@henols/vice-mcp 0.1.11 → 0.2.0

package/stock-memory.ts

@@ -25,6 +25,20 @@
 //     exactly how an answer ships without `runState`.
 //   - Never send an EXIT to "restore" the machine after a read (D-05) -- a
 //     read leaves the machine halted, and the answer says so via runState.
+//   - CR-01 (2026-08-17): a chip-state or VIC-fetch read must NEVER pass a
+//     literal bank id and must NEVER default to `0x0000` -- bank 0 is the
+//     CPU view and follows `$00`/`$01` banking, so with I/O banked out it
+//     silently returns the RAM underneath $D000-$DFFF as if it were chip
+//     registers. Such a caller MUST use resolveRequiredBank() below and
+//     refuse when the emulator's own catalog has no `io` bank -- never
+//     guess, never fall back to bank 0.
+//   - WR-01 (2026-08-17): never REPORT or LIST banks out of the catalog's
+//     `byId` map. Stock VICE reports several names for one wire id (3.9:
+//     both `default` and `cpu` are id 0), so an id-keyed map is lossy by
+//     construction -- enumerating it made vice_memory_banks answer 5 banks
+//     where the emulator enumerated 6, and made resolveRequiredBank()'s
+//     refusal tell an agent a working bank name did not exist. Anything
+//     agent-facing reads `entries`, the verbatim wire list.
 import { CommandType, memGetBody, memSetBody } from "./stock-protocol.ts";
 import { parseAddress, parseByteCount } from "./stock-address.ts";
 import { convertWireError, isErrorText, stockAnswer, type StockSessionHandler, type StockToolResult } from "./stock-handler.ts";
@@ -51,7 +65,18 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 
 export interface BankCatalog {
   byName: Map<string, number>;
+  /** ONE name per id, for the reverse lookup only. Real stock VICE reports
+   * MORE THAN ONE name for the same wire id (3.9 reports both `default` and
+   * `cpu` for id 0), so this map is LOSSY BY CONSTRUCTION -- never enumerate
+   * it to report "the banks the emulator has" (WR-01, 2026-08-17: doing
+   * exactly that made vice_memory_banks answer 5 banks where the emulator
+   * enumerated 6, and made a refusal claim a working bank name did not
+   * exist). Use `entries` for anything that reports or lists. */
   byId: Map<number, string>;
+  /** Every (id, name) pair the emulator reported, in wire order -- aliases
+   * included. This is the faithful record of the enumeration and the only
+   * thing that may be reported to a caller. */
+  entries: { id: number; name: string }[];
 }
 
 /** The one place this file's per-session cache storage is defined -- an
@@ -93,22 +118,34 @@ export async function bankCatalogFor(session: StockConnectSession): Promise<Bank
 
   const byName = new Map<string, number>();
   const byId = new Map<number, string>();
+  const entries: { id: number; name: string }[] = [];
   for (const bank of response.banks) {
     byName.set(bank.name.toLowerCase(), bank.id);
-    byId.set(bank.id, bank.name);
+    // WR-01: FIRST name per id wins here, so the reverse lookup is stable
+    // rather than "whichever alias the emulator listed last". Aliases are
+    // never lost -- they all live in `entries`.
+    if (!byId.has(bank.id)) {
+      byId.set(bank.id, bank.name);
+    }
+    entries.push({ id: bank.id, name: bank.name });
   }
 
-  const catalog: BankCatalog = { byName, byId };
+  const catalog: BankCatalog = { byName, byId, entries };
   bankCatalogs.set(session, catalog);
   return catalog;
 }
 
