machine-bridge-mcp 1.2.0 → 1.2.2

package/src/local/cli-options.mjs

@@ -11,7 +11,7 @@ const VALUE_OPTIONS = new Set([
 
 const LOG_FORMATS = new Set(["text", "json"]);
 
-const COMMAND_OPTIONS = {
+const COMMAND_OPTIONS = new Map(Object.entries({
   start: new Set([
     "workspace", "stateDir", "workerName", "quiet", "json", "verbose", "logLevel", "logFormat", "rotateSecrets", "forceWorker",
     "daemonOnly", "noAutostart",
@@ -31,17 +31,17 @@ const COMMAND_OPTIONS = {
   browser: new Set(["workspace", "stateDir", "json"]),
   job: new Set(["workspace", "stateDir", "json", "yes"]),
   uninstall: new Set(["stateDir", "keepWorker", "yes"]),
-};
+}));
 
 const SINGLE_WORKSPACE_POSITIONAL_COMMANDS = new Set(["start", "stdio", "status", "doctor", "full-test", "rotate-secrets"]);
-const STATIC_POSITIONAL_RULES = Object.freeze({
-  "client-config": Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" }),
-  uninstall: Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" }),
-});
-const RESOURCE_POSITIONAL_LIMITS = Object.freeze({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 });
-const JOB_POSITIONAL_LIMITS = Object.freeze({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 });
-const ACCOUNT_POSITIONAL_LIMITS = Object.freeze({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 });
-const ACTION_POSITIONAL_RULES = Object.freeze({
+const STATIC_POSITIONAL_RULES = new Map([
+  ["client-config", Object.freeze({ max: 1, tooMany: "client-config accepts at most one positional client name" })],
+  ["uninstall", Object.freeze({ max: 0, tooMany: "uninstall does not accept positional arguments" })],
+]);
+const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
+const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
+const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {
     const action = String(args._[0] || "show");
     return { max: action === "set" || action === "select" ? 2 : 1, tooMany: `workspace ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
@@ -50,14 +50,14 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
     const action = String(args._[0] || "status");
     return { max: ["install", "status", "stop", "uninstall", "remove"].includes(action) ? 2 : 1, tooMany: `service ${action} received too many positional arguments`, workspaceConflictAfter: 1 };
   },
-  autostart(args) { return ACTION_POSITIONAL_RULES.service(args); },
+  autostart(args) { return ACTION_POSITIONAL_RULES.get("service")(args); },
   resource(args) {
     const action = String(args._[0] || "list");
-    return { max: RESOURCE_POSITIONAL_LIMITS[action] ?? 1, tooMany: `resource ${action} received too many positional arguments` };
+    return { max: RESOURCE_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `resource ${action} received too many positional arguments` };
   },
   account(args) {
     const action = String(args._[0] || "list");
-    return { max: ACCOUNT_POSITIONAL_LIMITS[action] ?? 1, tooMany: `account ${action} received too many positional arguments` };
+    return { max: ACCOUNT_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `account ${action} received too many positional arguments` };
   },
   browser(args) {
     const action = String(args._[0] || "status");
@@ -65,9 +65,9 @@ const ACTION_POSITIONAL_RULES = Object.freeze({
   },
   job(args) {
     const action = String(args._[0] || "list");
-    return { max: JOB_POSITIONAL_LIMITS[action] ?? 1, tooMany: `job ${action} received too many positional arguments` };
+    return { max: JOB_POSITIONAL_LIMITS.get(action) ?? 1, tooMany: `job ${action} received too many positional arguments` };
   },
-});
+}));
 
 export function normalizeCommand(argv) {
   if (!argv.length || argv[0].startsWith("--")) return ["start", argv];
@@ -105,7 +105,7 @@ export function parseArgs(argv) {
 }
 
