation, security boundaries, or lifecycle logic into one authoritative implementation. Do not merge merely similar code when its semantics or failure policy differ.
+- **Exact key membership:** external string keys used for dispatch, enums, ACLs, forms, or registries use `Map`, `Set`, `Object.hasOwn`, or null-prototype records. Prototype-chain membership and truthy ordinary-object lookup are not contract validation.
 - Design patterns are used only when they remove an observed variation or coupling. A direct function or small module is preferred over speculative abstractions.
 
 Any deliberate boundary exception must document the dependency, reason, owner, test coverage, and removal condition.

package/docs/TESTING.md

@@ -54,6 +54,10 @@ The suite includes:
 - owner-only directory enforcement rejecting final symlinks, failing closed on POSIX chmod errors, verifying `0700`, and retaining Windows portability; Worker temporary-secret lifecycle coverage for process-start-bound names, valid stale-owner reclamation, ambiguous-owner retention, `0600` mode, deletion failures, and simultaneous deployment/cleanup failures;
 - SARIF security-gate behavior for unknown findings, exact accepted rule/path matches, path mismatch rejection, rationale quality, and exception expiry;
 - deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv;
+- prototype-shaped command, action, role, profile, form-field, keyboard, and resource names proving that inherited object properties are never interpreted as dispatch or authority; current-schema malformed OAuth roles are repaired to disabled reviewer accounts with credential revocation;
+- canonical Worker deployment URL extraction proving unrelated `/mcp`, `/healthz`, path-bearing, and wrong-name URLs cannot be persisted as upload evidence;
+- byte-exact UTF-8 DOM-source truncation across emoji and Chinese partial-code-point boundaries, including equality between the reported byte count and the encoded returned source;
+- independently injected service CLI status/install/start/stop/uninstall/remove paths, including provider failure, no selected workspace, no deployed Worker, aliases, and default output/exit adapters;
 - CLI parsing, policy profiles, and client configuration boundaries;
 - live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
 - live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, access/refresh rotation, stale refresh replay rejection, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
@@ -75,7 +79,7 @@ For deterministic release validation, perform an isolated-profile smoke test wit
 
 ## Critical-module coverage gate
 
-`npm run coverage:test` runs selected in-process and lightweight entrypoint fixtures under V8 coverage and enforces per-module function and branch baselines. The measured set now includes policy, typed errors, call registration, execution middleware, lifecycle/observability, logging, Runtime/CLI orchestration, Agent configuration, capability ranking, browser protocol/operation boundaries, runtime reporting/diagnostics/capability composition, and Worker pending/policy/error modules. The full stdio and workerd OAuth/MCP integration still runs separately; a focused direct Node test covers `OAuthController` registration throttling, authorization failure/success, resource-bound access tokens, expiry pruning, invalid-state rejection, and identity-key failure.
+`npm run coverage:test` runs selected in-process and lightweight entrypoint fixtures under V8 coverage and enforces per-module function and branch baselines. The measured set now includes policy, typed errors, call registration, execution middleware, lifecycle/observability, logging, Runtime/CLI orchestration, the independently injected service CLI adapter, Agent configuration, capability ranking, browser protocol/operation boundaries, runtime reporting/diagnostics/capability composition, and Worker pending/policy/error modules. The full stdio and workerd OAuth/MCP integration still runs separately; a focused direct Node test covers `OAuthController` registration throttling, authorization failure/success, resource-bound access tokens, expiry pruning, invalid-state rejection, and identity-key failure.
 
 The gate deliberately reports each module rather than one aggregate percentage. New extracted pure/domain modules carry explicit branch floors, while the broad CLI entrypoint remains reported and locked independently. Worker pending calls and policy now have branch minima instead of function-only gates. A refactor may raise a threshold, but must not lower one merely to make CI green without an explicit audit explanation.
 
@@ -124,4 +128,4 @@ The stdio integration test also sends an oversized line, verifies bounded reject
 
 ## Architecture and documentation regression checks
 
-`npm run architecture:test` rejects movable GitHub Action references and loss of the CI history scan, release-gate script drift, local-module dependency cycles, missing static or dynamic relative imports, package scripts that reference missing files, drift from the recursive syntax scanner, incomplete executable package directories, inconsistent installation guidance, obsolete `LocalDaemon`/`daemon.mjs` naming, broken relative Markdown links, invisible ASCII control bytes in repository text, removal of the owner-required default-`full` engineering invariant, and accidental publication of `.project-local/` notes.
+`npm run architecture:test` runs independent module-boundary, repository-hygiene, browser/security-structure, and release/documentation-contract checks. It rejects movable GitHub Action references and loss of the CI history scan, release-gate script drift, local-module dependency cycles, missing static or dynamic relative imports, package scripts that reference missing files, drift from the recursive syntax scanner, incomplete executable package directories, inconsistent installation guidance, obsolete `LocalDaemon`/`daemon.mjs` naming, broken relative Markdown links, invisible ASCII control bytes in repository text, removal of the owner-required default-`full` engineering invariant, and accidental publication of `.project-local/` notes.

package/docs/UPGRADING.md

@@ -4,7 +4,9 @@
 
 Machine Bridge does not retain parallel implementations for obsolete MCP protocol dates, policy revisions, state schemas, lock formats, or browser-extension protocols. The supported path is a direct upgrade from the immediately preceding published package while its state already uses the current schema.
 
-Version 1.2 keeps local state schema version 6 and policy revision 5 unchanged. Existing 1.1.5 workspaces, named accounts, resource registrations, managed-job history, Worker identity, and browser pairing state are reused without conversion. The architecture refactor changes module ownership, not persisted formats or authority.
+Version 1.2.1 keeps local state schema version 6 and policy revision 5 unchanged. Existing 1.2.0 workspaces, named accounts, resource registrations, managed-job history, Worker identity, and browser pairing state are reused without a schema conversion. The package change affects validation and adapter ownership, not the stored authority model.
+
+Version 1.2.0 could accept prototype-shaped account roles through malformed administration input. On the first 1.2.1 Worker access, such an account is preserved for recovery but repaired fail-closed: its role becomes `reviewer`, it is disabled, its account version advances, and its authorization codes and tokens are removed. An operator can then assign a valid role, enable the account, and rotate its password through the normal account administration flow. A local policy record with an unknown profile label is normalized to `custom` while retaining its explicit capability fields; an invalid explicit `--profile` is rejected.
 
 A state file from an older unsupported schema is rejected rather than guessed or silently rewritten. Upgrade an old installation through the last release that understands its schema, or initialize a new workspace and re-register resources. Do not edit schema numbers by hand.
 
