chainlesschain 0.163.2 → 0.163.3

package/src/commands/mcp.js

@@ -5,6 +5,7 @@
 
 import fs from "fs";
 import path from "path";
+import { isProxy } from "node:util/types";
 import chalk from "chalk";
 import ora from "ora";
 import { logger } from "../lib/logger.js";
@@ -45,11 +46,19 @@ import {
   issueMcpStdioExecutionAuthority,
   materializeApprovedMcpStdioInvocation,
   resolveMcpStdioExecutionApproval,
+  verifyMcpStdioApprovedWorkingDirectory,
 } from "../lib/mcp-stdio-execution-authority.js";
 import {
   MCP_STDIO_RUNTIME_KINDS,
   prepareMcpStdioExecutableIdentity,
 } from "../lib/mcp-stdio-executable-identity.js";
+import { resolveMcpStdioSandboxContext } from "../lib/mcp-stdio-workspace-authority.js";
+import {
+  MCP_SANDBOX_BOUNDARIES,
+  MCP_SANDBOX_POLICY_INVALID_CODE,
+  normalizeMcpSandboxPolicy,
+  readMcpStdioCwd,
+} from "../lib/mcp-sandbox-policy.js";
 import {
   materializeMcpStdioNpmPackage,
   parseExactNpmPackageSpec,
@@ -116,6 +125,7 @@ export function authorizeMcpRowForConnect(row, overrides = {}) {
     config,
     approvalKind,
     approvalSource: `${row?.configScope || "user"}:${row?.configSource || "database"}:${row.name}`,
+    workspaceRoot: projectMcpLocation(process.cwd()).root,
   });
   return config;
 }
@@ -124,6 +134,25 @@ function commandWorkspaceBinding() {
   return registerHostHooksV2Workspace(projectMcpLocation(process.cwd()).root);
 }
 
+export function resolveMcpCommandStdioWorkingDirectory(
+  serverName,
+  config,
+  approval,
+  workspaceBinding = commandWorkspaceBinding(),
+) {
+  const context = resolveMcpStdioSandboxContext({
+    serverName,
+    config,
+    workspaceBinding,
+  });
+  if (context.sandboxPolicy && config.cwd) {
+    verifyMcpStdioApprovedWorkingDirectory(approval, context.workingDirectory);
+  }
+  return (
+    context.workingDirectory || context.pluginWorkspaceRoot || process.cwd()
+  );
+}
+
 function getClient() {
   if (!mcpClient) {
     mcpClient = new MCPClient({ workspaceBinding: commandWorkspaceBinding() });
@@ -287,32 +316,95 @@ function headersHelperField(value) {
     : {};
 }
 
-async function readManagedMcpRows() {
-  const { loadManagedSettings } = await import("../lib/settings-loader.cjs");
-  const loaded = loadManagedSettings({ env: process.env });
-  const block =
-    loaded.settings?.managedMcpServers || loaded.settings?.mcpServers || {};
+function invalidMcpSandboxPolicy(message) {
+  const error = new TypeError(message);
+  error.code = MCP_SANDBOX_POLICY_INVALID_CODE;
+  return error;
+}
+
+function readMcpSandboxPolicy(owner, label) {
+  if (!owner || typeof owner !== "object" || isProxy(owner)) {
+    throw invalidMcpSandboxPolicy(`${label} must be a non-Proxy object`);
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(owner, "sandboxPolicy");
+  if (!descriptor) return { present: false, policy: null };
+  if (!("value" in descriptor)) {
+    throw invalidMcpSandboxPolicy(
+      `${label}.sandboxPolicy must be an own data property`,
+    );
+  }
+  return {
+    present: true,
+    policy: normalizeMcpSandboxPolicy(descriptor.value, {
+      label: `${label}.sandboxPolicy`,
+    }),
+  };
+}
+
+function collectMcpSandboxBoundary(value, previous = []) {
+  return [...previous, value];
+}
+
+export function mcpSandboxPolicyUpdateFromAddOptions(options = {}) {
+  const boundaries = options.sandboxBoundary;
+  if (boundaries !== undefined && !Array.isArray(boundaries)) {
+    throw invalidMcpSandboxPolicy(
+      "--sandbox-boundary must be supplied as a repeatable option",
+    );
+  }
+  if (options.clearSandboxBoundaries && boundaries?.length > 0) {
+    throw invalidMcpSandboxPolicy(
+      "--clear-sandbox-boundaries cannot be combined with --sandbox-boundary",
+    );
+  }
+  if (options.clearSandboxBoundaries) return null;
+  if (!boundaries || boundaries.length === 0) return undefined;
+  return normalizeMcpSandboxPolicy(
+    { requiredBoundaries: boundaries },
+    { label: "--sandbox-boundary" },
+  );
+}
+
+export function managedMcpRowsFromSettings(settings, file) {
+  const block = settings?.managedMcpServers || settings?.mcpServers || {};
   if (!block || typeof block !== "object" || Array.isArray(block)) return [];
   return Object.entries(block)
     .filter(([, config]) => config && typeof config === "object")
-    .map(([name, config]) => ({
-      name,
-      command: config.command || null,
-      args: Array.isArray(config.args) ? config.args : [],
