deadbyte-mcp 0.15.44 → 0.15.46

package/test/r72-publication-output-integrity.test.mjs

@@ -0,0 +1,110 @@
+import assert from 'node:assert/strict';
+import {test} from 'node:test';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rm,symlink,rename} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {assertR72NpmPublishReady} from '../scripts/npm-release-readiness-r72.mjs';
+
+const sha = bytes=>createHash('sha256').update(bytes).digest('hex');
+const gates = ['full_regression','windows_lifecycle','package_acceptance','independent_judge'];
+const parent = {
+  version:'0.15.45',release_id:'v0.15.45-34aa8d1241cfb8bf',
+  manifest_sha256:'34aa8d1241cfb8bf0b5ba303bf3c06e0e9e1bf01f64457bca659d6dd4d634fdc',
+  generation_manifest_sha256:'ff2b73410062688651abd7bc2dd7b2b8c87810a28e3808bfe1f4352a25b0e6e4'
+};
+const release={version:'0.15.46',name:'deadbyte-mcp',train:'R72',parent,runtime_predecessor:parent,r72_hotfix:{
+  status:'CANDIDATE_SEALED',windows_regression:'PASS',package_acceptance:'PASS',manifest:'PASS',
+  remote_lifecycle:'PASS',security_gate:'PASS',independent_judge:'PASS'
+}};
+
+async function fixture(){
+  const root=await mkdtemp(path.join(tmpdir(),'r72-fence-integrity-'));
+  const evidence=path.join(root,'testing','r72-release-evidence');
+  const outputs=path.join(evidence,'outputs');
+  await mkdir(outputs,{recursive:true});
+  const manifest=Buffer.from('synthetic test-only manifest, not a real release\n');
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  const index={schema:'deadbyte.r72-release-evidence-index.v1',version:'0.15.46',parent,
+    manifest_sha256:sha(manifest),gate_sha256:{}};
+  const outputPaths={};
+  for(const gate of gates){
+    const output=Buffer.from(`SYNTHETIC-TEST-ONLY\nGATE=${gate}\nEXIT=0\n`);
+    const outputPath=path.join(outputs,`${gate}.log`);
+    outputPaths[gate]=outputPath;
+    await writeFile(outputPath,output);
+    const receipt={schema:'deadbyte.r72-gate-result.v1',gate,version:'0.15.46',
+      manifest_sha256:index.manifest_sha256,status:'PASS',exit_code:0,
+      output_file:`outputs/${gate}.log`,output_sha256:sha(output),
+      ...(gate==='full_regression'?{pass_count:1,fail_count:0}:{}),
+      ...(gate==='windows_lifecycle'?{safe_default_arm_count:0,operator_owner_consent_enforced:true,
+       stale_owner_recovery_verified:true,signed_epoch_fail_closed:true}:{}),
+      ...(gate==='independent_judge'?{independent_verification:'PASS'}:{})};
+    const bytes=Buffer.from(JSON.stringify(receipt)+'\n');
+    index.gate_sha256[gate]=sha(bytes);
+    await writeFile(path.join(evidence,`${gate}.json`),bytes);
+  }
+  await writeFile(path.join(evidence,'ready.json'),JSON.stringify(index)+'\n');
+  return {root,evidence,outputPaths,dispose:()=>rm(root,{recursive:true,force:true})};
+}
+
+test('synthetic complete fixture validates receipt/output bytes linkage (not real release evidence)',async()=>{
+ const f=await fixture();try{
+   const result=await assertR72NpmPublishReady(release,{root:f.root});
+   assert.equal(result.status,'R72_RELEASE_READY_EVIDENCE_BOUND');
+ } finally {await f.dispose();}
+});
+
+test('mutating full regression output, without changing receipt, rejects',async()=>{
+ const f=await fixture();try{
+   await writeFile(f.outputPaths.full_regression,'tampered output\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(mismatch|tamper|hash)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing Windows lifecycle output rejects even with intact receipt',async()=>{
+ const f=await fixture();try{
+   await rm(f.outputPaths.windows_lifecycle);
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*(missing|invalid|unavailable)/i);
+ } finally {await f.dispose();}
+});
+
+test('receipt pointing to other output file rejects even with recomputed index SHA',async()=>{
+ const f=await fixture();try{
+   const gate='package_acceptance',receiptPath=path.join(f.evidence,`${gate}.json`);
+   const receipt=JSON.parse(await readFile(receiptPath,'utf8'));
+   receipt.output_file='outputs/full_regression.log';
+   const content=Buffer.from(JSON.stringify(receipt)+'\n');
+   await writeFile(receiptPath,content);
+   const indexPath=path.join(f.evidence,'ready.json');
+   const index=JSON.parse(await readFile(indexPath,'utf8'));
+   index.gate_sha256[gate]=sha(content);
+   await writeFile(indexPath,JSON.stringify(index)+'\n');
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/output.*path/i);
+ } finally {await f.dispose();}
+});
+
+test('symlinked evidence output or junction directory must not be trusted',async()=>{
+ const f=await fixture();try{
+   const target=f.outputPaths.independent_judge,other=path.join(f.root,'external.log');
+   await writeFile(other,await readFile(target));
+   await rm(target);
+   try {await symlink(other,target,'file');}
+   catch(e){
+     if(!['EPERM','EACCES','ENOTSUP'].includes(e.code))throw e;
+     // Windows can deny file symlinks while permitting unprivileged directory junctions.
