deadbyte-mcp 0.15.21 → 0.15.23

package/scripts/test-skill-creator-semver-matrix.mjs

@@ -0,0 +1,30 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+const ex=promisify(execFile);
+const creator=process.argv[2];
+if(!creator) throw new Error("creator path required");
+const valid=["1.0.0","0.0.1","1.1.1","12.34.56","1.0.0-rc.1"];
+const invalid=["1.0","v1.0.0","1.a.0","",String.fromCharCode(49,92,97,48,92,98,48)];
+const results=[];
+for(const version of valid){
+  const tmp=await mkdtemp(path.join(os.tmpdir(),"deadbyte-semver-valid-"));
+  try{
+    await ex(process.execPath,[creator,tmp,"fixture",version],{timeout:30000,maxBuffer:1048576});
+    results.push({version,expected:"PASS",observed:"PASS"});
+  }finally{await rm(tmp,{recursive:true,force:true});}
+}
+for(const version of invalid){
+  const tmp=await mkdtemp(path.join(os.tmpdir(),"deadbyte-semver-invalid-"));
+  let rejected=false;
+  try{
+    await ex(process.execPath,[creator,tmp,"fixture",version],{timeout:30000,maxBuffer:1048576});
+  }catch(e){
+    if(e.code===1 && String(e.stderr).includes("invalid version")) rejected=true;
+  }finally{await rm(tmp,{recursive:true,force:true});}
+  if(!rejected) throw new Error("invalid version accepted: "+JSON.stringify(version));
+  results.push({version,expected:"FAIL",observed:"FAIL"});
+}
+console.log(JSON.stringify({status:"PASS",cases:results},null,2));

package/scripts/test-skill-creator-semver.mjs

@@ -0,0 +1,22 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { execFile } from "node:child_process";
+
+const ex = promisify(execFile);
+const creator = process.argv[2];
+if (!creator) throw new Error("usage: node test-skill-creator-semver.mjs <create-skill.mjs>");
+const tmp = await mkdtemp(path.join(os.tmpdir(), "deadbyte-skill-creator-semver-"));
+try {
+  const r = await ex(process.execPath, [creator, tmp, "semver-regression-fixture", "1.0.0"], {
+    timeout: 30000,
+    maxBuffer: 1024 * 1024
+  });
+  if (!r.stdout.includes("semver-regression-fixture")) {
+    throw new Error("create-skill returned success without fixture path");
+  }
+  console.log(JSON.stringify({status:"PASS", version:"1.0.0", stdout:r.stdout.trim()}));
+} finally {
+  await rm(tmp, {recursive:true, force:true});
+}

package/src/capability-ledger.mjs

@@ -137,6 +137,13 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
   gateway('observation.process_list','machine_process_list','machine_observe','process_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.system_status','machine_system_status','machine_observe','system_status','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
   gateway('observation.hardware_query','machine_hardware_query','machine_observe','hardware_query','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.registry_query','machine_windows_query','machine_observe','registry_query','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.service_list','machine_windows_query','machine_observe','service_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.driver_list','machine_windows_query','machine_observe','driver_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.socket_list','machine_windows_query','machine_observe','socket_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.volume_list','machine_windows_query','machine_observe','volume_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.usb_list','machine_windows_query','machine_observe','usb_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
+  gateway('observation.wsl_list','machine_windows_query','machine_observe','wsl_list','DEADBYTE_OBSERVATION_RUNTIME','none',{receipt_class:'observation'}),
 
   gateway('desktop.status','desktop_status','desktop_control','status','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),
   gateway('desktop.observe','desktop_observe','desktop_control','observe','DEADBYTE_DESKTOP_RUNTIME','none',{receipt_class:'desktop'}),

