deadbyte-mcp 0.15.13 → 0.15.15

package/src/release-slot.mjs

@@ -1,293 +1,294 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { lstat, mkdir, open, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-
-const HEX64=/^[0-9a-f]{64}$/;
-const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
-const POINTER_SCHEMA='deadbyte.active-release.v1';
-
-export const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
-
-function safeRelative(rel){
-  if(typeof rel!=='string'||rel.length<1) throw new Error('manifest path empty');
-  const normalized=rel.replaceAll('\\','/');
-  if(path.posix.isAbsolute(normalized)||normalized.split('/').includes('..')||normalized.includes('\0')) {
-    throw new Error(`unsafe manifest path '${normalized}'`);
-  }
-  return normalized;
-}
-
-export function releaseId(version,manifestSha256){
-  if(!SEMVER.test(String(version))) throw new Error('release version must be SemVer');
-  if(!HEX64.test(String(manifestSha256))) throw new Error('release manifest must be lowercase SHA-256');
-  return `v${version}-${manifestSha256.slice(0,16)}`;
-}
-export function parseManifest(text){
-  const entries=new Map();
-  for(const [index,line] of String(text).split(/\r?\n/).entries()){
-    if(!line) continue;
-    const match=/^([0-9a-f]{64})  (.+)$/.exec(line);
-    if(!match) throw new Error(`manifest line ${index+1} malformed`);
-    const rel=safeRelative(match[2]);
-    if(entries.has(rel)) throw new Error(`manifest duplicate path '${rel}'`);
-    entries.set(rel,match[1]);
-  }
-  if(entries.size<1) throw new Error('manifest has no entries');
-  return entries;
-}
-
-async function plainManifestFile(root,rel,label){
-  const rootPath=path.resolve(root);
-  const rootStat=await lstat(rootPath).catch(error=>{throw new Error(`${label} root unavailable: ${error.message}`)});
-  if(!rootStat.isDirectory()||rootStat.isSymbolicLink()) throw new Error(`${label} root must be a real directory`);
-  let cursor=rootPath;
-  const parts=safeRelative(rel).split('/');
-  for(let index=0;index<parts.length;index++){
-    cursor=path.join(cursor,parts[index]);
-    const stat=await lstat(cursor).catch(error=>{throw new Error(`${label} file missing: ${rel}: ${error.message}`)});
-    if(stat.isSymbolicLink()) throw new Error(`${label} symlink is forbidden: ${rel}`);
-    if(index<parts.length-1&&!stat.isDirectory()) throw new Error(`${label} parent is not directory: ${rel}`);
-    if(index===parts.length-1&&!stat.isFile()) throw new Error(`${label} file is not regular: ${rel}`);
-  }
-  return cursor;
-}
-
-export async function verifyManifestTree(root,manifest){
-  for(const [rel,expected] of manifest){
-    const file=await plainManifestFile(root,rel,'manifest');
-    const actual=sha256Bytes(await readFile(file));
-    if(actual!==expected) throw new Error(`hash mismatch: ${rel}`);
-  }
-  return {files:manifest.size};
-}
-
-async function listManifestTreeFiles(root){
-  const base=path.resolve(root), files=[];
-  const walk=async(dir)=>{
-    for(const entry of await readdir(dir,{withFileTypes:true})){
-      const absolute=path.join(dir,entry.name);
-      const rel=path.relative(base,absolute).replaceAll('\\','/');
-      if(entry.isSymbolicLink()) throw new Error(`manifest-tree symlink forbidden: ${rel}`);
-      if(entry.isDirectory()) await walk(absolute);
-      else if(entry.isFile()) { if(rel!=='MANIFEST.SHA256') files.push(rel); }
-      else throw new Error(`manifest-tree unsupported entry: ${rel}`);
-    }
-  };
-  await walk(base);
-  return files.sort((a,b)=>a.localeCompare(b,'en'));
-}
-
-export async function verifyManifestTreeExact(root,manifest){
-  await verifyManifestTree(root,manifest);
-  const actual=await listManifestTreeFiles(root);
-  const expected=[...manifest.keys()].sort((a,b)=>a.localeCompare(b,'en'));
-  for(const rel of actual) if(!manifest.has(rel)) throw new Error(`unexpected manifest-tree file: ${rel}`);
-  for(const rel of expected) if(!actual.includes(rel)) throw new Error(`missing manifest-tree file: ${rel}`);
-  if(actual.length!==expected.length) throw new Error(`manifest-tree file count mismatch: expected=${expected.length} actual=${actual.length}`);
-  return {files:manifest.size};
-}
-export async function copyManifestTree({source,destination,manifest}){
-  await mkdir(destination,{recursive:false});
-  try {
-    for(const [rel] of manifest){
-      const src=await plainManifestFile(source,rel,'candidate');
-      const dst=path.resolve(destination,...safeRelative(rel).split('/'));
