deadbyte-mcp 0.15.42 → 0.15.44

package/test/r67-diagnostics-zip-oracle.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {makeOfflineDiagnosticBundle} from '../src/r67-diagnostic-export.mjs';
+test('R67 ZIP interoperates with independent Windows .NET ZipArchive reader',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'r67-dotnet-zip-'));
+ try{
+  const file=path.join(folder,'diag.zip');
+  const x=makeOfflineDiagnosticBundle({releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:'a'.repeat(64),logs:[
+   {source:'controller-start.stderr.log',content:'2026-10-11T01:02:03.000Z ERROR timeout win32=109 TOKEN_CANARY_7841'}
+  ]});
+  await writeFile(file,x.zip);
+  const escaped=file.replaceAll("'","''");
+  const ps=[
+    '$ErrorActionPreference="Stop"',
+    'Add-Type -AssemblyName System.IO.Compression.FileSystem',
+    "$zip=[System.IO.Compression.ZipFile]::OpenRead('"+escaped+"')",
+    "try{",
+    "  $entries=@($zip.Entries|ForEach-Object {$_.FullName})",
+    "  if($entries.Count -ne 2 -or $entries[0] -ne 'diagnostics.json' -or $entries[1] -ne 'redacted-events.json'){throw 'ZIP_ENTRY_MISMATCH'}",
+    "  foreach($entry in $zip.Entries){",
+    "    $reader=New-Object System.IO.StreamReader($entry.Open())",
+    "    try{$body=$reader.ReadToEnd();$parsed=ConvertFrom-Json -InputObject $body;if(!$parsed){throw 'INVALID_JSON'}}finally{$reader.Dispose()}",
+    "    if($body.Contains('TOKEN_CANARY_7841')){throw 'SECRET_LEAK'}",
+    "  }",
+    "  Write-Output 'ZIP_ORACLE_PASS'",
+    "}finally{$zip.Dispose()}"
+  ].join(';');
+  const r=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',ps],
+   {windowsHide:true,shell:false,encoding:'utf8',timeout:20000,maxBuffer:1024*1024});
+  assert.equal(r.error,undefined,r.error?.message);
+  assert.equal(r.status,0,r.stderr);
+  assert.match(r.stdout,/ZIP_ORACLE_PASS/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});

package/test/r67-diagnostics.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {redactDiagnosticLine,makeOfflineDiagnosticBundle,exportOfflineDiagnostics} from '../src/r67-diagnostic-export.mjs';
+const secret='SENTINEL_SECRET_CANARY_984031';
+const token='sk-proj-FAKE_DIAGNOSTIC_SECRET';
+const sha='a'.repeat(64);
+test('R67 local diagnostics use irreversible token-free allowlist, not regex-redacted raw log',()=>{
+ const line='2026-10-11T05:44:03.000Z ERROR reconnect win32=109 Authorization: Bearer '+secret+' '+token+' C:\\Users\\DEADBYTE\\passwords.txt';
+ const output=redactDiagnosticLine(line);
+ assert.deepEqual(output,{timestamp:'2026-10-11T05:44:03.000Z',level:'ERROR',event:'reconnect',win32_error:109});
+ assert.ok(!JSON.stringify(output).includes('FAKE'));
+ const unknown=redactDiagnosticLine('password='+secret+' '+token+' cwd=/private/location');
+ assert.equal(unknown,null,'unknown free-form lines must be dropped');
+});
+test('R67 offline ZIP contains only fixed names, derived summaries, no raw secrets or network URL',()=>{
+ const bundle=makeOfflineDiagnosticBundle({
+  releaseId:'v0.15.43-'+'a'.repeat(16),manifestSha256:sha,
+  logs:[{source:'controller-start.stderr.log',content:'ERROR reconnect win32=109 Bearer '+secret+'\nINFO ready '+token+'\npassword='+secret+'\n'}]
+ });
+ assert.ok(Buffer.isBuffer(bundle.zip));
+ assert.equal(bundle.zip.readUInt32LE(0),0x04034b50,'ZIP local file header');
+ assert.ok(bundle.zip.includes(Buffer.from('diagnostics.json')));
+ assert.ok(bundle.zip.includes(Buffer.from('redacted-events.json')));
+ for(const value of [secret,token,'password=','Bearer','C:\\Users\\','https://'])
+  assert.equal(bundle.zip.includes(Buffer.from(value)),false,'raw or sensitive text leaked');
+ assert.equal(bundle.summary.schema,'deadbyte.r67-offline-diagnostics.v1');
+ assert.equal(bundle.summary.network_upload,'NEVER');
+ assert.equal(bundle.summary.source_count,1);
+ assert.equal(bundle.summary.redacted_event_count,2);