 export function validateCommandOptions(command, args) {
-  const allowed = COMMAND_OPTIONS[command];
+  const allowed = COMMAND_OPTIONS.get(command);
   if (!allowed) return;
   for (const key of Object.keys(args)) {
     if (key === "_" || key === "help" || key === "version") continue;
@@ -144,8 +144,8 @@ function positionalRule(command, args) {
   if (SINGLE_WORKSPACE_POSITIONAL_COMMANDS.has(command)) {
     return { max: 1, tooMany: `${command} accepts at most one positional workspace path`, workspaceConflictAfter: 0 };
   }
-  if (STATIC_POSITIONAL_RULES[command]) return STATIC_POSITIONAL_RULES[command];
-  return ACTION_POSITIONAL_RULES[command]?.(args) || null;
+  if (STATIC_POSITIONAL_RULES.has(command)) return STATIC_POSITIONAL_RULES.get(command);
+  return ACTION_POSITIONAL_RULES.get(command)?.(args) || null;
 }
 function parseBooleanOption(value, key) {
   if (value === "true" || value === "1") return true;

package/src/local/cli-policy.mjs

@@ -37,7 +37,7 @@ function policyState(policy) {
 function selectPolicyBase(args, stored, hasStored) {
   if (args.profile !== undefined) {
     const profile = String(args.profile).trim().toLowerCase();
-    if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+    if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
     return policyProfile(profile, "explicit");
   }
   if (!hasStored) return policyProfile(DEFAULT_POLICY_PROFILE, "default");

package/src/local/cli-service.mjs

@@ -0,0 +1,132 @@
+import process from "node:process";
+import * as defaultService from "./service.mjs";
+import { inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
+import { serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadState, resolveWorkspace, selectedWorkspace } from "./state.mjs";
+
+const SERVICE_ACTION_HANDLERS = new Map([
+  ["status", serviceStatusAction],
+  ["install", serviceInstallAction],
+  ["start", serviceStartAction],
+  ["stop", serviceStopAction],
+  ["uninstall", serviceUninstallAction],
+  ["remove", serviceUninstallAction],
+]);
+
+export function createServiceCommand(dependencies) {
+  const context = {
+    chooseWorkspace: requiredFunction(dependencies.chooseWorkspace, "chooseWorkspace"),
+    stateRootFromArgs: requiredFunction(dependencies.stateRootFromArgs, "stateRootFromArgs"),
+    structuredLogger: requiredFunction(dependencies.structuredLogger, "structuredLogger"),
+    service: dependencies.service || defaultService,
+    inspectWorkspaceDaemon: dependencies.inspectWorkspaceDaemon || inspectWorkspaceDaemon,
+    stopWorkspaceServiceDaemon: dependencies.stopWorkspaceServiceDaemon || stopWorkspaceServiceDaemon,
+    stopAndRemoveAutostart: dependencies.stopAndRemoveAutostart || stopAndRemoveAutostart,
+    serviceEnvironmentSummary: dependencies.serviceEnvironmentSummary || serviceEnvironmentSummary,
+    loadState: dependencies.loadState || loadState,
+    resolveWorkspace: dependencies.resolveWorkspace || resolveWorkspace,
+    selectedWorkspace: dependencies.selectedWorkspace || selectedWorkspace,
+    entryScript: dependencies.entryScript || process.argv[1],
+    setExitCode: dependencies.setExitCode || setProcessExitCode,
+    print: dependencies.print || printLine,
+  };
+  return (args) => serviceCommand(args, context);
+}
+
+async function serviceCommand(args, context) {
+  const action = String(args._[0] || "status").toLowerCase();
+  const handler = SERVICE_ACTION_HANDLERS.get(action);
+  if (!handler) throw new Error(`Unknown service action: ${action}`);
+  const stateRoot = context.stateRootFromArgs(args);
+  return handler({ args, stateRoot, service: context.service, context });
+}
+
+async function serviceStatusAction({ args, stateRoot, service, context }) {
+  const status = await service.autostartStatus();
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state ? context.inspectWorkspaceDaemon(state) : null;
+  printServiceResult({
+    ...status,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+    service_environment: context.serviceEnvironmentSummary(stateRoot),
+    effective_active: Boolean(status.active || workspaceDaemon?.alive),
+    orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
+  }, context, false);
+}
+
+async function serviceInstallAction({ args, stateRoot, service, context }) {
+  const workspaceArgs = { ...args, _: args._.slice(1) };
+  const workspace = await context.chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
+  const state = context.loadState(workspace, { stateDir: stateRoot });
+  if (!state.worker?.url) {
+    throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
+  }
+  const result = await service.installAutostart({
+    workspace,
+    stateRoot,
+    entryScript: context.entryScript,
+    logger: context.structuredLogger(Boolean(args.quiet)),
+  });
+  printServiceResult(result, context);
+}
+
+async function serviceStartAction({ args, service, context }) {
+  const result = await service.startAutostart({ logger: context.structuredLogger(Boolean(args.quiet)) });
+  printServiceResult(result, context);
+}
+
+async function serviceStopAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const provider = await service.stopAutostart({ logger });
+  const state = optionalServiceState(args, stateRoot, context);
+  const workspaceDaemon = state
+    ? await context.stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
+    : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
+  printServiceResult({
+    ...provider,
+    ok: provider?.ok !== false && workspaceDaemon.ok,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: workspaceDaemon,
+  }, context);
+}
+
+async function serviceUninstallAction({ args, stateRoot, service, context }) {
+  const logger = context.structuredLogger(Boolean(args.quiet));
+  const state = optionalServiceState(args, stateRoot, context);
+  const lifecycle = await context.stopAndRemoveAutostart({
+    states: state ? [state] : [],
+    stateRoot,
+    logger,
+    reason: "service uninstall",
+    stopAutostart: service.stopAutostart,
+    uninstallAutostart: service.uninstallAutostart,
+    stopWorkspaceServiceDaemon: context.stopWorkspaceServiceDaemon,
+  });
+  printServiceResult({
+    ...lifecycle,
+    workspace: state?.workspace?.path || null,
+    workspace_daemon: lifecycle.workspace_daemons[0] || null,
+    autostart_removed: lifecycle.removed,
+  }, context);
+}
+
+function optionalServiceState(args, stateRoot, context) {
+  const requested = args.workspace || args._[1] || context.selectedWorkspace(stateRoot);
+  if (!requested || requested === true) return null;
+  return context.loadState(context.resolveWorkspace(String(requested)), { stateDir: stateRoot });
+}
+
+function printServiceResult(result, context, updateExitCode = true) {
+  context.print(JSON.stringify(result, null, 2));
+  if (updateExitCode && result?.ok === false) context.setExitCode(1);
+}
+
+function requiredFunction(value, name) {
+  if (typeof value !== "function") throw new TypeError(`service command requires ${name}`);
+  return value;
+}
+
+function setProcessExitCode(value) { process.exitCode = value; }
+function printLine(value) { console.log(value); }