@@ -25,6 +27,6 @@ Machine Bridge never treats an unreadable or foreign-schema state file as empty
 
 ## Rollback
 
-Rollback is supported only when the older package understands every persisted schema and protocol already written by the newer package. Version 1.2 does not advance local state or policy schemas, so rollback to 1.1.5 remains structurally possible, but the preferred recovery is to fix forward because the browser extension and deployed Worker must match the running package exactly.
+Rollback is supported only when the older package understands every persisted schema and protocol already written by the newer package. Version 1.2.1 does not advance local state or policy schemas, so rollback to 1.2.0 remains structurally possible. A repaired malformed account remains a valid disabled reviewer record that 1.2.0 can read. The preferred recovery is still to fix forward because the browser extension and deployed Worker must match the running package exactly, and rollback would restore the defective input validation.
 
 Never roll back by copying only selected state files or changing version fields. Restore one complete verified state backup, package version, Worker build, and browser extension as a single operational unit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "machine-bridge-mcp",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Cross-client MCP bridge for local agent context, structured browser and application automation, files, Git, processes, resources, and durable jobs over stdio or OAuth relay.",
   "type": "module",
   "license": "MIT",
@@ -47,7 +47,7 @@
     "worker:types": "node scripts/generate-worker-types.mjs",
     "typecheck": "npm run worker:types && tsc -p tsconfig.json --noEmit && npm run typecheck:local",
     "syntax": "node scripts/syntax-check.mjs",
-    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run worker-deployment:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run worker-oauth-controller:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-boundaries:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-environment:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test && npm run oauth-browser:test",
+    "check": "npm run privacy:check && npm run privacy:test && npm run release-impact:check && npm run release-impact:test && npm run release-state:test && npm run release-ci:test && npm run network-retry:test && npm run worker-deployment:test && npm run relay:test && npm run secure-file:test && npm run worker-secret-file:test && npm run sarif-security:test && npm run security-properties:test && npm run shell:test && npm run architecture:test && npm run markdown:test && npm run project-metadata:test && npm run numbers:test && npm run records:test && npm run state-inventory:test && npm run commit-message:test && npm run policy:test && npm run account:test && npm run worker-oauth-controller:test && npm run policy-docs:check && npm run tool-docs:check && npm run runtime-infrastructure:test && npm run runtime-boundaries:test && npm run runtime-handlers:test && npm run cli-entrypoint:test && npm run cli-service:test && npm run lifecycle:test && npm run logging-structure:test && npm run coverage:test && npm run worker-runtime-infrastructure:test && npm run lint:test && npm run lint && npm run typecheck && npm run syntax && npm run deadline:test && npm run process-lock:test && npm run service-lifecycle:test && npm run service-environment:test && npm run service-platform:test && npm run catalog:test && npm run agent-context:test && npm run capability-ranking:test && npm run browser-command:test && npm run browser-devtools-input:test && npm run browser-service-worker:test && npm run browser-page-automation:test && npm run browser-bridge:test && npm run app-automation:test && npm run self-test && npm run atomic-fs:test && npm run package:test && npm run install:test && npm run ssh-key:test && npm run full-access:test && npm run managed-jobs:test && npm run stdio:integration-test && npm run worker:integration-test && npm run oauth-browser:test",
     "worker:dry-run": "wrangler deploy --dry-run",
     "worker:integration-test": "node tests/worker-integration-test.mjs",
     "release:check": "node scripts/github-release.mjs --check",
@@ -116,7 +116,8 @@
     "worker-deployment:test": "node tests/worker-deployment-test.mjs",
     "typecheck:local": "tsc -p tsconfig.local.json --noEmit",
     "runtime-boundaries:test": "node tests/runtime-boundaries-test.mjs",
-    "worker-oauth-controller:test": "node tests/worker-oauth-controller-test.mjs"
+    "worker-oauth-controller:test": "node tests/worker-oauth-controller-test.mjs",
+    "cli-service:test": "node tests/cli-service-test.mjs"
   },
   "dependencies": {
     "https-proxy-agent": "9.1.0",

package/scripts/coverage-check.mjs

@@ -15,6 +15,7 @@ const tests = [
   "tests/logging-structure-test.mjs",
   "tests/runtime-handler-matrix-test.mjs",
   "tests/cli-entrypoint-test.mjs",
+  "tests/cli-service-test.mjs",
   "tests/local-self-test.mjs",
   "tests/runtime-self-test.mjs",
   "tests/numbers-test.mjs",
@@ -53,7 +54,8 @@ try {
     "src/local/process-tracker.mjs": [65, 35],
     "src/local/log.mjs": [60, 40],
     "src/local/runtime.mjs": [75, 55],
-    "src/local/cli.mjs": [45, 20],
+    "src/local/cli.mjs": [48, 21.9],
+    "src/local/cli-service.mjs": [90, 65],
     "src/local/cli-options.mjs": [65, 35],
     "src/local/cli-policy.mjs": [70, 35],
     "src/local/numbers.mjs": [100, 100],

package/src/local/account-access.mjs

@@ -3,20 +3,22 @@ import { BridgeError } from "./errors.mjs";
 import { policyProfile, toolNamesForPolicy, assertToolAllowed } from "./policy.mjs";
 
 export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
-export const ACCOUNT_ROLES = Object.freeze(Object.fromEntries(
-  Object.entries(accessContract.roles).map(([name, value]) => [name, Object.freeze({ ...value })]),
-));
+const ACCOUNT_ROLE_ENTRIES = Object.entries(accessContract.roles)
+  .map(([name, value]) => [name, Object.freeze({ ...value })]);
+const ACCOUNT_ROLE_BY_NAME = new Map(ACCOUNT_ROLE_ENTRIES);
+export const ACCOUNT_ROLES = Object.freeze(Object.fromEntries(ACCOUNT_ROLE_ENTRIES));
+export const DEFAULT_ACCOUNT_ROLE = String(accessContract.defaultRole);
 export const OWNER_ACCOUNT_ROLE = String(accessContract.ownerRole);
 
 export function normalizeAccountRole(value) {
   const role = String(value || "").trim().toLowerCase();
-  if (!ACCOUNT_ROLES[role]) throw new BridgeError("invalid_request", `unknown account role: ${role}`);
+  if (!ACCOUNT_ROLE_BY_NAME.has(role)) throw new BridgeError("invalid_request", `unknown account role: ${role}`);
   return role;
 }
 
 export function accountRolePolicy(role) {
   const normalized = normalizeAccountRole(role);
-  return policyProfile(ACCOUNT_ROLES[normalized].profile, "explicit");
+  return policyProfile(ACCOUNT_ROLE_BY_NAME.get(normalized).profile, "explicit");
 }
 
 export function accountRoleToolNames(role) {

package/src/local/cli-local-admin.mjs

@@ -25,17 +25,17 @@ export function createLocalAdminCommands(dependencies) {
   });
 }
 