-/** Shared bank-argument resolution for both memory handlers below: omitted
- * `bank` resolves to wire id 0x0000, a non-string `bank` refuses, and an
- * unknown name refuses listing the names the catalog actually returned --
- * never a hardcoded table. Factored once so handleMemoryRead/Write do not
- * each re-derive the same three branches. */
-async function resolveBank(
+/** Shared bank-argument resolution for every handler whose `bank` argument is
+ * OPTIONAL: omitted `bank` resolves to wire id 0x0000, a non-string `bank`
+ * refuses, and an unknown name refuses listing the names the catalog actually
+ * returned -- never a hardcoded table. Factored once so
+ * handleMemoryRead/Write, and stock-memory-search.ts's
+ * vice_memory_search/vice_memory_compare (WR-06), do not each re-derive the
+ * same three branches. An omitted bank is the CPU view, which is a defensible
+ * DEFAULT for a caller who asked to read memory as the CPU sees it -- but it
+ * is never correct for a chip-state or VIC-fetch read: those call
+ * resolveRequiredBank() below instead, where an absent catalog entry refuses. */
+export async function resolveBank(
   toolName: string,
   bankArg: unknown,
   session: StockConnectSession,
@@ -119,7 +156,30 @@ async function resolveBank(
   if (typeof bankArg !== "string") {
     return { ok: false, result: isErrorText(`${toolName}: bank must be a string, got ${typeof bankArg}`) };
   }
+  return await resolveRequiredBank(toolName, bankArg, session);
+}
 
+/**
+ * The one exported seam that turns a REQUIRED bank NAME into the emulator's
+ * own wire bank id, or refuses (CR-01, 2026-08-17, plan_decision_D-05-14).
+ * Unlike resolveBank() above -- whose contract is "an omitted bank means
+ * wire id 0x0000", correct for vice_memory_read/write where the caller
+ * asked for the CPU view -- this function's `bankName` is MANDATORY, and an
+ * absent catalog entry is a REFUSAL, never a fallback. Consumers that need
+ * a specific chip's register view (vice_vicii_get_state,
+ * vice_cia_get_state) call this directly; they must never default to bank
+ * 0x0000, which follows $00/$01 banking and returns the RAM underneath
+ * $D000-$DFFF whenever the running program has banked I/O out.
+ *
+ * Bank ids are never hardcoded here -- they come only from the emulator's
+ * own BANKS_AVAILABLE catalog (bankCatalogFor()'s per-session cache), since
+ * ids are build- and machine-specific.
+ */
+export async function resolveRequiredBank(
+  toolName: string,
+  bankName: string,
+  session: StockConnectSession,
+): Promise<{ ok: true; id: number; name: string } | { ok: false; result: StockToolResult }> {
   let catalog: BankCatalog;
   try {
     catalog = await bankCatalogFor(session);
@@ -127,12 +187,28 @@ async function resolveBank(
     return { ok: false, result: convertWireError(toolName, err) };
   }
 
-  const resolved = catalog.byName.get(bankArg.toLowerCase());
+  const requested = bankName.toLowerCase();
+  const resolved = catalog.byName.get(requested);
   if (resolved === undefined) {
-    const names = [...catalog.byId.values()].join(", ") || "(none reported)";
-    return { ok: false, result: isErrorText(`${toolName}: unknown bank "${bankArg}" -- available banks: ${names}`) };
+    // WR-01: listed from `entries`, NOT from byId -- byId collapses aliases
+    // sharing a wire id, so listing it told an agent that a bank name which
+    // resolves perfectly well (VICE 3.9's `default`, id 0) does not exist.
+    const names = catalog.entries.map((bank) => bank.name).join(", ") || "(none reported)";
+    return {
+      ok: false,
+      result: isErrorText(
+        `${toolName}: unknown bank "${bankName}" -- refusing rather than reading the banking-dependent CPU view. ` +
+          `The CPU view (bank 0) returns the RAM underneath $D000-$DFFF whenever the running program has banked ` +
+          `I/O out via $01 -- available banks: ${names}`,
+      ),
+    };
   }
-  return { ok: true, id: resolved, name: bankArg };
+  // WR-01: echo the wire spelling of the name the CALLER asked for, not
+  // "whatever name byId happens to hold for this id" -- asking for `default`
+  // and being answered `cpu` looks like the resolver silently substituted a
+  // different bank.
+  const match = catalog.entries.find((bank) => bank.id === resolved && bank.name.toLowerCase() === requested);
+  return { ok: true, id: resolved, name: match?.name ?? bankName };
 }
 
 // ---------------------------------------------------------------------------
@@ -155,7 +231,10 @@ export const handleMemoryBanks: StockSessionHandler = async (args, session, _dep
     return convertWireError("vice_memory_banks", err);
   }
 
