deadbyte-mcp 0.15.34 → 0.15.35

package/scripts/windows-gate-evidence-r58.mjs

@@ -0,0 +1,93 @@
+import {createHash} from 'node:crypto';
+import {mkdir,open,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {doctor} from '../src/doctor-r45.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const stateRoot=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const insist=(ok,message)=>{if(!ok)throw new Error(message);};
+const [pkg,release,provenance,matrix,active]=await Promise.all([
+  readFile(path.join(root,'package.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'RELEASE.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'PROVENANCE.json'),'utf8').then(JSON.parse),
+  readFile(path.join(root,'TEST-MATRIX.json'),'utf8').then(JSON.parse),
+  readFile(path.join(stateRoot,'active-release.json'),'utf8').then(JSON.parse)
+]);
+const manifestSha256=sha256(await readFile(path.join(root,'MANIFEST.SHA256')));
+
+insist(pkg.version==='0.15.35'&&release.version===pkg.version&&release.train==='R58','R58 candidate identity mismatch');
+insist(provenance.version===pkg.version&&matrix.version===pkg.version&&matrix.train==='R58','R58 release metadata identity mismatch');
+insist(release.parent?.version==='0.15.34','R58 parent version mismatch');
+insist(release.parent?.release_id==='v0.15.34-2199bb59f0e0fc20','R58 parent release mismatch');
+insist(release.parent?.manifest_sha256==='2199bb59f0e0fc205d470d11f990d3ce3df444be5eba2a7d8dbc60d5f5b790bb','R58 parent manifest mismatch');
+insist(release.parent?.generation_manifest_sha256==='1a20a62aaeb324a9b5c03d158952f35092d58fedf2ac7725820ba2b094a4a88f','R58 parent generation mismatch');
+insist(release.parent?.tarball_sha256==='a6f7b21faf34793ca17dfb6d0e9ec03320f1468d011e75d8349098df82fc2639','R58 parent tarball mismatch');
+insist(
+  active.release_id===release.runtime_predecessor.release_id&&
+  active.manifest_sha256===release.runtime_predecessor.manifest_sha256&&
+  active.generation_manifest_sha256===release.runtime_predecessor.generation_manifest_sha256,
+  'active runtime is not exact sealed 0.15.34 predecessor'
+);
+insist(release.consolidation?.bridge_bundled_inside_release===true,'R58 bundled bridge contract missing');
+insist(release.consolidation?.bridge_recursive_local_dependency_binding===true,'R58 recursive bridge dependency contract missing');
+insist(release.consolidation?.performance_acceptance==='PASS_BOUNDED_PREPUBLISH','R58 performance acceptance metadata not green');
+insist(release.consolidation?.cross_plane_acceptance==='PASS','R58 cross-plane acceptance metadata not green');
+insist(release.consolidation?.public_surface_compatibility==='PASS_43_TOOLS_NO_SCHEMA_DRIFT','R58 public surface contract not green');
+insist(matrix.observed_pre_release_evidence?.full_regression?.status==='PASS','R58 fresh full regression evidence not green');
+insist(matrix.observed_pre_release_evidence?.performance?.status==='PASS_BOUNDED_PREPUBLISH','R58 performance evidence not green');
+insist(matrix.observed_pre_release_evidence?.cross_plane?.status==='PASS','R58 cross-plane evidence not green');
+insist(matrix.observed_pre_release_evidence?.public_surface?.status==='PASS','R58 public surface evidence not green');
+insist(provenance.operator_override?.four_hour_soak==='NOT_COMPLETED','R58 must preserve incomplete soak truth');
+insist(provenance.operator_override?.clean_machine==='NOT_COMPLETED','R58 must preserve incomplete clean-machine truth');
+insist(provenance.operator_override?.stable_final_claim===false,'R58 must not claim stable/final before external evidence');
+
+const health=await doctor();
+insist(health.assessment!=='FAIL'&&['ok','warn'].includes(health.status)&&health.package_version===pkg.version&&health.manifest?.verified===true,'R58 doctor evidence invalid');
+
+const evidenceBody={
+ schema:'deadbyte.r58-windows-gate.v1',
+ status:'passed',
+ exit_code:0,
+ version:pkg.version,
+ train:'R58',
+ completed_at_utc:new Date().toISOString(),
+ manifest_sha256:manifestSha256,
+ parent:release.parent,
+ runtime_predecessor:release.runtime_predecessor,
+ consolidation:release.consolidation,
+ operator_override:provenance.operator_override,
+ active_predecessor:{
+   release_id:active.release_id,
+   version:active.version,
+   manifest_sha256:active.manifest_sha256,
+   generation_manifest_sha256:active.generation_manifest_sha256
+ },
+ doctor:{status:health.status,assessment:health.assessment,verified_entries:health.manifest.verified_entries,warnings:health.findings.filter(item=>item.level==='WARN').length},
+ gates:{
+   r58_focused:true,
+   package_boundary:true,
+   process_policy:true,
+   performance_recorded:true,
+   cross_plane_recorded:true,
+   public_surface_recorded:true,
+   full_regression_recorded:true,
+   manifest_final_verify:true,
+   four_hour_soak_completed:false,
+   clean_machine_completed:false
+ }
+};
+const bytes=Buffer.from(JSON.stringify(evidenceBody,null,2)+'\n');
+const dir=path.join(stateRoot,'evidence','release');await mkdir(dir,{recursive:true});
+const target=path.join(dir,`r58-windows-gate-${manifestSha256.slice(0,16)}.json`);
+try{
+ const handle=await open(target,'wx',0o600);
+ try{await handle.writeFile(bytes);await handle.sync();}finally{await handle.close();}
+}catch(error){
+ if(error?.code!=='EEXIST')throw error;
+ const prior=JSON.parse(await readFile(target,'utf8'));
+ insist(prior.schema===evidenceBody.schema&&prior.status==='passed'&&prior.version===evidenceBody.version&&prior.manifest_sha256===manifestSha256,'conflicting R58 gate evidence identity');
+}
+console.log(JSON.stringify({status:'passed',path:target,sha256:sha256(bytes),manifest_sha256:manifestSha256}));

