deadbyte-mcp 0.15.46 → 0.15.48

package/src/privileged-install-trust-r89.mjs

@@ -0,0 +1,196 @@
+// R89 development: fail closed before requiring a privileged Windows native addon.
+// Trust is an OS-owned installation property, not a manifest hash or npm version.
+// This checks an honest process against lower-trust filesystem principals; it is
+// NOT an attestation against a malicious actor already executing with equivalent
+// write/administrative rights, or against a compromised Node/PowerShell runtime.
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import path from 'node:path';
+
+const execFileAsync=promisify(execFile);
+function windowsPowerShellEnvironment(base=process.env){
+  const env={...base};
+  // The ACL probe must not autoload commands from caller-controlled module
+  // directories. Its executable is pinned to C:\Windows below, so use only
+  // that installation's built-in modules and matching OS-root variables.
+  for(const key of Object.keys(env)){
+    if(['psmodulepath','systemroot','windir'].includes(key.toLowerCase()))delete env[key];
+  }
+  env.SystemRoot='C:\\Windows';
+  env.WINDIR='C:\\Windows';
+  env.PSModulePath='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules';
+  return env;
+}
+const DRIVE=/^[A-Za-z]:\\/;
+const SYSTEM='S-1-5-18';
+const ADMINISTRATORS='S-1-5-32-544';
+const TRUSTED_INSTALLER='S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464';
+const TRUSTED=new Set([SYSTEM,ADMINISTRATORS,TRUSTED_INSTALLER]);
+// Block untrusted changes to an existing directory or file, including security
+// descriptor, content, attributes, or deletion. Create-child alone is not enough
+// to replace an existing child, but full Modify contains DELETE and is denied.
+const COMMON_MUTATION=0x000d0150;  // WRITE_EA, DELETE_CHILD, WRITE_ATTRIBUTES, DELETE, WRITE_DAC, WRITE_OWNER
+const FILE_MUTATION=COMMON_MUTATION|0x00000002|0x00000004; // WRITE_DATA / APPEND_DATA
+const DIR_MUTATION=COMMON_MUTATION;
+// Win32 ACEs may retain generic/indeterminate masks rather than expanded
+// FILE_GENERIC_WRITE/FILE_ALL_ACCESS. Do not treat those as harmless.
+const GENERIC_WRITE_OR_ALL=0x40000000|0x10000000;
+const INDETERMINATE_ACCESS=0x02000000; // MAXIMUM_ALLOWED is not a finite read-only grant
+const ANY_MUTATION_OR_UNDECIDABLE=(GENERIC_WRITE_OR_ALL|INDETERMINATE_ACCESS);
+// Windows ACE scope is not the same as ACE inheritance origin. INHERIT_ONLY
+// means the ACE does NOT apply to the currently inspected file/directory;
+// it may apply to children, which are checked separately in the path chain.
+// Missing / malformed scope must never silently become an allow.
+const INHERIT_ONLY=2; // .NET PropagationFlags.InheritOnly=2; NoPropagateInherit=1
+const KNOWN_INHERITANCE_FLAGS=3; // ContainerInherit | ObjectInherit
+const KNOWN_PROPAGATION_FLAGS=3; // InheritOnly | NoPropagateInherit
+
+function normalizeWindows(file){
+  if(typeof file!=='string'||!DRIVE.test(file)||file.includes('\0')||file.startsWith('\\\\'))
+    throw new Error('R89 privileged path must be a Windows drive-absolute path');
+  const normalized=path.win32.normalize(file);
+  if(!DRIVE.test(normalized))throw new Error('R89 privileged path normalization invalid');
+  return normalized.toLowerCase();
+}
+export function privilegedEpochInstallFiles(root,nodeExecutable){
+  const join=(...segments)=>path.win32.join(root,...segments);
+  return [nodeExecutable,
+    join('bin','deadbyte-epoch-lock-r85.node'),
+    join('docs','R85-EPOCH-LOCK-BINARY.json'),
+    join('native','deadbyte-epoch-lock-r85.cpp'),
+    join('src','epoch-lock-r85.mjs'),
