deadbyte-mcp 0.15.0 → 0.15.1

package/src/doctor-r45.mjs

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+import { lstat, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DEADBYTE_VERSION, MCP_PROTOCOL_VERSION } from './version.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=()=>path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=b=>createHash('sha256').update(b).digest('hex');
+async function jsonOrNull(file){try{return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));}catch(e){if(e?.code==='ENOENT')return null;throw e;}}
+async function fileHash(file){return sha256(await readFile(file));}
+function parseManifest(text){
+ const rows=[];
+ for(const [index,line] of text.split(/\r?\n/).entries()){
+  if(!line) continue;
+  const m=/^([0-9a-f]{64})  (.+)$/.exec(line);
+  if(!m) throw new Error(`manifest line ${index+1} malformed`);
+  if(path.isAbsolute(m[2])||m[2].includes('..')||m[2].includes('\\')) throw new Error(`manifest line ${index+1} path unsafe`);
+  rows.push({sha256:m[1],relative:m[2]});
+ }
+ return rows;
+}
+export async function doctor(){
+ const manifestPath=path.join(root,'MANIFEST.SHA256');
+ const manifestBytes=await readFile(manifestPath);
+ const manifestSha256=sha256(manifestBytes);
+ const rows=parseManifest(manifestBytes.toString('utf8'));
+ let verified=0;
+ for(const row of rows){
+  const file=path.join(root,...row.relative.split('/'));
+  const st=await lstat(file);
+  if(!st.isFile()||st.isSymbolicLink()) throw new Error(`manifest entry not regular file: ${row.relative}`);
+  const actual=await fileHash(file);
+  if(actual!==row.sha256) throw new Error(`manifest hash mismatch: ${row.relative}`);
+  verified+=1;
+ }
+ const metadata={};
+ for(const name of ['RELEASE.json','TEST-MATRIX.json','PROVENANCE.json','SBOM.cdx.json']){
+  const file=path.join(root,name),body=await jsonOrNull(file);
+  if(!body) throw new Error(`required release metadata missing: ${name}`);
+  metadata[name]={sha256:await fileHash(file),schema:body.schema??body.bomFormat??null};
+ }
+ const release=await jsonOrNull(path.join(root,'RELEASE.json'));
+ if(release?.version!==DEADBYTE_VERSION) throw new Error('RELEASE.json version mismatch');
+ const hardware=path.join(root,'bin','deadbyte-hardware-observer-r45.exe');
+ const hardwareStat=await lstat(hardware);
+ if(!hardwareStat.isFile()||hardwareStat.isSymbolicLink()) throw new Error('hardware observer must be a regular file');
+ const hardwareSha256=await fileHash(hardware);
+ const active=await jsonOrNull(path.join(stateRoot(),'active-release.json'));
+ const hostPolicy=await jsonOrNull(path.join(root,'controller','deadbyte-host-policy.json'));
+ if(hostPolicy&&release?.train==='R45'&&process.platform==='win32'&&hostPolicy.schema!=='deadbyte.host-policy.v2') throw new Error('R45 doctor rejects non-v2 generated host policy');
+ return {
+  schema:'deadbyte.doctor.v1',status:'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  platform:{current:process.platform,architecture:process.arch,primary:'win32',supported:process.platform==='win32'},
+  manifest:{sha256:manifestSha256,entries:rows.length,verified_entries:verified,verified:true},
+  release_metadata:metadata,
+  native:{hardware_observer:{path:'bin/deadbyte-hardware-observer-r45.exe',sha256:hardwareSha256,bytes:hardwareStat.size}},
+  policy:{host_schema:hostPolicy?.schema??null,host_v2_ready:hostPolicy?.schema==='deadbyte.host-policy.v2'},
+  active_release:active?{release_id:active.release_id,version:active.version,manifest_sha256:active.manifest_sha256,generation_manifest_sha256:active.generation_manifest_sha256,
+    candidate_active:active.version===DEADBYTE_VERSION&&active.manifest_sha256===manifestSha256}:null,
+  known_unsupported:process.platform==='win32'?[]:['native_hardware_observation','windows_controller','desktop_native']
+ };
+}
+export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');return value;}