package/src/local/cli.mjs

@@ -3,13 +3,14 @@ import { join, resolve } from "node:path";
 import process from "node:process";
 import readline from "node:readline/promises";
 import { LocalRuntime } from "./runtime.mjs";
-import { acquireDaemonLockWithTakeover, inspectWorkspaceDaemon, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
+import { acquireDaemonLockWithTakeover, stopWorkspaceServiceDaemon } from "./daemon-process.mjs";
 import { inspectProcessInstance } from "./process-identity.mjs";
 import { runStdioServer } from "./stdio.mjs";
 import { assertCanonicalFullPolicy, POLICY_PROFILES, toolsForPolicy } from "./tools.mjs";
 import { resolvePolicy } from "./cli-policy.mjs";
 import { effectiveLogFormat, effectiveLogLevel, normalizeCommand, parseArgs, validateCommandOptions, validateLoggingOptions, validatePositionals } from "./cli-options.mjs";
 import { createLocalAdminCommands } from "./cli-local-admin.mjs";
+import { createServiceCommand } from "./cli-service.mjs";
 import { generateAccountPassword } from "./account-admin.mjs";
 import { accountAdminClient, createAccountCommand } from "./cli-account-admin.mjs";
 export { resolvePolicy } from "./cli-policy.mjs";
@@ -18,7 +19,7 @@ import { classifyOperationalError, createLogger, sanitizeLogText } from "./log.m
 import { runExecutable, runWrangler } from "./shell.mjs";
 import { runFullAccessTest } from "./full-access-test.mjs";
 import { stopAndRemoveAutostart } from "./service-lifecycle.mjs";
-import { loadServiceEnvironment, serviceEnvironmentSummary } from "./service-environment.mjs";
+import { loadServiceEnvironment } from "./service-environment.mjs";
 import { ensureWorkerDeployment } from "./worker-deployment.mjs";
 import { workerHealth } from "./worker-health.mjs";
 export { workerHealthUserReason } from "./worker-health.mjs";
@@ -48,24 +49,25 @@ import {
 
