deadbyte-mcp 0.15.0 → 0.15.2

package/src/process-output-contracts.mjs

@@ -1,4 +1,4 @@
-import * as z from 'zod/v4';
+import * as z from 'zod/v4';
 import { structuredToolResult } from './output-contracts.mjs';
 
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
@@ -51,6 +51,23 @@ export const processActionOutputSchema = z.strictObject({
   }
 });
 
+export const processWriteOutputSchema = z.strictObject({
+  status: z.enum(['ok','denied','failed']),
+  error: z.string().min(1).max(4096).optional(),
+  logical_bytes: z.number().int().positive().optional(),
+  logical_sha256: hex64.optional(),
+  append_newline: z.boolean().optional(),
+  session: processSessionRecordSchema.optional()
+}).superRefine((value, ctx) => {
+  if (value.status !== 'ok') {
+    if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' });
+    return;
+  }
+  for (const key of ['logical_bytes','logical_sha256','append_newline','session']) {
+    if (value[key] === undefined) ctx.addIssue({ code: 'custom', path: [key], message: `${key} required` });
+  }
+});
+
 export const processListOutputSchema = z.strictObject({
   status: z.enum(['ok','failed']),
   error: z.string().min(1).max(4096).optional(),
@@ -65,11 +82,11 @@ export const processReadOutputSchema = z.strictObject({
   session_id: hex64.optional(), offset: z.number().int().nonnegative().optional(),
   next_offset: z.number().int().nonnegative().optional(), earliest_offset: z.number().int().nonnegative().optional(),
   stream_head: z.number().int().nonnegative().optional(), stream_sha256: hex64.optional(),
-  truncated: z.boolean().optional(), data_base64: z.string().max(400000).optional(),
+  truncated: z.boolean().optional(), wait_satisfied: z.boolean().optional(), data_base64: z.string().max(400000).optional(),
   state: processState.optional(), exit_code: z.number().int().nullable().optional()
 }).superRefine((value, ctx) => {
   if (value.status !== 'ok') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
-  for (const key of ['session_id','offset','next_offset','earliest_offset','stream_head','stream_sha256','truncated','data_base64','state','exit_code']) {
+  for (const key of ['session_id','offset','next_offset','earliest_offset','stream_head','stream_sha256','truncated','wait_satisfied','data_base64','state','exit_code']) {
     if (value[key] === undefined) ctx.addIssue({ code: 'custom', path: [key], message: `${key} required` });
   }
 });

package/src/process-policy.mjs

@@ -63,6 +63,8 @@ function normalizePolicyObject(raw, policyPath) {
     if (envAllow.some(name => !/^[A-Za-z_][A-Za-z0-9_()]*$/.test(name))) throw new Error(`process profile '${id}' env_allow invalid`);
     const transport = value.transport ?? 'conpty';
     if (transport !== 'conpty' && transport !== 'pipe') throw new Error(`process profile '${id}' transport invalid`);
+    if (value.allow_raw_input !== undefined && typeof value.allow_raw_input !== 'boolean') throw new Error(`process profile '${id}' allow_raw_input invalid`);
+    const allowRawInput = value.allow_raw_input === true;
     const inputActions = {};
     if (value.input_actions !== undefined) {
       if (!value.input_actions || typeof value.input_actions !== 'object' || Array.isArray(value.input_actions)) throw new Error(`process profile '${id}' input_actions invalid`);
@@ -80,7 +82,7 @@ function normalizePolicyObject(raw, policyPath) {
       max_sessions: finiteInteger(value.max_sessions, `profiles.${id}.max_sessions`, 1, 32, 4),
       max_input_bytes: finiteInteger(value.max_input_bytes, `profiles.${id}.max_input_bytes`, 1, 1024 * 1024, 64 * 1024),
       max_retained_output_bytes: finiteInteger(value.max_retained_output_bytes, `profiles.${id}.max_retained_output_bytes`, 4096, 16 * 1024 * 1024, 1024 * 1024),
-      transport, env_allow: [...new Set(envAllow)], input_actions: inputActions
+      transport, allow_raw_input: allowRawInput, env_allow: [...new Set(envAllow)], input_actions: inputActions
     };
   }
   if (Object.keys(profiles).length === 0) throw new Error('process policy requires at least one profile');