-const RESOURCE_ACTION_HANDLERS = Object.freeze({
-  list: resourceListAction,
-  add: resourceAddAction,
-  "generate-ssh-key": resourceGenerateSshKeyAction,
-  remove: resourceRemoveAction,
-  check: resourceCheckAction,
-});
+const RESOURCE_ACTION_HANDLERS = new Map([
+  ["list", resourceListAction],
+  ["add", resourceAddAction],
+  ["generate-ssh-key", resourceGenerateSshKeyAction],
+  ["remove", resourceRemoveAction],
+  ["check", resourceCheckAction],
+]);
 
 async function resourceCommand(args, { chooseWorkspace }) {
   const action = String(args._[0] || "list").toLowerCase();
-  const handler = RESOURCE_ACTION_HANDLERS[action];
+  const handler = RESOURCE_ACTION_HANDLERS.get(action);
   if (!handler) throw new Error(`Unknown resource action: ${action}`);
   const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
   const state = loadState(workspace, { stateDir: args.stateDir });
@@ -155,7 +155,7 @@ async function resourceRemoveAction({ args, workspace, state }) {
 
 function resourceCheckAction({ args, state }) {
   const name = validateResourceName(args._[1]);
-  const resource = state.resources[name];
+  const resource = Object.hasOwn(state.resources, name) ? state.resources[name] : null;
   if (!resource) throw new Error(`local resource is not registered: ${name}`);
   const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
   const result = publicResourceInspection(name, inspected, { includePath: args.showPaths === true });
@@ -181,15 +181,47 @@ function publicResourceInspection(name, inspected, { includePath = false, ...ext
   };
 }
 
-async function browserCommand(args, { chooseWorkspace }) {
+const BROWSER_ACTION_HANDLERS = new Map([
+  ["path", browserPathAction],
+  ["status", browserStatusAction],
+  ["setup", browserPairAction],
+  ["pair", browserPairAction],
+]);
+
+async function browserCommand(args, dependencies) {
   const action = String(args._[0] || "status").toLowerCase();
+  const handler = BROWSER_ACTION_HANDLERS.get(action);
+  if (!handler) throw new Error(`Unknown browser action: ${action}`);
+  return handler(args, dependencies);
+}
+
+function browserPathAction(args) {
   const extensionPath = resolve(packageRoot, "browser-extension");
-  if (action === "path") {
-    if (args.json) console.log(JSON.stringify({ extension_path: extensionPath }, null, 2));
-    else console.log(extensionPath);
+  if (args.json) console.log(JSON.stringify({ extension_path: extensionPath }, null, 2));
+  else console.log(extensionPath);
+}
+
+async function browserStatusAction(args, { chooseWorkspace }) {
+  const context = await browserCommandContext(args, chooseWorkspace);
+  renderBrowserStatus(context.result, args.json === true);
+}
+
+async function browserPairAction(args, { chooseWorkspace }) {
+  const context = await browserCommandContext(args, chooseWorkspace);
+  if (!context.result.running) throw new Error("browser bridge is not reachable; keep machine-mcp running and retry");
+  await openExternal(context.pairingUrl);
+  if (args.json) {
+    console.log(JSON.stringify({ ...context.result, pairing_page_opened: true }, null, 2));
     return;
   }
-  if (!["status", "setup", "pair"].includes(action)) throw new Error(`Unknown browser action: ${action}`);
+  console.log(`Extension path: ${context.extensionPath}`);
+  console.log("Load this directory in the Chromium profile you use every day; Machine Bridge does not install it into Playwright or a separate automation profile.");
+  console.log("Enable Developer mode, choose Load unpacked, and reload the extension after each Machine Bridge upgrade.");
+  console.log(`Pairing page opened: ${context.pairingUrl}`);
+}
+
+async function browserCommandContext(args, chooseWorkspace) {
+  const extensionPath = resolve(packageRoot, "browser-extension");
   const workspace = await chooseWorkspace({ ...args, _: [] }, { promptOnFirstRun: false, save: false, allowPositional: false });
   const state = loadState(workspace, { stateDir: args.stateDir });
   const pairingFile = join(state.paths.stateRoot, "browser-bridge.json");
@@ -197,6 +229,13 @@ async function browserCommand(args, { chooseWorkspace }) {
     throw new Error("browser bridge is not initialized; start machine-mcp once, then run this command again");
   }
   ownerOnlyFile(pairingFile);
+  const pairing = readBrowserPairingState(pairingFile);
+  const pairingUrl = `http://127.0.0.1:${pairing.port}/pair`;
+  const health = await readBrowserHealth(`http://127.0.0.1:${pairing.port}/healthz`);
+  return { extensionPath, pairingUrl, result: browserStatusResult(health, extensionPath, pairingUrl) };
+}
+
+function readBrowserPairingState(pairingFile) {
   let pairing;
   try {
     pairing = JSON.parse(readBoundedRegularFileSync(pairingFile, 64 * 1024).toString("utf8"));
@@ -206,12 +245,17 @@ async function browserCommand(args, { chooseWorkspace }) {
   const port = Number(pairing.port);
   if (!/^[A-Za-z0-9_-]{32,100}$/.test(String(pairing.token || ""))) throw new Error("browser bridge state contains an invalid token");
   if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("browser bridge state contains an invalid port");
-  const pairingUrl = `http://127.0.0.1:${port}/pair`;
-  const healthUrl = `http://127.0.0.1:${port}/healthz`;
-  const health = await fetch(healthUrl, { signal: AbortSignal.timeout(2000), cache: "no-store" })
+  return { port };
+}
+
+function readBrowserHealth(healthUrl) {
+  return fetch(healthUrl, { signal: AbortSignal.timeout(2000), cache: "no-store" })
     .then(async (response) => response.ok ? await response.json() : null)
     .catch(() => null);
-  const result = {
+}
+
+function browserStatusResult(health, extensionPath, pairingUrl) {
+  return {
     running: health?.ok === true && health?.broker === "machine-bridge-browser",
     connected: health?.broker === "machine-bridge-browser" && health?.connected === true,
     extension_path: extensionPath,
@@ -227,28 +271,20 @@ async function browserCommand(args, { chooseWorkspace }) {
     profile_identity_verifiable: health?.profile_identity_verifiable === true,
     token_exposed: false,
   };
-  if (action === "status") {
-    if (args.json) console.log(JSON.stringify(result, null, 2));
-    else {
-      console.log(`Browser bridge: ${result.running ? "running" : "not reachable"}`);
-      console.log(`Extension: ${result.connected ? "connected" : result.extension_reload_required ? "reload required" : "not connected"}`);
-      if (result.expected_extension_version) console.log(`Expected extension build: ${result.expected_extension_version}`);
-      if (result.extension_version || result.extension_protocol) console.log(`Connected extension build: ${result.extension_version || "unknown"} (protocol ${result.extension_protocol ?? "unknown"})`);
-      console.log(`Browser profile: ${result.controls_extension_profile ? "the Chromium profile where this extension is installed" : "unknown"}`);
-      if (result.controls_extension_profile) console.log(`Profile provenance: Machine Bridge did not launch the browser; daily-vs-isolated profile identity is not machine-verifiable.`);
-      console.log(`Extension path: ${extensionPath}`);
-    }
+}
+
+function renderBrowserStatus(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
     return;
   }
-  if (!result.running) throw new Error("browser bridge is not reachable; keep machine-mcp running and retry");
-  await openExternal(pairingUrl);
-  if (args.json) console.log(JSON.stringify({ ...result, pairing_page_opened: true }, null, 2));
-  else {
-    console.log(`Extension path: ${extensionPath}`);
-    console.log("Load this directory in the Chromium profile you use every day; Machine Bridge does not install it into Playwright or a separate automation profile.");
-    console.log("Enable Developer mode, choose Load unpacked, and reload the extension after each Machine Bridge upgrade.");
-    console.log(`Pairing page opened: ${pairingUrl}`);
-  }
+  console.log(`Browser bridge: ${result.running ? "running" : "not reachable"}`);
+  console.log(`Extension: ${result.connected ? "connected" : result.extension_reload_required ? "reload required" : "not connected"}`);
+  if (result.expected_extension_version) console.log(`Expected extension build: ${result.expected_extension_version}`);
+  if (result.extension_version || result.extension_protocol) console.log(`Connected extension build: ${result.extension_version || "unknown"} (protocol ${result.extension_protocol ?? "unknown"})`);
+  console.log(`Browser profile: ${result.controls_extension_profile ? "the Chromium profile where this extension is installed" : "unknown"}`);
+  if (result.controls_extension_profile) console.log("Profile provenance: Machine Bridge did not launch the browser; daily-vs-isolated profile identity is not machine-verifiable.");
+  console.log(`Extension path: ${result.extension_path}`);
 }
 