+     const outputs=path.join(f.evidence,'outputs');
+     const externalOutputs=path.join(f.root,'external-outputs');
+     await rename(outputs,externalOutputs);
+     await symlink(externalOutputs,outputs,'junction');
+   }
+   await assert.rejects(assertR72NpmPublishReady(release,{root:f.root}),/(output.*(regular|symlink)|evidence\/output directory is not a real directory)/i);
+ } finally {await f.dispose();}
+});
+
+test('missing status seal cannot be bypassed by synthetic receipts',async()=>{
+ const f=await fixture();try{
+   const uns={...release,r72_hotfix:{...release.r72_hotfix,status:'CANDIDATE_UNSEALED'}};
+   await assert.rejects(assertR72NpmPublishReady(uns,{root:f.root}),/CANDIDATE_SEALED/);
+ } finally {await f.dispose();}
+});

package/test/r72-remote-safe-contract.test.mjs

@@ -0,0 +1,101 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,rm,writeFile,access} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {authorityVector} from '../src/remote-authority.mjs';
+
+const controllerPath=new URL('../controller/deadbyte-controller.ps1',import.meta.url);
+const quote=value=>`'${String(value).replaceAll("'","''")}'`;
+const winTest=process.platform==='win32'?test:test.skip;
+
+// The legacy elevated contract is still available, but must be explicitly selected.
+test('R72 default remote asks for no standing authority',()=>{
+  assert.deepEqual(authorityVector('default'),{
+    process:false,coding:false,autonomous:false,desktop:false,host:false
+  });
+});
+test('R72 operator retains explicit process/coding/autonomous and no host/desktop',()=>{
+  assert.deepEqual(authorityVector('operator'),{
+    process:true,coding:true,autonomous:true,desktop:false,host:false
+  });
+});
+test('R72 desktop/host/full remain explicit elevated choices',()=>{
+  for(const [mode,desktop,host] of [['desktop',true,false],['host',false,true],['full',true,true]]){
+    assert.deepEqual(authorityVector(mode),{
+      process:true,coding:true,autonomous:true,desktop,host
+    });
+  }
+  assert.throws(()=>authorityVector('invalid'),/mode invalid/);
+});
+
+async function controllerScenario({grant=false,escape=false,epochFails=false}={}){
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r72-revocation-'));
+  const runtime=path.join(temp,'runtime');
+  const file=path.join(temp,'autonomous.json');
+  const grantFile=path.join(escape?temp:runtime,'autonomous-grant.json');
+  const epochTrace=path.join(temp,'epoch-trace.txt');
+  await mkdir(runtime,{recursive:true});
+  await writeFile(file,JSON.stringify({
+    schema:'deadbyte.autonomous-policy.v1',enabled:true,
+    lease_file:grantFile,coding_policy_sha256:'a'.repeat(64),root_ids:['core']
+  }));
+  if(grant)await writeFile(grantFile,'fixture-grant');
+  const source=await readFile(controllerPath,'utf8');
+  const begin=source.indexOf('function Get-AutonomousRevocationLeaseFile(');
+  const end=source.indexOf('function Show-AutonomousStatus(',begin);
+  const readBegin=source.indexOf('function Read-ControllerPolicySnapshot(');
+  const readEnd=source.indexOf('function Get-CodingPolicyMetadata(',readBegin);
+  assert.ok(begin>=0&&end>begin&&readBegin>=0&&readEnd>readBegin);
+  const script=`$ErrorActionPreference='Stop';
+$RuntimeDir=${quote(runtime)};
+function Fail([string]$m){throw $m};
+function Get-AutonomousPolicyMetadata($Cfg){throw 'ISSUANCE_PATH_MUST_NOT_RUN'};
+function Invoke-AuthorityEpochCommand($Cfg,[string]$Plane,[string]$Action,[string]$GrantFile){
+  [IO.File]::AppendAllText(${quote(epochTrace)},("$Plane/$Action"+[Environment]::NewLine));
+  ${epochFails?"throw 'FIXTURE_EPOCH_FAILED'":"return 'FIXTURE_SIGNED_REVOKE'"}
+};
+${source.slice(readBegin,readEnd)};
+${source.slice(begin,end)};
+try { Disarm-Autonomous @{AutonomousPolicyFile=${quote(file)}};Write-Output 'REVOKE_OK' }
+catch {Write-Output ('REVOKE_FAILED: '+$_.Exception.Message);exit 7}
