machine-bridge-mcp 3.0.0-beta.17 → 3.0.0-beta.21

package/src/local/app-automation.mjs

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { basename, extname, join } from "node:path";
 import { performance } from "node:perf_hooks";
 import { createToolAuthorizer } from "./policy.mjs";
+import { classifyOperationalError } from "./log.mjs";
 
 const MAX_APPLICATIONS = 1000;
 const MAX_APPLICATION_SCAN_ENTRIES = 20_000;
@@ -60,6 +61,9 @@ export class AppAutomationManager {
       applications: filtered,
       truncated: discovery.truncated || matched.length > limit,
       scanned_entries: discovery.visitedEntries,
+      warnings: discovery.warnings.map((warning) => ({
+        path: this.displayPath(warning.path), error_class: warning.error_class,
+      })),
       capabilities: this.capabilities(),
     };
   }
@@ -238,32 +242,48 @@ async function listExecutableRoots(roots, extensions, context, throwIfCancelled)
 
 async function scanApplicationRoots(roots, { context, throwIfCancelled, match, descend, makeItem }) {
   const results = [];
+  const warnings = [];
   const seenRoots = new Set();
   let visited = 0;
   for (const inputRoot of roots) {
-    const root = await realpath(inputRoot).catch(() => "");
-    if (!root || seenRoots.has(root)) continue;
+    let root;
+    try { root = await realpath(inputRoot); } catch (error) {
+      if (error?.code !== "ENOENT" && warnings.length < 50) {
+        warnings.push({ path: inputRoot, error_class: classifyOperationalError(error) });
+      }
+      continue;
+    }
+    if (seenRoots.has(root)) continue;
     seenRoots.add(root);
     const stack = [{ directory: root, depth: 0 }];
     while (stack.length) {
       const current = stack.pop();
-      const handle = await opendir(current.directory).catch(() => null);
-      if (!handle) continue;
+      let handle;
+      try { handle = await opendir(current.directory); } catch (error) {
+        if (error?.code !== "ENOENT" && warnings.length < 50) {
+          warnings.push({ path: current.directory, error_class: classifyOperationalError(error) });
+        }
+        continue;
+      }
       for await (const entry of handle) {
         throwIfCancelled(context);
         visited += 1;
-        if (visited > MAX_APPLICATION_SCAN_ENTRIES) return { applications: results, truncated: true, visitedEntries: visited };
+        if (visited > MAX_APPLICATION_SCAN_ENTRIES) {
+          return { applications: results, warnings, truncated: true, visitedEntries: visited };
+        }
         const path = join(current.directory, entry.name);
         if (match(entry)) {
           results.push(makeItem(path, entry));
-          if (results.length >= MAX_APPLICATIONS) return { applications: results, truncated: true, visitedEntries: visited };
+          if (results.length >= MAX_APPLICATIONS) {
+            return { applications: results, warnings, truncated: true, visitedEntries: visited };
+          }
         } else if (current.depth < MAX_APPLICATION_SCAN_DEPTH && descend(entry)) {
           stack.push({ directory: path, depth: current.depth + 1 });
         }
       }
     }
   }
-  return { applications: results, truncated: false, visitedEntries: visited };
+  return { applications: results, warnings, truncated: false, visitedEntries: visited };
 }
 
 function requiredApplication(value) {

package/src/local/cli-options.mjs

@@ -45,7 +45,7 @@ const STATIC_POSITIONAL_RULES = new Map([
 ]);
 const RESOURCE_POSITIONAL_LIMITS = new Map(Object.entries({ add: 3, "generate-ssh-key": 3, remove: 2, check: 2 }));
 const JOB_POSITIONAL_LIMITS = new Map(Object.entries({ read: 2, inspect: 2, cancel: 2, approve: 2, submit: 2 }));
-const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
+const ACCOUNT_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, clients: 1, "revoke-client": 2, add: 3, role: 3, enable: 2, disable: 2, "rotate-password": 2, remove: 2 }));
 const APPROVAL_POSITIONAL_LIMITS = new Map(Object.entries({ list: 1, revoke: 2, clear: 1 }));
 const ACTION_POSITIONAL_RULES = new Map(Object.entries({
   workspace(args) {

