deadbyte-mcp 0.15.12 → 0.15.14

package/MANIFEST.SHA256

@@ -1329,7 +1329,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-76ae33a2af233622bf1145ede51bf43ee2bba99566a2c7b69da072c3eec0c80c  package.json
+1372576b26135bde7220f29d6a664dc762ca006bfbf119455a2f02f5a7267270  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1398,7 +1398,7 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 5d81b599350d12f019586380d0983054c48fd89a7b948b335a4cec8fb9077ad7  README.txt
-6e49e03fa679ca211372919f6ef250424bcdcc700d3be12e2552e9a07cbc950d  RELEASE.json
+5c2c00d7c5f4e593c017cf6eaa2dd85ca3350ae031247070fc313a9acc54fef4  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1486,7 +1486,7 @@ a0ad824eed1d8be051d5f731579f9bf4115b311f202b75ea0d03aa257b13a671  scripts/gate-w
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
 7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
 9d12d15f7c83ddf272834072ed37d618a232bd8a3fd36c339761fe08bb9380d8  scripts/npm-publish-r47.ps1
-9799df2876e6f7851aeec04266b49a2fce58725cae281e58c73df1b4234e317a  scripts/npm-release-r47.mjs
+2a5b53ee74619814130fcdaf6c96d75bc08efb96d4004c391ab07a1b2454b7b9  scripts/npm-release-r47.mjs
 453dd636b452f4343a36f31a93a763e97f58ed5d6c9df3d2ba05b236934a3a1f  scripts/probe-source-zips.mjs
 8f9d97a4d23e9d05e7cadfb6a519b1ddb9da04894bca98bdc293fc3797e8423c  scripts/probe-zips.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
@@ -1585,7 +1585,7 @@ ecccd8645297f2edd131b2e1a30016fb58ea9d18d8536aa784a21734c81cf209  src/capability
 d6fc395575f49abbbf60bf6f6ef5ee9ad51034a7e770a381e6ec34f869788306  src/coding-output-contracts.mjs
 0857a458e9c5101eee94c0596b7699adc34c50687455688fe38d03d241d27935  src/coding-plane.mjs
 38a1b4e9f5aa14cd5fd9058345c3480ae72c4a6a6eeccdc46e71297c68b5b5a6  src/coding-search.mjs
-f87284dc71c167f6a17575b93730c258ed6c433831013c776bf2d14e2b77767f  src/coding-task-runtime.mjs
+2af167096db6e2946b91baa06961f46842d4dea2e8df960811442c0a11f38b6f  src/coding-task-runtime.mjs
 8478ef1f7b3dc89480c4310a20268048f581041bddcc0b7de9298fa2bfc654ca  src/compact-gateway-mcp-tools.mjs
 4218d1d1478d9e9a044d9b61c5ae205cd2ca0651a314900fad03992d0b12d286  src/compact-gateway-output-contracts.mjs
 40ac70ece531de7709d3c51686b36b48e0ae60283d1fb18d0adc037bfe6f9063  src/contained-cli.mjs
@@ -1707,7 +1707,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-b58265712b06c108331f51d2f42a1fe28ab5d9a06d5ee781f1c931559c104e79  src/version.mjs
+52a36e0a261fab6d40aa96b523efbaa87738600bacc6cd8b8d68047a261828cd  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs

package/RELEASE.json

@@ -1,54 +1,53 @@
-{
-  "schema": "deadbyte.release.v1",
-  "name": "deadbyte-mcp",
-  "version": "0.15.12",
-  "train": "R46",
-  "label": "FILELESS POWERSHELL PRODUCT BASELINE",
-  "protocol_revision": "2026-07-28",
-  "parent": {
-    "release_id": "v0.15.2-0fb46542f6a4345f",
-    "manifest_sha256": "0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34",
-    "generation_manifest_sha256": "00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8"
-  },
-  "platform": {
-    "primary": "win32",
-    "architectures": [
-      "x64"
-    ]
-  },
-  "capabilities": {
-    "host_execution_modes": [
-      "script",
-      "inline",
-      "native"
-    ],
-    "hardware_queries": [
-      "cpu",
-      "gpu",
-      "memory",
-      "storage",
-      "network",
-      "pci"
-    ],
-    "compact_tool_count": 43,
-    "full_tool_count": 83,
-    "process_profiles": [
-      "ping_hold",
-      "powershell",
-      "powershell_repl"
-    ],
-    "powershell_fileless": true,
-    "powershell_source_max_arg_bytes": 8192,
-    "powershell_persistent_repl": true,
-    "process_raw_input_profile_opt_in": true,
-    "process_tail_reads": true,
-    "process_wait_reads": true,
-    "process_chunked_output_ring": true,
-    "remote_reachability_ttl": true,
-    "remote_probe_timeout_retry": true,
-    "remote_dispatch_timeout_no_retry": true,
-    "observation_search_session_ttl": true,
-    "observation_search_session_cap": 128
-  }
-}
-
+{
+    "schema":  "deadbyte.release.v1",
+    "name":  "deadbyte-mcp",
+    "version":  "0.15.13",
+    "train":  "R46",
+    "label":  "FILELESS POWERSHELL PRODUCT BASELINE",
+    "protocol_revision":  "2026-07-28",
+    "parent":  {
+                   "release_id":  "v0.15.2-0fb46542f6a4345f",
+                   "manifest_sha256":  "0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34",
+                   "generation_manifest_sha256":  "00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8"
+               },
+    "platform":  {
+                     "primary":  "win32",
+                     "architectures":  [
+                                           "x64"
+                                       ]
+                 },
+    "capabilities":  {
+                         "host_execution_modes":  [
+                                                      "script",
+                                                      "inline",
+                                                      "native"
+                                                  ],
+                         "hardware_queries":  [
+                                                  "cpu",
+                                                  "gpu",
+                                                  "memory",
+                                                  "storage",
+                                                  "network",
+                                                  "pci"
+                                              ],
+                         "compact_tool_count":  43,
+                         "full_tool_count":  83,
+                         "process_profiles":  [
+                                                  "ping_hold",
+                                                  "powershell",
+                                                  "powershell_repl"
+                                              ],
+                         "powershell_fileless":  true,
+                         "powershell_source_max_arg_bytes":  8192,
+                         "powershell_persistent_repl":  true,
+                         "process_raw_input_profile_opt_in":  true,
+                         "process_tail_reads":  true,
+                         "process_wait_reads":  true,
+                         "process_chunked_output_ring":  true,
+                         "remote_reachability_ttl":  true,
+                         "remote_probe_timeout_retry":  true,
+                         "remote_dispatch_timeout_no_retry":  true,
+                         "observation_search_session_ttl":  true,
+                         "observation_search_session_cap":  128
+                     }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.12",
+  "version": "0.15.14",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-release-r47.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
 import { mkdtemp, readFile, rm, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -30,6 +30,20 @@ function runNpm(args, options = {}) {
   return run(node, [npmCli, ...args], options);
 }
 