package/src/deadbyte-cli.mjs

@@ -18,6 +18,8 @@ import { prepareRemoteConsole, remoteDisplayText } from './remote-console.mjs';
 import { ensureRuntimeCoherence } from './runtime-coherence.mjs';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
+import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -200,7 +202,7 @@ function controllerRuntimeReady(text){
     /^Loop supervisor:\s*RUNNING\s+\[verified\]\s*$/m.test(value);
 }
 function controllerRuntimeDegraded(text){
-  return /^DEADBYTE MCP\s*=\s*DEGRADED\s*$/m.test(String(text||''));
+  return /^DEADBYTE MCP\s*=\s*(?:DEGRADED|FAILED)\s*$/m.test(String(text||''));
 }
 async function listLogFiles(root){
   const auditDir=path.join(root,'audit');
@@ -352,17 +354,20 @@ function remoteTag(kind,displayMode){
 }
 function writeRemote(stream,text,displayMode){stream.write(remoteDisplayText(text,displayMode));}
 async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
+  const failed=[];
   for(const command of SESSION_CLEANUP){
     try{
-      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false});
-      if(result.status!==0) writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);
+      const result=invokeController(ctx,command,{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+      if(result.status!==0){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command} exit=${result.status}\n`,displayMode);}
     }
-    catch(error){writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
+    catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }
+  if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
 }
 const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
 function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
 function pidAlive(pid){
+  if(!Number.isInteger(pid)||pid<1)return false;
   try{process.kill(pid,0);return true;}
   catch(error){return error?.code!=='ESRCH';}
 }
@@ -376,9 +381,10 @@ async function readRemoteSessionMarker(root){
     return value;
   }
   if(value?.schema==='deadbyte.remote-session.v2'){
+    for(const key of ['owner_identity','guardian_identity'])if(value[key]!==undefined&&!validForegroundIdentity(value[key]))throw new Error('remote session ownership identity invalid');
     if(!Number.isInteger(value?.owner_pid)||value.owner_pid<1||
        !/^[0-9a-f]{64}$/.test(String(value?.session_nonce||''))||
-       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<1||
+       !Number.isInteger(value?.guardian_pid)||value.guardian_pid<0||
        (value.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(String(value.result_session_id)))) throw new Error('remote session marker schema invalid');
     return value;
   }
@@ -388,8 +394,18 @@ async function recoverRemoteSession(ctx,{displayMode='unicode'}={}){
   let prior=await readRemoteSessionMarker(ctx.root);
   if(!prior) return;
   const ownerPid=remoteOwnerPid(prior);
-  if(pidAlive(ownerPid)) throw new Error(`remote session already active pid=${ownerPid}`);
-  if(prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid)){
+  if(pidAlive(ownerPid)){
+    if(!prior.owner_identity)throw new Error(`remote session ownership unverified for legacy pid=${ownerPid}; marker retained`);
+    if(prior.owner_identity.pid!==ownerPid)throw new Error('remote session owner identity PID binding mismatch');
+    if(foregroundIdentityMatches(prior.owner_identity,queryForegroundIdentity(ownerPid)))throw new Error(`remote session already active pid=${ownerPid}`);
+  }
+  let guardianAlive=prior.schema==='deadbyte.remote-session.v2'&&pidAlive(prior.guardian_pid);
+  if(guardianAlive){
+    if(!prior.guardian_identity)throw new Error('remote guardian ownership unverified; marker retained');
+    if(prior.guardian_identity.pid!==prior.guardian_pid)throw new Error('remote guardian identity PID binding mismatch');
+    guardianAlive=foregroundIdentityMatches(prior.guardian_identity,queryForegroundIdentity(prior.guardian_pid));
+  }
+  if(guardianAlive){
     const deadline=Date.now()+3000;
     while(Date.now()<deadline){
       await sleep(100);
@@ -409,18 +425,23 @@ async function claimRemoteSession(ctx){
   const resultSessionId=randomBytes(12).toString('hex');
   const marker={schema:'deadbyte.remote-session.v2',owner_pid:process.pid,guardian_pid:0,session_nonce:nonce,
     result_session_id:resultSessionId,started_at_utc:new Date().toISOString()};
+  marker.owner_identity=queryForegroundIdentity(process.pid);
+  if(!marker.owner_identity)throw new Error('remote foreground identity unavailable');
   const markerPath=remoteSessionMarker(ctx.root);
   try{await writeFile(markerPath,`${JSON.stringify(marker)}\n`,{encoding:'utf8',flag:'wx'});}
   catch(error){if(error?.code==='EEXIST') throw new Error('remote session already claimed');throw error;}
   let guardian=null;
   try{
-    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce],{
-      detached:true,stdio:'ignore',windowsHide:true,shell:false,env:process.env
+    guardian=spawn(process.execPath,[GUARDIAN_SCRIPT,'--state-root',ctx.root,'--owner-pid',String(process.pid),'--session-nonce',nonce,'--owner-channel','ipc'],{
+      detached:true,stdio:['ignore','ignore','ignore','ipc'],windowsHide:true,shell:false,env:process.env
     });
     if(!Number.isInteger(guardian.pid)||guardian.pid<1) throw new Error('remote session guardian did not start');
     marker.guardian_pid=guardian.pid;
+    marker.guardian_identity=queryForegroundIdentity(guardian.pid);
+    if(!marker.guardian_identity||marker.guardian_identity.parent_pid!==process.pid)throw new Error('remote guardian parent identity mismatch');
     await writeFile(markerPath,`${JSON.stringify(marker)}\n`,'utf8');
     guardian.unref();
+    guardian.channel?.unref();
     return marker;
   }catch(error){
     try{guardian?.kill();}catch{}
@@ -439,8 +460,15 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   const ctx=await remoteContext();
   if(displayMode==='ascii') writeRemote(process.stdout,`[DISPLAY] ASCII fallback: ${display.reason}\n`,displayMode);
   if(resumeCursor!==null) await replayRemoteResults(ctx.root,resumeCursor,{displayMode});
-  await recoverRemoteSession(ctx,{displayMode});
-  const marker=await claimRemoteSession(ctx);
+  const startupLock=await acquireForegroundSessionLock({root:ctx.root,powershell:ctx.powershell});
+  let marker;
+  try{
+    startupLock.assertHeld();
+    await recoverRemoteSession(ctx,{displayMode});
+    startupLock.assertHeld();
+    marker=await claimRemoteSession(ctx);
+    startupLock.assertHeld();
+  }finally{await startupLock.release();}
   try{
     await synchronizeForegroundRuntime(ctx,{displayMode});
   }catch(error){
@@ -475,7 +503,7 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
       process.stdout.write('[BOOT] Runtime already ONLINE; reusing verified bridge/cloud/supervisor.\n');
     }else{
       const recovery=preflight.status===0&&controllerRuntimeDegraded(preflight.stdout);
-      process.stdout.write(recovery?'[RECOVERY] Runtime DEGRADED; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
+      process.stdout.write(recovery?'[RECOVERY] Runtime failed readiness; restarting verified owned components...\n':'[BOOT] Starting bridge/runtime...\n');
       const startCommand=recovery?'restart':'start';
       const controllerLogDir=path.join(ctx.root,'runtime','logs');
       await mkdir(controllerLogDir,{recursive:true});