+ assert.match(bundle.archive_sha256,/^[a-f0-9]{64}$/);
+});
+test('R67 exports only to owner-selected local path, absent target and no arbitrary logs',async()=>{
+ const folder=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-diagnostic-test-'));
+ try{
+  const stateRoot=path.join(folder,'state');
+  await mkdir(path.join(stateRoot,'runtime','logs'),{recursive:true});
+  await writeFile(path.join(stateRoot,'active-release.json'),JSON.stringify({release_id:'v0.15.43-'+'a'.repeat(16),manifest_sha256:sha}));
+  await writeFile(path.join(stateRoot,'runtime','logs','controller-start.stderr.log'),'ERROR timeout Authorization: Bearer '+secret+'\nINFO connected '+token+'\n');
+  await writeFile(path.join(stateRoot,'runtime','logs','arbitrary.log'),'ERROR THIS MUST NOT BE INCLUDED '+secret+'\n');
+  const output=path.join(folder,'owner-approved.zip');
+  const result=await exportOfflineDiagnostics({stateRoot,outputPath:output});
+  assert.equal(result.status,'written_local_only');
+  assert.equal(result.uploaded,false);
+  const actual=await readFile(output);
+  assert.equal(actual.readUInt32LE(0),0x04034b50);
+  assert.equal(actual.includes(Buffer.from(secret)),false);
+  assert.equal(actual.includes(Buffer.from(token)),false);
+  assert.equal(actual.includes(Buffer.from('arbitrary.log')),false);
+  const info=await lstat(output);
+  assert.ok(info.isFile()&&!info.isSymbolicLink());
+  await assert.rejects(()=>exportOfflineDiagnostics({stateRoot,outputPath:output}),/EEXIST|already exists/);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+test('R67 without output path fails before read and upload option is always forbidden',async()=>{
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a'}),/outputPath/);
+ await assert.rejects(()=>exportOfflineDiagnostics({stateRoot:'C:\\a',outputPath:'X',upload:true}),/upload.*disabled|no network/i);
+});

package/test/r67-evidence-reconcile.test.mjs

@@ -0,0 +1,186 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createR67ShardPlan,r67RegressionTreeHash,r67ShardTimeoutMs} from '../src/r67-regression-shards.mjs';
+import {reconcileR67Evidence} from '../src/r67-evidence-reconcile.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const op='r67-e2e-fixture-contract';
+async function fixture(){
+ const parent=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-e2e-'));
+ const root=path.join(parent,'candidate'),evidenceRoot=path.join(parent,'evidence');
+ await mkdir(path.join(root,'test'),{recursive:true});
+ await mkdir(path.join(root,'src'));
+ await mkdir(evidenceRoot);
+ await writeFile(path.join(root,'package.json'),'{}\n');
+ await writeFile(path.join(root,'src','core.mjs'),'export const r67 = true;\n');
+ const names=Array.from({length:32},(_,i)=>'test/fixture-'+String(i).padStart(2,'0')+'.test.mjs');
+ for(const name of names)await writeFile(path.join(root,name),'import test from "node:test"; test("fixture",()=>{});\n');
+ const plan=createR67ShardPlan(names,32);
+ const hashes=await Promise.all(names.map(async name=>[name,sha(await readFile(path.join(root,name)))]));
+ const testTree=sha(Buffer.from(JSON.stringify(hashes)));
+ const opts={roots:['src','test'],topLevel:['package.json'],extra:[]};
+ const tree=await r67RegressionTreeHash(root,opts);
+ async function writeShard(index,{kind='valid',signed=false}={}){
+  const shard=plan.shards[index],folder=path.join(evidenceRoot,op+'-shard-'+String(index).padStart(2,'0'));
+  await mkdir(folder,{recursive:true});
+  const intent={schema:'deadbyte.r67-shard-intent.v1',operation:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,started_at_utc:'2026-10-11T00:00:00.000Z',files:shard.files};
+  await writeFile(path.join(folder,'intent.json'),JSON.stringify(intent));
+  const status=kind==='unknown'?'OUTCOME_UNKNOWN':'PASS';
+  const result={schema:kind==='v1'?'deadbyte.r67-shard-result.v1':'deadbyte.r67-shard-result.v2',