package/src/host-plane.mjs

@@ -16,6 +16,7 @@ import { decodeUtf8Strict } from './text-policy.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 
 export const HOST_POLICY_SCHEMA = 'deadbyte.host-policy.v1';
+export const HOST_POLICY_SCHEMA_V2 = 'deadbyte.host-policy.v2';
 export const HOST_ARM_SCHEMA = 'deadbyte.host-arm.v1';
 export const HOST_GRANT_SCHEMA = 'deadbyte.host-grant.v2';
 export const HOST_DEFAULT_MAX_READ_BYTES = 256 * 1024;
@@ -45,7 +46,7 @@ function finiteInteger(value, name, min, max, fallback) {
 
 function normalizePolicyObject(raw, policyPath) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('host policy must be a JSON object');
-  if (raw.schema !== HOST_POLICY_SCHEMA) throw new Error('host policy schema mismatch');
+  if (![HOST_POLICY_SCHEMA, HOST_POLICY_SCHEMA_V2].includes(raw.schema)) throw new Error('host policy schema mismatch');
   if (raw.enabled !== true) throw new Error('host policy is not enabled');
   if (!raw.arm_file || typeof raw.arm_file !== 'string' || !path.isAbsolute(raw.arm_file)) {
     throw new Error('host policy arm_file must be absolute');
@@ -75,7 +76,10 @@ function normalizePolicyObject(raw, policyPath) {
   for (const [id, value] of Object.entries(raw.commands)) {
     if (!COMMAND_ID_RE.test(id)) throw new Error(`invalid host command id '${id}'`);
     if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`host command '${id}' malformed`);
-    if (value.kind !== 'script') throw new Error(`host command '${id}' kind must be script`);
+    const kind=value.kind;
+    if (kind!=='script' && !(raw.schema===HOST_POLICY_SCHEMA_V2 && kind==='inline')) {
+      throw new Error(`host command '${id}' kind must be script${raw.schema===HOST_POLICY_SCHEMA_V2?' or inline':''}`);
+    }
     if (typeof value.executable !== 'string' || !path.isAbsolute(value.executable)) {
       throw new Error(`host command '${id}' executable must be absolute`);
     }
@@ -86,37 +90,60 @@ function normalizePolicyObject(raw, policyPath) {
     if (rootIds.length === 0 || rootIds.some(rootId => !ROOT_ID_RE.test(rootId) || !roots[rootId])) {
       throw new Error(`host command '${id}' root_ids invalid`);
     }
-    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string')) {
+    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string' || x.includes('\0'))) {
       throw new Error(`host command '${id}' prefix_args must be strings`);
     }
-    if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
-        value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
-      throw new Error(`host command '${id}' extensions invalid`);
-    }
-    commands[id] = {
-      kind: 'script',
+    const base={
+      kind,
       executable: path.resolve(value.executable),
       executable_sha256: value.executable_sha256.toLowerCase(),
       root_ids: [...new Set(rootIds)],
       prefix_args: [...value.prefix_args],
-      extensions: value.extensions.map(x => x.toLowerCase()),
       timeout_ms: finiteInteger(value.timeout_ms, `commands.${id}.timeout_ms`, 100, 300_000, HOST_DEFAULT_TIMEOUT_MS),
       max_output_bytes: finiteInteger(value.max_output_bytes, `commands.${id}.max_output_bytes`, 1024, 4 * 1024 * 1024, HOST_DEFAULT_MAX_OUTPUT_BYTES)
     };
+    if(kind==='script'){
+      if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
+          value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
+        throw new Error(`host command '${id}' extensions invalid`);
+      }
+      base.extensions=value.extensions.map(x => x.toLowerCase());
+    } else {
+      base.max_command_chars=finiteInteger(value.max_command_chars,`commands.${id}.max_command_chars`,1,262144,32768);
+    }
+    commands[id]=base;
+  }
+
+  let nativeExec={enabled:false,root_ids:[],timeout_ms:HOST_DEFAULT_TIMEOUT_MS,max_output_bytes:HOST_DEFAULT_MAX_OUTPUT_BYTES,max_args:64,max_arg_chars:8192};
+  if(raw.schema===HOST_POLICY_SCHEMA_V2 && raw.native_exec!==undefined){
+    const value=raw.native_exec;
+    if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('host native_exec malformed');
+    if(value.enabled===true){
+      const rootIds=Array.isArray(value.root_ids)?value.root_ids:[];
+      if(rootIds.length===0||rootIds.some(rootId=>!ROOT_ID_RE.test(rootId)||!roots[rootId])) throw new Error('host native_exec root_ids invalid');
+      nativeExec={
+        enabled:true,
+        root_ids:[...new Set(rootIds)],
+        timeout_ms:finiteInteger(value.timeout_ms,'native_exec.timeout_ms',100,300000,HOST_DEFAULT_TIMEOUT_MS),
+        max_output_bytes:finiteInteger(value.max_output_bytes,'native_exec.max_output_bytes',1024,4*1024*1024,HOST_DEFAULT_MAX_OUTPUT_BYTES),
+        max_args:finiteInteger(value.max_args,'native_exec.max_args',0,64,64),
+        max_arg_chars:finiteInteger(value.max_arg_chars,'native_exec.max_arg_chars',1,32768,8192)
+      };
+    }
   }
 