package/src/local/path-inspection.mjs

@@ -0,0 +1,23 @@
+import { lstat, opendir } from "node:fs/promises";
+
+export function isMissingPathError(error) {
+  return error?.code === "ENOENT";
+}
+
+export async function pathEntryIfExists(path, inspect = lstat) {
+  try {
+    return await inspect(path);
+  } catch (error) {
+    if (isMissingPathError(error)) return null;
+    throw error;
+  }
+}
+
+export async function openDirectoryIfExists(path, openDirectory = opendir) {
+  try {
+    return await openDirectory(path);
+  } catch (error) {
+    if (isMissingPathError(error)) return null;
+    throw error;
+  }
+}

package/src/local/process-tree-ownership.mjs

@@ -12,22 +12,34 @@ export function captureProcessTreeOwnership(child, options = {}) {
   return { platform, pid, members: processGroupMembers(pid, options) };
 }
 
+export function refreshProcessTreeOwnership(snapshot, options = {}) {
+  if (!snapshot?.pid || snapshot.platform === "win32") return snapshot;
+  const members = [...(snapshot.members || [])];
+  for (const observed of processGroupMembers(snapshot.pid, options)) {
+    if (!members.some((expected) => sameProcessIdentity(expected, observed))) members.push(observed);
+  }
+  return { ...snapshot, members };
+}
+
 export function processTreeOwnershipStillCurrent(snapshot, child, options = {}) {
   if (!snapshot?.pid) return false;
   if (snapshot.platform === "win32") return !childHasExited(child);
   if (!Array.isArray(snapshot.members) || snapshot.members.length === 0) return !childHasExited(child);
   const current = processGroupMembers(snapshot.pid, options);
-  return snapshot.members.some((expected) => current.some((observed) => sameProcessIdentity(expected, observed)));
+  if (snapshot.members.some((expected) => current.some((observed) => sameProcessIdentity(expected, observed)))) return true;
+  return snapshot.members.some((expected) => processGroupMembers(snapshot.pid, options, expected.pid)
+    .some((observed) => sameProcessIdentity(expected, observed)));
 }
 
-function processGroupMembers(groupId, options = {}) {
+function processGroupMembers(groupId, options = {}, pid = 0) {
   const list = typeof options.listProcessGroups === "function" ? options.listProcessGroups : listProcessGroups;
-  return list(options).filter((entry) => entry.pgid === groupId).map(({ pid, startedAt }) => ({ pid, startedAt }));
+  return list(options, pid).filter((entry) => entry.pgid === groupId).map(({ pid: memberPid, startedAt }) => ({ pid: memberPid, startedAt }));
 }
 
-function listProcessGroups(options = {}) {
+function listProcessGroups(options = {}, pid = 0) {
   const run = typeof options.spawnSyncProcess === "function" ? options.spawnSyncProcess : spawnSync;
-  const result = run("ps", ["-axo", "pid=,pgid=,lstart="], {
+  const args = pid ? ["-p", String(pid), "-o", "pid=,pgid=,lstart="] : ["-axo", "pid=,pgid=,lstart="];
+  const result = run("ps", args, {
     encoding: "utf8",
     timeout: PROCESS_SNAPSHOT_TIMEOUT_MS,
     maxBuffer: PROCESS_SNAPSHOT_BYTES,

package/src/local/process-tree.mjs

@@ -2,8 +2,9 @@ import { spawn } from "node:child_process";
 import {
   captureProcessTreeOwnership,
   processTreeOwnershipStillCurrent,
+  refreshProcessTreeOwnership,
 } from "./process-tree-ownership.mjs";
-export { captureProcessTreeOwnership, processTreeOwnershipStillCurrent } from "./process-tree-ownership.mjs";
+export { captureProcessTreeOwnership, processTreeOwnershipStillCurrent, refreshProcessTreeOwnership } from "./process-tree-ownership.mjs";
 
 export const DEFAULT_PROCESS_TERMINATION_GRACE_MS = 2000;
 