package/src/doctor-foreground-r58.mjs

@@ -0,0 +1,44 @@
+import {lstat,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {resolveStateRoot} from './state-root.mjs';
+import {validForegroundIdentity,foregroundIdentityMatches,queryForegroundIdentity} from './foreground-process-identity.mjs';
+
+export async function inspectDoctorForeground(explicitRoot,{queryIdentity=queryForegroundIdentity}={}){
+ const state=resolveStateRoot(explicitRoot),runtime=path.join(state,'runtime');
+ const markerPath=path.join(runtime,'remote-session.json');
+ const findings=[];
+ const add=(id,level,what,evidence,next_action=null)=>findings.push({id,level,what,evidence,next_action});
+ const inspect='Retain ownership evidence; inspect the foreground session and use supported remote lifecycle commands. Do not kill or re-arm based on PID alone.';
+ let marker;
+ try{
+  for(const dir of [state,runtime]){const info=await lstat(dir);if(!info.isDirectory()||info.isSymbolicLink())throw new Error('unsafe marker parent');}
+  const info=await lstat(markerPath);
+  if(!info.isFile()||info.isSymbolicLink()||info.size>16384)throw new Error('invalid marker file');
+  marker=JSON.parse(await readFile(markerPath,'utf8'));
+ }catch(error){
+  if(error?.code==='ENOENT')add('foreground_marker','PASS','No foreground session marker in this state root.',{present:false});
+  else add('foreground_marker','FAIL','Foreground marker cannot be safely read or parsed.',{check:'regular_bounded_json',error_code:error?.code??'VALIDATION_FAILED'},inspect);
+  return {status:findings[0].level,findings};
+ }
+ if(marker?.schema==='deadbyte.remote-session.v1'&&Number.isSafeInteger(marker.pid)&&marker.pid>0){
+  add('foreground_marker','WARN','Legacy foreground marker has no verified owner/guardian binding.',{schema:marker.schema,pid:marker.pid},inspect);
+  return {status:'WARN',findings};
+ }
+ if(marker?.schema!=='deadbyte.remote-session.v2'||!Number.isSafeInteger(marker.owner_pid)||marker.owner_pid<1||!Number.isSafeInteger(marker.guardian_pid)||marker.guardian_pid<0||typeof marker.session_nonce!=='string'||!/^[0-9a-f]{64}$/.test(marker.session_nonce)||(marker.result_session_id!==undefined&&!/^[0-9a-f]{24}$/.test(marker.result_session_id))){
+  add('foreground_marker','FAIL','Foreground marker schema, nonce or PID fields are invalid.',{check:'foreground_marker_schema'},inspect);
+  return {status:'FAIL',findings};
+ }
+ add('foreground_marker','PASS','Foreground marker fields are valid.',{schema:marker.schema,owner_pid:marker.owner_pid,guardian_pid:marker.guardian_pid});
+ for(const [role,pid,identity]of [['owner',marker.owner_pid,marker.owner_identity],['guardian',marker.guardian_pid,marker.guardian_identity]]){
+  const id='foreground_'+role;
+  if(identity===undefined){add(id,'WARN',`${role} identity is unverified; PID alone is insufficient.`,{pid,binding_present:false},inspect);continue;}
+  if(!validForegroundIdentity(identity)||identity.pid!==pid){add(id,'FAIL',`${role} identity is malformed or disagrees with the marker PID.`,{pid,check:'identity_pid_binding'},inspect);continue;}
+  if(role==='guardian'&&identity.parent_pid!==marker.owner_pid){add(id,'FAIL','Guardian identity does not bind to the declared owner.',{pid,check:'guardian_parent_binding'},inspect);continue;}
+  try{
+   const observed=await queryIdentity(pid);
+   if(foregroundIdentityMatches(identity,observed))add(id,'PASS',`${role} process matches the recorded birth/executable/command identity.`,{pid,creation_utc:identity.creation_utc,identity_verified:true});
+   else add(id,'WARN',`${role} binding is stale; process is absent or its identity changed.`,{pid,observed_present:observed!==null,identity_verified:false},inspect);
+  }catch(error){add(id,'FAIL',`${role} process identity observation failed; liveness is unknown.`,{pid,check:'process_identity',error_code:error?.code??'OBSERVATION_FAILED'},inspect);}
+ }
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
+}