-  const banks = [...catalog.byId.entries()].map(([id, name]) => ({ id, name }));
+  // WR-01: report the emulator's OWN enumeration verbatim, in wire order,
+  // aliases included -- never `byId`, which keeps one name per id and so
+  // answered 5 banks on a machine that enumerated 6.
+  const banks = catalog.entries.map(({ id, name }) => ({ id, name }));
   return stockAnswer(session.client, { banks, count: banks.length });
 };
 

package/stock-protocol.ts

@@ -914,6 +914,60 @@ function requireAsciiFilename(callerName: string, filename: string): Buffer {
   return filenameBuf;
 }
 
+/** Shared name guard for resourceGetBody(): refuses a non-string, a length
+ * of 0 or over 255 (name_length is a uint8), and any byte outside printable
+ * ASCII (0x20-0x7e), naming the offending value/index and the valid bound --
+ * the same discipline as requireAsciiFilename() above. Returns the encoded
+ * ASCII Buffer so the caller never re-encodes. */
+function requireResourceName(name: unknown): Buffer {
+  if (typeof name !== "string") {
+    throw new StockEncodingError(`resourceGetBody: name must be a string, got ${typeof name}`, { field: "name" });
+  }
+  if (name.length === 0) {
+    throw new StockEncodingError("resourceGetBody: name must not be empty", { field: "name" });
+  }
+  for (let index = 0; index < name.length; index += 1) {
+    const codePoint = name.charCodeAt(index);
+    if (codePoint < 0x20 || codePoint > 0x7e) {
+      throw new StockEncodingError(
+        `resourceGetBody: name contains a non-printable-ASCII character at index ${index} (code point ${codePoint}) -- printable ASCII is 0x20-0x7e`,
+        { field: "name" },
+      );
+    }
+  }
+  const nameBuf = Buffer.from(name, "ascii");
+  if (nameBuf.length > 255) {
+    throw new StockEncodingError(`resourceGetBody: name exceeds 255 bytes (${nameBuf.length}) -- name_length is a uint8`, { field: "name" });
+  }
+  return nameBuf;
+}
+
+export interface ResourceGetBodyOptions {
+  name: string;
+}
+
+/**
+ * RESOURCE_GET (0x51) request body -- `name_length(1) name(ASCII, NOT
+ * NUL-terminated)`. [CITED monitor_binary.c:918-935]
+ *
+ * READ-SIDE ONLY: this encoder exists so this phase's sole production
+ * caller can read `MachineVideoStandard` to pick the right cycles-per-line
+ * and lines-per-frame constants. There is no `RESOURCE_SET` (0x52) encoder
+ * in this tree and this plan does not add one -- the SET side of
+ * `MachineVideoStandard`, `VICIIModel` and `MachinePowerFrequency` reaches
+ * `machine_trigger_reset(POWER_CYCLE)` one call deep (`c64/c64.c:1367`) and
+ * destroys all emulation state (CLAUDE.md's Safety constraint). Do not add
+ * a `resourceSetBody()` or a `case ResponseType.ResourceSet` beside this one
+ * without re-deriving that deny-list boundary first.
+ */
+export function resourceGetBody({ name }: ResourceGetBodyOptions): Buffer {
+  const nameBuf = requireResourceName(name);
+  const body = Buffer.alloc(1 + nameBuf.length);
+  body[0] = nameBuf.length;
+  nameBuf.copy(body, 1);
+  return body;
+}
+
 // CHECKPOINT_LIST (0x14), PING (0x81), BANKS_AVAILABLE (0x82),
 // EXECUTE_UNTIL_RETURN (0x73) and EXIT (0xaa) take EMPTY bodies --
 // deliberately no encoder for any of the five: ViceMonitorClient.send()
@@ -1046,6 +1100,73 @@ export interface ParsedUndumpResponse extends ParsedBaseResponse {
   programCounter: number;
 }
 
