deadbyte-mcp 0.15.1 → 0.15.3

package/src/compact-gateway-mcp-tools.mjs

@@ -26,7 +26,7 @@ export const codingInspectInputSchema=z.discriminatedUnion('op',[
 export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('stat'),root_id:id,path:rel.default('.'),hash:z.boolean().default(false)}),
   z.strictObject({op:z.literal('list'),root_id:id,path:rel.default('.'),cursor,limit:z.number().int().min(1).max(1000).default(100),hash_files:z.boolean().default(false)}),
-  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false)}),
+  z.strictObject({op:z.literal('read'),root_id:id,path:rel,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536),hash_file:z.boolean().default(false),timeout_ms:z.number().int().min(100).max(180000).default(30000)}),
   z.strictObject({op:z.literal('write'),root_id:id,path:rel,content:z.string().max(12*1024*1024),encoding:z.enum(['utf8','base64']).default('utf8'),expected_sha256:z.string().regex(/^(?:absent|[0-9a-f]{64})$/)}),
   z.strictObject({op:z.literal('edit_exact'),root_id:id,path:rel,expected_sha256:hex64,old_string:z.string().min(1).max(262144),new_string:z.string().max(524288),expected_replacements:z.number().int().min(1).max(64).default(1)}),
   z.strictObject({op:z.literal('mkdir'),root_id:id,path:rel}),
@@ -36,7 +36,8 @@ export const machineFsGatewayInputSchema=z.discriminatedUnion('op',[
 
 export const processSessionGatewayInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('start'),profile_id:id,root_id:id,cwd:rel.default('.'),args:z.array(z.string().max(8192)).max(64).default([])}),
-  z.strictObject({op:z.literal('read'),session_id:hex64,offset:nonneg.default(0),max_bytes:z.number().int().min(1).max(262144).default(65536)}),
+  z.strictObject({op:z.literal('read'),session_id:hex64,offset:z.number().int().min(-(16*1024*1024)).default(0),max_bytes:z.number().int().min(1).max(262144).default(65536),wait_ms:z.number().int().min(0).max(30000).default(0),wait_for:z.string().min(1).max(256).nullable().default(null)}),
+  z.strictObject({op:z.literal('write'),session_id:hex64,input:z.string().min(1).max(1024*1024),append_newline:z.boolean().default(true)}),
   z.strictObject({op:z.literal('status'),session_id:hex64}),
   z.strictObject({op:z.literal('list')}),
   z.strictObject({op:z.literal('action'),session_id:hex64,action_id:id}),
@@ -83,7 +84,7 @@ async function machineFs(args,runtime){
   const map={
     stat:r=>r.stat({rootId:args.root_id,relativePath:args.path,hash:args.hash}),
     list:r=>r.list({rootId:args.root_id,relativePath:args.path,cursor:args.cursor,limit:args.limit,hashFiles:args.hash_files}),
-    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file}),
+    read:r=>r.read({rootId:args.root_id,relativePath:args.path,offset:args.offset,maxBytes:args.max_bytes,hashFile:args.hash_file,timeoutMs:args.timeout_ms}),
     write:r=>r.write({rootId:args.root_id,relativePath:args.path,content:args.content,encoding:args.encoding,expectedSha256:args.expected_sha256}),
     edit_exact:r=>r.editExact({rootId:args.root_id,relativePath:args.path,expectedSha256:args.expected_sha256,oldString:args.old_string,newString:args.new_string,expectedReplacements:args.expected_replacements}),
     mkdir:r=>r.mkdir({rootId:args.root_id,relativePath:args.path}),
@@ -96,7 +97,8 @@ async function machineFs(args,runtime){
 async function processSession(args,runtime){
   const map={
     start:r=>r.start({profileId:args.profile_id,rootId:args.root_id,cwd:args.cwd,args:args.args}),
-    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes}),
+    read:r=>r.read({sessionId:args.session_id,offset:args.offset,maxBytes:args.max_bytes,waitMs:args.wait_ms,waitFor:args.wait_for}),
+    write:r=>r.write({sessionId:args.session_id,input:args.input,appendNewline:args.append_newline}),
     status:r=>r.status({sessionId:args.session_id}),
     list:r=>r.list(),
     action:r=>r.action({sessionId:args.session_id,actionId:args.action_id}),
@@ -136,7 +138,7 @@ export function registerCompactGatewayTools(server,{profile,ledger,codingRuntime
   });
   server.registerTool('coding_inspect',{description:'Typed compact coding inspection and semantic navigation gateway. No arbitrary tool dispatch.',inputSchema:codingInspectInputSchema,outputSchema:compactGatewayOutputSchema},args=>codingInspect(args,codingRuntime,semanticRuntime));
   server.registerTool('machine_fs',{description:'Typed compact machine filesystem gateway preserving root policy and mutation preconditions.',inputSchema:machineFsGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineFs(args,machineFsRuntime));
-  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. No raw stdin or PID authority.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
+  server.registerTool('process_session',{description:'Typed compact DEADBYTE-owned process session gateway. Raw input is available only for locally opt-in profiles and remains grant-bounded; numeric PID authority is never exposed.',inputSchema:processSessionGatewayInputSchema,outputSchema:compactGatewayOutputSchema},args=>processSession(args,processRuntime));
   server.registerTool('machine_observe',{description:'Typed compact machine identity and read-only observation gateway. Revoke is intentionally excluded.',inputSchema:machineObserveInputSchema,outputSchema:compactGatewayOutputSchema},args=>machineObserve(args,machineRuntime,observationRuntime));
   server.registerTool('desktop_control',{description:'Typed Desktop observe, target, status and guarded action gateway. No arbitrary dispatch; mutation still requires separate Desktop authority.',inputSchema:desktopControlInputSchema,outputSchema:compactGatewayOutputSchema},args=>invokeDesktopOperation(args,desktopRuntime));
 }

