deadbyte-mcp 0.15.36 → 0.15.37

package/src/deadbyte-cli.mjs

@@ -20,6 +20,8 @@ import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import {foregroundIdentityMatches,queryForegroundIdentity,validForegroundIdentity} from './foreground-process-identity.mjs';
 import {acquireForegroundSessionLock} from './foreground-session-lock.mjs';
+import { AUTHORITY_PLANES, authorityVector, parseAuthorityObservation, assertAuthorityVector, assertRuntimeReadyObservation, authorityBanner } from './remote-authority.mjs';
+import { decodeRemoteLogBytes, boundedRemoteDiagnostic, safeRemoteLogPrefixLength } from './remote-log-decode-r60.mjs';
 
 const REMOTE_COMMANDS=new Set([
   'menu','start','resume','park','stop','restart','status','url','test','fulltest','toggle','clean','machinetest',
@@ -27,17 +29,9 @@ const REMOTE_COMMANDS=new Set([
   'armdesktop','disarmdesktop','desktopstatus',
   'armcoding','disarmcoding','codingstatus','codingtest','armautonomous','disarmautonomous','autonomousstatus','autonomoustest'
 ]);
-const SESSION_ARM=['armprocess','armcoding','armautonomous'];
 const REMOTE_STATUS_TIMEOUT_MS=30000;
 const REMOTE_START_TIMEOUT_MS=150000;
-const SESSION_STATUS=[
-  ['processstatus',/^Process plane\s*:\s*ARMED\b/m],
-  ['codingstatus',/^Coding plane\s*:\s*ARMED\b/m],
-  ['autonomousstatus',/^Autonomous\s*:\s*ARMED\b/m],
-  ['desktopstatus',/^Desktop plane\s*:\s*DISARMED\b/m],
-  ['hoststatus',/^Host plane\s*:\s*DISARMED\b/m]
-];
-const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost','park'];
+const SESSION_CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
 const SUPERVISOR_COMMANDS=Object.freeze({
   start:'supervisorstart',stop:'supervisorstop',status:'supervisorstatus',recover:'supervisorrecover'
 });
@@ -55,6 +49,9 @@ function printHelp(){
     `  npx -y ${exact} doctor              # verify current package/release truth`,
     `  npx -y ${exact} mcp                 # stdio MCP server for local clients`,
     `  npx -y ${exact} remote              # unified foreground device session + live timeline`,
+    `  npx -y ${exact} remote --desktop    # session with Desktop authority; Host remains disarmed`,
+    `  npx -y ${exact} remote --host       # session with Host authority; Desktop remains disarmed`,
+    `  npx -y ${exact} remote --full       # explicit five-plane foreground session`,
     `  npx -y ${exact} remote --resume <cursor> # replay missed results, then reconnect`,
     `  npx -y ${exact} remote --trace           # show trace/span identity without payload detail`,
     `  npx -y ${exact} remote --filter <expr>   # presentation filter: tool/category/status/trace`,
@@ -75,8 +72,7 @@ async function remoteContext(){
   return {root,launcher,powershell};
 }
 function boundedSingleLine(value,maxChars=2048){
-  const line=String(value??'').replace(/[\r\n\t]+/g,' ').replace(/\s{2,}/g,' ').trim();
-  return line.length<=maxChars?line:`${line.slice(0,maxChars)}...`;
+  return boundedRemoteDiagnostic(value,maxChars);
 }
 async function readActiveRuntimeBinding(root){
   const file=path.join(root,'active-release.json');
@@ -158,11 +154,16 @@ async function readTailBounded(file,maxBytes=4096){
     if(length===0) return '';
     const buffer=Buffer.alloc(length);
     const handle=await open(file,'r');
-    try{await handle.read(buffer,0,length,info.size-length);}finally{await handle.close();}
-    return boundedSingleLine(buffer.toString('utf8'),maxBytes);
+    let encoding=null;
+    try{
+      const header=Buffer.alloc(2);await handle.read(header,0,2,0);
+      if(header[0]===0xff&&header[1]===0xfe)encoding='utf16le';
+      await handle.read(buffer,0,length,info.size-length);
+    }finally{await handle.close();}
+    return boundedSingleLine(decodeRemoteLogBytes(file,buffer,{encoding}),maxBytes);
   }catch(error){if(error?.code==='ENOENT') return '';throw error;}
 }
-function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null}={}){
+function invokeController(ctx,command,{capture=false,allowFailure=false,echoCaptured=true,timeoutMs=null,discardOutput=false,redirectOutput=null,json=false,probeMode=null}={}){
   if(capture&&discardOutput) throw new Error('invokeController cannot capture and discard output together');
   if(capture&&redirectOutput) throw new Error('invokeController cannot capture and redirect output together');
   if(discardOutput&&redirectOutput) throw new Error('invokeController cannot discard and redirect output together');
@@ -175,9 +176,10 @@ function invokeController(ctx,command,{capture=false,allowFailure=false,echoCapt
       stderrFd=openSync(redirectOutput.stderr_path,'w');
       stdio=['ignore',stdoutFd,stderrFd];
     }else stdio=capture?['ignore','pipe','pipe']:'inherit';
-    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,env:windowsPowerShellEnvironment()};
+    const options={stdio,encoding:capture?'utf8':undefined,windowsHide:false,shell:false,
+      env:windowsPowerShellEnvironment(probeMode?{...process.env,DEADBYTE_REMOTE_PROBE_MODE:probeMode}:process.env)};
     if(Number.isInteger(timeoutMs)&&timeoutMs>0) options.timeout=timeoutMs;
