deadbyte-mcp 0.15.0 → 0.15.2

package/test/observation-mcp-tools.test.mjs

@@ -15,14 +15,15 @@ function runtime(){
     searchStatus:async()=>({status:'ok',search_id:hex('a'),state:'completed',result_count:0,files_scanned:0,bytes_scanned:0,truncated:false,request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d'),error:null}),
     searchCancel:async()=>({status:'ok',search_id:hex('a'),state:'cancelled',cancel_requested:true}),
     processList:async()=>({status:'ok',snapshot_id:hex('e'),observed_at_utc:new Date(0).toISOString(),processes:[],next_cursor:null,request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')}),
-    systemStatus:async()=>({status:'ok',observed_at_utc:new Date(0).toISOString(),hostname:'x',platform:'win32',architecture:'x64',uptime_seconds:1,total_memory_bytes:2,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0],request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')})
+    systemStatus:async()=>({status:'ok',observed_at_utc:new Date(0).toISOString(),hostname:'x',platform:'win32',architecture:'x64',uptime_seconds:1,total_memory_bytes:2,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0],request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')}),
+    hardwareQuery:async({query})=>({status:'ok',query,observed_at_utc:new Date(0).toISOString(),observer_sha256:hex('e'),data:{vendor:'x'},request_sha256:hex('b'),result_head_sha256:hex('c'),receipt_id:receipt,receipt_sha256:hex('d')})
   };
 }
 
-test('R32 registers exactly six bounded observation tools',()=>{
+test('R45 registers exactly seven bounded observation tools including typed native hardware',()=>{
   const server=new FakeServer(); registerObservationTools(server,{runtime:runtime()});
   assert.deepEqual([...server.tools.keys()].sort(),[
-    'machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'
+    'machine_hardware_query','machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'
   ]);
   for(const [name,tool] of server.tools){ assert.ok(tool.spec.inputSchema,`${name} input`); assert.ok(tool.spec.outputSchema,`${name} output`); }
 });

package/test/observation-runtime.test.mjs

@@ -7,7 +7,7 @@ import { generateTrustKeypair } from '../src/trust.mjs';
 import { loadCodingPolicy } from '../src/coding-plane.mjs';
 import { createObservationRuntime, verifyObservationReceiptFile } from '../src/observation-runtime.mjs';
 
-async function fixture() {
+async function fixture(runtimeOptions={}) {
   const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-observation-'));
   const project = path.join(root, 'project');
   await mkdir(project); await mkdir(path.join(project, 'blocked'));
@@ -36,7 +36,8 @@ async function fixture() {
   const runtime = createObservationRuntime({
     policy, signingKeyPath:keys.privateKeyPath, verifyKeyPath:keys.publicKeyPath,
     processRuntime, stateRoot:root, processSnapshotProvider, systemSnapshotProvider,
-    ownedRuntimePidProvider: async () => new Set([111])
+    ownedRuntimePidProvider: async () => new Set([111]),
+    ...runtimeOptions
   });
   return { root, project, policy, keys, runtime, getProcessCalls:() => processCalls };
 }
@@ -121,3 +122,29 @@ test('R32 system observation is timestamped and signed without mutation authorit
   assert.equal(verified.ok,true);
   assert.equal(verified.result_head_sha256,status.result_head_sha256);
 });
+
+
+test('R46 observation search sessions expire after bounded terminal TTL and free capacity', async () => {
+  let now=1000;
+  const f=await fixture({searchSessionTtlMs:50,maxSearchSessions:1,clockMs:()=>now});
+  await writeFile(path.join(f.project,'ttl.txt'),'needle\n');
+  const first=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle',maxResults:10,maxFiles:10,maxBytes:65536});
+  const done=await waitTerminal(f.runtime,first.search_id);
+  assert.equal(done.state,'completed');
+  now+=60;
+  await assert.rejects(f.runtime.searchStatus({searchId:first.search_id}),/unknown or expired search/);
+  const second=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle',maxResults:10,maxFiles:10,maxBytes:65536});
+  assert.match(second.search_id,/^[0-9a-f]{64}$/);
+});
+
+test('R46 observation search hard cap fails closed while all retained sessions are active', async () => {
+  const f=await fixture({searchSessionTtlMs:5000,maxSearchSessions:2});
+  await writeFile(path.join(f.project,'cap.txt'),'needle\n');
+  const a=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle'});
+  const b=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle'});
+  assert.match(a.search_id,/^[0-9a-f]{64}$/);
+  assert.match(b.search_id,/^[0-9a-f]{64}$/);
+  await assert.rejects(f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle'}),/session limit reached/);
+  await waitTerminal(f.runtime,a.search_id).catch(()=>{});
+  await waitTerminal(f.runtime,b.search_id).catch(()=>{});
+});