package/src/deadbyte-cli.mjs

@@ -87,6 +87,9 @@ function controllerRuntimeReady(text){
     /^Local ready\s*:\s*True\s*$/m.test(value)&&
     /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
 }
+function controllerRuntimeDegraded(text){
+  return /^DEADBYTE MCP\s*=\s*DEGRADED\s*$/m.test(String(text||''));
+}
 async function listLogFiles(root){
   const files=[];
   const audit=path.join(root,'audit');
@@ -319,10 +322,11 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
     if(preflight.status===0&&controllerRuntimeReady(preflight.stdout)){
       process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     }else{
-      process.stdout.write('[BOOT] Starting bridge/runtime...\n');
-      invokeController(ctx,'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
+      const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
+      process.stdout.write(recovery?'[RECOVERY] Runtime DEGRADED; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      invokeController(ctx,recovery?'restart':'start',{discardOutput:true,timeoutMs:REMOTE_START_TIMEOUT_MS});
       const started=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
-      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error('remote controller start returned without a verified ONLINE runtime');
+      if(started.status!==0||!controllerRuntimeReady(started.stdout)) throw new Error(`remote controller ${recovery?'restart':'start'} returned without a verified ONLINE runtime`);
       startText=started.stdout||'';
     }
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);

package/src/deadline-cancellation.mjs

@@ -0,0 +1,83 @@
+const ID=/^[A-Za-z0-9._:-]{1,128}$/;
+
+export function createDeadline({timeoutMs=null, nowMs=Date.now(), id=null}={}) {
+  if(timeoutMs!==null && (!Number.isInteger(timeoutMs)||timeoutMs<1)) throw new Error('deadline timeout_ms invalid');
+  if(!Number.isFinite(nowMs)) throw new Error('deadline now_ms invalid');
+  const deadlineMs=timeoutMs===null?null:nowMs+timeoutMs;
+  return Object.freeze({
+    schema:'deadbyte.deadline.v1',
+    id:id===null?null:validateId(id),
+    created_at_ms:nowMs,
+    timeout_ms:timeoutMs,
+    deadline_ms:deadlineMs
+  });
+}
+
+export function deadlineState(deadline,{nowMs=Date.now()}={}) {
+  if(!deadline||deadline.schema!=='deadbyte.deadline.v1') throw new Error('deadline invalid');
+  if(!Number.isFinite(nowMs)) throw new Error('deadline now_ms invalid');
+  if(deadline.deadline_ms===null) return Object.freeze({expired:false,remaining_ms:null});
+  const remainingMs=deadline.deadline_ms-nowMs;
+  return Object.freeze({expired:remainingMs<=0,remaining_ms:Math.max(0,remainingMs)});
+}
+
+export function createCancellationToken({id=null}={}) {
+  const controller=new AbortController();
+  let requestedAtMs=null;
+  let reason=null;
+  const request=(value='cancelled')=>{
+    if(controller.signal.aborted)return false;
+    requestedAtMs=Date.now();
+    reason=String(value);
+    controller.abort(reason);
+    return true;
+  };
+  return Object.freeze({
+    schema:'deadbyte.cancellation.v1',
+    id:id===null?null:validateId(id),
+    signal:controller.signal,
+    request,
+    snapshot:()=>Object.freeze({
+      requested:controller.signal.aborted,
+      requested_at_ms:requestedAtMs,
+      reason
+    })
+  });
+}
+