 const localAdminCommands = createLocalAdminCommands({ chooseWorkspace, confirm });
 const accountCommand = createAccountCommand({ chooseWorkspace, confirm });
-
-const COMMAND_HANDLERS = Object.freeze({
-  start: startCommand,
-  stdio: stdioCommand,
-  "client-config": clientConfigCommand,
-  status: statusCommand,
-  doctor: doctorCommand,
-  "full-test": fullTestCommand,
-  workspace: workspaceCommand,
-  service: serviceCommand,
-  autostart: serviceCommand,
-  "rotate-secrets": rotateSecretsCommand,
-  resource: localAdminCommands.resourceCommand,
-  account: accountCommand,
-  browser: localAdminCommands.browserCommand,
-  job: localAdminCommands.jobCommand,
-  uninstall: uninstallCommand,
-});
+const serviceCommand = createServiceCommand({ chooseWorkspace, stateRootFromArgs, structuredLogger });
+
+const COMMAND_HANDLERS = new Map([
+  ["start", startCommand],
+  ["stdio", stdioCommand],
+  ["client-config", clientConfigCommand],
+  ["status", statusCommand],
+  ["doctor", doctorCommand],
+  ["full-test", fullTestCommand],
+  ["workspace", workspaceCommand],
+  ["service", serviceCommand],
+  ["autostart", serviceCommand],
+  ["rotate-secrets", rotateSecretsCommand],
+  ["resource", localAdminCommands.resourceCommand],
+  ["account", accountCommand],
+  ["browser", localAdminCommands.browserCommand],
+  ["job", localAdminCommands.jobCommand],
+  ["uninstall", uninstallCommand],
+]);
 
 export async function main(argv = process.argv.slice(2)) {
   const [command, rest] = normalizeCommand(argv);
@@ -75,7 +77,7 @@ export async function main(argv = process.argv.slice(2)) {
   validateCommandOptions(command, args);
   validatePositionals(command, args);
   validateLoggingOptions(args);
-  const handler = COMMAND_HANDLERS[command];
+  const handler = COMMAND_HANDLERS.get(command);
   if (handler) return handler(args);
   console.error(`Unknown command: ${command}`);
   usage();
@@ -352,7 +354,7 @@ async function clientConfigCommand(args) {
   const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: false, save: false, allowPositional: false });
   const requested = String(args.client || args._[0] || "all").trim().toLowerCase();
   const profile = String(args.profile || "full").trim().toLowerCase();
-  if (!POLICY_PROFILES[profile]) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
+  if (!Object.hasOwn(POLICY_PROFILES, profile)) throw new Error(`--profile must be one of: ${Object.keys(POLICY_PROFILES).join(", ")}`);
   if (!["all", "claude", "cursor", "codex", "generic"].includes(requested)) throw new Error("client must be all, claude, cursor, codex, or generic");
   const command = process.execPath;
   const argsList = [resolve(process.argv[1]), "stdio", "--workspace", workspace, "--profile", profile];
@@ -537,90 +539,6 @@ async function rotateSecretsCommand(args) {
   }
 }
 