+/**
+ * One CPUHISTORY_GET (0x86) entry. `cycle` is the monotonic absolute clock
+ * value Phase 7's Route A stopwatch reads -- a `bigint` via
+ * `readBigUInt64LE`, never narrowed to `Number`, since a uint64 clock does
+ * not fit a JS number safely and the stopwatch's whole value is exactness.
+ * The per-entry register block (the `regCount`-prefixed items between the
+ * `item_size` byte and `cycle`, written by `write_registers()`) is
+ * deliberately NOT decoded here: VICE hard-fills `LIN`/`CYC` inside
+ * CPU-history entries with the sentinel `0xffff`
+ * (`monitor_binary.c:1585-1590`), so those per-entry raster positions carry
+ * no real value and this phase never interprets them.
+ *
+ * `instructionLength` is NOT the real length of the decoded 6502
+ * instruction -- VICE hardcodes `uint8_t instruction_length = 4;`
+ * (`monitor_binary.c:1468`) regardless of what `opcode` actually is. Nothing
+ * may treat this field as an instruction size.
+ *
+ * Layout re-derived 2026-08-18 from `monitor_binary_process_cpuhistory()`
+ * (`monitor_binary.c:1452-1620`) and verified against the real committed
+ * captures `fixtures/binmon/cpuhistory-get.bin` and `cpuhistory-get-multi.bin`
+ * (plan 07-12). The PREVIOUS layout this comment cited was disproven live
+ * against a genuine VICE 3.10 build -- see
+ * `.planning/phases/07-cycle-timing-and-wedge-triage/deferred-items.md`,
+ * "Route A (CPUHISTORY_GET) live decode mismatch" -- do not re-trust it.
+ */
+export interface ParsedCpuHistoryEntry {
+  cycle: bigint;
+  opcode: number;
+  instructionLength: number;
+  p1: number;
+  p2: number;
+}
+
+/**
+ * CPUHISTORY_GET (0x86) parsed shape. CORRECTED 2026-08-18 (plan 07-12): the
+ * real `cpuhistory-get-multi.bin` capture (`count:4`) decodes to
+ * STRICTLY ASCENDING `cycle` values across `entries[0..3]` -- i.e.
+ * `entries[0]` is the OLDEST of the returned window and `entries[count-1]`
+ * is the NEWEST, the opposite of this comment's previous unverified
+ * "entries[0] is the newest" claim. Route A's live stopwatch
+ * (`stock-timing.ts`'s `readCycleBaseline()`) is UNAFFECTED by this
+ * correction: it always requests `CPUHISTORY_GET(count:1)`, never a larger
+ * count, so `entries[0]` is the only entry either way. Layout re-derived
+ * from `monitor_binary_process_cpuhistory()` (`monitor_binary.c:1452-1620`)
+ * and verified against the real captures `fixtures/binmon/cpuhistory-get.bin`
+ * (single entry) and `cpuhistory-get-multi.bin` (multi-entry, the stride AND
+ * order proof) -- see plan 07-12 and
+ * `.planning/phases/07-cycle-timing-and-wedge-triage/deferred-items.md` for
+ * the disproven earlier layout this replaces.
+ */
+export interface ParsedCpuHistoryResponse extends ParsedBaseResponse {
+  type: "cpu_history";
+  count: number;
+  entries: ParsedCpuHistoryEntry[];
+}
+
+/**
+ * RESOURCE_GET (0x51) parsed shape. A discriminated union on `valueType` --
+ * `e_MON_RESOURCE_TYPE_STRING` (wire byte 0) decodes to `value: string`,
+ * `e_MON_RESOURCE_TYPE_INT` (wire byte 1) decodes to `value: number`.
+ * [CITED monitor_binary.c:938-965]
+ */
+export type ParsedResourceGetResponse = ParsedBaseResponse & { type: "resource_get" } & (
+    | { valueType: "integer"; value: number }
+    | { valueType: "string"; value: string }
+  );
+
 /** Fallback shape for any responseType this module has no specific case for
  * (including VERIF-02 case 6's response type byte 0x00, which is never a
  * real response/event type on the wire) -- the parser must produce this
@@ -1069,6 +1190,8 @@ export type ParsedResponse =
   | ParsedResumedEvent
   | ParsedJamEvent
   | ParsedUndumpResponse
+  | ParsedCpuHistoryResponse
+  | ParsedResourceGetResponse
   | ParsedUnknownResponse;
 
