deadbyte-mcp 0.14.0 → 0.15.1

package/src/host-plane.mjs

@@ -16,6 +16,7 @@ import { decodeUtf8Strict } from './text-policy.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 
 export const HOST_POLICY_SCHEMA = 'deadbyte.host-policy.v1';
+export const HOST_POLICY_SCHEMA_V2 = 'deadbyte.host-policy.v2';
 export const HOST_ARM_SCHEMA = 'deadbyte.host-arm.v1';
 export const HOST_GRANT_SCHEMA = 'deadbyte.host-grant.v2';
 export const HOST_DEFAULT_MAX_READ_BYTES = 256 * 1024;
@@ -45,7 +46,7 @@ function finiteInteger(value, name, min, max, fallback) {
 
 function normalizePolicyObject(raw, policyPath) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('host policy must be a JSON object');
-  if (raw.schema !== HOST_POLICY_SCHEMA) throw new Error('host policy schema mismatch');
+  if (![HOST_POLICY_SCHEMA, HOST_POLICY_SCHEMA_V2].includes(raw.schema)) throw new Error('host policy schema mismatch');
   if (raw.enabled !== true) throw new Error('host policy is not enabled');
   if (!raw.arm_file || typeof raw.arm_file !== 'string' || !path.isAbsolute(raw.arm_file)) {
     throw new Error('host policy arm_file must be absolute');
@@ -75,7 +76,10 @@ function normalizePolicyObject(raw, policyPath) {
   for (const [id, value] of Object.entries(raw.commands)) {
     if (!COMMAND_ID_RE.test(id)) throw new Error(`invalid host command id '${id}'`);
     if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`host command '${id}' malformed`);
-    if (value.kind !== 'script') throw new Error(`host command '${id}' kind must be script`);
+    const kind=value.kind;
+    if (kind!=='script' && !(raw.schema===HOST_POLICY_SCHEMA_V2 && kind==='inline')) {
+      throw new Error(`host command '${id}' kind must be script${raw.schema===HOST_POLICY_SCHEMA_V2?' or inline':''}`);
+    }
     if (typeof value.executable !== 'string' || !path.isAbsolute(value.executable)) {
       throw new Error(`host command '${id}' executable must be absolute`);
     }
@@ -86,37 +90,60 @@ function normalizePolicyObject(raw, policyPath) {
     if (rootIds.length === 0 || rootIds.some(rootId => !ROOT_ID_RE.test(rootId) || !roots[rootId])) {
       throw new Error(`host command '${id}' root_ids invalid`);
     }
-    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string')) {
+    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string' || x.includes('\0'))) {
       throw new Error(`host command '${id}' prefix_args must be strings`);
     }
-    if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
-        value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
-      throw new Error(`host command '${id}' extensions invalid`);
-    }
-    commands[id] = {
-      kind: 'script',
+    const base={
+      kind,
       executable: path.resolve(value.executable),
       executable_sha256: value.executable_sha256.toLowerCase(),
       root_ids: [...new Set(rootIds)],
       prefix_args: [...value.prefix_args],
-      extensions: value.extensions.map(x => x.toLowerCase()),
       timeout_ms: finiteInteger(value.timeout_ms, `commands.${id}.timeout_ms`, 100, 300_000, HOST_DEFAULT_TIMEOUT_MS),
       max_output_bytes: finiteInteger(value.max_output_bytes, `commands.${id}.max_output_bytes`, 1024, 4 * 1024 * 1024, HOST_DEFAULT_MAX_OUTPUT_BYTES)
     };
+    if(kind==='script'){
+      if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
+          value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
+        throw new Error(`host command '${id}' extensions invalid`);
+      }
+      base.extensions=value.extensions.map(x => x.toLowerCase());
+    } else {
+      base.max_command_chars=finiteInteger(value.max_command_chars,`commands.${id}.max_command_chars`,1,262144,32768);
+    }
+    commands[id]=base;
+  }
+
+  let nativeExec={enabled:false,root_ids:[],timeout_ms:HOST_DEFAULT_TIMEOUT_MS,max_output_bytes:HOST_DEFAULT_MAX_OUTPUT_BYTES,max_args:64,max_arg_chars:8192};
+  if(raw.schema===HOST_POLICY_SCHEMA_V2 && raw.native_exec!==undefined){
+    const value=raw.native_exec;
+    if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('host native_exec malformed');
+    if(value.enabled===true){
+      const rootIds=Array.isArray(value.root_ids)?value.root_ids:[];
+      if(rootIds.length===0||rootIds.some(rootId=>!ROOT_ID_RE.test(rootId)||!roots[rootId])) throw new Error('host native_exec root_ids invalid');
+      nativeExec={
+        enabled:true,
+        root_ids:[...new Set(rootIds)],
+        timeout_ms:finiteInteger(value.timeout_ms,'native_exec.timeout_ms',100,300000,HOST_DEFAULT_TIMEOUT_MS),
+        max_output_bytes:finiteInteger(value.max_output_bytes,'native_exec.max_output_bytes',1024,4*1024*1024,HOST_DEFAULT_MAX_OUTPUT_BYTES),
+        max_args:finiteInteger(value.max_args,'native_exec.max_args',0,64,64),
+        max_arg_chars:finiteInteger(value.max_arg_chars,'native_exec.max_arg_chars',1,32768,8192)
+      };
+    }
   }
 