package/test/output-schema.test.mjs

@@ -40,6 +40,7 @@ async function fixture() {
       DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
       DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
       DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+      DEADBYTE_PRIVILEGED_POLICY: '',
       DEADBYTE_AGENT_RUNTIME: '1'
     },
     stderr: 'pipe'

package/test/package-boundary.test.mjs

@@ -39,6 +39,6 @@ test('R28 package boundary contains only immutable workspace seed files', () =>
 
 test('publish boundary excludes live state, private keys, grants and non-example controller secrets',()=>{
   const files=packFiles();
-  const forbidden=files.filter(rel=>/(^|\/)(active-release\.json|runtime\/|audit\/|evidence\/)|\.pem$|(^|\/)deadbyte-controller\.config\.psd1$|(^|\/)deadbyte-host-policy\.json$|(^|\/)[^/]*(?:grant|arm)\.json$/i.test(rel));
+  const forbidden=files.filter(rel=>rel.startsWith('tmp/')||rel.startsWith('.deadbyte-machine-fs-recovery/')||/(^|\/)(active-release\.json|runtime\/|audit\/|evidence\/)|\.pem$|(^|\/)deadbyte-controller\.config\.psd1$|(^|\/)deadbyte-host-policy\.json$|(^|\/)[^/]*(?:grant|arm)\.json$/i.test(rel));
   assert.deepEqual(forbidden,[]);
 });

package/test/process-mcp-tools.test.mjs

@@ -1,4 +1,4 @@
-import test from 'node:test';
+import test from 'node:test';
 import assert from 'node:assert/strict';
 import { registerProcessTools } from '../src/process-mcp-tools.mjs';
 
@@ -20,18 +20,19 @@ function runtime() {
   return {
     start: async () => session(), read: async () => ({
       session_id: hex('a'), offset: 0, next_offset: 4, earliest_offset: 0, stream_head: 4,
-      stream_sha256: hex('b'), truncated: false, data_base64: 'VEVTVA==', state: 'running', exit_code: null
+      stream_sha256: hex('b'), truncated: false, wait_satisfied: true, data_base64: 'VEVTVA==', state: 'running', exit_code: null
     }),
     status: async () => session(), list: async () => ({ sessions: [session()] }),
+    write: async ({ input, appendNewline }) => ({ logical_bytes: Buffer.byteLength(input + (appendNewline ? '\r\n' : '')), logical_sha256: hex('e'), append_newline: appendNewline, session: session() }),
     action: async ({ actionId }) => ({ action_id: actionId, logical_bytes: 4, logical_sha256: hex('d'), session: session() }),
     terminate: async () => session('terminated')
   };
 }
-test('R32 registers exactly six bounded process supervision tools', () => {
+test('R46 registers exactly seven bounded process supervision tools', () => {
   const server = new FakeServer();
   registerProcessTools(server, { runtime: runtime() });
   assert.deepEqual([...server.tools.keys()].sort(), [
-    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'
+    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'
   ]);
   for (const [name, tool] of server.tools) {
     assert.ok(tool.spec.inputSchema, `${name} input schema missing`);
@@ -41,7 +42,7 @@ test('R32 registers exactly six bounded process supervision tools', () => {
   }
 });
 
-test('R32 process tool inputs expose IDs and bounds but no executable or raw input field', () => {
+test('R46 process tool inputs expose guarded raw input only through process_session_write', () => {
   const server = new FakeServer();
   registerProcessTools(server, { runtime: runtime() });
   const start = server.tools.get('process_session_start').spec.inputSchema;
@@ -52,6 +53,10 @@ test('R32 process tool inputs expose IDs and bounds but no executable or raw inp
   assert.equal(start.safeParse({ profile_id: 'hold', root_id: 'core', input: 'whoami' }).success, false);
   assert.equal(terminate.safeParse({ session_id: hex('a') }).success, true);
   assert.equal(terminate.safeParse({ pid: 1234 }).success, false);
+  const write = server.tools.get('process_session_write').spec.inputSchema;
+  assert.equal(write.safeParse({ session_id: hex('a'), input: 'Write-Output 42', append_newline: true }).success, true);
+  assert.equal(write.safeParse({ session_id: hex('a'), input: '' }).success, false);
+  assert.equal(write.safeParse({ session_id: hex('a'), input: 'x', pid: 1234 }).success, false);
   assert.equal(action.safeParse({ session_id: hex('a'), action_id: 'ping' }).success, true);
   for (const forbidden of ['input','command','executable','environment','pid']) {
     assert.equal(action.safeParse({ session_id: hex('a'), action_id: 'ping', [forbidden]: 'forbidden' }).success, false);
@@ -69,3 +74,16 @@ test('R32 process action handler returns only strict logical identity and update
   assert.equal(result.structuredContent.session.state, 'running');
   assert.equal(tool.spec.outputSchema.safeParse({ ...result.structuredContent, raw_input: 'forbidden' }).success, false);
 });
+
+
+test('R46 process write handler returns only input identity and session state', async () => {
+  const server = new FakeServer();
+  registerProcessTools(server, { runtime: runtime() });
+  const tool = server.tools.get('process_session_write');
+  const result = await tool.handler({ session_id: hex('a'), input: 'Write-Output 42', append_newline: true });
+  assert.equal(result.isError, false);
+  assert.deepEqual(Object.keys(result.structuredContent).sort(), ['append_newline','logical_bytes','logical_sha256','session','status']);
+  assert.equal(result.structuredContent.append_newline, true);
+  assert.equal(result.structuredContent.session.state, 'running');
+  assert.equal(tool.spec.outputSchema.safeParse({ ...result.structuredContent, raw_input: 'forbidden' }).success, false);
+});

