deadbyte-mcp 0.15.20 → 0.15.22

package/scripts/promote-local-d-generation.ps1

@@ -0,0 +1,217 @@
+#requires -Version 5.1
+[CmdletBinding()]
+param()
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = 'Stop'
+
+function Fail([string]$Message) { throw "LOCAL_D_PROMOTION: $Message" }
+function Sha256-File([string]$Path) {
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
+}
+function Sha256-Text([string]$Text) {
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
+        return -join ($sha.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') })
+    } finally { $sha.Dispose() }
+}
+function Write-Utf8NoBom([string]$Path,[string]$Text) {
+    [System.IO.File]::WriteAllText($Path,$Text,(New-Object System.Text.UTF8Encoding($false)))
+}
+function Read-Raw([string]$Path) {
+    return [System.IO.File]::ReadAllText($Path,[System.Text.Encoding]::UTF8)
+}
+
+$stateRoot = Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointerPath = Join-Path $stateRoot 'active-release.json'
+$launcher = Join-Path $stateRoot 'bin\DEADBYTE-MCP.ps1'
+$runtimeRoot = Join-Path $stateRoot 'runtime'
+if (-not (Test-Path -LiteralPath $pointerPath -PathType Leaf)) { Fail 'active pointer missing' }
+if (-not (Test-Path -LiteralPath $launcher -PathType Leaf)) { Fail 'stable launcher missing' }
+
+$pointerText = Read-Raw $pointerPath
+$pointer = $pointerText | ConvertFrom-Json
+if ([string]$pointer.schema -ne 'deadbyte.active-release.v1') { Fail 'active pointer schema mismatch' }
+$oldGeneration = [System.IO.Path]::GetFullPath([string]$pointer.generation_root)
+$oldManifest = Join-Path $oldGeneration 'GENERATION.SHA256'
+if (-not (Test-Path -LiteralPath $oldManifest -PathType Leaf)) { Fail 'old generation manifest missing' }
+$oldManifestHash = Sha256-File $oldManifest
+if ($oldManifestHash -ne [string]$pointer.generation_manifest_sha256) { Fail 'old generation manifest hash mismatch' }
+
+$manifestLines = @(Get-Content -LiteralPath $oldManifest -Encoding UTF8)
+$entries = @()
+foreach ($line in $manifestLines) {
+    if ([string]::IsNullOrWhiteSpace([string]$line)) { continue }
+    if ([string]$line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail "malformed old generation manifest line: $line" }
+    $expected = [string]$Matches[1]
+    $name = [string]$Matches[2]
+    $path = Join-Path $oldGeneration $name
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { Fail "old generation file missing: $name" }
+    $actual = Sha256-File $path
+    if ($actual -ne $expected) { Fail "old generation hash mismatch: $name" }
+    $entries += [pscustomobject]@{ Name=$name; Expected=$expected }
+}
+$names = @($entries | ForEach-Object { $_.Name })
+foreach ($required in @('coding-policy.json','autonomous-policy.json','controller-config.psd1')) {
+    if ($required -notin $names) { Fail "required generation file not manifested: $required" }
+}
+
+$oldCodingPath = Join-Path $oldGeneration 'coding-policy.json'
+$oldAutonomousPath = Join-Path $oldGeneration 'autonomous-policy.json'
+$oldCodingHash = Sha256-File $oldCodingPath
+$oldAutonomousHash = Sha256-File $oldAutonomousPath
+
+$coding = (Read-Raw $oldCodingPath) | ConvertFrom-Json
+if ([string]$coding.schema -ne 'deadbyte.coding-policy.v1' -or $coding.enabled -ne $true) { Fail 'coding policy schema/enabled mismatch' }
+if ($null -eq $coding.roots) { Fail 'coding roots missing' }
+
+$localRoot = [pscustomobject][ordered]@{
+    path = 'D:\'
+    read = $true
+    write = $true
+    exec = $true
+    deny_paths = @()
+}
+if ($coding.roots.PSObject.Properties.Name -contains 'local_d') {
+    $coding.roots.local_d = $localRoot
+} else {
+    $coding.roots | Add-Member -NotePropertyName 'local_d' -NotePropertyValue $localRoot
+}
+foreach ($commandProp in @($coding.commands.PSObject.Properties)) {
+    $command = $commandProp.Value
+    if ($command.PSObject.Properties.Name -contains 'root_ids') {
+        $ids = @($command.root_ids)