   return {
-    schema: HOST_POLICY_SCHEMA,
+    schema: raw.schema,
     enabled: true,
     policy_path: path.resolve(policyPath),
     arm_file: path.resolve(raw.arm_file),
     roots,
     commands,
+    native_exec:nativeExec,
     max_read_bytes: finiteInteger(raw.max_read_bytes, 'max_read_bytes', 1, 4 * 1024 * 1024, HOST_DEFAULT_MAX_READ_BYTES),
     max_write_bytes: finiteInteger(raw.max_write_bytes, 'max_write_bytes', 1, 8 * 1024 * 1024, HOST_DEFAULT_MAX_WRITE_BYTES)
   };
 }
-
 export async function loadHostPolicy(policyPath) {
   if (!policyPath) throw new Error('missing DEADBYTE privileged host policy path');
   const absolute = path.resolve(policyPath);
@@ -345,6 +372,93 @@ function collectBounded(stream, limit, state, label, onExceeded) {
   });
 }
 
+function validateHostArgs(args,maxArgs=64,maxChars=2048,label='host exec args'){
+  if(!Array.isArray(args)||args.length>maxArgs||args.some(x=>typeof x!=='string'||x.length>maxChars||x.includes('\0'))){
+    throw new Error(`${label} must be <=${maxArgs} strings of <=${maxChars} characters`);
+  }
+}
+async function resolveExecCwd(policy,rootId,cwd){
+  const root=getRoot(policy,rootId,'exec');
+  let cwdResolved=root.real_path;
+  if(cwd!=='.'){
+    validatePortableRelativePath(cwd);
+    cwdResolved=path.resolve(root.real_path,cwd);
+    if(!isInside(root.real_path,cwdResolved)) throw new Error('host exec cwd escapes allowed root');
+    const realCwd=await realpath(cwdResolved);
+    if(!isInside(root.real_path,realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
+    const cwdStat=await stat(realCwd);
+    if(!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
+    cwdResolved=realCwd;
+  }
+  return cwdResolved;
+}
+async function runHostChild(policy,armed,{executable,argv,cwd,timeoutMs,maxTimeoutMs,maxOutputBytes,authorityPollMs=100}){
+  const activeArm=await recheckHostAuthority(policy,armed);
+  const grantBound=Number.isFinite(activeArm.remaining_ms)?Math.floor(activeArm.remaining_ms):maxTimeoutMs;
+  if(grantBound<100) throw new Error('privileged host plane arm lease expires too soon');
+  const requested=timeoutMs===null||timeoutMs===undefined?maxTimeoutMs:finiteInteger(timeoutMs,'timeout_ms',100,maxTimeoutMs,maxTimeoutMs);
+  const effectiveTimeout=Math.min(requested,maxTimeoutMs,grantBound);
+  const child=spawn(executable,argv,{cwd,env:scrubHostEnvironment(),shell:false,windowsHide:true,detached:false,stdio:['ignore','pipe','pipe']});
+  const stdoutState={chunks:[],bytes:0,exceeded:null};
+  const stderrState={chunks:[],bytes:0,exceeded:null};
+  const kill=()=>{try{child.kill('SIGKILL');}catch{}};
+  collectBounded(child.stdout,maxOutputBytes,stdoutState,'stdout',kill);
+  collectBounded(child.stderr,maxOutputBytes,stderrState,'stderr',kill);
+  let timedOut=false,authorityError=null,timer=null,poller=null;
+  const completion=new Promise((resolve,reject)=>{
+    child.once('error',reject);
+    child.once('close',(code,signal)=>resolve({code,signal}));
+    timer=setTimeout(()=>{timedOut=true;kill();},effectiveTimeout); timer.unref?.();
+    const poll=Math.max(25,Math.min(1000,Number.isInteger(authorityPollMs)?authorityPollMs:100));
+    poller=setInterval(()=>{void recheckHostAuthority(policy,armed).catch(error=>{if(!authorityError){authorityError=error;kill();}});},poll); poller.unref?.();
+  });
+  let result;
+  try{result=await completion;}finally{if(timer)clearTimeout(timer);if(poller)clearInterval(poller);}
+  if(authorityError) throw authorityError;
+  if(stdoutState.exceeded||stderrState.exceeded) throw new Error(stdoutState.exceeded??stderrState.exceeded);
+  const stdoutBytes=Buffer.concat(stdoutState.chunks),stderrBytes=Buffer.concat(stderrState.chunks);