package/src/process-runtime.mjs

@@ -60,6 +60,36 @@ function publicSession(session) {
     journal_head_sha256: session.journal_head_sha256
   };
 }
+function retainedSlice(session, begin = 0, length = session.retained_output_bytes - begin) {
+  if (!Number.isInteger(begin) || begin < 0 || !Number.isInteger(length) || length < 0) throw new Error('invalid retained output slice');
+  if (begin >= session.retained_output_bytes || length === 0) return Buffer.alloc(0);
+  const end = Math.min(session.retained_output_bytes, begin + length);
+  const parts = [];
+  let cursor = 0;
+  for (const chunk of session.output_chunks) {
+    const next = cursor + chunk.length;
+    if (next <= begin) { cursor = next; continue; }
+    if (cursor >= end) break;
+    const from = Math.max(0, begin - cursor);
+    const to = Math.min(chunk.length, end - cursor);
+    if (to > from) parts.push(chunk.subarray(from, to));
+    cursor = next;
+  }
+  if (parts.length === 0) return Buffer.alloc(0);
+  if (parts.length === 1) return Buffer.from(parts[0]);
+  return Buffer.concat(parts, end - begin);
+}
+function retainedAll(session) {
+  return retainedSlice(session, 0, session.retained_output_bytes);
+}
+function retainedTail(session, maxBytes) {
+  const length = Math.min(maxBytes, session.retained_output_bytes);
+  return retainedSlice(session, session.retained_output_bytes - length, length);
+}
+function retainedIndexOf(session, needle, begin = 0) {
+  if (!Buffer.isBuffer(needle) || needle.length < 1) return -1;
+  return retainedSlice(session, begin, session.retained_output_bytes - begin).indexOf(needle);
+}
 function appendOutput(session, chunk) {
   if (!chunk?.length) return;
   const bytes = Buffer.from(chunk);
@@ -67,13 +97,22 @@ function appendOutput(session, chunk) {
     Buffer.from(session.stream_sha256, 'hex'), bytes
   ]));
   session.stream_head += bytes.length;
-  session.output = Buffer.concat([session.output, bytes]);
-  if (session.output.length > session.max_retained_output_bytes) {
-    const drop = session.output.length - session.max_retained_output_bytes;
-    session.output = session.output.subarray(drop);
-    session.earliest_offset += drop;
+  session.output_chunks.push(bytes);
+  session.retained_output_bytes += bytes.length;
+  while (session.retained_output_bytes > session.max_retained_output_bytes && session.output_chunks.length > 0) {
+    const excess = session.retained_output_bytes - session.max_retained_output_bytes;
+    const first = session.output_chunks[0];
+    if (first.length <= excess) {
+      session.output_chunks.shift();
+      session.retained_output_bytes -= first.length;
+      session.earliest_offset += first.length;
+      continue;
+    }
+    session.output_chunks[0] = first.subarray(excess);
+    session.retained_output_bytes -= excess;
+    session.earliest_offset += excess;
   }
-  const tail = session.output.subarray(Math.max(0, session.output.length - 4096)).toString('latin1');
+  const tail = retainedTail(session, 4096).toString('latin1');
   const enabledAt = tail.lastIndexOf('\x1b[?9001h');
   const disabledAt = tail.lastIndexOf('\x1b[?9001l');
   if (enabledAt >= 0 || disabledAt >= 0) session.win32_input_mode = enabledAt > disabledAt;
@@ -166,7 +205,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
           child_pid:started.detail.child_pid, creation_filetime:String(started.detail.creation_filetime),
           state:terminal.type, exit_code:Number.isInteger(terminal.detail.exit_code) ? terminal.detail.exit_code : null,
           earliest_offset:terminal.detail.earliest_offset, stream_head:terminal.detail.stream_head,
-          stream_sha256:terminal.detail.stream_sha256, output, control_buffer:Buffer.alloc(0),
+          stream_sha256:terminal.detail.stream_sha256, output_chunks:[output], retained_output_bytes:output.length, control_buffer:Buffer.alloc(0),
           journal_head_sha256:checked.head_sha256, journal_path:path.join(policy.state_dir,name), event_count:checked.event_count,
           max_retained_output_bytes:profile.max_retained_output_bytes, stderr:'', terminate_requested:terminal.type==='terminated',
           protocol_error:null, transport:profile.transport, win32_input_mode:false, host:null, close_promise:Promise.resolve(),
@@ -262,7 +301,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     const session = {
       session_id: sessionId, job_id: randomBytes(32).toString('hex'), profile_id: profileId, root_id: rootId,
       cwd_relative: cwdInfo.relative, child_pid: null, creation_filetime: null, state: 'starting', exit_code: null,
-      earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output: Buffer.alloc(0), control_buffer: Buffer.alloc(0),
+      earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output_chunks: [], retained_output_bytes: 0, control_buffer: Buffer.alloc(0),
       journal_head_sha256: ZERO_SHA256, journal_path: path.join(policy.state_dir, `${sessionId}.jsonl`), event_count: 0,
       max_retained_output_bytes: profile.max_retained_output_bytes, stderr: '', terminate_requested: false, protocol_error: null,
       transport: profile.transport,
@@ -286,15 +325,16 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
         const terminalState = session.terminate_requested ? 'terminated' : 'exited';
         try {
           const outputFile = `${session.session_id}.stream.bin`;
-          const retainedOutputSha256 = sha256Bytes(session.output);
-          await writeFile(path.join(policy.state_dir, outputFile), session.output, { flag:'wx' });
+          const retainedOutput = retainedAll(session);
+          const retainedOutputSha256 = sha256Bytes(retainedOutput);
+          await writeFile(path.join(policy.state_dir, outputFile), retainedOutput, { flag:'wx' });
           await appendEvent(runtime, session, terminalState, {
             recovery_schema:TERMINAL_RECOVERY_SCHEMA,
             exit_code:session.exit_code,
             earliest_offset:session.earliest_offset,
             stream_head:session.stream_head,
             stream_sha256:session.stream_sha256,
-            retained_output_bytes:session.output.length,
+            retained_output_bytes:session.retained_output_bytes,
             retained_output_sha256:retainedOutputSha256,
             output_file:outputFile
           });
@@ -311,17 +351,57 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return publicSession(session);
   }
 