package/src/doctor-installation-r58.mjs

@@ -0,0 +1,63 @@
+import { lstat, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { parseActivePointer, parseManifest, sha256Bytes, verifyManifestTree } from './release-slot.mjs';
+import { verifyGenerationBundle } from './release-generation.mjs';
+import { resolveStateRoot } from './state-root.mjs';
+
+async function regularPath(state, target, directory=false) {
+  const relative=path.relative(state,target);
+  if(!relative||relative.startsWith('..'+path.sep)||relative==='..'||path.isAbsolute(relative))throw new Error('containment');
+  let cursor=state;
+  const parts=relative.split(path.sep);
+  for(let i=-1;i<parts.length;i++){
+    if(i>=0)cursor=path.join(cursor,parts[i]);
+    const info=await lstat(cursor);
+    if(info.isSymbolicLink()||((i<parts.length-1||directory)?!info.isDirectory():!info.isFile()))throw new Error('regular path');
+  }
+}
+
+export async function inspectDoctorInstallation(rawPointer, explicitRoot){
+  const state=resolveStateRoot(explicitRoot);
+  const pointer=parseActivePointer(JSON.stringify(rawPointer));
+  const findings=[];
+  const check=async(id,what,nextAction,operation)=>{
+    try{const evidence=await operation();findings.push({id,level:'PASS',what,evidence,next_action:null});}
+    catch(error){findings.push({id,level:'FAIL',what,evidence:{check:id,error_code:error?.code??'VALIDATION_FAILED'},next_action:nextAction});}
+  };
+  const next='Do not activate or arm authority; inspect the signed update receipt and use supported recovery for this state root.';
+  const expectedRelease=path.join(state,'releases',pointer.release_id);
+  const generation=path.resolve(pointer.generation_root);
+  const expectedGenerationParent=path.join(state,'generations');
+  await check('active_paths','Active release/generation/config paths match the state store.',next,async()=>{
+    if(!path.isAbsolute(pointer.release_root)||path.resolve(pointer.release_root)!==expectedRelease)throw new Error('release path');
+    if(!path.isAbsolute(pointer.generation_root)||path.dirname(generation)!==expectedGenerationParent)throw new Error('generation path');
+    if(!path.isAbsolute(pointer.config_path)||path.resolve(pointer.config_path)!==path.join(generation,'controller-config.psd1'))throw new Error('config path');
+    await regularPath(state,expectedRelease,true);await regularPath(state,generation,true);
+    return {release_id:pointer.release_id,generation_id:path.basename(generation)};
+  });
+  // Never follow unverified pointer paths, even just for diagnostics.
+  if(findings[0].level==='FAIL')return {status:'FAIL',findings};
+  await check('active_release','Installed release bytes match the pointer manifest and package identity.',next,async()=>{
+    const file=path.join(expectedRelease,'MANIFEST.SHA256');await regularPath(state,file);
+    const bytes=await readFile(file);if(sha256Bytes(bytes)!==pointer.manifest_sha256)throw new Error('manifest digest');
+    const manifest=parseManifest(bytes.toString('utf8'));if(!manifest.size||!manifest.has('package.json'))throw new Error('manifest package missing');
+    await verifyManifestTree(expectedRelease,manifest);
+    const pkg=JSON.parse(await readFile(path.join(expectedRelease,'package.json'),'utf8'));
+    if(pkg.name!=='deadbyte-mcp'||pkg.version!==pointer.version)throw new Error('package identity');
+    return {manifest_sha256:pointer.manifest_sha256,verified_files:manifest.size,version:pkg.version};
+  });
+  await check('active_generation','Generation bytes and config are bound to the active pointer.',next,async()=>{
+    await regularPath(state,path.join(generation,'GENERATION.SHA256'));await regularPath(state,pointer.config_path);
+    const bytes=await readFile(path.join(generation,'GENERATION.SHA256'));
+    const entries=parseManifest(bytes.toString('utf8'));
+    if(!entries.has('controller-config.psd1'))throw new Error('unbound config');
+    for(const relative of entries.keys())await regularPath(state,path.resolve(generation,...relative.split('/')));
+    return await verifyGenerationBundle(generation,pointer.generation_manifest_sha256);
+  });
+  await check('active_launcher','Stable launcher bytes match the active pointer.',next,async()=>{
+    const file=path.join(state,'bin','DEADBYTE-MCP.ps1');await regularPath(state,file);
+    const actual=sha256Bytes(await readFile(file));if(actual!==pointer.launcher_sha256)throw new Error('launcher digest');
+    return {sha256:actual};
+  });
+  return {status:findings.some(item=>item.level==='FAIL')?'FAIL':'PASS',findings};
+}