@@ -40,10 +41,13 @@ export function terminateProcessTreeWithEscalation(child, options = {}) {
     : DEFAULT_PROCESS_TERMINATION_GRACE_MS;
   const schedule = typeof options.setTimeout === "function" ? options.setTimeout : setTimeout;
   const terminate = typeof options.terminate === "function" ? options.terminate : terminateProcessTree;
-  const ownership = typeof options.captureOwnership === "function"
+  let ownership = typeof options.captureOwnership === "function"
     ? options.captureOwnership(child)
     : captureProcessTreeOwnership(child, options);
   terminate(child, "SIGTERM", options);
+  ownership = typeof options.refreshOwnership === "function"
+    ? options.refreshOwnership(ownership, child)
+    : refreshProcessTreeOwnership(ownership, options);
   return schedule(() => {
     try {
       const owned = typeof options.isTerminationTargetOwned === "function"

package/src/local/relay-connection.mjs

@@ -167,7 +167,7 @@ export class RelayConnection {
     this.logger.debug?.("remote relay welcome received");
     Promise.resolve(this.helloMessage(message)).then((hello) => {
       if (this.socket !== socket || this.closed || this.authenticated) return;
-      if (!this.sendOnSocket(socket, hello)) this.failPermanently("relay_authentication_failed");
+      this.sendOnSocket(socket, hello);
     }).catch((error) => {
       this.logger.debug?.("could not create daemon authentication proof", { error_class: classifyOperationalError(error) });
       this.failPermanently("relay_authentication_failed");
@@ -256,18 +256,18 @@ export class RelayConnection {
 
   handleServerError(message = {}) {
     const errorCode = sanitizeProtocolErrorCode(message?.error);
-    this.logger.debug?.("remote relay reported a protocol error", { error_code: errorCode });
-    if (errorCode === "daemon_hello_timeout" && !this.authenticated) {
-      const socket = this.socket;
-      if (this.closed || !socket) return true;
-      this.pendingCloseCategory = "relay_handshake_timeout";
-      terminateSocket(socket);
-      return true;
-    }
-    if (errorCode === "daemon_ready_timeout" && this.authenticated && !this.ready) {
+    const reconnectCategory = relayServerErrorReconnectCategory(errorCode, {
+      authenticated: this.authenticated,
+      ready: this.ready,
+    });
+    this.logger.debug?.(
+      reconnectCategory ? "remote relay requested connection recovery" : "remote relay reported a protocol error",
+      { error_code: errorCode, reconnect_category: reconnectCategory || "none" },
+    );
+    if (reconnectCategory) {
       const socket = this.socket;
       if (this.closed || !socket) return true;
-      this.pendingCloseCategory = "relay_readiness_timeout";
+      this.pendingCloseCategory = reconnectCategory;
       terminateSocket(socket);
       return true;
     }
@@ -587,12 +587,25 @@ export class RelayConnection {
   }
 }
 
+export function relayServerErrorReconnectCategory(errorCode, state = {}) {
+  const code = sanitizeProtocolErrorCode(errorCode);
+  const authenticated = state?.authenticated === true;
+  const ready = state?.ready === true;
+  if (code === "daemon_hello_timeout" && !authenticated) return "relay_handshake_timeout";
+  if (code === "daemon_ready_timeout" && authenticated && !ready) return "relay_readiness_timeout";
+  if (code === "daemon_transport_error") return "relay_transport_error";
+  if (code === "daemon_liveness_timeout") return "relay_heartbeat_timeout";
+  return "";
+}
+
 export function relayCloseCategory(code, reason = "") {
   const numeric = Number(code);
   const reasonText = String(reason || "");
   if (isSupersededClose(numeric, reasonText)) return "superseded";
   if (numeric === 1008 && reasonText === "daemon hello timeout") return "relay_handshake_timeout";
   if (numeric === 1008 && reasonText === "daemon ready timeout") return "relay_readiness_timeout";
+  if ([1008, 1012].includes(numeric) && ["daemon pong failed", "daemon send failed"].includes(reasonText)) return "relay_transport_error";
+  if ([1008, 1012].includes(numeric) && reasonText === "daemon liveness timeout") return "relay_heartbeat_timeout";
   if (numeric === 1008 && ["stale daemon candidate", "expired daemon candidate"].includes(reasonText)) return "relay_restarting_or_unavailable";
   if (numeric === 1008 && ["daemon hello required", "missing daemon attachment", "invalid daemon candidate timestamp"].includes(reasonText)) return "relay_protocol_error";
   if (numeric === 1000) return "normal_close";

