deadbyte-mcp 0.15.44 → 0.15.46

package/src/autonomous-policy.mjs

@@ -80,11 +80,11 @@ function normalizePlanner(raw,codingPolicy,rootIds) {
   }
   return provider;
 }
-function normalizeProfile(id, raw, codingPolicy) {
+function normalizeProfile(id, raw, codingPolicy, rootIds) {
   if (!ID_RE.test(id)) throw new Error(`invalid autonomous profile '${id}'`);
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error(`autonomous profile '${id}' malformed`);
   if (!['command','benchmark'].includes(raw.kind)) throw new Error(`autonomous profile '${id}' kind invalid`);
-  if (!ID_RE.test(raw.root_id ?? '') || !codingPolicy.roots[raw.root_id]) throw new Error(`autonomous profile '${id}' root invalid`);
+  if (!ID_RE.test(raw.root_id ?? '') || !codingPolicy.roots[raw.root_id] || !rootIds.includes(raw.root_id)) throw new Error(`autonomous profile '${id}' root invalid`);
   if (!ID_RE.test(raw.command_id ?? '') || !codingPolicy.commands[raw.command_id]) throw new Error(`autonomous profile '${id}' command invalid`);
   validatePortableRelativePath(raw.script_path);
   if (!SHA256_RE.test(raw.script_sha256 ?? '')) throw new Error(`autonomous profile '${id}' script hash invalid`);
@@ -130,7 +130,7 @@ export async function loadAutonomousPolicy(policyPath, codingPolicy) {
   const rootIds = Array.isArray(raw.root_ids) ? [...new Set(raw.root_ids)] : [];
   if (rootIds.length < 1 || rootIds.some(id => !ID_RE.test(id) || !codingPolicy.roots[id])) throw new Error('autonomous root_ids invalid');
   const profiles = {};
-  for (const [id, value] of Object.entries(raw.profiles ?? {})) profiles[id] = normalizeProfile(id, value, codingPolicy);
+  for (const [id, value] of Object.entries(raw.profiles ?? {})) profiles[id] = normalizeProfile(id, value, codingPolicy, rootIds);
   const limits = raw.limits ?? {};
   const policy = {
     schema: AUTONOMOUS_POLICY_SCHEMA, enabled: true, policy_path: absolute,
@@ -154,6 +154,43 @@ export async function loadAutonomousPolicy(policyPath, codingPolicy) {
   return Object.freeze(policy);
 }
 