 // ---------------------------------------------------------------------------
@@ -1319,6 +1442,209 @@ export function parseResponse({ apiVersion, responseType, errorCode, requestId,
     case ResponseType.Undump:
       need(body, 2, responseType, requestId);
       return { type: "undump", requestId, errorCode, programCounter: body.readUInt16LE(0) };
+    case ResponseType.CpuHistoryGet: {
+      // CPUHISTORY_GET (0x86) body layout, re-derived 2026-08-18 from
+      // monitor_binary_process_cpuhistory() (monitor_binary.c:1452-1620) and
+      // verified against the real captures fixtures/binmon/cpuhistory-get.bin
+      // (single entry) and cpuhistory-get-multi.bin (multi-entry, the stride
+      // proof) -- see plan 07-12 and
+      // .planning/phases/07-cycle-timing-and-wedge-triage/deferred-items.md's
+      // "Route A (CPUHISTORY_GET) live decode mismatch" for the disproven
+      // earlier layout this replaces (WR-13): that layout was NEVER
+      // confirmed against a real reply and does not match what a genuine
+      // VICE >= 3.10 build actually sends.
+      //
+      // count(u32LE) at offset 0. Then per entry: item_size(1) -- the byte
+      // count of EVERYTHING AFTER this size byte
+      // (response_size = 4 + count * (item_size + 1), so the entry stride is
+      // item_size + 1) -- NOT the register-block length alone, the single
+      // misreading that produced the previous layout. Inside one entry: a
+      // register block written by write_registers() -- regCount(u16LE),
+      // then regCount items of size(1)+id(1)+value(u16LE), each item's own
+      // stride being its declared size + 1 (same item_size-is-the-wire's-own
+      // -stride discipline as the RegisterInfo case above); then
+      // cycle(u64LE); then instruction_length(1); then exactly
+      // instruction_length bytes of instruction data (opcode, p1, p2, and a
+      // trailing placeholder byte for a third parameter that exists on some
+      // machines). instruction_length is a hardcoded constant 4 in VICE
+      // (monitor_binary.c:1468) regardless of the decoded instruction's real
+      // size -- see ParsedCpuHistoryEntry's doc comment.
+      //
+      // Every field is bounds-checked against BOTH the declared entry end
+      // (entryEnd = offset + 1 + itemSize) and the body end via need() --
+      // an item_size that does not leave room for its own
+      // regCount/register-items/cycle/instruction_length is a
+      // StockFramingError naming the observed item_size and what did not
+      // fit, never a truncated silent success and never a RangeError
+      // (T-07-12-03). 07-REVIEW.md WR-05 closed two holes in that claim: the
+      // regCount read was bounds-checked against the BODY only, so a
+      // multi-entry frame whose first entry declared item_size < 2 read its
+      // regCount out of the NEXT entry and reported a fabricated number; and
+      // the instruction-bytes guard used a hardcoded 3 rather than the
+      // entry's own declared instruction_length, so an entry declaring 200
+      // with 3 bytes present parsed successfully. Both are now
+      // entry-relative. Do not reintroduce a literal in either guard. count is rejected above 65535 up front: VICE's own
+      // count is a uint16_t (monitor_binary.c:1469, 1491's
+      // little_endian_to_uint32() read), so a larger declared count is a
+      // desynced or hostile frame and iterating it would be a
+      // denial-of-service loop (T-07-12-01). The cursor always advances by
+      // exactly 1 + itemSize per entry -- the stride from the source, never
+      // a recomputed sum of the fields just read.
+      need(body, 4, responseType, requestId);
+      const count = body.readUInt32LE(0);
+      if (count > 0xffff) {
+        throw new StockFramingError(
+          `CPUHISTORY_GET declared count ${count}, exceeding VICE's own uint16_t ceiling of 65535 (monitor_binary.c:1469) -- desynced or hostile frame`,
+          { observed: count, expected: 0xffff, responseType, requestId },
+        );
+      }
+      let offset = 4;
+      const entries: ParsedCpuHistoryEntry[] = [];
