deadbyte-mcp 0.15.43 → 0.15.44

package/test/r67-signed-receipt.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash} from 'node:crypto';
+import {signR67Observation} from '../src/r67-observation-receipt.mjs';
+import {independentlyVerifyR67Receipt} from '../scripts/r67-independent-observation-verify.mjs';
+import {runNativeInspect} from '../src/native-inspector-r67.mjs';
+
+const sha=s=>createHash('sha256').update(s).digest('hex');
+const pair=generateKeyPairSync('ed25519');
+const trustedPublicSpkiBase64=pair.publicKey.export({type:'spki',format:'der'}).toString('base64');
+const other=generateKeyPairSync('ed25519');
+const otherSpki=other.publicKey.export({type:'spki',format:'der'}).toString('base64');
+const requestSha256=sha(Buffer.from(JSON.stringify(['process','4']),'utf8'));
+const executableSha256='c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db';
+
+test('R67 signs a real Windows native observation and independently verifies exact result bytes',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ assert.equal(result.status,'ok');
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ const verified=independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256});
+ assert.equal(verified.ok,true,verified.reason);
+ assert.equal(verified.signature_valid,true);
+ assert.equal(verified.signer_key_id,sha(Buffer.from(trustedPublicSpkiBase64,'base64')));
+});
+
+test('R67 independent verifier rejects changed result, changed receipt, alternate signer and malformed encoding',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ const changedResult=structuredClone(result);
+ changedResult.data.processes[0].name+='INJECTED';
+ assert.equal(independentlyVerifyR67Receipt({receipt,result:changedResult,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const changedReceipt={...receipt,executable_sha256:sha(Buffer.from('ATTACK'))};
+ assert.equal(independentlyVerifyR67Receipt({receipt:changedReceipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64:otherSpki,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const forged=signR67Observation({privateKey:other.privateKey,publicKey:other.publicKey,operation:'process',requestSha256,executableSha256,result});
+ assert.equal(independentlyVerifyR67Receipt({receipt:forged,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const badSig={...receipt,attestation:{...receipt.attestation,signature_base64:'AAA='}};
+ assert.equal(independentlyVerifyR67Receipt({receipt:badSig,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+});
+
+test('R67 signing fails closed without trusted caller signer or on mismatched public/private key and corrupt data SHA',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ assert.throws(()=>signR67Observation({operation:'process',requestSha256,executableSha256,result}),/trusted runtime/);
+ assert.throws(()=>signR67Observation({privateKey:pair.privateKey,publicKey:other.publicKey,operation:'process',requestSha256,executableSha256,result}),/mismatch/);
+ const altered={...result,data_sha256:sha(Buffer.from('forged'))};
+ assert.throws(()=>signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result:altered}),/digest invalid/);
+});
+
+test('R67 trusted caller signing is integrated into actual native process inspection, not implicit CLI authority',async()=>{
+ const {result,receipt}=await runNativeInspect(['process','4'],{trustedSigner:{privateKey:pair.privateKey,publicKey:pair.publicKey}});
+ assert.equal(result.status,'ok');
+ assert.equal(receipt.operation,'process');
+ const check=independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256});
+ assert.equal(check.ok,true,check.reason);
+ const untrusted=await runNativeInspect(['process','4']);
+ assert.equal(untrusted.status,'ok');
+ assert.equal(Object.hasOwn(untrusted,'attestation'),false);
+});
+
+test('R67 independent verifier requires exact request argv and trusted executable pin',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','8'],expectedExecutableSha256:executableSha256}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:sha(Buffer.from('WRONG EXE'))}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64}).ok,false);
+});