package/src/capability-resolver.mjs

@@ -67,6 +67,13 @@ const CAPABILITY_OPERATIONS = Object.freeze({
   'observation.process_list': ['process_list'],
   'observation.system_status': ['system_status'],
   'observation.hardware_query': ['hardware_query'],
+  'observation.registry_query': ['registry_query'],
+  'observation.service_list': ['service_list'],
+  'observation.driver_list': ['driver_list'],
+  'observation.socket_list': ['socket_list'],
+  'observation.volume_list': ['volume_list'],
+  'observation.usb_list': ['usb_list'],
+  'observation.wsl_list': ['wsl_list'],
   'desktop.status': ['status'],
   'desktop.observe': ['observe'],
   'desktop.target': ['target'],

package/src/compact-gateway-mcp-tools.mjs

@@ -55,7 +55,14 @@ export const machineObserveInputSchema=z.discriminatedUnion('op',[
   z.strictObject({op:z.literal('search_cancel'),search_id:hex64}),
   z.strictObject({op:z.literal('process_list'),limit:z.number().int().min(1).max(256).default(100),include_external:z.boolean().default(false),cursor:z.string().max(512).nullable().default(null)}),
   z.strictObject({op:z.literal('system_status')}),
-  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])})
+  z.strictObject({op:z.literal('hardware_query'),query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),
+  z.strictObject({op:z.literal('registry_query'),hive:z.enum(['HKLM','HKCU']),key:z.string().min(1).max(1024),value:z.string().max(260).nullable().default(null)}),
+  z.strictObject({op:z.literal('service_list')}),
+  z.strictObject({op:z.literal('driver_list')}),
+  z.strictObject({op:z.literal('socket_list')}),
+  z.strictObject({op:z.literal('volume_list')}),
+  z.strictObject({op:z.literal('usb_list')}),
+  z.strictObject({op:z.literal('wsl_list')})
 ]);
 
 const capabilityManifestInputSchema=z.strictObject({});
@@ -119,7 +126,14 @@ async function machineObserve(args,machineRuntime,observationRuntime){
     search_cancel:r=>r.searchCancel({searchId:args.search_id}),
     process_list:r=>r.processList({limit:args.limit,includeExternal:args.include_external,cursor:args.cursor}),
     system_status:r=>r.systemStatus(),
-    hardware_query:r=>r.hardwareQuery({query:args.query})
+    hardware_query:r=>r.hardwareQuery({query:args.query}),
+    registry_query:r=>r.windowsQuery({query:'registry',hive:args.hive,key:args.key,value:args.value}),
+    service_list:r=>r.windowsQuery({query:'services'}),
+    driver_list:r=>r.windowsQuery({query:'drivers'}),
+    socket_list:r=>r.windowsQuery({query:'sockets'}),
+    volume_list:r=>r.windowsQuery({query:'volumes'}),
+    usb_list:r=>r.windowsQuery({query:'usb'}),
+    wsl_list:r=>r.windowsQuery({query:'wsl'})
   };
   return invoke(args.op,observationRuntime,'observation',map[args.op]);
 }

