deadbyte-mcp 0.15.0 → 0.15.2

package/src/machine-fs.mjs

@@ -1,7 +1,9 @@
 import { createHash, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
 import { createReadStream } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { lstat, mkdir as fsMkdir, open, readFile, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { canonicalJson } from './canonical-json.mjs';
 import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
@@ -29,6 +31,55 @@ async function sha256File(file) {
   return hash.digest('hex');
 }
 
+const machineFsReadWorkerPath = fileURLToPath(new URL('./machine-fs-read-worker.mjs', import.meta.url));
+async function boundedReadWorker({ file, offset, length, hashFile, timeoutMs, workerPath = machineFsReadWorkerPath }) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [workerPath, file, String(offset), String(length), hashFile ? '1' : '0'], {
+      windowsHide: true, shell: false, stdio: ['ignore','pipe','pipe']
+    });
+    const stdout = [];
+    let stdoutBytes = 0;
+    let stderr = '';
+    let settled = false;
+    let timedOut = false;
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(value);
+    };
+    child.stdout.on('data', chunk => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > 8 * 1024 * 1024) {
+        child.kill();
+        finish(reject, new Error('machine fs read worker output exceeded bound'));
+        return;
+      }
+      stdout.push(Buffer.from(chunk));
+    });
+    child.stderr.on('data', chunk => { stderr = (stderr + chunk.toString('utf8')).slice(-16384); });
+    child.once('error', error => finish(reject, error));
+    child.once('close', code => {
+      if (settled) return;
+      if (timedOut) return finish(reject, new Error(`machine fs read timed out after ${timeoutMs}ms`));
+      if (code !== 0) return finish(reject, new Error(`machine fs read worker failed exit=${String(code)}: ${stderr}`));
+      let value;
+      try { value = JSON.parse(Buffer.concat(stdout).toString('utf8')); }
+      catch { return finish(reject, new Error('machine fs read worker returned invalid JSON')); }
+      if (value?.schema !== 'deadbyte.machine-fs-read-worker.v1' || !Number.isInteger(value.bytes_read) ||
+          typeof value.data_base64 !== 'string' || (value.file_sha256 !== null && !SHA256_RE.test(value.file_sha256 ?? ''))) {
+        return finish(reject, new Error('machine fs read worker response invalid'));
+      }
+      finish(resolve, value);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
 function getRoot(policy, rootId, permission) {
   const root = policy.roots[rootId];
   if (!root) throw new Error(`machine fs root '${rootId}' is not allowed`);
@@ -245,7 +296,7 @@ async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null)
   return { before, after };
 }
 
-export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }) {
+export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
   if (!policy) throw new Error('machine fs runtime requires coding policy');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('machine fs runtime requires trust key paths');
 
@@ -292,25 +343,27 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const nextCursor = filtered.length > selected.length && selected.length ? encodeCursor(selected.at(-1).name) : null;
     return { status: 'ok', root_id: rootId, path: found.relative, entries, next_cursor: nextCursor };
   }
-  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false }) {
+  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false, timeoutMs = 30000 }) {
     if (!Number.isInteger(offset) || offset < 0) throw new Error('machine fs read offset must be nonnegative integer');
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingArmed(policy, rootId);
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
     const info = await lstat(found.resolved);
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
     if (offset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const handle = await open(found.resolved, 'r');
     const length = Math.min(maxBytes, info.size - offset);
-    const buffer = Buffer.alloc(length);
-    try { if (length) await handle.read(buffer, 0, length, offset); }
-    finally { await handle.close(); }
-    const fileSha = hashFile ? await sha256File(found.resolved) : null;
+    await recheckCodingAuthority(policy, grant, rootId);
+    const worker = await boundedReadWorker({ file: found.resolved, offset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const buffer = Buffer.from(worker.data_base64, 'base64');
+    if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    await recheckCodingAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset, next_offset: offset + length, file_size: info.size,
-      eof: offset + length >= info.size, data_base64: buffer.toString('base64'),
-      data_sha256: sha256Bytes(buffer), file_sha256: fileSha
+      offset, next_offset: offset + buffer.length, file_size: info.size,
+      eof: offset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
+      timeout_ms: timeoutMs
     };
   }
 