 function openExternal(target) {

package/src/local/cli-options.mjs

@@ -11,7 +11,7 @@ const VALUE_OPTIONS = new Set([
 
 const LOG_FORMATS = new Set(["text", "json"]);
 
-const COMMAND_OPTIONS = {
+const COMMAND_OPTIONS = new Map(Object.entries({
   start: new Set([
     "workspace", "stateDir", "workerName", "quiet", "json", "verbose", "logLevel", "logFormat", "rotateSecrets", "forceWorker",
     "daemonOnly", "noAutostart",
@@ -31,17 +31,17 @@ const COMMAND_OPTIONS = {
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
-};
+}));
 
 const SINGLE_WORKSPACE_POSITIONAL_COMMANDS = new Set(["start", "stdio", "status", "doctor", "full-test", "rotate-secrets"]);
-const STATIC_POSITIONAL_RULES = Object.freeze({
-  "client-config": Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" }),
-  uninstall: Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" }),
-});
-const RESOURCE_POSITIONAL_LIMITS = Object.freeze({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 });
-const JOB_POSITIONAL_LIMITS = Object.freeze({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 });
-const ACCOUNT_POSITIONAL_LIMITS = Object.freeze({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 });
-const ACTION_POSITIONAL_RULES = Object.freeze({
+const STATIC_POSITIONAL_RULES = new Map([
+  ["client-config", Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" })],
+  ["uninstall", Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" })],
+]);
+const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
+const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
+const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
     return { max: action === "set" || action === "select" ? 2 : 1, tooMany: `workspace ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
@@ -50,14 +50,14 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
     const action = String(args._[0] || "status");
     return { max: ["install", "status", "stop", "uninstall", "remove"].includes(action) ? 2 : 1, tooMany: `service ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
   },
-  autostart(args) { return ACTION_POSITIONAL_RULES.service(args); },
+  autostart(args) { return ACTION_POSITIONAL_RULES.get("service")(args); },
   resource(args) {
     const action = String(args._[0] || "list");
-    return { max: RESOURCE_POSITIONAL_LIMITS[action] ?? 1, tooMany: `resource ${action} received too many positional arguments` };
+    return { max: RESOURCE_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `resource ${action} received too many positional arguments` };
   },
   account(args) {
     const action = String(args._[0] || "list");
-    return { max: ACCOUNT_POSITIONAL_LIMITS[action] ?? 1, tooMany: `account ${action} received too many positional arguments` };
+    return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
   browser(args) {
     const action = String(args._[0] || "status");
@@ -65,9 +65,9 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
   },
   job(args) {
     const action = String(args._[0] || "list");
-    return { max: JOB_POSITIONAL_LIMITS[action] ?? 1, tooMany: `job ${action} received too many positional arguments` };
+    return { max: JOB_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `job ${action} received too many positional arguments` };
   },
-});
+}));
 
 export function normalizeCommand(argv) {
   if (!argv.length || argv[0].startsWith("--")) return ["start", argv];
@@ -105,7 +105,7 @@ export function parseArgs(argv) {
 }
 
 export function validateCommandOptions(command, args) {
-  const allowed = COMMAND_OPTIONS[command];
+  const allowed = COMMAND_OPTIONS.get(command);
   if (!allowed) return;
   for (const key of Object.keys(args)) {
     if (key === "_" || key === "help" || key === "version") continue;
@@ -144,8 +144,8 @@ function positionalRule(command, args) {
   if (SINGLE_WORKSPACE_POSITIONAL_COMMANDS.has(command)) {
     return { max: 1, tooMany: `${command} accepts at most one positional workspace path`, workspaceConflictAfter: 0 };
   }
-  if (STATIC_POSITIONAL_RULES[command]) return STATIC_POSITIONAL_RULES[command];
-  return ACTION_POSITIONAL_RULES[command]?.(args) || null;
+  if (STATIC_POSITIONAL_RULES.has(command)) return STATIC_POSITIONAL_RULES.get(command);
+  return ACTION_POSITIONAL_RULES.get(command)?.(args) || null;
 }
 function parseBooleanOption(value, key) {
   if (value === "true" || value === "1") return true;

