deadbyte-mcp 0.15.0 → 0.15.2

package/src/compact-gateway-mcp-tools.mjs

@@ -26,7 +26,7 @@ export const codingInspectInputSchema=z.discriminatedUnion('op',[
 export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('stat'),root_id:id,path:rel.default('.'),hash:z.boolean().default(false)}),
   z.strictObject({op:z.literal('list'),root_id:id,path:rel.default('.'),cursor,limit:z.number().int().min(1).max(1000).default(100),hash_files:z.boolean().default(false)}),
-  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false)}),
+  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false),timeout_ms:z.number().int().min(100).max(180000).default(30000)}),
   z.strictObject({op:z.literal('write'),root_id:id,path:rel,content:z.string().max(12*1024*1024),encoding:z.enum(['utf8','base64']).default('utf8'),expected_sha256:z.string().regex(/^(?:absent|[0-9a-f]{64})$/)}),
   z.strictObject({op:z.literal('edit_exact'),root_id:id,path:rel,expected_sha256:hex64,old_string:z.string().min(1).max(262144),new_string:z.string().max(524288),expected_replacements:z.number().int().min(1).max(64).default(1)}),
   z.strictObject({op:z.literal('mkdir'),root_id:id,path:rel}),
@@ -36,7 +36,8 @@ export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
 
 export const processSessionGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('start'),profile_id:id,root_id:id,cwd:rel.default('.'),args:z.array(z.string().max(8192)).max(64).default([])}),
-  z.strictObject({op:z.literal('read'),session_id:hex64,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(262144).default(65536)}),
+  z.strictObject({op:z.literal('read'),session_id:hex64,offset:z.number().int().min(-(16*1024*1024)).default(0),max_bytes:z.number().int().min(1).max(262144).default(65536),wait_ms:z.number().int().min(0).max(30000).default(0),wait_for:z.string().min(1).max(256).nullable().default(null)}),
+  z.strictObject({op:z.literal('write'),session_id:hex64,input:z.string().min(1).max(1024*1024),append_newline:z.boolean().default(true)}),
   z.strictObject({op:z.literal('status'),session_id:hex64}),
   z.strictObject({op:z.literal('list')}),
   z.strictObject({op:z.literal('action'),session_id:hex64,action_id:id}),
@@ -52,7 +53,8 @@ export const machineObserveInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('search_status'),search_id:hex64}),
   z.strictObject({op:z.literal('search_cancel'),search_id:hex64}),
   z.strictObject({op:z.literal('process_list'),limit:z.number().int().min(1).max(256).default(100),include_external:z.boolean().default(false),cursor:z.string().max(512).nullable().default(null)}),
-  z.strictObject({op:z.literal('system_status')})
+  z.strictObject({op:z.literal('system_status')}),
+  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])})
 ]);
 
 const capabilityManifestInputSchema=z.strictObject({});
@@ -82,7 +84,7 @@ async function machineFs(args,runtime){
   const map={
     stat:r=>r.stat({rootId:args.root_id,relativePath:args.path,hash:args.hash}),
     list:r=>r.list({rootId:args.root_id,relativePath:args.path,cursor:args.cursor,limit:args.limit,hashFiles:args.hash_files}),
-    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file}),
+    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file,timeoutMs:args.timeout_ms}),
     write:r=>r.write({rootId:args.root_id,relativePath:args.path,content:args.content,encoding:args.encoding,expectedSha256:args.expected_sha256}),
     edit_exact:r=>r.editExact({rootId:args.root_id,relativePath:args.path,expectedSha256:args.expected_sha256,oldString:args.old_string,newString:args.new_string,expectedReplacements:args.expected_replacements}),
     mkdir:r=>r.mkdir({rootId:args.root_id,relativePath:args.path}),
@@ -95,7 +97,8 @@ async function machineFs(args,runtime){
 async function processSession(args,runtime){
   const map={
     start:r=>r.start({profileId:args.profile_id,rootId:args.root_id,cwd:args.cwd,args:args.args}),
-    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes}),
+    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes,waitMs:args.wait_ms,waitFor:args.wait_for}),
+    write:r=>r.write({sessionId:args.session_id,input:args.input,appendNewline:args.append_newline}),
     status:r=>r.status({sessionId:args.session_id}),
     list:r=>r.list(),
     action:r=>r.action({sessionId:args.session_id,actionId:args.action_id}),
@@ -114,7 +117,8 @@ async function machineObserve(args,machineRuntime,observationRuntime){
     search_status:r=>r.searchStatus({searchId:args.search_id}),
     search_cancel:r=>r.searchCancel({searchId:args.search_id}),
     process_list:r=>r.processList({limit:args.limit,includeExternal:args.include_external,cursor:args.cursor}),
-    system_status:r=>r.systemStatus()
+    system_status:r=>r.systemStatus(),
+    hardware_query:r=>r.hardwareQuery({query:args.query})
   };
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }
@@ -134,7 +138,7 @@ export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));
   server.registerTool('machine_fs',{description:'Typed compact machine filesystem gateway preserving root policy and mutation preconditions.',inputSchema:machineFsGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineFs(args,machineFsRuntime));
-  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. No raw stdin or PID authority.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
+  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. Raw input is available only for locally opt-in profiles and remains grant-bounded; numeric PID authority is never exposed.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
   server.registerTool('machine_observe',{description:'Typed compact machine identity and read-only observation gateway. Revoke is intentionally excluded.',inputSchema:machineObserveInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineObserve(args,machineRuntime,observationRuntime));
   server.registerTool('desktop_control',{description:'Typed Desktop observe, target, status and guarded action gateway. No arbitrary dispatch; mutation still requires separate Desktop authority.',inputSchema:desktopControlInputSchema,outputSchema:compactGatewayOutputSchema},args=>invokeDesktopOperation(args,desktopRuntime));
 }