package/src/mcp-server.mjs

@@ -14,8 +14,9 @@ import { defaultPrivateKeyPath, defaultPublicKeyPath, loadPrivateSigningKey, loa
 import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
+import { installStdioConsoleGuard } from './stdio-console-guard.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
-import { assertHostArmed, hostExec, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
+import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
 import { registerMachineTools } from './machine-mcp-tools.mjs';
 import { createAgentRuntime } from './agent-runtime.mjs';
@@ -75,8 +76,9 @@ if (!['0','1'].includes(auditRuntimeMode)) throw new Error('DEADBYTE_AUDIT_RUNTI
 const runtimeStateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(),'.deadbyte-mcp'));
 const surfaceProfile = capabilityProfileFromEnv(process.env);
 const localPrivilegedPolicyPath = path.join(packageRoot, 'controller', 'deadbyte-host-policy.json');
+const privilegedPolicyExplicit = Object.hasOwn(process.env, 'DEADBYTE_PRIVILEGED_POLICY');
 let privilegedPolicyPath = process.env.DEADBYTE_PRIVILEGED_POLICY ?? '';
-if (!privilegedPolicyPath) {
+if (!privilegedPolicyExplicit) {
   try {
     await access(localPrivilegedPolicyPath);
     privilegedPolicyPath = localPrivilegedPolicyPath;
@@ -230,6 +232,9 @@ const skillRoot=path.join(runtimeStateRoot,'skills');
 await mkdir(skillRoot,{recursive:true});
 const skillRuntime=await createSkillPlane({root:skillRoot,verifyKeyPath});
 
+installStdioConsoleGuard();
+if (process.env.DEADBYTE_STDIO_CONSOLE_GUARD_PROBE === '1') console.log('DEADBYTE_STDIO_CONSOLE_GUARD_PROBE');
+
 const ingressAdapterMode = currentIngressAdapterMode();
 installTunnelStdioProbeCompat({
   enabled: ingressAdapterMode === TUNNEL_STDIO_PROBE_COMPAT_MODE,
@@ -505,31 +510,71 @@ serveStdio(() => {
     toolServer.registerTool(
       'host_exec',
       {
-        description: 'Privileged host-plane script execution through a locally allowlisted and SHA-256-pinned executable. No raw shell command string is accepted. Requires a live local arm lease.',
-        inputSchema: z.strictObject({
-          command_id: z.string().min(1).max(64),
-          root_id: z.string().min(1).max(64),
-          script_path: z.string().min(1).max(512),
-          script_sha256: z.string().regex(/^[0-9a-f]{64}$/),
-          args: z.array(z.string().max(2048)).max(64).default([]),
-          cwd: z.string().min(1).max(512).default('.'),
-          timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
-        }),
+        description: 'Privileged Host execution with three bounded modes: legacy hash-pinned script, policy-approved inline argv memory, or absolute hash-pinned native executable argv. shell=false; live Host revocation is enforced.',
+        inputSchema: z.union([
+          z.strictObject({
+            mode: z.literal('script').optional().default('script'),
+            command_id: z.string().min(1).max(64),
+            root_id: z.string().min(1).max(64),
+            script_path: z.string().min(1).max(512),
+            script_sha256: z.string().regex(/^[0-9a-f]{64}$/),
+            args: z.array(z.string().max(2048)).max(64).default([]),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          }),
+          z.strictObject({
+            mode: z.literal('inline'),
+            command_id: z.string().min(1).max(64),
+            root_id: z.string().min(1).max(64),
+            command: z.string().min(1).max(262144),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          }),
+          z.strictObject({
+            mode: z.literal('native'),
+            root_id: z.string().min(1).max(64),
+            executable: z.string().min(1).max(2048),
+            executable_sha256: z.string().regex(/^[0-9a-f]{64}$/),
+            args: z.array(z.string().max(32768)).max(64).default([]),
+            cwd: z.string().min(1).max(512).default('.'),
+            timeout_ms: z.number().int().min(100).max(300000).nullable().default(null)
+          })
+        ]),
         outputSchema: hostExecOutputSchema
       },
-      async ({ command_id, root_id, script_path, script_sha256, args, cwd, timeout_ms }) => {
+      async args => {
         try {
-          const result = await hostExec(hostPolicy, {
-            commandId: command_id,
-            rootId: root_id,
-            scriptPath: script_path,
-            scriptSha256: script_sha256,
-            args,
-            cwd,
-            timeoutMs: timeout_ms
-          });
+          let result;
+          if (args.mode === 'inline') {
+            result = await hostExecInline(hostPolicy, {
+              commandId: args.command_id,
+              rootId: args.root_id,
+              command: args.command,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          } else if (args.mode === 'native') {
+            result = await hostExecNative(hostPolicy, {
+              rootId: args.root_id,
+              executable: args.executable,
+              executableSha256: args.executable_sha256,
+              args: args.args,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          } else {
+            result = await hostExec(hostPolicy, {
+              commandId: args.command_id,
+              rootId: args.root_id,
+              scriptPath: args.script_path,
+              scriptSha256: args.script_sha256,
+              args: args.args,
+              cwd: args.cwd,
+              timeoutMs: args.timeout_ms
+            });
+          }
           const failed = result.timed_out || result.exit_code !== 0;
-          return textResult(hostExecOutputSchema, { status: failed ? 'failed' : 'passed', root_id, ...result }, failed);
+          return textResult(hostExecOutputSchema, { status: failed ? 'failed' : 'passed', root_id: args.root_id, ...result }, failed);
         } catch (error) {
           return textResult(hostExecOutputSchema, { status: 'denied', error: String(error) }, true);
         }