package/src/local/cli-policy.mjs

@@ -37,7 +37,7 @@ function policyState(policy) {
 function selectPolicyBase(args, stored, hasStored) {
   if (args.profile !== undefined) {
     const profile = String(args.profile).trim().toLowerCase();
-    if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+    if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
     return policyProfile(profile, "explicit");
   }
   if (!hasStored) return policyProfile(DEFAULT_POLICY_PROFILE, "default");

package/src/local/cli-service.mjs

@@ -0,0 +1,132 @@
+import process from "node:process";
+import * as defaultService from "./service.mjs";
+import { inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
+import { serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadState, resolveWorkspace, selectedWorkspace } from "./state.mjs";
+
+const SERVICE_ACTION_HANDLERS = new Map([
+  ["status", serviceStatusAction],
+  ["install", serviceInstallAction],
+  ["start", serviceStartAction],
+  ["stop", serviceStopAction],
+  ["uninstall", serviceUninstallAction],
+  ["remove", serviceUninstallAction],
+]);
+
+export function createServiceCommand(dependencies) {
+  const context = {
+    chooseWorkspace: requiredFunction(dependencies.chooseWorkspace, "chooseWorkspace"),
+    stateRootFromArgs: requiredFunction(dependencies.stateRootFromArgs, "stateRootFromArgs"),
+    structuredLogger: requiredFunction(dependencies.structuredLogger, "structuredLogger"),
+    service: dependencies.service || defaultService,
+    inspectWorkspaceDaemon: dependencies.inspectWorkspaceDaemon || inspectWorkspaceDaemon,
+    stopWorkspaceServiceDaemon: dependencies.stopWorkspaceServiceDaemon || stopWorkspaceServiceDaemon,
+    stopAndRemoveAutostart: dependencies.stopAndRemoveAutostart || stopAndRemoveAutostart,
+    serviceEnvironmentSummary: dependencies.serviceEnvironmentSummary || serviceEnvironmentSummary,
+    loadState: dependencies.loadState || loadState,
+    resolveWorkspace: dependencies.resolveWorkspace || resolveWorkspace,
+    selectedWorkspace: dependencies.selectedWorkspace || selectedWorkspace,
+    entryScript: dependencies.entryScript || process.argv[1],
+    setExitCode: dependencies.setExitCode || setProcessExitCode,
+    print: dependencies.print || printLine,
+  };
+  return (args) => serviceCommand(args, context);
+}
+
+async function serviceCommand(args, context) {
+  const action = String(args._[0] || "status").toLowerCase();
+  const handler = SERVICE_ACTION_HANDLERS.get(action);
+  if (!handler) throw new Error(`Unknown service action: ${action}`);
+  const stateRoot = context.stateRootFromArgs(args);
+  return handler({ args, stateRoot, service: context.service, context });
+}
+
+async function serviceStatusAction({ args, stateRoot, service, context }) {
+  const status = await service.autostartStatus();
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state ? context.inspectWorkspaceDaemon(state) : null;
+  printServiceResult({
+    ...status,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+    service_environment: context.serviceEnvironmentSummary(stateRoot),
+    effective_active: Boolean(status.active || workspaceDaemon?.alive),
+    orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
+  }, context, false);
+}
+
+async function serviceInstallAction({ args, stateRoot, service, context }) {
+  const workspaceArgs = { ...args, _: args._.slice(1) };
+  const workspace = await context.chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
+  const state = context.loadState(workspace, { stateDir: stateRoot });
+  if (!state.worker?.url) {
+    throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
+  }
+  const result = await service.installAutostart({
+    workspace,
+    stateRoot,
+    entryScript: context.entryScript,
+    logger: context.structuredLogger(Boolean(args.quiet)),
+  });
+  printServiceResult(result, context);
+}
+
+async function serviceStartAction({ args, service, context }) {
+  const result = await service.startAutostart({ logger: context.structuredLogger(Boolean(args.quiet)) });
+  printServiceResult(result, context);
+}
+
+async function serviceStopAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const provider = await service.stopAutostart({ logger });
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state
+    ? await context.stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
+    : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
+  printServiceResult({
+    ...provider,
+    ok: provider?.ok !== false && workspaceDaemon.ok,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+  }, context);
+}
+
+async function serviceUninstallAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const state = optionalServiceState(args, stateRoot, context);
+  const lifecycle = await context.stopAndRemoveAutostart({
+    states: state ? [state] : [],
+    stateRoot,
+    logger,
+    reason: "service uninstall",
+    stopAutostart: service.stopAutostart,
+    uninstallAutostart: service.uninstallAutostart,
+    stopWorkspaceServiceDaemon: context.stopWorkspaceServiceDaemon,
+  });
+  printServiceResult({
+    ...lifecycle,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: lifecycle.workspace_daemons[0] || null,
+    autostart_removed: lifecycle.removed,
+  }, context);
+}
+
+function optionalServiceState(args, stateRoot, context) {
+  const requested = args.workspace || args._[1] || context.selectedWorkspace(stateRoot);
+  if (!requested || requested === true) return null;
+  return context.loadState(context.resolveWorkspace(String(requested)), { stateDir: stateRoot });
+}
+
+function printServiceResult(result, context, updateExitCode = true) {
+  context.print(JSON.stringify(result, null, 2));
+  if (updateExitCode && result?.ok === false) context.setExitCode(1);
+}
+
+function requiredFunction(value, name) {
+  if (typeof value !== "function") throw new TypeError(`service command requires ${name}`);
+  return value;
+}
+
+function setProcessExitCode(value) { process.exitCode = value; }
+function printLine(value) { console.log(value); }