+        if ('local_d' -notin $ids) { $command.root_ids = @($ids + 'local_d') }
+    }
+}
+$codingText = ($coding | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newCodingHash = Sha256-Text $codingText
+
+$autonomous = (Read-Raw $oldAutonomousPath) | ConvertFrom-Json
+if ([string]$autonomous.schema -ne 'deadbyte.autonomous-policy.v1' -or $autonomous.enabled -ne $true) { Fail 'autonomous policy schema/enabled mismatch' }
+$autonomous.coding_policy_sha256 = $newCodingHash
+$autonomousText = ($autonomous | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+$newAutonomousHash = Sha256-Text $autonomousText
+
+$seed = $oldManifestHash + [Environment]::NewLine + $newCodingHash + [Environment]::NewLine + $newAutonomousHash + [Environment]::NewLine + 'local_d=D:\'
+$generationSuffix = (Sha256-Text $seed).Substring(0,16)
+$newGenerationId = ([string]$pointer.release_id) + '-g' + $generationSuffix
+$generationStore = Join-Path $stateRoot 'generations'
+$newGeneration = Join-Path $generationStore $newGenerationId
+if (Test-Path -LiteralPath $newGeneration) { Fail "target generation already exists: $newGeneration" }
+New-Item -ItemType Directory -Path $newGeneration | Out-Null
+
+$pointerBackup = Join-Path $runtimeRoot 'active-release.before-local-d.json'
+$codingGrantPath = Join-Path $runtimeRoot 'coding-grant.json'
+$autonomousGrantPath = Join-Path $runtimeRoot 'autonomous-grant.json'
+$hadCodingGrant = Test-Path -LiteralPath $codingGrantPath -PathType Leaf
+$hadAutonomousGrant = Test-Path -LiteralPath $autonomousGrantPath -PathType Leaf
+$oldCodingGrantText = if ($hadCodingGrant) { Read-Raw $codingGrantPath } else { $null }
+$oldAutonomousGrantText = if ($hadAutonomousGrant) { Read-Raw $autonomousGrantPath } else { $null }
+$wasAutonomousArmed = $false
+if ($hadCodingGrant -and $hadAutonomousGrant) {
+    try {
+        $cg = $oldCodingGrantText | ConvertFrom-Json
+        $ag = $oldAutonomousGrantText | ConvertFrom-Json
+        $wasAutonomousArmed =
+            ([string]$cg.policy_sha256 -eq $oldCodingHash) -and
+            ([string]$ag.policy_sha256 -eq $oldAutonomousHash) -and
+            ([string]$ag.coding_policy_sha256 -eq $oldCodingHash)
+    } catch { $wasAutonomousArmed = $false }
+}
+
+$switched = $false
+try {
+    foreach ($entry in $entries) {
+        $src = Join-Path $oldGeneration $entry.Name
+        $dst = Join-Path $newGeneration $entry.Name
+        Copy-Item -LiteralPath $src -Destination $dst
+    }
+
+    Write-Utf8NoBom (Join-Path $newGeneration 'coding-policy.json') $codingText
+    Write-Utf8NoBom (Join-Path $newGeneration 'autonomous-policy.json') $autonomousText
+
+    $configPath = Join-Path $newGeneration 'controller-config.psd1'
+    $configText = Read-Raw $configPath
+    if ($configText.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -lt 0) { Fail 'controller config is not bound to old generation root' }
+    $configText = $configText.Replace($oldGeneration,$newGeneration)
+    Write-Utf8NoBom $configPath $configText
+    $cfg = Import-PowerShellDataFile -LiteralPath $configPath
+    if ([System.IO.Path]::GetFullPath([string]$cfg.CodingPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'coding-policy.json'))) { Fail 'new controller CodingPolicyFile binding mismatch' }
+    if ([System.IO.Path]::GetFullPath([string]$cfg.AutonomousPolicyFile) -ne [System.IO.Path]::GetFullPath((Join-Path $newGeneration 'autonomous-policy.json'))) { Fail 'new controller AutonomousPolicyFile binding mismatch' }
+
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $text = $null
+        try { $text = Read-Raw $p } catch { $text = $null }
+        if ($null -ne $text -and $entry.Name -ne 'controller-config.psd1' -and $text.IndexOf($oldGeneration,[System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            Fail "unexpected old generation binding remains in $($entry.Name)"
+        }
+    }
+
+    $newManifestLines = @()
