deadbyte-mcp 0.14.0 → 0.15.1

package/scripts/verify-r45-parent.mjs

@@ -0,0 +1,142 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { lstat, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CLOSURE_DOMAIN=Buffer.from('DEADBYTE-R44-FINAL-CLOSURE-V1\0','utf8');
+const HEX64=/^[0-9a-f]{64}$/;
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+const same=(a,b)=>canonicalJson(a)===canonicalJson(b);
+const samePath=(a,b)=>path.resolve(String(a)).toLowerCase()===path.resolve(String(b)).toLowerCase();
+function insist(ok,message){if(!ok) throw new Error(message);}
+
+function parseManifest(text){
+  const out=new Map();
+  for(const [i,line] of text.split(/\r?\n/).entries()){
+    if(!line) continue;
+    const m=/^([0-9a-f]{64})  ([^\0]+)$/.exec(line);
+    insist(m,`manifest line ${i+1} malformed`);
+    const rel=m[2];
+    insist(!path.posix.isAbsolute(rel)&&!rel.split('/').includes('..')&&!out.has(rel),`unsafe/duplicate manifest path ${rel}`);
+    out.set(rel,m[1]);
+  }
+  return out;
+}
+async function walk(root,rel=''){
+  const dir=path.join(root,...(rel?rel.split('/'):[]));
+  const names=(await readdir(dir)).sort((a,b)=>a.localeCompare(b,'en'));
+  const files=[];
+  for(const name of names){
+    const childRel=rel?`${rel}/${name}`:name;
+    const full=path.join(root,...childRel.split('/'));
+    const st=await lstat(full);
+    insist(!st.isSymbolicLink(),`symlink forbidden: ${childRel}`);
+    if(st.isDirectory()) files.push(...await walk(root,childRel));
+    else { insist(st.isFile(),`non-file forbidden: ${childRel}`); files.push(childRel); }
+  }
+  return files;
+}
+async function verifyTree(root,manifestName,expectedDigest,expectedCount){
+  const manifestBytes=await readFile(path.join(root,manifestName));
+  insist(sha256(manifestBytes)===expectedDigest,`${manifestName} digest mismatch`);
+  const entries=parseManifest(manifestBytes.toString('utf8'));
+  insist(entries.size===expectedCount,`${manifestName} file count mismatch`);
+  const actual=(await walk(root)).filter(rel=>rel!==manifestName).sort((a,b)=>a.localeCompare(b,'en'));
+  const expected=[...entries.keys()].sort((a,b)=>a.localeCompare(b,'en'));
+  insist(same(actual,expected),`${manifestName} exact tree mismatch`);
+  for(const [rel,digest] of entries){
+    insist(sha256(await readFile(path.join(root,...rel.split('/'))))===digest,`${manifestName} file hash mismatch: ${rel}`);
+  }
+  return entries.size;
+}
+
+export async function verifyR45Parent(parentFile,{stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
+  const parentPath=path.resolve(parentFile);
+  const parent=JSON.parse(await readFile(parentPath,'utf8'));
+  insist(parent?.schema==='deadbyte.r45-parent.v1','R45 parent schema mismatch');
+  insist(parent.parent_release_id==='v0.15.0-c15fa41719be61b3','R45 parent release id mismatch');
+  insist(parent.parent_version==='0.15.0','R45 parent version mismatch');
+  insist(parent.parent_manifest_sha256==='c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483','R45 parent manifest mismatch');
+  insist(parent.parent_manifest_file_count===1871,'R45 parent file count mismatch');
+  insist(parent.parent_generation_manifest_sha256==='6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30','R45 parent generation mismatch');
+  insist(parent.parent_generation_file_count===7,'R45 parent generation file count mismatch');
+  insist(parent.parent_final_closure_file_sha256==='8aa9c31ab18dfde67275d7cd59295ba08099839d35d6c97ee277fb184c05cae0','R45 parent closure file hash mismatch');
+  insist(parent.parent_final_closure_sha256==='533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667','R45 parent closure hash mismatch');
+  insist(parent.parent_final_closure_signer_key_id==='c0727a7911e29a0f1edd3cd910e47f89f43edb484743988c89cd82bfd5e37936','R45 parent closure signer mismatch');
+  insist(parent.parent_proof==='immutable-slot+generation+signed-final-closure','R45 parent proof class mismatch');
+
+  const closureBytes=await readFile(path.resolve(parent.parent_final_closure_path));
+  insist(sha256(closureBytes)===parent.parent_final_closure_file_sha256,'R45 parent closure file bytes mismatch');
+  const envelope=JSON.parse(closureBytes.toString('utf8'));
