deadbyte-mcp 0.15.1 → 0.15.3

package/src/remote-device-r44.mjs

@@ -57,19 +57,34 @@ function parseDeviceKey(spki){
   insist(key.asymmetricKeyType==='ed25519','remote device key must be Ed25519');
   return {deviceId:sha(der),spki};
 }
-function publicDevice(d){
+function publicDevice(d,reachableTtlMs=Infinity){
+  const lastOk=typeof d.last_probe_ok_at_utc==='string'?Date.parse(d.last_probe_ok_at_utc):NaN;
+  const fresh=d.reachable===true&&(reachableTtlMs===Infinity||(Number.isFinite(lastOk)&&Date.now()-lastOk<=reachableTtlMs));
   return {device_id:d.device_id,display_name:d.display_name,epoch:d.epoch,revoked:d.revoked,
-    reported_online:d.reported_online,reachable:d.reachable,connection_id:d.connection_id,updated_at_utc:d.updated_at_utc};
+    reported_online:d.reported_online,reachable:fresh,connection_id:d.connection_id,
+    last_probe_ok_at_utc:d.last_probe_ok_at_utc??null,updated_at_utc:d.updated_at_utc};
+}
+async function withTimeout(operation,timeoutMs,label){
+  let timer;
+  try{
+    return await Promise.race([
+      Promise.resolve().then(operation),
+      new Promise((_,reject)=>{timer=setTimeout(()=>reject(new Error(`${label} timed out after ${timeoutMs}ms`)),timeoutMs);timer.unref?.();})
+    ]);
+  }finally{if(timer)clearTimeout(timer);}
 }
 function payloadHash({deviceId,epoch,capabilityId,payload}){
   return sha(Buffer.from(canonicalJson({device_id:deviceId,epoch,capability_id:capabilityId,payload}),'utf8'));
 }
 
