deadbyte-mcp 0.15.1 → 0.15.2

package/src/machine-fs.mjs

@@ -1,7 +1,9 @@
 import { createHash, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
 import { createReadStream } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { lstat, mkdir as fsMkdir, open, readFile, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { canonicalJson } from './canonical-json.mjs';
 import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
@@ -29,6 +31,55 @@ async function sha256File(file) {
   return hash.digest('hex');
 }
 
+const machineFsReadWorkerPath = fileURLToPath(new URL('./machine-fs-read-worker.mjs', import.meta.url));
+async function boundedReadWorker({ file, offset, length, hashFile, timeoutMs, workerPath = machineFsReadWorkerPath }) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [workerPath, file, String(offset), String(length), hashFile ? '1' : '0'], {
+      windowsHide: true, shell: false, stdio: ['ignore','pipe','pipe']
+    });
+    const stdout = [];
+    let stdoutBytes = 0;
+    let stderr = '';
+    let settled = false;
+    let timedOut = false;
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(value);
+    };
+    child.stdout.on('data', chunk => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > 8 * 1024 * 1024) {
+        child.kill();
+        finish(reject, new Error('machine fs read worker output exceeded bound'));
+        return;
+      }
+      stdout.push(Buffer.from(chunk));
+    });
+    child.stderr.on('data', chunk => { stderr = (stderr + chunk.toString('utf8')).slice(-16384); });
+    child.once('error', error => finish(reject, error));
+    child.once('close', code => {
+      if (settled) return;
+      if (timedOut) return finish(reject, new Error(`machine fs read timed out after ${timeoutMs}ms`));
+      if (code !== 0) return finish(reject, new Error(`machine fs read worker failed exit=${String(code)}: ${stderr}`));
+      let value;
+      try { value = JSON.parse(Buffer.concat(stdout).toString('utf8')); }
+      catch { return finish(reject, new Error('machine fs read worker returned invalid JSON')); }
+      if (value?.schema !== 'deadbyte.machine-fs-read-worker.v1' || !Number.isInteger(value.bytes_read) ||
+          typeof value.data_base64 !== 'string' || (value.file_sha256 !== null && !SHA256_RE.test(value.file_sha256 ?? ''))) {
+        return finish(reject, new Error('machine fs read worker response invalid'));
+      }
+      finish(resolve, value);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
 function getRoot(policy, rootId, permission) {
   const root = policy.roots[rootId];
   if (!root) throw new Error(`machine fs root '${rootId}' is not allowed`);
@@ -245,7 +296,7 @@ async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null)
   return { before, after };
 }
 
-export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }) {
+export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
   if (!policy) throw new Error('machine fs runtime requires coding policy');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('machine fs runtime requires trust key paths');
 
@@ -292,25 +343,27 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const nextCursor = filtered.length > selected.length && selected.length ? encodeCursor(selected.at(-1).name) : null;
     return { status: 'ok', root_id: rootId, path: found.relative, entries, next_cursor: nextCursor };
   }
-  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false }) {
+  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false, timeoutMs = 30000 }) {
     if (!Number.isInteger(offset) || offset < 0) throw new Error('machine fs read offset must be nonnegative integer');
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingArmed(policy, rootId);
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
     const info = await lstat(found.resolved);
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
     if (offset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const handle = await open(found.resolved, 'r');
     const length = Math.min(maxBytes, info.size - offset);
-    const buffer = Buffer.alloc(length);
-    try { if (length) await handle.read(buffer, 0, length, offset); }
-    finally { await handle.close(); }
-    const fileSha = hashFile ? await sha256File(found.resolved) : null;
+    await recheckCodingAuthority(policy, grant, rootId);
+    const worker = await boundedReadWorker({ file: found.resolved, offset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const buffer = Buffer.from(worker.data_base64, 'base64');
+    if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    await recheckCodingAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset, next_offset: offset + length, file_size: info.size,
-      eof: offset + length >= info.size, data_base64: buffer.toString('base64'),
-      data_sha256: sha256Bytes(buffer), file_sha256: fileSha
+      offset, next_offset: offset + buffer.length, file_size: info.size,
+      eof: offset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
+      timeout_ms: timeoutMs
     };
   }
 

package/src/mcp-server.mjs

@@ -14,6 +14,7 @@ import { defaultPrivateKeyPath, defaultPublicKeyPath, loadPrivateSigningKey, loa
 import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
+import { installStdioConsoleGuard } from './stdio-console-guard.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
@@ -231,6 +232,9 @@ const skillRoot=path.join(runtimeStateRoot,'skills');
 await mkdir(skillRoot,{recursive:true});
 const skillRuntime=await createSkillPlane({root:skillRoot,verifyKeyPath});
 