+function runNpmInteractive(args, options = {}) {
+  const { cwd = root, timeout = 300000 } = options;
+  const r = spawnSync(node, [npmCli, ...args], {
+    cwd,
+    timeout,
+    stdio: 'inherit',
+    shell: false,
+    windowsHide: false,
+  });
+  if (r.error) throw r.error;
+  if (r.status !== 0) throw new Error('Interactive npm command failed (exit=' + r.status + ', cwd=' + cwd + ')');
+  return '';
+}
+
 function parseJson(text) {
   const start = Math.min(...[text.indexOf('{'), text.indexOf('[')].filter(n => n >= 0));
   if (!Number.isFinite(start)) throw new Error('Command JSON output missing:\n' + text.slice(0, 1000));
@@ -72,7 +86,9 @@ async function main() {
   const packed = parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
   const filename = packed?.[0]?.filename;
   if (!filename) throw new Error('npm pack did not return a tarball filename');
-  const tarball = path.join(root, filename);
+  const tarball = path.join(root, filename);
+  let releaseSucceeded = false;
+  let publishAttempted = false;
 
   try {
     console.log('[4/7] Verifying packed artifact file surface against MANIFEST.SHA256 and packaging contract...');
@@ -143,7 +159,18 @@ async function main() {
     }
 
     console.log('[6/7] Publishing artifact to npm registry...');
-    const publishOut = runNpm(['publish', tarball, '--access', 'public'], { timeout: 300000 });
+    publishAttempted = true;
+    let publishOut;
+    try {
+      publishOut = runNpmInteractive(['publish', tarball, '--access', 'public', '--auth-type=web'], { timeout: 300000 });
+    } catch (publishError) {
+      const detail = String(publishError?.message || publishError);
+      if (/EOTP|one-time password|two-factor|2FA|security.?key|authentication/i.test(detail)) {
+        console.error('Publish requires interactive npm authentication (Security Key/WebAuthn).');
+        console.error('Tarball preserved for retry: ' + tarball);
+      }
+      throw publishError;
+    }
     const published = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.tarball', '--json'], { timeout: 120000 }));
     const tags = parseJson(runNpm(['view', 'deadbyte-mcp', 'dist-tags', '--json'], { timeout: 120000 }));
 
@@ -162,6 +189,7 @@ async function main() {
       timeout: 300000,
     });
 
+    releaseSucceeded = true;
     console.log('\nRELEASE SUCCESSFUL:');
     console.log(JSON.stringify({
       status: 'published',
@@ -178,7 +206,11 @@ async function main() {
     }, null, 2));
 
   } finally {
-    await unlink(tarball).catch(() => {});
+    if (releaseSucceeded || !publishAttempted) {
+      await unlink(tarball).catch(() => {});
+    } else {
+      console.error('Release artifact preserved after failure: ' + tarball);
+    }
   }
 }
 
@@ -187,3 +219,10 @@ main().catch(err => {
   console.error(err?.stack || err);
   process.exitCode = 1;
 });
+
+
+
+
+
+
+

package/src/coding-task-runtime.mjs

@@ -109,7 +109,12 @@ export function normalizeCodingTaskPlan({ policy, submissionId, title = '', step
       const cwd = raw.cwd ?? '.';
       if (cwd !== '.') validatePortableRelativePath(cwd);
       const timeout = raw.timeout_ms ?? null;
-      if (timeout !== null && (!Number.isInteger(timeout) || timeout < 100 || timeout > 900000)) throw new Error('coding command timeout invalid');
+      const commandPolicy = policy.commands[raw.command_id];
+      const commandMaxTimeout = commandPolicy.timeout_ms;
+      if (!Number.isInteger(commandMaxTimeout) || commandMaxTimeout < 100) throw new Error(`coding command '${raw.command_id}' policy timeout invalid`);
+      if (timeout !== null && (!Number.isInteger(timeout) || timeout < 100 || timeout > commandMaxTimeout)) {
+        throw new Error(`coding command timeout invalid: must be in [100, ${commandMaxTimeout}] for '${raw.command_id}'`);
+      }
       const base = { step_id: raw.step_id, kind: raw.kind, root_id: raw.root_id, command_id: raw.command_id,
         script_path: raw.script_path, script_sha256: raw.script_sha256, args: [...(raw.args ?? [])], cwd, timeout_ms: timeout,
         retry_limit: retryLimit(raw.retry_limit) };

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.12';
+export const DEADBYTE_VERSION = '0.15.13';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';