package/test/process-policy-refresh.test.mjs

@@ -13,18 +13,58 @@ async function fixture() {
   const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-process-refresh-'));
   const bin = path.join(root, 'bin');
   const controller = path.join(root, 'controller');
+  const systemRoot = path.join(root, 'Windows');
+  const system32 = path.join(systemRoot, 'System32');
+  const powershellDir = path.join(system32, 'WindowsPowerShell', 'v1.0');
   await mkdir(bin, { recursive: true });
   await mkdir(controller, { recursive: true });
+  await mkdir(powershellDir, { recursive: true });
+
   const hostPath = path.join(bin, 'deadbyte-process-host.exe');
   const hostBytes = Buffer.from('fresh-native-host\n');
+  const cmdPath = path.join(system32, 'cmd.exe');
+  const cmdBytes = Buffer.from('target-cmd\n');
+  const powershellPath = path.join(powershellDir, 'powershell.exe');
+  const powershellBytes = Buffer.from('target-powershell\n');
   await writeFile(hostPath, hostBytes);
+  await writeFile(cmdPath, cmdBytes);
+  await writeFile(powershellPath, powershellBytes);
+
   const policyPath = path.join(controller, 'deadbyte-process-policy.json');
-  const policy = { schema:'deadbyte.process-policy.v1', enabled:true, grant_file:path.join(root,'runtime','grant.json'),
-    state_dir:path.join(root,'state'), native_host:{ path:hostPath, sha256:'0'.repeat(64) },
-    roots:{core:{path:root,deny_paths:[]}}, profiles:{probe:{executable:process.execPath,executable_sha256:'1'.repeat(64),root_ids:['core'],prefix_args:[],max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:4096,env_allow:[],input_actions:{}}}};
+  const profile = executable => ({
+    executable,
+    executable_sha256:'1'.repeat(64),
+    root_ids:['core'],
+    prefix_args:[],
+    transport:'pipe',
+    max_args:1,
+    max_arg_bytes:8192,
+    max_sessions:1,
+    max_input_bytes:4096,
+    max_retained_output_bytes:4096,
+    env_allow:[],
+    input_actions:{}
+  });
+  const policy = {
+    schema:'deadbyte.process-policy.v1',
+    enabled:true,
+    grant_file:path.join(root,'runtime','grant.json'),
+    state_dir:path.join(root,'state'),
+    native_host:{ path:hostPath, sha256:'0'.repeat(64) },
+    roots:{core:{path:root,deny_paths:[]}},
+    profiles:{
+      ping_hold:profile(cmdPath),
+      powershell:profile(powershellPath),
+      powershell_repl:profile(powershellPath)
+    }
+  };
   await writeFile(policyPath, `${JSON.stringify(policy,null,2)}\n`);
-  return { root, policyPath, hostPath, hostBytes, policy };
+  return {
+    root, policyPath, hostPath, hostBytes, systemRoot,
+    cmdPath, cmdBytes, powershellPath, powershellBytes, policy
+  };
 }
+
 test('R33 candidate process policy self-binds to the current repository root', async () => {
   const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
   const policyPath = path.join(repoRoot, 'controller', 'deadbyte-process-policy.json');
@@ -33,32 +73,69 @@ test('R33 candidate process policy self-binds to the current repository root', a
   assert.equal(policy.state_dir, path.join(repoRoot, 'controller', 'runtime', 'process-state'));
   assert.equal(policy.native_host.path, path.join(repoRoot, 'bin', 'deadbyte-process-host.exe'));
   assert.equal(policy.roots.core.path, repoRoot);
+  assert.ok(policy.profiles.ping_hold);
+  assert.ok(policy.profiles.powershell);
+  assert.ok(policy.profiles.powershell_repl);
+  assert.equal(policy.profiles.powershell_repl.allow_raw_input,true);
+  assert.deepEqual(policy.profiles.powershell.prefix_args, ['-NoLogo','-NoProfile','-NonInteractive','-Command']);
+  assert.equal(policy.profiles.powershell.max_args, 1);
+  assert.equal(policy.profiles.powershell.max_arg_bytes, 8192);
 });
 