+  insist(envelope?.body?.schema==='deadbyte.r44-final-closure.v1','R45 parent closure schema mismatch');
+  insist(envelope.body.version===parent.parent_version,'R45 parent closure version mismatch');
+  insist(envelope.body.release_label==='R44 REMOTE AGENT SKILL BASELINE','R45 parent closure label mismatch');
+
+  const publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+  insist(publicKey.asymmetricKeyType==='ed25519','R45 parent trust key must be Ed25519');
+  const keyId=sha256(Buffer.from(publicKey.export({type:'spki',format:'der'})));
+  insist(keyId===parent.parent_final_closure_signer_key_id,'R45 parent trust key id mismatch');
+  const bodyBytes=Buffer.from(canonicalJson(envelope.body),'utf8');
+  insist(sha256(bodyBytes)===envelope.body_sha256,'R45 parent closure body hash mismatch');
+  const {closure_sha256,...unsigned}=envelope;
+  insist(sha256(Buffer.from(canonicalJson(unsigned),'utf8'))===closure_sha256,'R45 parent closure envelope hash mismatch');
+  insist(closure_sha256===parent.parent_final_closure_sha256,'R45 parent closure content address mismatch');
+  insist(envelope.attestation?.algorithm==='ed25519'&&envelope.attestation?.domain==='DEADBYTE-R44-FINAL-CLOSURE-V1','R45 parent closure attestation contract mismatch');
+  insist(envelope.attestation.key_id===keyId,'R45 parent closure attestation signer mismatch');
+  insist(cryptoVerify(null,Buffer.concat([CLOSURE_DOMAIN,bodyBytes]),publicKey,Buffer.from(envelope.attestation.signature_base64,'base64')),'R45 parent closure signature invalid');
+
+  const pointer=envelope.body.active_pointer;
+  insist(pointer?.release_id===parent.parent_release_id&&pointer?.version===parent.parent_version&&pointer?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent closure release binding mismatch');
+  insist(pointer.generation_manifest_sha256===parent.parent_generation_manifest_sha256,'R45 parent closure generation binding mismatch');
+  insist(pointer.launcher_sha256===parent.parent_launcher_sha256,'R45 parent launcher binding mismatch');
+  insist(samePath(pointer.release_root,parent.parent_release_root),'R45 parent release root mismatch');
+  insist(samePath(pointer.generation_root,parent.parent_generation_root),'R45 parent generation root mismatch');
+  insist(envelope.body.immutable_slot?.protected===true,'R45 parent immutable slot proof missing');
+  insist(samePath(envelope.body.immutable_slot.release_root,parent.parent_release_root),'R45 parent immutable release root mismatch');
+  insist(!samePath(envelope.body.immutable_slot.development_root,parent.parent_release_root),'R45 parent development root aliases release slot');
+  insist(samePath(envelope.body.immutable_slot.development_root,parent.development_root),'R45 parent development root mismatch');
+  insist(envelope.body.authority?.all_disarmed===true,'R45 parent closure did not record all-disarmed state');
+  for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+    insist(envelope.body.authority.grants_absent?.[name]===true,`R45 parent closure grant absence missing: ${name}`);
+  }
+
+  const evidence=envelope.body.evidence;
+  insist(evidence&&evidence.parity&&evidence.activation&&evidence.rollback&&evidence.restore&&evidence.windows_gate,'R45 parent closure evidence set incomplete');
+  for(const [name,item] of Object.entries(evidence)){
+    insist(typeof item?.path==='string'&&HEX64.test(item?.sha256??''),`R45 parent ${name} evidence identity malformed`);
+    insist(sha256(await readFile(item.path))===item.sha256,`R45 parent ${name} evidence hash mismatch`);
+  }
+  const parity=JSON.parse(await readFile(evidence.parity.path,'utf8'));
+  insist(parity?.schema==='deadbyte.r44-parity.v1'&&parity.status==='passed','R45 parent parity status mismatch');
+  insist(parity.candidate?.release_id===parent.parent_release_id&&parity.candidate?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent parity candidate mismatch');
+  insist(parity.successor?.release_id===parent.parent_release_id&&parity.successor?.manifest_sha256===parent.parent_manifest_sha256,'R45 parent parity successor mismatch');
+  insist(parity.successor_disarmed?.status==='passed','R45 parent successor-disarmed proof missing');
+
+  const releaseFiles=await verifyTree(parent.parent_release_root,'MANIFEST.SHA256',parent.parent_manifest_sha256,parent.parent_manifest_file_count);