package/src/doctor-r45.mjs

@@ -5,12 +5,22 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { DEADBYTE_VERSION, MCP_PROTOCOL_VERSION } from './version.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+import { inspectDoctorRuntime } from './doctor-runtime-r58.mjs';
+import { inspectDoctorForeground } from './doctor-foreground-r58.mjs';
+import { inspectDoctorTransactions } from './doctor-transactions-r58.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
-const stateRoot=()=>resolveStateRoot();
 const sha256=b=>createHash('sha256').update(b).digest('hex');
 async function jsonOrNull(file){try{return JSON.parse((await readFile(file,'utf8')).replace(/^\uFEFF/,''));}catch(e){if(e?.code==='ENOENT')return null;throw e;}}
 async function fileHash(file){return sha256(await readFile(file));}
+export async function readDoctorActivePointer(explicitRoot){
+ const pointerPath=path.join(resolveStateRoot(explicitRoot),'active-release.json');
+ let text;
+ try {text=await readFile(pointerPath,'utf8');}
+ catch(error){if(error?.code==='ENOENT')return null;throw error;}
+ return parseActivePointer(text.replace(/^\uFEFF/,''));
+}
 function parseManifest(text){
  const rows=[];
  for(const [index,line] of text.split(/\r?\n/).entries()){
@@ -48,11 +58,18 @@ export async function doctor(){
  const hardwareStat=await lstat(hardware);
  if(!hardwareStat.isFile()||hardwareStat.isSymbolicLink()) throw new Error('hardware observer must be a regular file');
  const hardwareSha256=await fileHash(hardware);
- const active=await jsonOrNull(path.join(stateRoot(),'active-release.json'));
+ const active=await readDoctorActivePointer();
+ const installation=active?await inspectDoctorRuntime(active):{status:'PASS',findings:[{id:'active_pointer',level:'PASS',what:'No active installation in this state root.',evidence:{pointer_present:false},next_action:null}]};
+ const foreground=await inspectDoctorForeground();
+ const transactions=await inspectDoctorTransactions();
+ const findings=[...installation.findings,...foreground.findings,...transactions.findings];
+ const assessment=findings.some(item=>item.level==='FAIL')?'FAIL':findings.some(item=>item.level==='WARN')?'WARN':'PASS';
  const hostPolicy=await jsonOrNull(path.join(root,'controller','deadbyte-host-policy.json'));
  if(hostPolicy&&release?.train==='R45'&&process.platform==='win32'&&hostPolicy.schema!=='deadbyte.host-policy.v2') throw new Error('R45 doctor rejects non-v2 generated host policy');
  return {
-  schema:'deadbyte.doctor.v1',status:'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  schema:'deadbyte.doctor.v1',status:assessment==='FAIL'?'fail':assessment==='WARN'?'warn':'ok',package_version:DEADBYTE_VERSION,protocol_revision:MCP_PROTOCOL_VERSION,
+  assessment,findings,
+  runtime_availability:installation.availability??null,
   platform:{current:process.platform,architecture:process.arch,primary:'win32',supported:process.platform==='win32'},
   manifest:{sha256:manifestSha256,entries:rows.length,verified_entries:verified,verified:true},
   release_metadata:metadata,
@@ -63,4 +80,4 @@ export async function doctor(){
   known_unsupported:process.platform==='win32'?[]:['native_hardware_observation','windows_controller','desktop_native']
  };
 }
-export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');return value;}
+export async function printDoctor(){const value=await doctor();process.stdout.write(JSON.stringify(value,null,2)+'\n');if(value.assessment==='FAIL')process.exitCode=1;return value;}