-      env: config.env && typeof config.env === "object" ? config.env : {},
-      runtimeKind: config.runtimeKind || null,
-      url: config.url || null,
-      transport: inferTransport(config),
-      headers:
-        config.headers && typeof config.headers === "object"
-          ? config.headers
-          : {},
-      ...headersHelperField(config.headersHelper),
-      autoConnect: config.autoConnect !== false,
-      configScope: "managed",
-      configSource: loaded.file,
-      projectPath: null,
-    }));
+    .map(([name, config]) => {
+      const { policy: sandboxPolicy } = readMcpSandboxPolicy(
+        config,
+        `Managed MCP server "${name}"`,
+      );
+      const { cwd } = readMcpStdioCwd(config, {
+        label: `Managed MCP server "${name}"`,
+      });
+      return {
+        name,
+        command: config.command || null,
+        args: Array.isArray(config.args) ? config.args : [],
+        env: config.env && typeof config.env === "object" ? config.env : {},
+        runtimeKind: config.runtimeKind || null,
+        ...(cwd ? { cwd } : {}),
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
+        url: config.url || null,
+        transport: inferTransport(config),
+        headers:
+          config.headers && typeof config.headers === "object"
+            ? config.headers
+            : {},
+        ...headersHelperField(config.headersHelper),
+        autoConnect: config.autoConnect !== false,
+        configScope: "managed",
+        configSource: file,
+        projectPath: null,
+      };
+    });
+}
+
+async function readManagedMcpRows() {
+  const { loadManagedSettings } = await import("../lib/settings-loader.cjs");
+  const loaded = loadManagedSettings({ env: process.env });
+  return managedMcpRowsFromSettings(loaded.settings, loaded.file);
 }
 
 function projectMcpLocation(cwd = process.cwd()) {
@@ -365,12 +457,21 @@ export function readProjectMcpRows(cwd = process.cwd()) {
   return Object.entries(document.mcpServers)
     .filter(([, config]) => config && typeof config === "object")
     .map(([name, config]) => {
+      const { policy: sandboxPolicy } = readMcpSandboxPolicy(
+        config,
+        `Project MCP server "${name}"`,
+      );
+      const { cwd } = readMcpStdioCwd(config, {
+        label: `Project MCP server "${name}"`,
+      });
       const row = {
         name,
         command: config.command || null,
         args: Array.isArray(config.args) ? config.args : [],
         env: config.env && typeof config.env === "object" ? config.env : {},
         runtimeKind: config.runtimeKind || null,
+        ...(cwd ? { cwd } : {}),
+        ...(sandboxPolicy ? { sandboxPolicy } : {}),
         url: config.url || null,
         transport: inferTransport(config),
         headers:
@@ -384,7 +485,7 @@ export function readProjectMcpRows(cwd = process.cwd()) {
         projectPath: root,
       };
       Object.defineProperty(row, PROJECT_MCP_FILE_TRUST, { value: trusted });
-      if (trusted && row.headersHelper) {
+      if (trusted && (row.headersHelper || inferTransport(row) === "stdio")) {
         row.projectMcpWorkspaceAuthority = issueProjectMcpWorkspaceAuthority({
           file,
           content,
@@ -414,11 +515,44 @@ function writeProjectMcpDocument(file, document) {
 
 export function writeProjectMcpServer(name, server, cwd = process.cwd()) {
   const { file, document } = readProjectMcpDocument(cwd);
+  if (!server || typeof server !== "object" || isProxy(server)) {
+    throw invalidMcpSandboxPolicy(
+      `Project MCP server "${name}" must be a non-Proxy object`,
+    );
+  }
+  const existing = document.mcpServers[name];
+  const requestedPolicy = readMcpSandboxPolicy(
+    server,
+    `Project MCP server "${name}" update`,
+  );
+  const retainedPolicy = requestedPolicy.present
+    ? requestedPolicy
+    : existing && typeof existing === "object" && !Array.isArray(existing)
+      ? readMcpSandboxPolicy(existing, `Existing project MCP server "${name}"`)
+      : { present: false, policy: null };
+  const requestedCwd = readMcpStdioCwd(server, {
+    label: `Project MCP server "${name}" update`,
+  });
+  const existingCwd =
+    existing && typeof existing === "object" && !Array.isArray(existing)
+      ? readMcpStdioCwd(existing, {
+          label: `Existing project MCP server "${name}"`,
+        })
+      : { present: false, cwd: null };
+  const retainedCwd = requestedCwd.present
+    ? requestedCwd.cwd
+    : existingCwd.present
+      ? existingCwd.cwd