+    join('src','privileged-install-trust-r89.mjs'),
+    join('src','authority-continuity-r65.mjs'),
+    join('src','canonical-json.mjs'),
+    join('src','text-policy.mjs'),
+    join('src','foreground-marker-cas-win32.mjs'),
+    join('src','foreground-process-identity.mjs'),
+    join('src','windows-powershell-environment.mjs')];
+}
+export function requiredAclPathChain(files){
+  if(!Array.isArray(files)||files.length<1||files.length>32)
+    throw new Error('R89 privileged path inventory invalid');
+  const seen=new Set();
+  for(const file of files){
+    let current=normalizeWindows(file);
+    for(let depth=0;depth<128;depth++){
+      seen.add(current);
+      const parent=path.win32.dirname(current);
+      if(parent===current)break;
+      if(depth===127)throw new Error('R89 privileged ancestor depth exceeded');
+      current=parent;
+    }
+  }
+  return [...seen].sort();
+}
+
+// Pure conservative evaluator. Records must come from Windows Get-Acl, never
+// from a writable package file, environment variable or release metadata.
+export function evaluatePrivilegedAclSnapshot(records,files){
+  const required=requiredAclPathChain(files);
+  if(!Array.isArray(records)||records.length!==required.length)
+    return Object.freeze({trusted:false,reason:'INCOMPLETE_ACL_SNAPSHOT'});
+  const byPath=new Map();
+  for(const rec of records){
+    let key;
+    try{key=normalizeWindows(rec?.path);}catch{return Object.freeze({trusted:false,reason:'INVALID_ACL_PATH'});}
+    if(byPath.has(key))return Object.freeze({trusted:false,reason:'DUPLICATE_ACL_PATH',path:key});
+    byPath.set(key,rec);
+  }
+  const leaves=new Set(files.map(normalizeWindows));
+  for(const file of required){
+    const rec=byPath.get(file);
+    if(!rec)return Object.freeze({trusted:false,reason:'MISSING_ACL_NODE',path:file});
+    if(rec.reparse!==false || typeof rec.directory!=='boolean' ||
+        !TRUSTED.has(rec.owner) || !Array.isArray(rec.aces))
+      return Object.freeze({trusted:false,reason:'UNTRUSTED_OWNER_OR_REPARSE',path:file});
+    if(leaves.has(file)&&rec.directory===true)
+      return Object.freeze({trusted:false,reason:'EXPECTED_FILE_NOT_FILE',path:file});
+    if(!leaves.has(file)&&rec.directory!==true)
+      return Object.freeze({trusted:false,reason:'EXPECTED_PARENT_NOT_DIRECTORY',path:file});
+    for(const ace of rec.aces){
+      if(!ace||typeof ace.sid!=='string'||!['Allow','Deny'].includes(ace.type)||
+         !Number.isSafeInteger(ace.mask)||ace.mask<0||ace.mask>0xffffffff)
+        return Object.freeze({trusted:false,reason:'UNKNOWN_ACL_RULE',path:file});
+      // These values are obtained directly from OS AccessRule fields below.
+      // An inheritance-only CREATOR OWNER placeholder is not an effective
+      // mutation grant on THIS object. An effective CREATOR OWNER ACE (or an
+      // untrusted effective GENERIC_ALL) is still rejected, not whitelisted.
+      if(!Number.isInteger(ace.inheritance)||ace.inheritance<0||
+         (ace.inheritance&~KNOWN_INHERITANCE_FLAGS)!==0||
+         !Number.isInteger(ace.propagation)||ace.propagation<0||
+         (ace.propagation&~KNOWN_PROPAGATION_FLAGS)!==0||
+         (ace.propagation!==0&&ace.inheritance===0)||
+         ((ace.propagation&INHERIT_ONLY)!==0&&(!rec.directory||ace.inheritance===0)))
+        return Object.freeze({trusted:false,reason:'UNKNOWN_ACL_SCOPE',path:file});
+      if((ace.propagation&INHERIT_ONLY)!==0)continue;
+      if(ace.type==='Allow'&&!TRUSTED.has(ace.sid)&&
+          (ace.mask&((rec.directory?DIR_MUTATION:FILE_MUTATION)|ANY_MUTATION_OR_UNDECIDABLE))!==0)