+`;
+  const result=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-Command',script],{
+    encoding:'utf8',timeout:15000,maxBuffer:1024*1024
+  });
+  const remaining=await access(grantFile).then(()=>true,()=>false);
+  const epoch=await readFile(epochTrace,'utf8').catch(error=>{
+    if(error?.code==='ENOENT')return '';throw error;
+  });
+  await rm(temp,{recursive:true,force:true});
+  return {result,remaining,epoch};
+}
+
+winTest('R72 disarm with broad Coding roots and no Autonomous grant succeeds without grant issuance',async()=>{
+  const {result,remaining,epoch}=await controllerScenario();
+  assert.equal(result.status,0,result.stderr+'\n'+result.stdout);
+  assert.match(result.stdout,/REVOKE_OK/);
+  assert.equal(remaining,false);
+  assert.equal(epoch,'');
+});
+winTest('R72 present Autonomous grant is sent to epoch revoker before removal',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true});
+  assert.equal(result.status,0,result.stderr+'\n'+result.stdout);
+  assert.match(epoch,/autonomous\/user-revoke/);
+  assert.equal(remaining,false);
+});
+winTest('R72 external grant path is rejected without touching the file',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true,escape:true});
+  assert.notEqual(result.status,0);
+  assert.match(result.stdout,/must live under controller runtime directory/);
+  assert.equal(remaining,true);
+  assert.equal(epoch,'');
+});
+winTest('R72 epoch revocation error remains a failure even after file removal',async()=>{
+  const {result,remaining,epoch}=await controllerScenario({grant:true,epochFails:true});
+  assert.notEqual(result.status,0);
+  assert.match(result.stdout,/FIXTURE_EPOCH_FAILED/);
+  assert.match(epoch,/autonomous\/user-revoke/);
+  assert.equal(remaining,false);
+});

package/test/r72-staging-input-isolation.test.mjs

@@ -0,0 +1,87 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile,symlink,readFile} from 'node:fs/promises';
+import {tmpdir,homedir} from 'node:os';
+import path from 'node:path';
+import {assertStageOwnedPath,assertStageNoProductionPath,assertStagingBootstrapInputs,assertStagingControlConfig} from '../src/staging-input-isolation.mjs';
+const usingStage=async fn=>{const dir=await mkdtemp(path.join(tmpdir(),'r72-g2-w2-'));try{const state=path.join(dir,'isolated-state');await mkdir(state);await fn({dir,state});}finally{await rm(dir,{recursive:true,force:true});}};
+const cfg=state=>({
+  CoreRoot:path.join(state,'releases','predecessor'),WorkspaceRoot:path.join(state,'workspaces'),
+  CodingPolicyFile:path.join(state,'policies','coding.json'),AutonomousPolicyFile:path.join(state,'policies','autonomous.json'),
+  HostPolicyFile:path.join(state,'policies','host.json'),ProcessPolicyFile:path.join(state,'policies','process.json'),
+  DesktopPolicyFile:path.join(state,'policies','desktop.json'),
+  Bridge:{FilePath:path.join(state,'bin','node.exe'),WorkingDirectory:path.join(state,'bridge'),ScriptPath:path.join(state,'bridge','src','bridge.mjs'),Dependencies:[{Name:'bridge-local',Path:path.join(state,'bridge','src','helper.mjs')}]},
+  Cloud:{FilePath:path.join(state,'bin','tunnel.exe'),WorkingDirectory:path.join(state,'releases','predecessor'),Dependencies:[{Name:'cloudflared',Path:path.join(path.parse(state).root,'opt','cloudflared.exe')},{Name:'tunnel-token',Path:path.join(state,'trust','cloud-token.txt')}]}
+});
+test('G2-W2 accepts stage-owned policy, Bridge and Cloud config paths',async()=>usingStage(async({state})=>{
+  assert.doesNotThrow(()=>assertStagingControlConfig(cfg(state),state,{configPath:path.join(state,'generations','config.psd1')}));
+}));
+test('G2-W2 rejects each external controller policy path before policy read',async()=>usingStage(async({dir,state})=>{
+  for(const key of ['CodingPolicyFile','AutonomousPolicyFile','HostPolicyFile','ProcessPolicyFile','DesktopPolicyFile']){