+export function composeAbortSignal({deadline=null,cancellation=null}={}) {
+  const controller=new AbortController();
+  let timeout=null;
+  const abort=(reason)=>{
+    if(!controller.signal.aborted)controller.abort(reason);
+  };
+  if(cancellation?.signal){
+    if(cancellation.signal.aborted)abort(cancellation.signal.reason??'cancelled');
+    else cancellation.signal.addEventListener('abort',()=>abort(cancellation.signal.reason??'cancelled'),{once:true});
+  }
+  if(deadline?.deadline_ms!==null&&deadline?.deadline_ms!==undefined){
+    const remaining=Math.max(0,deadline.deadline_ms-Date.now());
+    if(remaining===0)abort('deadline_exceeded');
+    else timeout=setTimeout(()=>abort('deadline_exceeded'),remaining);
+    timeout?.unref?.();
+  }
+  const close=()=>{if(timeout)clearTimeout(timeout);};
+  return Object.freeze({signal:controller.signal,close});
+}
+
+export function classifyTermination({deadlineExceeded=false,cancellationRequested=false,physicallyTerminated=false,verified=false}={}) {
+  return Object.freeze({
+    deadline_exceeded:deadlineExceeded===true,
+    cancellation_requested:cancellationRequested===true,
+    physical_termination:physicallyTerminated===true,
+    verified:verified===true,
+    terminal_semantics:
+      verified ? (physicallyTerminated ? 'verified_termination' : 'verified_stop')
+      : physicallyTerminated ? 'termination_unverified'
+      : cancellationRequested ? 'cancellation_requested'
+      : deadlineExceeded ? 'deadline_exceeded'
+      : 'running'
+  });
+}
+
+function validateId(id){if(typeof id!=='string'||!ID.test(id))throw new Error('deadline/cancellation id invalid');return id;}

package/src/machine-fs-mcp-tools.mjs

@@ -32,10 +32,10 @@ export function registerMachineFsTools(server, { runtime }) {
   });
   server.registerTool('machine_fs_read', {
     description:'Read one bounded byte range from a root-relative regular file.',
-    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false) }),
+    inputSchema:z.strictObject({ root_id:id, path:rel, offset:z.number().int().nonnegative().default(0), max_bytes:z.number().int().min(1).max(4*1024*1024).default(65536), hash_file:z.boolean().default(false), timeout_ms:z.number().int().min(100).max(180000).default(30000) }),
     outputSchema:machineFsReadOutputSchema
-  }, async ({root_id,path,offset,max_bytes,hash_file}) => {
-    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file})); }
+  }, async ({root_id,path,offset,max_bytes,hash_file,timeout_ms}) => {
+    try { return ok(machineFsReadOutputSchema, await runtime.read({rootId:root_id,relativePath:path,offset,maxBytes:max_bytes,hashFile:hash_file,timeoutMs:timeout_ms})); }
     catch (error) { return fail(machineFsReadOutputSchema,error); }
   });
   server.registerTool('machine_fs_write', {

package/src/machine-fs-output-contracts.mjs

@@ -33,7 +33,7 @@ export const machineFsReadOutputSchema = z.strictObject({
   offset: z.number().int().nonnegative().optional(), next_offset: z.number().int().nonnegative().optional(),
   file_size: z.number().int().nonnegative().optional(), eof: z.boolean().optional(),
   data_base64: z.string().max(12 * 1024 * 1024).optional(), data_sha256: hex64.optional(),
-  file_sha256: hex64.nullable().optional()
+  file_sha256: hex64.nullable().optional(), timeout_ms: z.number().int().min(100).max(180000).optional()
 });
 