+  const generationFiles=await verifyTree(parent.parent_generation_root,'GENERATION.SHA256',parent.parent_generation_manifest_sha256,parent.parent_generation_file_count);
+  return {
+    ok:true,
+    status:'passed',
+    proof_class:parent.parent_proof,
+    release_id:parent.parent_release_id,
+    manifest_sha256:parent.parent_manifest_sha256,
+    generation_manifest_sha256:parent.parent_generation_manifest_sha256,
+    release_files:releaseFiles,
+    generation_files:generationFiles,
+    closure_sha256:parent.parent_final_closure_sha256,
+    closure_file_sha256:parent.parent_final_closure_file_sha256,
+    signer_key_id:keyId,
+    recorded_all_disarmed:true
+  };
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){
+  const file=process.argv[2]??path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','R45-PARENT.json');
+  verifyR45Parent(file).then(result=>console.log(JSON.stringify(result,null,2)))
+    .catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});
+}

package/scripts/windows-gate-evidence-r43.mjs

@@ -0,0 +1,55 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR43Parent } from './verify-r43-parent.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const marker='DEADBYTE V0.14.1 / R43 AUTHORITY HARDENING WINDOWS BATCH GATE: PASS';
+function insist(ok,message){if(!ok)throw new Error(message);}
+
+export async function writeWindowsGateEvidence({
+  candidateRoot=root,
+  stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp')),
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(candidateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.14.1',`Windows gate evidence requires V0.14.1, found ${pkg.version}`);
+  const parent=await verifyR43Parent(path.join(candidate,'R43-PARENT.json'));
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'Windows gate evidence clock invalid');
+  const evidence={
+    schema:'deadbyte.r43-windows-gate.v1',status:'passed',exit_code:0,version:'0.14.1',
+    marker,completed_at_utc:completed.toISOString(),manifest_sha256:manifestSha256,
+    parent:{release_id:parent.parent_release_id,manifest_sha256:parent.parent_manifest_sha256,
+      generation_manifest_sha256:parent.parent_generation_manifest_sha256,
+      activation_receipt_sha256:parent.parent_activation_receipt_sha256},
+    hardening:{authority_toctou:true,absolute_execution_deadline:true,pre_spawn_authority_recheck:true,
+      full_regression_required:true,model_path_changed:false}
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(path.resolve(stateRoot),'evidence','release');
+  await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r43-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);
+    try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',path:file,sha256:sha256(bytes),manifest_sha256:manifestSha256,parent:evidence.parent};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing R43 Windows gate evidence invalid');
+    insist(existing.version==='0.14.1'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing R43 Windows gate identity mismatch');
+    insist(existing.parent?.release_id===parent.parent_release_id&&existing.parent?.activation_receipt_sha256===parent.parent_activation_receipt_sha256,'existing R43 parent evidence mismatch');
+    return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256,parent:existing.parent};
+  }
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)writeWindowsGateEvidence().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/scripts/windows-gate-evidence-r44.mjs

@@ -0,0 +1,55 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR44Parent } from './verify-r44-parent.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const marker='DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS';
+function insist(ok,message){if(!ok)throw new Error(message);}
+
+export async function writeWindowsGateEvidence({
+  candidateRoot=root,
+  stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp')),
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(candidateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.15.0',`Windows gate evidence requires V0.15.0, found ${pkg.version}`);
+  const parent=await verifyR44Parent(path.join(candidate,'R44-PARENT.json'));