+      : null;
   const config = {};
   if (server.command) config.command = server.command;
   if (server.args?.length) config.args = server.args;
   if (server.env && Object.keys(server.env).length > 0) config.env = server.env;
   if (server.runtimeKind) config.runtimeKind = server.runtimeKind;
+  if (typeof retainedCwd === "string" && retainedCwd.length > 0) {
+    config.cwd = retainedCwd;
+  }
+  if (retainedPolicy.policy) config.sandboxPolicy = retainedPolicy.policy;
   if (server.url) config.url = server.url;
   if (server.transport) config.transport = server.transport;
   if (server.headers && Object.keys(server.headers).length > 0) {
@@ -872,6 +1006,11 @@ export function registerMcpCommand(program) {
           { serverName: name, config: authorized },
         );
         const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvedCwd = resolveMcpCommandStdioWorkingDirectory(
+          name,
+          invocation,
+          approval,
+        );
         const approvalRecord = resolveMcpStdioExecutionApproval(approval);
         const materialized = materializeMcpStdioNpmPackage({
           approvalRecord,
@@ -892,7 +1031,7 @@ export function registerMcpCommand(program) {
           serverName: name,
           config: invocation,
           approval,
-          cwd: process.cwd(),
+          cwd: approvedCwd,
           env: process.env,
           retrust: true,
         });
@@ -973,11 +1112,16 @@ export function registerMcpCommand(program) {
           { serverName: name, config: authorized },
         );
         const invocation = materializeApprovedMcpStdioInvocation(approval);
+        const approvedCwd = resolveMcpCommandStdioWorkingDirectory(
+          name,
+          invocation,
+          approval,
+        );
         const prepared = prepareMcpStdioExecutableIdentity({
           serverName: name,
           config: invocation,
           approval,
-          cwd: process.cwd(),
+          cwd: approvedCwd,
           env: process.env,
           retrust: true,
         });
@@ -1022,6 +1166,15 @@ export function registerMcpCommand(program) {
       "--runtime-kind <kind>",
       "stdio runtime semantics: native | node | python | posix-shell | powershell | java | dotnet",
     )
+    .option(
+      "--sandbox-boundary <boundary>",
+      `Require a stdio sandbox boundary (${MCP_SANDBOX_BOUNDARIES.join(" | ")}); repeatable`,
+      collectMcpSandboxBoundary,
+    )
+    .option(
+      "--clear-sandbox-boundaries",
+      "Explicitly remove previously configured stdio sandbox boundaries",
+    )
     .option(
       "-u, --url <url>",
       "Server URL (http / https / ws / wss transports)",
@@ -1072,6 +1225,13 @@ export function registerMcpCommand(program) {
             `Invalid --runtime-kind; expected one of: ${MCP_STDIO_RUNTIME_KINDS.join(", ")}`,
           );
         }
+        const sandboxPolicyUpdate =
+          mcpSandboxPolicyUpdateFromAddOptions(options);
+        if (sandboxPolicyUpdate !== undefined && !options.command) {
+          throw new Error(
+            "--sandbox-boundary and --clear-sandbox-boundaries are only supported with --command",
+          );
+        }
 
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
@@ -1158,14 +1318,28 @@ export function registerMcpCommand(program) {
         }
 
         const workspaceRoot = projectMcpLocation(process.cwd()).root;
-        const previousLocal =
-          configScope === "local"
-            ? config.get(name, { scope: "local", cwd: workspaceRoot })
-            : null;
+        const previousStored =
+          configScope === "project"
+            ? null
+            : config.get(name, {
+                scope: configScope,
+                cwd: workspaceRoot,
+              });
+        const previousLocal = configScope === "local" ? previousStored : null;
+        const effectiveSandboxPolicy =
+          sandboxPolicyUpdate === undefined
+            ? previousStored?.sandboxPolicy || null
+            : sandboxPolicyUpdate;
+        let configuredSandboxPolicy = effectiveSandboxPolicy;
         const storedConfig = {
           command: options.command || null,
           args,
           runtimeKind: options.command ? options.runtimeKind || null : null,
+          ...(sandboxPolicyUpdate !== undefined
+            ? { sandboxPolicy: sandboxPolicyUpdate }
+            : effectiveSandboxPolicy
+              ? { sandboxPolicy: effectiveSandboxPolicy }
+              : {}),