 const commitBase = {

package/src/machine-fs-read-worker.mjs

@@ -0,0 +1,46 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, promises as fs } from 'node:fs';
+
+const [file, offsetText, lengthText, hashText] = process.argv.slice(2);
+const offset = Number(offsetText);
+const length = Number(lengthText);
+if (typeof file !== 'string' || !Number.isSafeInteger(offset) || offset < 0 ||
+    !Number.isSafeInteger(length) || length < 0 || length > 4 * 1024 * 1024 ||
+    !['0','1'].includes(hashText ?? '0')) {
+  process.stderr.write('invalid machine-fs read worker arguments\n');
+  process.exit(64);
+}
+
+try {
+  const handle = await fs.open(file, 'r');
+  let bytes;
+  try {
+    const buffer = Buffer.alloc(length);
+    const result = length ? await handle.read(buffer, 0, length, offset) : { bytesRead: 0 };
+    bytes = buffer.subarray(0, result.bytesRead);
+  } finally {
+    await handle.close();
+  }
+
+  let fileSha256 = null;
+  if (hashText === '1') {
+    const hash = createHash('sha256');
+    await new Promise((resolve, reject) => {
+      const stream = createReadStream(file);
+      stream.on('data', chunk => hash.update(chunk));
+      stream.once('error', reject);
+      stream.once('end', resolve);
+    });
+    fileSha256 = hash.digest('hex');
+  }
+
+  process.stdout.write(JSON.stringify({
+    schema: 'deadbyte.machine-fs-read-worker.v1',
+    bytes_read: bytes.length,
+    data_base64: bytes.toString('base64'),
+    file_sha256: fileSha256
+  }));
+} catch (error) {
+  process.stderr.write(String(error?.stack ?? error));
+  process.exit(1);
+}

package/src/machine-fs-smoke-client.mjs

@@ -56,7 +56,7 @@ const transport = new StdioClientTransport({
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const baseTools = ['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const codingTools = [
   'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
   'coding_receipt_verify','coding_search','coding_session_status','coding_stat',

package/src/machine-fs.mjs

@@ -1,12 +1,15 @@
 import { createHash, randomBytes, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
 import { createReadStream } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { lstat, mkdir as fsMkdir, open, readFile, readdir, realpath, rename, rm, rmdir } from 'node:fs/promises';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { canonicalJson } from './canonical-json.mjs';
 import { assertCodingArmed, recheckCodingAuthority } from './coding-plane.mjs';
 import { isInside, validatePortableRelativePath } from './path-policy.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { loadPrivateSigningKey, loadPublicVerifyKey } from './trust.mjs';
+import { atomicMutation } from './atomic-mutation.mjs';
 
 export const MACHINE_FS_RECEIPT_SCHEMA = 'deadbyte.machine-fs-receipt.v1';
 const RECEIPT_DOMAIN = Buffer.from('DEADBYTE-MACHINE-FS-RECEIPT-V1\0', 'utf8');
@@ -29,6 +32,55 @@ async function sha256File(file) {
   return hash.digest('hex');
 }
 
+const machineFsReadWorkerPath = fileURLToPath(new URL('./machine-fs-read-worker.mjs', import.meta.url));
+async function boundedReadWorker({ file, offset, length, hashFile, timeoutMs, workerPath = machineFsReadWorkerPath }) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [workerPath, file, String(offset), String(length), hashFile ? '1' : '0'], {
+      windowsHide: true, shell: false, stdio: ['ignore','pipe','pipe']
+    });
+    const stdout = [];
+    let stdoutBytes = 0;
+    let stderr = '';
+    let settled = false;
+    let timedOut = false;
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(value);
+    };
+    child.stdout.on('data', chunk => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > 8 * 1024 * 1024) {
+        child.kill();
+        finish(reject, new Error('machine fs read worker output exceeded bound'));
+        return;
+      }
+      stdout.push(Buffer.from(chunk));
+    });
+    child.stderr.on('data', chunk => { stderr = (stderr + chunk.toString('utf8')).slice(-16384); });
+    child.once('error', error => finish(reject, error));
+    child.once('close', code => {
+      if (settled) return;
+      if (timedOut) return finish(reject, new Error(`machine fs read timed out after ${timeoutMs}ms`));
+      if (code !== 0) return finish(reject, new Error(`machine fs read worker failed exit=${String(code)}: ${stderr}`));
+      let value;
+      try { value = JSON.parse(Buffer.concat(stdout).toString('utf8')); }
+      catch { return finish(reject, new Error('machine fs read worker returned invalid JSON')); }
+      if (value?.schema !== 'deadbyte.machine-fs-read-worker.v1' || !Number.isInteger(value.bytes_read) ||
+          typeof value.data_base64 !== 'string' || (value.file_sha256 !== null && !SHA256_RE.test(value.file_sha256 ?? ''))) {
+        return finish(reject, new Error('machine fs read worker response invalid'));
+      }
+      finish(resolve, value);
+    });
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
 function getRoot(policy, rootId, permission) {
   const root = policy.roots[rootId];
   if (!root) throw new Error(`machine fs root '${rootId}' is not allowed`);
@@ -220,32 +272,11 @@ function requestSha(operation, args) {
 }
 