-async function serviceCommand(args) {
-  const action = String(args._[0] || "status");
-  const stateRoot = stateRootFromArgs(args);
-  const { installAutostart, uninstallAutostart, autostartStatus, startAutostart, stopAutostart } = await import("./service.mjs");
-  if (action === "status") {
-    const status = await autostartStatus();
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state ? inspectWorkspaceDaemon(state) : null;
-    console.log(JSON.stringify({
-      ...status,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-      service_environment: serviceEnvironmentSummary(stateRoot),
-      effective_active: Boolean(status.active || workspaceDaemon?.alive),
-      orphaned_workspace_daemon: Boolean(status.active === false && workspaceDaemon?.alive && workspaceDaemon?.verified_service_daemon),
-    }, null, 2));
-    return;
-  }
-  if (action === "install") {
-    const workspaceArgs = { ...args, _: args._.slice(1) };
-    const workspace = await chooseWorkspace(workspaceArgs, { promptOnFirstRun: true, save: true, allowPositional: true });
-    const state = loadState(workspace, { stateDir: stateRoot });
-    if (!state.worker?.url) {
-      throw new Error("No deployed Worker is recorded for this workspace. Run `machine-mcp` once before `machine-mcp service install`.");
-    }
-    const result = await installAutostart({ workspace, stateRoot, entryScript: process.argv[1], logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "start") {
-    const result = await startAutostart({ logger: structuredLogger(Boolean(args.quiet)) });
-    console.log(JSON.stringify(result, null, 2));
-    if (result?.ok === false) process.exitCode = 1;
-    return;
-  }
-  if (action === "stop") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const provider = await stopAutostart({ logger });
-    const state = optionalServiceState(args, stateRoot);
-    const workspaceDaemon = state
-      ? await stopWorkspaceServiceDaemon(state, { logger, reason: "service stop" })
-      : { ok: true, found: false, stopped: false, verified_service_daemon: false, reason: "workspace_not_selected" };
-    const result = {
-      ...provider,
-      ok: provider?.ok !== false && workspaceDaemon.ok,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: workspaceDaemon,
-    };
-    console.log(JSON.stringify(result, null, 2));
-    if (!result.ok) process.exitCode = 1;
-    return;
-  }
-  if (action === "uninstall" || action === "remove") {
-    const logger = structuredLogger(Boolean(args.quiet));
-    const state = optionalServiceState(args, stateRoot);
-    const lifecycle = await stopAndRemoveAutostart({
-      states: state ? [state] : [],
-      stateRoot,
-      logger,
-      reason: "service uninstall",
-      stopAutostart,
-      uninstallAutostart,
-      stopWorkspaceServiceDaemon,
-    });
-    const output = {
-      ...lifecycle,
-      workspace: state?.workspace?.path || null,
-      workspace_daemon: lifecycle.workspace_daemons[0] || null,
-      autostart_removed: lifecycle.removed,
-    };
-    console.log(JSON.stringify(output, null, 2));
-    if (!output.ok) process.exitCode = 1;
-    return;
-  }
-  throw new Error(`Unknown service action: ${action}`);
-}
-
-function optionalServiceState(args, stateRoot) {
-  const requested = args.workspace || args._[1] || selectedWorkspace(stateRoot);
-  if (!requested || requested === true) return null;
-  return loadState(resolveWorkspace(String(requested)), { stateDir: stateRoot });
-}
-
 async function installAutostartBestEffort({ workspace, stateRoot, entryScript, logger }) {
   try {
     const { installAutostart } = await import("./service.mjs");

package/src/local/log.mjs

@@ -55,7 +55,7 @@ export function createLogger(options = {}) {
     const normalizedLevel = normalizeEventLevel(level);
     const eventName = sanitizeEventName(name);
     const payload = { event: eventName, ...fields };
-    const humanMessage = message || eventName;
+    const humanMessage = message || humanizeEventName(eventName);
     if (options.format === "json") {
       if (LEVEL_RANK[normalizedLevel] < LEVEL_RANK[minimumLevel]) return;
       const entry = sanitizeLogValue({
@@ -77,7 +77,7 @@ export function createLogger(options = {}) {
       error: [stderr, "[error]", COLORS.red],
     };
     const [stream, label, color] = methods[normalizedLevel];
-    write(stream, normalizedLevel, label, color, humanMessage, payload);
+    write(stream, normalizedLevel, label, color, humanMessage, fields);
   };
 
   return {
@@ -189,6 +189,14 @@ function normalizeEventLevel(value) {
   return Object.prototype.hasOwnProperty.call(LEVEL_RANK, level) ? level : "info";
 }
 
+function humanizeEventName(value) {
+  const words = String(value || "event")
+    .replace(/[._-]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : "Event";
+}
+
 function sanitizeEventName(value) {
   const name = String(value || "event").toLowerCase().replace(/[^a-z0-9._-]/g, "_").slice(0, 128);
   return name || "event";

package/src/local/managed-job-plan.mjs

@@ -156,10 +156,10 @@ function referencedResources(steps, registry) {
     }
   }
   if (names.size > MAX_RESOURCES) throw new Error(`job references more than ${MAX_RESOURCES} local resources`);
-  const out = {};
+  const out = Object.create(null);
   let totalBytes = 0;
   for (const name of names) {
-    const resource = registry[name];
+    const resource = Object.hasOwn(registry, name) ? registry[name] : null;
     if (!resource) throw new Error(`unknown local resource: ${name}`);
     const inspected = inspectResourceFile(resource.path, { allowInsecurePermissions: resource.allowInsecurePermissions === true, includeHash: true });
     totalBytes += inspected.size;
@@ -174,7 +174,7 @@ function referencedResources(steps, registry) {
 }
 