-    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command],options);
+    result=spawnSync(ctx.powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',ctx.launcher,command,...(json?['-Json']:[])],options);
   }finally{
     if(stdoutFd!==null) closeSync(stdoutFd);
     if(stderrFd!==null) closeSync(stderrFd);
@@ -193,6 +195,10 @@ function invokeController(ctx,command,{capture=false,allowFailure=false,echoCapt
   if(status!==0&&!allowFailure) throw new Error(`remote controller '${command}' failed exit=${status}`);
   return {status,stdout,stderr};
 }
+function observedAuthority(ctx){
+  const result=invokeController(ctx,'status',{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS,json:true});
+  return parseAuthorityObservation(result.stdout);
+}
 function controllerRuntimeReady(text){
   const value=String(text||'');
   return /^DEADBYTE MCP\s*=\s*ONLINE\s*$/m.test(value)&&
@@ -278,13 +284,23 @@ async function replayRemoteResults(root,cursor,{displayMode='unicode'}={}){
 async function readAppend(file,offset){
   let info;try{info=await stat(file);}catch(error){if(error?.code==='ENOENT') return {offset:0,text:''};throw error;}
   let start=offset;
-  if(info.size<start) start=0;
+  const reset=info.size<start;
+  if(reset) start=0;
   if(info.size===start) return {offset:start,text:''};
-  const length=info.size-start;
-  const buffer=Buffer.alloc(length);
   const handle=await open(file,'r');
-  try{await handle.read(buffer,0,length,start);}finally{await handle.close();}
-  return {offset:info.size,text:buffer.toString('utf8')};
+  let encoding=null,buffer,bytesRead=0;
+  try{
+    const header=Buffer.alloc(2);await handle.read(header,0,2,0);
+    if(header[0]===0xff&&header[1]===0xfe&&/\.log$/i.test(file)){
+      encoding='utf16le';if(start%2!==0)start=Math.max(0,start-1);
+    }
+    const length=Math.min(1024*1024,info.size-start);
+    if(length===0)return {offset:start,text:''};
+    buffer=Buffer.alloc(length);
+    ({bytesRead}=await handle.read(buffer,0,length,start));
+  }finally{await handle.close();}
+  const complete=safeRemoteLogPrefixLength(buffer.subarray(0,bytesRead),encoding??'utf8');
+  return {offset:start+complete,text:decodeRemoteLogBytes(file,buffer.subarray(0,complete),{encoding}),reset};
 }
 async function snapshotRemoteLogOffsets(root){
   const offsets=new Map();
@@ -314,6 +330,7 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
     ? '[LOG] Verbose live timeline. Full sanitized request detail enabled; Ctrl+C disconnects and revokes authority.\n'
     : '[LOG] Human live timeline. Transport IN/OUT hidden; full replay/audit detail remains on disk. Ctrl+C disconnects and revokes authority.\n');
   const activeOffsets=offsets??await snapshotRemoteLogOffsets(root);
+  const partialLines=new Map();
   let liveFiles=[...activeOffsets.keys()];
   let nextDiscoveryAt=0;
   while(!signal.aborted){
@@ -326,7 +343,13 @@ async function tailRemoteLogs(root,signal,{journal=null,offsets=null,activityTra
       const prior=activeOffsets.has(file)?activeOffsets.get(file):0;
       const next=await readAppend(file,prior);
       activeOffsets.set(file,next.offset);
-      for(const line of next.text.split(/\r?\n/)){
+      if(next.reset)partialLines.delete(file);
+      if(!next.text)continue;
+      const lines=((partialLines.get(file)??'')+next.text).split(/\r?\n/);
+      partialLines.set(file,lines.pop()??'');
+      if(Buffer.byteLength(partialLines.get(file),'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
+      for(const line of lines){
+        if(Buffer.byteLength(line,'utf8')>1024*1024) throw new Error(`remote log line exceeds bounded decode limit: ${path.basename(file)}`);
         const auditEvent=parseAuditLogLine(file,line);
         const timeline=auditTimelineRecord(file,line,auditEvent);
         let recorded=null;
@@ -363,6 +386,15 @@ async function cleanupRemoteSession(ctx,{displayMode='unicode'}={}){
     catch(error){failed.push(command);writeRemote(process.stderr,`${remoteTag('warn',displayMode)} cleanup ${command}: ${String(error?.message||error)}\n`,displayMode);}
   }
   if(failed.length) throw new Error(`remote session cleanup failed; ownership marker retained: ${failed.join(',')}`);
+  let snapshot;
+  try{snapshot=assertAuthorityVector(observedAuthority(ctx),Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,false])));}
+  catch(error){throw new Error(`remote session cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  if(snapshot.state==='ONLINE'){
+    try{invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:'revoked'});}
+    catch(error){throw new Error(`remote session enforcement cleanup verification failed; ownership marker retained: ${String(error?.message||error)}`);}
+  }
+  const parked=invokeController(ctx,'park',{allowFailure:true,capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+  if(parked.status!==0) throw new Error(`remote session park failed exit=${parked.status}; ownership marker retained`);
 }