package/src/local/resource-operations.mjs

@@ -5,12 +5,21 @@ import { inspectResourceFile, validateResourceName } from "./managed-jobs.mjs";
 import { generateSshKeyPair } from "./ssh-key.mjs";
 import { acquireStartupLockWithWait, loadState, saveState } from "./state.mjs";
 
-export async function generateRegisteredSshKey({ workspace, stateDir, name: rawName, targetPath, comment = "" }) {
+export async function generateRegisteredSshKey(
+  { workspace, stateDir, name: rawName, targetPath, comment = "" },
+  options = {},
+) {
   const name = validateResourceName(rawName);
   if (typeof targetPath !== "string" || !targetPath.trim()) throw new Error("SSH private key target path is required");
   const target = resolve(targetPath);
-  const state = loadState(workspace, { stateDir });
-  const lock = await acquireStartupLockWithWait(state, { operation: "generate-ssh-key" });
+  const loadStateFn = options.loadState || loadState;
+  const acquireLockFn = options.acquireStartupLockWithWait || acquireStartupLockWithWait;
+  const generateKeyFn = options.generateSshKeyPair || generateSshKeyPair;
+  const inspectResourceFn = options.inspectResourceFile || inspectResourceFile;
+  const saveStateFn = options.saveState || saveState;
+  const removeFileFn = options.removeFile || rm;
+  const state = loadStateFn(workspace, { stateDir });
+  const lock = await acquireLockFn(state, { operation: "generate-ssh-key" });
   let key = null;
   try {
     state.resources ||= {};
@@ -19,19 +28,25 @@ export async function generateRegisteredSshKey({ workspace, stateDir, name: rawN
       throw new Error(`local resource ${name} is already registered to a different file; remove it first`);
     }
     if (!existing && Object.keys(state.resources).length >= 64) throw new Error("local resource registry limit reached (64)");
-    key = await generateSshKeyPair({
+    key = await generateKeyFn({
       privateKeyPath: target,
       type: "ed25519",
       comment: comment || `machine-mcp:${name}`,
     });
-    const inspected = inspectResourceFile(key.privateKeyPath);
+    const inspected = inspectResourceFn(key.privateKeyPath);
     state.resources[name] = inspected;
     try {
-      saveState(state);
+      saveStateFn(state);
     } catch (error) {
       if (key.created) {
-        await rm(key.privateKeyPath, { force: true }).catch(() => {});
-        await rm(key.publicKeyPath, { force: true }).catch(() => {});
+        try {
+          await removeGeneratedSshKeyPair(key, removeFileFn);
+        } catch (cleanupError) {
+          throw new AggregateError(
+            [error, cleanupError],
+            "SSH key registration failed and generated-key rollback was incomplete",
+          );
+        }
       }
       throw error;
     }
@@ -53,6 +68,20 @@ export async function generateRegisteredSshKey({ workspace, stateDir, name: rawN
   }
 }
 