+    const c=cfg(state);c[key]=path.join(dir,'outside.json');
+    assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),new RegExp('STAGING_EXTERNAL_INPUT: '+key));
+  }
+}));
+test('G2-W2 rejects external controller config before PowerShell Import-PowerShellDataFile',async()=>usingStage(async({dir,state})=>{
+  assert.throws(()=>assertStageOwnedPath(path.join(dir,'production','config.psd1'),state,'controller config file'),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 rejects bridge and Cloud external working directories, dependencies and executables',async()=>usingStage(async({dir,state})=>{
+  for(const [component,key] of [['Bridge','WorkingDirectory'],['Bridge','ScriptPath'],['Cloud','WorkingDirectory']]){
+    const c=cfg(state);c[component][key]=path.join(dir,'foreign','escape.exe');
+    assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+  }
+  const c=cfg(state);c.Bridge.Dependencies[0].Path=path.join(dir,'foreign.js');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 permits a shared non-production executable but forbids a production-state executable',async()=>usingStage(async({dir,state})=>{
+  const c=cfg(state);c.Bridge.FilePath=path.join(dir,'system-node.exe');
+  assert.doesNotThrow(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}));
+  c.Bridge.FilePath=path.join(homedir(),'.deadbyte-mcp','bin','node.exe');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_PRODUCTION_INPUT/);
+}));
+test('G2-W2 rejects external cloud credential in existing config',async()=>usingStage(async({dir,state})=>{
+  const c=cfg(state);c.Cloud.Dependencies[1].Path=path.join(dir,'production','token.txt');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 rejects external policy override before state mutation',async()=>usingStage(async({dir,state})=>{
+  for(const key of ['codingPolicyBootstrap','autonomousPolicyBootstrap','hostPolicyBootstrap','processPolicyBootstrap','desktopPolicyBootstrap','ownerApprovalBootstrap','semanticLspBootstrap']){
+    assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,[key]:{path:path.join(dir,'outside.json'),sha256:'a'.repeat(64)}}),/STAGING_EXTERNAL_INPUT/);
+  }
+}));
+test('G2-W2 rejects production legacy --source-root and Bridge bootstrap before state mutation',async()=>usingStage(async({dir,state})=>{
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,sourceRoot:path.join(dir,'legacy-core')}),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,bridgeBootstrap:{root:path.join(dir,'bridge'),scriptSha256:'a'.repeat(64)}}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 requires named-tunnel token and working directory under stage state',async()=>usingStage(async({dir,state})=>{
+  const c={cloudflared:{path:path.join(dir,'nonprod-cloudflared.exe')},tokenFile:{path:path.join(state,'trust','token.txt')},childWorkingDirectory:path.join(state,'cloud')};
+  assert.doesNotThrow(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:c}));
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:{...c,tokenFile:{path:path.join(dir,'external-token.txt')}}}),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,cloudTransport:{...c,childWorkingDirectory:path.join(dir,'foreign')}}),/STAGING_EXTERNAL_INPUT/);
+}));
+test('G2-W2 prohibits production config, token and cloudflared even when explicitly pinned',async()=>usingStage(async({state})=>{
+  const prod=path.join(homedir(),'.deadbyte-mcp');
+  assert.throws(()=>assertStageOwnedPath(path.join(prod,'trust','update-key.json'),state,'production key'),/STAGING_EXTERNAL_INPUT/);
+  assert.throws(()=>assertStageNoProductionPath(path.join(prod,'bin','cloudflared.exe'),state,'cloudflared'),/STAGING_PRODUCTION_INPUT/);
+}));
+test('G2-W2 rejects staging nested in production root',()=>{
+  const prod=path.join(homedir(),'.deadbyte-mcp');