+   operation_id:op,shard_index:index,plan_sha256:plan.plan_sha256,
+   files_sha256:shard.files_sha256,test_tree_sha256:testTree,source_tree_sha256:tree.sha256,
+   source_file_count:tree.file_count,status,exit_code:status==='PASS'?0:null,
+   test_count:status==='PASS'?1:null,passed:status==='PASS'?1:null,failed:status==='PASS'?0:null,
+   skipped:status==='PASS'?0:null,cancelled:status==='PASS'?0:null,todo:status==='PASS'?0:null,
+   configured_timeout_ms:r67ShardTimeoutMs(shard),timed_out:false,failure_reason:null,elapsed_ms:1,
+   stdout_sha256:sha(Buffer.from('fixture output')),stderr_sha256:sha(Buffer.alloc(0))};
+  if(kind==='tampered')result.files_sha256='f'.repeat(64);
+  const receipt_sha256=sha(Buffer.from(JSON.stringify(result)));
+  await writeFile(path.join(folder,'result.json'),JSON.stringify({...result,receipt_sha256}));
+  return folder;
+ }
+ return {parent,root,evidenceRoot,plan,opts,writeShard,cleanup:()=>rm(parent,{recursive:true,force:true})};
+}
+test('R67 real reconciliation consumes 32 durable v2 receipts and reports PASS from fixture source bytes',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'PASS',JSON.stringify(r));
+  assert.equal(r.verified_receipts,32);
+  assert.equal(r.verdict.test_count,32);
+  assert.deepEqual(r.integrity_faults,[]);
+ }finally{await x.cleanup();}
+});
+test('R67 verified legacy v1 receipts cannot count toward a new full suite PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===5?'v1':'valid'});
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+  assert.deepEqual(r.stale_indices,[5]);
+  assert.equal(r.verified_receipts,31);
+ }finally{await x.cleanup();}
+});
+test('R67 rejects changed receipts before considering source staleness',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:i===7?'tampered':'valid'});
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const broken=JSON.parse(await readFile(file,'utf8'));broken.result_sha256='0'.repeat(64);
+  await writeFile(file,JSON.stringify(broken));
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(e=>e.index===7));
+ }finally{await x.cleanup();}
+});
+test('R67 source mutation, missing shard and unknown outcome never produce PASS',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<31;i++)await x.writeShard(i);
+  let r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED');
+  await x.writeShard(31,{kind:'unknown'});
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'OUTCOME_UNKNOWN');
+  await writeFile(path.join(x.root,'src','core.mjs'),'export const r67 = false;\n');
+  r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE');
+ }finally{await x.cleanup();}
+});
+
+test('R67 changed test plan makes authentic historical v1 receipts STALE, not integrity failures',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i,{kind:'v1'});
+  await writeFile(path.join(x.root,'test','fixture-added.test.mjs'),'import test from "node:test"; test("new",()=>{});\\n');
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'STALE_SOURCE',JSON.stringify(r.integrity_faults));
+  assert.deepEqual(r.integrity_faults,[]);
+  assert.equal(r.stale_indices.length,32);
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 PASS cannot coexist with timed_out=true even if receipt SHA is recomputed',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-08','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.timed_out=true;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'FAILED_INTEGRITY');
+  assert.ok(r.integrity_faults.some(v=>v.index===8));
+ }finally{await x.cleanup();}
+});
+
+test('R67 v2 skips cannot silently produce a full regression PASS without classification',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));result.passed=0;result.skipped=1;
+  const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+  await writeFile(file,JSON.stringify(result));
+  const r=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(r.status,'BLOCKED_NONPASS_CLASSIFICATION');