+installStdioConsoleGuard();
+if (process.env.DEADBYTE_STDIO_CONSOLE_GUARD_PROBE === '1') console.log('DEADBYTE_STDIO_CONSOLE_GUARD_PROBE');
+
 const ingressAdapterMode = currentIngressAdapterMode();
 installTunnelStdioProbeCompat({
   enabled: ingressAdapterMode === TUNNEL_STDIO_PROBE_COMPAT_MODE,

package/src/mcp-smoke-client.mjs

@@ -38,7 +38,8 @@ const transport = new StdioClientTransport({
     ...getDefaultEnvironment(),
     DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
     DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
-    DEADBYTE_VERIFY_KEY: keys.publicKeyPath
+    DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+    DEADBYTE_STDIO_CONSOLE_GUARD_PROBE: '1'
   },
   stderr: 'pipe'
 });
@@ -64,6 +65,8 @@ try {
 
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
+  const guardStderr = Buffer.concat(serverStderr).toString('utf8');
+  if (!guardStderr.includes('DEADBYTE MCP LOG DEADBYTE_STDIO_CONSOLE_GUARD_PROBE')) throw new Error('stdio console guard probe did not reach stderr');
   const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
   const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
   const allowedCatalogs = [

package/src/observation-runtime.mjs

@@ -133,14 +133,32 @@ function requestSha(policy,operation,args){
 }
 export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,processRuntime=null,stateRoot=path.join(os.homedir(),'.deadbyte-mcp'),
   processSnapshotProvider=defaultProcessSnapshotProvider,systemSnapshotProvider=defaultSystemSnapshotProvider,
-  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider}={}){
+  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,
+  searchSessionTtlMs=5*60*1000,maxSearchSessions=128,clockMs=()=>Date.now()}={}){
   if(!policy||!signingKeyPath||!verifyKeyPath) throw new Error('observation runtime requires policy and trust keys');
+  if(!Number.isInteger(searchSessionTtlMs)||searchSessionTtlMs<10||searchSessionTtlMs>24*60*60*1000) throw new Error('searchSessionTtlMs out of range');
+  if(!Number.isInteger(maxSearchSessions)||maxSearchSessions<1||maxSearchSessions>4096) throw new Error('maxSearchSessions out of range');
+  if(typeof clockMs!=='function') throw new Error('clockMs must be a function');
   const searches=new Map(),snapshots=new Map();
   let signingPromise=null;
   const runtime={policy,signing:()=>signingPromise??=(loadPrivateSigningKey(signingKeyPath))};
+  const terminalSearchState=state=>['completed','cancelled','failed'].includes(state);
+  function pruneSearches(){
+    const now=Number(clockMs());
+    if(!Number.isFinite(now)) throw new Error('search clock invalid');
+    for(const [id,session] of searches){
+      if(terminalSearchState(session.state)&&Number.isFinite(session.completed_at_ms)&&now-session.completed_at_ms>=searchSessionTtlMs) searches.delete(id);
+    }
+    if(searches.size>maxSearchSessions){
+      const terminal=[...searches.values()].filter(s=>terminalSearchState(s.state))
+        .sort((a,b)=>(a.completed_at_ms??Infinity)-(b.completed_at_ms??Infinity)||a.search_id.localeCompare(b.search_id));
+      for(const session of terminal){ if(searches.size<=maxSearchSessions) break; searches.delete(session.search_id); }
+    }
+  }
   function searchFor(searchId){
     if(!HEX64.test(searchId??'')) throw new Error('invalid search id');
-    const session=searches.get(searchId); if(!session) throw new Error(`unknown search '${searchId}'`); return session;
+    pruneSearches();
+    const session=searches.get(searchId); if(!session) throw new Error(`unknown or expired search '${searchId}'`); return session;
   }
   async function finalizeSearch(session,state,error=null){
     session.error=error?String(error):null;
@@ -149,7 +167,8 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
       bytes_scanned:session.bytes_scanned,truncated:session.truncated,error:session.error
     });
     session.receipt_id=receipt.receipt_id; session.receipt_sha256=receipt.receipt_sha256;
-    session.state=state;
+    session.state=state; session.completed_at_ms=Number(clockMs());
+    pruneSearches();
   }
   async function executeSearch(session){
     if(session.cancel_requested){ await finalizeSearch(session,'cancelled'); return; }
@@ -200,11 +219,13 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     if(!Number.isInteger(maxBytes)||maxBytes<1||maxBytes>64*1024*1024) throw new Error('max_bytes out of range');
     if(!Number.isInteger(maxFileBytes)||maxFileBytes<1||maxFileBytes>4*1024*1024) throw new Error('max_file_bytes out of range');
     rootFor(policy,rootId); if(relativePath!=='.') validatePortableRelativePath(relativePath);
+    pruneSearches();
+    if(searches.size>=maxSearchSessions) throw new Error('observation search session limit reached');
     const args={root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes};
     const session={search_id:randomBytes(32).toString('hex'),root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,
       max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes,state:'pending',cancel_requested:false,
       results:[],files_scanned:0,bytes_scanned:0,truncated:false,result_head_sha256:ZERO,error:null,receipt_id:null,receipt_sha256:null,
-      request_sha256:requestSha(policy,'machine_search_start',args)};
+      created_at_ms:Number(clockMs()),completed_at_ms:null,request_sha256:requestSha(policy,'machine_search_start',args)};
     searches.set(session.search_id,session); setImmediate(()=>{ void executeSearch(session); });
     return {status:'accepted',search_id:session.search_id,state:session.state,request_sha256:session.request_sha256};
   }