-  async function read({ sessionId, offset = 0, maxBytes = 65536 }) {
+  async function read({ sessionId, offset = 0, maxBytes = 65536, waitMs = 0, waitFor = null }) {
     const session = await sessionFor(sessionId);
-    if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 262144) throw new Error('invalid process read bounds');
-    if (offset > session.stream_head) throw new Error('process read offset is beyond stream head');
-    const truncated = offset < session.earliest_offset;
-    const effective = Math.max(offset, session.earliest_offset);
+    if (!Number.isInteger(offset) || offset < -(16 * 1024 * 1024) || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 262144 ||
+        !Number.isInteger(waitMs) || waitMs < 0 || waitMs > 30000) throw new Error('invalid process read bounds');
+    if (waitFor !== null && (typeof waitFor !== 'string' || waitFor.length < 1 || waitFor.includes('\0') || Buffer.byteLength(waitFor, 'utf8') > 256)) {
+      throw new Error('invalid process wait_for literal');
+    }
+    const requested = offset < 0 ? Math.max(0, session.stream_head + offset) : offset;
+    if (requested > session.stream_head) throw new Error('process read offset is beyond stream head');
+    const baseline = session.stream_head;
+    const literal = waitFor === null ? null : Buffer.from(waitFor, 'utf8');
+    const satisfied = () => {
+      if (literal === null) return session.stream_head > baseline || session.state !== 'running';
+      const effectiveSearch = Math.max(requested, session.earliest_offset);
+      const begin = effectiveSearch - session.earliest_offset;
+      return retainedIndexOf(session, literal, begin) >= 0;
+    };
+    if (waitMs > 0 && session.state === 'running' && !satisfied()) {
+      const deadline = Date.now() + waitMs;
+      while (session.state === 'running' && !satisfied() && Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, Math.min(25, Math.max(1, deadline - Date.now()))));
+      }
+    }
+    const effectiveRequested = offset < 0 ? Math.max(0, session.stream_head + offset) : requested;
+    const truncated = effectiveRequested < session.earliest_offset;
+    const effective = Math.max(effectiveRequested, session.earliest_offset);
     const begin = effective - session.earliest_offset;
-    const data = session.output.subarray(begin, begin + maxBytes);
+    const data = retainedSlice(session, begin, maxBytes);
     return { session_id: session.session_id, offset: effective, next_offset: effective + data.length,
       earliest_offset: session.earliest_offset, stream_head: session.stream_head, stream_sha256: session.stream_sha256,
-      truncated, data_base64: data.toString('base64'), state: session.state, exit_code: session.exit_code };
+      truncated, wait_satisfied: waitFor === null ? (session.stream_head > baseline || waitMs === 0 || session.state !== 'running') : satisfied(),
+      data_base64: data.toString('base64'), state: session.state, exit_code: session.exit_code };
+  }
+
+  async function write({ sessionId, input, appendNewline = true }) {
+    const session = await sessionFor(sessionId);
+    if (session.state !== 'running') throw new Error('process write requires a running session');
+    const grant = await assertProcessArmed(policy, session.profile_id, session.root_id);
+    const profile = policy.profiles[session.profile_id];
+    if (!profile?.allow_raw_input) throw new Error(`process profile '${session.profile_id}' does not allow raw input`);
+    if (session.transport !== 'pipe' || profile.transport !== 'pipe') throw new Error('process raw input requires pipe transport');
+    if (typeof input !== 'string' || input.includes('\0')) throw new Error('process raw input must be a NUL-free string');
+    if (typeof appendNewline !== 'boolean') throw new Error('process appendNewline must be boolean');
+    const logicalBytes = Buffer.from(appendNewline ? `${input}\r\n` : input, 'utf8');
+    if (logicalBytes.length < 1 || logicalBytes.length > profile.max_input_bytes) throw new Error('process raw input exceeds profile input bound');
+    if (!session.host?.stdin || session.host.stdin.destroyed || !session.host.stdin.writable) throw new Error('process session input is not writable');
+    await recheckProcessAuthority(policy, grant, session.profile_id, session.root_id);
+    await new Promise((resolve, reject) => session.host.stdin.write(logicalBytes, error => error ? reject(error) : resolve()));
+    const logicalSha256 = sha256Bytes(logicalBytes);
+    await appendEvent(runtime, session, 'input', { logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, append_newline: appendNewline });
+    return { logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, append_newline: appendNewline, session: publicSession(session) };
   }
 
   async function status({ sessionId }) { return publicSession(await sessionFor(sessionId)); }
@@ -383,5 +463,5 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return { ok: true, event_count: sequence, head_sha256: previous };
   }
 