-      await mkdir(path.dirname(dst),{recursive:true});
-      await writeFile(dst,await readFile(src),{flag:'wx'});
-    }
-    await verifyManifestTreeExact(destination,manifest);
-    return {files:manifest.size};
-  } catch(error){
-    await rm(destination,{recursive:true,force:true}).catch(()=>{});
-    throw error;
-  }
-}
-
-export async function materializeReleaseSlot({source,stateRoot,version,manifestSha256}){
-  if(!SEMVER.test(String(version))) throw new Error('candidate version must be SemVer');
-  if(!HEX64.test(String(manifestSha256))) throw new Error('candidate manifest must be lowercase SHA-256');
-  const sourceRoot=path.resolve(source),state=path.resolve(stateRoot);
-  const manifestBytes=await readFile(path.join(sourceRoot,'MANIFEST.SHA256'));
-  if(sha256Bytes(manifestBytes)!==manifestSha256) throw new Error('candidate manifest digest mismatch');
-  const manifest=parseManifest(manifestBytes.toString('utf8'));
-  for(const required of [
-    'package.json','controller/deadbyte-controller.ps1','scripts/runtime-self-update.mjs',
-    'bin/deadbyte-exec.exe','bin/contained-transform-worker.exe',
-    'bin/contained-reverse-worker.exe','bin/WORKER-REGISTRY.txt'
-  ]) {
-    if(!manifest.has(required)) throw new Error(`candidate manifest missing required entry: ${required}`);
-  }
-  await verifyManifestTree(sourceRoot,manifest);
-  const pkg=JSON.parse(await readFile(path.join(sourceRoot,'package.json'),'utf8'));
-  if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==version) throw new Error('candidate package identity mismatch');
-  const id=releaseId(version,manifestSha256),releasesRoot=path.join(state,'releases'),releaseRoot=path.join(releasesRoot,id);
-  const verifyFinal=async()=>{
-    const finalManifest=await readFile(path.join(releaseRoot,'MANIFEST.SHA256'));
-    if(sha256Bytes(finalManifest)!==manifestSha256) throw new Error('release slot manifest digest mismatch');
-    const finalEntries=parseManifest(finalManifest.toString('utf8'));
-    if(finalEntries.size!==manifest.size||[...manifest].some(([rel,hash])=>finalEntries.get(rel)!==hash)) throw new Error('release slot manifest entries mismatch');
-    await verifyManifestTreeExact(releaseRoot,finalEntries);
-    const finalPkg=JSON.parse(await readFile(path.join(releaseRoot,'package.json'),'utf8'));
-    if(finalPkg?.name!=='deadbyte-mcp'||finalPkg?.version!==version) throw new Error('release slot package identity mismatch');
-    return {release_id:id,release_root:releaseRoot,manifest_sha256:manifestSha256,files:finalEntries.size};
-  };
-  if(existsSync(releaseRoot)) return {...await verifyFinal(),adopted:true};
-  await mkdir(releasesRoot,{recursive:true});
-  const staging=path.join(releasesRoot,`.staging-${id}-${process.pid}-${randomBytes(4).toString('hex')}`);
-  try {
-    await copyManifestTree({source:sourceRoot,destination:staging,manifest});
-    await writeFile(path.join(staging,'MANIFEST.SHA256'),manifestBytes,{flag:'wx'});
-    await verifyManifestTreeExact(staging,manifest);
-    await rename(staging,releaseRoot);
-  } catch(error){
-    await rm(staging,{recursive:true,force:true}).catch(()=>{});
-    if(existsSync(releaseRoot)) return {...await verifyFinal(),adopted:true};
-    throw error;
-  }
-  return {...await verifyFinal(),adopted:false};
-}
-
-async function atomicJson(file,value){
-  await mkdir(path.dirname(file),{recursive:true});
-  const temp=`${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
-  const handle=await open(temp,'wx');
-  try { await handle.writeFile(`${JSON.stringify(value,null,2)}\n`,'utf8'); await handle.sync(); }
-  finally { await handle.close(); }
-  try { await rename(temp,file); }
-  catch(error){ await rm(temp,{force:true}).catch(()=>{}); throw error; }
-}
-export function parseActivePointer(text){
-  let value;
-  try { value=JSON.parse(String(text)); } catch(error){ throw new Error(`active pointer JSON invalid: ${error.message}`); }
-  if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('active pointer must be object');
-  if(value.schema!==POINTER_SCHEMA) throw new Error('active pointer schema mismatch');
-  if(!SEMVER.test(String(value.version))) throw new Error('active pointer version invalid');
-  if(!HEX64.test(String(value.manifest_sha256))) throw new Error('active pointer manifest invalid');
-  if(value.release_id!==releaseId(value.version,value.manifest_sha256)) throw new Error('active pointer release id mismatch');