package/test/r67-skip-rationale.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {parseR67NonpassCases,parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const historical=[
+ 'test/r53-release-contract.test.mjs','test/r54-release-contract.test.mjs','test/r55-release-contract.test.mjs',
+ 'test/r56-release-contract.test.mjs','test/r57-release-contract.test.mjs','test/r58-release-contract.test.mjs',
+ 'test/r58-windows-gate.test.mjs','test/r58-bundled-bridge.test.mjs','test/r60-release-contract.test.mjs',
+ 'test/r61-release-contract.test.mjs','test/r62-release-contract.test.mjs','test/r63-release-contract.test.mjs',
+ 'test/r64-release-contract.test.mjs','test/r65-release-contract.test.mjs','test/semantic-multilang.test.mjs'
+];
+test('R67 real TAP from historical release and R35 fixture skips has individual source-derived reasons',()=>{
+ const r=spawnSync(process.execPath,['--test','--test-reporter=tap','--test-concurrency=2',...historical],{
+ cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:90000,maxBuffer:16*1024*1024,
+ env:Object.fromEntries(Object.entries(process.env).filter(([key])=>key!=='NODE_TEST_CONTEXT'))
+ });
+ assert.equal(r.error,undefined,r.error?.message);
+ assert.equal(r.status,0,'selected regression exit '+r.status+' output tail '+r.stdout?.slice(-1500));
+ const tap=parseR67TapSummary(r.stdout);
+ assert.ok(tap,'valid full TAP totals; stdout-tail='+String(r.stdout).slice(-1600)+'; stderr-tail='+String(r.stderr).slice(-500));
+ assert.equal(tap.fail,0);
+ const ledger=parseR67NonpassCases(r.stdout);
+ assert.ok(ledger,'nonpass parser output');
+ assert.ok(ledger.expected_nonpass>0,'must exercise real skip path');
+ assert.equal(ledger.fully_classified,true,JSON.stringify(ledger.cases.filter(x=>!x.reason)));
+ assert.equal(ledger.cases.length,ledger.expected_nonpass);
+ for(const c of ledger.cases)assert.match(c.reason,/Historical|historical|fixture|R35|R\d+/);
+});

package/test/r67-tool-annotations.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {registerMachineTools} from '../src/machine-mcp-tools.mjs';
+test('R67 MCP annotations classify pure observation distinctly from machine revoke, without granting authority',async()=>{
+ const catalog=new Map();
+ const server={registerTool:(name,config,fn)=>catalog.set(name,{config,fn})};
+ let granted=false;
+ const runtime={list:async()=>({status:'ok',machines:[]}),status:async()=>({status:'ok'}),ping:async()=>({status:'ok'}),revoke:async()=>({status:'revoked'})};
+ registerMachineTools(server,{runtime,assertRevokeAuthority:async()=>{if(!granted)throw new Error('LOCAL_DENY');}});
+ for(const name of ['machine_list','machine_status','machine_ping']){
+  const hint=catalog.get(name).config.annotations;
+  assert.equal(hint.readOnlyHint,true,name);
+  assert.equal(hint.destructiveHint,false,name);
+  assert.equal(hint.openWorldHint,false,name);
+ }
+ const rev=catalog.get('machine_revoke');
+ assert.deepEqual(rev.config.annotations,{readOnlyHint:false,destructiveHint:true,idempotentHint:false,openWorldHint:false});
+ const denial=await rev.fn({reason:'check'});
+ assert.ok(denial.isError||denial.structuredContent?.status==='denied','annotations cannot grant revocation');
+ assert.equal(granted,false);
+});

package/test/r67-windows-gate-argv.test.mjs

@@ -0,0 +1,13 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+test('R67 Windows release gate must not shadow automatic PowerShell $Args when passing node script argv',async()=>{
+ const source=await readFile(path.join(root,'scripts','gate-windows-r67.ps1'),'utf8');
+ assert.doesNotMatch(source,/\[string\[\]\]\$Args\b/i,'PowerShell automatic $Args silently discards function parameters');
+ assert.match(source,/\[string\[\]\]\$NodeArgs\b/);
+ assert.match(source,/\& node @NodeArgs/);
+});

package/test/release-version.test.mjs

@@ -10,7 +10,7 @@ const PARENT_RELEASE='v0.15.2-0fb46542f6a4345f';
 const PARENT_MANIFEST='0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34';
 const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
 
-test.skip('R46 historical release contract is frozen at 0.15.15 and V0.15.2 parent identity',async()=>{
+test('R46 historical release contract is frozen at 0.15.15 and V0.15.2 parent identity',{skip:'Historical R46 release-version contract requires 0.15.15; current successor differs'},async()=>{
   const pkg=JSON.parse(await text('package.json'));
   const release=JSON.parse(await text('RELEASE.json'));
   const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,processPolicy]=await Promise.all([

