deadbyte-mcp 0.15.0 → 0.15.2

package/test/compact-gateway-r36.test.mjs

@@ -24,6 +24,8 @@ test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
   assert.equal(codingInspectInputSchema.safeParse({op:'call',tool_name:'host_exec',args:{}}).success,false);
   assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'write',session_id:'0'.repeat(64),input:'raw',append_newline:true}).success,true);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'write',session_id:'0'.repeat(64),input:'raw',pid:1234}).success,false);
   assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
   assert.equal(desktopControlInputSchema.safeParse({op:'call',tool_name:'host_exec'}).success,false);
 });
@@ -36,6 +38,7 @@ test('R36 compact schemas preserve representative preconditions',()=>{
     op:'move',root_id:'core',source_path:'a.txt',destination_path:'b.txt'
   }).success,false);
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
+  assert.equal(processSessionGatewayInputSchema.safeParse({op:'read',session_id:'b'.repeat(64),offset:-4096,max_bytes:4096,wait_ms:5000,wait_for:'READY>'}).success,true);
 });
 
 test('R40 registers exactly six compact gateway names including desktop_control',()=>{
@@ -116,3 +119,28 @@ test('R40 desktop_control is stable when runtime is absent and routes typed read
   assert.equal(unavailable.isError,true);
   assert.equal(unavailable.structuredContent.status,'unavailable');
 });
+
+
+test('R46 compact process_session routes guarded write and wait/tail read without adding a tool name',async()=>{
+  const calls=[];
+  const processRuntime={
+    write:async args=>{calls.push(['write',args]);return {logical_bytes:4,logical_sha256:'d'.repeat(64),append_newline:true,session:{session_id:'a'.repeat(64)}};},
+    read:async args=>{calls.push(['read',args]);return {session_id:'a'.repeat(64),offset:0,next_offset:0,earliest_offset:0,stream_head:0,stream_sha256:'b'.repeat(64),truncated:false,wait_satisfied:true,data_base64:'',state:'running',exit_code:null};}
+  };
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
+  });
+  const tool=server.tools.get('process_session');
+  const wrote=await tool.handler({op:'write',session_id:'a'.repeat(64),input:'x=1',append_newline:true});
+  assert.equal(wrote.isError,false);
+  const read=await tool.handler({op:'read',session_id:'a'.repeat(64),offset:-1024,max_bytes:4096,wait_ms:250,wait_for:'done'});
+  assert.equal(read.isError,false);
+  assert.deepEqual(calls,[
+    ['write',{sessionId:'a'.repeat(64),input:'x=1',appendNewline:true}],
+    ['read',{sessionId:'a'.repeat(64),offset:-1024,maxBytes:4096,waitMs:250,waitFor:'done'}]
+  ]);
+  assert.equal(server.tools.size,6);
+});

package/test/compact-max-catalog-r45.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R45 real max-runtime compact stdio catalog is exactly 43 with verified skill_catalog while all authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-max-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.equal(names.length,43,'expected exact compact max catalog 43, got '+names.length+': '+names.join(','));
+    for(const name of ['capability_manifest','desktop_control','coding_inspect','machine_fs','machine_observe','process_session',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    const m=manifest.structuredContent.result;
+    assert.equal(m.schema,'deadbyte.capability-manifest.v2');
+    assert.equal(m.profile,'compact');
+    assert.equal(m.tool_count,43);
+    assert.deepEqual(m.tool_catalog,names);
+    assert.match(m.catalog_sha256,/^[0-9a-f]{64}$/);
+    const hardware=m.capabilities.find(item=>item.id==='observation.hardware_query');
+    assert.ok(hardware);assert.equal(hardware.authority,'none');assert.equal(hardware.compact_tool,'machine_observe');assert.equal(hardware.compact_op,'hardware_query');
+    const skill=m.capabilities.find(item=>item.id==='skill.catalog');
+    assert.ok(skill);assert.equal(skill.authority,'none');assert.equal(skill.mutating,false);
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,hardware_query:true,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/contained.test.mjs