package/src/doctor-runtime-r58.mjs

@@ -0,0 +1,82 @@
+import {readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {resolveStateRoot} from './state-root.mjs';
+import {inspectDoctorInstallation} from './doctor-installation-r58.mjs';
+import {parseActivePointer,parseManifest,sha256Bytes} from './release-slot.mjs';
+import {windowsPowerShellEnvironment} from './runtime-update.mjs';
+
+function object(value,keys){
+ if(!value||typeof value!=='object'||Array.isArray(value)||Object.keys(value).length!==keys.length||keys.some(k=>!Object.hasOwn(value,k)))throw new Error('controller observation fields invalid');
+}
+const reason=value=>typeof value==='string'&&/^[a-z][a-z0-9-]{0,63}$/.test(value);
+const date=value=>typeof value==='string'&&/^\d{4}-\d\d-\d\dT.*Z$/.test(value)&&Number.isFinite(Date.parse(value));
+const pid=value=>Number.isSafeInteger(value)&&value>0;
+export function validateDoctorControllerObservation(value,expectedCoreRoot){
+ object(value,['schema','observed_at_utc','state','core_root','local_ready','bridge','core','cloud','supervisor','authority']);
+ if(value.schema!=='deadbyte.controller-observation.v1'||!date(value.observed_at_utc)||!['OFFLINE','PARKED','ONLINE','STARTING','FAILED','DEGRADED'].includes(value.state)||typeof value.local_ready!=='boolean'||typeof value.core_root!=='string'||!path.isAbsolute(value.core_root)||path.resolve(value.core_root)!==path.resolve(expectedCoreRoot))throw new Error('controller observation identity invalid');
+ for(const key of ['bridge','cloud']){
+  const item=value[key];object(item,['alive','reason','pid','creation_time_utc']);
+  if(typeof item.alive!=='boolean'||!reason(item.reason)||(item.alive?(!pid(item.pid)||!date(item.creation_time_utc)||item.reason!=='verified'):(item.pid!==null||item.creation_time_utc!==null)))throw new Error('controller component observation invalid');
+ }
+ const core=value.core;object(core,['alive','reason','pid','parent_pid','creation_time_utc','identity_basis']);
+ if(typeof core.alive!=='boolean'||!reason(core.reason))throw new Error('core observation invalid');
+ if(core.alive){
+  if(!value.bridge.alive||!pid(core.pid)||core.parent_pid!==value.bridge.pid||!date(core.creation_time_utc)||core.reason!=='verified'||!['command-line','verified-bridge-single-opaque-node-child'].includes(core.identity_basis))throw new Error('core topology binding invalid');
+ }else if(core.pid!==null||core.parent_pid!==null||core.creation_time_utc!==null||core.identity_basis!==null)throw new Error('failed core observation carries live identity');
+ object(value.supervisor,['configured','running','reason']);
+ if(typeof value.supervisor.configured!=='boolean'||typeof value.supervisor.running!=='boolean'||!reason(value.supervisor.reason)||(!value.supervisor.configured&&value.supervisor.running))throw new Error('supervisor observation invalid');
+ object(value.authority,['process','coding','autonomous','desktop','host']);
+ for(const item of Object.values(value.authority)){
+  object(item,['configured','armed','reason']);
+  if(typeof item.configured!=='boolean'||typeof item.armed!=='boolean'||!reason(item.reason)||(!item.configured&&item.armed)||(item.armed&&item.reason!=='standing-grant'))throw new Error('authority observation invalid');
+ }
+ return value;
+}
+
+export function classifyDoctorControllerObservation(raw,expectedCoreRoot){
+ const value=validateDoctorControllerObservation(raw,expectedCoreRoot),findings=[];
+ const add=(id,level,what,evidence,next_action=null)=>findings.push({id,level,what,evidence,next_action});
+ const inspect='Retain evidence and inspect exact controller/config/runtime bindings; use supported lifecycle recovery only after reconciling ownership.';
+ for(const name of ['bridge','cloud']){
+  const component=value[name];
+  const level=component.alive||component.reason==='no-ledger'?'PASS':component.reason==='process-missing'?'WARN':'FAIL';
+  add('runtime_'+name,level,`${name} ownership observation: ${component.reason}.`,{alive:component.alive,pid:component.pid,reason:component.reason},level==='PASS'?null:inspect);
+ }
+ const core=value.core;
+ const coreLevel=core.alive||(!value.bridge.alive&&core.reason==='bridge-unavailable')?'PASS':core.reason==='startup-zero-child'?'WARN':'FAIL';
+ add('runtime_core',coreLevel,`Downstream core observation: ${core.reason}.`,{alive:core.alive,pid:core.pid,parent_pid:core.parent_pid,identity_basis:core.identity_basis},coreLevel==='PASS'?null:inspect);
+ const localHealthy=value.bridge.alive&&core.alive&&value.local_ready;
+ const state=localHealthy&&value.cloud.alive?'ONLINE':!value.bridge.alive&&!value.cloud.alive?'OFFLINE':!value.bridge.alive&&value.cloud.alive?'PARKED':core.reason==='startup-zero-child'?'STARTING':'FAILED';
+ const contradiction=value.state==='ONLINE'&&state!=='ONLINE';
+ const availabilityLevel=contradiction?(state==='STARTING'?'WARN':'FAIL'):state==='ONLINE'||state==='OFFLINE'?'PASS':'WARN';
+ add('runtime_availability',availabilityLevel,`Observed availability is ${state}; local and remote availability are separate.`,{state,controller_state:value.state,local_healthy:localHealthy,remote_connected:value.cloud.alive,local_ready:value.local_ready},availabilityLevel==='PASS'?null:inspect);
+ if(value.supervisor.configured&&!value.supervisor.running)add('runtime_supervisor','WARN','Configured supervisor is not verified running.',{reason:value.supervisor.reason},inspect);
+ else add('runtime_supervisor','PASS','Supervisor observation is consistent.',{configured:value.supervisor.configured,running:value.supervisor.running});
+ for(const [plane,authority]of Object.entries(value.authority)){
+  const valid=authority.armed||['no-policy','disabled','disarmed','coding-disarmed'].includes(authority.reason);
+  const level=!valid?'FAIL':authority.armed&&(['host','desktop'].includes(plane)||state==='OFFLINE')?'WARN':'PASS';
+  add('authority_'+plane,level,`${plane} authority observation: ${authority.armed?'ARMED':'DISARMED'} (${authority.reason}).`,{configured:authority.configured,armed:authority.armed,reason:authority.reason},level==='PASS'?null:'Inspect the pinned policy/grant and revoke through the supported launcher if unintended; doctor never changes authority.');
+ }
+ if(value.authority.autonomous.armed&&!value.authority.coding.armed)add('authority_dependency','FAIL','Autonomous is armed while coding is not.',{autonomous_armed:true,coding_armed:false},inspect);
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings,availability:{state,local_healthy:localHealthy,remote_connected:value.cloud.alive}};
+}
+
+export async function inspectDoctorRuntime(rawPointer,explicitRoot){
+ const pointer=parseActivePointer(JSON.stringify(rawPointer)),state=resolveStateRoot(explicitRoot);
+ const installation=await inspectDoctorInstallation(pointer,state);
+ if(installation.status==='FAIL')return installation;
+ const controller=path.join(pointer.release_root,'controller','deadbyte-controller.ps1');
+ const sourceBytes=await readFile(controller),manifestBytes=await readFile(path.join(pointer.release_root,'MANIFEST.SHA256'));
+ if(sha256Bytes(manifestBytes)!==pointer.manifest_sha256||parseManifest(manifestBytes.toString('utf8')).get('controller/deadbyte-controller.ps1')!==sha256Bytes(sourceBytes))throw new Error('doctor controller is not manifest-bound');
+ const source=sourceBytes.toString('utf8');
+ if(!source.includes('[switch]$Json'))return {status:'WARN',findings:[...installation.findings,{id:'runtime_observation',level:'WARN',what:'Installed predecessor does not support read-only structured observation.',evidence:{release_id:pointer.release_id,structured_observation_supported:false},next_action:'Use the accepted predecessor evidence and supported status command; do not bypass controller root binding or rewrite the sealed parent.'}]};
+ const nativeRoot=process.env.SystemRoot||process.env.WINDIR;
+ const result=spawnSync(path.join(nativeRoot,'System32/WindowsPowerShell/v1.0/powershell.exe'),['-NoLogo','-NoProfile','-File',controller,'status','-Json'],{cwd:pointer.release_root,encoding:'utf8',windowsHide:true,timeout:20000,maxBuffer:262144,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:state,DEADBYTE_CONTROLLER_CONFIG:pointer.config_path,DEADBYTE_CONTROLLER_RUNTIME_ROOT:path.join(state,'runtime')})});
+ let runtime;
+ try{
+  if(result.error||result.status!==0)throw new Error('controller observation failed');
+  runtime=classifyDoctorControllerObservation(JSON.parse(result.stdout),pointer.release_root);
+ }catch{runtime={status:'FAIL',findings:[{id:'runtime_observation',level:'FAIL',what:'Read-only controller observation failed or its structured contract/binding is invalid.',evidence:{exit_code:result.status??null,error_code:result.error?.code??'OBSERVATION_FAILED'},next_action:'Inspect the exact release/generation and supported controller status; do not auto-repair or retry effects.'}]};}
+ return {...runtime,findings:[...installation.findings,...runtime.findings]};
+}