package/src/deadbyte-cli.mjs

@@ -13,7 +13,7 @@ import { openRemoteResultJournal, parseRemoteResultCursor } from './remote-resul
 import { DEADBYTE_VERSION } from './version.mjs';
 import { parseActivePointer } from './release-slot.mjs';
 import { printDoctor } from './doctor-r45.mjs';
-import { createLiveTimelineTracker, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine } from './remote-live-log.mjs';
+import { createLiveTimelineFilter, createLiveTimelineTracker, createLiveTimelineWriter, formatCompactAuditEvent, formatRemoteLifecycle, formatRemoteToolCall, formatRuntimeDiagnosticLine } from './remote-live-log.mjs';
 import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 
 const REMOTE_COMMANDS=new Set([
@@ -46,6 +46,8 @@ function printHelp(){
     `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
     `  npx -y ${exact} remote              # unified foreground device session + live timeline`,
     `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
+    `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
+    `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
     `  npx -y ${exact} remote status`,
     `  npx -y ${exact} remote restart`,
     `  npx -y ${exact} supervisor status`,
@@ -71,6 +73,21 @@ async function readActiveRuntimeBinding(root){
   try{return parseActivePointer(await readFile(file,'utf8'));}
   catch(error){if(error?.code==='ENOENT') return null;throw new Error(`active runtime pointer invalid: ${boundedSingleLine(error?.message||error,512)}`);}
 }
+async function readLiveRootPaths(root){
+  const active=await readActiveRuntimeBinding(root);
+  if(!active) return Object.freeze({});
+  const file=path.join(active.generation_root,'coding-policy.json');
+  let raw;
+  try{raw=JSON.parse(await readFile(file,'utf8'));}
+  catch(error){if(error?.code==='ENOENT') return Object.freeze({});throw new Error(`live root policy invalid: ${boundedSingleLine(error?.message||error,512)}`);}
+  if(raw?.schema!=='deadbyte.coding-policy.v1'||!raw.roots||typeof raw.roots!=='object'||Array.isArray(raw.roots)) throw new Error('live root policy schema invalid');
+  const roots={};
+  for(const [id,spec] of Object.entries(raw.roots)){
+    if(!/^[A-Za-z0-9._-]{1,64}$/.test(id)||!spec||typeof spec!=='object'||typeof spec.path!=='string'||!path.isAbsolute(spec.path)) continue;
+    roots[id]=path.resolve(spec.path);
+  }
+  return Object.freeze(roots);
+}
 async function reportVersionCoherence(root,{displayMode='ascii'}={}){
   const active=await readActiveRuntimeBinding(root);
   if(!active||active.version===DEADBYTE_VERSION) return active;
@@ -227,7 +244,22 @@ async function snapshotRemoteLogOffsets(root){
   }
   return offsets;
 }
-async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,verbose=false,displayMode='unicode'}={}){
+function timelineFilterEvent(timeline){
+  if(!timeline) return null;
+  if(timeline.event_type==='tool.call') return {
+    event_type:'tool.request',request_id:timeline.request_id,tool:timeline.tool,args:timeline.arguments??{}
+  };
+  return {
+    event_type:'tool.result',request_id:timeline.request_id,tool:timeline.tool,
+    outcome:{
+      is_error:timeline.status==='error',
+      ...(Number.isFinite(Number(timeline.duration_ms))?{duration_ms:Number(timeline.duration_ms)}:{}),
+      ...(timeline.side_effect_state?{side_effect_state:timeline.side_effect_state}:{}),
+      ...(timeline.reason?{reason:timeline.reason}:{})
+    }
+  };
+}
+async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTracker=null,timelineFilter=null,timelineWriter=null,verbose=false,displayMode='unicode'}={}){
   process.stdout.write(verbose
     ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
     : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. Ctrl+C disconnects and revokes authority.\n');
@@ -244,10 +276,14 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
           ? await journal.recordCall(timeline)
           : await journal.recordTerminal(timeline);
         if(recorded?.duplicate) continue;
+        const accepted=timelineFilter&&timeline?timelineFilter.accept(timelineFilterEvent(timeline)):true;
         const formatted=formatLogLine(file,line,{activityTracker,sequence:recorded?.event?.seq??null,verbose,displayMode});
-        if(!formatted) continue;
+        if(!formatted||!accepted) continue;
         const output=Array.isArray(formatted)?formatted:[formatted];
-        for(const item of output) if(item) process.stdout.write(`${item}\n`);
+        for(const item of output) if(item){
+          if(timelineWriter) timelineWriter.write(item,{event_type:timeline?.event_type??null,request_id:timeline?.request_id??null});
+          else process.stdout.write(`${item}\n`);
+        }
       }
     }