package/src/deadbyte-cli.mjs

@@ -10,12 +10,14 @@ import { defaultPublicKeyPath } from './trust.mjs';
 import { verifyAuditChain } from './audit-verify.mjs';
 import { openRemoteResultJournal, parseRemoteResultCursor } from './remote-result-journal.mjs';
 import { DEADBYTE_VERSION } from './version.mjs';
+import { printDoctor } from './doctor-r45.mjs';
 import { createLiveTimelineTracker, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine } from './remote-live-log.mjs';
 import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
   'armprocess','disarmprocess','processstatus','armhost','disarmhost','hoststatus','hosttest',
+  'armdesktop','disarmdesktop','desktopstatus',
   'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
 ]);
 const SESSION_ARM=['armprocess','armcoding','armautonomous'];
@@ -35,17 +37,19 @@ const SUPERVISOR_COMMANDS=Object.freeze({
 function stateRoot(){return path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));}
 async function requireRegular(file,label){const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()) throw new Error(`${label} must be a regular non-symlink file`);return file;}
 function printHelp(){
+  const exact=`deadbyte-mcp@${DEADBYTE_VERSION}`;
   process.stdout.write([
     'DEADBYTE MCP CLI','',
-    '  npx deadbyte-mcp@latest mcp                 # stdio MCP server for local clients',
-    '  npx deadbyte-mcp@latest remote              # unified foreground device session + live timeline',
-    '  npx deadbyte-mcp@latest remote --resume <cursor> # replay missed results, then reconnect',
-    '  npx deadbyte-mcp@latest remote status',
-    '  npx deadbyte-mcp@latest remote restart',
-    '  npx deadbyte-mcp@latest supervisor status',
-    '  npx deadbyte-mcp@latest supervisor recover',
-    '  npx deadbyte-mcp@latest audit verify',
-    '  npx deadbyte-mcp@latest audit status',''
+    `  npx -y ${exact} doctor              # verify current package/release truth`,
+    `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
+    `  npx -y ${exact} remote              # unified foreground device session + live timeline`,
+    `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
+    `  npx -y ${exact} remote status`,
+    `  npx -y ${exact} remote restart`,
+    `  npx -y ${exact} supervisor status`,
+    `  npx -y ${exact} supervisor recover`,
+    `  npx -y ${exact} audit verify`,
+    `  npx -y ${exact} audit status`,''
   ].join('\n'));
 }
 async function remoteContext(){
@@ -83,6 +87,9 @@ function controllerRuntimeReady(text){
     /^Local ready\s*:\s*True\s*$/m.test(value)&&
     /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
 }
+function controllerRuntimeDegraded(text){
+  return /^DEADBYTE MCP\s*=\s*DEGRADED\s*$/m.test(String(text||''));
+}
 async function listLogFiles(root){
   const files=[];
   const audit=path.join(root,'audit');
@@ -315,10 +322,11 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
     if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
       process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     }else{
-      process.stdout.write('[BOOT] Starting bridge/runtime...\n');
-      invokeController(ctx,'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
+      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
+      process.stdout.write(recovery?'[RECOVERY] Runtime DEGRADED; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      invokeController(ctx,recovery?'restart':'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
       const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error('remote controller start returned without a verified ONLINE runtime');
+      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
       startText=started.stdout||'';
     }
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
@@ -388,6 +396,10 @@ async function main(argv){
     process.stdout.write(`${DEADBYTE_VERSION}\n`);return;
   }
   if(!command||command==='help'||command==='--help'||command==='-h'){printHelp();return;}
+  if(command==='doctor'){
+    if(rest.length) throw new Error('doctor accepts no arguments');
+    await printDoctor();return;
+  }
   if(command==='mcp'){
     if(rest.length) throw new Error('mcp accepts no arguments');
     await import('./mcp-server.mjs');