package/src/mcp-smoke-client.mjs

@@ -38,7 +38,8 @@ const transport = new StdioClientTransport({
     ...getDefaultEnvironment(),
     DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
     DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
-    DEADBYTE_VERIFY_KEY: keys.publicKeyPath
+    DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+    DEADBYTE_STDIO_CONSOLE_GUARD_PROBE: '1'
   },
   stderr: 'pipe'
 });
@@ -64,6 +65,8 @@ try {
 
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
+  const guardStderr = Buffer.concat(serverStderr).toString('utf8');
+  if (!guardStderr.includes('DEADBYTE MCP LOG DEADBYTE_STDIO_CONSOLE_GUARD_PROBE')) throw new Error('stdio console guard probe did not reach stderr');
   const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
   const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
   const allowedCatalogs = [

package/src/native-diff-v2.mjs

@@ -321,17 +321,22 @@ export function createNativeDiffV2Runtime({policy,codingRuntime,machineFsRuntime
     const receipt=await createApplyReceipt(ctx,diffId,identity,preimage,events);return {status:'committed',diff_id:diffId,receipt_sha256:receipt.receipt_sha256,operation_count:identity.operations.length,operation_receipts:receipt.operation_receipts.map(x=>({index:x.index,kind:x.kind,receipt_class:x.receipt_class,receipt_id:x.receipt_id,receipt_sha256:x.receipt_sha256}))};
   }
 
-  async function verify({diffId}){
+  async function verifyEvidence({diffId}){
     try{
       const {ctx,identity}=await loadDiff(diffId);const verifyKey=await loadPublicVerifyKey(verifyKeyPath);const preimage=await readEnvelope(ctx.preimagePath,verifyKey,PREIMAGE_DOMAIN,'native diff V2 preimage');const events=await readEvents(ctx);const receipt=await readEnvelope(ctx.receiptPath,verifyKey,RECEIPT_DOMAIN,'native diff V2 receipt');const {attestation:_a,receipt_sha256:claimed,...body}=receipt;
       if(body.schema!==NATIVE_DIFF_V2_RECEIPT_SCHEMA||body.diff_id!==diffId||body.policy_sha256!==policy.policy_sha256||body.coding_policy_sha256!==policy.coding_policy_sha256||!SHA256_RE.test(claimed??'')||sha256Object(body)!==claimed)return {ok:false,reason:'native diff V2 receipt identity/hash mismatch'};
       const completion=events.at(-1);if(completion?.type!=='transaction_completed'||completion.prev_sha256!==receipt.event_head_sha256||completion.payload?.receipt_sha256!==claimed||receipt.preimage_sha256!==preimage.preimage_sha256)return {ok:false,reason:'native diff V2 receipt/event/preimage binding mismatch'};
       if(!Array.isArray(receipt.operation_receipts)||receipt.operation_receipts.length!==identity.operations.length)return {ok:false,reason:'native diff V2 operation receipt count mismatch'};
       let verified=0,codingVerified=0;for(let index=0;index<identity.operations.length;index+=1){const op=identity.operations[index];const bound=receipt.operation_receipts.find(x=>x.index===index);if(!bound||bound.kind!==op.kind||bound.receipt_class!==receiptClass(op))return {ok:false,reason:`native diff V2 receipt binding mismatch index ${index}`};const checked=await verifyOperationReceipt(op,bound.receipt_id);if(!checked.ok||checked.receipt_sha256!==bound.receipt_sha256||checked.request_sha256!==bound.request_sha256)return {ok:false,reason:`native diff V2 operation receipt invalid index ${index}`};verified+=1;if(bound.receipt_class==='coding')codingVerified+=1;}
-      let currentMatches=true;for(const op of identity.operations)if(!(await terminalStateMatches(identity.root_id,op)))currentMatches=false;
-      return {ok:true,diff_id:diffId,receipt_sha256:claimed,signature_valid:true,root_id:identity.root_id,operation_count:identity.operations.length,coding_receipts_verified:codingVerified,operation_receipts_verified:verified,final_states:receipt.final_states,current_state_matches:currentMatches,journal_head_sha256:completion.event_sha256};
+      return {ok:true,diff_id:diffId,receipt_sha256:claimed,signature_valid:true,root_id:identity.root_id,operation_count:identity.operations.length,coding_receipts_verified:codingVerified,operation_receipts_verified:verified,final_states:receipt.final_states,journal_head_sha256:completion.event_sha256};
     }catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
   }
 