-  return { policy, start, read, status, list, action, terminate, verifyEventJournal };
+  return { policy, start, read, write, status, list, action, terminate, verifyEventJournal };
 }

package/src/process-smoke-client.mjs

@@ -29,7 +29,7 @@ const policy = await loadProcessPolicy(smokePolicyPath);
 const keys = await generateTrustKeypair({ privateKeyPath: path.join(smokeTrust, 'private.pem'), publicKeyPath: path.join(smokeTrust, 'public.pem') });
 await mkdir(path.dirname(policy.grant_file), { recursive: true });
 const grant = { schema: PROCESS_GRANT_SCHEMA, policy_sha256: policy.policy_sha256,
-  instance_nonce: randomBytes(32).toString('hex'), profile_ids: ['ping_hold'], root_ids: ['core'],
+  instance_nonce: randomBytes(32).toString('hex'), profile_ids: ['ping_hold','powershell_repl'], root_ids: ['core'],
   granted_at_utc: new Date().toISOString() };
 await writeFile(policy.grant_file, `${JSON.stringify(grant, null, 2)}\n`, { flag: 'wx' });
 
@@ -37,8 +37,10 @@ const client = new Client({ name: 'deadbyte-process-smoke', version: '0.8.0' },
   { versionNegotiation: { mode: { pin: '2026-07-28' } } });
 const transport = new StdioClientTransport({
   command: process.execPath, args: [serverPath], cwd: repoRoot,
-  env: { ...getDefaultEnvironment(), DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: smokePolicyPath,
-    DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath },
+  env: { ...getDefaultEnvironment(), DEADBYTE_PRIVILEGED_POLICY: '', DEADBYTE_MACHINE_RUNTIME:'0', DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: smokePolicyPath, DEADBYTE_CODING_RUNTIME:'0', DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0', DEADBYTE_DESKTOP_RUNTIME:'0', DEADBYTE_AUTONOMOUS_RUNTIME:'0', DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_CAPABILITY_PROFILE:'full', DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath },
   stderr: 'pipe'
 });
 const stderrChunks = [];
@@ -51,12 +53,13 @@ const structured = (result, label) => {
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 let sessionId = null;
 let journalPath = null;
+let replJournalPath = null;
 try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
   const expected = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open',
-    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'].sort();
+    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'].sort();
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`process smoke catalog mismatch: ${JSON.stringify(names)}`);
   const started = structured(await client.callTool({ name: 'process_session_start', arguments: {
     profile_id: 'ping_hold', root_id: 'core', cwd: '.', args: []
@@ -93,31 +96,72 @@ try {
   const terminated = structured(await client.callTool({ name: 'process_session_terminate', arguments: { session_id: sessionId } }), 'process_session_terminate');
   if (terminated.status !== 'ok' || terminated.session.state !== 'terminated') throw new Error(`process terminate failed: ${JSON.stringify(terminated)}`);
   const finalHead = terminated.session.journal_head_sha256;
+
+  const replStarted = structured(await client.callTool({ name: 'process_session_start', arguments: {
+    profile_id: 'powershell_repl', root_id: 'core', cwd: '.', args: []
+  } }), 'process_session_start powershell_repl');
+  const replSessionId = replStarted.session?.session_id;
+  if (replStarted.status !== 'ok' || !/^[0-9a-f]{64}$/.test(replSessionId ?? '')) throw new Error('powershell repl start malformed');
+  replJournalPath = path.join(policy.state_dir, `${replSessionId}.jsonl`);
+  const firstWrite = structured(await client.callTool({ name: 'process_session_write', arguments: {
+    session_id: replSessionId, input: "$x=41;[Console]::WriteLine('DB_PUBLIC_REPL_SET')", append_newline: true
+  } }), 'process_session_write set');
+  if (firstWrite.status !== 'ok' || firstWrite.session?.state !== 'running') throw new Error('powershell repl first write failed');
+  const beforeSecond = firstWrite.session.stream_head;
+  const secondWrite = structured(await client.callTool({ name: 'process_session_write', arguments: {
+    session_id: replSessionId, input: "[Console]::WriteLine('DB_PUBLIC_REPL_VALUE=' + ($x+1))", append_newline: true
+  } }), 'process_session_write value');
+  if (secondWrite.status !== 'ok') throw new Error('powershell repl second write failed');
+  const replRead = structured(await client.callTool({ name: 'process_session_read', arguments: {
+    session_id: replSessionId, offset: beforeSecond, max_bytes: 65536, wait_ms: 5000, wait_for: 'DB_PUBLIC_REPL_VALUE=42'
+  } }), 'process_session_read repl');
+  const replText = Buffer.from(replRead.data_base64 ?? '', 'base64').toString('utf8');
+  if (replRead.status !== 'ok' || replRead.wait_satisfied !== true || !replText.includes('DB_PUBLIC_REPL_VALUE=42')) {
+    throw new Error(`powershell repl state persistence proof failed: ${JSON.stringify(replRead)}`);
+  }
+  const replTail = structured(await client.callTool({ name: 'process_session_read', arguments: {
+    session_id: replSessionId, offset: -4096, max_bytes: 4096, wait_ms: 0, wait_for: null
+  } }), 'process_session_read tail');
+  if (!Buffer.from(replTail.data_base64 ?? '', 'base64').toString('utf8').includes('DB_PUBLIC_REPL_VALUE=42')) {
+    throw new Error('powershell repl tail read proof failed');
+  }
+  const replTerminated = structured(await client.callTool({ name: 'process_session_terminate', arguments: { session_id: replSessionId } }), 'process_session_terminate repl');
+  if (replTerminated.status !== 'ok' || replTerminated.session.state !== 'terminated') throw new Error('powershell repl terminate failed');
+  const replJournalText = await readFile(replJournalPath, 'utf8');
+  if (/DB_PUBLIC_REPL_SET|DB_PUBLIC_REPL_VALUE|\$x=41/.test(replJournalText)) throw new Error('powershell repl journal leaked raw input payload');
+  const replFinalHead = replTerminated.session.journal_head_sha256;
   await client.close();
 