   return {
-    schema: HOST_POLICY_SCHEMA,
+    schema: raw.schema,
     enabled: true,
     policy_path: path.resolve(policyPath),
     arm_file: path.resolve(raw.arm_file),
     roots,
     commands,
+    native_exec:nativeExec,
     max_read_bytes: finiteInteger(raw.max_read_bytes, 'max_read_bytes', 1, 4 * 1024 * 1024, HOST_DEFAULT_MAX_READ_BYTES),
     max_write_bytes: finiteInteger(raw.max_write_bytes, 'max_write_bytes', 1, 8 * 1024 * 1024, HOST_DEFAULT_MAX_WRITE_BYTES)
   };
 }
-
 export async function loadHostPolicy(policyPath) {
   if (!policyPath) throw new Error('missing DEADBYTE privileged host policy path');
   const absolute = path.resolve(policyPath);
@@ -157,6 +184,22 @@ export async function assertHostArmed(policy, now = new Date()) {
   return { arm, standing:false, remaining_ms: expires - now.getTime() };
 }
 
+export async function recheckHostAuthority(policy, initial, now = new Date()) {
+  if (!initial?.arm || typeof initial.arm.instance_nonce !== 'string') {
+    throw new Error('host authority recheck requires an armed initial snapshot');
+  }
+  let current;
+  try { current = await assertHostArmed(policy, now); }
+  catch (error) { throw new Error(`host authority changed during operation: ${String(error?.message ?? error)}`); }
+  const changed =
+    current.arm.schema !== initial.arm.schema ||
+    current.arm.instance_nonce !== initial.arm.instance_nonce ||
+    current.standing !== initial.standing ||
+    (current.arm.expires_at_utc ?? null) !== (initial.arm.expires_at_utc ?? null);
+  if (changed) throw new Error('host authority changed during operation');
+  return current;
+}
+
 function getRoot(policy, rootId, permission) {
   if (!ROOT_ID_RE.test(rootId)) throw new Error('invalid host root id');
   const root = policy.roots[rootId];
@@ -190,7 +233,7 @@ async function nearestExistingParent(candidate) {
   }
 }
 
-async function resolveHostWritable(policy, rootId, relativePath) {
+async function resolveHostWritable(policy, rootId, relativePath, authorityCheck = null) {
   validatePortableRelativePath(relativePath);
   const root = getRoot(policy, rootId, 'write');
   const lexical = path.resolve(root.real_path, relativePath);
@@ -201,6 +244,7 @@ async function resolveHostWritable(policy, rootId, relativePath) {
   const realExisting = await realpath(existingParent);
   if (!isInside(root.real_path, realExisting)) throw new Error('host parent symlink escapes allowed root');
 
+  if (authorityCheck) await authorityCheck();
   await mkdir(parent, { recursive: true });
   const realParent = await realpath(parent);
   if (!isInside(root.real_path, realParent)) throw new Error('host parent resolves outside allowed root');
@@ -265,8 +309,9 @@ function checkExpectedState(state, expectedSha256) {
 }
 
 export async function hostFileWrite(policy, { rootId, relativePath, content, encoding = 'utf8', expectedSha256 }) {
-  await assertHostArmed(policy);
-  const { lexical } = await resolveHostWritable(policy, rootId, relativePath);
+  const armed = await assertHostArmed(policy);
+  const authorityCheck = () => recheckHostAuthority(policy, armed);
+  const { lexical } = await resolveHostWritable(policy, rootId, relativePath, authorityCheck);
   const bytes = decodeWriteContent(content, encoding);
   if (bytes.length > policy.max_write_bytes) throw new Error(`host write exceeds ${policy.max_write_bytes} byte limit`);
 