     try{await sleep(250,null,{signal});}catch(error){if(error?.name!=='AbortError') throw error;}
@@ -341,7 +377,7 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
   const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
   if(same) await rm(remoteSessionMarker(ctx.root),{force:true});
 }
-async function runRemoteSession({resumeCursor=null,verbose=false}={}){
+async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression=''}={}){
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -353,7 +389,10 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
   const resultJournal=await openRemoteResultJournal({
     filePath:remoteResultJournalPath(ctx.root,marker.result_session_id),sessionId:marker.result_session_id,maxEntries:2048
   });
-  const activityTracker=createLiveTimelineTracker({verbose,displayMode});
+  const rootPaths=await readLiveRootPaths(ctx.root);
+  const activityTracker=createLiveTimelineTracker({verbose,displayMode,rootPaths,trace});
+  const timelineFilter=filterExpression?createLiveTimelineFilter(filterExpression):null;
+  const timelineWriter=createLiveTimelineWriter({stream:process.stdout,displayMode,rewrite:!verbose});
   const aborter=new AbortController();
   const abort=()=>aborter.abort();
   const watchStdin=!process.stdin.isTTY;
@@ -366,7 +405,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
     process.stdout.write(`${formatRemoteLifecycle('device_start',{displayMode})}\n`);
     process.stdout.write(`${formatRemoteLifecycle(resumeCursor!==null?'session_restored':'session_new',{displayMode})}\n`);
     const logOffsets=await snapshotRemoteLogOffsets(ctx.root);
-    logTask=tailRemoteLogs(ctx.root,aborter.signal,{journal:resultJournal,offsets:logOffsets,activityTracker,verbose,displayMode});
+    logTask=tailRemoteLogs(ctx.root,aborter.signal,{journal:resultJournal,offsets:logOffsets,activityTracker,timelineFilter,timelineWriter,verbose,displayMode});
     process.stdout.write('[BOOT] Starting local + remote runtime...\n');
     const preflight=invokeController(ctx,'status',{capture:true,allowFailure:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
     let startText=preflight.stdout||'';
@@ -415,6 +454,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
     const wasAborted=aborter.signal.aborted;
     aborter.abort();
     if(logTask) await logTask.catch(()=>{});
+    timelineWriter.flush();
     for(const line of activityTracker.reconcileInterrupted('session_end')) process.stdout.write(`${line}\n`);
     process.stdout.write(`${activityTracker.summary()}\n`);
     process.removeListener('SIGINT',abort);process.removeListener('SIGTERM',abort);
@@ -426,14 +466,29 @@ async function runRemoteSession({resumeCursor=null,verbose=false}={}){
   }
 }
 async function runRemote(args){
-  if(args.length===0){await runRemoteSession();return;}
-  const verbose=args.includes('--verbose')||args.includes('-v');
-  const filtered=args.filter(arg=>arg!=='--verbose'&&arg!=='-v');
-  if(filtered.length===0){await runRemoteSession({verbose});return;}
-  if(filtered.length===2&&filtered[0]==='--resume'){await runRemoteSession({resumeCursor:filtered[1],verbose});return;}
-  if(verbose) throw new Error('remote --verbose/-v is valid only for foreground session or --resume <cursor>');
-  if(filtered.length>1) throw new Error('remote accepts one controller command or --resume <cursor>');
-  const command=filtered[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
+  let verbose=false,trace=false,filterExpression='',resumeCursor=null;
+  const positional=[];
+  for(let index=0;index<args.length;index++){
+    const arg=args[index];
+    if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
+    if(arg==='--trace'){trace=true;continue;}
+    if(arg==='--filter'){
+      if(filterExpression) throw new Error('remote --filter may be specified once');
+      if(index+1>=args.length) throw new Error('remote --filter requires an expression');
+      filterExpression=args[++index];continue;
+    }
+    if(arg==='--resume'){
+      if(resumeCursor!==null) throw new Error('remote --resume may be specified once');
+      if(index+1>=args.length) throw new Error('remote --resume requires a cursor');
+      resumeCursor=args[++index];continue;
+    }
+    positional.push(arg);
+  }
+  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null;
+  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression});return;}
+  if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
+  if(positional.length>1) throw new Error('remote accepts one controller command');
+  const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);
   const ctx=await remoteContext();
   await reportVersionCoherence(ctx.root,{displayMode:'ascii'});
   const result=invokeController(ctx,command,{allowFailure:true});