+export function inspectAutonomousStandingWindow(lease,now=new Date()){
+  // v2 legacy standing grants have no expiry. New bounded grants must be
+  // checked on every authority observation, including after a runtime restart.
+  if(!lease||typeof lease!=='object'||Array.isArray(lease)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  if(!Object.hasOwn(lease,'expires_at_utc')){
+    return {ok:true,reason:null,expires_at_utc:null,remaining_ms:null};
+  }
+  const canonical=value=>typeof value==='string'&&
+    /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3,7}Z$/.test(value);
+  const expiry=lease.expires_at_utc;
+  const issued=lease.granted_at_utc;
+  if(!canonical(expiry)||!canonical(issued)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  const end=Date.parse(expiry),start=Date.parse(issued);
+  if(!Number.isFinite(end)||!Number.isFinite(start)){
+    return {ok:false,reason:'expiry-invalid',expires_at_utc:null,remaining_ms:null};
+  }
+  const duration=end-start;
+  if(duration<=0||duration>3_600_000){
+    return {ok:false,reason:'expiry-window-invalid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  const observed=now instanceof Date?now.getTime():NaN;
+  if(!Number.isFinite(observed)){
+    return {ok:false,reason:'clock-invalid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  if(observed<start){
+    return {ok:false,reason:'not-yet-valid',expires_at_utc:expiry,remaining_ms:null};
+  }
+  if(observed>=end){
+    return {ok:false,reason:'expired',expires_at_utc:expiry,remaining_ms:0};
+  }
+  return {ok:true,reason:null,expires_at_utc:expiry,remaining_ms:end-observed};
+}
+
 export async function autonomousSessionStatus(policy, now = new Date()) {
   let lease,leaseBytes;
   try { leaseBytes=await readFile(policy.lease_file); lease = JSON.parse(decodeUtf8Strict(leaseBytes)); }
@@ -164,15 +201,25 @@ export async function autonomousSessionStatus(policy, now = new Date()) {
     return { configured:true, armed:false, reason:'lease-schema', expires_at_utc:null };
   }
   if (lease.policy_sha256 !== policy.policy_sha256) return { configured:true, armed:false, reason:'policy-digest', expires_at_utc:null };
+  // Controller and runtime must agree on the exact Coding authority policy
+  // for every signed v2 Autonomous grant, including after generation changes.
+  if (lease.schema === AUTONOMOUS_GRANT_SCHEMA &&
+      lease.coding_policy_sha256 !== policy.coding_policy_sha256) {
+    return { configured:true, armed:false, reason:'coding-policy-digest', expires_at_utc:null };
+  }
   if (typeof lease.instance_nonce !== 'string' || !SHA256_RE.test(lease.instance_nonce)) return { configured:true, armed:false, reason:'nonce-invalid', expires_at_utc:null };
   const roots = Array.isArray(lease.root_ids) ? [...new Set(lease.root_ids)] : [];
   if (roots.length < 1 || roots.some(id => !policy.root_ids.includes(id))) return { configured:true, armed:false, reason:'roots-invalid', expires_at_utc:null };
   if (lease.schema === AUTONOMOUS_GRANT_SCHEMA) {
+    const window=inspectAutonomousStandingWindow(lease,now);
+    if(!window.ok) return {configured:true,armed:false,reason:window.reason,
+      expires_at_utc:window.expires_at_utc,remaining_ms:window.remaining_ms,
+      standing:false,instance_nonce:lease.instance_nonce,root_ids:roots};
     const epoch=await verifyStandingGrantEpoch({plane:'autonomous',grantFile:policy.lease_file,grantBytes:leaseBytes,grantInstanceNonce:lease.instance_nonce,policyPath:policy.policy_path});
-    if(!epoch.trusted)return { configured:true,armed:false,reason:epoch.reason,expires_at_utc:null,
-      remaining_ms:null,standing:false,instance_nonce:lease.instance_nonce,root_ids:roots };
-    return { configured:true, armed:true, reason:'standing-grant', expires_at_utc:null,
-      remaining_ms:null, standing:true, instance_nonce:lease.instance_nonce, root_ids:roots, authority_epoch:epoch };
+    if(!epoch.trusted)return { configured:true,armed:false,reason:epoch.reason,expires_at_utc:window.expires_at_utc,
+      remaining_ms:window.remaining_ms,standing:false,instance_nonce:lease.instance_nonce,root_ids:roots };
+    return { configured:true, armed:true, reason:'standing-grant', expires_at_utc:window.expires_at_utc,
+      remaining_ms:window.remaining_ms, standing:true, instance_nonce:lease.instance_nonce, root_ids:roots, authority_epoch:epoch };
   }
   const expires = Date.parse(lease.expires_at_utc);
   if (!Number.isFinite(expires)) return { configured:true, armed:false, reason:'expiry-invalid', expires_at_utc:null };

package/src/capability-ledger.mjs

@@ -152,7 +152,7 @@ export const R36_CAPABILITY_ENTRIES=Object.freeze([
   gateway('desktop.action','desktop_action','desktop_control','action','DEADBYTE_DESKTOP_RUNTIME','desktop',{mutating:true,receipt_class:'desktop'}),
 
   direct('autonomous.session_status','autonomous_session_status','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'autonomous'}),
-  direct('native_diff.preview','native_diff_preview','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
+  direct('native_diff.preview','native_diff_preview','DEADBYTE_AUTONOMOUS_RUNTIME','coding',{receipt_class:'native_diff'}),
   direct('native_diff.apply','native_diff_apply','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'native_diff'}),
   direct('native_diff.verify','native_diff_verify','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{receipt_class:'verification'}),
   direct('autonomous.goal_submit','autonomous_goal_submit','DEADBYTE_AUTONOMOUS_RUNTIME','autonomous',{mutating:true,receipt_class:'autonomous'}),

package/src/capability-resolver.mjs

@@ -3,7 +3,8 @@ import { assertHostArmed } from './host-plane.mjs';
 