-export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapability,onCredentialSuperseded=null}={}){
+export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapability,onCredentialSuperseded=null,relayTimeoutMs=15000,probeRetries=1,reachableTtlMs=75000}={}){
   insist(typeof stateDir==='string'&&path.isAbsolute(stateDir),'remote stateDir must be absolute');
   insist(relay&&typeof relay.probe==='function'&&typeof relay.request==='function','remote relay contract invalid');
   insist(typeof authorizeCapability==='function','remote capability authorizer required');
   insist(onCredentialSuperseded===null||typeof onCredentialSuperseded==='function','remote credential supersede callback invalid');
+  insist(Number.isInteger(relayTimeoutMs)&&relayTimeoutMs>=100&&relayTimeoutMs<=120000,'remote relayTimeoutMs invalid');
+  insist(Number.isInteger(probeRetries)&&probeRetries>=0&&probeRetries<=3,'remote probeRetries invalid');
+  insist(Number.isInteger(reachableTtlMs)&&reachableTtlMs>=1000&&reachableTtlMs<=10*60*1000,'remote reachableTtlMs invalid');
   await mkdir(stateDir,{recursive:true});const root=await realpath(stateDir);
   const stateFile=path.join(root,'remote-devices.json'),credentialsDir=path.join(root,'credentials');
   await mkdir(credentialsDir,{recursive:true});
@@ -79,6 +94,8 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     const run=lock.then(fn,fn);lock=run.catch(()=>{});return run;
   };
   const persist=()=>{state.updated_at_utc=now();return atomicJson(stateFile,state);};
+  const pub=d=>publicDevice(d,reachableTtlMs);
+  const fresh=d=>pub(d).reachable;
   const getDevice=(deviceId,epoch=null)=>{
     insist(HEX64.test(deviceId??''),'device id invalid');
     const d=state.devices[deviceId];insist(d,'unknown remote device');
@@ -95,21 +112,21 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
       if(existing){
         insist(!existing.revoked,'remote device revoked');
         insist(existing.public_key_spki_base64===spki,'remote device key drift');
-        return publicDevice(existing);
+        return pub(existing);
       }
       const d={device_id:deviceId,public_key_spki_base64:spki,display_name:displayName,epoch:1,revoked:false,
         reported_online:false,reachable:false,connection_id:null,last_probe_nonce:null,updated_at_utc:now()};
-      state.devices[deviceId]=d;await persist();return publicDevice(d);
+      state.devices[deviceId]=d;await persist();return pub(d);
     });
   }
   async function status({deviceId}={}){
-    const d=getDevice(deviceId);return publicDevice(d);
+    const d=getDevice(deviceId);return pub(d);
   }
   async function reportOnline({deviceId,epoch,connectionId}={}){
     insist(typeof connectionId==='string'&&connectionId.length>=1&&connectionId.length<=256,'connection id invalid');
     return withLock(async()=>{
       const d=getDevice(deviceId,epoch);d.reported_online=true;d.reachable=false;d.connection_id=connectionId;
-      d.last_probe_nonce=null;d.updated_at_utc=now();await persist();return publicDevice(d);
+      d.last_probe_nonce=null;d.updated_at_utc=now();await persist();return pub(d);
     });
   }
   async function probe({deviceId,epoch}={}){
@@ -119,12 +136,25 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
       const d=getDevice(deviceId,epoch);insist(d.reported_online&&d.connection_id,'remote device is not reported online');
       connectionId=d.connection_id;d.reachable=false;d.last_probe_nonce=nonce;d.updated_at_utc=now();await persist();
     });
-    const response=await relay.probe({device_id:deviceId,epoch,connection_id:connectionId,nonce});
+    let response=null,lastError=null;
+    for(let attempt=0;attempt<=probeRetries;attempt+=1){
+      try{
+        response=await withTimeout(
+          ()=>relay.probe({device_id:deviceId,epoch,connection_id:connectionId,nonce}),
+          relayTimeoutMs,'remote readiness probe'
+        );
+        lastError=null;break;
+      }catch(error){lastError=error;}
+    }
+    if(lastError){
+      await withLock(async()=>{const d=getDevice(deviceId,epoch);if(d.connection_id===connectionId){d.reachable=false;d.updated_at_utc=now();await persist();}});
+      throw lastError;
+    }
     return withLock(async()=>{
       const d=getDevice(deviceId,epoch);
       insist(response&&response.device_id===deviceId&&response.epoch===epoch&&response.nonce===nonce&&response.ready===true,'remote readiness probe acknowledgment invalid');
       insist(d.connection_id===connectionId&&d.last_probe_nonce===nonce,'remote connection changed during readiness probe');
-      d.reachable=true;d.updated_at_utc=now();await persist();return {...publicDevice(d),probe_nonce:nonce};
+      d.reachable=true;d.last_probe_ok_at_utc=now();d.updated_at_utc=now();await persist();return {...pub(d),probe_nonce:nonce};
     });
   }
   async function dispatch({deviceId,epoch,capabilityId,payload={},requestId}={}){
@@ -141,7 +171,7 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     const allowed=await authorizeCapability({deviceId,epoch,capabilityId});
     insist(allowed===true,'remote capability denied by local policy');
     await withLock(async()=>{
-      const d=getDevice(deviceId,epoch);insist(d.reported_online&&d.reachable,'remote device not reachable');
+      const d=getDevice(deviceId,epoch);insist(d.reported_online&&fresh(d),'remote device not reachable or readiness probe is stale');
       const again=state.requests[requestId];
       if(again){insist(again.request_sha256===requestSha,'remote request id conflict');return;}
       state.requests[requestId]={request_id:requestId,request_sha256:requestSha,device_id:deviceId,epoch,capability_id:capabilityId,
@@ -150,9 +180,17 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     });
     if(state.requests[requestId].state!=='accepted')return {...structuredClone(state.requests[requestId]),replay:true};
     let response=null;
-    try{response=await relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload,request_id:requestId,request_sha256:requestSha});}
-    catch(error){
-      return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';rec.error=String(error?.message??error);rec.updated_at_utc=now();await persist();return structuredClone(rec);});
+    try{
+      response=await withTimeout(
+        ()=>relay.request({device_id:deviceId,epoch,capability_id:capabilityId,payload,request_id:requestId,request_sha256:requestSha}),
+        relayTimeoutMs,'remote dispatch'
+      );
+    }catch(error){
+      return withLock(async()=>{
+        const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_error';rec.error=String(error?.message??error);rec.updated_at_utc=now();
+        const d=state.devices[deviceId];if(d&&d.epoch===epoch){d.reachable=false;d.updated_at_utc=now();}
+        await persist();return structuredClone(rec);
+      });
     }
     if(!response||response.ack!=='accepted'||response.request_id!==requestId){
       return withLock(async()=>{const rec=state.requests[requestId];rec.state='failed';rec.error_code='transport_no_ack';rec.updated_at_utc=now();await persist();return structuredClone(rec);});
@@ -172,7 +210,7 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
   async function revoke({deviceId,epoch}={}){
     return withLock(async()=>{
       const d=getDevice(deviceId,epoch);d.revoked=true;d.reported_online=false;d.reachable=false;d.connection_id=null;d.updated_at_utc=now();await persist();
-      return {...publicDevice(d),revoked:true};
+      return {...pub(d),revoked:true};
     });
   }
   async function rotateCredential({deviceId,epoch,encryptedBundleBase64,expectedPreviousSha256}={}){
@@ -200,6 +238,6 @@ export async function createRemoteDevicePlaneR44({stateDir,relay,authorizeCapabi
     }
     return {status:'committed',device_id:deviceId,epoch,credential_sha256:credentialSha,previous_credential_sha256:previous?.credential_sha256??null};
   }
-  async function list(){return {status:'ok',devices:Object.values(state.devices).map(publicDevice).sort((a,b)=>a.device_id.localeCompare(b.device_id)),requests:structuredClone(state.requests)};}
+  async function list(){return {status:'ok',devices:Object.values(state.devices).map(pub).sort((a,b)=>a.device_id.localeCompare(b.device_id)),requests:structuredClone(state.requests)};}
   return Object.freeze({pair,status,reportOnline,probe,dispatch,revoke,rotateCredential,list,state_file:stateFile});
 }