@@ -276,6 +321,7 @@ export async function hostFileWrite(policy, { rootId, relativePath, content, enc
   const temp = path.join(path.dirname(lexical), `.${path.basename(lexical)}.deadbyte-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
   let handle;
   try {
+    await authorityCheck();
     handle = await open(temp, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
     await handle.writeFile(bytes);
     await handle.sync();
@@ -284,6 +330,7 @@ export async function hostFileWrite(policy, { rootId, relativePath, content, enc
 
     const raceCheck = await currentTargetState(lexical);
     checkExpectedState(raceCheck, expectedSha256);
+    await authorityCheck();
     await rename(temp, lexical);
   } catch (error) {
     if (handle) await handle.close().catch(() => {});
@@ -325,6 +372,93 @@ function collectBounded(stream, limit, state, label, onExceeded) {
   });
 }
 
+function validateHostArgs(args,maxArgs=64,maxChars=2048,label='host exec args'){
+  if(!Array.isArray(args)||args.length>maxArgs||args.some(x=>typeof x!=='string'||x.length>maxChars||x.includes('\0'))){
+    throw new Error(`${label} must be <=${maxArgs} strings of <=${maxChars} characters`);
+  }
+}
+async function resolveExecCwd(policy,rootId,cwd){
+  const root=getRoot(policy,rootId,'exec');
+  let cwdResolved=root.real_path;
+  if(cwd!=='.'){
+    validatePortableRelativePath(cwd);
+    cwdResolved=path.resolve(root.real_path,cwd);
+    if(!isInside(root.real_path,cwdResolved)) throw new Error('host exec cwd escapes allowed root');
+    const realCwd=await realpath(cwdResolved);
+    if(!isInside(root.real_path,realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
+    const cwdStat=await stat(realCwd);
+    if(!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
+    cwdResolved=realCwd;
+  }
+  return cwdResolved;
+}
+async function runHostChild(policy,armed,{executable,argv,cwd,timeoutMs,maxTimeoutMs,maxOutputBytes,authorityPollMs=100}){
+  const activeArm=await recheckHostAuthority(policy,armed);
+  const grantBound=Number.isFinite(activeArm.remaining_ms)?Math.floor(activeArm.remaining_ms):maxTimeoutMs;
+  if(grantBound<100) throw new Error('privileged host plane arm lease expires too soon');
+  const requested=timeoutMs===null||timeoutMs===undefined?maxTimeoutMs:finiteInteger(timeoutMs,'timeout_ms',100,maxTimeoutMs,maxTimeoutMs);
+  const effectiveTimeout=Math.min(requested,maxTimeoutMs,grantBound);
+  const child=spawn(executable,argv,{cwd,env:scrubHostEnvironment(),shell:false,windowsHide:true,detached:false,stdio:['ignore','pipe','pipe']});
+  const stdoutState={chunks:[],bytes:0,exceeded:null};
+  const stderrState={chunks:[],bytes:0,exceeded:null};
+  const kill=()=>{try{child.kill('SIGKILL');}catch{}};
+  collectBounded(child.stdout,maxOutputBytes,stdoutState,'stdout',kill);
+  collectBounded(child.stderr,maxOutputBytes,stderrState,'stderr',kill);
+  let timedOut=false,authorityError=null,timer=null,poller=null;
+  const completion=new Promise((resolve,reject)=>{
+    child.once('error',reject);
+    child.once('close',(code,signal)=>resolve({code,signal}));
+    timer=setTimeout(()=>{timedOut=true;kill();},effectiveTimeout); timer.unref?.();
+    const poll=Math.max(25,Math.min(1000,Number.isInteger(authorityPollMs)?authorityPollMs:100));
+    poller=setInterval(()=>{void recheckHostAuthority(policy,armed).catch(error=>{if(!authorityError){authorityError=error;kill();}});},poll); poller.unref?.();
+  });
+  let result;
+  try{result=await completion;}finally{if(timer)clearTimeout(timer);if(poller)clearInterval(poller);}
+  if(authorityError) throw authorityError;
+  if(stdoutState.exceeded||stderrState.exceeded) throw new Error(stdoutState.exceeded??stderrState.exceeded);
+  const stdoutBytes=Buffer.concat(stdoutState.chunks),stderrBytes=Buffer.concat(stderrState.chunks);
+  return {
+    exit_code:result.code,signal:result.signal,timed_out:timedOut,timeout_ms:effectiveTimeout,
+    stdout:decodeUtf8Strict(stdoutBytes),stderr:decodeUtf8Strict(stderrBytes),