-  return Object.freeze({preview,apply,verify,policy});
+  async function verify({diffId}){
+    const checked=await verifyEvidence({diffId});if(!checked.ok)return checked;
+    try{const {identity}=await loadDiff(diffId);let currentMatches=true;for(const op of identity.operations)if(!(await terminalStateMatches(identity.root_id,op)))currentMatches=false;return {...checked,current_state_matches:currentMatches};}
+    catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
+  }
+
+  return Object.freeze({preview,apply,verify,verifyEvidence,policy});
 }

package/src/native-diff.mjs

@@ -361,7 +361,7 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
       coding_receipts:receipt.coding_receipts.map(item => ({ index:item.index, path:item.path, receipt_id:item.receipt_id, receipt_sha256:item.receipt_sha256 })) };
   }
 
-  async function verify({ diffId }) {
+  async function verifyEvidence({ diffId }) {
     try {
       const { ctx, identity } = await loadDiff(diffId);
       const verifyKey = await loadPublicVerifyKey(verifyKeyPath);
@@ -390,21 +390,32 @@ function createNativeDiffRuntimeV1({ policy, codingRuntime, signingKeyPath, veri
         }
         verifiedReceipts += 1;
       }
+      return { ok:true, diff_id:diffId, receipt_sha256:claimed, signature_valid:true,
+        root_id:identity.root_id, operation_count:identity.operations.length,
+        coding_receipts_verified:verifiedReceipts, final_states:receipt.final_states,
+        journal_head_sha256:completion.event_sha256 };
+    } catch (error) {
+      return { ok:false, reason:String(error).slice(0,2048) };
+    }
+  }
+
+  async function verify({ diffId }) {
+    const checked = await verifyEvidence({ diffId });
+    if (!checked.ok) return checked;
+    try {
+      const { identity } = await loadDiff(diffId);
       let currentMatches = true;
       for (const op of identity.operations) {
         const current = await codingRuntime.fileState({ rootId:identity.root_id, relativePath:op.path });
         if (!stateMatches(current, op.after_sha256)) currentMatches = false;
       }
-      return { ok:true, diff_id:diffId, receipt_sha256:claimed, signature_valid:true,
-        root_id:identity.root_id, operation_count:identity.operations.length,
-        coding_receipts_verified:verifiedReceipts, final_states:receipt.final_states,
-        current_state_matches:currentMatches, journal_head_sha256:completion.event_sha256 };
+      return { ...checked, current_state_matches:currentMatches };
     } catch (error) {
       return { ok:false, reason:String(error).slice(0,2048) };
     }
   }
 
-  return Object.freeze({ preview, apply, verify, policy });
+  return Object.freeze({ preview, apply, verify, verifyEvidence, policy });
 }
 
 export { NATIVE_DIFF_V2_SCHEMA };
@@ -448,5 +459,16 @@ export function createNativeDiffRuntime(options) {
       return {ok:false,reason:String(error).slice(0,2048)};
     }
   }
-  return Object.freeze({preview,apply,verify,policy:options.policy});
+  async function verifyEvidence(args){
+    try {
+      const schema=await schemaFor(args?.diffId);
+      if(schema===NATIVE_DIFF_SCHEMA) return v1.verifyEvidence(args);
+      if(schema===NATIVE_DIFF_V2_SCHEMA){
+        if(!v2) return {ok:false,reason:'native diff V2 topology requires machine fs runtime'};
+        return v2.verifyEvidence(args);
+      }
+      return {ok:false,reason:`unsupported native diff schema: ${String(schema)}`};
+    }catch(error){return {ok:false,reason:String(error).slice(0,2048)};}
+  }
+  return Object.freeze({preview,apply,verify,verifyEvidence,policy:options.policy});
 }

package/src/observation-mcp-tools.mjs

@@ -1,6 +1,6 @@
 import * as z from 'zod/v4';
 import {
-  observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
+  observationHardwareQueryOutputSchema,observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
   observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema
 } from './observation-output-contracts.mjs';
 