 const GUARDIAN_SCRIPT=fileURLToPath(new URL('./remote-session-guardian.mjs',import.meta.url));
 function remoteSessionMarker(root){return path.join(root,'runtime','remote-session.json');}
@@ -454,7 +486,7 @@ async function releaseRemoteSession(ctx,marker,{displayMode='unicode'}={}){
   const same=current?.schema==='deadbyte.remote-session.v2'&&current.owner_pid===marker.owner_pid&&current.session_nonce===marker.session_nonce;
   if(same) await rm(remoteSessionMarker(ctx.root),{force:true});
 }
-async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression=''}={}){
+async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,filterExpression='',mode='default'}={}){
   const display=prepareRemoteConsole();
   const displayMode=display.mode;
   const ctx=await remoteContext();
@@ -524,21 +556,31 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
     }
     process.stdout.write(`${formatRemoteLifecycle('bridge_connected',{displayMode})}\n`);
     process.stdout.write(`${formatRemoteLifecycle('cloud_connected',{displayMode})}\n`);
-    for(const command of SESSION_ARM){
+    const desired=authorityVector(mode);
+    const priorAuthority=observedAuthority(ctx);
+    for(const plane of AUTHORITY_PLANES.filter(name=>!desired[name]&&priorAuthority.authority[name].armed)){
+      const command=`disarm${plane}`;
+      writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Revoking unwanted ${plane} authority...\n`,displayMode);
+      invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
+    }
+    for(const plane of AUTHORITY_PLANES.filter(name=>desired[name])){
+      const command=`arm${plane}`;
       writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Arming ${command.slice(3)}...\n`,displayMode);
       invokeController(ctx,command,{capture:true,echoCaptured:false,timeoutMs:REMOTE_STATUS_TIMEOUT_MS});
     }
     const url=startText.match(/^URL\s*:\s*(\S+)/m)?.[1]||'';
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying exact ${mode} authority vector...\n`,displayMode);
+    const current=await readActiveRuntimeBinding(ctx.root);
+    const authority=assertAuthorityVector(assertRuntimeReadyObservation(observedAuthority(ctx),{
+      coreRoot:current?.release_root??null
+    }),desired);
+    process.stdout.write('[BOOT] Verifying public signed MCP execution path...\n');
+    invokeController(ctx,'machinetest',{capture:true,echoCaptured:false,timeoutMs:REMOTE_START_TIMEOUT_MS,probeMode:mode});
+    ready=true;
+    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ${authorityBanner(authority)}\n`,displayMode);
     process.stdout.write('[OK] ONLINE\n');
     process.stdout.write(`${formatRemoteLifecycle('ready',{displayMode})}\n`);
     if(url) writeRemote(process.stdout,`URL: ${url}\n`,displayMode);
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} Verifying process, coding, autonomous; desktop + host must stay DISARMED...\n`,displayMode);
-    for(const [command,pattern] of SESSION_STATUS){
-      const result=invokeController(ctx,command,{capture:true,echoCaptured:false});
-      if(!pattern.test(result.stdout)) throw new Error(`remote session authority verification failed: ${command} state mismatch`);
-    }
-    ready=true;
-    writeRemote(process.stdout,`${remoteTag('auth',displayMode)} ARMED: process, coding, autonomous | desktop, host DISARMED\n`,displayMode);
     await logTask;
   }finally{
     const wasAborted=aborter.signal.aborted;
@@ -556,12 +598,16 @@ async function runRemoteSession({resumeCursor=null,verbose=false,trace=false,fil
   }
 }
 async function runRemote(args){
-  let verbose=false,trace=false,filterExpression='',resumeCursor=null;
+  let verbose=false,trace=false,filterExpression='',resumeCursor=null,mode='default';
   const positional=[];
   for(let index=0;index<args.length;index++){
     const arg=args[index];
     if(arg==='--verbose'||arg==='-v'){verbose=true;continue;}
     if(arg==='--trace'){trace=true;continue;}
+    if(['--desktop','--host','--full'].includes(arg)){
+      if(mode!=='default') throw new Error('remote authority modes are mutually exclusive');
+      mode=arg.slice(2);continue;
+    }
     if(arg==='--filter'){
       if(filterExpression) throw new Error('remote --filter may be specified once');
       if(index+1>=args.length) throw new Error('remote --filter requires an expression');
@@ -574,8 +620,8 @@ async function runRemote(args){
     }
     positional.push(arg);
   }
-  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null;
-  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression});return;}
+  const presentation=verbose||trace||Boolean(filterExpression)||resumeCursor!==null||mode!=='default';
+  if(positional.length===0){await runRemoteSession({resumeCursor,verbose,trace,filterExpression,mode});return;}
   if(presentation) throw new Error('remote presentation flags are valid only for foreground session');
   if(positional.length>1) throw new Error('remote accepts one controller command');
   const command=positional[0];if(!REMOTE_COMMANDS.has(command)) throw new Error(`unsupported remote command '${command}'`);