+    stdout_sha256:sha256Bytes(stdoutBytes),stderr_sha256:sha256Bytes(stderrBytes),
+    argv_sha256:sha256Bytes(Buffer.from(JSON.stringify(argv),'utf8'))
+  };
+}
+
+export async function hostExecInline(policy,{commandId,rootId,command,cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  if(!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
+  const spec=policy.commands[commandId];
+  if(!spec||spec.kind!=='inline') throw new Error(`host inline command '${commandId}' is not allowed`);
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof command!=='string'||command.length<1||command.length>spec.max_command_chars||command.includes('\0')) throw new Error('host inline command exceeds policy bounds');
+  const actualExecutableHash=await sha256File(spec.executable);
+  if(actualExecutableHash!==spec.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...spec.prefix_args,command];
+  const result=await runHostChild(policy,armed,{executable:spec.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:commandId,mode:'inline',executable_sha256:actualExecutableHash,command_sha256:sha256Bytes(Buffer.from(command,'utf8')),...result};
+}
+
+export async function hostExecNative(policy,{rootId,executable,executableSha256,args=[],cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  const spec=policy.native_exec;
+  if(!spec?.enabled) throw new Error('host native exec is not enabled by policy');
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host native exec is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof executable!=='string'||!path.isAbsolute(executable)) throw new Error('host native executable must be absolute');
+  if(typeof executableSha256!=='string'||!SHA256_RE.test(executableSha256)) throw new Error('executable_sha256 must be a lowercase SHA-256 digest');
+  validateHostArgs(args,spec.max_args,spec.max_arg_chars,'host native args');
+  const resolved=path.resolve(executable); const info=await stat(resolved);
+  if(!info.isFile()) throw new Error('host native executable is not a file');
+  const actualExecutableHash=await sha256File(resolved);
+  if(actualExecutableHash!==executableSha256) throw new Error(`host native executable hash mismatch: expected ${executableSha256}, found ${actualExecutableHash}`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const result=await runHostChild(policy,armed,{executable:resolved,argv:[...args],cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:'native',mode:'native',executable_sha256:actualExecutableHash,...result};
+}
+
 export async function hostExec(policy, {
   commandId,
   rootId,
@@ -337,14 +471,12 @@ export async function hostExec(policy, {
   const armed = await assertHostArmed(policy);
   if (!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
   const command = policy.commands[commandId];
-  if (!command) throw new Error(`host command '${commandId}' is not allowed`);
-  if (!Array.isArray(args) || args.length > 64 || args.some(x => typeof x !== 'string' || x.length > 2048 || x.includes('\0'))) {
-    throw new Error('host exec args must be <=64 strings of <=2048 characters');
-  }
+  if (!command || command.kind!=='script') throw new Error(`host command '${commandId}' is not allowed as a script command`);
+  validateHostArgs(args,64,2048,'host exec args');
   if (typeof scriptSha256 !== 'string' || !SHA256_RE.test(scriptSha256)) throw new Error('script_sha256 must be a lowercase SHA-256 digest');
 
   if (!ROOT_ID_RE.test(rootId) || !command.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
-  const root = getRoot(policy, rootId, 'exec');
+  getRoot(policy, rootId, 'exec');
   const script = await resolveHostExisting(policy, rootId, scriptPath, 'exec');
   const extension = path.extname(script.resolved).toLowerCase();
   if (!command.extensions.includes(extension)) throw new Error(`script extension '${extension}' is not allowed for '${commandId}'`);
@@ -353,71 +485,8 @@ export async function hostExec(policy, {
 