package/src/doctor-r45.mjs

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+import { lstat, readFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { DEADBYTE_VERSION, MCP_PROTOCOL_VERSION } from './version.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=()=>path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=b=>createHash('sha256').update(b).digest('hex');
+async function jsonOrNull(file){try{return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));}catch(e){if(e?.code==='ENOENT')return null;throw e;}}
+async function fileHash(file){return sha256(await readFile(file));}
+function parseManifest(text){
+ const rows=[];
+ for(const [index,line] of text.split(/\r?\n/).entries()){
+  if(!line) continue;
+  const m=/^([0-9a-f]{64})  (.+)$/.exec(line);
+  if(!m) throw new Error(`manifest line ${index+1} malformed`);
+  if(path.isAbsolute(m[2])||m[2].includes('..')||m[2].includes('\\')) throw new Error(`manifest line ${index+1} path unsafe`);
+  rows.push({sha256:m[1],relative:m[2]});
+ }
+ return rows;
+}
+export async function doctor(){
+ const manifestPath=path.join(root,'MANIFEST.SHA256');
+ const manifestBytes=await readFile(manifestPath);
+ const manifestSha256=sha256(manifestBytes);
+ const rows=parseManifest(manifestBytes.toString('utf8'));
+ let verified=0;
+ for(const row of rows){
+  const file=path.join(root,...row.relative.split('/'));
+  const st=await lstat(file);
+  if(!st.isFile()||st.isSymbolicLink()) throw new Error(`manifest entry not regular file: ${row.relative}`);
+  const actual=await fileHash(file);
+  if(actual!==row.sha256) throw new Error(`manifest hash mismatch: ${row.relative}`);
+  verified+=1;
+ }
+ const metadata={};
+ for(const name of ['RELEASE.json','TEST-MATRIX.json','PROVENANCE.json','SBOM.cdx.json']){
+  const file=path.join(root,name),body=await jsonOrNull(file);
+  if(!body) throw new Error(`required release metadata missing: ${name}`);
+  metadata[name]={sha256:await fileHash(file),schema:body.schema??body.bomFormat??null};
+ }
+ const release=await jsonOrNull(path.join(root,'RELEASE.json'));
+ if(release?.version!==DEADBYTE_VERSION) throw new Error('RELEASE.json version mismatch');
+ const hardware=path.join(root,'bin','deadbyte-hardware-observer-r45.exe');
+ const hardwareStat=await lstat(hardware);
+ if(!hardwareStat.isFile()||hardwareStat.isSymbolicLink()) throw new Error('hardware observer must be a regular file');
+ const hardwareSha256=await fileHash(hardware);
+ const active=await jsonOrNull(path.join(stateRoot(),'active-release.json'));
+ const hostPolicy=await jsonOrNull(path.join(root,'controller','deadbyte-host-policy.json'));
+ if(hostPolicy&&release?.train==='R45'&&process.platform==='win32'&&hostPolicy.schema!=='deadbyte.host-policy.v2') throw new Error('R45 doctor rejects non-v2 generated host policy');
+ return {
+  schema:'deadbyte.doctor.v1',status:'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  platform:{current:process.platform,architecture:process.arch,primary:'win32',supported:process.platform==='win32'},
+  manifest:{sha256:manifestSha256,entries:rows.length,verified_entries:verified,verified:true},
+  release_metadata:metadata,
+  native:{hardware_observer:{path:'bin/deadbyte-hardware-observer-r45.exe',sha256:hardwareSha256,bytes:hardwareStat.size}},
+  policy:{host_schema:hostPolicy?.schema??null,host_v2_ready:hostPolicy?.schema==='deadbyte.host-policy.v2'},
+  active_release:active?{release_id:active.release_id,version:active.version,manifest_sha256:active.manifest_sha256,generation_manifest_sha256:active.generation_manifest_sha256,
+    candidate_active:active.version===DEADBYTE_VERSION&&active.manifest_sha256===manifestSha256}:null,
+  known_unsupported:process.platform==='win32'?[]:['native_hardware_observation','windows_controller','desktop_native']
+ };
+}
+export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');return value;}