package/src/machine-fs.mjs

@@ -338,7 +338,7 @@ async function atomicWrite(target, bytes, expectedSha256, authorityCheck = null)
     assertExpected: checkExpectedFile, authorityCheck, tempTag: 'deadbyte-machine-fs' });
 }
 
-export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath }) {
+export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath, readWorkerPath = machineFsReadWorkerPath, listEntryLstat = lstat, listEntrySha256File = sha256File }) {
   if (!policy) throw new Error('machine fs runtime requires coding policy');
   if (!signingKeyPath || !verifyKeyPath) throw new Error('machine fs runtime requires trust key paths');
 
@@ -384,9 +384,22 @@ export function createMachineFsRuntime({ policy, signingKeyPath, verifyKeyPath,
       const rel = found.relative === '.' ? child.name : `${found.relative}/${child.name}`;
       if (child.isSymbolicLink()) return { path: rel, kind: 'reparse', bytes: 0, mtime_utc: null, sha256: null };
       const childPath = path.join(found.resolved, child.name);
-      const childInfo = await lstat(childPath);
+      let childInfo;
+      try { childInfo = await listEntryLstat(childPath); }
+      catch (error) {
+        const code = typeof error?.code === 'string' && /^[A-Z0-9_]+$/.test(error.code) ? error.code : 'UNKNOWN';
+        return { path: rel, kind: 'unreadable', bytes: 0, mtime_utc: null, sha256: null, error: { code, operation: 'lstat' } };
+      }
       const kind = kindOf(childInfo);
-      const digest = hashFiles && kind === 'file' ? await sha256File(childPath) : null;
+      let digest = null;
+      if (hashFiles && kind === 'file') {
+        try { digest = await listEntrySha256File(childPath); }
+        catch (error) {
+          const code = typeof error?.code === 'string' && /^[A-Z0-9_]+$/.test(error.code) ? error.code : 'UNKNOWN';
+          return { path: rel, kind, bytes: childInfo.size, mtime_utc: childInfo.mtime.toISOString(), sha256: null,
+            error: { code, operation: 'sha256' } };
+        }
+      }
       return { path: rel, kind, bytes: kind === 'file' ? childInfo.size : 0, mtime_utc: childInfo.mtime.toISOString(), sha256: digest };
     }));
     const nextCursor = filtered.length > selected.length && selected.length

package/src/observation-mcp-tools.mjs

@@ -1,7 +1,7 @@
 import * as z from 'zod/v4';
 import {
   observationHardwareQueryOutputSchema,observationProcessListOutputSchema,observationSearchCancelOutputSchema,observationSearchPageOutputSchema,
-  observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema
+  observationSearchStartOutputSchema,observationSearchStatusOutputSchema,observationStructuredResult,observationSystemStatusOutputSchema,observationWindowsQueryOutputSchema
 } from './observation-output-contracts.mjs';
 