-test('R31 refresh changes only the native-host digest after the Windows build', async () => {
+test('process policy refresh repins native host and Windows system executables', async () => {
   const f = await fixture();
-  const result = await refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath });
+  const result = await refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath, systemRoot:f.systemRoot });
   const after = JSON.parse(await readFile(f.policyPath,'utf8'));
   assert.equal(after.native_host.path, f.hostPath);
   assert.equal(after.native_host.sha256, sha256(f.hostBytes));
+  assert.equal(after.profiles.ping_hold.executable, f.cmdPath);
+  assert.equal(after.profiles.ping_hold.executable_sha256, sha256(f.cmdBytes));
+  assert.equal(after.profiles.powershell.executable, f.powershellPath);
+  assert.equal(after.profiles.powershell.executable_sha256, sha256(f.powershellBytes));
+  assert.equal(after.profiles.powershell_repl.executable, f.powershellPath);
+  assert.equal(after.profiles.powershell_repl.executable_sha256, sha256(f.powershellBytes));
   assert.equal(result.native_host_sha256, sha256(f.hostBytes));
+  assert.equal(result.cmd_executable_sha256, sha256(f.cmdBytes));
+  assert.equal(result.powershell_executable_sha256, sha256(f.powershellBytes));
+  assert.equal(result.powershell_repl_executable_sha256, sha256(f.powershellBytes));
+
   const expected = structuredClone(f.policy);
   expected.native_host.sha256 = sha256(f.hostBytes);
+  expected.profiles.ping_hold.executable_sha256 = sha256(f.cmdBytes);
+  expected.profiles.powershell.executable_sha256 = sha256(f.powershellBytes);
+  expected.profiles.powershell_repl.executable_sha256 = sha256(f.powershellBytes);
   assert.deepEqual(after, expected);
 });
 
-test('R31 refresh fails closed when native-host path is not the candidate bin path', async () => {
+test('process policy refresh fails closed when native-host path is not the candidate bin path', async () => {
   const f = await fixture();
   const raw = JSON.parse(await readFile(f.policyPath,'utf8'));
   raw.native_host.path = process.execPath;
   await writeFile(f.policyPath, `${JSON.stringify(raw,null,2)}\n`);
-  await assert.rejects(() => refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath }), /native_host path must equal candidate bin/);
+  await assert.rejects(
+    () => refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath, systemRoot:f.systemRoot }),
+    /native_host path must equal candidate bin/
+  );
+});
+
+test('process policy refresh fails closed when a system profile path is not target-bound', async () => {
+  const f = await fixture();
+  const raw = JSON.parse(await readFile(f.policyPath,'utf8'));
+  raw.profiles.powershell.executable = process.execPath;
+  await writeFile(f.policyPath, `${JSON.stringify(raw,null,2)}\n`);
+  await assert.rejects(
+    () => refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath, systemRoot:f.systemRoot }),
+    /profile 'powershell' executable path mismatch/
+  );
 });
 
-test('R31 refresh refuses a malformed or disabled process policy', async () => {
+test('process policy refresh refuses a malformed or disabled process policy', async () => {
   const f = await fixture();
   const raw = JSON.parse(await readFile(f.policyPath,'utf8'));
   raw.enabled = false;
   await writeFile(f.policyPath, `${JSON.stringify(raw,null,2)}\n`);
-  await assert.rejects(() => refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath }), /schema\/enabled mismatch/);
+  await assert.rejects(
+    () => refreshProcessPolicy({ repoRoot:f.root, policyPath:f.policyPath, systemRoot:f.systemRoot }),
+    /schema\/enabled mismatch/
+  );
 });