@@ -41,4 +41,8 @@ export function registerObservationTools(server,{runtime}){
     description:'Read bounded timestamped system status with signed observation evidence. This tool cannot mutate or arm any authority.',
     inputSchema:z.strictObject({}),outputSchema:observationSystemStatusOutputSchema
   },async()=>{try{return ok(observationSystemStatusOutputSchema,await runtime.systemStatus());}catch(error){return fail(observationSystemStatusOutputSchema,error);}});
+  server.registerTool('machine_hardware_query',{
+    description:'Read one typed native hardware snapshot (CPU, GPU, memory, storage, network, or PCI) with signed observation evidence. No shell or Host authority is used.',
+    inputSchema:z.strictObject({query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),outputSchema:observationHardwareQueryOutputSchema
+  },async args=>{try{return ok(observationHardwareQueryOutputSchema,await runtime.hardwareQuery({query:args.query}));}catch(error){return fail(observationHardwareQueryOutputSchema,error);}});
 }

package/src/observation-output-contracts.mjs

@@ -45,6 +45,14 @@ export const observationSystemStatusOutputSchema=statusContract({
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
 },['observed_at_utc','hostname','platform','architecture','uptime_seconds','total_memory_bytes','free_memory_bytes','cpu_count','load_average','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
+export const observationHardwareQueryOutputSchema=statusContract({
+  observed_at_utc:z.string().min(1).optional(),
+  query:z.enum(['cpu','gpu','memory','storage','network','pci']).optional(),
+  data:z.record(z.string(),z.json()).optional(),
+  observer_sha256:hex64.optional(),
+  ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
+},['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+
 export function observationStructuredResult(schema,value,isError=false){
   return structuredToolResult(schema,value,isError);
 }