+  return {
+    exit_code:result.code,signal:result.signal,timed_out:timedOut,timeout_ms:effectiveTimeout,
+    stdout:decodeUtf8Strict(stdoutBytes),stderr:decodeUtf8Strict(stderrBytes),
+    stdout_sha256:sha256Bytes(stdoutBytes),stderr_sha256:sha256Bytes(stderrBytes),
+    argv_sha256:sha256Bytes(Buffer.from(JSON.stringify(argv),'utf8'))
+  };
+}
+
+export async function hostExecInline(policy,{commandId,rootId,command,cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  if(!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
+  const spec=policy.commands[commandId];
+  if(!spec||spec.kind!=='inline') throw new Error(`host inline command '${commandId}' is not allowed`);
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof command!=='string'||command.length<1||command.length>spec.max_command_chars||command.includes('\0')) throw new Error('host inline command exceeds policy bounds');
+  const actualExecutableHash=await sha256File(spec.executable);
+  if(actualExecutableHash!==spec.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...spec.prefix_args,command];
+  const result=await runHostChild(policy,armed,{executable:spec.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:commandId,mode:'inline',executable_sha256:actualExecutableHash,command_sha256:sha256Bytes(Buffer.from(command,'utf8')),...result};
+}
+
+export async function hostExecNative(policy,{rootId,executable,executableSha256,args=[],cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  const spec=policy.native_exec;
+  if(!spec?.enabled) throw new Error('host native exec is not enabled by policy');
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host native exec is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof executable!=='string'||!path.isAbsolute(executable)) throw new Error('host native executable must be absolute');
+  if(typeof executableSha256!=='string'||!SHA256_RE.test(executableSha256)) throw new Error('executable_sha256 must be a lowercase SHA-256 digest');
+  validateHostArgs(args,spec.max_args,spec.max_arg_chars,'host native args');
+  const resolved=path.resolve(executable); const info=await stat(resolved);
+  if(!info.isFile()) throw new Error('host native executable is not a file');
+  const actualExecutableHash=await sha256File(resolved);
+  if(actualExecutableHash!==executableSha256) throw new Error(`host native executable hash mismatch: expected ${executableSha256}, found ${actualExecutableHash}`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const result=await runHostChild(policy,armed,{executable:resolved,argv:[...args],cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:'native',mode:'native',executable_sha256:actualExecutableHash,...result};
+}
+
 export async function hostExec(policy, {
   commandId,
   rootId,
@@ -357,14 +471,12 @@ export async function hostExec(policy, {
   const armed = await assertHostArmed(policy);
   if (!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
   const command = policy.commands[commandId];
-  if (!command) throw new Error(`host command '${commandId}' is not allowed`);
-  if (!Array.isArray(args) || args.length > 64 || args.some(x => typeof x !== 'string' || x.length > 2048 || x.includes('\0'))) {
-    throw new Error('host exec args must be <=64 strings of <=2048 characters');
-  }
+  if (!command || command.kind!=='script') throw new Error(`host command '${commandId}' is not allowed as a script command`);
+  validateHostArgs(args,64,2048,'host exec args');
   if (typeof scriptSha256 !== 'string' || !SHA256_RE.test(scriptSha256)) throw new Error('script_sha256 must be a lowercase SHA-256 digest');
 