@@ -352,6 +352,10 @@ test('contained execution source has a compile-time worker registry and no user
   const executor = await readFile(fileURLToPath(new URL('../src/contained-executor.mjs', import.meta.url)), 'utf8');
   const registry = await readFile(fileURLToPath(new URL('../src/worker-registry.mjs', import.meta.url)), 'utf8');
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
   assert.match(registry, /contained-transform-worker\.exe/);
   assert.match(registry, /contained-reverse-worker\.exe/);
   assert.match(registry, /CONTAINED_EXECUTION_REGISTRY/);
@@ -360,9 +364,9 @@ test('contained execution source has a compile-time worker registry and no user
   assert.match(registry, /lowercase_ascii/);
   assert.match(registry, /reverse_bytes/);
   assert.match(executor, /loadVerifiedWorkerRegistry/);
-  assert.match(server, /'contained_transform'/);
-  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
-  assert.doesNotMatch(server, /executable:\s*z\./);
+  assert.match(contained, /'contained_transform'/);
+  assert.match(contained, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.doesNotMatch(contained, /executable:\s*z\./);
   assert.doesNotMatch(executor, /--worker/);
   assert.doesNotMatch(server, /registerTool\(\s*['"](?:command_run|shell_execute|powershell_run)['"]/);
 });
@@ -706,12 +710,16 @@ test('contained execution validator rejects missing or altered worker manifest e
 
 test('MCP contained_transform schema is a compile-time operation enum with no executable or invocation-control surface', async () => {
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
-  assert.match(server, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
-  assert.equal((server.match(/inputSchema: z\.strictObject\(\{/g) ?? []).length, 8);
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
+  assert.match(contained, /z\.enum\(CONTAINED_TRANSFORM_OPERATIONS\)/);
+  assert.match(contained, /inputSchema: z\.strictObject\(\{/);
   assert.match(server, /if \(hostPolicy\)/);
   for (const name of ['host_file_read', 'host_file_write', 'host_exec']) assert.match(server, new RegExp(`'${name}'`));
-  assert.doesNotMatch(server, /inputSchema: z\.object\(\{/);
-  assert.doesNotMatch(server, /executable:\s*z\.|argv:\s*z\.|environment:\s*z\.|challenge:\s*z\.|request_digest:\s*z\.|worker_id:\s*z\./);
+  assert.doesNotMatch(contained, /inputSchema: z\.object\(\{/);
+  assert.doesNotMatch(contained, /executable:\s*z\.|argv:\s*z\.|environment:\s*z\.|challenge:\s*z\.|request_digest:\s*z\.|worker_id:\s*z\./);
 });
 
 test('R27 Windows batch gate builds native payload before freezing and verifying the candidate', async () => {
@@ -914,13 +922,17 @@ test('contained execution validator fails closed on active network evidence', ()
 
 test('execution authority is strict at MCP and native argv boundaries', async () => {
   const server = await readFile(fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url)), 'utf8');
+  const containedStart = server.indexOf("toolServer.registerTool(\n    'contained_transform'");
+  const containedEnd = server.indexOf('toolServer.registerTool(', containedStart + 1);
+  const contained = server.slice(containedStart, containedEnd);
   const launcher = await readFile(fileURLToPath(new URL('../native/deadbyte-exec.cpp', import.meta.url)), 'utf8');
   const helper = await readFile(fileURLToPath(new URL('../native/contained-network-proof.h', import.meta.url)), 'utf8');
   const authority = await readFile(fileURLToPath(new URL('../src/authority-smoke.mjs', import.meta.url)), 'utf8');
-  assert.match(server, /inputSchema: z\.strictObject\(/);
-  assert.doesNotMatch(server, /worker_id:\s*z\./);
-  assert.doesNotMatch(server, /executable:\s*z\./);
-  assert.doesNotMatch(server, /argv:\s*z\./);
+  assert.ok(containedStart >= 0 && containedEnd > containedStart);
+  assert.match(contained, /inputSchema: z\.strictObject\(/);
+  assert.doesNotMatch(contained, /worker_id:\s*z\./);
+  assert.doesNotMatch(contained, /executable:\s*z\./);
+  assert.doesNotMatch(contained, /argv:\s*z\./);
   assert.match(launcher, /argc != 7/);
   assert.match(launcher, /invalid fixed argument contract/);
   assert.match(helper, /HasExactContainedWorkerArguments/);