+  assert.throws(()=>assertStageOwnedPath(path.join(prod,'stage','policies','coding.json'),path.join(prod,'stage'),'policy'),/STAGING_STATE_OVERLAPS_PRODUCTION/);
+});
+test('G2-W2 allows production legacy policy paths without modifying production data',async()=>usingStage(async({dir})=>{
+  const production=path.join(homedir(),'.deadbyte-mcp');
+  const c=cfg(path.join(dir,'separate-stage'));
+  assert.doesNotThrow(()=>assertStagingControlConfig(c,production,{configPath:path.join(dir,'external.psd1')}));
+  assert.doesNotThrow(()=>assertStagingBootstrapInputs({stateRoot:production,sourceRoot:dir,cloudTransport:{tokenFile:{path:dir}}}));
+}));
+test('G2-W2 rejects a symlink path component in an otherwise owned policy path',async t=>usingStage(async({dir,state})=>{
+  const external=path.join(dir,'external');await mkdir(external);
+  try{await symlink(external,path.join(state,'linked'),process.platform==='win32'?'junction':'dir');}
+  catch(error){if(['EPERM','EACCES','ENOSYS'].includes(error.code)){t.diagnostic('symlink privilege not present');return;}throw error;}
+  const c=cfg(state);c.CodingPolicyFile=path.join(state,'linked','coding.json');
+  assert.throws(()=>assertStagingControlConfig(c,state,{configPath:path.join(state,'config.psd1')}),/STAGING_REPARSE_INPUT/);
+}));
+test('G2-W2 rejection never modifies foreign source bytes',async()=>usingStage(async({dir,state})=>{
+  const foreign=path.join(dir,'foreign.json');await writeFile(foreign,'private-boundary-marker');
+  assert.throws(()=>assertStagingBootstrapInputs({stateRoot:state,codingPolicyBootstrap:{path:foreign}}),/STAGING_EXTERNAL_INPUT/);
+  assert.equal(await readFile(foreign,'utf8'),'private-boundary-marker');
+}));

package/test/r72-staging-workspace-isolation.test.mjs

@@ -0,0 +1,114 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,symlink} from 'node:fs/promises';
+import {tmpdir,homedir} from 'node:os';
+import {existsSync, lstatSync} from 'node:fs';
+import path from 'node:path';
+import {workspacePlan} from '../src/runtime-update.mjs';
+
+const stage = async fn => {
+  const dir=await mkdtemp(path.join(tmpdir(),'r72-g2-workspace-'));
+  try {await fn(dir,path.join(dir,'stage-state'));}
+  finally {await rm(dir,{recursive:true,force:true});}
+};
+
+test('staging rejects external existing workspace before any rename can be planned', async()=>{
+  await stage(async(base,state)=>{
+    const foreign=path.join(base,'production-workspaces');
+    await mkdir(foreign);
+    await assert.rejects(workspacePlan(foreign,state), /STAGING_WORKSPACE_OUTSIDE_STATE/);
+  });
+});
+
+test('staging rejects production-managed workspace path even if not present', async()=>{
+  await stage(async(base,state)=>{
+    const prod=path.join(homedir(),'.deadbyte-mcp','workspaces');
+    await assert.rejects(workspacePlan(prod,state), /STAGING_WORKSPACE_OUTSIDE_STATE/);
+  });
+});
+
+test('staging permits a stage-owned legacy workspace and preserves plan-only semantics', async()=>{
+  await stage(async(base,state)=>{
+    const old=path.join(state,'legacy-workspaces');
+    await mkdir(old,{recursive:true});
+    const planned=await workspacePlan(old,state);
+    assert.equal(planned.mode,'rename');
+    assert.equal(planned.target,path.join(state,'workspaces'));
+    assert.equal(planned.moved,false);
+  });
+});
+
+test('staging rejects a workspace equal to state root', async()=>{
+  await stage(async(base,state)=>{
+    await mkdir(state);
+    await assert.rejects(workspacePlan(state,state), /STAGING_WORKSPACE_STATE_ROOT/);
+  });
+});
+
+test('production keeps its established external-workspace migration behavior', async()=>{
+  await stage(async(base)=>{
+    const prod=path.join(homedir(),'.deadbyte-mcp');
+    const stable=path.join(prod,'workspaces');
+    const external=path.join(base,'legacy-workspaces');
+    await mkdir(external);
+    // Observe real target state read-only: production might already contain workspaces.