 export function normalizeResourceRegistry(resources) {
-  const out = {};
+  const out = Object.create(null);
   if (!resources || typeof resources !== "object" || Array.isArray(resources)) return out;
   for (const [rawName, rawValue] of Object.entries(resources).slice(0, MAX_RESOURCES)) {
     const name = validateResourceName(rawName);

package/src/local/policy.mjs

@@ -53,6 +53,7 @@ export const DEFAULT_POLICY_REVISION = Number(contract.revision);
 export const POLICY_PROFILES = Object.freeze(Object.fromEntries(
   Object.entries(contract.profiles).map(([name, value]) => [name, Object.freeze(/** @type {PolicyCapabilities} */ ({ ...value }))]),
 ));
+const POLICY_PROFILE_NAMES = Object.freeze(new Set(Object.keys(POLICY_PROFILES)));
 export const POLICY_ORIGINS = Object.freeze(new Set(contract.origins.map(String)));
 /** @type {Readonly<Record<string, Readonly<AvailabilityRequirements>>>} */
 export const POLICY_AVAILABILITY = Object.freeze(Object.fromEntries(
@@ -69,8 +70,8 @@ const TOOL_BY_NAME = new Map(TOOLS.map((tool) => [tool.name, tool]));
 /** @param {unknown} name @param {unknown} [origin] */
 export function policyProfile(name, origin = "explicit") {
   const profile = String(name || "").trim().toLowerCase();
+  if (!POLICY_PROFILE_NAMES.has(profile)) throw new BridgeError("invalid_request", `unknown policy profile: ${profile}`);
   const canonical = POLICY_PROFILES[profile];
-  if (!canonical) throw new BridgeError("invalid_request", `unknown policy profile: ${profile}`);
   return normalizePolicy({ ...canonical, origin, revision: DEFAULT_POLICY_REVISION });
 }
 
@@ -89,7 +90,8 @@ export function normalizePolicy(policy = {}) {
   const revision = Number.isInteger(requestedRevision) && requestedRevision > 0
     ? requestedRevision
     : DEFAULT_POLICY_REVISION;
-  const requestedProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const rawProfile = typeof policy.profile === "string" && policy.profile ? policy.profile : "custom";
+  const requestedProfile = POLICY_PROFILE_NAMES.has(rawProfile) ? rawProfile : "custom";
   /** @type {NormalizedPolicy} */
   const normalized = {
     profile: requestedProfile,
@@ -102,8 +104,10 @@ export function normalizePolicy(policy = {}) {
     minimalEnv: policy.minimalEnv !== false,
     exposeAbsolutePaths: policy.exposeAbsolutePaths === true,
   };
-  const canonical = POLICY_PROFILES[requestedProfile];
-  if (canonical) Object.assign(normalized, canonical, { allowExec: canonical.execMode !== "off" });
+  if (POLICY_PROFILE_NAMES.has(requestedProfile)) {
+    const canonical = POLICY_PROFILES[requestedProfile];
+    Object.assign(normalized, canonical, { allowExec: canonical.execMode !== "off" });
+  }
   return Object.freeze(normalized);
 }
 
@@ -136,8 +140,9 @@ export function assertCanonicalFullPolicy(policy = {}) {
 /** @param {PolicyInput} policy @param {unknown} availability */
 export function policyAllowsAvailability(policy, availability) {
   const normalized = normalizePolicy(policy);
-  const requirements = POLICY_AVAILABILITY[String(availability || "")];
-  if (!requirements) return false;
+  const availabilityName = String(availability || "");
+  if (!Object.hasOwn(POLICY_AVAILABILITY, availabilityName)) return false;
+  const requirements = POLICY_AVAILABILITY[availabilityName];
   if (requirements.profile && normalized.profile !== requirements.profile) return false;
   if (requirements.allowWrite === true && normalized.allowWrite !== true) return false;
   if (Array.isArray(requirements.execModes) && !requirements.execModes.includes(normalized.execMode)) return false;