 const hex64=z.string().regex(/^[0-9a-f]{64}$/);
@@ -45,4 +45,16 @@ export function registerObservationTools(server,{runtime}){
     description:'Read one typed native hardware snapshot (CPU, GPU, memory, storage, network, or PCI) with signed observation evidence. No shell or Host authority is used.',
     inputSchema:z.strictObject({query:z.enum(['cpu','gpu','memory','storage','network','pci'])}),outputSchema:observationHardwareQueryOutputSchema
   },async args=>{try{return ok(observationHardwareQueryOutputSchema,await runtime.hardwareQuery({query:args.query}));}catch(error){return fail(observationHardwareQueryOutputSchema,error);}});
+  server.registerTool('machine_windows_query',{
+    description:'Read one typed native Windows snapshot for Registry, services, drivers, sockets, volumes, USB, or WSL. No shell parsing is used.',
+    inputSchema:z.discriminatedUnion('query',[
+      z.strictObject({query:z.literal('registry'),hive:z.enum(['HKLM','HKCU']),key:z.string().min(1).max(1024),value:z.string().max(260).nullable().default(null)}),
+      z.strictObject({query:z.literal('services')}),
+      z.strictObject({query:z.literal('drivers')}),
+      z.strictObject({query:z.literal('sockets')}),
+      z.strictObject({query:z.literal('volumes')}),
+      z.strictObject({query:z.literal('usb')}),
+      z.strictObject({query:z.literal('wsl')})
+    ]),outputSchema:observationWindowsQueryOutputSchema
+  },async args=>{try{return ok(observationWindowsQueryOutputSchema,await runtime.windowsQuery(args));}catch(error){return fail(observationWindowsQueryOutputSchema,error);}});
 }

package/src/observation-output-contracts.mjs

@@ -55,6 +55,14 @@ export const observationHardwareQueryOutputSchema=statusContract({
   ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
 },['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
 
+export const observationWindowsQueryOutputSchema=statusContract({
+  observed_at_utc:z.string().min(1).optional(),
+  query:z.enum(['registry','services','drivers','sockets','volumes','usb','wsl']).optional(),
+  data:z.record(z.string(),z.json()).optional(),
+  observer_sha256:hex64.optional(),
+  ...Object.fromEntries(Object.entries(evidenceShape).map(([k,v])=>[k,v.optional()]))
+},['observed_at_utc','query','data','request_sha256','result_head_sha256','receipt_id','receipt_sha256']);
+
 export function observationStructuredResult(schema,value,isError=false){
   return structuredToolResult(schema,value,isError);
 }