   const verifyKey = await loadPublicVerifyKey(keys.publicKeyPath);
-  const records = (await readFile(journalPath, 'utf8')).split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
-  let previous = ZERO_SHA256;
-  let sequence = 0;
-  for (const record of records) {
-    const { event_sha256: eventSha, key_id: keyId, signature, ...unsigned } = record;
-    if (unsigned.session_id !== sessionId || unsigned.sequence !== sequence + 1 || unsigned.previous_event_sha256 !== previous || unsigned.policy_sha256 !== policy.policy_sha256) {
-      throw new Error('process journal chain mismatch');
+  const verifyJournal = async (targetSessionId, targetJournalPath, expectedHead, minimumEvents) => {
+    const records = (await readFile(targetJournalPath, 'utf8')).split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    let previous = ZERO_SHA256;
+    let sequence = 0;
+    for (const record of records) {
+      const { event_sha256: eventSha, key_id: keyId, signature, ...unsigned } = record;
+      if (unsigned.session_id !== targetSessionId || unsigned.sequence !== sequence + 1 || unsigned.previous_event_sha256 !== previous || unsigned.policy_sha256 !== policy.policy_sha256) {
+        throw new Error('process journal chain mismatch');
+      }
+      const canonical = Buffer.from(canonicalJson(unsigned), 'utf8');
+      const observed = sha256(canonical);
+      if (eventSha !== observed || keyId !== verifyKey.keyId || !cryptoVerify(null, Buffer.concat([EVENT_DOMAIN, canonical]), verifyKey.publicKey, Buffer.from(signature, 'base64'))) {
+        throw new Error('process journal signature mismatch');
+      }
+      previous = observed;
+      sequence += 1;
     }
-    const canonical = Buffer.from(canonicalJson(unsigned), 'utf8');
-    const observed = sha256(canonical);
-    if (eventSha !== observed || keyId !== verifyKey.keyId || !cryptoVerify(null, Buffer.concat([EVENT_DOMAIN, canonical]), verifyKey.publicKey, Buffer.from(signature, 'base64'))) {
-      throw new Error('process journal signature mismatch');
-    }
-    previous = observed;
-    sequence += 1;
-  }
-  if (sequence < 3 || previous !== finalHead) throw new Error('process journal head mismatch');
+    if (sequence < minimumEvents || previous !== expectedHead) throw new Error('process journal head mismatch');
+    return { sequence, head: previous };
+  };
+  const pingVerified = await verifyJournal(sessionId, journalPath, finalHead, 3);
+  const replVerified = await verifyJournal(replSessionId, replJournalPath, replFinalHead, 4);
   if ((await readFile(journalPath, 'utf8')).includes('DEADBYTE_ACTION_PING')) throw new Error('process journal leaked action payload');
-  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 12,
+  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 13,
     profile_id: 'ping_hold', session_id: sessionId, observed_output_bytes: read.stream_head,
     action_id: action.action_id, logical_bytes: action.logical_bytes, logical_sha256: action.logical_sha256,
-    final_state: terminated.session.state, event_count: sequence, journal_head_sha256: previous,
+    final_state: terminated.session.state, event_count: pingVerified.sequence, journal_head_sha256: pingVerified.head,
+    persistent_repl: { profile_id:'powershell_repl', session_id:replSessionId, state_persisted:true, wait_for:true, tail_read:true,
+      raw_input_not_journaled:true, event_count:replVerified.sequence, journal_head_sha256:replVerified.head },
     policy_sha256: policy.policy_sha256, key_id: verifyKey.keyId, signature_valid: true }, null, 2));
 } catch (error) {
   const stderr = Buffer.concat(stderrChunks).toString('utf8').trim();
@@ -128,5 +172,6 @@ try {
   await client.close().catch(() => {});
   await rm(policy.grant_file, { force: true }).catch(() => {});
   if (journalPath) await rm(journalPath, { force: true }).catch(() => {});
+  if (replJournalPath) await rm(replJournalPath, { force: true }).catch(() => {});
   await rm(smokeTrust, { recursive: true, force: true }).catch(() => {});
 }