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'Windows gate evidence clock invalid');
+  const evidence={
+    schema:'deadbyte.r44-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.0',
+    marker,completed_at_utc:completed.toISOString(),manifest_sha256:manifestSha256,
+    parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+      generation_manifest_sha256:parent.generation_manifest_sha256,
+      final_closure_sha256:parent.closure_sha256,final_closure_file_sha256:parent.closure_file_sha256,
+      signer_key_id:parent.signer_key_id},
+    features:{skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+      remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,
+      full_regression_required:true,codex_live_binary_required:false}
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(path.resolve(stateRoot),'evidence','release');await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r44-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',path:file,sha256:sha256(bytes),manifest_sha256:manifestSha256,parent:evidence.parent};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing R44 Windows gate evidence invalid');
+    insist(existing.version==='0.15.0'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing R44 Windows gate identity mismatch');
+    insist(existing.parent?.release_id===parent.release_id&&existing.parent?.final_closure_sha256===parent.closure_sha256,'existing R44 parent evidence mismatch');
+    return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256,parent:existing.parent};
+  }
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)writeWindowsGateEvidence().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/scripts/windows-gate-evidence-r45.mjs

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifyR45Parent } from './verify-r45-parent.mjs';
+import { doctor } from '../src/doctor-r45.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'..');
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const marker='DEADBYTE V0.15.1 / R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS';
+function insist(ok,message){if(!ok)throw new Error(message);}
+
+export async function writeWindowsGateEvidence({
+  candidateRoot=root,
+  stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp')),
+  clock=()=>new Date()
+}={}){
+  const candidate=path.resolve(candidateRoot);
+  const manifestBytes=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+  const manifestSha256=sha256(manifestBytes);
+  const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+  insist(pkg.version==='0.15.1',`Windows gate evidence requires V0.15.1, found ${pkg.version}`);
+  const parent=await verifyR45Parent(path.join(candidate,'R45-PARENT.json'));
+  const doctorResult=await doctor();
+  insist(doctorResult?.status==='ok'&&doctorResult?.package_version==='0.15.1'&&doctorResult?.manifest?.verified===true,'R45 doctor evidence invalid');
+  insist(doctorResult?.policy?.host_v2_ready===true,'R45 doctor did not verify Host policy v2');
+  const completed=clock();
+  insist(completed instanceof Date&&!Number.isNaN(completed.getTime()),'Windows gate evidence clock invalid');
+  const evidence={
+    schema:'deadbyte.r45-windows-gate.v1',status:'passed',exit_code:0,version:'0.15.1',
+    marker,completed_at_utc:completed.toISOString(),manifest_sha256:manifestSha256,
+    doctor:{status:doctorResult.status,manifest_sha256:doctorResult.manifest.sha256,verified_entries:doctorResult.manifest.verified_entries,host_v2_ready:doctorResult.policy.host_v2_ready},
+    parent:{release_id:parent.release_id,manifest_sha256:parent.manifest_sha256,
+      generation_manifest_sha256:parent.generation_manifest_sha256,
+      final_closure_sha256:parent.closure_sha256,final_closure_file_sha256:parent.closure_file_sha256,
+      signer_key_id:parent.signer_key_id},
+    features:{skill_integrity:true,agent_backend_persistence:true,codex_protocol_contract:true,
+      remote_device_identity:true,durable_job_supervisor:true,real_external_supervisor_smoke:true,
+      full_regression_required:true,codex_live_binary_required:false,host_inline_native:true,native_hardware_observation:true,doctor_release_truth:true}
+  };
+  const bytes=Buffer.from(`${JSON.stringify(evidence,null,2)}\n`,'utf8');
