deadbyte-mcp 0.15.21 → 0.15.22

package/test/r48-release-contract.test.mjs

@@ -6,29 +6,33 @@ import { DEADBYTE_VERSION } from '../src/version.mjs';
 const root=new URL('../',import.meta.url);
 const read=rel=>readFile(new URL(rel,root),'utf8');
 
-test('R48 successor identity is coherent and binds active 0.15.20 parent plus sealed 0.15.20 source predecessor',async()=>{
+test('R48 0.15.22 successor binds active 0.15.21 parent and native Windows observation release evidence',async()=>{
   const [pkg,lock,release,provenance]=await Promise.all([
     read('package.json').then(JSON.parse),
     read('package-lock.json').then(JSON.parse),
     read('RELEASE.json').then(JSON.parse),
     read('PROVENANCE.json').then(JSON.parse)
   ]);
-  assert.equal(pkg.version,'0.15.21');
-  assert.equal(lock.version,'0.15.21');
-  assert.equal(lock.packages[''].version,'0.15.21');
-  assert.equal(DEADBYTE_VERSION,'0.15.21');
-  assert.equal(release.version,'0.15.21');
-  assert.equal(provenance.version,'0.15.21');
+  assert.equal(pkg.version,'0.15.22');
+  assert.equal(lock.version,'0.15.22');
+  assert.equal(lock.packages[''].version,'0.15.22');
+  assert.equal(DEADBYTE_VERSION,'0.15.22');
+  assert.equal(release.version,'0.15.22');
+  assert.equal(provenance.version,'0.15.22');
   assert.equal(release.train,'R48');
-  assert.equal(release.label,'CAPABILITY MANIFEST AUTHORITY TRUTH');
-  assert.equal(release.parent.release_id,'v0.15.20-bab990b08c9c1f07');
-  assert.equal(release.parent.manifest_sha256,'bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d');
-  assert.equal(release.parent.generation_manifest_sha256,'617ea6bfbfc7e1952d17e7fea1043fd70b32bb1edacbd3ed6002fec7235c7221');
-  assert.equal(release.source_predecessor.version,'0.15.20');
-  assert.equal(release.source_predecessor.tarball_sha256,'eb7cbe8465ae3834c9857fc2115c7ab4eb3d1a018aa1695b799912def5dc3cee');
-  assert.equal(release.source_predecessor.manifest_file_sha256,'bab990b08c9c1f0788a1ede6b0695d293f8433e4ef0f541eca59635cf125a43d');
+  assert.equal(release.label,'NATIVE WINDOWS OBSERVATION + MACHINE FS RESILIENCE');
+  assert.equal(release.parent.release_id,'v0.15.21-7c2735e0b1c6cc8d');
+  assert.equal(release.parent.manifest_sha256,'7c2735e0b1c6cc8dac6581c47b6b557d8d0157a324b67efd4df058e67cdb289f');
+  assert.equal(release.parent.generation_manifest_sha256,'b376e7fc450f44edddb0d0e1d596014c463f603e4917c56a68906b7f66f99dc7');
+  assert.equal(release.source_predecessor.version,'0.15.21');
+  assert.equal(release.source_predecessor.tarball_sha256,'3439f5f4435632e4cde385a6937e3e3d2ffcfb777295dd56aafbf3b036be7493');
+  assert.equal(release.source_predecessor.manifest_file_sha256,'7c2735e0b1c6cc8dac6581c47b6b557d8d0157a324b67efd4df058e67cdb289f');
   assert.equal(release.source_predecessor.reference_server_sha256,'dfc303bb7dd2e8d01debac50fc43bb8644d00089bffdf2887e149497cff8b305');
   assert.equal(release.source_predecessor.reference_schemas_sha256,'f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140');
+  assert.equal(release.capabilities.full_tool_count,116);
+  assert.equal(release.capabilities.full_tool_catalog.path,'docs/R48-FULL-TOOL-CATALOG.json');
+  assert.deepEqual(release.capabilities.windows_queries,['registry','services','drivers','sockets','volumes','usb','wsl']);
+  assert.equal(release.capabilities.machine_fs_list_entry_fault_isolation,true);
   assert.equal(release.capabilities.capability_manifest_authority_truth,true);
   assert.equal(release.capabilities.capability_manifest_host_grant_truth,true);
   assert.equal(provenance.parent_release_id,release.parent.release_id);