package/test/controller.test.mjs

@@ -82,11 +82,15 @@ test('controller keeps privileged policy optional and propagates it only to the
 
 test('Windows host policy bootstrap pins executables and creates only explicit local roots', async () => {
   const init = await readFile(fileURLToPath(new URL('../scripts/init-host-policy.ps1', import.meta.url)), 'utf8');
-  assert.match(init, /deadbyte\.host-policy\.v1/);
+  assert.match(init, /deadbyte\.host-policy\.v2/);
   assert.match(init, /Get-FileHash/);
   assert.match(init, /powershell_script/);
   assert.match(init, /cmd_script/);
   assert.match(init, /node_script/);
+  assert.match(init, /powershell_inline/);
+  assert.match(init, /cmd_inline/);
+  assert.match(init, /node_inline/);
+  assert.match(init, /native_exec/);
   assert.match(init, /D:\\Projects/);
   assert.match(init, /State\s+: DISARMED/);
 });

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.15.0');
+  assert.equal(result.receipt.runtime.package_version, '0.15.2');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/full-max-catalog-r45.test.mjs

@@ -0,0 +1,91 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R45 real max-runtime full stdio catalog is exactly 82 with skill and four Desktop primitives while authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r45-full-catalog',version:'0.15.1'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'full',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    const {R45_EXPECTED_TOOLS}=await import('../src/remote-mcp-r45-parity-client.mjs');
+    assert.equal(names.length,82,'expected exact full R45 catalog 82, got '+names.length+': '+names.join(','));
+    assert.deepEqual(names,R45_EXPECTED_TOOLS);
+    for(const name of ['machine_hardware_query','desktop_status','desktop_observe','desktop_target','desktop_action',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    for(const tool of listed.tools) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
+    const catalog_sha256=sha(Buffer.from(JSON.stringify(names),'utf8'));
+    console.log(JSON.stringify({tool_count:names.length,catalog_sha256,desktop_tools:4,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/full-max-catalog-r46.test.mjs