+  const dir=path.join(path.resolve(stateRoot),'evidence','release');await mkdir(dir,{recursive:true});
+  const file=path.join(dir,`r45-windows-gate-${manifestSha256.slice(0,16)}.json`);
+  try{
+    const handle=await open(file,'wx',0o600);try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+    return {status:'written',path:file,sha256:sha256(bytes),manifest_sha256:manifestSha256,parent:evidence.parent};
+  }catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existingBytes=await readFile(file);
+    const existing=JSON.parse(existingBytes.toString('utf8').replace(/^\uFEFF/,''));
+    insist(existing.schema===evidence.schema&&existing.status==='passed'&&existing.exit_code===0,'existing R45 Windows gate evidence invalid');
+    insist(existing.version==='0.15.1'&&existing.marker===marker&&existing.manifest_sha256===manifestSha256,'existing R45 Windows gate identity mismatch');
+    insist(existing.parent?.release_id===parent.release_id&&existing.parent?.final_closure_sha256===parent.closure_sha256,'existing R45 parent evidence mismatch');
+    return {status:'existing',path:file,sha256:sha256(existingBytes),manifest_sha256:manifestSha256,parent:existing.parent};
+  }
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked)writeWindowsGateEvidence().then(value=>console.log(JSON.stringify(value))).catch(error=>{console.error(error instanceof Error?error.stack:String(error));process.exitCode=1;});

package/src/agent-backend-r44.mjs

@@ -0,0 +1,254 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { lstat, mkdir, open, readFile, realpath, rename } from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+const STATE_SCHEMA='deadbyte.agent-backend-state.v1';
+const HEX64=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const METHOD=/^[A-Za-z0-9._\/-]{1,128}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort((a,b)=>a.localeCompare(b,'en')).map(key=>[key,canonical(value[key])])):value;
+const canonicalJson=value=>JSON.stringify(canonical(value));
+function insist(ok,message){if(!ok) throw new Error(message);}
+function now(){return new Date().toISOString();}
+function isJson(value){try{JSON.stringify(value);return true;}catch{return false;}}
+
+async function atomicJson(file,value){
+  await mkdir(path.dirname(file),{recursive:true});
+  const bytes=Buffer.from(`${JSON.stringify(value,null,2)}\n`,'utf8');
+  const temp=`${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  const handle=await open(temp,'wx');
+  try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+  await rename(temp,file);
+  return sha(bytes);
+}
+function validateState(state,backendId){
+  insist(state&&typeof state==='object'&&!Array.isArray(state),'agent backend state must be object');
+  const allowed=['schema','backend_id','state_epoch','next_sequence','threads','requests','updated_at_utc'];
+  insist(Object.keys(state).every(k=>allowed.includes(k))&&allowed.every(k=>Object.hasOwn(state,k)),'agent backend state fields mismatch');
+  insist(state.schema===STATE_SCHEMA,'agent backend state schema mismatch');
+  insist(state.backend_id===backendId,'agent backend state backend mismatch');
+  insist(HEX64.test(state.state_epoch??''),'agent backend state epoch invalid');
+  insist(Number.isInteger(state.next_sequence)&&state.next_sequence>=0,'agent backend sequence invalid');
+  insist(state.threads&&typeof state.threads==='object'&&!Array.isArray(state.threads),'agent backend threads invalid');
+  for(const [logicalId,threadId] of Object.entries(state.threads)){
+    insist(ID.test(logicalId),'agent backend logical thread id invalid');
+    insist(typeof threadId==='string'&&threadId.length>=1&&threadId.length<=512,'agent backend thread id invalid');
+  }
+  insist(state.requests&&typeof state.requests==='object'&&!Array.isArray(state.requests),'agent backend requests invalid');
+  for(const [id,item] of Object.entries(state.requests)){
+    insist(HEX64.test(id),'agent backend request id invalid');
+    insist(item&&typeof item==='object'&&!Array.isArray(item),'agent backend request record invalid');
+    insist(['pending','completed','failed','interrupted'].includes(item.state),'agent backend request state invalid');
+    insist(typeof item.method==='string'&&METHOD.test(item.method),'agent backend request method invalid');