   const actualExecutableHash = await sha256File(command.executable);
   if (actualExecutableHash !== command.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
-
-  let cwdResolved = root.real_path;
-  if (cwd !== '.') {
-    validatePortableRelativePath(cwd);
-    cwdResolved = path.resolve(root.real_path, cwd);
-    if (!isInside(root.real_path, cwdResolved)) throw new Error('host exec cwd escapes allowed root');
-    const realCwd = await realpath(cwdResolved);
-    if (!isInside(root.real_path, realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
-    const cwdStat = await stat(realCwd);
-    if (!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
-    cwdResolved = realCwd;
-  }
-
-  if (Number.isFinite(armed.remaining_ms) && armed.remaining_ms < 100) throw new Error('privileged host plane arm lease expires too soon');
-  const requestedTimeout = timeoutMs === null ? command.timeout_ms : finiteInteger(timeoutMs, 'timeout_ms', 100, command.timeout_ms, command.timeout_ms);
-  const grantBound = Number.isFinite(armed.remaining_ms) ? armed.remaining_ms : command.timeout_ms;
-  const effectiveTimeout = Math.max(100, Math.min(requestedTimeout, command.timeout_ms, grantBound));
-  const argv = [...command.prefix_args, script.resolved, ...args];
-
-  const child = spawn(command.executable, argv, {
-    cwd: cwdResolved,
-    env: scrubHostEnvironment(),
-    shell: false,
-    windowsHide: true,
-    detached: false,
-    stdio: ['ignore', 'pipe', 'pipe']
-  });
-
-  const stdoutState = { chunks: [], bytes: 0, exceeded: null };
-  const stderrState = { chunks: [], bytes: 0, exceeded: null };
-  collectBounded(child.stdout, command.max_output_bytes, stdoutState, 'stdout', () => child.kill('SIGKILL'));
-  collectBounded(child.stderr, command.max_output_bytes, stderrState, 'stderr', () => child.kill('SIGKILL'));
-
-  let timedOut = false;
-  let timer;
-  const completion = new Promise((resolve, reject) => {
-    child.once('error', reject);
-    child.once('close', (code, signal) => resolve({ code, signal }));
-    timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGKILL');
-    }, effectiveTimeout);
-    timer.unref?.();
-  });
-  let result;
-  try {
-    result = await completion;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-
-  if (stdoutState.exceeded || stderrState.exceeded) {
-    throw new Error(stdoutState.exceeded ?? stderrState.exceeded);
-  }
-  const stdoutBytes = Buffer.concat(stdoutState.chunks);
-  const stderrBytes = Buffer.concat(stderrState.chunks);
-  return {
-    command_id: commandId,
-    executable_sha256: actualExecutableHash,
-    script_sha256: actualScriptHash,
-    exit_code: result.code,
-    signal: result.signal,
-    timed_out: timedOut,
-    timeout_ms: effectiveTimeout,
-    stdout: decodeUtf8Strict(stdoutBytes),
-    stderr: decodeUtf8Strict(stderrBytes)
-  };
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...command.prefix_args,script.resolved,...args];
+  const result=await runHostChild(policy,armed,{executable:command.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:command.timeout_ms,maxOutputBytes:command.max_output_bytes});
+  return {command_id:commandId,mode:'script',executable_sha256:actualExecutableHash,script_sha256:actualScriptHash,...result};
 }