package/src/observation-runtime.mjs

@@ -3,6 +3,7 @@ import { spawnSync } from 'node:child_process';
 import { lstat, mkdir, open, readFile, readdir, realpath } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { canonicalJson } from './canonical-json.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
@@ -13,6 +14,7 @@ const RECEIPT_DOMAIN=Buffer.from('DEADBYTE-OBSERVATION-RECEIPT-V1\0','utf8');
 const ZERO='0'.repeat(64);
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,64}$/;
+const HARDWARE_QUERIES=new Set(['cpu','gpu','memory','storage','network','pci']);
 const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
 const sha256Object=value=>sha256Bytes(Buffer.from(canonicalJson(value),'utf8'));
 const nowUtc=()=>new Date().toISOString();
@@ -110,19 +112,53 @@ function defaultSystemSnapshotProvider(){
   return {hostname:os.hostname(),platform:process.platform,architecture:process.arch,uptime_seconds:Math.floor(os.uptime()),
     total_memory_bytes:os.totalmem(),free_memory_bytes:os.freemem(),cpu_count:os.cpus().length,load_average:os.loadavg().map(Number)};
 }
+async function defaultHardwareSnapshotProvider(query){
+  if(process.platform!=='win32') throw new Error('native hardware observation is supported on win32 only');
+  if(!HARDWARE_QUERIES.has(query)) throw new Error('unsupported hardware query');
+  const executable=fileURLToPath(new URL('../bin/deadbyte-hardware-observer-r45.exe',import.meta.url));
+  const executableSha256=sha256Bytes(await readFile(executable));
+  const result=spawnSync(executable,[query],{encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:16*1024*1024});
+  if(result.error) throw result.error;
+  if(result.status!==0) throw new Error(`hardware observation failed query=${query}: ${String(result.stderr??result.stdout??'').trim()}`);
+  let parsed;
+  try{parsed=JSON.parse(String(result.stdout??'').trim());}
+  catch{throw new Error(`hardware observation returned invalid JSON query=${query}`);}
+  if(parsed?.schema!=='deadbyte.hardware-query.v1'||parsed?.query!==query||!parsed.data||typeof parsed.data!=='object'||Array.isArray(parsed.data)){
+    throw new Error(`hardware observation contract mismatch query=${query}`);
+  }
+  return {...parsed,observer_sha256:executableSha256};
+}
 function requestSha(policy,operation,args){
   return sha256Object({schema:'deadbyte.observation-request.v1',policy_sha256:policy.policy_sha256,operation,args});
 }
 export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,processRuntime=null,stateRoot=path.join(os.homedir(),'.deadbyte-mcp'),
   processSnapshotProvider=defaultProcessSnapshotProvider,systemSnapshotProvider=defaultSystemSnapshotProvider,
-  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider}={}){
+  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,
+  searchSessionTtlMs=5*60*1000,maxSearchSessions=128,clockMs=()=>Date.now()}={}){
   if(!policy||!signingKeyPath||!verifyKeyPath) throw new Error('observation runtime requires policy and trust keys');
+  if(!Number.isInteger(searchSessionTtlMs)||searchSessionTtlMs<10||searchSessionTtlMs>24*60*60*1000) throw new Error('searchSessionTtlMs out of range');
+  if(!Number.isInteger(maxSearchSessions)||maxSearchSessions<1||maxSearchSessions>4096) throw new Error('maxSearchSessions out of range');
+  if(typeof clockMs!=='function') throw new Error('clockMs must be a function');
   const searches=new Map(),snapshots=new Map();
   let signingPromise=null;
   const runtime={policy,signing:()=>signingPromise??=(loadPrivateSigningKey(signingKeyPath))};
+  const terminalSearchState=state=>['completed','cancelled','failed'].includes(state);
+  function pruneSearches(){
+    const now=Number(clockMs());
+    if(!Number.isFinite(now)) throw new Error('search clock invalid');
+    for(const [id,session] of searches){
+      if(terminalSearchState(session.state)&&Number.isFinite(session.completed_at_ms)&&now-session.completed_at_ms>=searchSessionTtlMs) searches.delete(id);
+    }
+    if(searches.size>maxSearchSessions){
+      const terminal=[...searches.values()].filter(s=>terminalSearchState(s.state))
+        .sort((a,b)=>(a.completed_at_ms??Infinity)-(b.completed_at_ms??Infinity)||a.search_id.localeCompare(b.search_id));
+      for(const session of terminal){ if(searches.size<=maxSearchSessions) break; searches.delete(session.search_id); }
+    }
+  }
   function searchFor(searchId){
     if(!HEX64.test(searchId??'')) throw new Error('invalid search id');
-    const session=searches.get(searchId); if(!session) throw new Error(`unknown search '${searchId}'`); return session;
+    pruneSearches();
+    const session=searches.get(searchId); if(!session) throw new Error(`unknown or expired search '${searchId}'`); return session;
   }
   async function finalizeSearch(session,state,error=null){
     session.error=error?String(error):null;
@@ -131,7 +167,8 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
       bytes_scanned:session.bytes_scanned,truncated:session.truncated,error:session.error
     });
     session.receipt_id=receipt.receipt_id; session.receipt_sha256=receipt.receipt_sha256;
-    session.state=state;
+    session.state=state; session.completed_at_ms=Number(clockMs());
+    pruneSearches();
   }
   async function executeSearch(session){
     if(session.cancel_requested){ await finalizeSearch(session,'cancelled'); return; }
@@ -182,11 +219,13 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     if(!Number.isInteger(maxBytes)||maxBytes<1||maxBytes>64*1024*1024) throw new Error('max_bytes out of range');
     if(!Number.isInteger(maxFileBytes)||maxFileBytes<1||maxFileBytes>4*1024*1024) throw new Error('max_file_bytes out of range');
     rootFor(policy,rootId); if(relativePath!=='.') validatePortableRelativePath(relativePath);
+    pruneSearches();
+    if(searches.size>=maxSearchSessions) throw new Error('observation search session limit reached');
     const args={root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes};
     const session={search_id:randomBytes(32).toString('hex'),root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,
       max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes,state:'pending',cancel_requested:false,
       results:[],files_scanned:0,bytes_scanned:0,truncated:false,result_head_sha256:ZERO,error:null,receipt_id:null,receipt_sha256:null,
-      request_sha256:requestSha(policy,'machine_search_start',args)};
+      created_at_ms:Number(clockMs()),completed_at_ms:null,request_sha256:requestSha(policy,'machine_search_start',args)};
     searches.set(session.search_id,session); setImmediate(()=>{ void executeSearch(session); });
     return {status:'accepted',search_id:session.search_id,state:session.state,request_sha256:session.request_sha256};
   }
@@ -253,5 +292,18 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     const receipt=await writeReceipt(runtime,'machine_system_status',req,head,{observed_at_utc:observedAt});
     return {...result,request_sha256:req,result_head_sha256:head,...receipt};
   }
-  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus});
+  async function hardwareQuery({query}={}){
+    if(typeof query!=='string'||!HARDWARE_QUERIES.has(query)) throw new Error('hardware query must be one of cpu,gpu,memory,storage,network,pci');
+    const observedAt=nowUtc();
+    const snapshot=await hardwareSnapshotProvider(query);
+    if(!snapshot||snapshot.schema!=='deadbyte.hardware-query.v1'||snapshot.query!==query||!snapshot.data||typeof snapshot.data!=='object'||Array.isArray(snapshot.data)){
+      throw new Error('hardware query provider contract mismatch');
+    }
+    const result={status:'ok',observed_at_utc:observedAt,query,data:snapshot.data};
+    if(typeof snapshot.observer_sha256==='string'&&HEX64.test(snapshot.observer_sha256)) result.observer_sha256=snapshot.observer_sha256;
+    const req=requestSha(policy,'machine_hardware_query',{query}); const head=sha256Object(result);
+    const receipt=await writeReceipt(runtime,'machine_hardware_query',req,head,{observed_at_utc:observedAt,query,observer_sha256:result.observer_sha256??null});
+    return {...result,request_sha256:req,result_head_sha256:head,...receipt};
+  }
+  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus,hardwareQuery});
 }