package/test/process-runtime.test.mjs

@@ -12,6 +12,7 @@ import { generateTrustKeypair } from '../src/trust.mjs';
 const repo = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const host = path.join(repo, 'bin', 'deadbyte-process-host.exe');
 const cmd = 'C:\\Windows\\System32\\cmd.exe';
+const powershell = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
 const sha = bytes => createHash('sha256').update(bytes).digest('hex');
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 
@@ -25,6 +26,7 @@ async function fixture() {
   const policyPath = path.join(root, 'process-policy.json');
   const hostSha = sha(await readFile(host));
   const cmdSha = sha(await readFile(cmd));
+  const powershellSha = sha(await readFile(powershell));
   const raw = {
     schema: PROCESS_POLICY_SCHEMA, enabled: true, grant_file: grantFile, state_dir: stateDir,
     native_host: { path: host, sha256: hostSha },
@@ -47,6 +49,18 @@ async function fixture() {
         prefix_args: ['/d', '/q'], max_args: 0, max_arg_bytes: 256,
         max_sessions: 1, max_input_bytes: 4096, max_retained_output_bytes: 65536,
         env_allow: ['PATH', 'TEMP', 'TMP'], input_actions: { ping: 'echo mustnotrun\r\n' }
+      },
+      powershell: {
+        executable: powershell, executable_sha256: powershellSha, root_ids: ['core'], transport: 'pipe',
+        prefix_args: ['-NoLogo','-NoProfile','-NonInteractive','-Command'], max_args: 1, max_arg_bytes: 8192,
+        max_sessions: 2, max_input_bytes: 65536, max_retained_output_bytes: 1048576,
+        env_allow: ['PATH','TEMP','TMP','SystemRoot','WINDIR','USERPROFILE','PSModulePath','COMSPEC','PATHEXT'], input_actions: {}
+      },
+      powershell_repl: {
+        executable: powershell, executable_sha256: powershellSha, root_ids: ['core'], transport: 'pipe', allow_raw_input: true,
+        prefix_args: ['-NoLogo','-NoProfile','-NonInteractive'], max_args: 0, max_arg_bytes: 256,
+        max_sessions: 2, max_input_bytes: 65536, max_retained_output_bytes: 4 * 1024 * 1024,
+        env_allow: ['PATH','TEMP','TMP','SystemRoot','WINDIR','USERPROFILE','PSModulePath','COMSPEC','PATHEXT'], input_actions: {}
       }
     }
   };
@@ -54,7 +68,7 @@ async function fixture() {
   const policy = await loadProcessPolicy(policyPath);
   await writeFile(grantFile, JSON.stringify({
     schema: PROCESS_GRANT_SCHEMA, policy_sha256: policy.policy_sha256,
-    instance_nonce: 'a'.repeat(64), profile_ids: ['echo', 'hold', 'conptyhold'], root_ids: ['core'],
+    instance_nonce: 'a'.repeat(64), profile_ids: ['echo', 'hold', 'conptyhold', 'powershell', 'powershell_repl'], root_ids: ['core'],
     granted_at_utc: '2026-09-14T00:00:00Z'
   }));
   const keys = await generateTrustKeypair({
@@ -90,6 +104,102 @@ test('R31 runtime starts one approved profile and exposes ordered bounded output
   assert.equal(observed.page.truncated, false);
 });
 