-  if(!HEX64.test(String(value.generation_manifest_sha256))) throw new Error('active pointer generation manifest invalid');
-  if(!HEX64.test(String(value.launcher_sha256))) throw new Error('active pointer launcher digest invalid');
-  for(const key of ['release_root','generation_root','config_path']) {
-    if(typeof value[key]!=='string'||value[key].length<3) throw new Error(`active pointer ${key} invalid`);
-  }
-  return {
-    schema:POINTER_SCHEMA,
-    release_id:value.release_id,
-    version:value.version,
-    manifest_sha256:value.manifest_sha256,
-    release_root:value.release_root,
-    generation_root:value.generation_root,
-    generation_manifest_sha256:value.generation_manifest_sha256,
-    launcher_sha256:value.launcher_sha256,
-    config_path:value.config_path
-  };
-}
-
-export async function atomicWriteActivePointer(file,pointer){
-  const normalized=parseActivePointer(JSON.stringify(pointer));
-  await atomicJson(file,normalized);
-  const observed=parseActivePointer(await readFile(file,'utf8'));
-  if(JSON.stringify(observed)!==JSON.stringify(normalized)) throw new Error('active pointer readback mismatch');
-  return observed;
-}
-export function renderStableLauncherCmd(){
-  return [
-    '@echo off',
-    'setlocal EnableExtensions DisableDelayedExpansion',
-    'powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%USERPROFILE%\\.deadbyte-mcp\\bin\\DEADBYTE-MCP.ps1" %*',
-    'exit /b %ERRORLEVEL%',
-    ''
-  ].join('\r\n');
-}
-
-export function renderStableLauncherPs1(){
-  return [
-    '#requires -Version 5.1',
-    '[CmdletBinding()]',
-    'param([Parameter(ValueFromRemainingArguments=$true)][string[]]$ControllerArgs)',
-    'Set-StrictMode -Version 3.0',
-    "$ErrorActionPreference = 'Stop'",
-    "$StateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'",
-    "$PointerPath = Join-Path $StateRoot 'active-release.json'",
-    "function Fail([string]$m) { throw ('DEADBYTE launcher: ' + $m) }",
-    "if (-not (Test-Path -LiteralPath $PointerPath -PathType Leaf)) { Fail 'active release pointer missing' }",
-    '$p = Get-Content -LiteralPath $PointerPath -Raw -Encoding UTF8 | ConvertFrom-Json',
-    "if ($p.schema -ne 'deadbyte.active-release.v1') { Fail 'active release schema mismatch' }",
-    "if ([string]$p.manifest_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active manifest digest invalid' }",
-    "if ([string]$p.generation_manifest_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active generation manifest digest invalid' }",
-    "if ([string]$p.launcher_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active launcher digest invalid' }",
-    '$launcherHash = (Get-FileHash -LiteralPath $MyInvocation.MyCommand.Path -Algorithm SHA256).Hash.ToLowerInvariant()',
-    "if ($launcherHash -ne [string]$p.launcher_sha256) { Fail 'stable launcher hash mismatch' }",
-    "$expectedId = 'v{0}-{1}' -f [string]$p.version,([string]$p.manifest_sha256).Substring(0,16)",
-    "if ([string]$p.release_id -ne $expectedId) { Fail 'active release id mismatch' }",
-    "$releases = [IO.Path]::GetFullPath((Join-Path $StateRoot 'releases')).TrimEnd('\\') + '\\'",
-    "$generations = [IO.Path]::GetFullPath((Join-Path $StateRoot 'generations')).TrimEnd('\\') + '\\'",
-    '$releaseRoot = [IO.Path]::GetFullPath([string]$p.release_root)',
-    '$generationRoot = [IO.Path]::GetFullPath([string]$p.generation_root)',
-    '$configPath = [IO.Path]::GetFullPath([string]$p.config_path)',
-    "if (-not $releaseRoot.StartsWith($releases,[StringComparison]::OrdinalIgnoreCase)) { Fail 'release root escapes release store' }",
-    "if (-not $generationRoot.StartsWith($generations,[StringComparison]::OrdinalIgnoreCase)) { Fail 'generation root escapes generation store' }",
-    "$expectedConfig = Join-Path $generationRoot 'controller-config.psd1'",
-    "if (-not [string]::Equals($configPath,$expectedConfig,[StringComparison]::OrdinalIgnoreCase)) { Fail 'config path is not generation-bound' }",
-    "$manifest = Join-Path $releaseRoot 'MANIFEST.SHA256'",
-    "$generationManifest = Join-Path $generationRoot 'GENERATION.SHA256'",
-    "$package = Join-Path $releaseRoot 'package.json'",
-    "$controller = Join-Path $releaseRoot 'controller\\deadbyte-controller.ps1'",
-    "foreach ($file in @($manifest,$generationManifest,$package,$controller,$configPath)) { if (-not (Test-Path -LiteralPath $file -PathType Leaf)) { Fail ('required file missing: ' + $file) } }",