+    foreach ($entry in $entries) {
+        $p = Join-Path $newGeneration $entry.Name
+        $newManifestLines += ((Sha256-File $p) + '  ' + $entry.Name)
+    }
+    $newManifestText = ($newManifestLines -join [Environment]::NewLine) + [Environment]::NewLine
+    $newManifestPath = Join-Path $newGeneration 'GENERATION.SHA256'
+    Write-Utf8NoBom $newManifestPath $newManifestText
+    $newManifestHash = Sha256-File $newManifestPath
+
+    foreach ($line in $newManifestLines) {
+        if ($line -notmatch '^([0-9a-f]{64})  ([A-Za-z0-9._-]+)$') { Fail 'new manifest internal format error' }
+        $actual = Sha256-File (Join-Path $newGeneration ([string]$Matches[2]))
+        if ($actual -ne [string]$Matches[1]) { Fail "new generation verification failed: $($Matches[2])" }
+    }
+    if ((Sha256-File (Join-Path $newGeneration 'coding-policy.json')) -ne $newCodingHash) { Fail 'new coding hash self-check failed' }
+    if ((Sha256-File (Join-Path $newGeneration 'autonomous-policy.json')) -ne $newAutonomousHash) { Fail 'new autonomous hash self-check failed' }
+
+    Write-Utf8NoBom $pointerBackup $pointerText
+    $pointer.generation_root = $newGeneration
+    $pointer.config_path = Join-Path $newGeneration 'controller-config.psd1'
+    $pointer.generation_manifest_sha256 = $newManifestHash
+    if ($pointer.PSObject.Properties.Name -contains 'generation_id') { $pointer.generation_id = $newGenerationId }
+    if ($pointer.PSObject.Properties.Name -contains 'generation_manifest_path') { $pointer.generation_manifest_path = $newManifestPath }
+    if ($pointer.PSObject.Properties.Name -contains 'updated_at_utc') { $pointer.updated_at_utc = [DateTime]::UtcNow.ToString('o') }
+    $newPointerText = ($pointer | ConvertTo-Json -Depth 32) + [Environment]::NewLine
+    $pointerTmp = $pointerPath + '.local-d.tmp'
+    Write-Utf8NoBom $pointerTmp $newPointerText
+    Move-Item -LiteralPath $pointerTmp -Destination $pointerPath -Force
+    $switched = $true
+
+    $statusText = (& $launcher status 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "launcher status failed after pointer switch: $statusText" }
+
+    $armCodingText = (& $launcher armcoding 2>&1 | Out-String)
+    if ($LASTEXITCODE -ne 0) { Fail "armcoding failed after pointer switch: $armCodingText" }
+
+    $armAutonomousText = ''
+    if ($wasAutonomousArmed) {
+        $armAutonomousText = (& $launcher armautonomous 2>&1 | Out-String)
+        if ($LASTEXITCODE -ne 0) { Fail "armautonomous failed after pointer switch: $armAutonomousText" }
+    }
+
+    Write-Output 'LOCAL_D_PROMOTION=PASS'
+    Write-Output ('OLD_GENERATION=' + $oldGeneration)
+    Write-Output ('NEW_GENERATION=' + $newGeneration)
+    Write-Output ('OLD_GENERATION_MANIFEST_SHA256=' + $oldManifestHash)
+    Write-Output ('NEW_GENERATION_MANIFEST_SHA256=' + $newManifestHash)
+    Write-Output ('OLD_CODING_POLICY_SHA256=' + $oldCodingHash)
+    Write-Output ('NEW_CODING_POLICY_SHA256=' + $newCodingHash)
+    Write-Output ('NEW_AUTONOMOUS_POLICY_SHA256=' + $newAutonomousHash)
+    Write-Output ('AUTONOMOUS_REARMED=' + $wasAutonomousArmed)
+    Write-Output ('ROLLBACK_POINTER=' + $pointerBackup)
+    Write-Output 'RESTART_REQUIRED=YES'
+} catch {
+    $message = $_.Exception.Message
+    if ($switched) {
+        try { Write-Utf8NoBom $pointerPath $pointerText } catch {}
+        if ($hadCodingGrant) { try { Write-Utf8NoBom $codingGrantPath $oldCodingGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $codingGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+        if ($hadAutonomousGrant) { try { Write-Utf8NoBom $autonomousGrantPath $oldAutonomousGrantText } catch {} }
+        else { try { Remove-Item -LiteralPath $autonomousGrantPath -Force -ErrorAction SilentlyContinue } catch {} }
+    }
+    try { if (Test-Path -LiteralPath $newGeneration) { Remove-Item -LiteralPath $newGeneration -Recurse -Force } } catch {}
+    Fail $message
+}