+    insist(HEX64.test(item.params_sha256??''),'agent backend params hash invalid');
+    insist(typeof item.created_at_utc==='string'&&typeof item.updated_at_utc==='string','agent backend request timestamp invalid');
+  }
+  insist(typeof state.updated_at_utc==='string','agent backend state timestamp invalid');
+  return state;
+}
+async function loadState(file,backendId){
+  try{
+    const st=await lstat(file);
+    insist(st.isFile()&&!st.isSymbolicLink(),'agent backend state must be real file');
+    let parsed;
+    try{parsed=JSON.parse(await readFile(file,'utf8'));}catch(error){throw new Error(`agent backend state JSON invalid: ${error.message}`);}
+    return validateState(parsed,backendId);
+  }catch(error){
+    if(error?.code!=='ENOENT') throw error;
+    return {schema:STATE_SCHEMA,backend_id:backendId,state_epoch:randomBytes(32).toString('hex'),next_sequence:0,threads:{},requests:{},updated_at_utc:now()};
+  }
+}
+async function fileSha256(file){
+  const st=await lstat(file);
+  insist(st.isFile()&&!st.isSymbolicLink(),'agent backend executable must be real file');
+  return sha(await readFile(file));
+}
+
+class JsonRpcLineTransport extends EventEmitter {
+  constructor({executable,args=[],cwd=null,env=null,maxLineBytes=1024*1024}){
+    super();this.executable=executable;this.args=args;this.cwd=cwd;this.env=env;this.maxLineBytes=maxLineBytes;this.child=null;this.buffer='';
+  }
+  async start(){
+    if(this.child) throw new Error('agent backend transport already started');
+    this.child=spawn(this.executable,this.args,{cwd:this.cwd??undefined,env:this.env??process.env,windowsHide:true,shell:false,stdio:['pipe','pipe','pipe']});
+    this.child.stdout.setEncoding('utf8');
+    this.child.stdout.on('data',chunk=>{
+      this.buffer+=chunk;
+      if(Buffer.byteLength(this.buffer,'utf8')>this.maxLineBytes*2){this.emit('protocol_error',new Error('agent backend JSON-RPC buffer limit exceeded'));return;}
+      for(;;){
+        const nl=this.buffer.indexOf('\n');if(nl<0)break;
+        const line=this.buffer.slice(0,nl).trim();this.buffer=this.buffer.slice(nl+1);
+        if(!line)continue;
+        if(Buffer.byteLength(line,'utf8')>this.maxLineBytes){this.emit('protocol_error',new Error('agent backend JSON-RPC line limit exceeded'));continue;}
+        try{this.emit('message',JSON.parse(line));}catch(error){this.emit('protocol_error',new Error(`agent backend JSON-RPC invalid: ${error.message}`));}
+      }
+    });
+    let stderr='';
+    this.child.stderr.setEncoding('utf8');
+    this.child.stderr.on('data',chunk=>{stderr=(stderr+chunk).slice(-16384);});
+    this.child.once('error',error=>this.emit('transport_error',error));
+    this.child.once('exit',(code,signal)=>{this.emit('exit',{code,signal,stderr});this.child=null;});
+    await new Promise((resolve,reject)=>{
+      if(this.child.pid){resolve();return;}
+      this.child.once('spawn',resolve);this.child.once('error',reject);
+    });
+  }
+  async send(value){
+    insist(this.child?.stdin?.writable,'agent backend transport is not writable');
+    const line=`${JSON.stringify(value)}\n`;
+    insist(Buffer.byteLength(line,'utf8')<=this.maxLineBytes,'agent backend outbound JSON-RPC line limit exceeded');
+    await new Promise((resolve,reject)=>this.child.stdin.write(line,error=>error?reject(error):resolve()));
+  }
+  async stop(){
+    if(!this.child)return;
+    const child=this.child;
+    const done=new Promise(resolve=>child.once('exit',resolve));
+    child.kill();
+    await Promise.race([done,new Promise(resolve=>setTimeout(resolve,3000))]);
+  }
+}
+
+export async function createAgentBackendR44({
+  backendId,stateDir,transportFactory=null,serverRequestHandler=null,notificationHandler=null,wireMode='jsonrpc2',
+  executable=null,executableSha256=null,args=[],cwd=null,env=null
+}={}){
+  insist(typeof backendId==='string'&&ID.test(backendId),'agent backend id invalid');
+  insist(typeof stateDir==='string'&&path.isAbsolute(stateDir),'agent backend stateDir must be absolute');
+  await mkdir(stateDir,{recursive:true});
+  const root=await realpath(stateDir);
+  const stateFile=path.join(root,`${backendId}.json`);
+  if(transportFactory===null){
+    insist(typeof executable==='string'&&path.isAbsolute(executable),'agent backend executable must be absolute');