package/src/doctor-transactions-r58.mjs

@@ -0,0 +1,40 @@
+import {lstat,opendir,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {resolveStateRoot} from './state-root.mjs';
+
+export async function inspectDoctorTransactions(explicitRoot,{maxEntries=256}={}){
+ if(!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>256)throw new Error('doctor transaction budget invalid');
+ const state=resolveStateRoot(explicitRoot),root=path.join(state,'evidence','updates'),findings=[];
+ const next='Retain transaction evidence; inspect the exact signed receipt/handoff and current pointer before any supported recovery. Doctor never launches recovery.';
+ const add=(level,what,evidence)=>findings.push({id:'transaction_residue',level,what,evidence,next_action:level==='PASS'?null:next});
+ let directory;
+ try{
+  for(const dir of [state,path.join(state,'evidence'),root]){const st=await lstat(dir);if(!st.isDirectory()||st.isSymbolicLink())throw new Error('unsafe evidence parent');}
+  directory=await opendir(root);
+ }catch(error){
+  if(error?.code==='ENOENT')add('PASS','No update evidence directory in this state root.',{present:false,states_checked:0});
+  else add('FAIL','Update evidence directory cannot be safely inspected.',{error_code:error?.code??'VALIDATION_FAILED'});
+  return {status:findings[0].level,findings};
+ }
+ let entries=0,checked=0,terminal=0;
+ try{
+  for await(const entry of directory){
+   if(++entries>maxEntries){add('WARN','Transaction inventory budget reached; unobserved entries remain.',{max_entries:maxEntries,states_checked:checked,inventory_complete:false});break;}
+   if(entry.isSymbolicLink()){add('FAIL','Transaction evidence contains a link; it was not followed.',{entry_name_sha256:createHash('sha256').update(entry.name).digest('hex')});continue;}
+   if(!entry.isDirectory())continue;
+   const file=path.join(root,entry.name,'state.json');let bytes;
+   try{
+    const info=await lstat(file);if(!info.isFile()||info.isSymbolicLink()||info.size>1048576)throw new Error('unsafe transaction state');
+    bytes=await readFile(file);if(bytes.length>1048576)throw new Error('transaction state budget');
+    const body=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));checked++;
+    const digest=createHash('sha256').update(bytes).digest('hex');
+    if(!['deadbyte.r27-slot-update-state.v1','deadbyte.r31-slot-rollback-state.v1'].includes(body?.schema)||typeof body.phase!=='string'||!/^[a-z_]{1,64}$/.test(body.phase)){add('FAIL','Transaction state schema or phase is invalid.',{state_sha256:digest,check:'transaction_schema'});continue;}
+    if(['completed','superseded','failed_receipted'].includes(body.phase)){terminal++;continue;}
+    add('WARN','Nonterminal or unresolved transaction record remains; liveness/outcome is not inferred from its age or PID.',{state_sha256:digest,schema:body.schema,recorded_phase:body.phase});
+   }catch(error){if(error?.code==='ENOENT')continue;add('FAIL','Transaction state cannot be safely parsed or inspected.',{error_code:error?.code??'VALIDATION_FAILED'});}
+  }
+ }catch(error){add('FAIL','Transaction inventory observation failed.',{error_code:error?.code??'OBSERVATION_FAILED'});}
+ add('PASS','Recorded terminal transaction phases counted; signatures and desired outcomes are not established by this inventory.',{states_checked:checked,recorded_terminal_states:terminal,receipt_verification_performed:false});
+ return {status:findings.some(f=>f.level==='FAIL')?'FAIL':findings.some(f=>f.level==='WARN')?'WARN':'PASS',findings};
+}

package/src/foreground-process-identity.mjs

@@ -0,0 +1,27 @@
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {windowsPowerShellEnvironment} from './runtime-update.mjs';
+
+export function validForegroundIdentity(value){
+ return value?.schema==='deadbyte.foreground-process.v1'&&Number.isSafeInteger(value.pid)&&value.pid>0&&Number.isSafeInteger(value.parent_pid)&&value.parent_pid>=0&&typeof value.creation_utc==='string'&&/^\d{4}-\d\d-\d\dT.*Z$/.test(value.creation_utc)&&Number.isFinite(Date.parse(value.creation_utc))&&typeof value.executable_path==='string'&&path.isAbsolute(value.executable_path)&&/^[0-9a-f]{64}$/.test(value.command_line_sha256??'');
+}
+export function foregroundIdentityMatches(expected,observed){
+ if(!validForegroundIdentity(expected))throw new Error('foreground ownership identity unverified');
+ if(observed===null)return false;
+ if(!validForegroundIdentity(observed))throw new Error('observed foreground identity incomplete');
+ return expected.pid===observed.pid&&expected.parent_pid===observed.parent_pid&&expected.creation_utc===observed.creation_utc&&path.resolve(expected.executable_path).toLowerCase()===path.resolve(observed.executable_path).toLowerCase()&&expected.command_line_sha256===observed.command_line_sha256;
+}
+export function queryForegroundIdentity(pid){
+ if(process.platform!=='win32'||!Number.isSafeInteger(pid)||pid<1)throw new Error('foreground identity requires a positive Windows PID');
+ const root=process.env.SystemRoot||process.env.WINDIR;if(!root)throw new Error('Windows system root missing');
+ const command=`$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}'; if ($null -eq $p) {Write-Output 'null';exit 0}; [pscustomobject]@{pid=$p.ProcessId;parent_pid=$p.ParentProcessId;creation_utc=$p.CreationDate.ToUniversalTime().ToString('o');executable_path=$p.ExecutablePath;command_line=$p.CommandLine} | ConvertTo-Json -Compress`;
+ const result=spawnSync(path.join(root,'System32/WindowsPowerShell/v1.0/powershell.exe'),['-NoLogo','-NoProfile','-Command',command],{encoding:'utf8',windowsHide:true,env:windowsPowerShellEnvironment(process.env),timeout:15000,maxBuffer:1024*1024});
+ if(result.error||result.status!==0)throw new Error('foreground process identity query failed');
+ let raw;try{raw=JSON.parse(result.stdout);}catch{throw new Error('foreground process identity query malformed');}
+ if(raw===null)return null;
+ if(typeof raw.command_line!=='string'||!raw.command_line)throw new Error('foreground process command identity unavailable');
+ const identity={schema:'deadbyte.foreground-process.v1',pid:raw.pid,parent_pid:raw.parent_pid,creation_utc:raw.creation_utc,executable_path:raw.executable_path,command_line_sha256:createHash('sha256').update(raw.command_line).digest('hex')};
+ if(!validForegroundIdentity(identity)||identity.pid!==pid)throw new Error('foreground process identity incomplete');
+ return identity;
+}