package/src/process-mcp-tools.mjs

@@ -1,4 +1,4 @@
-import * as z from 'zod/v4';
+import * as z from 'zod/v4';
 import {
   processActionOutputSchema,
   processListOutputSchema,
@@ -6,6 +6,7 @@ import {
   processStartOutputSchema,
   processStatusOutputSchema,
   processTerminateOutputSchema,
+  processWriteOutputSchema,
   processStructuredResult
 } from './process-output-contracts.mjs';
 
@@ -30,14 +31,26 @@ export function registerProcessTools(server, { runtime }) {
   server.registerTool('process_session_read', {
     description: 'Read a bounded byte range from one DEADBYTE-owned process session using ordered stream offsets.',
     inputSchema: z.strictObject({
-      session_id: hex64, offset: z.number().int().nonnegative().default(0),
-      max_bytes: z.number().int().min(1).max(262144).default(65536)
+      session_id: hex64, offset: z.number().int().min(-(16 * 1024 * 1024)).default(0),
+      max_bytes: z.number().int().min(1).max(262144).default(65536),
+      wait_ms: z.number().int().min(0).max(30000).default(0),
+      wait_for: z.string().min(1).max(256).nullable().default(null)
     }), outputSchema: processReadOutputSchema
-  }, async ({ session_id, offset, max_bytes }) => {
-    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes })) }); }
+  }, async ({ session_id, offset, max_bytes, wait_ms, wait_for }) => {
+    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes, waitMs: wait_ms, waitFor: wait_for })) }); }
     catch (error) { return fail(processReadOutputSchema, 'denied', error); }
   });
 
+  server.registerTool('process_session_write', {
+    description: 'Write one bounded UTF-8 input payload to a running DEADBYTE-owned pipe session only when its local profile explicitly enables raw input. Input text is never stored in the signed journal; only byte count and SHA-256 identity are recorded.',
+    inputSchema: z.strictObject({
+      session_id: hex64, input: z.string().min(1).max(1024 * 1024), append_newline: z.boolean().default(true)
+    }), outputSchema: processWriteOutputSchema
+  }, async ({ session_id, input, append_newline }) => {
+    try { return ok(processWriteOutputSchema, { status: 'ok', ...(await runtime.write({ sessionId: session_id, input, appendNewline: append_newline })) }); }
+    catch (error) { return fail(processWriteOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_status', {
     description: 'Read the verified state of one DEADBYTE-owned process session by session identity.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processStatusOutputSchema

package/src/process-output-contracts.mjs

@@ -1,4 +1,4 @@
-import * as z from 'zod/v4';
+import * as z from 'zod/v4';
 import { structuredToolResult } from './output-contracts.mjs';
 
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/);
@@ -51,6 +51,23 @@ export const processActionOutputSchema = z.strictObject({
   }
 });
 
+export const processWriteOutputSchema = z.strictObject({
+  status: z.enum(['ok','denied','failed']),
+  error: z.string().min(1).max(4096).optional(),
+  logical_bytes: z.number().int().positive().optional(),
+  logical_sha256: hex64.optional(),
+  append_newline: z.boolean().optional(),
+  session: processSessionRecordSchema.optional()
+}).superRefine((value, ctx) => {
+  if (value.status !== 'ok') {
+    if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' });
+    return;
+  }
+  for (const key of ['logical_bytes','logical_sha256','append_newline','session']) {
+    if (value[key] === undefined) ctx.addIssue({ code: 'custom', path: [key], message: `${key} required` });
+  }
+});
+
 export const processListOutputSchema = z.strictObject({
   status: z.enum(['ok','failed']),
   error: z.string().min(1).max(4096).optional(),
@@ -65,11 +82,11 @@ export const processReadOutputSchema = z.strictObject({
   session_id: hex64.optional(), offset: z.number().int().nonnegative().optional(),
   next_offset: z.number().int().nonnegative().optional(), earliest_offset: z.number().int().nonnegative().optional(),
   stream_head: z.number().int().nonnegative().optional(), stream_sha256: hex64.optional(),
-  truncated: z.boolean().optional(), data_base64: z.string().max(400000).optional(),
+  truncated: z.boolean().optional(), wait_satisfied: z.boolean().optional(), data_base64: z.string().max(400000).optional(),
   state: processState.optional(), exit_code: z.number().int().nullable().optional()
 }).superRefine((value, ctx) => {
   if (value.status !== 'ok') { if (!value.error) ctx.addIssue({ code: 'custom', path: ['error'], message: 'error required' }); return; }
-  for (const key of ['session_id','offset','next_offset','earliest_offset','stream_head','stream_sha256','truncated','data_base64','state','exit_code']) {
+  for (const key of ['session_id','offset','next_offset','earliest_offset','stream_head','stream_sha256','truncated','wait_satisfied','data_base64','state','exit_code']) {
     if (value[key] === undefined) ctx.addIssue({ code: 'custom', path: [key], message: `${key} required` });
   }
 });