+    insist(HEX64.test(executableSha256??''),'agent backend executable SHA-256 invalid');
+    insist(await fileSha256(executable)===executableSha256,'agent backend executable hash mismatch');
+    insist(Array.isArray(args)&&args.length<=64&&args.every(x=>typeof x==='string'&&x.length<=4096),'agent backend args invalid');
+    transportFactory=async()=>new JsonRpcLineTransport({executable,args,cwd,env});
+  }else insist(typeof transportFactory==='function','agent backend transportFactory invalid');
+  insist(serverRequestHandler===null||typeof serverRequestHandler==='function','agent backend serverRequestHandler invalid');
+  insist(notificationHandler===null||typeof notificationHandler==='function','agent backend notificationHandler invalid');
+  insist(['jsonrpc2','codex-app-server'].includes(wireMode),'agent backend wireMode invalid');
+  const wire=value=>wireMode==='jsonrpc2'?{jsonrpc:'2.0',...value}:value;
+
+  let state=await loadState(stateFile,backendId);
+  let changed=false;
+  for(const item of Object.values(state.requests)){
+    if(item.state==='pending'){item.state='interrupted';item.updated_at_utc=now();item.error='backend restarted before terminal response';changed=true;}
+  }
+  if(changed){state.updated_at_utc=now();await atomicJson(stateFile,state);}
+  else{
+    try{await lstat(stateFile);}catch(error){if(error?.code==='ENOENT')await atomicJson(stateFile,state);else throw error;}
+  }
+
+  let transport=null;
+  let started=false;
+  const pending=new Map();
+  let writeChain=Promise.resolve();
+  const persist=async()=>{
+    state.updated_at_utc=now();
+    writeChain=writeChain.then(()=>atomicJson(stateFile,state));
+    return writeChain;
+  };
+  const publicState=()=>({
+    status:'ok',backend_id:backendId,running:started,state_epoch:state.state_epoch,
+    threads:structuredClone(state.threads),requests:structuredClone(state.requests)
+  });
+
+  async function terminal(id,{stateName,result=null,error=null}){
+    const record=state.requests[id];if(!record||record.state!=='pending')return;
+    record.state=stateName;record.updated_at_utc=now();
+    if(result!==null)record.result=result;
+    if(error!==null)record.error=String(error);
+    await persist();
+    const waiter=pending.get(id);pending.delete(id);
+    if(!waiter)return;
+    if(stateName==='completed')waiter.resolve(result);
+    else waiter.reject(new Error(record.error??stateName));
+  }
+  async function handleMessage(message){
+    if(!message||typeof message!=='object'||Array.isArray(message))return;
+    if(typeof message.id==='string'&&Object.hasOwn(message,'method')){
+      const method=String(message.method);
+      try{
+        if(!serverRequestHandler) throw Object.assign(new Error('server request denied by DEADBYTE policy'),{code:-32001});
+        const result=await serverRequestHandler({method,params:message.params??{},backendId});
+        await transport?.send(wire({id:message.id,result}));
+      }catch(error){
+        await transport?.send(wire({id:message.id,error:{code:Number.isInteger(error?.code)?error.code:-32001,message:String(error?.message??error)}}));
+      }
+      return;
+    }
+    if(!Object.hasOwn(message,'id')&&typeof message.method==='string'){
+      if(notificationHandler) await notificationHandler({method:String(message.method),params:message.params??{},backendId});
+      return;
+    }
+    if(typeof message.id!=='string'||!state.requests[message.id])return;
+    if(Object.hasOwn(message,'result'))await terminal(message.id,{stateName:'completed',result:message.result});
+    else if(Object.hasOwn(message,'error'))await terminal(message.id,{stateName:'failed',error:message.error?.message??'JSON-RPC error'});
+  }
+  async function start(){
+    if(started)return publicState();
+    transport=await transportFactory();
+    insist(transport&&typeof transport.start==='function'&&typeof transport.send==='function'&&typeof transport.on==='function','agent backend transport contract invalid');
+    transport.on('message',message=>{void handleMessage(message);});
+    transport.on('protocol_error',error=>{
+      for(const id of pending.keys())void terminal(id,{stateName:'failed',error:String(error?.message??error)});
+    });