+  assert.deepEqual(r.unclassified_nonpass,[{index:9,skipped:1,todo:0,cancelled:0}]);
+ }finally{await x.cleanup();}
+});
+
+test('R67 case-level SKIP evidence stays visible and forged case counts fail integrity',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-09','result.json');
+  const report=JSON.parse(await readFile(file,'utf8'));
+  report.passed=0;report.skipped=1;
+  report.nonpass_cases=[{kind:'SKIP',name:'offline fixture',reason:'unsupported platform'}];
+  report.nonpass_fully_classified=true;
+  const seal=async()=>{
+    const {receipt_sha256,...body}=report;report.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));
+    await writeFile(file,JSON.stringify(report));
+  };
+  await seal();
+  const observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'PASS','Fully reasoned skips must be honestly recorded but should not fabricate test failures');
+  assert.deepEqual(observed.classified_nonpass[0].cases,report.nonpass_cases);
+  assert.equal(observed.verdict.passed,31);
+  assert.equal(observed.verdict.test_count,32);
+  report.nonpass_cases.push({kind:'SKIP',name:'forged',reason:'unsupported platform'});
+  await seal();
+  const broken=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(broken.status,'FAILED_INTEGRITY');
+ }finally{await x.cleanup();}
+});
+
+
+test('R67 v2 FAILED result must bind a complete named failure case ledger, not an empty passing-shaped ledger',async()=>{
+ const x=await fixture();
+ try{
+  for(let i=0;i<32;i++)await x.writeShard(i);
+  const file=path.join(x.evidenceRoot,op+'-shard-07','result.json');
+  const result=JSON.parse(await readFile(file,'utf8'));
+  const name='remote ownership race';
+  result.status='FAILED';result.exit_code=1;result.failed=1;result.passed=0;
+  result.failure_cases=[{name,name_sha256:sha(Buffer.from(name,'utf8'))}];
+  result.failure_cases_complete=true;
+  const seal=async()=>{const {receipt_sha256,...body}=result;result.receipt_sha256=sha(Buffer.from(JSON.stringify(body)));await writeFile(file,JSON.stringify(result));};
+  await seal();
+  let observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED');
+  assert.deepEqual(observed.integrity_faults,[]);
+  result.failure_cases=[];result.failure_cases_complete=true;await seal();
+  observed=await reconcileR67Evidence({root:x.root,evidenceRoot:x.evidenceRoot,operationId:op,sourceHashOptions:x.opts});
+  assert.equal(observed.status,'FAILED_INTEGRITY');
+  assert.ok(observed.integrity_faults.some(v=>v.index===7));
+ }finally{await x.cleanup();}
+});

package/test/r67-isolated-slot-rollback-restore.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
+
+const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const parent=path.resolve(candidate,'..','deadbyte-mcp-0.15.43-r66');
+const parentManifestSha='4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33';
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function generation(state,label){
+  const root=path.join(state,'generations',label);
+  await mkdir(root,{recursive:true});
+  const config=Buffer.from(`@{ Label = '${label}' }\r\n`,'utf8');
+  await writeFile(path.join(root,'controller-config.psd1'),config,{flag:'wx'});
+  const manifest=Buffer.from(`${sha(config)}  controller-config.psd1\n`,'utf8');
+  await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
+  return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
+}
+
+test('R67 isolated immutable slot activates, rolls back exact R66, and restores the same R67 bytes with no authority',async()=>{
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-slot-parity-'));
+  const state=path.join(base,'state');
+  try{
+    const parentManifest=await readFile(path.join(parent,'MANIFEST.SHA256'));
+    const candidateManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+    assert.equal(sha(parentManifest),parentManifestSha);
+    const candidateManifestSha=sha(candidateManifest);