package/src/process-policy.mjs

@@ -63,6 +63,8 @@ function normalizePolicyObject(raw, policyPath) {
     if (envAllow.some(name => !/^[A-Za-z_][A-Za-z0-9_()]*$/.test(name))) throw new Error(`process profile '${id}' env_allow invalid`);
     const transport = value.transport ?? 'conpty';
     if (transport !== 'conpty' && transport !== 'pipe') throw new Error(`process profile '${id}' transport invalid`);
+    if (value.allow_raw_input !== undefined && typeof value.allow_raw_input !== 'boolean') throw new Error(`process profile '${id}' allow_raw_input invalid`);
+    const allowRawInput = value.allow_raw_input === true;
     const inputActions = {};
     if (value.input_actions !== undefined) {
       if (!value.input_actions || typeof value.input_actions !== 'object' || Array.isArray(value.input_actions)) throw new Error(`process profile '${id}' input_actions invalid`);
@@ -80,7 +82,7 @@ function normalizePolicyObject(raw, policyPath) {
       max_sessions: finiteInteger(value.max_sessions, `profiles.${id}.max_sessions`, 1, 32, 4),
       max_input_bytes: finiteInteger(value.max_input_bytes, `profiles.${id}.max_input_bytes`, 1, 1024 * 1024, 64 * 1024),
       max_retained_output_bytes: finiteInteger(value.max_retained_output_bytes, `profiles.${id}.max_retained_output_bytes`, 4096, 16 * 1024 * 1024, 1024 * 1024),
-      transport, env_allow: [...new Set(envAllow)], input_actions: inputActions
+      transport, allow_raw_input: allowRawInput, env_allow: [...new Set(envAllow)], input_actions: inputActions
     };
   }
   if (Object.keys(profiles).length === 0) throw new Error('process policy requires at least one profile');