-    '$manifestHash = (Get-FileHash -LiteralPath $manifest -Algorithm SHA256).Hash.ToLowerInvariant()',
-    "if ($manifestHash -ne [string]$p.manifest_sha256) { Fail 'active manifest hash mismatch' }",
-    '$generationManifestHash = (Get-FileHash -LiteralPath $generationManifest -Algorithm SHA256).Hash.ToLowerInvariant()',
-    "if ($generationManifestHash -ne [string]$p.generation_manifest_sha256) { Fail 'active generation manifest hash mismatch' }",
-    '$releasePrefix = $releaseRoot.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar',
-    '$generationPrefix = $generationRoot.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar',
-    '$manifestLines = Get-Content -LiteralPath $manifest -Encoding UTF8',
-    '$manifestPathSet = @{}',
-    'foreach ($line in $manifestLines) {',
-    "    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }",
-    "    if ([string]$line -notmatch '^([0-9a-f]{64})  (.+)$') { Fail 'release manifest line malformed' }",
-    '    $expectedHash = [string]$Matches[1]',
-    '    $rel = [string]$Matches[2]',
-    "    if ([IO.Path]::IsPathRooted($rel) -or (($rel -split '[\\/]') -contains '..')) { Fail ('unsafe release manifest path: ' + $rel) }",
-    "    $relKey = ($rel -replace '\\\\','/').ToLowerInvariant()",
-    "    if ($manifestPathSet.ContainsKey($relKey)) { Fail ('duplicate release manifest path: ' + $rel) }",
-    '    $manifestPathSet[$relKey] = $true',
-    '    $target = [IO.Path]::GetFullPath((Join-Path $releaseRoot $rel))',
-    "    if (-not $target.StartsWith($releasePrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('release manifest path escapes slot: ' + $rel) }",
-    "    if (-not (Test-Path -LiteralPath $target -PathType Leaf)) { Fail ('release file missing: ' + $rel) }",
-    '    $targetItem = Get-Item -LiteralPath $target -Force',
-    "    if (($targetItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Fail ('release reparse point forbidden: ' + $rel) }",
-    '    $actualHash = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()',
-    "    if ($actualHash -ne $expectedHash) { Fail ('release file hash mismatch: ' + $rel) }",
-    '}',
-    '$releaseItems = Get-ChildItem -LiteralPath $releaseRoot -Force -Recurse',
-    'foreach ($item in $releaseItems) {',
-    "    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Fail ('release reparse point forbidden: ' + $item.FullName) }",
-    '    if ($item.PSIsContainer) { continue }',
-    '    if ([string]::Equals($item.FullName,$manifest,[StringComparison]::OrdinalIgnoreCase)) { continue }',
-    "    if (-not $item.FullName.StartsWith($releasePrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('release file escapes slot: ' + $item.FullName) }",
-    "    $actualRel = $item.FullName.Substring($releasePrefix.Length).Replace('\\','/')",
-    "    if (-not $manifestPathSet.ContainsKey($actualRel.ToLowerInvariant())) { Fail ('unexpected release file: ' + $actualRel) }",
-    '}',
-    '$generationLines = Get-Content -LiteralPath $generationManifest -Encoding UTF8',
-    'foreach ($line in $generationLines) {',
-    "    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }",
-    "    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'generation manifest line malformed' }",
-    '    $expectedHash = [string]$Matches[1]',
-    '    $rel = [string]$Matches[2]',
-    '    $target = [IO.Path]::GetFullPath((Join-Path $generationRoot $rel))',
-    "    if (-not $target.StartsWith($generationPrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('generation manifest path escapes generation: ' + $rel) }",
-    "    if (-not (Test-Path -LiteralPath $target -PathType Leaf)) { Fail ('generation file missing: ' + $rel) }",
-    '    $actualHash = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()',
-    "    if ($actualHash -ne $expectedHash) { Fail ('generation file hash mismatch: ' + $rel) }",
-    '}',
-    '$pkg = Get-Content -LiteralPath $package -Raw -Encoding UTF8 | ConvertFrom-Json',
-    "if ([string]$pkg.name -ne 'deadbyte-mcp' -or [string]$pkg.version -ne [string]$p.version) { Fail 'active package identity mismatch' }",
-    '$env:DEADBYTE_STATE_ROOT = $StateRoot',
-    '$env:DEADBYTE_CONTROLLER_CONFIG = $configPath',
-    "$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT = Join-Path $StateRoot 'runtime'",
-    "$powershell = Join-Path $PSHOME 'powershell.exe'",
-    '& $powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -File $controller @ControllerArgs',