           url: options.url || null,
           transport,
           env: {},
@@ -1182,6 +1356,9 @@ export function registerMcpCommand(program) {
             storedConfig,
             process.cwd(),
           );
+          configuredSandboxPolicy =
+            readProjectMcpRows(process.cwd()).find((row) => row.name === name)
+              ?.sandboxPolicy || null;
         } else {
           if (configScope === "local" && previousLocal?.headersHelper) {
             revokeLocalMcpHeadersHelperTrust({
@@ -1213,6 +1390,11 @@ export function registerMcpCommand(program) {
           command: options.command || null,
           args,
           runtimeKind: storedConfig.runtimeKind,
+          ...(configuredSandboxPolicy
+            ? { sandboxPolicy: configuredSandboxPolicy }
+            : sandboxPolicyUpdate === null
+              ? { sandboxPolicy: null }
+              : {}),
           url: options.url || null,
           transport,
           autoConnect: !!options.autoConnect,
@@ -1240,6 +1422,11 @@ export function registerMcpCommand(program) {
                 `  ${chalk.gray("Runtime kind:")} ${storedConfig.runtimeKind}`,
               );
             }
+            if (configuredSandboxPolicy) {
+              logger.log(
+                `  ${chalk.gray("Sandbox boundaries:")} ${configuredSandboxPolicy.requiredBoundaries.join(", ")}`,
+              );
+            }
           }
           if (configScope === "project") {
             logger.log(

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.163.3",
+      "cliVersions": ["0.163.2", "0.163.3"],
+      "date": "2026-08-10",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.163.3: isolated background agents and policy-bound runtimes",
+          "body": "> `chainlesschain` **0.163.2 → 0.163.3** (candidate; not yet published,\n> 2026-08-10).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Git background isolation by default**: `cc agent --bg` runs started from a\n  clean Git checkout and not using `--input-format stream-json` now create a\n  worktree at committed `HEAD`; `--worktree` requests the same path and only\n  `--no-worktree` opts into the shared checkout. Foreground runs, runs using\n  `--input-format stream-json`, and non-Git runs retain their prior behavior,\n  while a dirty Git source is rejected instead of silently omitting uncommitted\n  changes.\n- **Generation- and token-fenced ownership**: locked atomic state, immutable\n  worktree/profile identity, worker-generation claims, terminal-absorbing\n  updates, durable turn intents, and stop/cleanup fences prevent stale\n  cooperative workers from reviving or deleting live work. Versioned,\n  secret-free launch profiles preserve compatible resume settings.\n- **Grammar-safe detached arguments**: new background launches preserve option\n  values and `--` literals, pass prompts as one `--print=<text>` token,\n  canonicalize resume/continue/fork to one session, and remap repository\n  `--add-dir` roots into the worktree. Canonical external roots remain shared\n  and produce a warning.\n- **Policy-bearing stdio MCP sources**: explicit `--mcp-config`, managed and\n  registered local/project/user sources, trusted project configuration, Skill,\n  and Cowork definitions propagate normalized `filesystem`/`network`\n  requirements plus separately validated working-directory/workspace authority\n  to the Process Broker. Unprovable requirements fail closed, and invalid named\n  higher-precedence entries do not fall through to a weaker source.\n- **Sealed Linux plugin file sets**: strict direct Plugin Node and supported\n  narrow native ELF launches snapshot every pinned regular plugin file into\n  sealed anonymous data-bind mounts. Dynamic native evidence covers only\n  `PT_INTERP` and direct `DT_NEEDED`; tree attestation remains per-file rather\n  than one atomic filesystem snapshot.\n- **Contained Windows adapter artifacts**: helper, cache, and test artifacts use\n  an attested non-reparse local temporary root, identity/content rechecks,\n  randomized materialization, and bounded retirement. Unknown or unverifiable\n  leftovers are preserved and make cleanup fail closed.\n- **Fail-closed CI routing**: the generic selector routes the defined Windows\n  helper-support paths to their CLI contract tests, supports multi-suite\n  execution, and cannot turn selected-test or primary-run failure into a\n  fallback/diagnostic pass. Full-suite workflows provision their required\n  dependencies explicitly; this routing does not replace the exact-SHA release\n  matrices.