package/src/process-runtime.mjs

@@ -60,6 +60,36 @@ function publicSession(session) {
     journal_head_sha256: session.journal_head_sha256
   };
 }
+function retainedSlice(session, begin = 0, length = session.retained_output_bytes - begin) {
+  if (!Number.isInteger(begin) || begin < 0 || !Number.isInteger(length) || length < 0) throw new Error('invalid retained output slice');
+  if (begin >= session.retained_output_bytes || length === 0) return Buffer.alloc(0);
+  const end = Math.min(session.retained_output_bytes, begin + length);
+  const parts = [];
+  let cursor = 0;
+  for (const chunk of session.output_chunks) {
+    const next = cursor + chunk.length;
+    if (next <= begin) { cursor = next; continue; }
+    if (cursor >= end) break;
+    const from = Math.max(0, begin - cursor);
+    const to = Math.min(chunk.length, end - cursor);
+    if (to > from) parts.push(chunk.subarray(from, to));
+    cursor = next;
+  }
+  if (parts.length === 0) return Buffer.alloc(0);
+  if (parts.length === 1) return Buffer.from(parts[0]);
+  return Buffer.concat(parts, end - begin);
+}
+function retainedAll(session) {
+  return retainedSlice(session, 0, session.retained_output_bytes);
+}
+function retainedTail(session, maxBytes) {
+  const length = Math.min(maxBytes, session.retained_output_bytes);
+  return retainedSlice(session, session.retained_output_bytes - length, length);
+}
+function retainedIndexOf(session, needle, begin = 0) {
+  if (!Buffer.isBuffer(needle) || needle.length < 1) return -1;
+  return retainedSlice(session, begin, session.retained_output_bytes - begin).indexOf(needle);
+}
 function appendOutput(session, chunk) {
   if (!chunk?.length) return;
   const bytes = Buffer.from(chunk);
@@ -67,13 +97,22 @@ function appendOutput(session, chunk) {
     Buffer.from(session.stream_sha256, 'hex'), bytes
   ]));
   session.stream_head += bytes.length;
-  session.output = Buffer.concat([session.output, bytes]);
-  if (session.output.length > session.max_retained_output_bytes) {
-    const drop = session.output.length - session.max_retained_output_bytes;
-    session.output = session.output.subarray(drop);
-    session.earliest_offset += drop;
+  session.output_chunks.push(bytes);
+  session.retained_output_bytes += bytes.length;
+  while (session.retained_output_bytes > session.max_retained_output_bytes && session.output_chunks.length > 0) {
+    const excess = session.retained_output_bytes - session.max_retained_output_bytes;
+    const first = session.output_chunks[0];
+    if (first.length <= excess) {
+      session.output_chunks.shift();
+      session.retained_output_bytes -= first.length;
+      session.earliest_offset += first.length;
+      continue;
+    }
+    session.output_chunks[0] = first.subarray(excess);
+    session.retained_output_bytes -= excess;
+    session.earliest_offset += excess;
   }
-  const tail = session.output.subarray(Math.max(0, session.output.length - 4096)).toString('latin1');
+  const tail = retainedTail(session, 4096).toString('latin1');
   const enabledAt = tail.lastIndexOf('\x1b[?9001h');
   const disabledAt = tail.lastIndexOf('\x1b[?9001l');
   if (enabledAt >= 0 || disabledAt >= 0) session.win32_input_mode = enabledAt > disabledAt;
@@ -166,7 +205,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
           child_pid:started.detail.child_pid, creation_filetime:String(started.detail.creation_filetime),
           state:terminal.type, exit_code:Number.isInteger(terminal.detail.exit_code) ? terminal.detail.exit_code : null,
           earliest_offset:terminal.detail.earliest_offset, stream_head:terminal.detail.stream_head,
-          stream_sha256:terminal.detail.stream_sha256, output, control_buffer:Buffer.alloc(0),
+          stream_sha256:terminal.detail.stream_sha256, output_chunks:[output], retained_output_bytes:output.length, control_buffer:Buffer.alloc(0),
           journal_head_sha256:checked.head_sha256, journal_path:path.join(policy.state_dir,name), event_count:checked.event_count,
           max_retained_output_bytes:profile.max_retained_output_bytes, stderr:'', terminate_requested:terminal.type==='terminated',
           protocol_error:null, transport:profile.transport, win32_input_mode:false, host:null, close_promise:Promise.resolve(),
@@ -262,7 +301,7 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     const session = {
       session_id: sessionId, job_id: randomBytes(32).toString('hex'), profile_id: profileId, root_id: rootId,
       cwd_relative: cwdInfo.relative, child_pid: null, creation_filetime: null, state: 'starting', exit_code: null,
-      earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output: Buffer.alloc(0), control_buffer: Buffer.alloc(0),
+      earliest_offset: 0, stream_head: 0, stream_sha256: ZERO_SHA256, output_chunks: [], retained_output_bytes: 0, control_buffer: Buffer.alloc(0),
       journal_head_sha256: ZERO_SHA256, journal_path: path.join(policy.state_dir, `${sessionId}.jsonl`), event_count: 0,
       max_retained_output_bytes: profile.max_retained_output_bytes, stderr: '', terminate_requested: false, protocol_error: null,
       transport: profile.transport,
@@ -286,15 +325,16 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
         const terminalState = session.terminate_requested ? 'terminated' : 'exited';
         try {
           const outputFile = `${session.session_id}.stream.bin`;
-          const retainedOutputSha256 = sha256Bytes(session.output);
-          await writeFile(path.join(policy.state_dir, outputFile), session.output, { flag:'wx' });
+          const retainedOutput = retainedAll(session);
+          const retainedOutputSha256 = sha256Bytes(retainedOutput);
+          await writeFile(path.join(policy.state_dir, outputFile), retainedOutput, { flag:'wx' });
           await appendEvent(runtime, session, terminalState, {
             recovery_schema:TERMINAL_RECOVERY_SCHEMA,
             exit_code:session.exit_code,
             earliest_offset:session.earliest_offset,
             stream_head:session.stream_head,
             stream_sha256:session.stream_sha256,
-            retained_output_bytes:session.output.length,
+            retained_output_bytes:session.retained_output_bytes,
             retained_output_sha256:retainedOutputSha256,
             output_file:outputFile
           });
@@ -311,17 +351,57 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return publicSession(session);
   }
 