+
+export async function removeGeneratedSshKeyPair(key, removeFile = rm) {
+  if (!key?.created) return;
+  const failures = [];
+  for (const [kind, filePath] of [["private", key.privateKeyPath], ["public", key.publicKeyPath]]) {
+    try {
+      await removeFile(filePath, { force: true });
+    } catch (cause) {
+      failures.push(new Error(`generated SSH ${kind} key cleanup failed`, { cause }));
+    }
+  }
+  if (failures.length) throw new AggregateError(failures, "generated SSH key rollback was incomplete");
+}
+
 function samePathIdentity(left, right) {
   const a = canonicalIfExisting(left);
   const b = canonicalIfExisting(right);

package/src/local/runtime-activation.mjs

@@ -19,11 +19,14 @@ export async function activatePersistentRuntime(options = {}) {
   let daemonLock = null;
   let candidateRuntime = null;
   let candidateRelayVerified = false;
+  let providerStopped = false;
+  let serviceStarted = false;
   try {
     const providerStop = await options.stopAutostart();
     if (providerStop?.ok === false && providerStop?.active === true) {
       throw new Error("the existing autostart service could not be stopped before activation");
     }
+    providerStopped = providerStop?.active_before === true && providerStop?.active === false;
 
     daemonLock = await options.acquireDaemonLock();
     if (!daemonLock?.acquired) {
@@ -60,6 +63,7 @@ export async function activatePersistentRuntime(options = {}) {
     if (serviceStart?.ok === false) {
       throw new Error(`autostart start failed (${serviceStart.provider || "unknown"})`);
     }
+    serviceStarted = true;
 
     const convergence = await waitForActivatedRuntime({
       expectedVersion: options.expectedVersion,
@@ -85,6 +89,9 @@ export async function activatePersistentRuntime(options = {}) {
       try { startupLock.release(); }
       catch (failure) { cleanupErrors.push(failure); }
     }
+    try {
+      await restoreStoppedProvider(options.startAutostart, { providerStopped, serviceStarted });
+    } catch (failure) { cleanupErrors.push(failure); }
     if (cleanupErrors.length) {
       throw new AggregateError(
         [error, ...cleanupErrors],
@@ -95,6 +102,15 @@ export async function activatePersistentRuntime(options = {}) {
   }
 }
 
+
+async function restoreStoppedProvider(startAutostart, { providerStopped, serviceStarted }) {
+  if (!providerStopped || serviceStarted) return;
+  const restored = await startAutostart();
+  if (restored?.ok === false) {
+    throw new Error(`previous autostart service could not be restored (${restored.provider || "unknown"})`);
+  }
+}
+
 export async function waitForActivatedRuntime({
   inspectDaemon,
   checkWorker,

package/src/local/runtime-capabilities.mjs

@@ -1,3 +1,5 @@
+import { classifyOperationalError } from "./log.mjs";
+
 export async function sessionBootstrap({
   agentContextManager,
   appAutomationManager,
@@ -26,9 +28,18 @@ export async function resolveTaskCapabilities({
   const result = await agentContextManager.resolveTaskCapabilities(args, context);
   const task = String(args.task || "");
   if (policy.profile === "full") {
-    const applications = await appAutomationManager
-      .listApplications({ query: "", max_results: 500 }, context)
-      .catch(() => ({ applications: [] }));
+    let applications;
+    try {
+      applications = await appAutomationManager.listApplications({ query: "", max_results: 500 }, context);
+    } catch (error) {
+      applications = { applications: [], warnings: [{ error_class: classifyOperationalError(error) }], truncated: false };
+    }
+    result.application_discovery = {
+      available: !(applications.warnings?.length),
+      warning_count: applications.warnings?.length ?? 0,
+      truncated: applications.truncated === true,
+      ...(applications.warnings?.[0]?.error_class ? { error_class: applications.warnings[0].error_class } : {}),
+    };
     const lower = task.toLowerCase();
     result.application_matches = applications.applications
       .map((application) => ({ application, score: applicationMatchScore(lower, application) }))
@@ -38,6 +49,7 @@ export async function resolveTaskCapabilities({
       .map(({ application, score }) => ({ ...application, score }));
   } else {
     result.application_matches = [];
+    result.application_discovery = { available: false, warning_count: 0, truncated: false, reason: "policy" };
   }
   if (result.application_matches.length) {
     result.recommended_tools = [...new Set([