   if (!ROOT_ID_RE.test(rootId) || !command.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
-  const root = getRoot(policy, rootId, 'exec');
+  getRoot(policy, rootId, 'exec');
   const script = await resolveHostExisting(policy, rootId, scriptPath, 'exec');
   const extension = path.extname(script.resolved).toLowerCase();
   if (!command.extensions.includes(extension)) throw new Error(`script extension '${extension}' is not allowed for '${commandId}'`);
@@ -373,72 +485,8 @@ export async function hostExec(policy, {
 
   const actualExecutableHash = await sha256File(command.executable);
   if (actualExecutableHash !== command.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
-
-  let cwdResolved = root.real_path;
-  if (cwd !== '.') {
-    validatePortableRelativePath(cwd);
-    cwdResolved = path.resolve(root.real_path, cwd);
-    if (!isInside(root.real_path, cwdResolved)) throw new Error('host exec cwd escapes allowed root');
-    const realCwd = await realpath(cwdResolved);
-    if (!isInside(root.real_path, realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
-    const cwdStat = await stat(realCwd);
-    if (!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
-    cwdResolved = realCwd;
-  }
-
-  const requestedTimeout = timeoutMs === null ? command.timeout_ms : finiteInteger(timeoutMs, 'timeout_ms', 100, command.timeout_ms, command.timeout_ms);
-  const activeArm = await recheckHostAuthority(policy, armed);
-  const grantBound = Number.isFinite(activeArm.remaining_ms) ? Math.floor(activeArm.remaining_ms) : command.timeout_ms;
-  if (grantBound < 100) throw new Error('privileged host plane arm lease expires too soon');
-  const effectiveTimeout = Math.min(requestedTimeout, command.timeout_ms, grantBound);
-  const argv = [...command.prefix_args, script.resolved, ...args];
-
-  const child = spawn(command.executable, argv, {
-    cwd: cwdResolved,
-    env: scrubHostEnvironment(),
-    shell: false,
-    windowsHide: true,
-    detached: false,
-    stdio: ['ignore', 'pipe', 'pipe']
-  });
-
-  const stdoutState = { chunks: [], bytes: 0, exceeded: null };
-  const stderrState = { chunks: [], bytes: 0, exceeded: null };
-  collectBounded(child.stdout, command.max_output_bytes, stdoutState, 'stdout', () => child.kill('SIGKILL'));
-  collectBounded(child.stderr, command.max_output_bytes, stderrState, 'stderr', () => child.kill('SIGKILL'));
-
-  let timedOut = false;
-  let timer;
-  const completion = new Promise((resolve, reject) => {
-    child.once('error', reject);
-    child.once('close', (code, signal) => resolve({ code, signal }));
-    timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGKILL');
-    }, effectiveTimeout);
-    timer.unref?.();
-  });
-  let result;
-  try {
-    result = await completion;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-
-  if (stdoutState.exceeded || stderrState.exceeded) {
-    throw new Error(stdoutState.exceeded ?? stderrState.exceeded);
-  }
-  const stdoutBytes = Buffer.concat(stdoutState.chunks);
-  const stderrBytes = Buffer.concat(stderrState.chunks);
-  return {
-    command_id: commandId,
-    executable_sha256: actualExecutableHash,
-    script_sha256: actualScriptHash,
-    exit_code: result.code,
-    signal: result.signal,
-    timed_out: timedOut,
-    timeout_ms: effectiveTimeout,
-    stdout: decodeUtf8Strict(stdoutBytes),
-    stderr: decodeUtf8Strict(stderrBytes)
-  };
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...command.prefix_args,script.resolved,...args];
+  const result=await runHostChild(policy,armed,{executable:command.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:command.timeout_ms,maxOutputBytes:command.max_output_bytes});
+  return {command_id:commandId,mode:'script',executable_sha256:actualExecutableHash,script_sha256:actualScriptHash,...result};
 }