-  async function read({ sessionId, offset = 0, maxBytes = 65536 }) {
+  async function read({ sessionId, offset = 0, maxBytes = 65536, waitMs = 0, waitFor = null }) {
     const session = await sessionFor(sessionId);
-    if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 262144) throw new Error('invalid process read bounds');
-    if (offset > session.stream_head) throw new Error('process read offset is beyond stream head');
-    const truncated = offset < session.earliest_offset;
-    const effective = Math.max(offset, session.earliest_offset);
+    if (!Number.isInteger(offset) || offset < -(16 * 1024 * 1024) || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 262144 ||
+        !Number.isInteger(waitMs) || waitMs < 0 || waitMs > 30000) throw new Error('invalid process read bounds');
+    if (waitFor !== null && (typeof waitFor !== 'string' || waitFor.length < 1 || waitFor.includes('\0') || Buffer.byteLength(waitFor, 'utf8') > 256)) {
+      throw new Error('invalid process wait_for literal');
+    }
+    const requested = offset < 0 ? Math.max(0, session.stream_head + offset) : offset;
+    if (requested > session.stream_head) throw new Error('process read offset is beyond stream head');
+    const baseline = session.stream_head;
+    const literal = waitFor === null ? null : Buffer.from(waitFor, 'utf8');
+    const satisfied = () => {
+      if (literal === null) return session.stream_head > baseline || session.state !== 'running';
+      const effectiveSearch = Math.max(requested, session.earliest_offset);
+      const begin = effectiveSearch - session.earliest_offset;
+      return retainedIndexOf(session, literal, begin) >= 0;
+    };
+    if (waitMs > 0 && session.state === 'running' && !satisfied()) {
+      const deadline = Date.now() + waitMs;
+      while (session.state === 'running' && !satisfied() && Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, Math.min(25, Math.max(1, deadline - Date.now()))));
+      }
+    }
+    const effectiveRequested = offset < 0 ? Math.max(0, session.stream_head + offset) : requested;
+    const truncated = effectiveRequested < session.earliest_offset;
+    const effective = Math.max(effectiveRequested, session.earliest_offset);
     const begin = effective - session.earliest_offset;
-    const data = session.output.subarray(begin, begin + maxBytes);
+    const data = retainedSlice(session, begin, maxBytes);
     return { session_id: session.session_id, offset: effective, next_offset: effective + data.length,
       earliest_offset: session.earliest_offset, stream_head: session.stream_head, stream_sha256: session.stream_sha256,
-      truncated, data_base64: data.toString('base64'), state: session.state, exit_code: session.exit_code };
+      truncated, wait_satisfied: waitFor === null ? (session.stream_head > baseline || waitMs === 0 || session.state !== 'running') : satisfied(),
+      data_base64: data.toString('base64'), state: session.state, exit_code: session.exit_code };
+  }
+
+  async function write({ sessionId, input, appendNewline = true }) {
+    const session = await sessionFor(sessionId);
+    if (session.state !== 'running') throw new Error('process write requires a running session');
+    const grant = await assertProcessArmed(policy, session.profile_id, session.root_id);
+    const profile = policy.profiles[session.profile_id];
+    if (!profile?.allow_raw_input) throw new Error(`process profile '${session.profile_id}' does not allow raw input`);
+    if (session.transport !== 'pipe' || profile.transport !== 'pipe') throw new Error('process raw input requires pipe transport');
+    if (typeof input !== 'string' || input.includes('\0')) throw new Error('process raw input must be a NUL-free string');
+    if (typeof appendNewline !== 'boolean') throw new Error('process appendNewline must be boolean');
+    const logicalBytes = Buffer.from(appendNewline ? `${input}\r\n` : input, 'utf8');
+    if (logicalBytes.length < 1 || logicalBytes.length > profile.max_input_bytes) throw new Error('process raw input exceeds profile input bound');
+    if (!session.host?.stdin || session.host.stdin.destroyed || !session.host.stdin.writable) throw new Error('process session input is not writable');
+    await recheckProcessAuthority(policy, grant, session.profile_id, session.root_id);
+    await new Promise((resolve, reject) => session.host.stdin.write(logicalBytes, error => error ? reject(error) : resolve()));
+    const logicalSha256 = sha256Bytes(logicalBytes);
+    await appendEvent(runtime, session, 'input', { logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, append_newline: appendNewline });
+    return { logical_bytes: logicalBytes.length, logical_sha256: logicalSha256, append_newline: appendNewline, session: publicSession(session) };
   }
 
   async function status({ sessionId }) { return publicSession(await sessionFor(sessionId)); }
@@ -383,5 +463,5 @@ export function createProcessRuntime({ policy, signingKeyPath, verifyKeyPath })
     return { ok: true, event_count: sequence, head_sha256: previous };
   }
 
-  return { policy, start, read, status, list, action, terminate, verifyEventJournal };
+  return { policy, start, read, write, status, list, action, terminate, verifyEventJournal };
 }

package/src/process-smoke-client.mjs

@@ -29,7 +29,7 @@ const policy = await loadProcessPolicy(smokePolicyPath);
 const keys = await generateTrustKeypair({ privateKeyPath: path.join(smokeTrust, 'private.pem'), publicKeyPath: path.join(smokeTrust, 'public.pem') });
 await mkdir(path.dirname(policy.grant_file), { recursive: true });
 const grant = { schema: PROCESS_GRANT_SCHEMA, policy_sha256: policy.policy_sha256,
-  instance_nonce: randomBytes(32).toString('hex'), profile_ids: ['ping_hold'], root_ids: ['core'],
+  instance_nonce: randomBytes(32).toString('hex'), profile_ids: ['ping_hold','powershell_repl'], root_ids: ['core'],
   granted_at_utc: new Date().toISOString() };
 await writeFile(policy.grant_file, `${JSON.stringify(grant, null, 2)}\n`, { flag: 'wx' });
 