package/src/host-plane.mjs

@@ -16,6 +16,7 @@ import { decodeUtf8Strict } from './text-policy.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 
 export const HOST_POLICY_SCHEMA = 'deadbyte.host-policy.v1';
+export const HOST_POLICY_SCHEMA_V2 = 'deadbyte.host-policy.v2';
 export const HOST_ARM_SCHEMA = 'deadbyte.host-arm.v1';
 export const HOST_GRANT_SCHEMA = 'deadbyte.host-grant.v2';
 export const HOST_DEFAULT_MAX_READ_BYTES = 256 * 1024;
@@ -45,7 +46,7 @@ function finiteInteger(value, name, min, max, fallback) {
 
 function normalizePolicyObject(raw, policyPath) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('host policy must be a JSON object');
-  if (raw.schema !== HOST_POLICY_SCHEMA) throw new Error('host policy schema mismatch');
+  if (![HOST_POLICY_SCHEMA, HOST_POLICY_SCHEMA_V2].includes(raw.schema)) throw new Error('host policy schema mismatch');
   if (raw.enabled !== true) throw new Error('host policy is not enabled');
   if (!raw.arm_file || typeof raw.arm_file !== 'string' || !path.isAbsolute(raw.arm_file)) {
     throw new Error('host policy arm_file must be absolute');
@@ -75,7 +76,10 @@ function normalizePolicyObject(raw, policyPath) {
   for (const [id, value] of Object.entries(raw.commands)) {
     if (!COMMAND_ID_RE.test(id)) throw new Error(`invalid host command id '${id}'`);
     if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`host command '${id}' malformed`);
-    if (value.kind !== 'script') throw new Error(`host command '${id}' kind must be script`);
+    const kind=value.kind;
+    if (kind!=='script' && !(raw.schema===HOST_POLICY_SCHEMA_V2 && kind==='inline')) {
+      throw new Error(`host command '${id}' kind must be script${raw.schema===HOST_POLICY_SCHEMA_V2?' or inline':''}`);
+    }
     if (typeof value.executable !== 'string' || !path.isAbsolute(value.executable)) {
       throw new Error(`host command '${id}' executable must be absolute`);
     }
@@ -86,37 +90,60 @@ function normalizePolicyObject(raw, policyPath) {
     if (rootIds.length === 0 || rootIds.some(rootId => !ROOT_ID_RE.test(rootId) || !roots[rootId])) {
       throw new Error(`host command '${id}' root_ids invalid`);
     }
-    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string')) {
+    if (!Array.isArray(value.prefix_args) || value.prefix_args.some(x => typeof x !== 'string' || x.includes('\0'))) {
       throw new Error(`host command '${id}' prefix_args must be strings`);
     }
-    if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
-        value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
-      throw new Error(`host command '${id}' extensions invalid`);
-    }
-    commands[id] = {
-      kind: 'script',
+    const base={
+      kind,
       executable: path.resolve(value.executable),
       executable_sha256: value.executable_sha256.toLowerCase(),
       root_ids: [...new Set(rootIds)],
       prefix_args: [...value.prefix_args],
-      extensions: value.extensions.map(x => x.toLowerCase()),
       timeout_ms: finiteInteger(value.timeout_ms, `commands.${id}.timeout_ms`, 100, 300_000, HOST_DEFAULT_TIMEOUT_MS),
       max_output_bytes: finiteInteger(value.max_output_bytes, `commands.${id}.max_output_bytes`, 1024, 4 * 1024 * 1024, HOST_DEFAULT_MAX_OUTPUT_BYTES)
     };
+    if(kind==='script'){
+      if (!Array.isArray(value.extensions) || value.extensions.length === 0 ||
+          value.extensions.some(x => typeof x !== 'string' || !/^\.[A-Za-z0-9._-]+$/.test(x))) {
+        throw new Error(`host command '${id}' extensions invalid`);
+      }
+      base.extensions=value.extensions.map(x => x.toLowerCase());
+    } else {
+      base.max_command_chars=finiteInteger(value.max_command_chars,`commands.${id}.max_command_chars`,1,262144,32768);
+    }
+    commands[id]=base;
+  }
+
+  let nativeExec={enabled:false,root_ids:[],timeout_ms:HOST_DEFAULT_TIMEOUT_MS,max_output_bytes:HOST_DEFAULT_MAX_OUTPUT_BYTES,max_args:64,max_arg_chars:8192};
+  if(raw.schema===HOST_POLICY_SCHEMA_V2 && raw.native_exec!==undefined){
+    const value=raw.native_exec;
+    if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('host native_exec malformed');
+    if(value.enabled===true){
+      const rootIds=Array.isArray(value.root_ids)?value.root_ids:[];
+      if(rootIds.length===0||rootIds.some(rootId=>!ROOT_ID_RE.test(rootId)||!roots[rootId])) throw new Error('host native_exec root_ids invalid');
+      nativeExec={
+        enabled:true,
+        root_ids:[...new Set(rootIds)],
+        timeout_ms:finiteInteger(value.timeout_ms,'native_exec.timeout_ms',100,300000,HOST_DEFAULT_TIMEOUT_MS),
+        max_output_bytes:finiteInteger(value.max_output_bytes,'native_exec.max_output_bytes',1024,4*1024*1024,HOST_DEFAULT_MAX_OUTPUT_BYTES),
+        max_args:finiteInteger(value.max_args,'native_exec.max_args',0,64,64),
+        max_arg_chars:finiteInteger(value.max_arg_chars,'native_exec.max_arg_chars',1,32768,8192)
+      };
+    }
   }
 