package/src/foreground-session-lock.mjs

@@ -0,0 +1,20 @@
+import {spawn} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {windowsPowerShellEnvironment} from './runtime-update.mjs';
+
+export async function acquireForegroundSessionLock({root,powershell}){
+ const hash=createHash('sha256').update(path.resolve(root).toLowerCase()).digest('hex');
+ const child=spawn(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',fileURLToPath(new URL('./foreground-session-lock.ps1',import.meta.url)),'-LockName',`Local\\DEADBYTE-foreground-${hash}`],{windowsHide:true,stdio:['pipe','pipe','pipe'],env:windowsPowerShellEnvironment(process.env)});
+ let text='',errorText='';child.stderr.on('data',b=>{errorText=(errorText+b).slice(-2048);});
+ let settled=false;
+ const exited=new Promise(resolve=>{child.once('exit',(code,signal)=>resolve({code,signal}));child.once('error',error=>resolve({error}));});
+ const ready=new Promise((resolve,reject)=>{
+  const timer=setTimeout(()=>{if(!settled){settled=true;child.kill();reject(new Error('foreground session lock acquisition timed out'));}},15000);
+  child.stdout.on('data',b=>{text+=b.toString();if(!settled&&text.includes('DEADBYTE_FOREGROUND_LOCK_READY')){settled=true;clearTimeout(timer);resolve();}});
+  exited.then(result=>{if(!settled){settled=true;clearTimeout(timer);reject(new Error(result.code===73?'remote session already claimed (startup/recovery lock)':`foreground session lock failed: ${errorText||result.error?.message||result.code}`));}});
+ });
+ try{await ready;}catch(error){child.stdin.end();await exited;throw error;}
+ return {assertHeld(){if(child.exitCode!==null||child.signalCode!==null)throw new Error('foreground session lock ownership lost');},async release(){child.stdin.end();const result=await exited;if(result.code!==0)throw new Error('foreground session lock release failed');}};
+}

package/src/foreground-session-lock.ps1

@@ -0,0 +1,15 @@
+param([Parameter(Mandatory=$true)][ValidatePattern('^Local\\DEADBYTE-foreground-[0-9a-f]{64}$')][string]$LockName)
+$ErrorActionPreference='Stop'
+$mutex=New-Object System.Threading.Mutex($false,$LockName)
+$owned=$false
+try {
+    try { $owned=$mutex.WaitOne(0) } catch [System.Threading.AbandonedMutexException] { $owned=$true }
+    if(-not $owned){exit 73}
+    [Console]::Out.WriteLine('DEADBYTE_FOREGROUND_LOCK_READY')
+    [Console]::Out.Flush()
+    # Owner death closes the inherited stdin pipe. No persisted PID lockfile.
+    [void][Console]::In.ReadLine()
+} finally {
+    if($owned){$mutex.ReleaseMutex()}
+    $mutex.Dispose()
+}

package/src/release-generation.mjs

@@ -200,6 +200,7 @@ function renderControllerConfig({currentConfig,coreRoot,workspaceRoot,processPol
     `        WorkingDirectory = ${psQuote(bridge.WorkingDirectory)}`,
     `        ScriptPath = ${psQuote(bridge.ScriptPath)}`,
     `        ScriptSha256 = ${psQuote(bridge.ScriptSha256)}`,
+    ...renderPsDependencies(bridge.Dependencies),
     '    }','    Cloud = @{',
     `        FilePath = ${psQuote(cloud.FilePath)}`,
     `        FileSha256 = ${psQuote(cloud.FileSha256)}`,

package/src/release-slot.mjs

@@ -289,7 +289,8 @@ export function renderStableLauncherPs1(){
     '$env:DEADBYTE_STATE_ROOT = $StateRoot',
     '$env:DEADBYTE_CONTROLLER_CONFIG = $configPath',
     "$env:DEADBYTE_CONTROLLER_RUNTIME_ROOT = Join-Path $StateRoot 'runtime'",
-    "$powershell = Join-Path $PSHOME 'powershell.exe'",
+    "$powershell = Join-Path ([Environment]::GetFolderPath('Windows')) 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'",
+    "if (-not (Test-Path -LiteralPath $powershell -PathType Leaf)) { Fail 'native Windows PowerShell missing' }",
     '& $powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -File $controller @ControllerArgs',
     '$exitCode = (Get-Variable -Name LASTEXITCODE -ValueOnly -ErrorAction SilentlyContinue)',
     'if ($null -eq $exitCode) { $exitCode = 0 }',