@@ -37,8 +37,10 @@ const client = new Client({ name: 'deadbyte-process-smoke', version: '0.8.0' },
   { versionNegotiation: { mode: { pin: '2026-07-28' } } });
 const transport = new StdioClientTransport({
   command: process.execPath, args: [serverPath], cwd: repoRoot,
-  env: { ...getDefaultEnvironment(), DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: smokePolicyPath,
-    DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath },
+  env: { ...getDefaultEnvironment(), DEADBYTE_PRIVILEGED_POLICY: '', DEADBYTE_MACHINE_RUNTIME:'0', DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME: '1', DEADBYTE_PROCESS_POLICY: smokePolicyPath, DEADBYTE_CODING_RUNTIME:'0', DEADBYTE_MACHINE_FS_RUNTIME:'0',
+    DEADBYTE_OBSERVATION_RUNTIME:'0', DEADBYTE_DESKTOP_RUNTIME:'0', DEADBYTE_AUTONOMOUS_RUNTIME:'0', DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_CAPABILITY_PROFILE:'full', DEADBYTE_SIGNING_KEY: keys.privateKeyPath, DEADBYTE_VERIFY_KEY: keys.publicKeyPath },
   stderr: 'pipe'
 });
 const stderrChunks = [];
@@ -51,12 +53,13 @@ const structured = (result, label) => {
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 let sessionId = null;
 let journalPath = null;
+let replJournalPath = null;
 try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
   const expected = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open',
-    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate'].sort();
+    'process_session_action','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'].sort();
   if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`process smoke catalog mismatch: ${JSON.stringify(names)}`);
   const started = structured(await client.callTool({ name: 'process_session_start', arguments: {
     profile_id: 'ping_hold', root_id: 'core', cwd: '.', args: []
@@ -93,31 +96,72 @@ try {
   const terminated = structured(await client.callTool({ name: 'process_session_terminate', arguments: { session_id: sessionId } }), 'process_session_terminate');
   if (terminated.status !== 'ok' || terminated.session.state !== 'terminated') throw new Error(`process terminate failed: ${JSON.stringify(terminated)}`);
   const finalHead = terminated.session.journal_head_sha256;
+
+  const replStarted = structured(await client.callTool({ name: 'process_session_start', arguments: {
+    profile_id: 'powershell_repl', root_id: 'core', cwd: '.', args: []
+  } }), 'process_session_start powershell_repl');
+  const replSessionId = replStarted.session?.session_id;
+  if (replStarted.status !== 'ok' || !/^[0-9a-f]{64}$/.test(replSessionId ?? '')) throw new Error('powershell repl start malformed');
+  replJournalPath = path.join(policy.state_dir, `${replSessionId}.jsonl`);
+  const firstWrite = structured(await client.callTool({ name: 'process_session_write', arguments: {
+    session_id: replSessionId, input: "$x=41;[Console]::WriteLine('DB_PUBLIC_REPL_SET')", append_newline: true
+  } }), 'process_session_write set');
+  if (firstWrite.status !== 'ok' || firstWrite.session?.state !== 'running') throw new Error('powershell repl first write failed');
+  const beforeSecond = firstWrite.session.stream_head;
+  const secondWrite = structured(await client.callTool({ name: 'process_session_write', arguments: {
+    session_id: replSessionId, input: "[Console]::WriteLine('DB_PUBLIC_REPL_VALUE=' + ($x+1))", append_newline: true
+  } }), 'process_session_write value');
+  if (secondWrite.status !== 'ok') throw new Error('powershell repl second write failed');
+  const replRead = structured(await client.callTool({ name: 'process_session_read', arguments: {
+    session_id: replSessionId, offset: beforeSecond, max_bytes: 65536, wait_ms: 5000, wait_for: 'DB_PUBLIC_REPL_VALUE=42'
+  } }), 'process_session_read repl');
+  const replText = Buffer.from(replRead.data_base64 ?? '', 'base64').toString('utf8');
+  if (replRead.status !== 'ok' || replRead.wait_satisfied !== true || !replText.includes('DB_PUBLIC_REPL_VALUE=42')) {
+    throw new Error(`powershell repl state persistence proof failed: ${JSON.stringify(replRead)}`);
+  }
+  const replTail = structured(await client.callTool({ name: 'process_session_read', arguments: {
+    session_id: replSessionId, offset: -4096, max_bytes: 4096, wait_ms: 0, wait_for: null
+  } }), 'process_session_read tail');
+  if (!Buffer.from(replTail.data_base64 ?? '', 'base64').toString('utf8').includes('DB_PUBLIC_REPL_VALUE=42')) {
+    throw new Error('powershell repl tail read proof failed');
+  }
+  const replTerminated = structured(await client.callTool({ name: 'process_session_terminate', arguments: { session_id: replSessionId } }), 'process_session_terminate repl');
+  if (replTerminated.status !== 'ok' || replTerminated.session.state !== 'terminated') throw new Error('powershell repl terminate failed');
+  const replJournalText = await readFile(replJournalPath, 'utf8');
+  if (/DB_PUBLIC_REPL_SET|DB_PUBLIC_REPL_VALUE|\$x=41/.test(replJournalText)) throw new Error('powershell repl journal leaked raw input payload');
+  const replFinalHead = replTerminated.session.journal_head_sha256;
   await client.close();
 