   return {
-    schema: HOST_POLICY_SCHEMA,
+    schema: raw.schema,
     enabled: true,
     policy_path: path.resolve(policyPath),
     arm_file: path.resolve(raw.arm_file),
     roots,
     commands,
+    native_exec:nativeExec,
     max_read_bytes: finiteInteger(raw.max_read_bytes, 'max_read_bytes', 1, 4 * 1024 * 1024, HOST_DEFAULT_MAX_READ_BYTES),
     max_write_bytes: finiteInteger(raw.max_write_bytes, 'max_write_bytes', 1, 8 * 1024 * 1024, HOST_DEFAULT_MAX_WRITE_BYTES)
   };
 }
-
 export async function loadHostPolicy(policyPath) {
   if (!policyPath) throw new Error('missing DEADBYTE privileged host policy path');
   const absolute = path.resolve(policyPath);
@@ -345,6 +372,93 @@ function collectBounded(stream, limit, state, label, onExceeded) {
   });
 }
 
+function validateHostArgs(args,maxArgs=64,maxChars=2048,label='host exec args'){
+  if(!Array.isArray(args)||args.length>maxArgs||args.some(x=>typeof x!=='string'||x.length>maxChars||x.includes('\0'))){
+    throw new Error(`${label} must be <=${maxArgs} strings of <=${maxChars} characters`);
+  }
+}
+async function resolveExecCwd(policy,rootId,cwd){
+  const root=getRoot(policy,rootId,'exec');
+  let cwdResolved=root.real_path;
+  if(cwd!=='.'){
+    validatePortableRelativePath(cwd);
+    cwdResolved=path.resolve(root.real_path,cwd);
+    if(!isInside(root.real_path,cwdResolved)) throw new Error('host exec cwd escapes allowed root');
+    const realCwd=await realpath(cwdResolved);
+    if(!isInside(root.real_path,realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
+    const cwdStat=await stat(realCwd);
+    if(!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
+    cwdResolved=realCwd;
+  }
+  return cwdResolved;
+}
+async function runHostChild(policy,armed,{executable,argv,cwd,timeoutMs,maxTimeoutMs,maxOutputBytes,authorityPollMs=100}){
+  const activeArm=await recheckHostAuthority(policy,armed);
+  const grantBound=Number.isFinite(activeArm.remaining_ms)?Math.floor(activeArm.remaining_ms):maxTimeoutMs;
+  if(grantBound<100) throw new Error('privileged host plane arm lease expires too soon');
+  const requested=timeoutMs===null||timeoutMs===undefined?maxTimeoutMs:finiteInteger(timeoutMs,'timeout_ms',100,maxTimeoutMs,maxTimeoutMs);
+  const effectiveTimeout=Math.min(requested,maxTimeoutMs,grantBound);
+  const child=spawn(executable,argv,{cwd,env:scrubHostEnvironment(),shell:false,windowsHide:true,detached:false,stdio:['ignore','pipe','pipe']});
+  const stdoutState={chunks:[],bytes:0,exceeded:null};
+  const stderrState={chunks:[],bytes:0,exceeded:null};
+  const kill=()=>{try{child.kill('SIGKILL');}catch{}};
+  collectBounded(child.stdout,maxOutputBytes,stdoutState,'stdout',kill);
+  collectBounded(child.stderr,maxOutputBytes,stderrState,'stderr',kill);
+  let timedOut=false,authorityError=null,timer=null,poller=null;
+  const completion=new Promise((resolve,reject)=>{
+    child.once('error',reject);
+    child.once('close',(code,signal)=>resolve({code,signal}));
+    timer=setTimeout(()=>{timedOut=true;kill();},effectiveTimeout); timer.unref?.();
+    const poll=Math.max(25,Math.min(1000,Number.isInteger(authorityPollMs)?authorityPollMs:100));
+    poller=setInterval(()=>{void recheckHostAuthority(policy,armed).catch(error=>{if(!authorityError){authorityError=error;kill();}});},poll); poller.unref?.();
+  });
+  let result;
+  try{result=await completion;}finally{if(timer)clearTimeout(timer);if(poller)clearInterval(poller);}
+  if(authorityError) throw authorityError;
+  if(stdoutState.exceeded||stderrState.exceeded) throw new Error(stdoutState.exceeded??stderrState.exceeded);
+  const stdoutBytes=Buffer.concat(stdoutState.chunks),stderrBytes=Buffer.concat(stderrState.chunks);
+  return {