package/src/remote-mcp-smoke-client.mjs

@@ -13,7 +13,7 @@ const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
 const machineTools = ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status'];
 const processTools = [
   'process_session_action', 'process_session_list', 'process_session_read', 'process_session_start',
-  'process_session_status', 'process_session_terminate'
+  'process_session_status', 'process_session_terminate', 'process_session_write'
 ];
 const machineFsTools = [
   'machine_fs_delete', 'machine_fs_edit_exact', 'machine_fs_list', 'machine_fs_mkdir',

package/src/resource-identity.mjs

@@ -0,0 +1,59 @@
+import { createHash } from 'node:crypto';
+
+const SHA256_RE = /^[0-9a-f]{64}$/;
+
+function hashObject(value) {
+  const json = JSON.stringify(value);
+  return createHash('sha256').update(Buffer.from(json, 'utf8')).digest('hex');
+}
+
+function requiredString(value, name, max = 512) {
+  if (typeof value !== 'string' || value.length < 1 || value.length > max) throw new Error(`resource identity ${name} invalid`);
+  return value;
+}
+
+export function createResourceIdentity({
+  rootId,
+  rootGeneration = null,
+  relativePath,
+  canonicalPath,
+  kind,
+  exists,
+  size = 0,
+  contentSha256 = null,
+  objectIdentitySha256 = null
+}) {
+  requiredString(rootId, 'root_id', 64);
+  requiredString(relativePath, 'relative_path');
+  requiredString(canonicalPath, 'canonical_path', 4096);
+  requiredString(kind, 'kind', 32);
+  if (rootGeneration !== null && typeof rootGeneration !== 'string') throw new Error('resource identity root_generation invalid');
+  if (typeof exists !== 'boolean') throw new Error('resource identity exists invalid');
+  if (!Number.isSafeInteger(size) || size < 0) throw new Error('resource identity size invalid');
+  if (contentSha256 !== null && !SHA256_RE.test(contentSha256)) throw new Error('resource identity content_sha256 invalid');
+  if (objectIdentitySha256 !== null && !SHA256_RE.test(objectIdentitySha256)) throw new Error('resource identity object_identity_sha256 invalid');
+
+  const location = {
+    schema: 'deadbyte.resource-location.v1',
+    root_id: rootId,
+    root_generation: rootGeneration,
+    relative_path: relativePath.replaceAll('\\', '/'),
+    canonical_path: canonicalPath,
+    kind,
+    exists
+  };
+  const resourceIdentitySha256 = hashObject(location);
+
+  return Object.freeze({
+    ...location,
+    size,
+    content_sha256: contentSha256,
+    object_identity_sha256: objectIdentitySha256,
+    resource_identity_sha256: resourceIdentitySha256
+  });
+}
+
+export function contentIdentitySha256(contentSha256) {
+  if (contentSha256 !== null && !SHA256_RE.test(contentSha256)) throw new Error('content_sha256 invalid');
+  return contentSha256;
+}