 const CODING_ARMED_READ_CAPABILITIES = new Set([
   'coding.tree','coding.stat','coding.search','coding.files_read','coding.file_read',
-  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview'
+  'semantic.outline','semantic.definition','semantic.references','semantic.diagnostics','semantic.implementations','semantic.rename_preview',
+  'native_diff.preview'
 ]);
 
 export const CAPABILITY_STATES = Object.freeze({

package/src/commander-compat-runtime.mjs

@@ -20,7 +20,7 @@ const CONTRACTS = Object.freeze({
   get_recent_tool_calls:{native:'operation_history.recent',required:[],mutation:false},
   get_usage_stats:{native:'operation_history.stats',required:[],mutation:false},
   give_feedback_to_desktop_commander:{native:'commander.feedback',required:['message'],mutation:true},
-  host_exec:{native:'host.exec',required:['command_id','root_id','script_path','script_sha256'],mutation:true},
+  host_exec:{native:'host.exec',required:['root_id'],mutation:true},
   host_file_read:{native:'host.file_read',required:['path'],mutation:false},
   host_file_write:{native:'host.file_write',required:['path','content','expected_sha256'],mutation:true},
   interact_with_process:{native:'process.input',required:['session_id','input'],mutation:true},
@@ -53,13 +53,41 @@ export function commanderCompatibilityContract(name) {
   return CONTRACTS[name] ?? {native:DEADBYTE_NATIVE_TOOLS[name] ?? null,required:[],mutation:false};
 }
 
+function validateHostExecRequest(args) {
+  const mode=args.mode??'script';
+  const common=['mode','root_id','cwd','timeout_ms'];
+  let required, allowed;
+  if(mode==='script'){
+    required=['root_id','command_id','script_path','script_sha256'];
+    allowed=[...common,'command_id','script_path','script_sha256','args'];
+  }else if(mode==='inline'){
+    required=['root_id','command_id','command'];
+    allowed=[...common,'command_id','command'];
+  }else if(mode==='native'){
+    required=['root_id','executable','executable_sha256'];
+    allowed=[...common,'executable','executable_sha256','args'];
+  }else{
+    throw new Error('host_exec mode must be script, inline, or native');
+  }
+  const missing=required.filter(k=>!own(args,k)||args[k]===undefined||args[k]===null||args[k]==='');
+  if(missing.length) throw new Error(`missing required fields: ${missing.join(', ')}`);
+  const unknown=Object.keys(args).filter(k=>!allowed.includes(k));
+  if(unknown.length) throw new Error(`host_exec ${mode} unexpected fields: ${unknown.join(', ')}`);
+  const id=/^[A-Za-z0-9._-]{1,64}$/;
+  if(typeof args.root_id!=='string'||!id.test(args.root_id)) throw new Error('host_exec root_id invalid');
+  if(mode!=='native'&&(typeof args.command_id!=='string'||!id.test(args.command_id))) throw new Error('host_exec command_id invalid');
+  if(mode==='inline'&&(typeof args.command!=='string'||args.command.length>262144||args.command.includes(String.fromCharCode(0)))) throw new Error('host_exec inline command invalid');
+  if(mode==='script'&&!/^[0-9a-f]{64}$/.test(args.script_sha256)) throw new Error('host_exec script_sha256 invalid');
+  if(mode==='native'&&!/^[0-9a-f]{64}$/.test(args.executable_sha256)) throw new Error('host_exec executable_sha256 invalid');
+}
+
 export function validateCommanderRequest(name,args={}) {
   const c=commanderCompatibilityContract(name);
   if (!args || typeof args!=='object' || Array.isArray(args)) throw new Error('request arguments must be an object');
   const missing=c.required.filter(k=>!own(args,k)||args[k]===undefined||args[k]===null||args[k]==='');
   if(missing.length) throw new Error(`missing required fields: ${missing.join(', ')}`);
   if(c.mutation && !['create_directory','start_process','force_terminate','kill_process','interact_with_process','host_exec'].includes(name) && !('expected_sha256' in args) && !('expected_source_identity' in args)) throw new Error('mutation requires an explicit precondition');
-  if((name==='host_exec') && typeof args.script_sha256!=='string') throw new Error('host_exec requires hash-pinned script');
+  if(name==='host_exec') validateHostExecRequest(args);
   return Object.freeze({commander_tool:name,native_tool:c.native,mutation:c.mutation,args});
 }