package/src/local/cli.mjs

@@ -3,13 +3,14 @@ import { join, resolve } from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalRuntime } from "./runtime.mjs";
-import { acquireDaemonLockWithTakeover, inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { acquireDaemonLockWithTakeover, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
 import { inspectProcessInstance } from "./process-identity.mjs";
 import { runStdioServer } from "./stdio.mjs";
 import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./tools.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { createServiceCommand } from "./cli-service.mjs";
 import { generateAccountPassword } from "./account-admin.mjs";
 import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
 export { resolvePolicy } from "./cli-policy.mjs";
@@ -18,7 +19,7 @@ import { classifyOperationalError, createLogger, sanitizeLogText } from "./log.m
 import { runExecutable, runWrangler } from "./shell.mjs";
 import { runFullAccessTest } from "./full-access-test.mjs";
 import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
-import { loadServiceEnvironment, serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadServiceEnvironment } from "./service-environment.mjs";
 import { ensureWorkerDeployment } from "./worker-deployment.mjs";
 import { workerHealth } from "./worker-health.mjs";
 export { workerHealthUserReason } from "./worker-health.mjs";
@@ -48,24 +49,25 @@ import {
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
-
-const COMMAND_HANDLERS = Object.freeze({
-  start: startCommand,
-  stdio: stdioCommand,
-  "client-config": clientConfigCommand,
-  status: statusCommand,
-  doctor: doctorCommand,
-  "full-test": fullTestCommand,
-  workspace: workspaceCommand,
-  service: serviceCommand,
-  autostart: serviceCommand,
-  "rotate-secrets": rotateSecretsCommand,
-  resource: localAdminCommands.resourceCommand,
-  account: accountCommand,
-  browser: localAdminCommands.browserCommand,
-  job: localAdminCommands.jobCommand,
-  uninstall: uninstallCommand,
-});
+const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
+
+const COMMAND_HANDLERS = new Map([
+  ["start", startCommand],
+  ["stdio", stdioCommand],
+  ["client-config", clientConfigCommand],
+  ["status", statusCommand],
+  ["doctor", doctorCommand],
+  ["full-test", fullTestCommand],
+  ["workspace", workspaceCommand],
+  ["service", serviceCommand],
+  ["autostart", serviceCommand],
+  ["rotate-secrets", rotateSecretsCommand],
+  ["resource", localAdminCommands.resourceCommand],
+  ["account", accountCommand],
+  ["browser", localAdminCommands.browserCommand],
+  ["job", localAdminCommands.jobCommand],
+  ["uninstall", uninstallCommand],
+]);
 
 export async function main(argv = process.argv.slice(2)) {
   const [command, rest] = normalizeCommand(argv);
@@ -75,7 +77,7 @@ export async function main(argv = process.argv.slice(2)) {
   validateCommandOptions(command, args);
   validatePositionals(command, args);
   validateLoggingOptions(args);
-  const handler = COMMAND_HANDLERS[command];
+  const handler = COMMAND_HANDLERS.get(command);
   if (handler) return handler(args);
   console.error(`Unknown command: ${command}`);
   usage();
@@ -352,7 +354,7 @@ async function clientConfigCommand(args) {
   const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: false, save: false, allowPositional: false });
   const requested = String(args.client || args._[0] || "all").trim().toLowerCase();
   const profile = String(args.profile || "full").trim().toLowerCase();
-  if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+  if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
   if (!["all", "claude", "cursor", "codex", "generic"].includes(requested)) throw new Error("client must be all, claude, cursor, codex, or generic");
   const command = process.execPath;
   const argsList = [resolve(process.argv[1]), "stdio", "--workspace", workspace, "--profile", profile];
@@ -537,90 +539,6 @@ async function rotateSecretsCommand(args) {
   }
 }
 
-async function serviceCommand(args) {
-  const action = String(args._[0] || "status");
-  const stateRoot = stateRootFromArgs(args);
-  const { installAutostart, uninstallAutostart, autostartStatus, startAutostart, stopAutostart } = await import("./service.mjs");
-  if (action === "status") {
-    const status = await autostartStatus();
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state ? inspectWorkspaceDaemon(state) : null;
-    console.log(JSON.stringify({
-      ...status,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-      service_environment: serviceEnvironmentSummary(stateRoot),
-      effective_active: Boolean(status.active || workspaceDaemon?.alive),
-      orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
-    }, null, 2));
-    return;
-  }
-  if (action === "install") {
-    const workspaceArgs = { ...args, _: args._.slice(1) };
-    const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
-    const state = loadState(workspace, { stateDir: stateRoot });
-    if (!state.worker?.url) {
-      throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
-    }
-    const result = await installAutostart({ workspace, stateRoot, entryScript: process.argv[1], logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "start") {
-    const result = await startAutostart({ logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "stop") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const provider = await stopAutostart({ logger });
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state
-      ? await stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
-      : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
-    const result = {
-      ...provider,
-      ok: provider?.ok !== false && workspaceDaemon.ok,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-    };
-    console.log(JSON.stringify(result, null, 2));
-    if (!result.ok) process.exitCode = 1;
-    return;
-  }
-  if (action === "uninstall" || action === "remove") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const state = optionalServiceState(args, stateRoot);
-    const lifecycle = await stopAndRemoveAutostart({
-      states: state ? [state] : [],
-      stateRoot,
-      logger,
-      reason: "service uninstall",
-      stopAutostart,
-      uninstallAutostart,
-      stopWorkspaceServiceDaemon,
-    });
-    const output = {
-      ...lifecycle,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: lifecycle.workspace_daemons[0] || null,
-      autostart_removed: lifecycle.removed,
-    };
-    console.log(JSON.stringify(output, null, 2));
-    if (!output.ok) process.exitCode = 1;
-    return;
-  }
-  throw new Error(`Unknown service action: ${action}`);
-}
-
-function optionalServiceState(args, stateRoot) {
-  const requested = args.workspace || args._[1] || selectedWorkspace(stateRoot);
-  if (!requested || requested === true) return null;
-  return loadState(resolveWorkspace(String(requested)), { stateDir: stateRoot });
-}
-
 async function installAutostartBestEffort({ workspace, stateRoot, entryScript, logger }) {
   try {
     const { installAutostart } = await import("./service.mjs");

package/src/local/managed-job-plan.mjs

@@ -156,10 +156,10 @@ function referencedResources(steps, registry) {
     }
   }
   if (names.size > MAX_RESOURCES) throw new Error(`job references more than ${MAX_RESOURCES} local resources`);
-  const out = {};
+  const out = Object.create(null);
   let totalBytes = 0;
   for (const name of names) {
-    const resource = registry[name];
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
     if (!resource) throw new Error(`unknown local resource: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true, includeHash: true });
     totalBytes += inspected.size;
@@ -174,7 +174,7 @@ function referencedResources(steps, registry) {
 }
 
 export function normalizeResourceRegistry(resources) {
-  const out = {};
+  const out = Object.create(null);
   if (!resources || typeof resources !== "object" || Array.isArray(resources)) return out;
   for (const [rawName, rawValue] of Object.entries(resources).slice(0, MAX_RESOURCES)) {
     const name = validateResourceName(rawName);