package/src/remote-authority.mjs

@@ -0,0 +1,56 @@
+import path from 'node:path';
+
+export const AUTHORITY_PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+
+export function authorityVector(mode='default'){
+  if(!['default','desktop','host','full'].includes(mode)) throw new Error('remote authority mode invalid');
+  return Object.freeze({
+    process:true,coding:true,autonomous:true,
+    desktop:mode==='desktop'||mode==='full',
+    host:mode==='host'||mode==='full'
+  });
+}
+
+export function parseAuthorityObservation(raw){
+  let value;
+  try{value=typeof raw==='string'?JSON.parse(raw.replace(/^\uFEFF/,'')):raw;}
+  catch{throw new Error('controller observation JSON invalid');}
+  if(value?.schema!=='deadbyte.controller-observation.v1'||!value.authority||typeof value.authority!=='object'||Array.isArray(value.authority))
+    throw new Error('controller observation schema invalid');
+  const authority={};
+  for(const plane of AUTHORITY_PLANES){
+    const entry=value.authority[plane];
+    if(!entry||typeof entry!=='object'||typeof entry.armed!=='boolean'||typeof entry.configured!=='boolean'||typeof entry.reason!=='string')
+      throw new Error(`controller authority ${plane} observation invalid`);
+    authority[plane]=Object.freeze({configured:entry.configured,armed:entry.armed,reason:entry.reason.slice(0,128)});
+  }
+  return Object.freeze({...value,authority:Object.freeze(authority)});
+}
+
+export function assertAuthorityVector(snapshot,expected){
+  for(const plane of AUTHORITY_PLANES){
+    const entry=snapshot?.authority?.[plane];
+    if(!entry||typeof expected?.[plane]!=='boolean') throw new Error(`authority ${plane} observation or expectation invalid`);
+    if(entry.armed!==expected[plane]) throw new Error(`${plane} authority expected ${expected[plane]?'ARMED':'DISARMED'}; observed ${entry.armed?'ARMED':'DISARMED'} (${entry.reason})`);
+    if(expected[plane]&&!entry.configured) throw new Error(`${plane} authority unconfigured`);
+  }
+  return snapshot;
+}
+
+export function authorityBanner(snapshot){
+  return AUTHORITY_PLANES.map(plane=>`${plane} ${snapshot.authority[plane].armed?'ARMED':'DISARMED'}`).join(' | ');
+}
+
+export function assertRuntimeReadyObservation(snapshot,{coreRoot=null}={}){
+  if(snapshot?.state!=='ONLINE') throw new Error(`runtime state not ONLINE: ${String(snapshot?.state)}`);
+  for(const name of ['bridge','core','cloud']){
+    if(snapshot[name]?.alive!==true||snapshot[name]?.reason!=='verified') throw new Error(`${name} runtime identity unverified`);
+  }
+  if(snapshot.local_ready!==true) throw new Error('local MCP readiness unverified');
+  if(snapshot.supervisor?.running!==true) throw new Error('autonomous supervisor not running');
+  if(coreRoot!==null){
+    if(typeof snapshot.core_root!=='string'||path.win32.resolve(snapshot.core_root).toLowerCase()!==path.win32.resolve(coreRoot).toLowerCase())
+      throw new Error('core root does not match active release');
+  }
+  return snapshot;
+}

package/src/remote-enforcement-probe-r60.mjs

@@ -0,0 +1,17 @@
+import { authorityVector } from './remote-authority.mjs';
+
+export async function probeRemoteEnforcement({client,mode='default'}={}){
+  if(!client||typeof client.callTool!=='function')throw new Error('remote enforcement client invalid');
+  const expected=mode==='revoked'?{desktop:false,host:false}:authorityVector(mode);
+  const desktop=await client.callTool({name:'desktop_control',arguments:{op:'status'}});
+  const desktopValue=desktop?.structuredContent;
+  const desktopArmed=desktop?.isError===false&&desktopValue?.status==='ok'&&desktopValue?.result?.armed===true;
+  const desktopUnavailable=desktop?.isError===true&&desktopValue?.status==='unavailable';
+  if(expected.desktop?!desktopArmed:desktopArmed||(!desktopUnavailable&&desktopValue?.result?.armed!==false))
+    throw new Error('Desktop enforcement does not match requested authority');
+  const host=await client.callTool({name:'host_file_read',arguments:{root_id:'core',path:'package.json',encoding:'utf8'}});
+  const hostArmed=host?.isError===false&&host?.structuredContent?.status==='ok'&&/^[0-9a-f]{64}$/.test(String(host.structuredContent.sha256??''));
+  const hostDenied=host?.isError===true&&host?.structuredContent?.status==='denied';
+  if(expected.host?!hostArmed:!hostDenied) throw new Error('Host enforcement does not match requested authority');
+  return Object.freeze({desktop_armed:desktopArmed,host_armed:hostArmed});
+}

package/src/remote-live-log.mjs

@@ -319,19 +319,21 @@ export function createLiveTimelineWriter({stream=process.stdout,displayMode='uni
   return Object.freeze({write,flush,pending(){return active?{...active}:null;}});
 }
 