-    'exit $LASTEXITCODE',
-    ''
-  ].join('\r\n');
-}
+import { createHash, randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { lstat, mkdir, open, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const POINTER_SCHEMA='deadbyte.active-release.v1';
+
+export const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+function safeRelative(rel){
+  if(typeof rel!=='string'||rel.length<1) throw new Error('manifest path empty');
+  const normalized=rel.replaceAll('\\','/');
+  if(path.posix.isAbsolute(normalized)||normalized.split('/').includes('..')||normalized.includes('\0')) {
+    throw new Error(`unsafe manifest path '${normalized}'`);
+  }
+  return normalized;
+}
+
+export function releaseId(version,manifestSha256){
+  if(!SEMVER.test(String(version))) throw new Error('release version must be SemVer');
+  if(!HEX64.test(String(manifestSha256))) throw new Error('release manifest must be lowercase SHA-256');
+  return `v${version}-${manifestSha256.slice(0,16)}`;
+}
+export function parseManifest(text){
+  const entries=new Map();
+  for(const [index,line] of String(text).split(/\r?\n/).entries()){
+    if(!line) continue;
+    const match=/^([0-9a-f]{64})  (.+)$/.exec(line);
+    if(!match) throw new Error(`manifest line ${index+1} malformed`);
+    const rel=safeRelative(match[2]);
+    if(entries.has(rel)) throw new Error(`manifest duplicate path '${rel}'`);
+    entries.set(rel,match[1]);
+  }
+  if(entries.size<1) throw new Error('manifest has no entries');
+  return entries;
+}
+
+async function plainManifestFile(root,rel,label){
+  const rootPath=path.resolve(root);
+  const rootStat=await lstat(rootPath).catch(error=>{throw new Error(`${label} root unavailable: ${error.message}`)});
+  if(!rootStat.isDirectory()||rootStat.isSymbolicLink()) throw new Error(`${label} root must be a real directory`);
+  let cursor=rootPath;
+  const parts=safeRelative(rel).split('/');
+  for(let index=0;index<parts.length;index++){
+    cursor=path.join(cursor,parts[index]);
+    const stat=await lstat(cursor).catch(error=>{throw new Error(`${label} file missing: ${rel}: ${error.message}`)});
+    if(stat.isSymbolicLink()) throw new Error(`${label} symlink is forbidden: ${rel}`);
+    if(index<parts.length-1&&!stat.isDirectory()) throw new Error(`${label} parent is not directory: ${rel}`);
+    if(index===parts.length-1&&!stat.isFile()) throw new Error(`${label} file is not regular: ${rel}`);
+  }
+  return cursor;
+}
+
+export async function verifyManifestTree(root,manifest){
+  for(const [rel,expected] of manifest){
+    const file=await plainManifestFile(root,rel,'manifest');
+    const actual=sha256Bytes(await readFile(file));
+    if(actual!==expected) throw new Error(`hash mismatch: ${rel}`);
+  }
+  return {files:manifest.size};
+}
+
+async function listManifestTreeFiles(root){
+  const base=path.resolve(root), files=[];
+  const walk=async(dir)=>{
+    for(const entry of await readdir(dir,{withFileTypes:true})){
+      const absolute=path.join(dir,entry.name);
+      const rel=path.relative(base,absolute).replaceAll('\\','/');
+
+      if(entry.isSymbolicLink()) throw new Error(`manifest-tree symlink forbidden: ${rel}`);
+      if(entry.isDirectory()) await walk(absolute);
+      else if(entry.isFile()) { if(rel!=='MANIFEST.SHA256') files.push(rel); }
+      else throw new Error(`manifest-tree unsupported entry: ${rel}`);
+    }
+  };
+  await walk(base);
+  return files.sort((a,b)=>a.localeCompare(b,'en'));
+}
+
+export async function verifyManifestTreeExact(root,manifest){
+  await verifyManifestTree(root,manifest);
+  const actual=await listManifestTreeFiles(root);
+  const expected=[...manifest.keys()].sort((a,b)=>a.localeCompare(b,'en'));
+  for(const rel of actual) if(!manifest.has(rel)) throw new Error(`unexpected manifest-tree file: ${rel}`);
+  for(const rel of expected) if(!actual.includes(rel)) throw new Error(`missing manifest-tree file: ${rel}`);
+  if(actual.length!==expected.length) throw new Error(`manifest-tree file count mismatch: expected=${expected.length} actual=${actual.length}`);
+  return {files:manifest.size};
+}
+export async function copyManifestTree({source,destination,manifest}){
+  await mkdir(destination,{recursive:false});
+  try {
+    for(const [rel] of manifest){
+      const src=await plainManifestFile(source,rel,'candidate');
+      const dst=path.resolve(destination,...safeRelative(rel).split('/'));
+      await mkdir(path.dirname(dst),{recursive:true});