package/test/remote-live-log-r36.test.mjs

@@ -35,3 +35,13 @@ test('compact live activity shows failed result duration',()=>{
 test('compact live activity ignores unrelated audit events',()=>{
   assert.equal(formatCompactAuditEvent({event_type:'checkpoint',tool:'coding_tree'}),null);
 });
+
+test('R67 live logs must reject terminal control injection and path escape codes',()=>{
+ const attacker=String.fromCharCode(27)+'[2J'+String.fromCharCode(27)+'[31mINJECTED';
+ const injectedTool=formatCompactAuditEvent({event_type:'tool.request',tool:'coding_file_read'+attacker,args:{root_id:'projects',path:'src/test.txt'}});
+ assert.equal(injectedTool,null,'tool names carrying control codes must never render');
+ const injectedPath=formatCompactAuditEvent({event_type:'tool.request',tool:'coding_file_read',args:{root_id:'projects',path:'src/'+attacker}});
+ assert.ok(injectedPath!==null);
+ assert.equal(injectedPath.includes(String.fromCharCode(27)),false,'terminal ESC must not be included in line');
+ assert.equal(injectedPath.includes('INJECTED'),false,'invalid path should be rejected rather than partially displayed');
+});

package/test/remote-live-log-r37.test.mjs

@@ -235,3 +235,32 @@ test('foreground human log keeps START and DONE separate and folds heartbeat noi
   assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose\}\)/);
   assert.match(src,/createLiveTimelineWriter\(\{stream:process\.stdout,displayMode,rewrite:false\}\)/);
 });
+
+test('R67 timeline normal/verbose views reject ANSI tool names, paths and error reasons',()=>{
+  const esc=String.fromCharCode(27);
+  const tracker=createLiveTimelineTracker({clock:()=>2000,verbose:false,rootPaths:{projects:'D:\\Projects\\safe'}});
+  const forged={event_type:'tool.request',tool:'coding_file_write'+esc+'[2J',request_id:'bad-tool-aaaa',args:{root_id:'projects',path:'readme.txt'}};
+  assert.equal(tracker.observe(forged,{sequence:1}),null);
+  assert.deepEqual(tracker.pending(),[]);
+  const started=tracker.observe({event_type:'tool.request',tool:'coding_file_write',request_id:'safe-abc12345',
+    args:{root_id:'projects',path:'file'+esc+'[31mPWNED',content:'safe'}},{sequence:2});
+  assert.ok(started);
+  assert.equal(started.includes(esc),false);
+  assert.equal(started.includes('PWNED'),false);
+  const end=tracker.observe({event_type:'tool.result',tool:'coding_file_write',request_id:'safe-abc12345',
+    outcome:{is_error:true,duration_ms:3,reason:'failed'+esc+'[2JINJECT'}},{sequence:3});
+  assert.ok(end);
+  assert.equal(end.includes(esc),false);
+  const raw=live.formatRemoteToolCall({...forged,event_type:'tool.request'});
+  assert.equal(raw,null);
+});
+
+test('R67 live timeline must not expose credential canaries from an error outcome reason',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1200});
+  tracker.observe({event_type:'tool.request',tool:'coding_command_run',request_id:'secret-r67-aaa',args:{root_id:'projects',command_id:'node_script'}},{sequence:1});
+  const output=tracker.observe({event_type:'tool.result',tool:'coding_command_run',request_id:'secret-r67-aaa',
+    outcome:{is_error:true,duration_ms:20,reason:'HTTP 401 Authorization: Bearer SECRET_TOKEN_SHOULD_NOT_APPEAR'}},{sequence:2});
+  assert.ok(output);
+  assert.doesNotMatch(output,/SECRET_TOKEN_SHOULD_NOT_APPEAR|Bearer/i);
+  assert.match(output,/REDACTED|SENSITIVE/);
+});

package/test/semantic-multilang.test.mjs

@@ -50,7 +50,7 @@ const cases=[
 ];
 
 for(const entry of cases){
-  test(`R35 ${entry.id} semantic tracer proves outline definition references and receipt-backed replace`,{skip:!(semanticConfigPath&&semanticConfigSha256),timeout:120000},async()=>{
+  test(`R35 ${entry.id} semantic tracer proves outline definition references and receipt-backed replace`,{skip:!(semanticConfigPath&&semanticConfigSha256) ? 'R35 external semantic backend fixture requires DEADBYTE_R35_SEMANTIC_CONFIG and matching SHA256; fixture not configured' : false,timeout:120000},async()=>{
     const f=await makeFixture(entry.id);
     try{
       await f.client.connect(f.transport);