+test('R46 runtime executes fileless PowerShell source without ps1 materialization', { skip: process.platform !== 'win32' }, async () => {
+  const f = await fixture();
+  const source = "$ErrorActionPreference='Stop';$before=@(Get-ChildItem -LiteralPath $env:TEMP -Filter '*.ps1' -File -ErrorAction SilentlyContinue|ForEach-Object{$_.FullName});[Console]::WriteLine('DB_FILELESS_PS_TEST');[Console]::WriteLine('PSCommandPath=' + [string]$PSCommandPath);[Console]::WriteLine('InvocationPath=' + [string]$MyInvocation.MyCommand.Path);$after=@(Get-ChildItem -LiteralPath $env:TEMP -Filter '*.ps1' -File -ErrorAction SilentlyContinue|ForEach-Object{$_.FullName});$new=@($after|Where-Object{$_ -notin $before});[Console]::WriteLine('NEW_TEMP_PS1_COUNT=' + $new.Count)";
+  const started = await f.runtime.start({ profileId: 'powershell', rootId: 'core', cwd: '.', args: [source] });
+  const observed = await waitFor(f.runtime, started.session_id, text => text.includes('NEW_TEMP_PS1_COUNT=0'));
+  assert.match(observed.text, /DB_FILELESS_PS_TEST/);
+  assert.match(observed.text, /PSCommandPath=\r?\n/);
+  assert.match(observed.text, /InvocationPath=\r?\n/);
+  assert.match(observed.text, /NEW_TEMP_PS1_COUNT=0/);
+  const deadline = Date.now() + 5000;
+  let status = await f.runtime.status({ sessionId: started.session_id });
+  while (status.state === 'running' && Date.now() < deadline) {
+    await sleep(25);
+    status = await f.runtime.status({ sessionId: started.session_id });
+  }
+  assert.equal(status.state, 'exited');
+  assert.equal(status.exit_code, 0);
+  const verified = await f.runtime.verifyEventJournal({ sessionId: started.session_id });
+  assert.equal(verified.ok, true);
+});
+
+test('R46 process output retention evicts oldest bytes without losing tail identity under multi-megabyte output', { skip: process.platform !== 'win32' }, async () => {
+  const f = await fixture();
+  const source = "[Console]::Write(('A'*2097152));[Console]::WriteLine('DB_RING_TAIL_MARK')";
+  const started = await f.runtime.start({ profileId: 'powershell', rootId: 'core', cwd: '.', args: [source] });
+  const deadline = Date.now() + 10000;
+  let status = await f.runtime.status({ sessionId: started.session_id });
+  while (status.state === 'running' && Date.now() < deadline) {
+    await sleep(25);
+    status = await f.runtime.status({ sessionId: started.session_id });
+  }
+  assert.equal(status.state, 'exited');
+  assert.equal(status.exit_code, 0);
+  assert.ok(status.stream_head > 2 * 1024 * 1024);
+  assert.ok(status.earliest_offset > 0);
+  assert.ok(status.stream_head - status.earliest_offset <= 1024 * 1024);
+  const fromStart = await f.runtime.read({ sessionId: started.session_id, offset: 0, maxBytes: 4096 });
+  assert.equal(fromStart.truncated, true);
+  assert.equal(fromStart.offset, status.earliest_offset);
+  const tail = await f.runtime.read({ sessionId: started.session_id, offset: -4096, maxBytes: 4096 });
+  const tailText = Buffer.from(tail.data_base64, 'base64').toString('utf8');
+  assert.match(tailText, /DB_RING_TAIL_MARK/);
+  const verified = await f.runtime.verifyEventJournal({ sessionId: started.session_id });
+  assert.equal(verified.ok, true);
+});
+
+test('R46 process raw input keeps persistent PowerShell state with bounded wait and tail reads', { skip: process.platform !== 'win32' }, async () => {
+  const f = await fixture();
+  const started = await f.runtime.start({ profileId: 'powershell_repl', rootId: 'core', cwd: '.', args: [] });
+  try {
+    const first = await f.runtime.write({ sessionId: started.session_id, input: "$x=41;[Console]::WriteLine('DB_REPL_SET')", appendNewline: true });
+    assert.equal(first.session.state, 'running');
+    assert.match(first.logical_sha256, /^[0-9a-f]{64}$/);
+    const page1 = await f.runtime.read({ sessionId: started.session_id, offset: 0, maxBytes: 65536, waitMs: 3000, waitFor: 'DB_REPL_SET' });
+    const text1 = Buffer.from(page1.data_base64, 'base64').toString('utf8');
+    assert.match(text1, /DB_REPL_SET/);
+
+    const beforeSecond = (await f.runtime.status({ sessionId: started.session_id })).stream_head;
+    await f.runtime.write({ sessionId: started.session_id, input: "[Console]::WriteLine('DB_REPL_VALUE=' + ($x+1))", appendNewline: true });
+    const waited = await f.runtime.read({ sessionId: started.session_id, offset: beforeSecond, maxBytes: 65536, waitMs: 3000, waitFor: 'DB_REPL_VALUE=42' });
+    const waitedText = Buffer.from(waited.data_base64, 'base64').toString('utf8');
+    assert.equal(waited.wait_satisfied, true);
+    assert.match(waitedText, /DB_REPL_VALUE=42/);
+    const tail = await f.runtime.read({ sessionId: started.session_id, offset: -4096, maxBytes: 4096, waitMs: 0 });
+    const tailText = Buffer.from(tail.data_base64, 'base64').toString('utf8');
+    assert.match(tailText, /DB_REPL_VALUE=42/);
+
+    const journal = await readFile(path.join(f.stateDir, `${started.session_id}.jsonl`), 'utf8');
+    assert.doesNotMatch(journal, /DB_REPL_SET|DB_REPL_VALUE|\$x=41/);
+    const verified = await f.runtime.verifyEventJournal({ sessionId: started.session_id });
+    assert.equal(verified.ok, true);
+    assert.ok(verified.event_count >= 3);
+  } finally {
+    await f.runtime.terminate({ sessionId: started.session_id }).catch(() => {});
+  }
+});
+
+test('R46 raw process input is profile-opt-in, bounded, and rechecks standing authority', { skip: process.platform !== 'win32' }, async () => {
+  const f = await fixture();
+  const hold = await f.runtime.start({ profileId: 'hold', rootId: 'core', cwd: '.', args: [] });
+  try {
+    await assert.rejects(() => f.runtime.write({ sessionId: hold.session_id, input: 'echo forbidden', appendNewline: true }), /does not allow raw input/);
+  } finally {
+    await f.runtime.terminate({ sessionId: hold.session_id }).catch(() => {});
+  }
+
+  const repl = await f.runtime.start({ profileId: 'powershell_repl', rootId: 'core', cwd: '.', args: [] });
+  try {
+    await assert.rejects(() => f.runtime.write({ sessionId: repl.session_id, input: 'x'.repeat(65536), appendNewline: true }), /exceeds profile input bound/);
+    await rm(f.grantFile);
+    await assert.rejects(() => f.runtime.write({ sessionId: repl.session_id, input: 'Write-Output denied', appendNewline: true }), /process plane is disarmed/);
+  } finally {
+    await f.runtime.terminate({ sessionId: repl.session_id }).catch(() => {});
+  }
+});
+
 test('R31 runtime lists, reports and terminates only its owned session', { skip: process.platform !== 'win32' }, async () => {
   const f = await fixture();
   const started = await f.runtime.start({ profileId: 'hold', rootId: 'core', cwd: '.', args: [] });