-export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,heartbeatBurstLimit=10,heartbeatWindowMs=3000,displayMode='unicode',rootPaths={},trace=false,slowCallMs=1000}={}){
+export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,foldHeartbeats=false,heartbeatBurstLimit=10,heartbeatWindowMs=3000,displayMode='unicode',rootPaths={},trace=false,slowCallMs=1000}={}){
   if(typeof clock!=='function') throw new Error('live timeline clock must be a function');
   if(!REMOTE_DISPLAY_MODES.includes(displayMode)) throw new Error('remote display mode invalid');
   if(!Number.isInteger(heartbeatBurstLimit)||heartbeatBurstLimit<2||heartbeatBurstLimit>100) throw new Error('heartbeatBurstLimit invalid');
   if(!Number.isInteger(heartbeatWindowMs)||heartbeatWindowMs<250||heartbeatWindowMs>60000) throw new Error('heartbeatWindowMs invalid');
   if(!rootPaths||typeof rootPaths!=='object'||Array.isArray(rootPaths)) throw new Error('live timeline rootPaths invalid');
   if(typeof trace!=='boolean') throw new Error('live timeline trace invalid');
+  if(typeof foldHeartbeats!=='boolean') throw new Error('live timeline foldHeartbeats invalid');
   if(!Number.isInteger(slowCallMs)||slowCallMs<100||slowCallMs>600000) throw new Error('live timeline slowCallMs invalid');
   const pending=new Map();
   const completed=new Set();
   const toolCounts=new Map();
   const durationSamples=[];
   let resultCount=0,okCount=0,errorCount=0,unknownCount=0,mutationCount=0,totalDurationMs=0,slowest=null,burst=null,foldedHeartbeatLines=0,peakInFlight=0;
+  let lastCapability=null,suppressedCapability=0,suppressedCapabilityReported=false;
 
   function eventPrefix(event,sequence,{displayTool=null,icon=null}={}){
     const seq=Number.isSafeInteger(sequence)&&sequence>0?'#'+sequence+'  ':'';
@@ -419,7 +421,18 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,he
       addStats(event,span);
       const error=event.outcome?.is_error===true;
       const nowMs=eventMs(event,clock);
-      if(HEARTBEAT_TOOLS.has(tool)&&!error){
+      if(tool==='capability_manifest'&&!error){
+        const snapshot=event.outcome?.snapshot_id,epoch=event.outcome?.state_epoch;
+        if(/^[0-9a-f]{64}$/.test(String(snapshot??''))&&Number.isInteger(epoch)&&epoch>0){
+          const identity=`${snapshot}:${epoch}`;
+          if(identity===lastCapability){suppressedCapability++;return null;}
+          lastCapability=identity;
+          const prior=flushBurst();
+          const line=resultLine(event,span,sequence)+`  snapshot=${snapshot.slice(0,8)} epoch=${epoch}`;
+          return prior?[prior,line]:line;
+        }
+      }
+      if(foldHeartbeats&&HEARTBEAT_TOOLS.has(tool)&&!error){
         const duration=Number(event.outcome?.duration_ms);
         if(burst&&burst.tool===tool&&nowMs-burst.last_ms<=heartbeatWindowMs){
           burst.count++;
@@ -449,6 +462,10 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,he
     const lines=[];
     const folded=flushBurst();
     if(folded) lines.push(folded);
+    if(suppressedCapability>0&&!suppressedCapabilityReported){
+      lines.push(remoteDisplayText(`capability_manifest ×${suppressedCapability} unchanged suppressed`,displayMode));
+      suppressedCapabilityReported=true;
+    }
     for(const item of pending.values()) lines.push(remoteDisplayText((displayMode==='ascii'?'[WARN]':'⚠')+' ['+shortSpanId(item.request_id)+'] OUTCOME_UNKNOWN '+item.tool+' — '+suffix+'; inspect state before retry',displayMode));
     pending.clear();
     return lines;