package/src/local/project-package.mjs

@@ -138,7 +138,7 @@ export function safeVersionValue(value) {
 function packageScriptSearchTerms(script) {
   const normalized = String(script).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   const root = normalized.split("-")[0];
-  return PACKAGE_SCRIPT_INTENTS[root] || "";
+  return Object.hasOwn(PACKAGE_SCRIPT_INTENTS, root) ? PACKAGE_SCRIPT_INTENTS[root] : "";
 }
 
 function invalidPackageMetadata(packagePath, lockfiles, packageState) {

package/src/local/relay-connection.mjs

@@ -73,6 +73,8 @@ export class RelayConnection {
     this.connectedOnce = null;
     this.connectedOnceResolve = null;
     this.connectedOnceReject = null;
+    this.sessionGeneration = 0;
+    this.activeSessionId = 0;
   }
 
   status() {
@@ -82,9 +84,14 @@ export class RelayConnection {
       network_route: this.networkRoute,
       reconnect_attempt: this.reconnectAttempt,
       outage_active: this.outageStartedAt > 0,
+      session_generation: this.sessionGeneration,
     };
   }
 
+  currentSessionId() {
+    return this.ready ? this.activeSessionId : 0;
+  }
+
   start() {
     if (!this.closed && this.connectedOnce) return this.connectedOnce;
     this.closed = false;
@@ -99,6 +106,7 @@ export class RelayConnection {
   stop() {
     this.closed = true;
     this.ready = false;
+    this.activeSessionId = 0;
     this.clearTimer("heartbeatTimer", "clearInterval");
     this.clearTimer("connectTimer", "clearTimeout");
     this.clearTimer("handshakeTimer", "clearTimeout");
@@ -118,6 +126,15 @@ export class RelayConnection {
     return this.sendOnSocket(this.socket, value);
   }
 
+  sendForSession(value, expectedSessionId) {
+    const sessionId = Number(expectedSessionId) || 0;
+    if (!sessionId || sessionId !== this.activeSessionId) return { ok: false, reason: "session_ended" };
+    if (!this.ready || !this.isSocketOpen(this.socket)) return { ok: false, reason: "transport_unavailable" };
+    return this.sendOnSocket(this.socket, value)
+      ? { ok: true, reason: "sent" }
+      : { ok: false, reason: "send_failed" };
+  }
+
   interrupt(category = "relay_transport_error") {
     if (this.closed || !this.socket) return false;
     this.pendingCloseCategory = String(category || "relay_transport_error");
@@ -148,6 +165,8 @@ export class RelayConnection {
       return false;
     }
     this.ready = true;
+    this.sessionGeneration += 1;
+    this.activeSessionId = this.sessionGeneration;
     this.clearTimer("handshakeTimer", "clearTimeout");
     this.connectedAt = this.now();
     this.lastInboundAt = this.connectedAt;
@@ -268,6 +287,7 @@ export class RelayConnection {
       const wasReady = this.ready;
       this.socket = null;
       this.ready = false;
+      this.activeSessionId = 0;
       this.clearTimer("connectTimer", "clearTimeout");
       this.clearTimer("heartbeatTimer", "clearInterval");
       this.clearTimer("handshakeTimer", "clearTimeout");
@@ -329,6 +349,7 @@ export class RelayConnection {
     const socket = this.socket;
     this.closed = true;
     this.ready = false;
+    this.activeSessionId = 0;
     this.socket = null;
     this.clearTimer("connectTimer", "clearTimeout");
     this.clearTimer("heartbeatTimer", "clearInterval");

package/src/local/resource-operations.mjs

@@ -14,7 +14,7 @@ export async function generateRegisteredSshKey({ workspace, stateDir, name: rawN
   let key = null;
   try {
     state.resources ||= {};
-    const existing = state.resources[name];
+    const existing = Object.hasOwn(state.resources, name) ? state.resources[name] : null;
     if (existing?.path && !samePathIdentity(existing.path, target)) {
       throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
     }

package/src/local/runtime-reporting.mjs

@@ -103,8 +103,8 @@ export async function buildProjectOverview({
 }
 
 function policyMatchesNamedProfile(policy) {
+  if (!Object.hasOwn(POLICY_PROFILES, policy.profile)) return false;
   const named = POLICY_PROFILES[policy.profile];
-  if (!named) return false;
   return policy.allowWrite === named.allowWrite
     && policy.execMode === named.execMode
     && policy.unrestrictedPaths === named.unrestrictedPaths