package/src/local/runtime.mjs

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { realpathSync, rmSync } from "node:fs";
-import { lstat, realpath, stat } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { isRelayReadyContext } from "./relay-connection.mjs";
 import { ProcessSessionManager } from "./process-sessions.mjs";
@@ -37,6 +37,7 @@ import { createRuntimeRelayConnection, normalizeRelayResumeCalls, normalizeRelay
 import { RelayCallRecovery } from "./relay-call-recovery.mjs";
 import { RuntimeResourceService } from "./runtime-resource-service.mjs";
 import { assertContainedPath, createRuntimeDir, redactRuntimeErrorMessage } from "./runtime-paths.mjs";
+import { pathEntryIfExists } from "./path-inspection.mjs";
 import {
   resolveTaskCapabilities as resolveRuntimeTaskCapabilities,
   sessionBootstrap as buildRuntimeSessionBootstrap,
@@ -358,7 +359,9 @@ export class LocalRuntime {
     const relaySessionId = Number(relayContext.sessionId) || 0;
     if (!id || !relaySessionId) return this.handleRelayProtocolViolation("invalid_relay_probe");
     const outcome = this.relay?.sendForSession?.({ type: "relay_probe_result", id }, relaySessionId);
-    if (!outcome?.ok) this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    if (!outcome?.ok && !["send_failed", "transport_unavailable", "session_ended"].includes(outcome?.reason)) {
+      this.handleRelayProtocolViolation("relay_probe_delivery_failed");
+    }
   }
 
   async handleRelayToolCall(message) {
@@ -598,10 +601,10 @@ export class LocalRuntime {
 
   async resolveWritePath(inputPath = ".", context = {}) {
     const candidate = this.resolvePath(inputPath);
-    const candidateInfo = await lstat(candidate).catch(() => null);
+    const candidateInfo = await pathEntryIfExists(candidate);
     if (candidateInfo?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
     let ancestor = candidate;
-    while (!(await lstat(ancestor).catch(() => null))) {
+    while (!(await pathEntryIfExists(ancestor))) {
       const parent = dirname(ancestor);
       if (parent === ancestor) break;
       ancestor = parent;

package/src/local/worker-deployment.mjs

@@ -12,6 +12,8 @@ import {
   workerHealthUserReason,
 } from "./worker-health.mjs";
 
+const DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS = 20;
+
 export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   const logger = options.logger || console;
   const expectedVersion = options.expectedVersion || currentPackageVersion(options.packageRoot || packageRoot);
@@ -24,18 +26,24 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   const complete = hasCompleteWorkerState(state.worker);
 
   if (!args.forceWorker && !args.rotateSecrets && complete && state.worker.deployHash === desiredHash) {
-    const health = await retryHealthFn(state.worker.url, expectedVersion, options.existingHealthAttempts || 2, healthOptions);
+    const recordedCurrentDeployment = state.worker.deployedVersion === expectedVersion;
+    const attempts = recordedCurrentDeployment
+      ? (options.recordedDeploymentHealthAttempts ?? DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS)
+      : (options.existingHealthAttempts ?? 2);
+    const health = await retryHealthFn(state.worker.url, expectedVersion, attempts, healthOptions);
     if (health.ok) {
       logger.success?.("Worker unchanged and healthy", { url: state.worker.url });
       logger.debug?.("Worker health route", { network_route: health.networkRoute || "unknown" });
       return state.worker;
     }
+    logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
+    if (recordedCurrentDeployment) {
+      throw workerVerificationError(health.error, { deploymentSucceeded: false, recordedCurrentDeployment: true });
+    }
     if (!workerHealthRequiresRedeploy(health.error)) {
-      logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
       throw workerVerificationError(health.error, { deploymentSucceeded: false });
     }
     logger.warn?.("Recorded Worker is stale; redeploying the same Worker", { reason: workerHealthUserReason(health.error) });
-    logger.debug?.("Worker health check detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
   }
 
   logger.info?.("Checking Cloudflare Wrangler login");
@@ -68,7 +76,7 @@ export async function ensureWorkerDeployment(state, args = {}, options = {}) {
   state.worker.updatedAt = new Date().toISOString();
   saveStateFn(state);
 