\n- **Known residuals**: non-Git, `--input-format stream-json`, `--no-worktree`,\n  and external `add-dir` roots are not worktree-isolated. Spawn-to-PID\n  hard-crash recovery and long-soak closure remain open; Linux native\n  dependency evidence is non-transitive and has no `dlopen` closure; Windows\n  path operations are\n  re-attested but not handle-atomic. macOS atomic runtime execution, arbitrary\n  shared-library closure, remote revocation, signed native distribution, and\n  alias telemetry/removal remain out of scope, so this release does not claim\n  complete P1-2 closure.\n- **Release status**: final tag, exact source SHA, workflow run IDs, package\n  digest, provenance, and public registry readback are intentionally omitted\n  until the exact `0.163.3` release commit passes the required Linux, Windows,\n  and macOS `CLI CI` and `CLI Strict Sandbox` gates and the npm release/readback\n  workflows complete successfully."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.2",
@@ -10,7 +23,7 @@
       "sections": [
         {
           "heading": "Fixed — cc CLI 0.163.2: fail-closed MCP capsule sandbox composition",
-          "body": "> `chainlesschain` **0.163.1 → 0.163.2** (release candidate,\n> 2026-08-09). CLI-only release metadata;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Explicit MCP runtime identity**: stdio MCP configuration now supports\n  `--runtime-kind` for `native`, `node`, `python`, `posix-shell`, `powershell`,\n  `java`, and `dotnet`. Recognized runtimes cannot be relabeled, while renamed\n  or custom runtime executables must declare their semantics before trust is\n  granted. The declaration persists through local, project, managed, Skill, and\n  Cowork configuration sources.\n- **Descriptor-bound Linux MCP capsules**: fixed npm/Node MCP servers now keep\n  the verified Node runtime and entry source bound through launch. The direct\n  inherited-FD path and the `bwrap` filesystem/network/process-tree path both\n  validate the exact runtime, entry, and passthrough arguments; ambiguous\n  separators, path traversal, mixed evidence families, and pathname replacement\n  fail closed.\n- **One-launch Windows MCP authority**: restricted-token and AppContainer plans\n  are issued only by the production adapter and admitted only by the built-in\n  Broker. The private capability binds the original contract, helper payload,\n  environment, stdio handles, and post-spawn closure; validation and post-spawn\n  authority are delete-before-use, cleanup revokes abandoned plans, and replay\n  or injected-adapter plans are rejected before native spawn.\n- **Honest macOS boundary**: public Darwin exec/spawn APIs cannot atomically bind\n  the verified runtime descriptor to the launched image, so strict MCP capsule\n  startup now returns a typed fail-closed result instead of claiming a\n  pathname-based code snapshot. A root-owned/signed broker or equivalent atomic\n  exec design remains a separate roadmap requirement.\n- **Malicious-host evidence v4**: repeated Linux descriptor-bound\n  pathname-replacement probes, explicit macOS fail-closed evidence, and the\n  separately enforced Windows strict gate now use distinct evidence contracts.\n  Formal soak workflows bind their inputs and aggregate artifacts to an exact\n  source SHA.\n- **Accurate native release status**: the unsigned six-target native build/run\n  validation is no longer reported as missing. Native publication remains\n  fail-closed pending Linux signing, Windows Authenticode, macOS\n  signing/notarization, signed install/upgrade/rollback validation,\n  package-manager publication, and public artifact readback.\n- **Scope remains narrow**: this patch does not claim arbitrary native/shared\n  library closure, remote distributed revocation, permissioned or unrestricted\n  Node-builtin modes, the complete malicious Skill matrix, or signed native\n  distribution. All 25 deprecated command aliases remain retained; the\n  `0.164.0` removal floor and representative opt-in telemetry are still unmet.\n- **Release condition**: publication remains blocked until the exact release\n  SHA passes every configured Linux, Windows, and macOS job in `CLI CI` and the\n  `CLI Strict Sandbox` matrix. Because this patch changes MCP isolation, tag\n  `v-npm-0-163-2` additionally waits for exact-SHA three-platform safety and\n  formal two-hour reliability/malicious MCP soak evidence."