package/src/r45-compact-disarmed-probe.mjs

@@ -0,0 +1,74 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { R45_COMPACT_GATEWAYS,R45_COMPACT_TOOL_LIMIT } from './remote-mcp-r45-parity-client.mjs';
+import { loadDesktopPolicy } from './desktop-policy-r40.mjs';
+import { verifyDesktopReceiptObject } from './desktop-runtime-r40.mjs';
+import { loadPublicVerifyKey } from './trust.mjs';
+
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const verifyKeyPath=path.join(stateRoot,'trust','ed25519-public.pem');
+function structured(result,label){
+  if(result.isError) throw new Error(label+' returned error: '+JSON.stringify(result.structuredContent??result.content));
+  if(!result.structuredContent||typeof result.structuredContent!=='object') throw new Error(label+' missing structured output');
+  return result.structuredContent;
+}
+function gateway(result,label){
+  const value=structured(result,label);
+  if(value.status!=='ok'||!value.result||typeof value.result!=='object') throw new Error(label+' gateway status='+String(value.status));
+  return value.result;
+}
+async function verifyDesktop(policy,verifyKey,id,sha,kind){
+  const receipt=JSON.parse(await readFile(path.join(policy.evidence_dir,id+'.json'),'utf8'));
+  const proof=verifyDesktopReceiptObject(receipt,{policySha256:policy.policy_sha256,publicKey:verifyKey.publicKey,keyId:verifyKey.keyId});
+  if(!proof.ok||proof.receipt_sha256!==sha||proof.kind!==kind) throw new Error('R45 desktop '+kind+' receipt verification failed');
+}
+export async function probeR45CompactDisarmed(endpointText){
+  const endpoint=new URL(endpointText);if(endpoint.protocol!=='https:')throw new Error('R45 compact disarmed probe requires HTTPS');
+  const pointer=JSON.parse(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+  const desktopPolicy=await loadDesktopPolicy(path.join(pointer.generation_root,'desktop-policy.json'));
+  const verifyKey=await loadPublicVerifyKey(verifyKeyPath);
+  const client=new Client({name:'deadbyte-r45-compact-disarmed-probe',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StreamableHTTPClientTransport(endpoint);
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools(),names=listed.tools.map(t=>t.name).sort();
+    if(names.length!==R45_COMPACT_TOOL_LIMIT)throw new Error('R45 compact disarmed catalog must be exactly '+R45_COMPACT_TOOL_LIMIT+', got '+names.length);
+    for(const name of R45_COMPACT_GATEWAYS)if(!names.includes(name))throw new Error('R45 compact gateway missing '+name);
+    for(const tool of listed.tools)if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties)throw new Error('tool '+tool.name+' missing strict output schema');
+    const manifest=gateway(await client.callTool({name:'capability_manifest',arguments:{}}),'capability_manifest');
+    if(manifest.schema!=='deadbyte.capability-manifest.v2'||manifest.profile!=='compact'||manifest.tool_count!==names.length||
+       JSON.stringify(manifest.tool_catalog)!==JSON.stringify(names))throw new Error('R45 compact manifest malformed');
+    const required=manifest.capabilities.filter(x=>x?.production===true&&x?.host_only!==true);
+    for(const item of required)if(typeof item.compact_tool!=='string'||!names.includes(item.compact_tool))throw new Error('compact route missing '+String(item.id));
+    const skillCatalog=structured(await client.callTool({name:'skill_catalog',arguments:{op:'list'}}),'skill_catalog');
+    if(skillCatalog.status!=='ok'||skillCatalog.op!=='list'||!skillCatalog.result||!Array.isArray(skillCatalog.result.skills)||
+       !/^[0-9a-f]{64}$/.test(String(skillCatalog.result.registry_sha256??'')))throw new Error('R45 skill catalog verification failed');
+    const coding=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding status');
+    const autonomous=structured(await client.callTool({name:'autonomous_session_status',arguments:{}}),'autonomous status');
+    const desktop=gateway(await client.callTool({name:'desktop_control',arguments:{op:'status'}}),'desktop status');
+    if(coding.armed!==false||autonomous.coding_armed!==false||autonomous.autonomous_armed!==false||desktop.armed!==false)throw new Error('R45 closure requires Coding/Autonomous/Desktop DISARMED');
+    const observed=gateway(await client.callTool({name:'desktop_control',arguments:{op:'observe',preview:false}}),'desktop observe');
+    await verifyDesktop(desktopPolicy,verifyKey,observed.receipt_id,observed.receipt_sha256,'desktop_observation');
+    const grounded=gateway(await client.callTool({name:'desktop_control',arguments:{op:'target',frame_id:observed.frame.frame_id,uia_query:{kind:'root',value:'',max_results:1,ordinal:0}}}),'desktop target');
+    await verifyDesktop(desktopPolicy,verifyKey,grounded.grounding.receipt_id,grounded.grounding.receipt_sha256,'desktop_grounding');
+    const machine=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_status'}}),'machine status');
+    const nonce='r45-final-'+randomBytes(16).toString('hex');
+    const ping=gateway(await client.callTool({name:'machine_observe',arguments:{op:'machine_ping',nonce}}),'machine ping');
+    if(ping.nonce!==nonce||ping.release_id!==machine.release_id||ping.release_manifest_sha256!==machine.release_manifest_sha256)throw new Error('R45 machine ping binding mismatch');
+    return {status:'passed',profile:'compact',tool_count:names.length,tools:names,catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),
+      strict_output_schemas:true,ledger_sha256:manifest.ledger_sha256,skill_catalog_verified:true,skill_count:skillCatalog.result.skills.length,capability_count:manifest.capabilities.length,
+      production_non_host_capabilities:required.length,capability_closure:true,coding_armed:false,autonomous_armed:false,desktop_armed:false,
+      desktop_observation_receipt_verified:true,desktop_grounding_receipt_verified:true,
+      desktop_frame_id:observed.frame.frame_id,desktop_target_id:grounded.target.target_id,
+      release_id:machine.release_id,release_manifest_sha256:machine.release_manifest_sha256,machine_status:machine,machine_ping:ping,nonce,
+      protocol_revision:client.getNegotiatedProtocolVersion()};
+  }finally{await client.close().catch(()=>{});}
+}
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url);
+if(invoked){const endpoint=process.argv[2];if(!endpoint)throw new Error('usage: node src/r45-compact-disarmed-probe.mjs https://host/mcp/path');
+probeR45CompactDisarmed(endpoint).then(v=>console.log(JSON.stringify(v,null,2))).catch(e=>{console.error(e instanceof Error?e.stack:String(e));process.exitCode=1;});}