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.43',manifestSha256:parentManifestSha});
+    const candidateSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version:'0.15.44',manifestSha256:candidateManifestSha});
+    const parentGeneration=await generation(state,'r66-parent');
+    const candidateGeneration=await generation(state,'r67-candidate');
+    const launcherSha=sha(Buffer.from(renderStableLauncherPs1(),'utf8'));
+    const pointerPath=path.join(state,'active-release.json');
+    const pointer=(slot,version,g)=>({schema:'deadbyte.active-release.v1',release_id:slot.release_id,version,
+      manifest_sha256:slot.manifest_sha256,release_root:slot.release_root,generation_root:g.root,
+      generation_manifest_sha256:g.manifest_sha256,launcher_sha256:launcherSha,config_path:g.config_path});
+
+    const activated=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.44',candidateGeneration));
+    assert.equal(activated.release_id,candidateSlot.release_id);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+
+    const rolledBack=await atomicWriteActivePointer(pointerPath,pointer(parentSlot,'0.15.43',parentGeneration));
+    assert.equal(rolledBack.release_id,parentSlot.release_id);
+    assert.equal(rolledBack.manifest_sha256,parentManifestSha);
+    await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));
+
+    const restored=await atomicWriteActivePointer(pointerPath,pointer(candidateSlot,'0.15.44',candidateGeneration));
+    assert.deepEqual(restored,activated);
+    assert.deepEqual(parseActivePointer(await readFile(pointerPath,'utf8')),activated);
+    await verifyManifestTreeExact(candidateSlot.release_root,parseManifest(candidateManifest.toString('utf8')));
+    for(const name of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+      await assert.rejects(()=>lstat(path.join(state,'runtime',name)),{code:'ENOENT'});
+    }
+  }finally{
+    await rm(base,{recursive:true,force:true});
+  }
+});

package/test/r67-live-log-secret-canary.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {formatRemoteToolCall,createLiveTimelineTracker} from '../src/remote-live-log.mjs';
+const token='sk-proj-SENTINEL_CANARY_NEVER_PRINT_8675309';
+test('R67 live log does not echo credential-shaped token in path argument, including verbose call',()=>{
+ const evt={event_type:'tool.request',request_id:'canary-00000001',tool:'coding_file_read',args:{root_id:'projects',path:'sensitive/'+token+'/file.txt'}};
+ const verbose=formatRemoteToolCall(evt);
+ assert.equal(typeof verbose,'string');
+ assert.doesNotMatch(verbose,/SENTINEL_CANARY_NEVER_PRINT/);
+ const track=createLiveTimelineTracker({clock:()=>1000,verbose:true});
+ const start=track.observe(evt,{sequence:10});
+ const end=track.observe({event_type:'tool.result',request_id:evt.request_id,tool:evt.tool,outcome:{is_error:false,duration_ms:1}},{sequence:11});
+ assert.doesNotMatch(String(start)+String(end),/SENTINEL_CANARY_NEVER_PRINT/);
+});
+
+test('R67 compact live activity refuses credential in path and pattern even when caller passes unsanitized event',async()=>{
+ const {formatCompactAuditEvent,createLiveActivityTracker}=await import('../src/remote-live-log.mjs');
+ const sentinel='ghp_PRIVATE_CANARY_ABCDEF0123456789Q';
+ const event={event_type:'tool.request',request_id:'span-safe-121',tool:'coding_search',
+  args:{root_id:'projects',path:'source/'+sentinel+'/target',pattern:'token='+sentinel}};
+ const line=formatCompactAuditEvent(event);
+ assert.equal(typeof line,'string');
+ assert.doesNotMatch(line,/PRIVATE_CANARY/);
+ const activity=createLiveActivityTracker();
+ assert.doesNotMatch(activity.observe(event),/PRIVATE_CANARY/);
+});
+test('R67 trace-enabled live log does not disclose credential-shaped user session id or script_path',async()=>{
+ const event={event_type:'tool.request',request_id:'good-span-5678',tool:'coding_command_run',