package/src/local/policy.mjs

@@ -53,6 +53,7 @@ export const DEFAULT_POLICY_REVISION = Number(contract.revision);
 export const POLICY_PROFILES = Object.freeze(Object.fromEntries(
   Object.entries(contract.profiles).map(([name, value]) => [name, Object.freeze(/** @type {PolicyCapabilities} */ ({ ...value }))]),
 ));
+const POLICY_PROFILE_NAMES = Object.freeze(new Set(Object.keys(POLICY_PROFILES)));
 export const POLICY_ORIGINS = Object.freeze(new Set(contract.origins.map(String)));
 /** @type {Readonly<Record<string, Readonly<AvailabilityRequirements>>>} */
 export const POLICY_AVAILABILITY = Object.freeze(Object.fromEntries(
@@ -69,8 +70,8 @@ const TOOL_BY_NAME = new Map(TOOLS.map((tool) => [tool.name, tool]));
 /** @param {unknown} name @param {unknown} [origin] */
 export function policyProfile(name, origin = "explicit") {
   const profile = String(name || "").trim().toLowerCase();
+  if (!POLICY_PROFILE_NAMES.has(profile)) throw new BridgeError("invalid_request", `unknown policy profile: ${profile}`);
   const canonical = POLICY_PROFILES[profile];
-  if (!canonical) throw new BridgeError("invalid_request", `unknown policy profile: ${profile}`);
   return normalizePolicy({ ...canonical, origin, revision: DEFAULT_POLICY_REVISION });
 }
 
@@ -89,7 +90,8 @@ export function normalizePolicy(policy = {}) {
   const revision = Number.isInteger(requestedRevision) && requestedRevision > 0
     ? requestedRevision
     : DEFAULT_POLICY_REVISION;
-  const requestedProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const rawProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const requestedProfile = POLICY_PROFILE_NAMES.has(rawProfile) ? rawProfile : "custom";
   /** @type {NormalizedPolicy} */
   const normalized = {
     profile: requestedProfile,
@@ -102,8 +104,10 @@ export function normalizePolicy(policy = {}) {
     minimalEnv: policy.minimalEnv !== false,
     exposeAbsolutePaths: policy.exposeAbsolutePaths === true,
   };
-  const canonical = POLICY_PROFILES[requestedProfile];
-  if (canonical) Object.assign(normalized, canonical, { allowExec: canonical.execMode !== "off" });
+  if (POLICY_PROFILE_NAMES.has(requestedProfile)) {
+    const canonical = POLICY_PROFILES[requestedProfile];
+    Object.assign(normalized, canonical, { allowExec: canonical.execMode !== "off" });
+  }
   return Object.freeze(normalized);
 }
 
@@ -136,8 +140,9 @@ export function assertCanonicalFullPolicy(policy = {}) {
 /** @param {PolicyInput} policy @param {unknown} availability */
 export function policyAllowsAvailability(policy, availability) {
   const normalized = normalizePolicy(policy);
-  const requirements = POLICY_AVAILABILITY[String(availability || "")];
-  if (!requirements) return false;
+  const availabilityName = String(availability || "");
+  if (!Object.hasOwn(POLICY_AVAILABILITY, availabilityName)) return false;
+  const requirements = POLICY_AVAILABILITY[availabilityName];
   if (requirements.profile && normalized.profile !== requirements.profile) return false;
   if (requirements.allowWrite === true && normalized.allowWrite !== true) return false;
   if (Array.isArray(requirements.execModes) && !requirements.execModes.includes(normalized.execMode)) return false;

package/src/local/project-package.mjs

@@ -138,7 +138,7 @@ export function safeVersionValue(value) {
 function packageScriptSearchTerms(script) {
   const normalized = String(script).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   const root = normalized.split("-")[0];
-  return PACKAGE_SCRIPT_INTENTS[root] || "";
+  return Object.hasOwn(PACKAGE_SCRIPT_INTENTS, root) ? PACKAGE_SCRIPT_INTENTS[root] : "";
 }
 
 function invalidPackageMetadata(packagePath, lockfiles, packageState) {

package/src/local/resource-operations.mjs

@@ -14,7 +14,7 @@ export async function generateRegisteredSshKey({ workspace, stateDir, name: rawN
   let key = null;
   try {
     state.resources ||= {};
-    const existing = state.resources[name];
+    const existing = Object.hasOwn(state.resources, name) ? state.resources[name] : null;
     if (existing?.path && !samePathIdentity(existing.path, target)) {
       throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
     }

package/src/local/runtime-reporting.mjs

@@ -103,8 +103,8 @@ export async function buildProjectOverview({
 }
 
 function policyMatchesNamedProfile(policy) {
+  if (!Object.hasOwn(POLICY_PROFILES, policy.profile)) return false;
   const named = POLICY_PROFILES[policy.profile];
-  if (!named) return false;
   return policy.allowWrite === named.allowWrite
     && policy.execMode === named.execMode
     && policy.unrestrictedPaths === named.unrestrictedPaths

package/src/local/runtime.mjs

@@ -513,7 +513,7 @@ export class LocalRuntime {
 
   readLocalResourceBinary(name) {
     const registry = this.managedJobManager.currentResources();
-    const resource = registry[name];
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
     if (!resource) throw new Error(`unknown local resource: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true });
     if (inspected.size > 1024 * 1024) throw new Error("local resource exceeds 1 MiB browser injection limit");

package/src/local/worker-deployment.mjs

@@ -5,6 +5,7 @@ import { runWrangler } from "./shell.mjs";
 import { packageRoot, saveState } from "./state.mjs";
 import { withWorkerSecretsFile } from "./worker-secret-file.mjs";
 import {
+  normalizeWorkerOrigin,
   retryWorkerHealth,
   workerHealthRequiresRedeploy,
   workerHealthUserReason,
@@ -52,7 +53,7 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
     "--secrets-file", secretFile,
   ], { capture: true }));
 
-  const detectedUrl = extractWorkerUrl(deploy.stdout) || extractWorkerUrl(deploy.stderr);
+  const detectedUrl = extractWorkerUrl(deploy.stdout, state.worker.name) || extractWorkerUrl(deploy.stderr, state.worker.name);
   const recordedUrl = workerUrlMatchesName(state.worker.url, state.worker.name) ? state.worker.url : "";
   const workerUrl = detectedUrl || recordedUrl;
   if (!workerUrl) {
@@ -93,20 +94,24 @@ export function workerDeploymentFingerprint(state, options = {}) {
   return fingerprint.digest("hex");
 }
 