package/test/windows-observation-r48.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createObservationRuntime, verifyObservationReceiptFile } from '../src/observation-runtime.mjs';
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-windows-query-r48-'));
+  const project=path.join(root,'project');await mkdir(project);
+  const policyPath=path.join(root,'coding-policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:path.join(root,'coding-grant.json'),evidence_dir:path.join(root,'evidence'),
+    roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},commands:{},
+    max_read_bytes:65536,max_write_bytes:65536}));
+  const policy=await loadCodingPolicy(policyPath);
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+  const calls=[];
+  const windowsSnapshotProvider=async args=>{
+    calls.push(args);
+    return {schema:'deadbyte.windows-query.v1',query:args.query,data:{query:args.query,fixture:true},observer_sha256:'e'.repeat(64)};
+  };
+  const runtime=createObservationRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath,
+    stateRoot:root,processSnapshotProvider:async()=>[],systemSnapshotProvider:async()=>({hostname:'x',platform:'win32',architecture:'x64',
+      uptime_seconds:1,total_memory_bytes:1,free_memory_bytes:1,cpu_count:1,load_average:[0,0,0]}),
+    ownedRuntimePidProvider:async()=>new Set(),hardwareSnapshotProvider:async query=>({schema:'deadbyte.hardware-query.v1',query,data:{fixture:true}}),
+    windowsSnapshotProvider});
+  return {root,policy,keys,runtime,calls};
+}
+
+test('R48 typed Windows queries are read-only signed native observations',async()=>{
+  const f=await fixture();
+  assert.equal(typeof f.runtime.windowsQuery,'function','windowsQuery runtime method missing');
+  const requests=[
+    {query:'registry',hive:'HKLM',key:'SYSTEM\\CurrentControlSet\\Control',value:null},
+    {query:'services'},{query:'drivers'},{query:'sockets'},{query:'volumes'},{query:'usb'},{query:'wsl'}
+  ];
+  for(const request of requests){
+    const out=await f.runtime.windowsQuery(request);
+    assert.equal(out.status,'ok');
+    assert.equal(out.query,request.query);
+    assert.equal(out.data.query,request.query);
+    assert.match(out.observer_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.request_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.result_head_sha256,/^[0-9a-f]{64}$/);
+    assert.match(out.receipt_id,/^[0-9a-f]{24}$/);
+    const verified=await verifyObservationReceiptFile({policy:f.policy,verifyKeyPath:f.keys.publicKeyPath,receiptId:out.receipt_id});
+    assert.equal(verified.ok,true);
+    assert.equal(verified.kind,'machine_windows_query');
+  }
+  assert.deepEqual(f.calls,requests);
+});
+
+test('R48 Windows query validation rejects arbitrary commands and malformed registry selectors before dispatch',async()=>{
+  const f=await fixture();
+  assert.equal(typeof f.runtime.windowsQuery,'function','windowsQuery runtime method missing');
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'powershell',command:'Get-Service'}),/windows query/i);
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'registry',hive:'HKCR',key:'x'}),/registry hive/i);
+  await assert.rejects(()=>f.runtime.windowsQuery({query:'registry',hive:'HKLM',key:''}),/registry key/i);
+  assert.deepEqual(f.calls,[]);
+});