   const verifyKey = await loadPublicVerifyKey(keys.publicKeyPath);
-  const records = (await readFile(journalPath, 'utf8')).split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
-  let previous = ZERO_SHA256;
-  let sequence = 0;
-  for (const record of records) {
-    const { event_sha256: eventSha, key_id: keyId, signature, ...unsigned } = record;
-    if (unsigned.session_id !== sessionId || unsigned.sequence !== sequence + 1 || unsigned.previous_event_sha256 !== previous || unsigned.policy_sha256 !== policy.policy_sha256) {
-      throw new Error('process journal chain mismatch');
+  const verifyJournal = async (targetSessionId, targetJournalPath, expectedHead, minimumEvents) => {
+    const records = (await readFile(targetJournalPath, 'utf8')).split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    let previous = ZERO_SHA256;
+    let sequence = 0;
+    for (const record of records) {
+      const { event_sha256: eventSha, key_id: keyId, signature, ...unsigned } = record;
+      if (unsigned.session_id !== targetSessionId || unsigned.sequence !== sequence + 1 || unsigned.previous_event_sha256 !== previous || unsigned.policy_sha256 !== policy.policy_sha256) {
+        throw new Error('process journal chain mismatch');
+      }
+      const canonical = Buffer.from(canonicalJson(unsigned), 'utf8');
+      const observed = sha256(canonical);
+      if (eventSha !== observed || keyId !== verifyKey.keyId || !cryptoVerify(null, Buffer.concat([EVENT_DOMAIN, canonical]), verifyKey.publicKey, Buffer.from(signature, 'base64'))) {
+        throw new Error('process journal signature mismatch');
+      }
+      previous = observed;
+      sequence += 1;
     }
-    const canonical = Buffer.from(canonicalJson(unsigned), 'utf8');
-    const observed = sha256(canonical);
-    if (eventSha !== observed || keyId !== verifyKey.keyId || !cryptoVerify(null, Buffer.concat([EVENT_DOMAIN, canonical]), verifyKey.publicKey, Buffer.from(signature, 'base64'))) {
-      throw new Error('process journal signature mismatch');
-    }
-    previous = observed;
-    sequence += 1;
-  }
-  if (sequence < 3 || previous !== finalHead) throw new Error('process journal head mismatch');
+    if (sequence < minimumEvents || previous !== expectedHead) throw new Error('process journal head mismatch');
+    return { sequence, head: previous };
+  };
+  const pingVerified = await verifyJournal(sessionId, journalPath, finalHead, 3);
+  const replVerified = await verifyJournal(replSessionId, replJournalPath, replFinalHead, 4);
   if ((await readFile(journalPath, 'utf8')).includes('DEADBYTE_ACTION_PING')) throw new Error('process journal leaked action payload');
-  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 12,
+  console.log(JSON.stringify({ status: 'passed', protocol_revision: '2026-07-28', tool_count: 13,
     profile_id: 'ping_hold', session_id: sessionId, observed_output_bytes: read.stream_head,
     action_id: action.action_id, logical_bytes: action.logical_bytes, logical_sha256: action.logical_sha256,
-    final_state: terminated.session.state, event_count: sequence, journal_head_sha256: previous,
+    final_state: terminated.session.state, event_count: pingVerified.sequence, journal_head_sha256: pingVerified.head,
+    persistent_repl: { profile_id:'powershell_repl', session_id:replSessionId, state_persisted:true, wait_for:true, tail_read:true,
+      raw_input_not_journaled:true, event_count:replVerified.sequence, journal_head_sha256:replVerified.head },
     policy_sha256: policy.policy_sha256, key_id: verifyKey.keyId, signature_valid: true }, null, 2));
 } catch (error) {
   const stderr = Buffer.concat(stderrChunks).toString('utf8').trim();
@@ -128,5 +172,6 @@ try {
   await client.close().catch(() => {});
   await rm(policy.grant_file, { force: true }).catch(() => {});
   if (journalPath) await rm(journalPath, { force: true }).catch(() => {});
+  if (replJournalPath) await rm(replJournalPath, { force: true }).catch(() => {});
   await rm(smokeTrust, { recursive: true, force: true }).catch(() => {});
 }