+    exit_code:result.code,signal:result.signal,timed_out:timedOut,timeout_ms:effectiveTimeout,
+    stdout:decodeUtf8Strict(stdoutBytes),stderr:decodeUtf8Strict(stderrBytes),
+    stdout_sha256:sha256Bytes(stdoutBytes),stderr_sha256:sha256Bytes(stderrBytes),
+    argv_sha256:sha256Bytes(Buffer.from(JSON.stringify(argv),'utf8'))
+  };
+}
+
+export async function hostExecInline(policy,{commandId,rootId,command,cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  if(!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
+  const spec=policy.commands[commandId];
+  if(!spec||spec.kind!=='inline') throw new Error(`host inline command '${commandId}' is not allowed`);
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof command!=='string'||command.length<1||command.length>spec.max_command_chars||command.includes('\0')) throw new Error('host inline command exceeds policy bounds');
+  const actualExecutableHash=await sha256File(spec.executable);
+  if(actualExecutableHash!==spec.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...spec.prefix_args,command];
+  const result=await runHostChild(policy,armed,{executable:spec.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:commandId,mode:'inline',executable_sha256:actualExecutableHash,command_sha256:sha256Bytes(Buffer.from(command,'utf8')),...result};
+}
+
+export async function hostExecNative(policy,{rootId,executable,executableSha256,args=[],cwd='.',timeoutMs=null,authorityPollMs=100}){
+  const armed=await assertHostArmed(policy);
+  const spec=policy.native_exec;
+  if(!spec?.enabled) throw new Error('host native exec is not enabled by policy');
+  if(!ROOT_ID_RE.test(rootId)||!spec.root_ids.includes(rootId)) throw new Error(`host native exec is not allowed for root '${rootId}'`);
+  getRoot(policy,rootId,'exec');
+  if(typeof executable!=='string'||!path.isAbsolute(executable)) throw new Error('host native executable must be absolute');
+  if(typeof executableSha256!=='string'||!SHA256_RE.test(executableSha256)) throw new Error('executable_sha256 must be a lowercase SHA-256 digest');
+  validateHostArgs(args,spec.max_args,spec.max_arg_chars,'host native args');
+  const resolved=path.resolve(executable); const info=await stat(resolved);
+  if(!info.isFile()) throw new Error('host native executable is not a file');
+  const actualExecutableHash=await sha256File(resolved);
+  if(actualExecutableHash!==executableSha256) throw new Error(`host native executable hash mismatch: expected ${executableSha256}, found ${actualExecutableHash}`);
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const result=await runHostChild(policy,armed,{executable:resolved,argv:[...args],cwd:cwdResolved,timeoutMs,maxTimeoutMs:spec.timeout_ms,maxOutputBytes:spec.max_output_bytes,authorityPollMs});
+  return {command_id:'native',mode:'native',executable_sha256:actualExecutableHash,...result};
+}
+
 export async function hostExec(policy, {
   commandId,
   rootId,
@@ -357,14 +471,12 @@ export async function hostExec(policy, {
   const armed = await assertHostArmed(policy);
   if (!COMMAND_ID_RE.test(commandId)) throw new Error('invalid host command id');
   const command = policy.commands[commandId];
-  if (!command) throw new Error(`host command '${commandId}' is not allowed`);
-  if (!Array.isArray(args) || args.length > 64 || args.some(x => typeof x !== 'string' || x.length > 2048 || x.includes('\0'))) {
-    throw new Error('host exec args must be <=64 strings of <=2048 characters');
-  }
+  if (!command || command.kind!=='script') throw new Error(`host command '${commandId}' is not allowed as a script command`);
+  validateHostArgs(args,64,2048,'host exec args');
   if (typeof scriptSha256 !== 'string' || !SHA256_RE.test(scriptSha256)) throw new Error('script_sha256 must be a lowercase SHA-256 digest');
 