-  const health = await retryHealthFn(state.worker.url, expectedVersion, options.deploymentHealthAttempts || 8, healthOptions);
+  const health = await retryHealthFn(state.worker.url, expectedVersion, options.deploymentHealthAttempts ?? DEFAULT_DEPLOYMENT_HEALTH_ATTEMPTS, healthOptions);
   if (!health.ok) {
     logger.debug?.("Worker post-deployment health detail", { health_error: health.error, network_route: health.networkRoute || "unknown" });
     throw workerVerificationError(health.error, { deploymentSucceeded: true });
@@ -143,12 +151,14 @@ function collectHashFiles(target, out) {
   }
 }
 
-function workerVerificationError(reason, { deploymentSucceeded }) {
+function workerVerificationError(reason, { deploymentSucceeded, recordedCurrentDeployment = false }) {
   const readable = workerHealthUserReason(reason);
   const guidance = workerVerificationGuidance(reason);
   const message = deploymentSucceeded
     ? `Cloudflare reported the Worker deployment succeeded, but ${readable}. The deployment fingerprint was saved, so retrying will verify the same Worker instead of deploying again. ${guidance}`
-    : `The recorded Worker could not be verified because ${readable}. No deployment was attempted. ${guidance}`;
+    : recordedCurrentDeployment
+      ? `The current Worker deployment fingerprint is already recorded, but ${readable}. No deployment was attempted because duplicating the recorded deployment is unsafe; use --force-worker only after diagnosis. ${guidance}`
+      : `The recorded Worker could not be verified because ${readable}. No deployment was attempted. ${guidance}`;
   const error = new Error(message);
   error.code = "worker_health_unverified";
   error.healthError = reason;

package/src/local/workspace-file-service.mjs

@@ -3,6 +3,7 @@ import { constants as fsConstants } from "node:fs";
 import { link, lstat, mkdir, open, opendir, rename, rm, stat } from "node:fs/promises";
 import path, { basename, dirname, join, resolve } from "node:path";
 import { applyUpdateHunks, parsePatchEnvelope } from "./patch.mjs";
+import { openDirectoryIfExists, pathEntryIfExists } from "./path-inspection.mjs";
 import { clampInteger } from "./numbers.mjs";
 
 export const MAX_WRITE_BYTES = 5 * 1024 * 1024;
@@ -43,12 +44,13 @@ export class WorkspaceFileService {
     for await (const entry of await opendir(full)) {
       this.throwIfCancelled(context);
       const entryPath = resolve(full, entry.name);
-      const info = await lstat(entryPath).catch(() => null);
+      const info = await pathEntryIfExists(entryPath);
+      if (!info) continue;
       const item = {
         name: entry.name,
         path: this.displayPath(entryPath, context),
         type: entry.isDirectory() ? "directory" : entry.isFile() ? "file" : entry.isSymbolicLink() ? "symlink" : "other",
-        size: info?.size ?? 0,
+        size: info.size,
       };
       const itemBytes = Buffer.byteLength(item.name) + Buffer.byteLength(item.path) + 64;
       if (entries.length >= MAX_DIRECTORY_ENTRIES || resultBytes + itemBytes > MAX_PATH_RESULT_BYTES) {
@@ -150,7 +152,7 @@ export class WorkspaceFileService {
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_WRITE_BYTES) throw new Error(`content exceeds maximum write size (${bytes} > ${MAX_WRITE_BYTES})`);
       const full = await this.resolveWritePath(args.path, context);
-      const existing = await lstat(full).catch(() => null);
+      const existing = await pathEntryIfExists(full);
       if (existing?.isSymbolicLink()) throw new Error("refusing to overwrite a symbolic link");
       if (args.create_only && existing) throw new Error("file exists and create_only=true");
       if (existing && !existing.isFile()) throw new Error("path is not a regular file");
@@ -206,7 +208,7 @@ export class WorkspaceFileService {
         this.throwIfCancelled(context);
         if (operation.kind === "add") {
           const target = await this.resolveWritePath(operation.path, context);
-          if (await lstat(target).catch(() => null)) throw new Error(`add target already exists: ${operation.path}`);
+          if (await pathEntryIfExists(target)) throw new Error(`add target already exists: ${operation.path}`);
           assertTextSize(operation.content, operation.path);
           prepared.push({ kind: "add", source: null, target, content: operation.content, mode: 0o600 });
           continue;
@@ -222,7 +224,7 @@ export class WorkspaceFileService {
         const content = applyUpdateHunks(original, operation.hunks, operation.path);
         assertTextSize(content, operation.path);
         const target = operation.moveTo ? await this.resolveWritePath(operation.moveTo, context) : source;
-        if (target !== source && await lstat(target).catch(() => null)) throw new Error(`move target already exists: ${operation.moveTo}`);
+        if (target !== source && await pathEntryIfExists(target)) throw new Error(`move target already exists: ${operation.moveTo}`);
         prepared.push({ kind: operation.moveTo ? "move" : "update", source, target, content, originalHash: sha256(original), mode: sourceInfo.mode & 0o777 });
       }
       assertNoResolvedPatchCollisions(prepared);
@@ -267,8 +269,12 @@ export class WorkspaceFileService {
 