+    if(existsSync(stable)){
+      const info=lstatSync(stable);
+      if(!info.isDirectory()||info.isSymbolicLink()){
+        await assert.rejects(workspacePlan(external,prod),/stable workspace root must be a real directory/);
+      }else{
+        await assert.rejects(workspacePlan(external,prod),/workspace migration conflict: both source and stable target exist/);
+      }
+    }else{
+      const result=await workspacePlan(external,prod);
+      assert.equal(result.source,external);
+      assert.equal(result.target,stable);
+      assert.equal(result.mode,'rename');
+      assert.equal(result.moved,false);
+    }
+    // Planning must never rename or remove the legacy source.
+    assert.equal(existsSync(external),true);
+  });
+});
+
+test('staging refuses workspace path through symlink or junction', async(t)=>{
+  await stage(async(base,state)=>{
+    const real=path.join(base,'foreign');await mkdir(real);
+    const link=path.join(state,'link');await mkdir(state);
+    try{await symlink(real,link,process.platform==='win32'?'junction':'dir');}
+    catch(e){if(['EPERM','EACCES','ENOSYS'].includes(e.code)){t.diagnostic('symlink creation not permitted');return;}throw e;}
+    await assert.rejects(workspacePlan(link,state), /STAGING_WORKSPACE_REPARSE/);
+  });
+});
+
+test('staging refuses reserved trust, release and runtime trees as workspace sources',async()=>{
+ await stage(async(base,state)=>{
+  for(const child of ['trust','releases','runtime','bin','evidence']){
+   const source=path.join(state,child,'workspace');
+   await assert.rejects(workspacePlan(source,state),/STAGING_WORKSPACE_RESERVED_STATE/);
+  }
+ });
+});
+
+test('workspace apply rejects a newly introduced target junction/symlink',async(t)=>{
+ await stage(async(base,state)=>{
+  const old=path.join(state,'old-workspaces');await mkdir(old,{recursive:true});
+  const plan=await workspacePlan(old,state);
+  const external=path.join(base,'foreign');await mkdir(external);
+  try{await symlink(external,path.join(state,'workspaces'),process.platform==='win32'?'junction':'dir');}
+  catch(e){if(['EPERM','EACCES','ENOSYS'].includes(e.code)){t.diagnostic('symlink creation not permitted');return;}throw e;}
+  const {applyWorkspacePlan}=await import('../src/runtime-update.mjs');
+  await assert.rejects(applyWorkspacePlan(plan),/STAGING_WORKSPACE_REPARSE/);
+  assert.equal((await import('node:fs')).existsSync(old),true);
+ });
+});
+
+test('workspace rollback rejects a foreign workspace source without touching it',async()=>{
+ await stage(async(base,state)=>{
+  const foreign=path.join(base,'foreign');await mkdir(foreign);
+  const {rollbackWorkspacePlan}=await import('../src/runtime-update.mjs');
+  const fake={source:foreign,target:path.join(state,'workspaces'),mode:'rename',moved:true};
+  await assert.rejects(rollbackWorkspacePlan(fake),/STAGING_WORKSPACE_OUTSIDE_STATE/);
+  assert.equal((await import('node:fs')).existsSync(foreign),true);
+ });
+});

package/test/remote-result-journal.test.mjs

@@ -71,3 +71,15 @@ test('remote result journal preserves explicit unknown side-effect state across
     await assert.rejects(journal.recordTerminal({...item('req-invalid',H('5'),'error'),side_effect_state:'committed'}),/side_effect_state invalid/);
   }finally{await rm(root,{recursive:true,force:true});}
 });
+
+test('R69 replay retains an input-required result as pending, never ok',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r69-remote-pending-'));
+  try{
+    const file=path.join(root,'journal.json');
+    let journal=await openRemoteResultJournal({filePath:file,sessionId:session,maxEntries:8});
+    await journal.recordTerminal(item('req-input',H('6'),'pending'));
+    journal=await openRemoteResultJournal({filePath:file,sessionId:session,maxEntries:8});
+    const replay=await journal.replayAfter('r1:'+session+':0',{limit:8});
+    assert.equal(replay.events[0].status,'pending');
+  }finally{await rm(root,{recursive:true,force:true});}
+});