   if (!ROOT_ID_RE.test(rootId) || !command.root_ids.includes(rootId)) throw new Error(`host command '${commandId}' is not allowed for root '${rootId}'`);
-  const root = getRoot(policy, rootId, 'exec');
+  getRoot(policy, rootId, 'exec');
   const script = await resolveHostExisting(policy, rootId, scriptPath, 'exec');
   const extension = path.extname(script.resolved).toLowerCase();
   if (!command.extensions.includes(extension)) throw new Error(`script extension '${extension}' is not allowed for '${commandId}'`);
@@ -373,72 +485,8 @@ export async function hostExec(policy, {
 
   const actualExecutableHash = await sha256File(command.executable);
   if (actualExecutableHash !== command.executable_sha256) throw new Error(`host command '${commandId}' executable hash changed`);
-
-  let cwdResolved = root.real_path;
-  if (cwd !== '.') {
-    validatePortableRelativePath(cwd);
-    cwdResolved = path.resolve(root.real_path, cwd);
-    if (!isInside(root.real_path, cwdResolved)) throw new Error('host exec cwd escapes allowed root');
-    const realCwd = await realpath(cwdResolved);
-    if (!isInside(root.real_path, realCwd)) throw new Error('host exec cwd symlink escapes allowed root');
-    const cwdStat = await stat(realCwd);
-    if (!cwdStat.isDirectory()) throw new Error('host exec cwd must be a directory');
-    cwdResolved = realCwd;
-  }
-
-  const requestedTimeout = timeoutMs === null ? command.timeout_ms : finiteInteger(timeoutMs, 'timeout_ms', 100, command.timeout_ms, command.timeout_ms);
-  const activeArm = await recheckHostAuthority(policy, armed);
-  const grantBound = Number.isFinite(activeArm.remaining_ms) ? Math.floor(activeArm.remaining_ms) : command.timeout_ms;
-  if (grantBound < 100) throw new Error('privileged host plane arm lease expires too soon');
-  const effectiveTimeout = Math.min(requestedTimeout, command.timeout_ms, grantBound);
-  const argv = [...command.prefix_args, script.resolved, ...args];
-
-  const child = spawn(command.executable, argv, {
-    cwd: cwdResolved,
-    env: scrubHostEnvironment(),
-    shell: false,
-    windowsHide: true,
-    detached: false,
-    stdio: ['ignore', 'pipe', 'pipe']
-  });
-
-  const stdoutState = { chunks: [], bytes: 0, exceeded: null };
-  const stderrState = { chunks: [], bytes: 0, exceeded: null };
-  collectBounded(child.stdout, command.max_output_bytes, stdoutState, 'stdout', () => child.kill('SIGKILL'));
-  collectBounded(child.stderr, command.max_output_bytes, stderrState, 'stderr', () => child.kill('SIGKILL'));
-
-  let timedOut = false;
-  let timer;
-  const completion = new Promise((resolve, reject) => {
-    child.once('error', reject);
-    child.once('close', (code, signal) => resolve({ code, signal }));
-    timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGKILL');
-    }, effectiveTimeout);
-    timer.unref?.();
-  });
-  let result;
-  try {
-    result = await completion;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-
-  if (stdoutState.exceeded || stderrState.exceeded) {
-    throw new Error(stdoutState.exceeded ?? stderrState.exceeded);
-  }
-  const stdoutBytes = Buffer.concat(stdoutState.chunks);
-  const stderrBytes = Buffer.concat(stderrState.chunks);
-  return {
-    command_id: commandId,
-    executable_sha256: actualExecutableHash,
-    script_sha256: actualScriptHash,
-    exit_code: result.code,
-    signal: result.signal,
-    timed_out: timedOut,
-    timeout_ms: effectiveTimeout,
-    stdout: decodeUtf8Strict(stdoutBytes),
-    stderr: decodeUtf8Strict(stderrBytes)
-  };
+  const cwdResolved=await resolveExecCwd(policy,rootId,cwd);
+  const argv=[...command.prefix_args,script.resolved,...args];
+  const result=await runHostChild(policy,armed,{executable:command.executable,argv,cwd:cwdResolved,timeoutMs,maxTimeoutMs:command.timeout_ms,maxOutputBytes:command.max_output_bytes});
+  return {command_id:commandId,mode:'script',executable_sha256:actualExecutableHash,script_sha256:actualScriptHash,...result};
 }