package/test/windows-observation-surface-r48.test.mjs

@@ -0,0 +1,70 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { machineObserveInputSchema, registerCompactGatewayTools } from '../src/compact-gateway-mcp-tools.mjs';
+import { registerObservationTools } from '../src/observation-mcp-tools.mjs';
+import { R36_CAPABILITY_LEDGER } from '../src/capability-ledger.mjs';
+
+const fakeServer=()=>{
+  const tools=new Map();
+  return {tools,registerTool(name,spec,handler){if(tools.has(name))throw new Error('duplicate '+name);tools.set(name,{spec,handler});}};
+};
+const ledger={schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)};
+const evidence=query=>({status:'ok',observed_at_utc:new Date(0).toISOString(),query,data:{query},observer_sha256:'e'.repeat(64),
+  request_sha256:'b'.repeat(64),result_head_sha256:'c'.repeat(64),receipt_id:'a'.repeat(24),receipt_sha256:'d'.repeat(64)});
+
+test('R48 compact machine_observe exposes seven strict Windows native operations without generic command dispatch',()=>{
+  const valid=[
+    {op:'registry_query',hive:'HKLM',key:'SYSTEM\\CurrentControlSet\\Control',value:null},
+    {op:'service_list'},{op:'driver_list'},{op:'socket_list'},{op:'volume_list'},{op:'usb_list'},{op:'wsl_list'}
+  ];
+  for(const input of valid) assert.equal(machineObserveInputSchema.safeParse(input).success,true,JSON.stringify(input));
+  assert.equal(machineObserveInputSchema.safeParse({op:'registry_query',hive:'HKCR',key:'x',value:null}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'service_list',command:'sc.exe query'}).success,false);
+  assert.equal(machineObserveInputSchema.safeParse({op:'socket_list',powershell:'Get-NetTCPConnection'}).success,false);
+});
+
+test('R48 compact machine_observe routes all Windows operations to one typed runtime method',async()=>{
+  const calls=[];
+  const observationRuntime={windowsQuery:async args=>{calls.push(args);return evidence(args.query);}};
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{profile:'compact',ledger,codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,
+    observationRuntime,machineRuntime:null,desktopRuntime:null,skillRuntime:null,autonomousRuntime:null,hostPolicy:null,
+    catalogProvider:()=>[...server.tools.keys()]});
+  const tool=server.tools.get('machine_observe');
+  const inputs=[
+    {op:'registry_query',hive:'HKCU',key:'Software\\Microsoft',value:'Test'},
+    {op:'service_list'},{op:'driver_list'},{op:'socket_list'},{op:'volume_list'},{op:'usb_list'},{op:'wsl_list'}
+  ];
+  for(const input of inputs){
+    const out=await tool.handler(input);
+    assert.equal(out.isError,false);
+  }
+  assert.deepEqual(calls,[
+    {query:'registry',hive:'HKCU',key:'Software\\Microsoft',value:'Test'},
+    {query:'services'},{query:'drivers'},{query:'sockets'},{query:'volumes'},{query:'usb'},{query:'wsl'}
+  ]);
+});
+
+test('R48 full observation surface exposes one typed machine_windows_query tool',()=>{
+  const server=fakeServer();
+  registerObservationTools(server,{runtime:{windowsQuery:async args=>evidence(args.query),
+    searchStart:async()=>{},searchPage:async()=>{},searchStatus:async()=>{},searchCancel:async()=>{},processList:async()=>{},systemStatus:async()=>{},hardwareQuery:async()=>{}}});
+  assert.equal(server.tools.has('machine_windows_query'),true);
+  const schema=server.tools.get('machine_windows_query').spec.inputSchema;
+  assert.equal(schema.safeParse({query:'registry',hive:'HKLM',key:'SOFTWARE',value:null}).success,true);
+  assert.equal(schema.safeParse({query:'services'}).success,true);
+  assert.equal(schema.safeParse({query:'services',command:'sc query'}).success,false);
+});
+
+test('R48 capability ledger declares every Windows observation through compact machine_observe',()=>{
+  const expected=['registry_query','service_list','driver_list','socket_list','volume_list','usb_list','wsl_list'];
+  for(const op of expected){
+    const cap=R36_CAPABILITY_LEDGER.entries.find(x=>x.id===`observation.${op}`);
+    assert.ok(cap,`missing observation.${op}`);
+    assert.equal(cap.full_tool,'machine_windows_query');
+    assert.equal(cap.compact_tool,'machine_observe');
+    assert.equal(cap.compact_op,op);
+    assert.equal(cap.authority,'none');
+    assert.equal(cap.mutating,false);
+  }
+});