package/scripts/test-r48-post-bump.ps1

@@ -0,0 +1,8 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$Root=Split-Path -Parent $PSScriptRoot
+Push-Location $Root
+try {
+  & node --test --test-concurrency=1 test/r48-release-contract.test.mjs test/release-version.test.mjs test/cli-entrypoint.test.mjs test/package-boundary.test.mjs test/release-smoke-isolation.test.mjs test/full-max-catalog-r48.test.mjs
+  if($LASTEXITCODE -ne 0){throw "R48 post-bump release checks failed exit=$LASTEXITCODE"}
+} finally { Pop-Location }

package/scripts/test-r48-windows-observation.ps1

@@ -0,0 +1,8 @@
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$Root=Split-Path -Parent $PSScriptRoot
+Push-Location $Root
+try {
+  & node --test test/machine-fs-runtime.test.mjs test/windows-observation-r48.test.mjs test/windows-observation-surface-r48.test.mjs test/hardware-observation-r45.test.mjs test/observation-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-resolver.test.mjs test/compact-catalog-r36.test.mjs test/compact-max-catalog-r45.test.mjs test/full-max-catalog-r45.test.mjs test/full-max-catalog-r46.test.mjs test/full-max-catalog-r47.test.mjs test/full-max-catalog-r48.test.mjs
+  if($LASTEXITCODE -ne 0){throw "R48 focused regression failed exit=$LASTEXITCODE"}
+} finally { Pop-Location }

package/src/capability-ledger.mjs

@@ -137,6 +137,13 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
   gateway('observation.process_list','machine_process_list','machine_observe','process_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.system_status','machine_system_status','machine_observe','system_status','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.hardware_query','machine_hardware_query','machine_observe','hardware_query','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.registry_query','machine_windows_query','machine_observe','registry_query','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.service_list','machine_windows_query','machine_observe','service_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.driver_list','machine_windows_query','machine_observe','driver_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.socket_list','machine_windows_query','machine_observe','socket_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.volume_list','machine_windows_query','machine_observe','volume_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.usb_list','machine_windows_query','machine_observe','usb_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.wsl_list','machine_windows_query','machine_observe','wsl_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
 
   gateway('desktop.status','desktop_status','desktop_control','status','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.observe','desktop_observe','desktop_control','observe','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),

package/src/capability-resolver.mjs

@@ -1,3 +1,11 @@
+import { processSessionStatus } from './process-policy.mjs';
+import { assertHostArmed } from './host-plane.mjs';
+
+const CODING_ARMED_READ_CAPABILITIES = new Set([
+  'coding.tree','coding.stat','coding.search','coding.files_read','coding.file_read',
+  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview'
+]);
+
 export const CAPABILITY_STATES = Object.freeze({
   AVAILABLE: 'AVAILABLE',
   DEGRADED: 'DEGRADED',
@@ -59,6 +67,13 @@ const CAPABILITY_OPERATIONS = Object.freeze({
   'observation.process_list': ['process_list'],
   'observation.system_status': ['system_status'],
   'observation.hardware_query': ['hardware_query'],
+  'observation.registry_query': ['registry_query'],
+  'observation.service_list': ['service_list'],
+  'observation.driver_list': ['driver_list'],
+  'observation.socket_list': ['socket_list'],
+  'observation.volume_list': ['volume_list'],
+  'observation.usb_list': ['usb_list'],
+  'observation.wsl_list': ['wsl_list'],
   'desktop.status': ['status'],
   'desktop.observe': ['observe'],
   'desktop.target': ['target'],
@@ -88,12 +103,11 @@ export function deriveCapabilityRequirements(capability) {
     reqs.push('skill_plane.valid');
     return reqs;
   }
+  if (CODING_ARMED_READ_CAPABILITIES.has(capability.id) && capability.authority !== 'coding') reqs.push('coding_session.armed');
   if (capability.authority === 'coding') {
-    if (capability.mutating) {
-      reqs.push('coding_session.armed', 'policy.write');
-    } else {
-      reqs.push('coding_runtime.ready');
-    }
+    if (capability.mutating || CODING_ARMED_READ_CAPABILITIES.has(capability.id)) reqs.push('coding_session.armed');
+    else reqs.push('coding_runtime.ready');
+    if (capability.mutating) reqs.push('policy.write');
   } else if (capability.authority === 'process') {
     if (capability.mutating) {
       reqs.push('process_session.armed');
@@ -113,11 +127,7 @@ export function deriveCapabilityRequirements(capability) {
       reqs.push('desktop_runtime.ready');
     }
   } else if (capability.authority === 'host' || capability.host_only) {
-    if (capability.mutating) {
-      reqs.push('host_policy.armed');
-    } else {
-      reqs.push('host_policy.configured');
-    }
+    reqs.push('host_policy.armed');
   }
   return reqs;
 }
@@ -148,11 +158,33 @@ export async function resolveCapabilityStates({
     try { codingStatus = await codingRuntime.sessionStatus(); } catch {}
   }
 