package/src/job-supervisor-host-r44.mjs

@@ -0,0 +1,112 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, openSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, realpath, rename, rm } from 'node:fs/promises';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function insist(ok,message){if(!ok)throw new Error(message);}
+async function atomicJson(file,value){
+  const bytes=Buffer.from(`${JSON.stringify(value,null,2)}\n`,'utf8');
+  const temp=`${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  const h=await open(temp,'wx');try{await h.writeFile(bytes);await h.sync();}finally{await h.close();}
+  await rename(temp,file);
+}
+const arg=process.argv.indexOf('--state-dir');
+if(arg<0||!process.argv[arg+1])throw new Error('R44 job supervisor host requires --state-dir');
+const stateDir=await realpath(path.resolve(process.argv[arg+1]));
+const authPath=path.join(stateDir,'supervisor-auth.json');
+const endpointPath=path.join(stateDir,'supervisor-endpoint.json');
+const auth=JSON.parse(await readFile(authPath,'utf8'));
+insist(auth?.schema==='deadbyte.job-supervisor-auth.v1'&&HEX64.test(auth.token??''),'supervisor auth state invalid');
+const authBytes=Buffer.from(auth.token,'hex');
+const instanceId=randomBytes(32).toString('hex');
+const jobs=new Map();
+const logs=path.join(stateDir,'logs');await mkdir(logs,{recursive:true});
+
+function publicHandle(job){
+  return {handle_id:job.handle_id,pid:job.pid,creation_id:job.creation_id,profile_id:job.profile_id,state:job.state,exit_code:job.exit_code??null};
+}
+function exactJob(input){
+  insist(input&&typeof input==='object','supervisor handle missing');
+  const job=jobs.get(input.handle_id);insist(job,'unknown supervisor handle');
+  insist(job.pid===input.pid&&job.creation_id===input.creation_id&&job.profile_id===input.profile_id,'supervisor process identity mismatch');
+  return job;
+}
+async function verifyExecutable(file,expected){
+  insist(path.isAbsolute(file)&&HEX64.test(expected??''),'supervisor executable identity invalid');
+  const st=await lstat(file);insist(st.isFile()&&!st.isSymbolicLink(),'supervisor executable must be real file');
+  insist(sha(await readFile(file))===expected,'supervisor executable hash mismatch');
+}
+async function handle(op,args){
+  if(op==='hello')return {kind:'external-supervisor',instance_id:instanceId,pid:process.pid};
+  if(op==='start'){
+    insist(args&&HEX64.test(args.job_id??'')&&ID.test(args.profile_id??''),'supervisor start identity invalid');
+    insist(Array.isArray(args.argv)&&args.argv.length<=128&&args.argv.every(v=>typeof v==='string'&&v.length<=8192),'supervisor argv invalid');
+    await verifyExecutable(args.executable,args.executable_sha256);
+    insist(typeof args.cwd==='string'&&path.isAbsolute(args.cwd),'supervisor cwd must be absolute');
+    const cwd=await realpath(args.cwd);const cwdSt=await lstat(cwd);insist(cwdSt.isDirectory()&&!cwdSt.isSymbolicLink(),'supervisor cwd invalid');
+    const handleId=randomBytes(32).toString('hex'),creationId=randomBytes(32).toString('hex');
+    const stdoutPath=path.join(logs,`${handleId}.stdout.log`),stderrPath=path.join(logs,`${handleId}.stderr.log`);
+    const outFd=openSync(stdoutPath,'a'),errFd=openSync(stderrPath,'a');
+    let child;
+    try{
+      child=spawn(args.executable,args.argv,{cwd,windowsHide:true,shell:false,detached:true,stdio:['ignore',outFd,errFd]});
+    }finally{closeSync(outFd);closeSync(errFd);}
+    insist(Number.isInteger(child.pid)&&child.pid>0,'supervisor child spawn failed');
+    const job={handle_id:handleId,pid:child.pid,creation_id:creationId,profile_id:args.profile_id,state:'running',exit_code:null,
+      child,stdout_path:stdoutPath,stderr_path:stderrPath,started_at_utc:new Date().toISOString()};
+    jobs.set(handleId,job);
+    child.once('exit',(code)=>{job.state='terminated';job.exit_code=Number.isInteger(code)?code:null;});
+    child.once('error',()=>{job.state='failed';});
+    child.unref();
+    return publicHandle(job);
+  }
+  if(op==='reattach'||op==='status')return publicHandle(exactJob(args));
+  if(op==='terminate'){
+    const job=exactJob(args);
+    if(job.state==='running'){
+      const exited=new Promise(resolve=>job.child.once('exit',resolve));
+      job.child.kill();
+      await Promise.race([exited,new Promise(resolve=>setTimeout(resolve,3000))]);
+      if(job.state==='running')job.state='terminated';
+    }
+    return publicHandle(job);
+  }
+  if(op==='shutdown'){
+    for(const job of jobs.values())if(job.state==='running')job.child.kill();
+    return {status:'shutting_down'};
+  }
+  throw new Error('unknown supervisor operation');
+}
+function authOk(token){
+  if(!HEX64.test(token??''))return false;
+  const candidate=Buffer.from(token,'hex');return candidate.length===authBytes.length&&timingSafeEqual(candidate,authBytes);
+}
+
+const server=net.createServer(socket=>{
+  socket.setEncoding('utf8');let buffer='';
+  socket.on('data',chunk=>{
+    buffer+=chunk;
+    if(Buffer.byteLength(buffer,'utf8')>1024*1024){socket.destroy();return;}
+    const nl=buffer.indexOf('\n');if(nl<0)return;
+    const line=buffer.slice(0,nl);buffer='';
+    void(async()=>{
+      let request;try{request=JSON.parse(line);}catch{socket.end(JSON.stringify({ok:false,error:'invalid JSON'})+'\n');return;}
+      if(!authOk(request?.token)){socket.end(JSON.stringify({ok:false,error:'unauthorized'})+'\n');return;}
+      try{
+        const result=await handle(request.op,request.args??{});
+        socket.end(JSON.stringify({ok:true,result})+'\n');
+        if(request.op==='shutdown'){
+          setTimeout(async()=>{server.close();await rm(endpointPath,{force:true}).catch(()=>{});process.exit(0);},50).unref();
+        }
+      }catch(error){socket.end(JSON.stringify({ok:false,error:String(error?.message??error)})+'\n');}
+    })();
+  });
+});
+await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(0,'127.0.0.1',resolve);});
+const address=server.address();insist(address&&typeof address==='object','supervisor listen address invalid');
+await atomicJson(endpointPath,{schema:'deadbyte.job-supervisor-endpoint.v1',host:'127.0.0.1',port:address.port,instance_id:instanceId,pid:process.pid,created_at_utc:new Date().toISOString()});