package/src/mcp-server.mjs

@@ -15,7 +15,7 @@ import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
-import { assertHostArmed, hostExec, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
+import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
 import { registerMachineTools } from './machine-mcp-tools.mjs';
 import { createAgentRuntime } from './agent-runtime.mjs';
@@ -75,8 +75,9 @@ if (!['0','1'].includes(auditRuntimeMode)) throw new Error('DEADBYTE_AUDIT_RUNTI
 const runtimeStateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(),'.deadbyte-mcp'));
 const surfaceProfile = capabilityProfileFromEnv(process.env);
 const localPrivilegedPolicyPath = path.join(packageRoot, 'controller', 'deadbyte-host-policy.json');
+const privilegedPolicyExplicit = Object.hasOwn(process.env, 'DEADBYTE_PRIVILEGED_POLICY');
 let privilegedPolicyPath = process.env.DEADBYTE_PRIVILEGED_POLICY ?? '';
-if (!privilegedPolicyPath) {
+if (!privilegedPolicyExplicit) {
   try {
     await access(localPrivilegedPolicyPath);
     privilegedPolicyPath = localPrivilegedPolicyPath;
@@ -505,31 +506,71 @@ serveStdio(() => {
     toolServer.registerTool(
       'host_exec',
       {
-        description: 'Privileged host-plane script execution through a locally allowlisted and SHA-256-pinned executable. No raw shell command string is accepted. Requires a live local arm lease.',
-        inputSchema: z.strictObject({
-          command_id: z.string().min(1).max(64),
-          root_id: z.string().min(1).max(64),
-          script_path: z.string().min(1).max(512),
-          script_sha256: z.string().regex(/^[0-9a-f]{64}$/),
-          args: z.array(z.string().max(2048)).max(64).default([]),
-          cwd: z.string().min(1).max(512).default('.'),
-          timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
-        }),
+        description: 'Privileged Host execution with three bounded modes: legacy hash-pinned script, policy-approved inline argv memory, or absolute hash-pinned native executable argv. shell=false; live Host revocation is enforced.',
+        inputSchema: z.union([
+          z.strictObject({
+            mode: z.literal('script').optional().default('script'),
+            command_id: z.string().min(1).max(64),
+            root_id: z.string().min(1).max(64),
+            script_path: z.string().min(1).max(512),
+            script_sha256: z.string().regex(/^[0-9a-f]{64}$/),
+            args: z.array(z.string().max(2048)).max(64).default([]),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          }),
+          z.strictObject({
+            mode: z.literal('inline'),
+            command_id: z.string().min(1).max(64),
+            root_id: z.string().min(1).max(64),
+            command: z.string().min(1).max(262144),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          }),
+          z.strictObject({
+            mode: z.literal('native'),
+            root_id: z.string().min(1).max(64),
+            executable: z.string().min(1).max(2048),
+            executable_sha256: z.string().regex(/^[0-9a-f]{64}$/),
+            args: z.array(z.string().max(32768)).max(64).default([]),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          })
+        ]),
         outputSchema: hostExecOutputSchema
       },
-      async ({ command_id, root_id, script_path, script_sha256, args, cwd, timeout_ms }) => {
+      async args => {
         try {
-          const result = await hostExec(hostPolicy, {
-            commandId: command_id,
-            rootId: root_id,
-            scriptPath: script_path,
-            scriptSha256: script_sha256,
-            args,
-            cwd,
-            timeoutMs: timeout_ms
-          });
+          let result;
+          if (args.mode === 'inline') {
+            result = await hostExecInline(hostPolicy, {
+              commandId: args.command_id,
+              rootId: args.root_id,
+              command: args.command,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          } else if (args.mode === 'native') {
+            result = await hostExecNative(hostPolicy, {
+              rootId: args.root_id,
+              executable: args.executable,
+              executableSha256: args.executable_sha256,
+              args: args.args,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          } else {
+            result = await hostExec(hostPolicy, {
+              commandId: args.command_id,
+              rootId: args.root_id,
+              scriptPath: args.script_path,
+              scriptSha256: args.script_sha256,
+              args: args.args,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          }
           const failed = result.timed_out || result.exit_code !== 0;
-          return textResult(hostExecOutputSchema, { status: failed ? 'failed' : 'passed', root_id, ...result }, failed);
+          return textResult(hostExecOutputSchema, { status: failed ? 'failed' : 'passed', root_id: args.root_id, ...result }, failed);
         } catch (error) {
           return textResult(hostExecOutputSchema, { status: 'denied', error: String(error) }, true);
         }

package/src/native-diff-v2.mjs

@@ -321,17 +321,22 @@ export function createNativeDiffV2Runtime({policy,codingRuntime,machineFsRuntime
     const receipt=await createApplyReceipt(ctx,diffId,identity,preimage,events);return {status:'committed',diff_id:diffId,receipt_sha256:receipt.receipt_sha256,operation_count:identity.operations.length,operation_receipts:receipt.operation_receipts.map(x=>({index:x.index,kind:x.kind,receipt_class:x.receipt_class,receipt_id:x.receipt_id,receipt_sha256:x.receipt_sha256}))};
   }
 