package/src/remote-log-decode-r60.mjs

@@ -0,0 +1,32 @@
+import path from 'node:path';
+
+export function safeRemoteLogPrefixLength(bytes,encoding='utf8'){
+  if(!Buffer.isBuffer(bytes))throw new Error('remote log prefix bytes invalid');
+  if(encoding==='utf16le'){
+    let size=bytes.length-(bytes.length%2);
+    if(size>=2){const last=bytes.readUInt16LE(size-2);if(last>=0xd800&&last<=0xdbff)size-=2;}
+    return size;
+  }
+  if(encoding!=='utf8')throw new Error('remote log prefix encoding invalid');
+  let index=bytes.length-1;
+  while(index>=0&&(bytes[index]&0xc0)===0x80)index--;
+  if(index<0)return 0;
+  const lead=bytes[index];
+  const needed=lead<0x80?1:lead>=0xc2&&lead<=0xdf?2:lead>=0xe0&&lead<=0xef?3:lead>=0xf0&&lead<=0xf4?4:1;
+  return bytes.length-index<needed?index:bytes.length;
+}
+
+export function decodeRemoteLogBytes(file,bytes,{encoding=null}={}){
+  if(typeof file!=='string'||!Buffer.isBuffer(bytes))throw new Error('remote log decoder input invalid');
+  const knownLog=/\.log$/i.test(path.basename(file));
+  if(!knownLog)return bytes.toString('utf8');
+  const utf16=encoding==='utf16le'||(bytes.length>=2&&bytes[0]===0xff&&bytes[1]===0xfe);
+  if(!utf16)return bytes.toString('utf8').replace(/^\uFEFF/,'');
+  return bytes.toString('utf16le').replace(/^\uFEFF/,'');
+}
+
+export function boundedRemoteDiagnostic(value,maxChars=2048){
+  if(!Number.isInteger(maxChars)||maxChars<32||maxChars>8192)throw new Error('remote diagnostic bound invalid');
+  const line=String(value??'').replace(/\x1b\[[0-9;]*[A-Za-z]/g,'').replace(/[\x00-\x1f\x7f]+/g,' ').replace(/\s{2,}/g,' ').trim();
+  return line.length<=maxChars?line:`${line.slice(0,maxChars)}...`;
+}

package/src/remote-mcp-machine-smoke-client.mjs

@@ -1,11 +1,17 @@
 import { randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
 import { verifyMachinePingPublic } from './machine-identity.mjs';
+import { parseActivePointer } from './release-slot.mjs';
+import { probeRemoteEnforcement } from './remote-enforcement-probe-r60.mjs';
 
 const endpointText = process.argv[2];
 if (!endpointText) throw new Error('usage: node src/remote-mcp-machine-smoke-client.mjs https://host/mcp/path');
 const endpoint = new URL(endpointText);
 if (endpoint.protocol !== 'https:') throw new Error('machine live gate requires HTTPS');
+const enforcementMode=process.argv[3]??null;
+if(enforcementMode!==null&&!['default','desktop','host','full','revoked'].includes(enforcementMode))throw new Error('remote enforcement probe mode invalid');
 
 const machineTools = ['machine_list', 'machine_ping', 'machine_revoke', 'machine_status'];
 const client = new Client(
@@ -49,6 +55,17 @@ try {
   }
   const signatureVerified = await verifyMachinePingPublic({ ping, publicKeySpkiBase64: status.public_key_spki_base64 });
   if (!signatureVerified) throw new Error('machine ping public Ed25519 verification failed');
+  if(enforcementMode!==null){
+    const stateRoot=process.env.DEADBYTE_STATE_ROOT;
+    if(!stateRoot||!path.isAbsolute(stateRoot))throw new Error('remote enforcement probe state root missing');
+    const pointer=parseActivePointer(await readFile(path.join(stateRoot,'active-release.json'),'utf8'));
+    for(const [actual,expected] of [
+      [status.release_id,pointer.release_id],
+      [status.release_manifest_sha256,pointer.manifest_sha256],
+      [status.generation_manifest_sha256,pointer.generation_manifest_sha256]
+    ])if(actual!==expected)throw new Error('signed machine status does not bind active release/generation');
+    await probeRemoteEnforcement({client,mode:enforcementMode});
+  }
 
   console.log(JSON.stringify({
     status: 'passed',
@@ -59,7 +76,8 @@ try {
     release_id: status.release_id,
     release_manifest_sha256: status.release_manifest_sha256,
     generation_manifest_sha256: status.generation_manifest_sha256,
-    signature_verified: true
+    signature_verified: true,
+    ...(enforcementMode?{enforcement_mode:enforcementMode,enforcement_verified:true}:{})
   }));
 } finally {
   await client.close().catch(() => {});

package/src/remote-session-guardian.mjs

@@ -6,8 +6,9 @@ import path from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
+import { AUTHORITY_PLANES, parseAuthorityObservation, assertAuthorityVector } from './remote-authority.mjs';
 
-const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost','park'];
+const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
 // This inherited IPC channel is an OS-owned parent lifetime handle, not a PID
 // poll. A reused PID cannot keep a new foreground guardian alive.
 let ownerDisconnected=false;
@@ -42,12 +43,23 @@ function markerMatches(marker,{ownerPid,nonce}){
     marker?.owner_pid===ownerPid&&
     marker?.session_nonce===nonce;
 }
-function invokeCleanup(powershell,launcher,command,stateRoot){
+function invokeCleanup(powershell,launcher,command,stateRoot,probeMode=null){
   const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{
-    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
+    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot,
+      ...(probeMode?{DEADBYTE_REMOTE_PROBE_MODE:probeMode}:{})}),timeout:probeMode?150000:30000
   });
   return !result.error&&result.status===0;
 }
+function verifyRevoked(powershell,launcher,stateRoot){
+  const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status','-Json'],{
+    stdio:['ignore','pipe','pipe'],encoding:'utf8',windowsHide:true,shell:false,
+    env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
+  });
+  if(result.error||result.status!==0) return null;
+  try{
+    return assertAuthorityVector(parseAuthorityObservation(result.stdout),Object.fromEntries(AUTHORITY_PLANES.map(plane=>[plane,false])));
+  }catch{return null;}
+}
 