+      await writeFile(dst,await readFile(src),{flag:'wx'});
+    }
+    await verifyManifestTreeExact(destination,manifest);
+    return {files:manifest.size};
+  } catch(error){
+    await rm(destination,{recursive:true,force:true}).catch(()=>{});
+    throw error;
+  }
+}
+
+export async function materializeReleaseSlot({source,stateRoot,version,manifestSha256}){
+  if(!SEMVER.test(String(version))) throw new Error('candidate version must be SemVer');
+  if(!HEX64.test(String(manifestSha256))) throw new Error('candidate manifest must be lowercase SHA-256');
+  const sourceRoot=path.resolve(source),state=path.resolve(stateRoot);
+  const manifestBytes=await readFile(path.join(sourceRoot,'MANIFEST.SHA256'));
+  if(sha256Bytes(manifestBytes)!==manifestSha256) throw new Error('candidate manifest digest mismatch');
+  const manifest=parseManifest(manifestBytes.toString('utf8'));
+  for(const required of [
+    'package.json','controller/deadbyte-controller.ps1','scripts/runtime-self-update.mjs',
+    'bin/deadbyte-exec.exe','bin/contained-transform-worker.exe',
+    'bin/contained-reverse-worker.exe','bin/WORKER-REGISTRY.txt'
+  ]) {
+    if(!manifest.has(required)) throw new Error(`candidate manifest missing required entry: ${required}`);
+  }
+  await verifyManifestTree(sourceRoot,manifest);
+  const pkg=JSON.parse(await readFile(path.join(sourceRoot,'package.json'),'utf8'));
+  if(pkg?.name!=='deadbyte-mcp'||pkg?.version!==version) throw new Error('candidate package identity mismatch');
+  const id=releaseId(version,manifestSha256),releasesRoot=path.join(state,'releases'),releaseRoot=path.join(releasesRoot,id);
+  const verifyFinal=async()=>{
+    const finalManifest=await readFile(path.join(releaseRoot,'MANIFEST.SHA256'));
+    if(sha256Bytes(finalManifest)!==manifestSha256) throw new Error('release slot manifest digest mismatch');
+    const finalEntries=parseManifest(finalManifest.toString('utf8'));
+    if(finalEntries.size!==manifest.size||[...manifest].some(([rel,hash])=>finalEntries.get(rel)!==hash)) throw new Error('release slot manifest entries mismatch');
+    await verifyManifestTreeExact(releaseRoot,finalEntries);
+    const finalPkg=JSON.parse(await readFile(path.join(releaseRoot,'package.json'),'utf8'));
+    if(finalPkg?.name!=='deadbyte-mcp'||finalPkg?.version!==version) throw new Error('release slot package identity mismatch');
+    return {release_id:id,release_root:releaseRoot,manifest_sha256:manifestSha256,files:finalEntries.size};
+  };
+  if(existsSync(releaseRoot)) return {...await verifyFinal(),adopted:true};
+  await mkdir(releasesRoot,{recursive:true});
+  const staging=path.join(releasesRoot,`.staging-${id}-${process.pid}-${randomBytes(4).toString('hex')}`);
+  try {
+    await copyManifestTree({source:sourceRoot,destination:staging,manifest});
+    await writeFile(path.join(staging,'MANIFEST.SHA256'),manifestBytes,{flag:'wx'});
+    await verifyManifestTreeExact(staging,manifest);
+    await rename(staging,releaseRoot);
+  } catch(error){
+    await rm(staging,{recursive:true,force:true}).catch(()=>{});
+    if(existsSync(releaseRoot)) return {...await verifyFinal(),adopted:true};
+    throw error;
+  }
+  return {...await verifyFinal(),adopted:false};
+}
+
+async function atomicJson(file,value){
+  await mkdir(path.dirname(file),{recursive:true});
+  const temp=`${file}.tmp-${process.pid}-${randomBytes(4).toString('hex')}`;
+  const handle=await open(temp,'wx');
+  try { await handle.writeFile(`${JSON.stringify(value,null,2)}\n`,'utf8'); await handle.sync(); }
+  finally { await handle.close(); }
+  try { await rename(temp,file); }
+  catch(error){ await rm(temp,{force:true}).catch(()=>{}); throw error; }
+}
+export function parseActivePointer(text){
+  let value;
+  try { value=JSON.parse(String(text)); } catch(error){ throw new Error(`active pointer JSON invalid: ${error.message}`); }
+  if(!value||typeof value!=='object'||Array.isArray(value)) throw new Error('active pointer must be object');
+  if(value.schema!==POINTER_SCHEMA) throw new Error('active pointer schema mismatch');
+  if(!SEMVER.test(String(value.version))) throw new Error('active pointer version invalid');
+  if(!HEX64.test(String(value.manifest_sha256))) throw new Error('active pointer manifest invalid');
+  if(value.release_id!==releaseId(value.version,value.manifest_sha256)) throw new Error('active pointer release id mismatch');
+  if(!HEX64.test(String(value.generation_manifest_sha256))) throw new Error('active pointer generation manifest invalid');