@@ -0,0 +1,92 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R46 real max-runtime full stdio catalog is exactly 83 with skill and four Desktop primitives while authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r46-full-catalog',version:'0.15.2'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'full',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    const {R45_EXPECTED_TOOLS}=await import('../src/remote-mcp-r45-parity-client.mjs');
+    const R46_EXPECTED_TOOLS=[...R45_EXPECTED_TOOLS,'process_session_write'].sort();
+    assert.equal(names.length,83,'expected exact full R46 catalog 83, got '+names.length+': '+names.join(','));
+    assert.deepEqual(names,R46_EXPECTED_TOOLS);
+    for(const name of ['machine_hardware_query','desktop_status','desktop_observe','desktop_target','desktop_action',
+      'host_file_read','host_file_write','host_exec','skill_catalog']) assert.ok(names.includes(name),'missing '+name);
+    for(const tool of listed.tools) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
+    const catalog_sha256=sha(Buffer.from(JSON.stringify(names),'utf8'));
+    console.log(JSON.stringify({tool_count:names.length,catalog_sha256,desktop_tools:4,skill:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/hardware-observation-r45.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createObservationRuntime, verifyObservationReceiptFile } from '../src/observation-runtime.mjs';
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-hardware-query-r45-'));
+  const project=path.join(root,'project');await mkdir(project);
+  const policyPath=path.join(root,'coding-policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:path.join(root,'coding-grant.json'),evidence_dir:path.join(root,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{},
+    max_read_bytes:65536,max_write_bytes:65536}));
+  const policy=await loadCodingPolicy(policyPath);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+  const calls=[];
+  const hardwareSnapshotProvider=async query=>{calls.push(query);return {schema:'deadbyte.hardware-query.v1',query,
+    data:query==='cpu'?{brand:'TEST CPU',logical_processors:16}:{fixture:true}};};
+  const runtime=createObservationRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath,
+    stateRoot:root,processSnapshotProvider:async()=>[],systemSnapshotProvider:async()=>({hostname:'x',platform:'win32',architecture:'x64',
+      uptime_seconds:1,total_memory_bytes:1,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0]}),
+    ownedRuntimePidProvider:async()=>new Set(),hardwareSnapshotProvider});
+  return {root,policy,keys,runtime,calls};
+}
+
+test('R45 hardware query is typed read-only observation with signed evidence and no host authority',async()=>{
+  const f=await fixture();
+  const out=await f.runtime.hardwareQuery({query:'cpu'});
+  assert.equal(out.query,'cpu');assert.equal(out.data.brand,'TEST CPU');assert.deepEqual(f.calls,['cpu']);
+  assert.match(out.request_sha256,/^[0-9a-f]{64}$/);assert.match(out.result_head_sha256,/^[0-9a-f]{64}$/);
+  assert.match(out.receipt_id,/^[0-9a-f]{24}$/);assert.match(out.receipt_sha256,/^[0-9a-f]{64}$/);
+  const verified=await verifyObservationReceiptFile({policy:f.policy,verifyKeyPath:f.keys.publicKeyPath,receiptId:out.receipt_id});
+  assert.equal(verified.ok,true);assert.equal(verified.signature_valid,true);assert.equal(verified.kind,'machine_hardware_query');
+});
+
+test('R45 hardware query rejects untyped arbitrary query names before provider dispatch',async()=>{
+  const f=await fixture();
+  await assert.rejects(()=>f.runtime.hardwareQuery({query:'run_powershell'}),/hardware query/i);
+  assert.deepEqual(f.calls,[]);
+});