+  let processStatus = null;
+  if (processRuntime?.sessionStatus) {
+    try { processStatus = await processRuntime.sessionStatus(); } catch {}
+  } else if (processRuntime?.policy) {
+    try { processStatus = await processSessionStatus(processRuntime.policy); } catch {}
+  }
+
   let autonomousStatus = null;
   if (autonomousRuntime?.sessionStatus) {
     try { autonomousStatus = await autonomousRuntime.sessionStatus(); } catch {}
   }
 
+  let desktopStatus = null;
+  if (desktopRuntime?.status) {
+    try { desktopStatus = await desktopRuntime.status(); } catch {}
+  }
+
+  let hostStatus = null;
+  if (hostPolicy) {
+    try {
+      const armed = await assertHostArmed(hostPolicy);
+      hostStatus = { configured:true, armed:true, reason:armed.standing ? 'standing-grant' : 'armed' };
+    } catch (error) {
+      hostStatus = { configured:true, armed:false, reason:String(error?.message ?? error) };
+    }
+  }
+
   let skillListResult = null;
   if (skillRuntime?.list) {
     try { skillListResult = await skillRuntime.list(); } catch (err) {
@@ -225,20 +257,44 @@ export async function resolveCapabilityStates({
       };
     }
     // 4. Session Authority Checks
-    else if (cap.authority === 'coding' && cap.mutating && codingStatus && !codingStatus.armed) {
+    else if (requires.includes('coding_session.armed') && !codingStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
       diagnostic = {
         code: 'CODING_SESSION_DISARMED',
-        reason: codingStatus.reason || 'Coding session is not armed for mutation',
+        reason: codingStatus?.reason || 'Coding session is not armed for this capability',
         recoverable: true
       };
-    } else if (cap.authority === 'autonomous' && cap.mutating && autonomousStatus && !autonomousStatus.armed) {
+    } else if (requires.includes('process_session.armed') && !processStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'PROCESS_SESSION_DISARMED',
+        reason: processStatus?.reason || 'Process session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('autonomous_session.armed') && !autonomousStatus?.armed) {
       state = CAPABILITY_STATES.DENIED;
       ready = false;
       diagnostic = {
         code: 'AUTONOMOUS_SESSION_DISARMED',
-        reason: autonomousStatus.reason || 'Autonomous session is not armed for mutation',
+        reason: autonomousStatus?.reason || 'Autonomous session is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('desktop_control.armed') && !desktopStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'DESKTOP_SESSION_DISARMED',
+        reason: desktopStatus?.reason || 'Desktop control is not armed for mutation',
+        recoverable: true
+      };
+    } else if (requires.includes('host_policy.armed') && !hostStatus?.armed) {
+      state = CAPABILITY_STATES.DENIED;
+      ready = false;
+      diagnostic = {
+        code: 'HOST_POLICY_DISARMED',
+        reason: hostStatus?.reason || 'Privileged host policy is disarmed',
         recoverable: true
       };
     }