 async function main(){
   if(process.platform!=='win32') return;
@@ -82,6 +94,11 @@ async function main(){
       if(!invokeCleanup(powershell,launcher,command,root)) failed.push(command);
     }
     if(failed.length) throw new Error('guardian cleanup failed; ownership marker retained: '+failed.join(','));
+    const observed=verifyRevoked(powershell,launcher,root);
+    if(!observed) throw new Error('guardian authority cleanup unverified; ownership marker retained');
+    if(observed.state==='ONLINE'&&!invokeCleanup(powershell,launcher,'machinetest',root,'revoked'))
+      throw new Error('guardian runtime enforcement cleanup unverified; ownership marker retained');
+    if(!invokeCleanup(powershell,launcher,'park',root)) throw new Error('guardian park failed; ownership marker retained');
     const current=await readMarker(markerPath);
     if(current&&markerMatches(current,{ownerPid,nonce})) await rm(markerPath,{force:true});
     return;

package/src/tool-audit.mjs

@@ -116,7 +116,12 @@ function summarizeOutcome(result,error,durationMs){
   const structured=result?.structuredContent;
   const status=typeof structured?.status==='string'?structured.status:(result?.isError===true?'error':'ok');
   const isError=result?.isError===true;
+  const capability=structured?.result;
+  const snapshot=capability?.schema==='deadbyte.capability-manifest.v3'&&HEX64.test(String(capability.snapshot_id??''))&&
+    Number.isInteger(capability.state_epoch)&&capability.state_epoch>0
+    ?{snapshot_id:capability.snapshot_id,state_epoch:capability.state_epoch}:{};
   return {status:String(status).slice(0,128),is_error:isError,duration_ms:duration,receipt_sha256s:outcomeReceiptHashes(result),
+    ...snapshot,
     ...(isError?{reason:resultOutcomeReason(result)}:{})};
 }
 

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.36';
+export const DEADBYTE_VERSION = '0.15.37';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/r48-release-contract.test.mjs

@@ -5,7 +5,7 @@ import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root = new URL('../', import.meta.url);
 const read = rel => readFile(new URL(rel, root), 'utf8');
-const json = rel => read(rel).then(JSON.parse);
+const json = rel => read(rel).then(raw => JSON.parse(raw.replace(/^\uFEFF/,'')));
 
 test('R48 compatibility release contract remains coherent in the current successor', async () => {
   const [pkg, lock, release, provenance, matrix] = await Promise.all([

package/test/r51-runtime-coherence.test.mjs

@@ -53,7 +53,7 @@ test('R51 bare remote wires coherence before live generation binding and deploy
 test('R51 foreground authority contract explicitly verifies and cleans desktop plus host',async()=>{
   const {readFile}=await import('node:fs/promises');
   const cli=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
-  assert.match(cli,/\['desktopstatus',\/\^Desktop plane/);
+  assert.match(cli,/assertAuthorityVector\(assertRuntimeReadyObservation\(observedAuthority/);
   assert.match(cli,/SESSION_CLEANUP=.*disarmdesktop.*disarmhost/s);
-  assert.match(cli,/desktop, host DISARMED/);
+  assert.match(cli,/authorityBanner\(authority\)/);
 });

package/test/r58-cleanup-retention.test.mjs

@@ -11,7 +11,12 @@ test('R58 foreground cleanup failure retains ownership evidence for recovery', {
   await mkdir(base,{recursive:true});
   const root=await mkdtemp(path.join(base,'cleanup-'));
   await mkdir(path.join(root,'bin'));
-  await writeFile(path.join(root,'bin','DEADBYTE-MCP.ps1'),`param([string]$Command)
+  await writeFile(path.join(root,'bin','DEADBYTE-MCP.ps1'),`param([string]$Command,[switch]$Json)
+if ($Command -eq 'status' -and $Json) {
+ $on=@{configured=$true;armed=$true;reason='standing-grant'}; $off=@{configured=$true;armed=$false;reason='disarmed'}
+ @{schema='deadbyte.controller-observation.v1';state='ONLINE';core_root='fixture';local_ready=$true;bridge=@{alive=$true;reason='verified'};core=@{alive=$true;reason='verified'};cloud=@{alive=$true;reason='verified'};supervisor=@{running=$true};authority=@{process=$on;coding=$on;autonomous=$on;desktop=$off;host=$off}} | ConvertTo-Json -Depth 5 -Compress
+ exit 0
+}
 switch ($Command) {
  'status' { Write-Output 'DEADBYTE MCP = ONLINE'; Write-Output 'Bridge PID   : 1001 [verified]'; Write-Output 'Cloud PID    : 1002 [verified]'; Write-Output 'Local ready  : True'; Write-Output 'Loop supervisor: RUNNING [verified]' }
  'processstatus' { Write-Output 'Process plane  : ARMED [standing-grant]' }
@@ -30,8 +35,9 @@ exit 0
   const closed=new Promise(resolve=>child.once('close',code=>resolve(code)));
   try {
     const deadline=Date.now()+12000;
-    while(!stdout.includes('ARMED: process, coding, autonomous')&&child.exitCode===null&&Date.now()<deadline) await delay(50);
-    assert.match(stdout,/ARMED: process, coding, autonomous/,stderr);
+    while(!stdout.includes('[READY]')&&child.exitCode===null&&Date.now()<deadline) await delay(50);
+    assert.match(stdout,/\[READY\]/,stderr);
+    assert.match(stdout,/\[AUTH\] process ARMED \| coding ARMED \| autonomous ARMED \| desktop DISARMED \| host DISARMED/,stderr);
     child.stdin.end();
     assert.notEqual(await closed,0,'cleanup failure must not report a successful foreground exit');
     assert.match(stderr,/cleanup disarmprocess exit=9/);