+  context:{trace_id:'sk-proj-SENTINEL_TRACE_CANARY_3456789'},
+  args:{root_id:'projects',command_id:'node_script',script_path:'tmp/github_pat_PRIVATE_SCRIPT_CANARY_1234567890.ps1'}};
+ const tracker=createLiveTimelineTracker({clock:()=>1000,trace:true});
+ const line=tracker.observe(event,{sequence:77});
+ assert.equal(typeof line,'string');
+ assert.doesNotMatch(line,/SENTINEL_TRACE_CANARY|PRIVATE_SCRIPT_CANARY/);
+});
+test('R67 result error reason does not reveal github token in user supplied text',()=>{
+ const token='github_pat_SECRET_RESULT_CANARY_ABCDEFGHIJKLMNOP';
+ const tracker=createLiveTimelineTracker({clock:()=>1000,trace:true});
+ tracker.observe({event_type:'tool.request',request_id:'foo-1',tool:'coding_command_run',args:{root_id:'projects',command_id:'node_script'}},{sequence:4});
+ const output=tracker.observe({event_type:'tool.result',request_id:'foo-1',tool:'coding_command_run',
+  outcome:{is_error:true,reason:'failure after credential '+token,duration_ms:33}},{sequence:5});
+ assert.equal(typeof output,'string');
+ assert.doesNotMatch(output,/SECRET_RESULT_CANARY/);
+});

package/test/r67-machine-fs-smoke-epoch.test.mjs

@@ -0,0 +1,22 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+test('R67 isolated machine-fs smoke binds its Coding grant to a durable authority epoch',()=>{
+  const env={...process.env};
+  delete env.DEADBYTE_STATE_ROOT;
+  const result=spawnSync(process.execPath,['src/machine-fs-smoke-client.mjs'],{
+    cwd:root,env,encoding:'utf8',windowsHide:true,shell:false,timeout:30000,maxBuffer:4*1024*1024
+  });
+  assert.equal(result.error,undefined,String(result.error??''));
+  assert.equal(result.status,0,`${result.stdout}\n${result.stderr}`);
+  const receipt=JSON.parse(String(result.stdout));
+  assert.equal(receipt.status,'passed');
+  assert.equal(receipt.mutation_receipts,5);
+  assert.equal(receipt.signature_valid,true);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`,/legacy-no-epoch/);
+});

package/test/r67-native-inspector.test.mjs

@@ -0,0 +1,131 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFile,writeFile,mkdtemp,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {spawnSync} from 'node:child_process';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const exe=path.join(root,'bin','deadbyte-native-inspect-r67.exe');
+const hash=b=>createHash('sha256').update(b).digest('hex');
+function run(...args){
+ const r=spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:30000,maxBuffer:4*1024*1024});
+ assert.equal(r.error,undefined,r.error?.message);
+ const out=JSON.parse((r.stdout??'').trim());
+ assert.equal(out.schema,'deadbyte.native-inspect.r67.v1');
+ if(out.status==='ok')assert.equal(out.data_sha256,hash(Buffer.from(JSON.stringify(out.data),'utf8')),'independent serialized data digest');
+ return {...out,exit_code:r.status};
+}
+test('R67 native process snapshot is bounded, identity-bearing, and honestly partial',()=>{
+ const r=run('process','48');
+ assert.equal(r.status,'ok');
+ assert.equal(r.exit_code,0);
+ assert.equal(r.operation,'process');
+ assert.equal(r.data.api,'CreateToolhelp32Snapshot+OpenProcess+GetProcessTimes+QueryFullProcessImageNameW');
+ assert.ok(r.data.processes.length>=1&&r.data.processes.length<=48);
+ for(const p of r.data.processes){
+  assert.ok(Number.isSafeInteger(p.pid)&&p.pid>=0);
+  assert.ok(Number.isSafeInteger(p.parent_pid)&&p.parent_pid>=0);
+  assert.ok(['observed','unavailable','stale_or_reused'].includes(p.state));
+  if(p.state==='unavailable')assert.ok(Number.isInteger(p.win32_error)&&p.win32_error>0);
+  else if(p.state==='stale_or_reused'){assert.equal(p.snapshot_binding,'NAME_MISMATCH');assert.equal(p.win32_error,0);}
+  else {assert.equal(p.snapshot_binding,'UNVERIFIED');assert.match(p.creation_time_utc,/^\d{4}-\d\d-\d\dT/);assert.match(p.creation_filetime,/^\d+$/);assert.equal(p.win32_error,0);}
+ }
+});