package/src/observation-runtime.mjs

@@ -15,6 +15,8 @@ const ZERO='0'.repeat(64);
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,64}$/;
 const HARDWARE_QUERIES=new Set(['cpu','gpu','memory','storage','network','pci']);
+const WINDOWS_QUERIES=new Set(['registry','services','drivers','sockets','volumes','usb','wsl']);
+const REGISTRY_HIVES=new Set(['HKLM','HKCU']);
 const sha256Bytes=bytes=>createHash('sha256').update(bytes).digest('hex');
 const sha256Object=value=>sha256Bytes(Buffer.from(canonicalJson(value),'utf8'));
 const nowUtc=()=>new Date().toISOString();
@@ -131,12 +133,49 @@ async function defaultHardwareSnapshotProvider(query){
   }
   return {...parsed,observer_sha256:executableSha256};
 }
+function normalizeWindowsQueryArgs(input={}){
+  const query=String(input.query??'');
+  if(!WINDOWS_QUERIES.has(query)) throw new Error('windows query must be one of registry,services,drivers,sockets,volumes,usb,wsl');
+  if(query==='registry'){
+    const hive=String(input.hive??'');
+    const key=String(input.key??'');
+    const value=input.value===null||input.value===undefined?null:String(input.value);
+    if(!REGISTRY_HIVES.has(hive)) throw new Error('registry hive must be HKLM or HKCU');
+    if(key.length<1||key.length>1024||key.includes('\0')) throw new Error('registry key must contain 1-1024 non-NUL characters');
+    if(value!==null&&(value.length>260||value.includes('\0'))) throw new Error('registry value must be null or at most 260 non-NUL characters');
+    return {query,hive,key,value};
+  }
+  const extra=Object.keys(input).filter(k=>k!=='query'&&input[k]!==undefined&&input[k]!==null);
+  if(extra.length) throw new Error(`windows query '${query}' does not accept additional selectors`);
+  return {query};
+}
+async function defaultWindowsSnapshotProvider(input){
+  if(process.platform!=='win32') throw new Error('native Windows observation is supported on win32 only');
+  const args=normalizeWindowsQueryArgs(input);
+  const executable=fileURLToPath(new URL('../bin/deadbyte-hardware-observer-r45.exe',import.meta.url));
+  const executableSha256=sha256Bytes(await readFile(executable));
+  const argv=[args.query];
+  if(args.query==='registry'){
+    argv.push(args.hive,args.key);
+    if(args.value!==null) argv.push(args.value);
+  }
+  const result=spawnSync(executable,argv,{encoding:'utf8',windowsHide:true,shell:false,timeout:15000,maxBuffer:16*1024*1024});
+  if(result.error) throw result.error;
+  if(result.status!==0) throw new Error(`Windows observation failed query=${args.query}: ${String(result.stderr??result.stdout??'').trim()}`);
+  let parsed;
+  try{parsed=JSON.parse(String(result.stdout??'').trim());}
+  catch{throw new Error(`Windows observation returned invalid JSON query=${args.query}`);}
+  if(parsed?.schema!=='deadbyte.windows-query.v1'||parsed?.query!==args.query||!parsed.data||typeof parsed.data!=='object'||Array.isArray(parsed.data)){
+    throw new Error(`Windows observation contract mismatch query=${args.query}`);
+  }
+  return {...parsed,observer_sha256:executableSha256};
+}
 function requestSha(policy,operation,args){
   return sha256Object({schema:'deadbyte.observation-request.v1',policy_sha256:policy.policy_sha256,operation,args});
 }
 export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,processRuntime=null,stateRoot=path.join(os.homedir(),'.deadbyte-mcp'),
   processSnapshotProvider=defaultProcessSnapshotProvider,systemSnapshotProvider=defaultSystemSnapshotProvider,
-  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,
+  ownedRuntimePidProvider=defaultOwnedRuntimePidProvider,hardwareSnapshotProvider=defaultHardwareSnapshotProvider,windowsSnapshotProvider=defaultWindowsSnapshotProvider,
   searchSessionTtlMs=5*60*1000,maxSearchSessions=128,clockMs=()=>Date.now()}={}){
   if(!policy||!signingKeyPath||!verifyKeyPath) throw new Error('observation runtime requires policy and trust keys');
   if(!Number.isInteger(searchSessionTtlMs)||searchSessionTtlMs<10||searchSessionTtlMs>24*60*60*1000) throw new Error('searchSessionTtlMs out of range');
@@ -337,5 +376,18 @@ export function createObservationRuntime({policy,signingKeyPath,verifyKeyPath,pr
     const receipt=await writeReceipt(runtime,'machine_hardware_query',req,head,{observed_at_utc:observedAt,query,observer_sha256:result.observer_sha256??null});
     return {...result,request_sha256:req,result_head_sha256:head,...receipt};
   }
-  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus,hardwareQuery});
+  async function windowsQuery(input={}){
+    const args=normalizeWindowsQueryArgs(input);
+    const observedAt=nowUtc();
+    const snapshot=await windowsSnapshotProvider(args);
+    if(!snapshot||snapshot.schema!=='deadbyte.windows-query.v1'||snapshot.query!==args.query||!snapshot.data||typeof snapshot.data!=='object'||Array.isArray(snapshot.data)){
+      throw new Error('windows query provider contract mismatch');
+    }
+    const result={status:'ok',observed_at_utc:observedAt,query:args.query,data:snapshot.data};
+    if(typeof snapshot.observer_sha256==='string'&&HEX64.test(snapshot.observer_sha256)) result.observer_sha256=snapshot.observer_sha256;
+    const req=requestSha(policy,'machine_windows_query',args); const head=sha256Object(result);
+    const receipt=await writeReceipt(runtime,'machine_windows_query',req,head,{observed_at_utc:observedAt,query:args.query,observer_sha256:result.observer_sha256??null});
+    return {...result,request_sha256:req,result_head_sha256:head,...receipt};
+  }
+  return Object.freeze({policy,searchStart,searchPage,searchStatus,searchCancel,processList,systemStatus,hardwareQuery,windowsQuery});
 }