+  if(!HEX64.test(String(value.launcher_sha256))) throw new Error('active pointer launcher digest invalid');
+  for(const key of ['release_root','generation_root','config_path']) {
+    if(typeof value[key]!=='string'||value[key].length<3) throw new Error(`active pointer ${key} invalid`);
+  }
+  return {
+    schema:POINTER_SCHEMA,
+    release_id:value.release_id,
+    version:value.version,
+    manifest_sha256:value.manifest_sha256,
+    release_root:value.release_root,
+    generation_root:value.generation_root,
+    generation_manifest_sha256:value.generation_manifest_sha256,
+    launcher_sha256:value.launcher_sha256,
+    config_path:value.config_path
+  };
+}
+
+export async function atomicWriteActivePointer(file,pointer){
+  const normalized=parseActivePointer(JSON.stringify(pointer));
+  await atomicJson(file,normalized);
+  const observed=parseActivePointer(await readFile(file,'utf8'));
+  if(JSON.stringify(observed)!==JSON.stringify(normalized)) throw new Error('active pointer readback mismatch');
+  return observed;
+}
+export function renderStableLauncherCmd(){
+  return [
+    '@echo off',
+    'setlocal EnableExtensions DisableDelayedExpansion',
+    'powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%USERPROFILE%\\.deadbyte-mcp\\bin\\DEADBYTE-MCP.ps1" %*',
+    'exit /b %ERRORLEVEL%',
+    ''
+  ].join('\r\n');
+}
+
+export function renderStableLauncherPs1(){
+  return [
+    '#requires -Version 5.1',
+    '[CmdletBinding()]',
+    'param([Parameter(ValueFromRemainingArguments=$true)][string[]]$ControllerArgs)',
+    'Set-StrictMode -Version 3.0',
+    "$ErrorActionPreference = 'Stop'",
+    "$StateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'",
+    "$PointerPath = Join-Path $StateRoot 'active-release.json'",
+    "function Fail([string]$m) { throw ('DEADBYTE launcher: ' + $m) }",
+    "if (-not (Test-Path -LiteralPath $PointerPath -PathType Leaf)) { Fail 'active release pointer missing' }",
+    '$p = Get-Content -LiteralPath $PointerPath -Raw -Encoding UTF8 | ConvertFrom-Json',
+    "if ($p.schema -ne 'deadbyte.active-release.v1') { Fail 'active release schema mismatch' }",
+    "if ([string]$p.manifest_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active manifest digest invalid' }",
+    "if ([string]$p.generation_manifest_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active generation manifest digest invalid' }",
+    "if ([string]$p.launcher_sha256 -notmatch '^[0-9a-f]{64}$') { Fail 'active launcher digest invalid' }",
+    '$launcherHash = (Get-FileHash -LiteralPath $MyInvocation.MyCommand.Path -Algorithm SHA256).Hash.ToLowerInvariant()',
+    "if ($launcherHash -ne [string]$p.launcher_sha256) { Fail 'stable launcher hash mismatch' }",
+    "$expectedId = 'v{0}-{1}' -f [string]$p.version,([string]$p.manifest_sha256).Substring(0,16)",
+    "if ([string]$p.release_id -ne $expectedId) { Fail 'active release id mismatch' }",
+    "$releases = [IO.Path]::GetFullPath((Join-Path $StateRoot 'releases')).TrimEnd('\\') + '\\'",
+    "$generations = [IO.Path]::GetFullPath((Join-Path $StateRoot 'generations')).TrimEnd('\\') + '\\'",
+    '$releaseRoot = [IO.Path]::GetFullPath([string]$p.release_root)',
+    '$generationRoot = [IO.Path]::GetFullPath([string]$p.generation_root)',
+    '$configPath = [IO.Path]::GetFullPath([string]$p.config_path)',
+    "if (-not $releaseRoot.StartsWith($releases,[StringComparison]::OrdinalIgnoreCase)) { Fail 'release root escapes release store' }",
+    "if (-not $generationRoot.StartsWith($generations,[StringComparison]::OrdinalIgnoreCase)) { Fail 'generation root escapes generation store' }",
+    "$expectedConfig = Join-Path $generationRoot 'controller-config.psd1'",
+    "if (-not [string]::Equals($configPath,$expectedConfig,[StringComparison]::OrdinalIgnoreCase)) { Fail 'config path is not generation-bound' }",
+    "$manifest = Join-Path $releaseRoot 'MANIFEST.SHA256'",
+    "$generationManifest = Join-Path $generationRoot 'GENERATION.SHA256'",
+    "$package = Join-Path $releaseRoot 'package.json'",
+    "$controller = Join-Path $releaseRoot 'controller\\deadbyte-controller.ps1'",
+    "foreach ($file in @($manifest,$generationManifest,$package,$controller,$configPath)) { if (-not (Test-Path -LiteralPath $file -PathType Leaf)) { Fail ('required file missing: ' + $file) } }",
+    '$manifestHash = (Get-FileHash -LiteralPath $manifest -Algorithm SHA256).Hash.ToLowerInvariant()',