package/src/r45-full-surface-probe.mjs

@@ -0,0 +1,34 @@
+import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport,getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { fileURLToPath } from 'node:url';
+import { R45_EXPECTED_TOOLS } from './remote-mcp-r45-parity-client.mjs';
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+export async function probeR45FullSurface({packageRoot,generationRoot,stateRoot=path.join(os.homedir(),'.deadbyte-mcp')}={}){
+  const pkgRoot=packageRoot?path.resolve(packageRoot):path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+  const gen=path.resolve(generationRoot),semanticPath=path.join(gen,'semantic-lsp-config.json');
+  const semanticSha=sha256(await readFile(semanticPath));
+  const env={...getDefaultEnvironment(),DEADBYTE_STATE_ROOT:path.resolve(stateRoot),DEADBYTE_CORE_ROOT:pkgRoot,
+    DEADBYTE_WORKSPACE_ROOT:path.join(pkgRoot,'workspaces'),DEADBYTE_CAPABILITY_PROFILE:'full',DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_AGENT_RUNTIME:'1',DEADBYTE_PROCESS_RUNTIME:'1',DEADBYTE_PROCESS_POLICY:path.join(gen,'process-policy.json'),
+    DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_MACHINE_FS_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',DEADBYTE_DESKTOP_POLICY:path.join(gen,'desktop-policy.json'),
+    DEADBYTE_CODING_POLICY:path.join(gen,'coding-policy.json'),DEADBYTE_SEMANTIC_LSP_CONFIG:semanticPath,DEADBYTE_SEMANTIC_LSP_CONFIG_SHA256:semanticSha,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',DEADBYTE_AUTONOMOUS_POLICY:path.join(gen,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external',DEADBYTE_PRIVILEGED_POLICY:path.join(gen,'host-policy.json')};
+  const client=new Client({name:'deadbyte-r45-full-surface-probe',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const transport=new StdioClientTransport({command:process.execPath,args:[path.join(pkgRoot,'src','mcp-server.mjs')],cwd:pkgRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);const listed=await client.listTools(),names=listed.tools.map(t=>t.name).sort();
+    if(JSON.stringify(names)!==JSON.stringify(R45_EXPECTED_TOOLS))throw new Error('R45 full catalog mismatch count='+names.length);
+    for(const tool of listed.tools)if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false||!tool.outputSchema?.properties)throw new Error('R45 full tool '+tool.name+' missing strict output schema');
+    return {status:'passed',profile:'full',tool_count:names.length,tools:names,catalog_sha256:sha256(Buffer.from(JSON.stringify(names),'utf8')),
+      strict_output_schemas:true,desktop_tools:['desktop_status','desktop_observe','desktop_target','desktop_action'],protocol_revision:client.getNegotiatedProtocolVersion()};
+  }finally{await client.close().catch(()=>{});}
+}
+if(process.argv[1]&&path.resolve(process.argv[1])===fileURLToPath(import.meta.url)){const [packageRoot,generationRoot]=process.argv.slice(2);
+if(!packageRoot||!generationRoot)throw new Error('usage: node src/r45-full-surface-probe.mjs <package-root> <generation-root>');
+probeR45FullSurface({packageRoot,generationRoot}).then(v=>console.log(JSON.stringify(v,null,2))).catch(e=>{console.error(e instanceof Error?e.stack:String(e));process.exitCode=1;});}