+      for (let index = 0; index < count; index += 1) {
+        need(body, offset + 1, responseType, requestId);
+        const itemSize = body[offset]!;
+        const entryEnd = offset + 1 + itemSize;
+        need(body, entryEnd, responseType, requestId);
+
+        let cursor = offset + 1;
+        // WR-05 (1): bound regCount by the DECLARED ENTRY, not just the body.
+        // The body-relative need() alone let an entry with item_size < 2 in a
+        // multi-entry frame read its regCount out of the NEXT entry's bytes;
+        // the resulting diagnostic then named a fabricated register count
+        // (observed live: "does not leave room for register item 0 of 4608",
+        // where 4608 was assembled from bytes outside entry 0). Check the
+        // entry first, so the message can only ever name real numbers.
+        if (cursor + 2 > entryEnd) {
+          throw new StockFramingError(
+            `CPUHISTORY_GET entry ${index}'s item_size ${itemSize} does not leave room for its own 2-byte regCount field`,
+            { observed: itemSize, expected: 2, responseType, requestId },
+          );
+        }
+        need(body, cursor + 2, responseType, requestId);
+        const regCount = body.readUInt16LE(cursor);
+        cursor += 2;
+        for (let regIndex = 0; regIndex < regCount; regIndex += 1) {
+          if (cursor + 2 > entryEnd) {
+            throw new StockFramingError(
+              `CPUHISTORY_GET entry ${index}'s item_size ${itemSize} does not leave room for register item ${regIndex} of ${regCount}`,
+              { observed: itemSize, responseType, requestId },
+            );
+          }
+          const regItemSize = body[cursor]!;
+          cursor += 1 + regItemSize;
+        }
+        if (cursor + 8 > entryEnd) {
+          throw new StockFramingError(
+            `CPUHISTORY_GET entry ${index}'s item_size ${itemSize} does not leave room for the 8-byte cycle field after its ${regCount}-item register block`,
+            { observed: itemSize, responseType, requestId },
+          );
+        }
+        need(body, cursor + 8, responseType, requestId);
+        const cycle = body.readBigUInt64LE(cursor);
+        cursor += 8;
+
+        if (cursor + 1 > entryEnd) {
+          throw new StockFramingError(
+            `CPUHISTORY_GET entry ${index}'s item_size ${itemSize} does not leave room for the instruction_length byte`,
+            { observed: itemSize, responseType, requestId },
+          );
+        }
+        need(body, cursor + 1, responseType, requestId);
+        const instructionLength = body[cursor]!;
+        cursor += 1;
+        if (instructionLength < 3) {
+          throw new StockFramingError(
+            `CPUHISTORY_GET entry ${index} declares instruction_length ${instructionLength}, too short to hold opcode/p1/p2`,
+            { observed: instructionLength, expected: 3, responseType, requestId },
+          );
+        }
+        // WR-05 (2): validate against what the entry DECLARES, not a
+        // hardcoded 3. The error message here has always claimed to check
+        // "room for its declared instruction_length", but the guard used a
+        // literal 3 -- so an entry declaring instruction_length 200 with only
+        // 3 instruction bytes present PARSED SUCCESSFULLY and handed
+        // `instructionLength: 200` to consumers (observed against the real
+        // parser). Bound it by instructionLength, then read the 3 fields this
+        // struct defines (opcode/p1/p2); any bytes beyond those 3 within the
+        // declared length are the trailing third-parameter placeholder VICE
+        // reserves and are deliberately not surfaced.
+        if (cursor + instructionLength > entryEnd) {
+          throw new StockFramingError(
+            `CPUHISTORY_GET entry ${index}'s item_size ${itemSize} does not leave room for its declared instruction_length ${instructionLength} ` +
+              `(${entryEnd - cursor} byte(s) remain in the entry)`,
+            { observed: itemSize, expected: instructionLength, responseType, requestId },
+          );
+        }
+        need(body, cursor + instructionLength, responseType, requestId);