package/test/r58-concurrent-recovery.test.mjs

@@ -11,9 +11,15 @@ test('R58 simultaneous stale recovery cannot both revoke the shared authority',
  const root=await mkdtemp(path.join(base,'concurrent-recovery-'));await mkdir(path.join(root,'bin'));await mkdir(path.join(root,'runtime'));
  const trace=path.join(root,'trace.txt'),markerPath=path.join(root,'runtime','remote-session.json');
  await writeFile(markerPath,JSON.stringify({schema:'deadbyte.remote-session.v1',pid:2147483000,started_at_utc:'2000-01-01T00:00:00.000Z'}));
- await writeFile(path.join(root,'bin','DEADBYTE-MCP.ps1'),`param([string]$Command)
+ await writeFile(path.join(root,'bin','DEADBYTE-MCP.ps1'),`param([string]$Command,[switch]$Json)
 $ErrorActionPreference='Stop'
 for($i=0;$i -lt 40;$i++){try{[IO.File]::AppendAllText('${trace.replaceAll("'","''")}',$Command+[Environment]::NewLine);break}catch{if($i -eq 39){throw};Start-Sleep -Milliseconds 10}}
+if ($Command -match '^(arm|disarm)(process|coding|autonomous|desktop|host)$') { $file=Join-Path $env:DEADBYTE_STATE_ROOT ('runtime/' + $Matches[2] + '.armed'); if ($Matches[1] -eq 'arm') { [IO.File]::WriteAllText($file,'1') } else { Remove-Item -LiteralPath $file -Force -ErrorAction SilentlyContinue } }
+if ($Command -eq 'status' -and $Json) {
+ $authority=@{};foreach($name in @('process','coding','autonomous','desktop','host')) { $armed=Test-Path -LiteralPath (Join-Path $env:DEADBYTE_STATE_ROOT ('runtime/' + $name + '.armed'));$authority[$name]=@{configured=$true;armed=[bool]$armed;reason=$(if($armed){'standing-grant'}else{'disarmed'})} }
+ @{schema='deadbyte.controller-observation.v1';state='ONLINE';core_root='fixture';local_ready=$true;bridge=@{alive=$true;reason='verified'};core=@{alive=$true;reason='verified'};cloud=@{alive=$true;reason='verified'};supervisor=@{running=$true};authority=$authority} | ConvertTo-Json -Depth 5 -Compress
+ exit 0
+}
 switch($Command){
  'status' {Write-Output 'DEADBYTE MCP = ONLINE';Write-Output 'Bridge PID   : 1001 [verified]';Write-Output 'Cloud PID    : 1002 [verified]';Write-Output 'Local ready  : True';Write-Output 'Loop supervisor: RUNNING [verified]'}
  'processstatus' {Write-Output 'Process plane  : ARMED [standing-grant]'}
@@ -42,9 +48,9 @@ exit 0
    const o={stdout:'',stderr:''};c.stdout.on('data',b=>{o.stdout+=b;});c.stderr.on('data',b=>{o.stderr+=b;});o.exit=new Promise(resolve=>c.once('exit',resolve));children.push(c);outputs.push(o);
   }
   const until=Date.now()+12000;let commands=[];
-  while(Date.now()<until){try{commands=(await readFile(trace,'utf8')).trim().split(/\r?\n/);}catch{}if(commands.includes('hoststatus'))break;await delay(50);}
+  while(Date.now()<until){try{commands=(await readFile(trace,'utf8')).trim().split(/\r?\n/);}catch{}if(outputs.some(o=>o.stdout.includes('[READY]')))break;await delay(50);}
   await writeFile(path.join(root,'observation.json'),JSON.stringify({commands,outputs:outputs.map(o=>({stdout:o.stdout,stderr:o.stderr})),simulation:'concurrent stale marker recovery with delayed second park'}),{flag:'wx'});
-  assert.ok(commands.includes('hoststatus'),'a recovered foreground must become ready');
+  assert.ok(outputs.some(o=>o.stdout.includes('[READY]')),'a recovered foreground must become ready');
   for(const cmd of ['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'])assert.equal(commands.filter(x=>x===cmd).length,1,`stale recovery must serialize ${cmd}`);
  }finally{
   for(const c of children)if(c.exitCode===null)c.stdin.end();