package/src/compact-gateway-mcp-tools.mjs

@@ -55,7 +55,14 @@ export const machineObserveInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('search_cancel'),search_id:hex64}),
   z.strictObject({op:z.literal('process_list'),limit:z.number().int().min(1).max(256).default(100),include_external:z.boolean().default(false),cursor:z.string().max(512).nullable().default(null)}),
   z.strictObject({op:z.literal('system_status')}),
-  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])})
+  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),
+  z.strictObject({op:z.literal('registry_query'),hive:z.enum(['HKLM','HKCU']),key:z.string().min(1).max(1024),value:z.string().max(260).nullable().default(null)}),
+  z.strictObject({op:z.literal('service_list')}),
+  z.strictObject({op:z.literal('driver_list')}),
+  z.strictObject({op:z.literal('socket_list')}),
+  z.strictObject({op:z.literal('volume_list')}),
+  z.strictObject({op:z.literal('usb_list')}),
+  z.strictObject({op:z.literal('wsl_list')})
 ]);
 
 const capabilityManifestInputSchema=z.strictObject({});
@@ -119,7 +126,14 @@ async function machineObserve(args,machineRuntime,observationRuntime){
     search_cancel:r=>r.searchCancel({searchId:args.search_id}),
     process_list:r=>r.processList({limit:args.limit,includeExternal:args.include_external,cursor:args.cursor}),
     system_status:r=>r.systemStatus(),
-    hardware_query:r=>r.hardwareQuery({query:args.query})
+    hardware_query:r=>r.hardwareQuery({query:args.query}),
+    registry_query:r=>r.windowsQuery({query:'registry',hive:args.hive,key:args.key,value:args.value}),
+    service_list:r=>r.windowsQuery({query:'services'}),
+    driver_list:r=>r.windowsQuery({query:'drivers'}),
+    socket_list:r=>r.windowsQuery({query:'sockets'}),
+    volume_list:r=>r.windowsQuery({query:'volumes'}),
+    usb_list:r=>r.windowsQuery({query:'usb'}),
+    wsl_list:r=>r.windowsQuery({query:'wsl'})
   };
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }

package/src/machine-fs.mjs

@@ -338,7 +338,7 @@ async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null)
     assertExpected: checkExpectedFile, authorityCheck, tempTag: 'deadbyte-machine-fs' });
 }
 
-export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
+export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath, listEntryLstat = lstat, listEntrySha256File = sha256File }) {
   if (!policy) throw new Error('machine fs runtime requires coding policy');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('machine fs runtime requires trust key paths');
 
@@ -384,9 +384,22 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
       const rel = found.relative === '.' ? child.name : `${found.relative}/${child.name}`;
       if (child.isSymbolicLink()) return { path: rel, kind: 'reparse', bytes: 0, mtime_utc: null, sha256: null };
       const childPath = path.join(found.resolved, child.name);
-      const childInfo = await lstat(childPath);
+      let childInfo;
+      try { childInfo = await listEntryLstat(childPath); }
+      catch (error) {
+        const code = typeof error?.code === 'string' && /^[A-Z0-9_]+$/.test(error.code) ? error.code : 'UNKNOWN';
+        return { path: rel, kind: 'unreadable', bytes: 0, mtime_utc: null, sha256: null, error: { code, operation: 'lstat' } };
+      }
       const kind = kindOf(childInfo);
-      const digest = hashFiles && kind === 'file' ? await sha256File(childPath) : null;
+      let digest = null;
+      if (hashFiles && kind === 'file') {
+        try { digest = await listEntrySha256File(childPath); }
+        catch (error) {
+          const code = typeof error?.code === 'string' && /^[A-Z0-9_]+$/.test(error.code) ? error.code : 'UNKNOWN';
+          return { path: rel, kind, bytes: childInfo.size, mtime_utc: childInfo.mtime.toISOString(), sha256: null,
+            error: { code, operation: 'sha256' } };
+        }
+      }
       return { path: rel, kind, bytes: kind === 'file' ? childInfo.size : 0, mtime_utc: childInfo.mtime.toISOString(), sha256: digest };
     }));
     const nextCursor = filtered.length > selected.length && selected.length

package/src/mcp-server.mjs

@@ -479,7 +479,8 @@ serveStdio(() => {
 
   registerCompactGatewayTools(toolServer,{
     profile:surfaceProfile,ledger:R36_CAPABILITY_LEDGER,codingRuntime,semanticRuntime,machineFsRuntime,
-    processRuntime,observationRuntime,machineRuntime,desktopRuntime,catalogProvider:()=>[...registeredToolNames]
+    processRuntime,observationRuntime,machineRuntime,desktopRuntime,skillRuntime,autonomousRuntime,hostPolicy,
+    catalogProvider:()=>[...registeredToolNames]
   });
 