+        return Object.freeze({trusted:false,reason:'UNTRUSTED_WRITE_ACE',path:file,sid:ace.sid});
+    }
+  }
+  return Object.freeze({trusted:true,reason:'PROTECTED_INSTALLATION_ACL_SNAPSHOT'});
+}
+
+// This command is compiled into the module; it does NOT run a repo-local .ps1.
+// Errors, unknown ACEs/SIDs and inaccessible paths are fatal.
+const aclProbe=String.raw`
+$ErrorActionPreference='Stop'; Set-StrictMode -Version Latest
+try {
+  $utf8=[Text.Encoding]::UTF8
+  $files=ConvertFrom-Json -InputObject ($utf8.GetString([Convert]::FromBase64String('__PATHS_BASE64__')))
+  $seen=[System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+  $items=New-Object System.Collections.ArrayList
+  foreach($p in @($files)) {
+    $node=[IO.Path]::GetFullPath([string]$p)
+    while($true) {
+      if($seen.Add($node)) {
+        $item=Get-Item -LiteralPath $node -Force -ErrorAction Stop
+        $acl=Get-Acl -LiteralPath $node -ErrorAction Stop
+        $owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        $aces=New-Object System.Collections.ArrayList
+        foreach($entry in $acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])) {
+          [void]$aces.Add(@{sid=$entry.IdentityReference.Value;type=$entry.AccessControlType.ToString();mask=([int64]$entry.FileSystemRights -band [int64]4294967295);inheritance=[int]$entry.InheritanceFlags;propagation=[int]$entry.PropagationFlags})
+        }
+        [void]$items.Add(@{path=$node;owner=$owner;reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);directory=[bool]$item.PSIsContainer;aces=@($aces.ToArray())})
+      }
+      $parent=[IO.Directory]::GetParent($node)
+      if($null -eq $parent){break}
+      $node=$parent.FullName
+    }
+  }
+  ConvertTo-Json -InputObject @($items.ToArray()) -Depth 9 -Compress
+} catch { [Console]::Error.WriteLine('R89_ACL_PROBE_FAILED: '+$_.Exception.GetType().Name); exit 12 }
+`;
+
+export async function inspectTrustedInstallation(files){
+  if(process.platform!=='win32'||process.arch!=='x64')
+    throw new Error('R89 privileged native loading requires Windows x64');
+  const required=requiredAclPathChain(files);
+  // Absolute OS executable: do not resolve a user-controlled PATH, run a
+  // repo-owned helper, or honor a caller-provided tool override.
+  const ps='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+  const json=Buffer.from(JSON.stringify(files),'utf8').toString('base64');
+  const script=aclProbe.replace('__PATHS_BASE64__',json);
+  const encoded=Buffer.from(script,'utf16le').toString('base64');
+  let stdout;
+  try{
+    ({stdout}=await execFileAsync(ps,['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+      {windowsHide:true,timeout:12000,maxBuffer:512*1024,encoding:'utf8',env:windowsPowerShellEnvironment()}));
+  }catch(error){
+    throw Object.assign(new Error('R89 privileged installation ACL inspection failed closed',{cause:error}),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+  }
+  let records;
+  try{records=JSON.parse(stdout);}catch{
+    throw Object.assign(new Error('R89 privileged installation ACL response invalid'),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+  }
+  const decision=evaluatePrivilegedAclSnapshot(records,files);
+  if(!decision.trusted){
+    throw Object.assign(new Error(`R89 privileged installation not protected: ${decision.reason}`),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED',reason:decision.reason});
+  }
+  if(required.length!==records.length)throw new Error('R89 ACL result cardinality changed');
+  return decision;
+}