+test('R67 VirtualQueryEx memory map records process identity, monotone bounded regions, and zero private memory data',()=>{
+ const r=run('map','self','64');
+ assert.equal(r.status,'ok');
+ assert.equal(r.exit_code,0);
+ assert.equal(r.operation,'map');
+ assert.equal(r.data.api,'VirtualQueryEx');
+ assert.match(r.data.creation_filetime,/^\d+$/);
+ assert.ok(r.data.regions.length>=1&&r.data.regions.length<=64);
+ let prev=-1n;
+ for(const row of r.data.regions){
+  const base=BigInt(row.base),size=BigInt(row.size);
+  assert.ok(base>prev&&size>0n);
+  prev=base;
+  assert.ok(Number.isInteger(row.state)&&Number.isInteger(row.protect)&&Number.isInteger(row.type));
+  assert.deepEqual(Object.keys(row),['base','allocation_base','size','state','protect','type']);
+ }
+ assert.equal(r.data.process_exited,false);
+ assert.equal(r.data.outcome,'HANDLE_IDENTITY_CONFIRMED');
+});
+test('R67 PE bytes and section table agree with an independent raw-file oracle',async()=>{
+ const b=await readFile(exe);
+ assert.equal(b.readUInt16LE(0),0x5a4d);
+ const p=b.readInt32LE(0x3c);
+ assert.ok(p>=64&&p+24<b.length);
+ assert.equal(b.readUInt32LE(p),0x4550);
+ const machine=b.readUInt16LE(p+4),sectionCount=b.readUInt16LE(p+6);
+ const optLength=b.readUInt16LE(p+20),magic=b.readUInt16LE(p+24);
+ const sectionOff=p+24+optLength;
+ const r=run('pe',exe);
+ assert.equal(r.status,'ok');assert.equal(r.exit_code,0);
+ assert.equal(r.data.file_sha256,hash(b));
+ assert.equal(r.data.file_size,b.length);
+ assert.equal(r.data.machine,machine);
+ assert.equal(r.data.number_of_sections,sectionCount);
+ assert.equal(r.data.format,magic===0x20b?'PE32+':'PE32');
+ assert.equal(r.data.sections.length,sectionCount);
+ for(let i=0;i<sectionCount;i++){
+  const off=sectionOff+i*40,row=r.data.sections[i];
+  assert.equal(row.rva,'0x'+b.readUInt32LE(off+12).toString(16));
+  assert.equal(row.raw_size,b.readUInt32LE(off+16));
+  assert.equal(row.raw_offset,b.readUInt32LE(off+20));
+  assert.equal(row.characteristics,b.readUInt32LE(off+36));
+  assert.ok(!row.raw_size||row.raw_offset+row.raw_size<=b.length);
+ }
+});
+test('R67 returns failed/error for inaccessible PID and malformed PE, never fabricated empty observations',async()=>{
+ const bad=run('map','4294967295','1','4');
+ assert.equal(bad.status,'failed');assert.equal(bad.exit_code,2);
+ assert.match(bad.error,/OpenProcess.*win32=|invalid PID/);
+ assert.ok(['ACCESS_DENIED','INVALID_PARAMETER','WIN32_FAILURE'].includes(bad.error_code));
+ assert.ok(Number.isInteger(bad.win32_error)&&bad.win32_error>0);
+ const folder=await mkdtemp(path.join(tmpdir(),'deadbyte-r67-pe-'));
+ try{
+  const file=path.join(folder,'invalid.exe');await writeFile(file,Buffer.alloc(128,0));
+  const invalid=run('pe',file);
+  assert.equal(invalid.status,'failed');assert.equal(invalid.exit_code,2);assert.match(invalid.error,/MZ|PE/);
+  assert.equal(invalid.error_code,'INVALID_INPUT');assert.equal(invalid.win32_error,0);
+ }finally{await rm(folder,{recursive:true,force:true});}
+});
+
+test('R67 external PID memory map fails closed on missing or mismatched creation FILETIME',()=>{
+ const missing=run('map',String(process.pid));
+ assert.equal(missing.status,'failed');assert.equal(missing.exit_code,2);
+ assert.match(missing.error,/creation_filetime/);
+ const swapped=run('map',String(process.pid),'1','4');
+ assert.equal(swapped.status,'failed');assert.equal(swapped.exit_code,2);
+ assert.equal(swapped.error_code,'PROCESS_IDENTITY_MISMATCH');
+ assert.equal(swapped.win32_error,0);
+ const observed=run('identity',String(process.pid));
+ assert.equal(observed.status,'ok',observed.error);
+ assert.equal(observed.data.pid,process.pid);
+ const valid=run('map',String(process.pid),observed.data.creation_filetime,'4');
+ assert.equal(valid.status,'ok',valid.error);
+ assert.equal(valid.data.creation_filetime,observed.data.creation_filetime);
+ assert.equal(valid.data.pid,process.pid);