package/test/host-inline-r45.test.mjs

@@ -0,0 +1,67 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  HOST_GRANT_SCHEMA, HOST_POLICY_SCHEMA_V2, hostExecInline, hostExecNative, loadHostPolicy
+} from '../src/host-plane.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function fixture(){
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-host-inline-r45-'));
+  const root=path.join(dir,'root');await mkdir(root);
+  const arm=path.join(dir,'arm.json'), policyPath=path.join(dir,'policy.json');
+  const exeSha=sha(await readFile(process.execPath));
+  const raw={
+    schema:HOST_POLICY_SCHEMA_V2,enabled:true,arm_file:arm,
+    roots:{core:{path:root,read:true,write:true,exec:true}},
+    commands:{
+      node_inline:{kind:'inline',executable:process.execPath,executable_sha256:exeSha,root_ids:['core'],
+        prefix_args:['-e'],timeout_ms:5000,max_output_bytes:65536,max_command_chars:32768}
+    },
+    native_exec:{enabled:true,root_ids:['core'],timeout_ms:5000,max_output_bytes:65536,max_args:64,max_arg_chars:8192},
+    max_read_bytes:262144,max_write_bytes:1048576
+  };
+  await writeFile(policyPath,JSON.stringify(raw,null,2));
+  const policy=await loadHostPolicy(policyPath);
+  await writeFile(arm,JSON.stringify({schema:HOST_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,
+    instance_nonce:randomBytes(32).toString('hex'),armed_at_utc:new Date().toISOString()},null,2));
+  return {dir,root,arm,policy,exeSha};
+}
+
+test('R45 host inline executes in argv memory with zero staging artifact and hashes command/output',async t=>{
+  const f=await fixture();t.after(()=>rm(f.dir,{recursive:true,force:true}));
+  const before=(await readdir(f.root)).sort();
+  const command='process.stdout.write("INLINE_OK")';
+  const out=await hostExecInline(f.policy,{commandId:'node_inline',rootId:'core',command,cwd:'.',timeoutMs:2000});
+  const after=(await readdir(f.root)).sort();
+  assert.deepEqual(after,before,'inline execution must not stage a script file');
+  assert.equal(out.exit_code,0);assert.equal(out.stdout,'INLINE_OK');assert.equal(out.stderr,'');
+  assert.equal(out.command_sha256,sha(Buffer.from(command,'utf8')));
+  assert.equal(out.stdout_sha256,sha(Buffer.from('INLINE_OK','utf8')));
+  assert.equal(out.stderr_sha256,sha(Buffer.alloc(0)));
+  assert.match(out.argv_sha256,/^[0-9a-f]{64}$/);assert.equal(out.executable_sha256,f.exeSha);
+});
+
+test('R45 native argv execution accepts arbitrary absolute hash-pinned executable only while Host is armed',async t=>{
+  const f=await fixture();t.after(()=>rm(f.dir,{recursive:true,force:true}));
+  const before=(await readdir(f.root)).sort();
+  const out=await hostExecNative(f.policy,{rootId:'core',executable:process.execPath,executableSha256:f.exeSha,
+    args:['-e','process.stdout.write("NATIVE_OK")'],cwd:'.',timeoutMs:2000});
+  assert.equal(out.exit_code,0);assert.equal(out.stdout,'NATIVE_OK');
+  assert.deepEqual((await readdir(f.root)).sort(),before,'native argv execution must not create staging files');
+  await assert.rejects(()=>hostExecNative(f.policy,{rootId:'core',executable:process.execPath,executableSha256:'f'.repeat(64),
+    args:['--version'],cwd:'.'}),/executable hash mismatch/i);
+});
+
+test('R45 inline execution observes authority revocation during a live child and fails closed',async t=>{
+  const f=await fixture();t.after(()=>rm(f.dir,{recursive:true,force:true}));
+  const running=hostExecInline(f.policy,{commandId:'node_inline',rootId:'core',
+    command:'setTimeout(()=>process.stdout.write("SHOULD_NOT_COMPLETE"),1500)',cwd:'.',timeoutMs:4000,authorityPollMs:50});
+  await new Promise(r=>setTimeout(r,150));
+  await rm(f.arm,{force:true});
+  await assert.rejects(()=>running,/host authority changed during operation/i);
+});

package/test/machine-fs-mcp-tools.test.mjs

@@ -11,7 +11,7 @@ function runtime() {
   return {
     stat: async () => ({ status:'ok', root_id:'core', path:'a.txt', kind:'file', bytes:1, mtime_utc:new Date(0).toISOString(), sha256:hex('a'), identity_sha256:hex('b') }),
     list: async () => ({ status:'ok', root_id:'core', path:'.', entries:[], next_cursor:null }),
-    read: async () => ({ status:'ok', root_id:'core', path:'a.txt', offset:0, next_offset:1, file_size:1, eof:true, data_base64:'YQ==', data_sha256:hex('a'), file_sha256:hex('a') }),
+    read: async () => ({ status:'ok', root_id:'core', path:'a.txt', offset:0, next_offset:1, file_size:1, eof:true, data_base64:'YQ==', data_sha256:hex('a'), file_sha256:hex('a'), timeout_ms:30000 }),
     write: async () => ({ status:'committed', root_id:'core', path:'a.txt', previous_sha256:null, sha256:hex('a'), bytes:1, created:true, receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
     editExact: async () => ({ status:'committed', root_id:'core', path:'a.txt', previous_sha256:hex('a'), sha256:hex('b'), bytes:1, replacements:1, receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
     mkdir: async () => ({ status:'committed', root_id:'core', path:'d', identity_sha256:hex('a'), receipt_id:'a'.repeat(24), receipt_sha256:hex('b'), request_sha256:hex('c') }),
@@ -35,6 +35,9 @@ test('R31 registers exactly eight bounded machine filesystem tools', () => {
 test('R31 machine filesystem schemas expose root-relative IDs/preconditions only', () => {
   const server = new FakeServer();
   registerMachineFsTools(server, { runtime: runtime() });
+  const read = server.tools.get('machine_fs_read').spec.inputSchema;
+  assert.equal(read.safeParse({ root_id:'core', path:'a.txt', offset:0, max_bytes:65536, hash_file:false, timeout_ms:30000 }).success, true);
+  assert.equal(read.safeParse({ root_id:'core', path:'a.txt', timeout_ms:99 }).success, false);
   const write = server.tools.get('machine_fs_write').spec.inputSchema;
   const move = server.tools.get('machine_fs_move').spec.inputSchema;
   const del = server.tools.get('machine_fs_delete').spec.inputSchema;