+        const opcode = body[cursor]!;
+        const p1 = body[cursor + 1]!;
+        const p2 = body[cursor + 2]!;
+
+        entries.push({ cycle, instructionLength, opcode, p1, p2 });
+        offset = entryEnd; // advance by 1 + itemSize -- the stride from the source
+      }
+      return { type: "cpu_history", requestId, errorCode, count, entries };
+    }
+    case ResponseType.ResourceGet: {
+      // RESOURCE_GET (0x51) response layout: type(1) size(1) payload(size
+      // bytes). type: 0 = e_MON_RESOURCE_TYPE_STRING, 1 =
+      // e_MON_RESOURCE_TYPE_INT. For the integer case size is always 4 and
+      // the payload is a uint32LE; for the string case size is the payload's
+      // own byte length. [CITED monitor_binary.c:938-965]
+      //
+      // CR-02 (code review, plan 07-12 Task 3): the integer branch used to
+      // read a FIXED 4 bytes at offset 2 behind only `need(body, 2 + size,
+      // ...)` -- a body of `[0x01, 0x00]` (size=0) satisfies that guard and
+      // then `readUInt32LE(2)` throws a bare RangeError straight out of
+      // parseResponse(), violating this function's own normative rule
+      // (never add a case that reads at a fixed or wire-derived offset
+      // without a preceding need() for the bytes it ACTUALLY reads). A
+      // 4-byte payload is part of e_MON_RESOURCE_TYPE_INT's own contract,
+      // not a value to read past -- so the size mismatch is checked FIRST,
+      // independent of how many bytes the (possibly also-lying) body
+      // physically has, naming the observed size rather than surfacing as
+      // a generic "body too short" message. Only once size is confirmed to
+      // be exactly 4 does need(body, 2 + 4, ...) bounds-check the actual
+      // payload bytes before reading them.
+      need(body, 2, responseType, requestId);
+      const valueTypeByte = body[0]!;
+      const size = body[1]!;
+      if (valueTypeByte === 1) {
+        if (size !== 4) {
+          throw new StockFramingError(
+            `RESOURCE_GET integer response declares size ${size}, expected 4 (a uint32LE payload)`,
+            { observed: size, expected: 4, responseType, requestId },
+          );
+        }
+        need(body, 2 + 4, responseType, requestId);
+        return { type: "resource_get", requestId, errorCode, valueType: "integer", value: body.readUInt32LE(2) };
+      }
+      // WR-06 (07-REVIEW.md): the documented contract is EXACTLY two value
+      // types -- 0 = string, 1 = int ([CITED monitor_binary.c:938-965]
+      // above). The CR-02 rewrite hardened `=== 1` and let everything else
+      // fall through to the string branch, so a wire byte of 2, 7 or 0xff was
+      // reported as `valueType: "string"` with `size` bytes of arbitrary
+      // memory rendered as ASCII -- a MISLABELLED value where every other
+      // out-of-contract input in this function produces a framing error, and
+      // a direct sibling of the CR-02 rule stated at the top of this file. It
+      // degraded safely only because the single consumer
+      // (stock-timing.ts's resolveVideoStandard) rejects any non-integer
+      // reply; that is a property of today's consumer, not of this parser.
+      if (valueTypeByte !== 0) {
+        throw new StockFramingError(
+          `RESOURCE_GET reply declared value type ${valueTypeByte}, expected 0 (string) or 1 (integer)`,
+          { observed: valueTypeByte, expected: 0, responseType, requestId },
+        );
+      }
+      need(body, 2 + size, responseType, requestId);
+      return {
+        type: "resource_get",
+        requestId,
+        errorCode,
+        valueType: "string",
+        value: body.subarray(2, 2 + size).toString("ascii"),
+      };
+    }
     default:
       return { type: "unknown", requestId, errorCode, responseType };
   }
@@ -1540,6 +1866,8 @@ const RESPONSE_TYPE_OF_PARSED_KIND: Partial<Record<ParsedResponse["type"], Respo
   resumed: ResponseType.Resumed,
   jam: ResponseType.Jam,
   undump: ResponseType.Undump,
+  cpu_history: ResponseType.CpuHistoryGet,
+  resource_get: ResponseType.ResourceGet,
 };
 
 /** The wire ResponseType byte a parsed response was decoded from, for