-  async function verify({diffId}){
+  async function verifyEvidence({diffId}){
     try{
       const {ctx,identity}=await loadDiff(diffId);const verifyKey=await loadPublicVerifyKey(verifyKeyPath);const preimage=await readEnvelope(ctx.preimagePath,verifyKey,PREIMAGE_DOMAIN,'native diff V2 preimage');const events=await readEvents(ctx);const receipt=await readEnvelope(ctx.receiptPath,verifyKey,RECEIPT_DOMAIN,'native diff V2 receipt');const {attestation:_a,receipt_sha256:claimed,...body}=receipt;
       if(body.schema!==NATIVE_DIFF_V2_RECEIPT_SCHEMA||body.diff_id!==diffId||body.policy_sha256!==policy.policy_sha256||body.coding_policy_sha256!==policy.coding_policy_sha256||!SHA256_RE.test(claimed??'')||sha256Object(body)!==claimed)return {ok:false,reason:'native diff V2 receipt identity/hash mismatch'};
       const completion=events.at(-1);if(completion?.type!=='transaction_completed'||completion.prev_sha256!==receipt.event_head_sha256||completion.payload?.receipt_sha256!==claimed||receipt.preimage_sha256!==preimage.preimage_sha256)return {ok:false,reason:'native diff V2 receipt/event/preimage binding mismatch'};
       if(!Array.isArray(receipt.operation_receipts)||receipt.operation_receipts.length!==identity.operations.length)return {ok:false,reason:'native diff V2 operation receipt count mismatch'};
       let verified=0,codingVerified=0;for(let index=0;index<identity.operations.length;index+=1){const op=identity.operations[index];const bound=receipt.operation_receipts.find(x=>x.index===index);if(!bound||bound.kind!==op.kind||bound.receipt_class!==receiptClass(op))return {ok:false,reason:`native diff V2 receipt binding mismatch index ${index}`};const checked=await verifyOperationReceipt(op,bound.receipt_id);if(!checked.ok||checked.receipt_sha256!==bound.receipt_sha256||checked.request_sha256!==bound.request_sha256)return {ok:false,reason:`native diff V2 operation receipt invalid index ${index}`};verified+=1;if(bound.receipt_class==='coding')codingVerified+=1;}
-      let currentMatches=true;for(const op of identity.operations)if(!(await terminalStateMatches(identity.root_id,op)))currentMatches=false;
-      return {ok:true,diff_id:diffId,receipt_sha256:claimed,signature_valid:true,root_id:identity.root_id,operation_count:identity.operations.length,coding_receipts_verified:codingVerified,operation_receipts_verified:verified,final_states:receipt.final_states,current_state_matches:currentMatches,journal_head_sha256:completion.event_sha256};
+      return {ok:true,diff_id:diffId,receipt_sha256:claimed,signature_valid:true,root_id:identity.root_id,operation_count:identity.operations.length,coding_receipts_verified:codingVerified,operation_receipts_verified:verified,final_states:receipt.final_states,journal_head_sha256:completion.event_sha256};
     }catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
   }
 
-  return Object.freeze({preview,apply,verify,policy});
+  async function verify({diffId}){
+    const checked=await verifyEvidence({diffId});if(!checked.ok)return checked;
+    try{const {identity}=await loadDiff(diffId);let currentMatches=true;for(const op of identity.operations)if(!(await terminalStateMatches(identity.root_id,op)))currentMatches=false;return {...checked,current_state_matches:currentMatches};}
+    catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
+  }
+
+  return Object.freeze({preview,apply,verify,verifyEvidence,policy});
 }

package/src/native-diff.mjs

@@ -361,7 +361,7 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
       coding_receipts:receipt.coding_receipts.map(item => ({ index:item.index, path:item.path, receipt_id:item.receipt_id, receipt_sha256:item.receipt_sha256 })) };
   }
 