package/src/machine-fs-smoke-client.mjs

@@ -56,7 +56,7 @@ const transport = new StdioClientTransport({
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','workspace_open'];
+const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
 const codingTools = [
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat',

package/src/machine-fs.mjs

@@ -3,7 +3,7 @@ import { createReadStream } from 'node:fs';
 import { lstat, mkdir as fsMkdir, open, readFile, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
-import { assertCodingArmed } from './coding-plane.mjs';
+import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
@@ -219,18 +219,20 @@ function requestSha(operation, args) {
   return sha256Object({ schema: 'deadbyte.machine-fs-request.v1', operation, args });
 }
 
-async function atomicWrite(target, bytes, expectedSha256) {
+async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
   const before = await regularState(target);
   checkExpectedFile(before, expectedSha256);
   const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-machine-fs-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
   let handle;
   try {
+    if (authorityCheck) await authorityCheck();
     handle = await open(temp, 'wx', 0o600);
     await handle.writeFile(bytes);
     await handle.sync();
     await handle.close();
     handle = null;
     checkExpectedFile(await regularState(target), expectedSha256);
+    if (authorityCheck) await authorityCheck();
     await rename(temp, target);
   } catch (error) {
     if (handle) await handle.close().catch(() => {});
@@ -322,8 +324,10 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
       content_sha256: sha256Bytes(bytes)
     });
     const started = nowUtc();
-    const { before, after } = await atomicWrite(target.lexical, bytes, expectedSha256);
-    const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_write', request, {
+    let activeGrant = grant;
+    const authorityCheck = async () => { activeGrant = await recheckCodingAuthority(policy, grant, rootId); return activeGrant; };
+    const { before, after } = await atomicWrite(target.lexical, bytes, expectedSha256, authorityCheck);
+    const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_write', request, {
       root_id: rootId, path: target.relative, started_at_utc: started, completed_at_utc: nowUtc(),
       before_sha256: before.sha256, after_sha256: after.sha256, bytes: after.bytes
     }, receiptId);
@@ -358,8 +362,10 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
       old_sha256: sha256Bytes(Buffer.from(oldString, 'utf8')), new_sha256: sha256Bytes(Buffer.from(newString, 'utf8'))
     });
     const started = nowUtc();
-    const { after } = await atomicWrite(found.lexical, nextBytes, expectedSha256);
-    const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_edit_exact', request, {
+    let activeGrant = grant;
+    const authorityCheck = async () => { activeGrant = await recheckCodingAuthority(policy, grant, rootId); return activeGrant; };
+    const { after } = await atomicWrite(found.lexical, nextBytes, expectedSha256, authorityCheck);
+    const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_edit_exact', request, {
       root_id: rootId, path: found.relative, started_at_utc: started, completed_at_utc: nowUtc(),
       before_sha256: beforeSha, after_sha256: after.sha256, replacements: count, bytes: after.bytes
     });
@@ -376,11 +382,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     const request = requestSha('machine_fs_mkdir', { root_id: rootId, path: target.relative, expected: 'absent' });
     const started = nowUtc();
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await fsMkdir(target.lexical, { recursive: false });
     try {
       const identity = await objectIdentity(target.lexical);
       if (identity.kind !== 'directory') throw new Error('machine fs mkdir post-commit type mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_mkdir', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_mkdir', request, {
         root_id: rootId, path: target.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         before_identity_sha256: null, after_identity_sha256: identity.identity_sha256