package/test/process-supervision.test.mjs

@@ -7,7 +7,7 @@ const runtimePath = fileURLToPath(new URL('../src/process-runtime.mjs', import.m
 const serverPath = fileURLToPath(new URL('../src/mcp-server.mjs', import.meta.url));
 const toolsPath = fileURLToPath(new URL('../src/process-mcp-tools.mjs', import.meta.url));
 
-test('R32 process supervision is policy-gated and registers the bounded named-action tool', async () => {
+test('R46 process supervision is policy-gated and exposes bounded action plus opt-in raw input', async () => {
   const runtimeSource = await readFile(runtimePath, 'utf8');
   const serverSource = await readFile(serverPath, 'utf8');
   const toolsSource = await readFile(toolsPath, 'utf8');
@@ -20,5 +20,7 @@ test('R32 process supervision is policy-gated and registers the bounded named-ac
   assert.match(serverSource, /processRuntime/);
   assert.match(toolsSource, /process_session_action/);
   assert.match(toolsSource, /action_id/);
-  assert.doesNotMatch(toolsSource, /raw_stdin|raw_input/);
+  assert.match(toolsSource, /process_session_write/);
+  assert.match(toolsSource, /append_newline/);
+  assert.doesNotMatch(toolsSource, /caller-selected executable|raw_stdin/);
 });

package/test/production-docs.test.mjs

@@ -9,9 +9,9 @@ const readme=()=>readFile(path.join(root,'README.txt'),'utf8');
 
 test('production README documents one-command stdio configs for major MCP clients',async()=>{
   const text=await readme();
-  assert.match(text,/npx -y deadbyte-mcp@0\.11\.3 mcp/);
+  assert.match(text,/npx -y deadbyte-mcp@0\.15\.2 mcp/);
   assert.match(text,/CLAUDE DESKTOP/);
-  assert.match(text,/"mcpServers"[\s\S]*?"command"\s*:\s*"npx"[\s\S]*?"-y"[\s\S]*?"deadbyte-mcp@0\.11\.3"[\s\S]*?"mcp"/);
+  assert.match(text,/"mcpServers"[\s\S]*?"command"\s*:\s*"npx"[\s\S]*?"-y"[\s\S]*?"deadbyte-mcp@0\.15\.2"[\s\S]*?"mcp"/);
   assert.match(text,/CURSOR/);
   assert.match(text,/\.cursor\/mcp\.json/);
   assert.match(text,/VS CODE/);
@@ -20,7 +20,7 @@ test('production README documents one-command stdio configs for major MCP client
   assert.match(text,/CODEX/);
   assert.match(text,/\[mcp_servers\.deadbyte\]/);
   assert.match(text,/command\s*=\s*"npx"/);
-  assert.match(text,/args\s*=\s*\["-y",\s*"deadbyte-mcp@0\.11\.3",\s*"mcp"\]/);
+  assert.match(text,/args\s*=\s*\["-y",\s*"deadbyte-mcp@0\.15\.2",\s*"mcp"\]/);
 });
 
 test('production README records tracer bullet, semantic scope, remote UX, safety and document extension',async()=>{

package/test/r33-closeout-regression.test.mjs

@@ -86,23 +86,24 @@ test('audit restart reconciles an orphan request with an explicit interrupted re
   }finally{await rm(stateRoot,{recursive:true,force:true});}
 });
 