   if (hostPolicy) {

package/src/observation-mcp-tools.mjs

@@ -1,7 +1,7 @@
 import * as z from 'zod/v4';
 import {
   observationHardwareQueryOutputSchema,observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
-  observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema
+  observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema,observationWindowsQueryOutputSchema
 } from './observation-output-contracts.mjs';
 
 const hex64=z.string().regex(/^[0-9a-f]{64}$/);
@@ -45,4 +45,16 @@ export function registerObservationTools(server,{runtime}){
     description:'Read one typed native hardware snapshot (CPU, GPU, memory, storage, network, or PCI) with signed observation evidence. No shell or Host authority is used.',
     inputSchema:z.strictObject({query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),outputSchema:observationHardwareQueryOutputSchema
   },async args=>{try{return ok(observationHardwareQueryOutputSchema,await runtime.hardwareQuery({query:args.query}));}catch(error){return fail(observationHardwareQueryOutputSchema,error);}});
+  server.registerTool('machine_windows_query',{
+    description:'Read one typed native Windows snapshot for Registry, services, drivers, sockets, volumes, USB, or WSL. No shell parsing is used.',
+    inputSchema:z.discriminatedUnion('query',[
+      z.strictObject({query:z.literal('registry'),hive:z.enum(['HKLM','HKCU']),key:z.string().min(1).max(1024),value:z.string().max(260).nullable().default(null)}),
+      z.strictObject({query:z.literal('services')}),
+      z.strictObject({query:z.literal('drivers')}),
+      z.strictObject({query:z.literal('sockets')}),
+      z.strictObject({query:z.literal('volumes')}),
+      z.strictObject({query:z.literal('usb')}),
+      z.strictObject({query:z.literal('wsl')})
+    ]),outputSchema:observationWindowsQueryOutputSchema
+  },async args=>{try{return ok(observationWindowsQueryOutputSchema,await runtime.windowsQuery(args));}catch(error){return fail(observationWindowsQueryOutputSchema,error);}});
 }

package/src/observation-output-contracts.mjs

@@ -55,6 +55,14 @@ export const observationHardwareQueryOutputSchema=statusContract({
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
 },['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
+export const observationWindowsQueryOutputSchema=statusContract({
+  observed_at_utc:z.string().min(1).optional(),
+  query:z.enum(['registry','services','drivers','sockets','volumes','usb','wsl']).optional(),
+  data:z.record(z.string(),z.json()).optional(),
+  observer_sha256:hex64.optional(),
+  ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
+},['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+
 export function observationStructuredResult(schema,value,isError=false){
   return structuredToolResult(schema,value,isError);
 }