package/src/observation-smoke-client.mjs

@@ -57,7 +57,7 @@ const coding=['coding_benchmark_run','coding_command_run','coding_file_read','co
   'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',
   'coding_task_approve','coding_task_cancel','coding_task_events','coding_task_run','coding_task_status',
   'coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'];
-const observation=['machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'];
+const observation=['machine_hardware_query','machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'];
 const expected=[...base,...machine,...coding,...observation].sort();
 try{
   await client.connect(transport);
@@ -70,6 +70,10 @@ try{
   if(system.status!=='ok'||!/^[0-9a-f]{24}$/.test(system.receipt_id??'')) throw new Error('system observation missing signed receipt');
   const systemVerify=await verifyObservationReceiptFile({policy,verifyKeyPath:keys.publicKeyPath,receiptId:system.receipt_id});
   if(!systemVerify.ok||systemVerify.signature_valid!==true||systemVerify.request_sha256!==system.request_sha256) throw new Error('system observation receipt verification failed');
+  const hardware=structured(await client.callTool({name:'machine_hardware_query',arguments:{query:'cpu'}}),'machine_hardware_query');
+  if(hardware.status!=='ok'||hardware.query!=='cpu'||!/^[0-9a-f]{24}$/.test(hardware.receipt_id??'')||!/^[0-9a-f]{64}$/.test(hardware.observer_sha256??'')) throw new Error('hardware observation missing signed native evidence');
+  const hardwareVerify=await verifyObservationReceiptFile({policy,verifyKeyPath:keys.publicKeyPath,receiptId:hardware.receipt_id});
+  if(!hardwareVerify.ok||hardwareVerify.signature_valid!==true||hardwareVerify.request_sha256!==hardware.request_sha256) throw new Error('hardware observation receipt verification failed');
   const processes=structured(await client.callTool({name:'machine_process_list',arguments:{limit:16,include_external:false,cursor:null}}),'machine_process_list');
   if(processes.status!=='ok'||!/^[0-9a-f]{24}$/.test(processes.receipt_id??'')) throw new Error('process observation missing signed receipt');
   const started=structured(await client.callTool({name:'machine_search_start',arguments:{root_id:'core',path:'.',pattern:'needle',case_sensitive:true,
@@ -87,7 +91,7 @@ try{
   if(!searchVerify.ok||searchVerify.signature_valid!==true||searchVerify.result_head_sha256!==status.result_head_sha256) throw new Error('search receipt verification failed');
   console.log(JSON.stringify({status:'passed',protocol_revision:'2026-07-28',tool_count:names.length,
     coding_armed:false,search_results:page.results.length,process_snapshot_id:processes.snapshot_id,
-    system_receipt_id:system.receipt_id,search_receipt_id:status.receipt_id,strict_output_schemas:true,
+    system_receipt_id:system.receipt_id,hardware_receipt_id:hardware.receipt_id,hardware_observer_sha256:hardware.observer_sha256,search_receipt_id:status.receipt_id,strict_output_schemas:true,
     signature_valid:true,policy_sha256:policy.policy_sha256},null,2));
 }catch(error){
   const detail=Buffer.concat(stderr).toString('utf8').trim(); if(detail) console.error(`server stderr:\n${detail}`);

package/src/output-contracts.mjs

@@ -226,17 +226,33 @@ export const hostFileWriteOutputSchema = statusContract({
   successStatuses: ['committed'], successRequired: ['root_id', 'path', 'previous_sha256', 'sha256', 'bytes', 'created'], errorStatuses: ['denied']
 });
 