-test('Windows current R44 gate emits signed-R43-parent feature evidence outside the candidate tree', async()=>{
-  const stateRoot=await temp('deadbyte-r44-windows-evidence-');
-  try{
-    const gate=await readFile(path.join(root,'scripts','gate-windows-r44.ps1'),'utf8');
-    assert.match(gate,/windows-gate-evidence-r44\.mjs/);assert.match(gate,/r44-parent-verify/);
-    const manifestSha=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
-    const {writeWindowsGateEvidence}=await import('../scripts/windows-gate-evidence-r44.mjs');
-    const summary=await writeWindowsGateEvidence({candidateRoot:root,stateRoot,clock:()=>new Date('2026-09-21T00:01:00.000Z')});
-    const evidence=JSON.parse(await readFile(summary.path,'utf8'));
-    assert.equal(evidence.schema,'deadbyte.r44-windows-gate.v1');assert.equal(evidence.version,'0.15.0');
-    assert.equal(evidence.manifest_sha256,manifestSha);
-    assert.equal(evidence.marker,'DEADBYTE V0.15.0 / R44 REMOTE AGENT SKILL WINDOWS BATCH GATE: PASS');
-    assert.equal(evidence.parent.release_id,'v0.14.1-0a5a833892593283');
-    assert.equal(evidence.parent.final_closure_sha256,'2f29e94dd726638c23b2e520a608dcf2a6919e43348855be3940599d557f920b');
-    for(const key of ['skill_integrity','agent_backend_persistence','codex_protocol_contract','remote_device_identity','durable_job_supervisor','real_external_supervisor_smoke','full_regression_required']) assert.equal(evidence.features[key],true,key);
-    assert.ok(summary.path.startsWith(path.join(stateRoot,'evidence','release')));
-    const historical=await readFile(path.join(root,'scripts','windows-gate-evidence-r43.mjs'),'utf8');
-    assert.match(historical,/version:'0\.14\.1'/);assert.match(historical,/deadbyte\.r43-windows-gate\.v1/);
-  }finally{await rm(stateRoot,{recursive:true,force:true});}
+test('Windows current R45 gate binds exact sealed R44 parent and machine-freedom evidence contract', async()=>{
+  const gate=await readFile(path.join(root,'scripts','gate-windows-r45.ps1'),'utf8');
+  const evidenceSource=await readFile(path.join(root,'scripts','windows-gate-evidence-r45.mjs'),'utf8');
+  const parent=JSON.parse(await readFile(path.join(root,'R45-PARENT.json'),'utf8'));
+  assert.match(gate,/windows-gate-evidence-r45\.mjs/);
+  assert.match(gate,/r45-parent-verify/);
+  assert.match(gate,/host-policy-refresh/);
+  assert.match(gate,/hardware-build/);
+  assert.match(gate,/doctor/);
+  assert.match(evidenceSource,/deadbyte\.r45-windows-gate\.v1/);
+  assert.match(evidenceSource,/version:'0\.15\.1'/);
+  assert.match(evidenceSource,/DEADBYTE V0\.15\.1 \/ R45 MACHINE FREEDOM WINDOWS BATCH GATE: PASS/);
+  for(const key of ['host_inline_native','native_hardware_observation','doctor_release_truth']) assert.match(evidenceSource,new RegExp(key+':true'));
+  assert.equal(parent.parent_release_id,'v0.15.0-c15fa41719be61b3');
+  assert.equal(parent.parent_manifest_sha256,'c15fa41719be61b3186e49b2367a5f4c057365cfb465102dbefb7d7355f45483');
+  assert.equal(parent.parent_generation_manifest_sha256,'6d7429c050b7fe893492e102f00282019116e0c9e54e4f25a5791defa1661d30');
+  assert.equal(parent.parent_final_closure_sha256,'533b7e0ff9ded04086dd90ed34e3b87bc427acc3c55c25bb9f4ec66cb448e667');
+  const historical=await readFile(path.join(root,'scripts','windows-gate-evidence-r44.mjs'),'utf8');
+  assert.match(historical,/version:'0\.15\.0'/);
+  assert.match(historical,/deadbyte\.r44-windows-gate\.v1/);
 });

package/test/r33-finalization.test.mjs

@@ -19,9 +19,9 @@ test('R34 public parity catalog is exact, unique, and includes production coding
 
 test('release parity and final verifier are package entry points', async () => {
   const pkg = JSON.parse(await text('package.json'));
-  assert.equal(pkg.scripts['release:parity'], 'node scripts/release-parity-r44.mjs');
-  assert.equal(pkg.scripts['release:final:write'], 'node scripts/final-closure-r44.mjs');
-  assert.equal(pkg.scripts['release:final:verify'], 'node scripts/final-closure-verify-r44.mjs');
+  assert.equal(pkg.scripts['release:parity'], 'node scripts/release-parity-r46.mjs');
+  assert.equal(pkg.scripts['release:final:write'], 'node scripts/final-closure-r46.mjs');
+  assert.equal(pkg.scripts['release:final:verify'], 'node scripts/final-closure-verify-r46.mjs');
   assert.equal(typeof validateParityEvidence, 'function');
   assert.equal(typeof verifyFinalClosureObject, 'function');
 });

package/test/r45-autonomous-quick-test.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+test('R45 autonomous quick-test is fixture-scoped and does not invoke legacy npm test matrix', async () => {
+  const text=await readFile(new URL('../scripts/autonomous-tests.ps1',import.meta.url),'utf8');
+  assert.match(text,/node\.exe --test test\/autonomous-live-fixture\.test\.mjs/);
+  assert.doesNotMatch(text,/npm\.cmd test/);
+  assert.match(text,/R24 QUICK TEST PASS/);
+});