 async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null) {
-  const before = await regularState(target);
-  checkExpectedFile(before, expectedSha256);
-  const temp = path.join(path.dirname(target), `.${path.basename(target)}.deadbyte-machine-fs-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
-  let handle;
-  try {
-    if (authorityCheck) await authorityCheck();
-    handle = await open(temp, 'wx', 0o600);
-    await handle.writeFile(bytes);
-    await handle.sync();
-    await handle.close();
-    handle = null;
-    checkExpectedFile(await regularState(target), expectedSha256);
-    if (authorityCheck) await authorityCheck();
-    await rename(temp, target);
-  } catch (error) {
-    if (handle) await handle.close().catch(() => {});
-    await rm(temp, { force: true }).catch(() => {});
-    throw error;
-  }
-  const after = await regularState(target);
-  const expectedAfter = sha256Bytes(bytes);
-  if (!after.exists || after.sha256 !== expectedAfter) throw new Error('machine fs post-commit hash mismatch');
-  return { before, after };
+  return atomicMutation({ target, bytes, expected: expectedSha256, readState: regularState,
+    assertExpected: checkExpectedFile, authorityCheck, tempTag: 'deadbyte-machine-fs' });
 }
 
-export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }) {
+export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
   if (!policy) throw new Error('machine fs runtime requires coding policy');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('machine fs runtime requires trust key paths');
 
@@ -292,25 +323,27 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath }
     const nextCursor = filtered.length > selected.length && selected.length ? encodeCursor(selected.at(-1).name) : null;
     return { status: 'ok', root_id: rootId, path: found.relative, entries, next_cursor: nextCursor };
   }
-  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false }) {
+  async function readRange({ rootId, relativePath, offset = 0, maxBytes = 65536, hashFile = false, timeoutMs = 30000 }) {
     if (!Number.isInteger(offset) || offset < 0) throw new Error('machine fs read offset must be nonnegative integer');
     if (!Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > policy.max_read_bytes) throw new Error(`machine fs max_bytes must be in [1, ${policy.max_read_bytes}]`);
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 180000) throw new Error('machine fs read timeout_ms must be in [100, 180000]');
     const grant = await assertCodingArmed(policy, rootId);
     const found = await resolveExisting(policy, grant, rootId, relativePath, 'read', false);
     const info = await lstat(found.resolved);
     if (!info.isFile()) throw new Error('machine fs read target must be a regular file');
     if (offset > info.size) throw new Error('machine fs read offset exceeds file size');
-    const handle = await open(found.resolved, 'r');
     const length = Math.min(maxBytes, info.size - offset);
-    const buffer = Buffer.alloc(length);
-    try { if (length) await handle.read(buffer, 0, length, offset); }
-    finally { await handle.close(); }
-    const fileSha = hashFile ? await sha256File(found.resolved) : null;
+    await recheckCodingAuthority(policy, grant, rootId);
+    const worker = await boundedReadWorker({ file: found.resolved, offset, length, hashFile, timeoutMs, workerPath: readWorkerPath });
+    const buffer = Buffer.from(worker.data_base64, 'base64');
+    if (buffer.length !== worker.bytes_read || buffer.length > length) throw new Error('machine fs read worker byte count mismatch');
+    await recheckCodingAuthority(policy, grant, rootId);
     return {
       status: 'ok', root_id: rootId, path: found.relative,
-      offset, next_offset: offset + length, file_size: info.size,
-      eof: offset + length >= info.size, data_base64: buffer.toString('base64'),
-      data_sha256: sha256Bytes(buffer), file_sha256: fileSha
+      offset, next_offset: offset + buffer.length, file_size: info.size,
+      eof: offset + buffer.length >= info.size, data_base64: buffer.toString('base64'),
+      data_sha256: sha256Bytes(buffer), file_sha256: worker.file_sha256,
+      timeout_ms: timeoutMs
     };
   }
 