+    "if ($manifestHash -ne [string]$p.manifest_sha256) { Fail 'active manifest hash mismatch' }",
+    '$generationManifestHash = (Get-FileHash -LiteralPath $generationManifest -Algorithm SHA256).Hash.ToLowerInvariant()',
+    "if ($generationManifestHash -ne [string]$p.generation_manifest_sha256) { Fail 'active generation manifest hash mismatch' }",
+    '$releasePrefix = $releaseRoot.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar',
+    '$generationPrefix = $generationRoot.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar',
+    '$manifestLines = Get-Content -LiteralPath $manifest -Encoding UTF8',
+    '$manifestPathSet = @{}',
+    'foreach ($line in $manifestLines) {',
+    "    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }",
+    "    if ([string]$line -notmatch '^([0-9a-f]{64})  (.+)$') { Fail 'release manifest line malformed' }",
+    '    $expectedHash = [string]$Matches[1]',
+    '    $rel = [string]$Matches[2]',
+    "    if ([IO.Path]::IsPathRooted($rel) -or (($rel -split '[\\/]') -contains '..')) { Fail ('unsafe release manifest path: ' + $rel) }",
+    "    $relKey = ($rel -replace '\\\\','/').ToLowerInvariant()",
+    "    if ($manifestPathSet.ContainsKey($relKey)) { Fail ('duplicate release manifest path: ' + $rel) }",
+    '    $manifestPathSet[$relKey] = $true',
+    '    $target = [IO.Path]::GetFullPath((Join-Path $releaseRoot $rel))',
+    "    if (-not $target.StartsWith($releasePrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('release manifest path escapes slot: ' + $rel) }",
+    "    if (-not (Test-Path -LiteralPath $target -PathType Leaf)) { Fail ('release file missing: ' + $rel) }",
+    '    $targetItem = Get-Item -LiteralPath $target -Force',
+    "    if (($targetItem.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Fail ('release reparse point forbidden: ' + $rel) }",
+    '    $actualHash = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()',
+    "    if ($actualHash -ne $expectedHash) { Fail ('release file hash mismatch: ' + $rel) }",
+    '}',
+    '$releaseItems = Get-ChildItem -LiteralPath $releaseRoot -Force -Recurse',
+    'foreach ($item in $releaseItems) {',
+    "    if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Fail ('release reparse point forbidden: ' + $item.FullName) }",
+    '    if ($item.PSIsContainer) { continue }',
+    '    if ([string]::Equals($item.FullName,$manifest,[StringComparison]::OrdinalIgnoreCase)) { continue }',
+    "    if (-not $item.FullName.StartsWith($releasePrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('release file escapes slot: ' + $item.FullName) }",
+    "    $actualRel = $item.FullName.Substring($releasePrefix.Length).Replace('\\','/')",
+    "    if (-not $manifestPathSet.ContainsKey($actualRel.ToLowerInvariant())) { Fail ('unexpected release file: ' + $actualRel) }",
+    '}',
+    '$generationLines = Get-Content -LiteralPath $generationManifest -Encoding UTF8',
+    'foreach ($line in $generationLines) {',
+    "    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }",
+    "    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'generation manifest line malformed' }",
+    '    $expectedHash = [string]$Matches[1]',
+    '    $rel = [string]$Matches[2]',
+    '    $target = [IO.Path]::GetFullPath((Join-Path $generationRoot $rel))',
+    "    if (-not $target.StartsWith($generationPrefix,[StringComparison]::OrdinalIgnoreCase)) { Fail ('generation manifest path escapes generation: ' + $rel) }",
+    "    if (-not (Test-Path -LiteralPath $target -PathType Leaf)) { Fail ('generation file missing: ' + $rel) }",
+    '    $actualHash = (Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash.ToLowerInvariant()',
+    "    if ($actualHash -ne $expectedHash) { Fail ('generation file hash mismatch: ' + $rel) }",
+    '}',
+    '$pkg = Get-Content -LiteralPath $package -Raw -Encoding UTF8 | ConvertFrom-Json',
+    "if ([string]$pkg.name -ne 'deadbyte-mcp' -or [string]$pkg.version -ne [string]$p.version) { Fail 'active package identity mismatch' }",
+    '$env:DEADBYTE_STATE_ROOT = $StateRoot',
+    '$env:DEADBYTE_CONTROLLER_CONFIG = $configPath',
+    "$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT = Join-Path $StateRoot 'runtime'",
+    "$powershell = Join-Path $PSHOME 'powershell.exe'",
+    '& $powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -File $controller @ControllerArgs',
+    'exit $LASTEXITCODE',
+    ''
+  ].join('\r\n');
+}