+});
+
+test('R67 exited process cannot silently turn into a successful PID-reused memory map',async()=>{
+ const {spawn}=await import('node:child_process');
+ const {once}=await import('node:events');
+ const child=spawn(process.execPath,['-e','setInterval(()=>{},500)'],{shell:false,windowsHide:true,stdio:'ignore'});
+ try{
+  await once(child,'spawn');
+  const identity=run('identity',String(child.pid));
+  assert.equal(identity.status,'ok',identity.error);
+  assert.equal(identity.data.pid,child.pid);
+  const stopped=once(child,'exit');
+  assert.equal(child.kill(),true);
+  await stopped;
+  const after=run('map',String(child.pid),identity.data.creation_filetime,'4');
+  assert.equal(after.status,'failed');
+  assert.equal(after.exit_code,2);
+  assert.equal(Object.hasOwn(after,'data'),false);
+  assert.ok(['WIN32_FAILURE','INVALID_PARAMETER','PROCESS_EXITED','PROCESS_IDENTITY_MISMATCH'].includes(after.error_code),after.error_code);
+ }finally{if(child.exitCode===null)child.kill();}
+});

package/test/r67-native-observation-authority.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createR67NativeObservationAuthority} from '../src/r67-native-observation-authority.mjs';
+
+const hex=c=>c.repeat(64);
+const policy={policy_sha256:hex('a'),roots:{projects:{read:true}}};
+let alive=true,generation=17;
+const getSession=async()=>alive?{
+ armed:true,standing:true,reason:'standing-grant',instance_nonce:hex('b'),root_ids:['projects'],
+ authority_epoch:{trusted:true,seq:generation,event_sha256:hex('c')}
+}:{armed:false,reason:'disarmed'};
+
+test('R67 observer fails closed without explicit owner opt-in, and denies other PID reads',async()=>{
+ const disabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession});
+ await assert.rejects(()=>disabled({operation:'process',args:['process','4']}),/DISABLED/);
+ const enabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession,enabled:true});
+ await assert.rejects(()=>enabled({operation:'map',args:['map','4148','3']}),/OTHER_PID/);
+ await assert.rejects(()=>enabled({operation:'identity',args:['identity','4148']}),/OTHER_PID/);
+ await assert.rejects(()=>enabled({operation:'exec',args:['exec','whoami']}),/SCOPE_DENIED/);
+});
+test('R67 observer binds machine-supplied authority to real standing epoch, not client grant',async()=>{
+ alive=true;
+ const enabled=createR67NativeObservationAuthority({getCodingPolicy:()=>policy,sessionStatus:getSession,enabled:true});
+ const first=await enabled({operation:'map',args:['map','self','4']});
+ assert.equal(first.scope,'native-observe-readonly');
+ assert.equal(first.policy_sha256,policy.policy_sha256);
+ assert.equal(first.authority_generation,generation);
+ assert.match(first.grant_id,/^coding\.r67\.[0-9a-f]{32}$/);
+ const next=await enabled({operation:'map',args:['map','self','4']});
+ assert.deepEqual(first,next);
+ generation+=1;
+ const rotated=await enabled({operation:'map',args:['map','self','4']});
+ assert.notEqual(first.authority_generation,rotated.authority_generation);
+ alive=false;
+ await assert.rejects(()=>enabled({operation:'process',args:['process','4']}),/AUTHORITY_REVOKED/);
+});
+test('R67 observer rejects unverified lease epoch or changed policy',async()=>{
+ const disabled=createR67NativeObservationAuthority({
+  getCodingPolicy:()=>policy,enabled:true,sessionStatus:async()=>({
+   armed:true,standing:true,reason:'standing-grant',instance_nonce:hex('b'),root_ids:['projects'],
+   authority_epoch:{trusted:false,seq:100,event_sha256:hex('c')}
+  })
+ });
+ await assert.rejects(()=>disabled({operation:'process',args:['process','4']}),/AUTHORITY_REVOKED/);
+ const malformed=createR67NativeObservationAuthority({
+  getCodingPolicy:()=>({policy_sha256:hex('a'),roots:{}}),enabled:true,sessionStatus:getSession
+ });
+ await assert.rejects(()=>malformed({operation:'process',args:['process','4']}),/POLICY_MISSING/);
+});