package/src/mcp-server.mjs

@@ -14,6 +14,8 @@ import { defaultPrivateKeyPath, defaultPublicKeyPath, loadPrivateSigningKey, loa
 import { DEADBYTE_VERSION } from './version.mjs';
 import { currentIngressAdapterMode, TUNNEL_STDIO_PROBE_COMPAT_MODE } from './ingress-mode.mjs';
 import { installTunnelStdioProbeCompat } from './tunnel-stdio-compat.mjs';
+import { installStdioConsoleGuard } from './stdio-console-guard.mjs';
+import { recoverInterruptedSlotUpdates } from './runtime-update.mjs';
 import { decodeUtf8Strict } from './text-policy.mjs';
 import { assertHostArmed, hostExec, hostExecInline, hostExecNative, hostFileRead, hostFileWrite, loadHostPolicy } from './host-plane.mjs';
 import { createMachineRuntime } from './machine-identity.mjs';
@@ -73,6 +75,11 @@ const verifyKeyPath = process.env.DEADBYTE_VERIFY_KEY ?? defaultPublicKeyPath();
 const auditRuntimeMode = process.env.DEADBYTE_AUDIT_RUNTIME ?? '0';
 if (!['0','1'].includes(auditRuntimeMode)) throw new Error('DEADBYTE_AUDIT_RUNTIME must be 0 or 1');
 const runtimeStateRoot = path.resolve(process.env.DEADBYTE_STATE_ROOT || path.join(os.homedir(),'.deadbyte-mcp'));
+const interruptedUpdateRecovery = await recoverInterruptedSlotUpdates({ stateRoot: runtimeStateRoot });
+if (interruptedUpdateRecovery.launched > 0) {
+  console.error(`[runtime-update-recovery] launched ${interruptedUpdateRecovery.launched} detached supervisor(s)`);
+}
+
 const surfaceProfile = capabilityProfileFromEnv(process.env);
 const localPrivilegedPolicyPath = path.join(packageRoot, 'controller', 'deadbyte-host-policy.json');
 const privilegedPolicyExplicit = Object.hasOwn(process.env, 'DEADBYTE_PRIVILEGED_POLICY');
@@ -231,6 +238,9 @@ const skillRoot=path.join(runtimeStateRoot,'skills');
 await mkdir(skillRoot,{recursive:true});
 const skillRuntime=await createSkillPlane({root:skillRoot,verifyKeyPath});
 
+installStdioConsoleGuard();
+if (process.env.DEADBYTE_STDIO_CONSOLE_GUARD_PROBE === '1') console.log('DEADBYTE_STDIO_CONSOLE_GUARD_PROBE');
+
 const ingressAdapterMode = currentIngressAdapterMode();
 installTunnelStdioProbeCompat({
   enabled: ingressAdapterMode === TUNNEL_STDIO_PROBE_COMPAT_MODE,

package/src/mcp-smoke-client.mjs

@@ -38,7 +38,8 @@ const transport = new StdioClientTransport({
     ...getDefaultEnvironment(),
     DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
     DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
-    DEADBYTE_VERIFY_KEY: keys.publicKeyPath
+    DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+    DEADBYTE_STDIO_CONSOLE_GUARD_PROBE: '1'
   },
   stderr: 'pipe'
 });
@@ -64,6 +65,8 @@ try {
 
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
+  const guardStderr = Buffer.concat(serverStderr).toString('utf8');
+  if (!guardStderr.includes('DEADBYTE MCP LOG DEADBYTE_STDIO_CONSOLE_GUARD_PROBE')) throw new Error('stdio console guard probe did not reach stderr');
   const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
   const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
   const allowedCatalogs = [