package/src/machine-fs-mcp-tools.mjs

@@ -32,10 +32,10 @@ export function registerMachineFsTools(server, { runtime }) {
   });
   server.registerTool('machine_fs_read', {
     description:'Read one bounded byte range from a root-relative regular file.',
-    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false) }),
+    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
     outputSchema:machineFsReadOutputSchema
-  }, async ({root_id,path,offset,max_bytes,hash_file}) => {
-    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file})); }
+  }, async ({root_id,path,offset,max_bytes,hash_file,timeout_ms}) => {
+    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file,timeoutMs:timeout_ms})); }
     catch (error) { return fail(machineFsReadOutputSchema,error); }
   });
   server.registerTool('machine_fs_write', {

package/src/machine-fs-output-contracts.mjs

@@ -33,7 +33,7 @@ export const machineFsReadOutputSchema = z.strictObject({
   offset: z.number().int().nonnegative().optional(), next_offset: z.number().int().nonnegative().optional(),
   file_size: z.number().int().nonnegative().optional(), eof: z.boolean().optional(),
   data_base64: z.string().max(12 * 1024 * 1024).optional(), data_sha256: hex64.optional(),
-  file_sha256: hex64.nullable().optional()
+  file_sha256: hex64.nullable().optional(), timeout_ms: z.number().int().min(100).max(180000).optional()
 });
 
 const commitBase = {

package/src/machine-fs-read-worker.mjs

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, promises as fs } from 'node:fs';
+
+const [file, offsetText, lengthText, hashText] = process.argv.slice(2);
+const offset = Number(offsetText);
+const length = Number(lengthText);
+if (typeof file !== 'string' || !Number.isSafeInteger(offset) || offset < 0 ||
+    !Number.isSafeInteger(length) || length < 0 || length > 4 * 1024 * 1024 ||
+    !['0','1'].includes(hashText ?? '0')) {
+  process.stderr.write('invalid machine-fs read worker arguments\n');
+  process.exit(64);
+}
+
+try {
+  const handle = await fs.open(file, 'r');
+  let bytes;
+  try {
+    const buffer = Buffer.alloc(length);
+    const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
+    bytes = buffer.subarray(0, result.bytesRead);
+  } finally {
+    await handle.close();
+  }
+
+  let fileSha256 = null;
+  if (hashText === '1') {
+    const hash = createHash('sha256');
+    await new Promise((resolve, reject) => {
+      const stream = createReadStream(file);
+      stream.on('data', chunk => hash.update(chunk));
+      stream.once('error', reject);
+      stream.once('end', resolve);
+    });
+    fileSha256 = hash.digest('hex');
+  }
+
+  process.stdout.write(JSON.stringify({
+    schema: 'deadbyte.machine-fs-read-worker.v1',
+    bytes_read: bytes.length,
+    data_base64: bytes.toString('base64'),
+    file_sha256: fileSha256
+  }));
+} catch (error) {
+  process.stderr.write(String(error?.stack ?? error));
+  process.exit(1);
+}