       }, receiptId);
@@ -409,11 +416,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const started = nowUtc();
     const race = await objectIdentity(source.resolved);
     if (race.identity_sha256 !== expectedSourceIdentity) throw new Error(`machine fs source identity mismatch before commit: expected ${expectedSourceIdentity}, found ${race.identity_sha256}`);
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rename(source.lexical, destination.lexical);
     try {
       const after = await objectIdentity(destination.lexical);
       if (after.identity_sha256 !== expectedSourceIdentity) throw new Error('machine fs move post-commit identity mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_move', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_move', request, {
         root_id: rootId, source_path: source.relative, destination_path: destination.relative,
         started_at_utc: started, completed_at_utc: nowUtc(), source_identity_sha256: expectedSourceIdentity
       }, receiptId);
@@ -436,6 +444,7 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const before = await objectIdentity(source.resolved);
     if (before.identity_sha256 !== expectedSourceIdentity) throw new Error(`machine fs source identity mismatch: expected ${expectedSourceIdentity}, found ${before.identity_sha256}`);
     const recoveryRoot = path.join(source.root.real_path, '.deadbyte-machine-fs-recovery');
+    let activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await fsMkdir(recoveryRoot, { recursive: true });
     const recoveryKey = sha256Object({ source_path: source.relative, identity_sha256: expectedSourceIdentity });
     const recoveryTarget = path.join(recoveryRoot, recoveryKey);
@@ -443,11 +452,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     catch (error) { if (error?.code !== 'ENOENT') throw error; }
     const request = requestSha('machine_fs_delete', { root_id: rootId, path: source.relative, expected_source_identity: expectedSourceIdentity });
     const started = nowUtc();
+    activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rename(source.lexical, recoveryTarget);
     try {
       const recovered = await objectIdentity(recoveryTarget);
       if (recovered.identity_sha256 !== expectedSourceIdentity) throw new Error('machine fs delete recovery identity mismatch');
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_delete', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_delete', request, {
         root_id: rootId, path: source.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         source_identity_sha256: expectedSourceIdentity, recovery_key: recoveryKey
       });
@@ -485,11 +495,12 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     if (race.kind !== 'directory' || race.entries.length !== 0 || race.identity_sha256 !== expectedSourceIdentity) {
       throw new Error('machine fs rmdir precondition changed before commit');
     }
+    const activeGrant = await recheckCodingAuthority(policy, grant, rootId);
     await rmdir(source.lexical);
     try {
       try { await lstat(source.lexical); throw new Error('machine fs rmdir post-commit path still exists'); }
       catch (error) { if (error?.code !== 'ENOENT') throw error; }
-      const signed = await signReceipt(policy, signingKeyPath, grant, 'machine_fs_rmdir_empty', request, {
+      const signed = await signReceipt(policy, signingKeyPath, activeGrant, 'machine_fs_rmdir_empty', request, {
         root_id: rootId, path: source.relative, started_at_utc: started, completed_at_utc: nowUtc(),
         before_identity_sha256: expectedSourceIdentity, after_identity_sha256: null
       }, receiptId);

package/src/mcp-host-smoke-client.mjs

@@ -84,7 +84,7 @@ function structured(result, label) {
 try {
   await client.connect(transport);
   const names = (await client.listTools()).tools.map(t => t.name).sort();
-  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'workspace_open'];
+  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'skill_catalog', 'workspace_open'];
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`privileged catalog mismatch: ${JSON.stringify(names)}`);
 
   const writeText = structured(await client.callTool({