package/src/observation-runtime.mjs

@@ -133,14 +133,32 @@ function requestSha(policy,operation,args){
 }
 export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,processRuntime=null,stateRoot=path.join(os.homedir(),'.deadbyte-mcp'),
   processSnapshotProvider=defaultProcessSnapshotProvider,systemSnapshotProvider=defaultSystemSnapshotProvider,
-  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider}={}){
+  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,
+  searchSessionTtlMs=5*60*1000,maxSearchSessions=128,clockMs=()=>Date.now()}={}){
   if(!policy||!signingKeyPath||!verifyKeyPath) throw new Error('observation runtime requires policy and trust keys');
+  if(!Number.isInteger(searchSessionTtlMs)||searchSessionTtlMs<10||searchSessionTtlMs>24*60*60*1000) throw new Error('searchSessionTtlMs out of range');
+  if(!Number.isInteger(maxSearchSessions)||maxSearchSessions<1||maxSearchSessions>4096) throw new Error('maxSearchSessions out of range');
+  if(typeof clockMs!=='function') throw new Error('clockMs must be a function');
   const searches=new Map(),snapshots=new Map();
   let signingPromise=null;
   const runtime={policy,signing:()=>signingPromise??=(loadPrivateSigningKey(signingKeyPath))};
+  const terminalSearchState=state=>['completed','cancelled','failed'].includes(state);
+  function pruneSearches(){
+    const now=Number(clockMs());
+    if(!Number.isFinite(now)) throw new Error('search clock invalid');
+    for(const [id,session] of searches){
+      if(terminalSearchState(session.state)&&Number.isFinite(session.completed_at_ms)&&now-session.completed_at_ms>=searchSessionTtlMs) searches.delete(id);
+    }
+    if(searches.size>maxSearchSessions){
+      const terminal=[...searches.values()].filter(s=>terminalSearchState(s.state))
+        .sort((a,b)=>(a.completed_at_ms??Infinity)-(b.completed_at_ms??Infinity)||a.search_id.localeCompare(b.search_id));
+      for(const session of terminal){ if(searches.size<=maxSearchSessions) break; searches.delete(session.search_id); }
+    }
+  }
   function searchFor(searchId){
     if(!HEX64.test(searchId??'')) throw new Error('invalid search id');
-    const session=searches.get(searchId); if(!session) throw new Error(`unknown search '${searchId}'`); return session;
+    pruneSearches();
+    const session=searches.get(searchId); if(!session) throw new Error(`unknown or expired search '${searchId}'`); return session;
   }
   async function finalizeSearch(session,state,error=null){
     session.error=error?String(error):null;
@@ -149,7 +167,8 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
       bytes_scanned:session.bytes_scanned,truncated:session.truncated,error:session.error
     });
     session.receipt_id=receipt.receipt_id; session.receipt_sha256=receipt.receipt_sha256;
-    session.state=state;
+    session.state=state; session.completed_at_ms=Number(clockMs());
+    pruneSearches();
   }
   async function executeSearch(session){
     if(session.cancel_requested){ await finalizeSearch(session,'cancelled'); return; }
@@ -200,11 +219,13 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     if(!Number.isInteger(maxBytes)||maxBytes<1||maxBytes>64*1024*1024) throw new Error('max_bytes out of range');
     if(!Number.isInteger(maxFileBytes)||maxFileBytes<1||maxFileBytes>4*1024*1024) throw new Error('max_file_bytes out of range');
     rootFor(policy,rootId); if(relativePath!=='.') validatePortableRelativePath(relativePath);
+    pruneSearches();
+    if(searches.size>=maxSearchSessions) throw new Error('observation search session limit reached');
     const args={root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes};
     const session={search_id:randomBytes(32).toString('hex'),root_id:rootId,path:relativePath,pattern,case_sensitive:caseSensitive,
       max_results:maxResults,max_files:maxFiles,max_bytes:maxBytes,max_file_bytes:maxFileBytes,state:'pending',cancel_requested:false,
       results:[],files_scanned:0,bytes_scanned:0,truncated:false,result_head_sha256:ZERO,error:null,receipt_id:null,receipt_sha256:null,
-      request_sha256:requestSha(policy,'machine_search_start',args)};
+      created_at_ms:Number(clockMs()),completed_at_ms:null,request_sha256:requestSha(policy,'machine_search_start',args)};
     searches.set(session.search_id,session); setImmediate(()=>{ void executeSearch(session); });
     return {status:'accepted',search_id:session.search_id,state:session.state,request_sha256:session.request_sha256};
   }

package/src/observation-smoke-client.mjs

@@ -51,7 +51,7 @@ const transport=new StdioClientTransport({command:process.execPath,args:[serverP
   env:{...getDefaultEnvironment(),DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
     DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_STATE_ROOT:state,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath},stderr:'pipe'});
 const stderr=[]; transport.stderr?.on('data',chunk=>stderr.push(Buffer.from(chunk)));
-const base=['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open'];
+const base=['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
 const machine=['machine_list','machine_ping','machine_revoke','machine_status'];
 const coding=['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read','coding_receipt_verify','coding_search',
   'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',

package/src/process-mcp-tools.mjs

@@ -1,4 +1,4 @@
-import * as z from 'zod/v4';
+import * as z from 'zod/v4';
 import {
   processActionOutputSchema,
   processListOutputSchema,
@@ -6,6 +6,7 @@ import {
   processStartOutputSchema,
   processStatusOutputSchema,
   processTerminateOutputSchema,
+  processWriteOutputSchema,
   processStructuredResult
 } from './process-output-contracts.mjs';
 