-export function extractWorkerUrl(text = "") {
-  const matches = [...String(text).matchAll(/https:\/\/[^\s"'<>]+\.workers\.dev[^\s"'<>]*/g)];
-  if (matches.length) return matches.at(-1)[0].replace(/[),.]+$/, "");
-  const anyHttps = [...String(text).matchAll(/https:\/\/[^\s"'<>]+/g)];
-  return anyHttps.find(match => /workers\.dev|\/healthz|\/mcp/.test(match[0]))?.[0]?.replace(/[),.]+$/, "") || "";
+export function extractWorkerUrl(text = "", workerName = "") {
+  const candidates = [...String(text).matchAll(/https:\/\/[^\s"'<>]+/g)]
+    .map((match) => match[0].replace(/[),.;:!?]+$/, ""));
+  for (const candidate of candidates.reverse()) {
+    try {
+      return normalizeWorkerOrigin(candidate, workerName);
+    } catch {
+      // Wrangler output may contain unrelated links; only a canonical matching workers.dev origin is deployment evidence.
+    }
+  }
+  return "";
 }
 
 export function workerUrlMatchesName(workerUrl, workerName) {
   if (!workerUrl || !workerName) return false;
   try {
-    const url = new URL(String(workerUrl));
-    return url.protocol === "https:"
-      && url.hostname.endsWith(".workers.dev")
-      && url.hostname.startsWith(`${String(workerName)}.`);
+    normalizeWorkerOrigin(workerUrl, workerName);
+    return true;
   } catch {
     return false;
   }

package/src/local/worker-health.mjs

@@ -53,8 +53,8 @@ export async function retryWorkerHealth(workerUrl, expectedVersion, attempts, op
   return last;
 }
 
-export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
-  const base = new URL(`${String(workerUrl).replace(/\/+$/, "")}/`);
+export function normalizeWorkerOrigin(workerUrl, expectedWorkerName = "") {
+  const base = new URL(String(workerUrl));
   const hostname = base.hostname.toLowerCase();
   const expectedName = String(expectedWorkerName || "").toLowerCase();
   if (base.protocol !== "https:" || base.port || base.username || base.password || base.search || base.hash || base.pathname !== "/") {
@@ -64,7 +64,11 @@ export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
   if (expectedName && (!WORKER_NAME.test(expectedName) || hostname.split(".")[0] !== expectedName)) {
     throw new Error("Worker URL hostname does not match the recorded Worker name");
   }
-  return `https://${hostname}/healthz`;
+  return `https://${hostname}`;
+}
+
+export function workerHealthUrl(workerUrl, expectedWorkerName = "") {
+  return `${normalizeWorkerOrigin(workerUrl, expectedWorkerName)}/healthz`;
 }
 
 export function isRetryableWorkerHealthError(value) {

package/src/worker/access.ts

@@ -11,16 +11,17 @@ const toolAvailability = new Map((toolCatalog as Array<{ name: string; availabil
 
 export const ACCOUNT_ACCESS_REVISION = Number(accessContract.revision);
 export const ACCOUNT_ROLES = Object.freeze(Object.keys(roles));
+export const DEFAULT_ACCOUNT_ROLE = String(accessContract.defaultRole) as AccountRole;
 export const OWNER_ACCOUNT_ROLE = String(accessContract.ownerRole) as AccountRole;
 
 export function normalizeAccountRole(value: unknown): AccountRole | null {
   const role = String(value ?? "").trim().toLowerCase();
-  return role in roles ? role as AccountRole : null;
+  return Object.hasOwn(roles, role) ? role as AccountRole : null;
 }
 
 export function accountRolePolicy(role: AccountRole): DaemonPolicy {
-  const profileName = roles[role]?.profile;
-  const profile = profiles[profileName];
+  const profileName = Object.hasOwn(roles, role) ? roles[role].profile : undefined;
+  const profile = profileName && Object.hasOwn(profiles, profileName) ? profiles[profileName] : undefined;
   if (!profile) throw new Error(`account role references an unknown policy profile: ${role}`);
   return {
     profile: String(profile.profile),

package/src/worker/http.ts

@@ -218,9 +218,9 @@ export function searchParamsEntries(params: URLSearchParams): Array<[string, str
 }
 
 export function searchParamsObject(params: URLSearchParams): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
+  const out = Object.create(null) as Record<string, unknown>;
   params.forEach((value, key) => {
-    if (out[key] === undefined) out[key] = value;
+    if (!Object.hasOwn(out, key)) out[key] = value;
     else if (Array.isArray(out[key])) (out[key] as string[]).push(value);
     else out[key] = [out[key] as string, value];
   });

package/src/worker/index.ts

@@ -17,7 +17,7 @@ import {
 } from "./http.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.0";
+const SERVER_VERSION = "1.2.1";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const JSONRPC_VERSION = "2.0";

package/src/worker/oauth-controller.ts

@@ -1,4 +1,4 @@
-import { type AccountRole } from "./access.ts";
+import { DEFAULT_ACCOUNT_ROLE, normalizeAccountRole, type AccountRole } from "./access.ts";
 import { accountAdminAuthorized, handleAccountAdminOperation } from "./account-admin.ts";
 import { exchangeOAuthToken } from "./oauth-tokens.ts";
 import {
@@ -50,12 +50,21 @@ export class OAuthController {
   private async oauthStore(): Promise<OAuthStore> {
     const raw = await this.ctx.storage.get<unknown>("oauth");
     if (raw !== undefined && !isCurrentOAuthStore(raw)) {
-      throw new HttpError(503, "oauth_state_schema_mismatch", "OAuth state requires the one-time multi-account upgrade");
+      throw new HttpError(503, "oauth_state_schema_mismatch", "OAuth state does not match the current schema");
     }
     const store = isCurrentOAuthStore(raw) ? raw : emptyOAuthStore();
     let changed = false;
     const now = Math.floor(Date.now() / 1000);
 
+    for (const account of Object.values(store.accounts)) {
+      if (normalizeAccountRole(account.role)) continue;
+      account.role = DEFAULT_ACCOUNT_ROLE;
+      account.active = false;
+      account.version = Number.isInteger(account.version) && account.version > 0 ? account.version + 1 : 1;
+      account.updated_at = now;
+      changed = true;
+    }
+
     for (const [code, value] of Object.entries(store.codes)) {
       const account = store.accounts[value.account_id];
       if (value.expires_at <= now || !account || !account.active || account.version !== value.account_version || account.role !== value.role) {