-  async function verify({ diffId }) {
+  async function verifyEvidence({ diffId }) {
     try {
       const { ctx, identity } = await loadDiff(diffId);
       const verifyKey = await loadPublicVerifyKey(verifyKeyPath);
@@ -390,21 +390,32 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
         }
         verifiedReceipts += 1;
       }
+      return { ok:true, diff_id:diffId, receipt_sha256:claimed, signature_valid:true,
+        root_id:identity.root_id, operation_count:identity.operations.length,
+        coding_receipts_verified:verifiedReceipts, final_states:receipt.final_states,
+        journal_head_sha256:completion.event_sha256 };
+    } catch (error) {
+      return { ok:false, reason:String(error).slice(0,2048) };
+    }
+  }
+
+  async function verify({ diffId }) {
+    const checked = await verifyEvidence({ diffId });
+    if (!checked.ok) return checked;
+    try {
+      const { identity } = await loadDiff(diffId);
       let currentMatches = true;
       for (const op of identity.operations) {
         const current = await codingRuntime.fileState({ rootId:identity.root_id, relativePath:op.path });
         if (!stateMatches(current, op.after_sha256)) currentMatches = false;
       }
-      return { ok:true, diff_id:diffId, receipt_sha256:claimed, signature_valid:true,
-        root_id:identity.root_id, operation_count:identity.operations.length,
-        coding_receipts_verified:verifiedReceipts, final_states:receipt.final_states,
-        current_state_matches:currentMatches, journal_head_sha256:completion.event_sha256 };
+      return { ...checked, current_state_matches:currentMatches };
     } catch (error) {
       return { ok:false, reason:String(error).slice(0,2048) };
     }
   }
 
-  return Object.freeze({ preview, apply, verify, policy });
+  return Object.freeze({ preview, apply, verify, verifyEvidence, policy });
 }
 
 export { NATIVE_DIFF_V2_SCHEMA };
@@ -448,5 +459,16 @@ export function createNativeDiffRuntime(options) {
       return {ok:false,reason:String(error).slice(0,2048)};
     }
   }
-  return Object.freeze({preview,apply,verify,policy:options.policy});
+  async function verifyEvidence(args){
+    try {
+      const schema=await schemaFor(args?.diffId);
+      if(schema===NATIVE_DIFF_SCHEMA) return v1.verifyEvidence(args);
+      if(schema===NATIVE_DIFF_V2_SCHEMA){
+        if(!v2) return {ok:false,reason:'native diff V2 topology requires machine fs runtime'};
+        return v2.verifyEvidence(args);
+      }
+      return {ok:false,reason:`unsupported native diff schema: ${String(schema)}`};
+    }catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
+  }
+  return Object.freeze({preview,apply,verify,verifyEvidence,policy:options.policy});
 }

package/src/observation-mcp-tools.mjs

@@ -1,6 +1,6 @@
 import * as z from 'zod/v4';
 import {
-  observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
+  observationHardwareQueryOutputSchema,observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
   observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema
 } from './observation-output-contracts.mjs';
 
@@ -41,4 +41,8 @@ export function registerObservationTools(server,{runtime}){
     description:'Read bounded timestamped system status with signed observation evidence. This tool cannot mutate or arm any authority.',
     inputSchema:z.strictObject({}),outputSchema:observationSystemStatusOutputSchema
   },async()=>{try{return ok(observationSystemStatusOutputSchema,await runtime.systemStatus());}catch(error){return fail(observationSystemStatusOutputSchema,error);}});
+  server.registerTool('machine_hardware_query',{
+    description:'Read one typed native hardware snapshot (CPU, GPU, memory, storage, network, or PCI) with signed observation evidence. No shell or Host authority is used.',
+    inputSchema:z.strictObject({query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),outputSchema:observationHardwareQueryOutputSchema
+  },async args=>{try{return ok(observationHardwareQueryOutputSchema,await runtime.hardwareQuery({query:args.query}));}catch(error){return fail(observationHardwareQueryOutputSchema,error);}});
 }

package/src/observation-output-contracts.mjs

@@ -45,6 +45,14 @@ export const observationSystemStatusOutputSchema=statusContract({
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
 },['observed_at_utc','hostname','platform','architecture','uptime_seconds','total_memory_bytes','free_memory_bytes','cpu_count','load_average','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
+export const observationHardwareQueryOutputSchema=statusContract({
+  observed_at_utc:z.string().min(1).optional(),
+  query:z.enum(['cpu','gpu','memory','storage','network','pci']).optional(),
+  data:z.record(z.string(),z.json()).optional(),
+  observer_sha256:hex64.optional(),
+  ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
+},['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+
 export function observationStructuredResult(schema,value,isError=false){
   return structuredToolResult(schema,value,isError);
 }