@@ -21,23 +22,35 @@ export function registerProcessTools(server, { runtime }) {
     description: 'Start one locally registered process profile inside an approved root. Executable identity comes only from local policy.',
     inputSchema: z.strictObject({
       profile_id: id, root_id: id, cwd: z.string().min(1).max(1024).default('.'),
-      args: z.array(z.string().max(8192)).max(64).default([])
+      args: z.array(z.string().max(8192)).max(64).default([]), timeout_ms: z.number().int().min(100).max(900000).nullable().default(null)
     }), outputSchema: processStartOutputSchema
-  }, async ({ profile_id, root_id, cwd, args }) => {
-    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args }) }); }
+  }, async ({ profile_id, root_id, cwd, args, timeout_ms }) => {
+    try { return ok(processStartOutputSchema, { status: 'ok', session: await runtime.start({ profileId: profile_id, rootId: root_id, cwd, args, timeoutMs: timeout_ms }) }); }
     catch (error) { return fail(processStartOutputSchema, 'denied', error); }
   });
   server.registerTool('process_session_read', {
     description: 'Read a bounded byte range from one DEADBYTE-owned process session using ordered stream offsets.',
     inputSchema: z.strictObject({
-      session_id: hex64, offset: z.number().int().nonnegative().default(0),
-      max_bytes: z.number().int().min(1).max(262144).default(65536)
+      session_id: hex64, offset: z.number().int().min(-(16 * 1024 * 1024)).default(0),
+      max_bytes: z.number().int().min(1).max(262144).default(65536),
+      wait_ms: z.number().int().min(0).max(30000).default(0),
+      wait_for: z.string().min(1).max(256).nullable().default(null)
     }), outputSchema: processReadOutputSchema
-  }, async ({ session_id, offset, max_bytes }) => {
-    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes })) }); }
+  }, async ({ session_id, offset, max_bytes, wait_ms, wait_for }) => {
+    try { return ok(processReadOutputSchema, { status: 'ok', ...(await runtime.read({ sessionId: session_id, offset, maxBytes: max_bytes, waitMs: wait_ms, waitFor: wait_for })) }); }
     catch (error) { return fail(processReadOutputSchema, 'denied', error); }
   });
 
+  server.registerTool('process_session_write', {
+    description: 'Write one bounded UTF-8 input payload to a running DEADBYTE-owned pipe session only when its local profile explicitly enables raw input. Input text is never stored in the signed journal; only byte count and SHA-256 identity are recorded.',
+    inputSchema: z.strictObject({
+      session_id: hex64, input: z.string().min(1).max(1024 * 1024), append_newline: z.boolean().default(true)
+    }), outputSchema: processWriteOutputSchema
+  }, async ({ session_id, input, append_newline }) => {
+    try { return ok(processWriteOutputSchema, { status: 'ok', ...(await runtime.write({ sessionId: session_id, input, appendNewline: append_newline })) }); }
+    catch (error) { return fail(processWriteOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_status', {
     description: 'Read the verified state of one DEADBYTE-owned process session by session identity.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processStatusOutputSchema
@@ -53,6 +66,14 @@ export function registerProcessTools(server, { runtime }) {
     try { return ok(processListOutputSchema, { status: 'ok', ...(await runtime.list()) }); }
     catch (error) { return fail(processListOutputSchema, 'failed', error); }
   });
+  server.registerTool('process_session_cancel', {
+    description: 'Request cooperative cancellation of one DEADBYTE-owned process session. Cancellation is recorded separately from physical termination.',
+    inputSchema: z.strictObject({ session_id: hex64, reason: z.string().min(1).max(256).default('operator_request') }), outputSchema: processTerminateOutputSchema
+  }, async ({ session_id, reason }) => {
+    try { return ok(processTerminateOutputSchema, { status: 'ok', session: await runtime.cancel({ sessionId: session_id, reason }) }); }
+    catch (error) { return fail(processTerminateOutputSchema, 'denied', error); }
+  });
+
   server.registerTool('process_session_terminate', {
     description: 'Terminate one DEADBYTE-owned process session through its owned host boundary. Numeric PID is never an input.',
     inputSchema: z.strictObject({ session_id: hex64 }), outputSchema: processTerminateOutputSchema