   async searchOneFile(full, query, matches, max, context = {}) {
     this.throwIfCancelled(context);
-    const bounded = await readBoundedFile(full, 1024 * 1024, "search file").catch(() => null);
-    if (!bounded || bounded.buffer.includes(0)) return;
+    let bounded;
+    try { bounded = await readBoundedFile(full, 1024 * 1024, "search file"); } catch (error) {
+      if (isSkippableSearchFileError(error)) return;
+      throw error;
+    }
+    if (bounded.buffer.includes(0)) return;
     const buffer = bounded.buffer;
     let text;
     try { text = new TextDecoder("utf-8", { fatal: true }).decode(buffer); } catch { return; }
@@ -288,7 +294,7 @@ export class WorkspaceFileService {
     while (stack.length) {
       this.throwIfCancelled(context);
       const current = stack.pop();
-      const entries = await opendir(current).catch(() => null);
+      const entries = await openDirectoryIfExists(current);
       if (!entries) continue;
       for await (const entry of entries) {
         this.throwIfCancelled(context);
@@ -328,6 +334,14 @@ export async function readBoundedFile(filePath, maxBytes, label) {
   }
 }
 
+function isSkippableSearchFileError(error) {
+  const message = String(error?.message || "");
+  return error?.code === "ELOOP"
+    || message.startsWith("search file exceeds maximum size")
+    || message === "search file is not a regular file"
+    || message === "refusing to read search file with multiple hard links";
+}
+
 function decodeUtf8(buffer) {
   try { return new TextDecoder("utf-8", { fatal: true }).decode(buffer); } catch {
     throw new Error("file is not valid UTF-8 text");
@@ -364,8 +378,12 @@ async function atomicWriteText(full, content, existing = null, options = {}) {
   try {
     await writeFlushedText(temp, content, existing ? existing.mode & 0o777 : 0o600);
     if (options.expectedHash) {
-      const current = await readUtf8File(full).catch(() => null);
-      if (current === null || sha256(current) !== options.expectedHash) throw new Error("file changed before atomic commit");
+      let current;
+      try { current = await readUtf8File(full); } catch (error) {
+        if (error?.code === "ENOENT") throw new Error("file changed before atomic commit", { cause: error });
+        throw error;
+      }
+      if (sha256(current) !== options.expectedHash) throw new Error("file changed before atomic commit");
     }
     if (options.createOnly) {
       await link(temp, full);
@@ -414,7 +432,7 @@ export async function commitPatchTransaction(operations, options = {}) {
         if (sha256(current) !== operation.originalHash) throw new Error(`patch source changed during apply: ${operation.source}`);
       }
       if (operation.kind === "add" || operation.kind === "move") {
-        if (await lstat(operation.target).catch(() => null)) throw new Error(`patch target appeared during apply: ${operation.target}`);
+        if (await pathEntryIfExists(operation.target)) throw new Error(`patch target appeared during apply: ${operation.target}`);
       }
     }