+          "body": "> `chainlesschain` **0.163.1 → 0.163.2** (published from exact SHA\n> `2d6f19aea243ed4f054b585d4bc709d4209ff80d`, 2026-08-09). CLI-only release;\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Explicit MCP runtime identity**: stdio MCP configuration now supports\n  `--runtime-kind` for `native`, `node`, `python`, `posix-shell`, `powershell`,\n  `java`, and `dotnet`. Recognized runtimes cannot be relabeled, while renamed\n  or custom runtime executables must declare their semantics before trust is\n  granted. The declaration persists through local, project, managed, Skill, and\n  Cowork configuration sources.\n- **Descriptor-bound Linux MCP capsules**: fixed npm/Node MCP servers now keep\n  the verified Node runtime and entry source bound through launch. The direct\n  inherited-FD path and the `bwrap` filesystem/network/process-tree path both\n  validate the exact runtime, entry, and passthrough arguments; ambiguous\n  separators, path traversal, mixed evidence families, and pathname replacement\n  fail closed.\n- **One-launch Windows MCP authority**: restricted-token and AppContainer plans\n  are issued only by the production adapter and admitted only by the built-in\n  Broker. The private capability binds the original contract, helper payload,\n  environment, stdio handles, and post-spawn closure; validation and post-spawn\n  authority are delete-before-use, cleanup revokes abandoned plans, and replay\n  or injected-adapter plans are rejected before native spawn.\n- **Honest macOS boundary**: public Darwin exec/spawn APIs cannot atomically bind\n  the verified runtime descriptor to the launched image, so strict MCP capsule\n  startup now returns a typed fail-closed result instead of claiming a\n  pathname-based code snapshot. A root-owned/signed broker or equivalent atomic\n  exec design remains a separate roadmap requirement.\n- **Malicious-host evidence v4**: repeated Linux descriptor-bound\n  pathname-replacement probes, explicit macOS fail-closed evidence, and the\n  separately enforced Windows strict gate now use distinct evidence contracts.\n  Formal soak workflows bind their inputs and aggregate artifacts to an exact\n  source SHA.\n- **Accurate native release status**: the unsigned six-target native build/run\n  validation is no longer reported as missing. Native publication remains\n  fail-closed pending Linux signing, Windows Authenticode, macOS\n  signing/notarization, signed install/upgrade/rollback validation,\n  package-manager publication, and public artifact readback.\n- **Scope remains narrow**: this patch does not claim arbitrary native/shared\n  library closure, remote distributed revocation, permissioned or unrestricted\n  Node-builtin modes, the complete malicious Skill matrix, or signed native\n  distribution. All 25 deprecated command aliases remain retained; the\n  `0.164.0` removal floor and representative opt-in telemetry are still unmet.\n- **Published release evidence**: immutable tag `v-npm-0-163-2` resolves to\n  exact source commit `2d6f19aea243ed4f054b585d4bc709d4209ff80d`.\n  Its Linux, Windows, and macOS `CLI CI` and `CLI Strict Sandbox` matrices,\n  formal two-hour reliability/malicious MCP soak, and dedicated npm release all\n  succeeded. The release workflow completed its exact-SHA gate, immutable\n  tarball/CycloneDX SBOM, Trusted Publishing, SLSA provenance, registry\n  readback, and npmmirror synchronization; the independent public readback\n  proved the registry tarball byte-identical to the workflow artifact. The\n  public tarball SHA-256 is\n  `394a755d52fca98e7527228859a78e1c57eae69abfdcaf77cc56e9b665b13fe1`."
         }
       ]
     },