package/src/observation-runtime.mjs

@@ -15,6 +15,8 @@ const ZERO='0'.repeat(64);
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,64}$/;
 const HARDWARE_QUERIES=new Set(['cpu','gpu','memory','storage','network','pci']);
+const WINDOWS_QUERIES=new Set(['registry','services','drivers','sockets','volumes','usb','wsl']);
+const REGISTRY_HIVES=new Set(['HKLM','HKCU']);
 const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
 const sha256Object=value=>sha256Bytes(Buffer.from(canonicalJson(value),'utf8'));
 const nowUtc=()=>new Date().toISOString();
@@ -131,12 +133,49 @@ async function defaultHardwareSnapshotProvider(query){
   }
   return {...parsed,observer_sha256:executableSha256};
 }
+function normalizeWindowsQueryArgs(input={}){
+  const query=String(input.query??'');
+  if(!WINDOWS_QUERIES.has(query)) throw new Error('windows query must be one of registry,services,drivers,sockets,volumes,usb,wsl');
+  if(query==='registry'){
+    const hive=String(input.hive??'');
+    const key=String(input.key??'');
+    const value=input.value===null||input.value===undefined?null:String(input.value);
+    if(!REGISTRY_HIVES.has(hive)) throw new Error('registry hive must be HKLM or HKCU');
+    if(key.length<1||key.length>1024||key.includes('\0')) throw new Error('registry key must contain 1-1024 non-NUL characters');
+    if(value!==null&&(value.length>260||value.includes('\0'))) throw new Error('registry value must be null or at most 260 non-NUL characters');
+    return {query,hive,key,value};
+  }
+  const extra=Object.keys(input).filter(k=>k!=='query'&&input[k]!==undefined&&input[k]!==null);
+  if(extra.length) throw new Error(`windows query '${query}' does not accept additional selectors`);
+  return {query};
+}
+async function defaultWindowsSnapshotProvider(input){
+  if(process.platform!=='win32') throw new Error('native Windows observation is supported on win32 only');
+  const args=normalizeWindowsQueryArgs(input);
+  const executable=fileURLToPath(new URL('../bin/deadbyte-hardware-observer-r45.exe',import.meta.url));
+  const executableSha256=sha256Bytes(await readFile(executable));
+  const argv=[args.query];
+  if(args.query==='registry'){
+    argv.push(args.hive,args.key);
+    if(args.value!==null) argv.push(args.value);
+  }
+  const result=spawnSync(executable,argv,{encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:16*1024*1024});
+  if(result.error) throw result.error;
+  if(result.status!==0) throw new Error(`Windows observation failed query=${args.query}: ${String(result.stderr??result.stdout??'').trim()}`);
+  let parsed;
+  try{parsed=JSON.parse(String(result.stdout??'').trim());}
+  catch{throw new Error(`Windows observation returned invalid JSON query=${args.query}`);}
+  if(parsed?.schema!=='deadbyte.windows-query.v1'||parsed?.query!==args.query||!parsed.data||typeof parsed.data!=='object'||Array.isArray(parsed.data)){
+    throw new Error(`Windows observation contract mismatch query=${args.query}`);
+  }
+  return {...parsed,observer_sha256:executableSha256};
+}
 function requestSha(policy,operation,args){
   return sha256Object({schema:'deadbyte.observation-request.v1',policy_sha256:policy.policy_sha256,operation,args});
 }
 export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,processRuntime=null,stateRoot=path.join(os.homedir(),'.deadbyte-mcp'),
   processSnapshotProvider=defaultProcessSnapshotProvider,systemSnapshotProvider=defaultSystemSnapshotProvider,
-  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,
+  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,windowsSnapshotProvider=defaultWindowsSnapshotProvider,
   searchSessionTtlMs=5*60*1000,maxSearchSessions=128,clockMs=()=>Date.now()}={}){
   if(!policy||!signingKeyPath||!verifyKeyPath) throw new Error('observation runtime requires policy and trust keys');
   if(!Number.isInteger(searchSessionTtlMs)||searchSessionTtlMs<10||searchSessionTtlMs>24*60*60*1000) throw new Error('searchSessionTtlMs out of range');
@@ -337,5 +376,18 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     const receipt=await writeReceipt(runtime,'machine_hardware_query',req,head,{observed_at_utc:observedAt,query,observer_sha256:result.observer_sha256??null});
     return {...result,request_sha256:req,result_head_sha256:head,...receipt};
   }
-  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus,hardwareQuery});
+  async function windowsQuery(input={}){
+    const args=normalizeWindowsQueryArgs(input);
+    const observedAt=nowUtc();
+    const snapshot=await windowsSnapshotProvider(args);
+    if(!snapshot||snapshot.schema!=='deadbyte.windows-query.v1'||snapshot.query!==args.query||!snapshot.data||typeof snapshot.data!=='object'||Array.isArray(snapshot.data)){
+      throw new Error('windows query provider contract mismatch');
+    }
+    const result={status:'ok',observed_at_utc:observedAt,query:args.query,data:snapshot.data};
+    if(typeof snapshot.observer_sha256==='string'&&HEX64.test(snapshot.observer_sha256)) result.observer_sha256=snapshot.observer_sha256;
+    const req=requestSha(policy,'machine_windows_query',args); const head=sha256Object(result);
+    const receipt=await writeReceipt(runtime,'machine_windows_query',req,head,{observed_at_utc:observedAt,query:args.query,observer_sha256:result.observer_sha256??null});
+    return {...result,request_sha256:req,result_head_sha256:head,...receipt};
+  }
+  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus,hardwareQuery,windowsQuery});
 }

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.20';
+export const DEADBYTE_VERSION = '0.15.22';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';