-export const hostExecOutputSchema = statusContract({
-  statuses: ['passed', 'failed', 'denied'],
-  shape: {
-    root_id: z.string().min(1).max(64).optional(), command_id: z.string().min(1).max(64).optional(),
-    executable_sha256: hex64.optional(), script_sha256: hex64.optional(), exit_code: z.number().int().nullable().optional(),
-    signal: z.string().nullable().optional(), timed_out: z.boolean().optional(), timeout_ms: z.number().int().min(100).optional(),
-    stdout: z.string().optional(), stderr: z.string().optional()
-  },
-  successStatuses: ['passed', 'failed'],
-  successRequired: ['root_id', 'command_id', 'executable_sha256', 'script_sha256', 'exit_code', 'signal', 'timed_out', 'timeout_ms', 'stdout', 'stderr'],
-  errorStatuses: ['denied']
+export const hostExecOutputSchema = z.strictObject({
+  status: z.enum(['passed', 'failed', 'denied']),
+  error: z.string().optional(),
+  root_id: z.string().min(1).max(64).optional(),
+  mode: z.enum(['script','inline','native']).optional(),
+  command_id: z.string().min(1).max(64).optional(),
+  executable_sha256: hex64.optional(),
+  script_sha256: hex64.optional(),
+  command_sha256: hex64.optional(),
+  argv_sha256: hex64.optional(),
+  stdout_sha256: hex64.optional(),
+  stderr_sha256: hex64.optional(),
+  exit_code: z.number().int().nullable().optional(),
+  signal: z.string().nullable().optional(),
+  timed_out: z.boolean().optional(),
+  timeout_ms: z.number().int().min(100).optional(),
+  stdout: z.string().optional(),
+  stderr: z.string().optional()
+}).superRefine((value,ctx)=>{
+  if(value.status==='denied'){
+    if(!value.error) ctx.addIssue({code:'custom',path:['error'],message:'error required'});
+    return;
+  }
+  if(value.error!==undefined) ctx.addIssue({code:'custom',path:['error'],message:'error invalid for executed result'});
+  requireFields(value,ctx,['root_id','mode','command_id','executable_sha256','argv_sha256','stdout_sha256','stderr_sha256','exit_code','signal','timed_out','timeout_ms','stdout','stderr']);
+  if(value.mode==='script'&&value.script_sha256===undefined) ctx.addIssue({code:'custom',path:['script_sha256'],message:'script_sha256 required for script mode'});
+  if(value.mode==='inline'&&value.command_sha256===undefined) ctx.addIssue({code:'custom',path:['command_sha256'],message:'command_sha256 required for inline mode'});
 });
 
 export function structuredToolResult(schema, object, isError = false) {

package/src/process-mcp-tools.mjs

@@ -1,4 +1,4 @@
-import * as z from 'zod/v4';
+import * as z from 'zod/v4';
 import {
   processActionOutputSchema,
   processListOutputSchema,
@@ -6,6 +6,7 @@ import {
   processStartOutputSchema,
   processStatusOutputSchema,
   processTerminateOutputSchema,
+  processWriteOutputSchema,
   processStructuredResult
 } from './process-output-contracts.mjs';
 
@@ -30,14 +31,26 @@ export function registerProcessTools(server, { runtime }) {
   server.registerTool('process_session_read', {
     description: 'Read a bounded byte range from one DEADBYTE-owned process session using ordered stream offsets.',
     inputSchema: z.strictObject({
-      session_id: hex64, offset: z.number().int().nonnegative().default(0),
-      max_bytes: z.number().int().min(1).max(262144).default(65536)
+      session_id: hex64, offset: z.number().int().min(-(16 * 1024 * 1024)).default(0),
+      max_bytes: z.number().int().min(1).max(262144).default(65536),
+      wait_ms: z.number().int().min(0).max(30000).default(0),
+      wait_for: z.string().min(1).max(256).nullable().default(null)
     }), outputSchema: processReadOutputSchema
-  }, async ({ session_id, offset, max_bytes }) => {
-    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes })) }); }
+  }, async ({ session_id, offset, max_bytes, wait_ms, wait_for }) => {
+    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes, waitMs: wait_ms, waitFor: wait_for })) }); }
     catch (error) { return fail(processReadOutputSchema, 'denied', error); }
   });
 
+  server.registerTool('process_session_write', {
+    description: 'Write one bounded UTF-8 input payload to a running DEADBYTE-owned pipe session only when its local profile explicitly enables raw input. Input text is never stored in the signed journal; only byte count and SHA-256 identity are recorded.',
+    inputSchema: z.strictObject({
+      session_id: hex64, input: z.string().min(1).max(1024 * 1024), append_newline: z.boolean().default(true)
+    }), outputSchema: processWriteOutputSchema
+  }, async ({ session_id, input, append_newline }) => {
+    try { return ok(processWriteOutputSchema, { status: 'ok', ...(await runtime.write({ sessionId: session_id, input, appendNewline: append_newline })) }); }
+    catch (error) { return fail(processWriteOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_status', {
     description: 'Read the verified state of one DEADBYTE-owned process session by session identity.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processStatusOutputSchema