+    transport.on('transport_error',error=>{
+      for(const id of pending.keys())void terminal(id,{stateName:'interrupted',error:String(error?.message??error)});
+      started=false;
+    });
+    transport.on('exit',()=>{
+      for(const id of pending.keys())void terminal(id,{stateName:'interrupted',error:'agent backend transport exited'});
+      started=false;
+    });
+    await transport.start();started=true;return publicState();
+  }
+  async function bindThread({logicalId,threadId}={}){
+    insist(typeof logicalId==='string'&&ID.test(logicalId),'logical thread id invalid');
+    insist(typeof threadId==='string'&&threadId.length>=1&&threadId.length<=512,'provider thread id invalid');
+    const existing=state.threads[logicalId];
+    if(existing!==undefined&&existing!==threadId) throw new Error('logical thread already bound to different provider thread');
+    state.threads[logicalId]=threadId;await persist();
+    return {status:'ok',logical_id:logicalId,thread_id:threadId};
+  }
+  async function request({method,params={},timeoutMs=60000}={}){
+    insist(started&&transport,'agent backend is not started');
+    insist(typeof method==='string'&&METHOD.test(method),'agent backend method invalid');
+    insist(isJson(params)&&params&&typeof params==='object','agent backend params must be JSON');
+    insist(Number.isInteger(timeoutMs)&&timeoutMs>=100&&timeoutMs<=900000,'agent backend timeout invalid');
+    const sequence=++state.next_sequence;
+    const paramsSha=sha(Buffer.from(canonicalJson(params),'utf8'));
+    const id=sha(Buffer.from(canonicalJson({backend_id:backendId,state_epoch:state.state_epoch,sequence,method,params_sha256:paramsSha}),'utf8'));
+    state.requests[id]={state:'pending',method,params_sha256:paramsSha,created_at_utc:now(),updated_at_utc:now()};
+    await persist();
+    let timer;
+    const promise=new Promise((resolve,reject)=>{
+      pending.set(id,{resolve,reject});
+      timer=setTimeout(()=>{void terminal(id,{stateName:'failed',error:'agent backend request timeout'});},timeoutMs);
+    }).finally(()=>clearTimeout(timer));
+    try{await transport.send(wire({id,method,params}));}
+    catch(error){await terminal(id,{stateName:'failed',error:String(error?.message??error)});}
+    return promise;
+  }
+  async function notify({method,params={}}={}){
+    insist(started&&transport,'agent backend is not started');
+    insist(typeof method==='string'&&METHOD.test(method),'agent backend notification method invalid');
+    insist(isJson(params)&&params&&typeof params==='object','agent backend notification params must be JSON');
+    await transport.send(wire({method,params}));
+    return {status:'sent',method};
+  }
+  async function status(){return publicState();}
+  async function close(){
+    for(const id of [...pending.keys()])await terminal(id,{stateName:'interrupted',error:'agent backend closed before response'});
+    if(transport?.stop)await transport.stop();transport=null;started=false;return publicState();
+  }
+  async function simulateCrashForTest(){
+    for(const [id,waiter] of pending){waiter.reject(new Error('simulated backend crash'));pending.delete(id);}
+    if(transport?.stop)await transport.stop();transport=null;started=false;
+  }
+  return Object.freeze({start,bindThread,request,notify,status,close,simulateCrashForTest,state_file:stateFile,wire_mode:wireMode});
+}

package/src/autonomous-output-contracts.mjs

@@ -68,7 +68,7 @@ export const autonomousSessionStatusOutputSchema = statusContract({
   shape:{ configured:z.literal(true).optional(), armed:z.boolean().optional(), autonomous_armed:z.boolean().optional(),
     autonomous_reason:z.string().optional(), autonomous_expires_at_utc:z.string().nullable().optional(),
     coding_armed:z.boolean().optional(), coding_reason:z.string().optional(), root_ids:z.array(z.string()).max(64).optional(),
-    planner_backend:z.enum(['client_sampling','openai_compatible','openai_responses']).optional(), profile_ids:z.array(z.string()).max(128).optional(),
+    planner_backend:z.enum(['client_sampling','openai_compatible','openai_responses','codex_app_server']).optional(), profile_ids:z.array(z.string()).max(128).optional(),
     policy_sha256:hex64.optional(), coding_policy_sha256:hex64.optional() }
 });