package/src/release-generation.mjs

@@ -84,6 +84,7 @@ async function rebindAutonomousPolicy(raw,{stateRoot,codingPolicy,codingPolicyBy
     if(id==='windows-release'){
       if(profile.kind!=='command'||rootId!=='core'||profile.command_id!=='powershell_script') throw new Error('windows release profile shape invalid');
       profile.script_path=await currentWindowsGateScript(rootPath);
+      profile.timeout_ms=600000;
       profile.description='Full Windows target release gate; runs only when finish is requested.';
     }
     const rel=safeRel(String(profile.script_path).replaceAll('\\','/'));
@@ -104,7 +105,7 @@ function rebindHostPolicy(raw,{developmentRoot,stateRoot}){
   return policy;
 }
 
-async function rebindProcessPolicy(raw,{developmentRoot,stateRoot,releaseRoot}){
+async function rebindProcessPolicy(raw,{developmentRoot,stateRoot,releaseRoot,systemRoot}){
   if(!raw) return null;
   const policy=clone(raw);
   policy.grant_file=path.join(stateRoot,'runtime','process-grant.json');
@@ -115,6 +116,25 @@ async function rebindProcessPolicy(raw,{developmentRoot,stateRoot,releaseRoot}){
   const nativeHostStat=await lstat(nativeHostPath);
   if(!nativeHostStat.isFile()||nativeHostStat.isSymbolicLink()) throw new Error('process native host invalid in release slot');
   policy.native_host={path:nativeHostPath,sha256:sha256(await readFile(nativeHostPath))};
+
+  const systemProfiles=[
+    ['ping_hold',['System32','cmd.exe']],
+    ['powershell',['System32','WindowsPowerShell','v1.0','powershell.exe']],
+    ['powershell_repl',['System32','WindowsPowerShell','v1.0','powershell.exe']]
+  ];
+  const needsSystemRoot=systemProfiles.some(([id])=>policy.profiles?.[id]);
+  if(needsSystemRoot&&(typeof systemRoot!=='string'||systemRoot.length<1)) {
+    throw new Error('process system profiles require SystemRoot/WINDIR');
+  }
+  for(const [id,parts] of systemProfiles){
+    const profile=policy.profiles?.[id];
+    if(!profile) continue;
+    const executable=path.join(path.resolve(systemRoot),...parts);
+    const stat=await lstat(executable);
+    if(!stat.isFile()||stat.isSymbolicLink()) throw new Error(`process profile '${id}' system executable invalid`);
+    profile.executable=executable;
+    profile.executable_sha256=sha256(await readFile(executable));
+  }
   return policy;
 }
 
@@ -198,7 +218,7 @@ function renderControllerConfig({currentConfig,coreRoot,workspaceRoot,processPol
     '}',''
   ].join('\r\n');
 }
-export async function createGenerationBundle({stateRoot,releaseRoot,developmentRoot,workspaceRoot,releaseId,currentConfig,processPolicy,desktopPolicy,codingPolicy,autonomousPolicy,hostPolicy}){
+export async function createGenerationBundle({stateRoot,releaseRoot,developmentRoot,workspaceRoot,releaseId,currentConfig,processPolicy,desktopPolicy,codingPolicy,autonomousPolicy,hostPolicy,systemRoot=process.env.SystemRoot??process.env.WINDIR??null}){
   const state=path.resolve(stateRoot),release=path.resolve(releaseRoot),development=path.resolve(developmentRoot),workspace=path.resolve(workspaceRoot);
   if(typeof releaseId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(releaseId)) throw new Error('generation release id invalid');
   if(typeof currentConfig?.Bridge?.FileSha256!=='string'||!HEX64.test(currentConfig.Bridge.FileSha256)) throw new Error('generation Bridge FileSha256 invalid');
@@ -254,7 +274,7 @@ export async function createGenerationBundle({stateRoot,releaseRoot,developmentR
   const autonomousBytes=jsonBytes(autonomous);
   const host=rebindHostPolicy(hostPolicy,{developmentRoot:development,stateRoot:state});
   const hostBytes=host?jsonBytes(host):null;
-  const processBound=await rebindProcessPolicy(processPolicy,{developmentRoot:development,stateRoot:state,releaseRoot:release});
+  const processBound=await rebindProcessPolicy(processPolicy,{developmentRoot:development,stateRoot:state,releaseRoot:release,systemRoot});
   const processBytes=processBound?jsonBytes(processBound):null;
   const desktopBound=await rebindDesktopPolicy(desktopPolicy,{stateRoot:state,releaseRoot:release});
   const desktopBytes=desktopBound?jsonBytes(desktopBound):null;