package/test/machine-fs-runtime.test.mjs

@@ -10,7 +10,7 @@ import { createMachineFsRuntime, verifyMachineFsReceiptFile } from '../src/machi
 
 const sha = bytes => createHash('sha256').update(bytes).digest('hex');
 
-async function fixture() {
+async function fixture({ readWorkerPath = undefined } = {}) {
   const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-machine-fs-'));
   const project = path.join(root, 'project');
   await mkdir(project);
@@ -30,7 +30,7 @@ async function fixture() {
     privateKeyPath: path.join(root, 'private.pem'), publicKeyPath: path.join(root, 'public.pem')
   });
   const runtime = createMachineFsRuntime({
-    policy, signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath
+    policy, signingKeyPath: keys.privateKeyPath, verifyKeyPath: keys.publicKeyPath, readWorkerPath
   });
   return { root, project, policy, keys, runtime };
 }
@@ -52,6 +52,7 @@ test('R31 machine fs supports exact mkdir/write/stat/list/range-read/edit/move/d
   const read = await f.runtime.read({ rootId: 'project', relativePath: 'dir/a.txt', offset: 6, maxBytes: 4 });
   assert.equal(Buffer.from(read.data_base64, 'base64').toString('utf8'), 'beta');
   assert.equal(read.next_offset, 10);
+  assert.equal(read.timeout_ms, 30000);
   const edited = await f.runtime.editExact({
     rootId: 'project', relativePath: 'dir/a.txt', expectedSha256: written.sha256,
     oldString: 'beta', newString: 'BETA', expectedReplacements: 1
@@ -103,3 +104,18 @@ test('R31 machine fs fails closed on traversal, denied paths and stale source id
   assert.equal(verified.signature_valid, true);
   assert.equal(verified.operation, 'machine_fs_mkdir');
 });
+
+
+test('R46 machine fs read timeout kills a hung read worker instead of abandoning live I/O', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-machine-fs-hang-worker-'));
+  const worker = path.join(root, 'hang-worker.mjs');
+  await writeFile(worker, "setInterval(()=>{},1000);\n");
+  const f = await fixture({ readWorkerPath: worker });
+  await writeFile(path.join(f.project, 'hang.txt'), 'never read');
+  const started = Date.now();
+  await assert.rejects(
+    () => f.runtime.read({ rootId:'project', relativePath:'hang.txt', offset:0, maxBytes:16, timeoutMs:100 }),
+    /timed out after 100ms/
+  );
+  assert.ok(Date.now() - started < 3000, 'hung worker was not terminated promptly');
+});

package/test/machine-mcp-integration.test.mjs

@@ -51,6 +51,7 @@ async function fixture() {
     env: {
       ...getDefaultEnvironment(), DEADBYTE_STATE_ROOT: root, DEADBYTE_MACHINE_RUNTIME: '1',
       DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+      DEADBYTE_PRIVILEGED_POLICY: '',
       DEADBYTE_AGENT_RUNTIME: '0', DEADBYTE_CODING_RUNTIME: '0', DEADBYTE_AUTONOMOUS_RUNTIME: '0'
     }, stderr: 'pipe'
   });