package/src/remote-session-guardian.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { lstat, readFile, rm } from 'node:fs/promises';
+import { lstat } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
@@ -7,6 +7,7 @@ import { setTimeout as sleep } from 'node:timers/promises';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import { AUTHORITY_PLANES, parseAuthorityObservation, assertAuthorityVector } from './remote-authority.mjs';
+import { readRemoteMarkerSnapshot, deletePinnedRemoteMarker } from './foreground-marker-cas-win32.mjs';
 
 const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
 // This inherited IPC channel is an OS-owned parent lifetime handle, not a PID
@@ -33,10 +34,8 @@ function pidAlive(pid){
   catch(error){return error?.code!=='ESRCH';}
 }
 async function readMarker(file){
-  let text;
-  try{text=await readFile(file,'utf8');}
-  catch(error){if(error?.code==='ENOENT') return null;throw error;}
-  try{return JSON.parse(text);}catch{return null;}
+  const snapshot=await readRemoteMarkerSnapshot(file);
+  return snapshot?.marker??null;
 }
 function markerMatches(marker,{ownerPid,nonce}){
   return marker?.schema==='deadbyte.remote-session.v2'&&
@@ -99,8 +98,11 @@ async function main(){
     if(observed.state==='ONLINE'&&!invokeCleanup(powershell,launcher,'machinetest',root,'revoked'))
       throw new Error('guardian runtime enforcement cleanup unverified; ownership marker retained');
     if(!invokeCleanup(powershell,launcher,'park',root)) throw new Error('guardian park failed; ownership marker retained');
-    const current=await readMarker(markerPath);
-    if(current&&markerMatches(current,{ownerPid,nonce})) await rm(markerPath,{force:true});
+    const current=await readRemoteMarkerSnapshot(markerPath);
+    if(!current)return;
+    if(!markerMatches(current.marker,{ownerPid,nonce}))return;
+    if(deletePinnedRemoteMarker(markerPath,current.sha256)!=='REMOVED')
+      throw new Error('guardian marker changed before native deletion; marker retained');
     return;
   }
 }

package/src/runtime-update.mjs

@@ -21,6 +21,9 @@ import { resolveStateRoot } from './state-root.mjs';
 import {canonicalLauncherPaths,assertCanonicalLaunchers,renderStateBoundLauncherCmd} from './launcher-isolation.mjs';
 import {assertStageOwnedPath,assertStagingBootstrapInputs,assertStagingControlConfig} from './staging-input-isolation.mjs';
 import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
+import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
+
+export {windowsPowerShellEnvironment};
 
 const HEX64=/^[0-9a-f]{64}$/;
 const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -216,31 +219,11 @@ export function parseRollbackArgs(argv){
 }
 
 function powershellPath(){
-  return path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
-}
-export function windowsPowerShellEnvironment(base=process.env){
-  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
-  const userProfile=base.USERPROFILE||os.homedir();
-  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
-  const environment={...base};
-  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath').flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
-  for(const key of Object.keys(environment)) if(key.toLowerCase()==='psmodulepath') delete environment[key];
-  const modules=[
-    path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
-    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
-    path.join(programFiles,'WindowsPowerShell','Modules'),
-    ...inherited
-  ];
-  const seen=new Set();
-  return {...environment,PSModulePath:modules.filter(modulePath=>{
-    const key=modulePath.toLowerCase();
-    if(seen.has(key)) return false;
-    seen.add(key);return true;
-  }).join(';')};
+  return 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
 }
 function commandEnvironment(exe,base=process.env){
   return path.resolve(exe).toLowerCase()===path.resolve(powershellPath()).toLowerCase()
-    ?windowsPowerShellEnvironment(base):base;
+    ?windowsPowerShellEnvironment({...base,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'}):base;
 }
 function runCaptured(exe,args,{cwd,env,timeoutMs=45000}={}){
   const baseEnv=env??process.env;

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.46';
+export const DEADBYTE_VERSION = '0.15.48';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/src/windows-powershell-environment.mjs

@@ -0,0 +1,24 @@
+// Dependency-light PowerShell child environment for security-critical process
+// identity and pinned-marker operations. Do not import the updater here.
+import os from 'node:os';
+import path from 'node:path';
+
+export function windowsPowerShellEnvironment(base=process.env){
+  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
+  const userProfile=base.USERPROFILE||os.homedir();
+  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
+  const hasWindir=Object.keys(base).some(key=>key.toLowerCase()==='windir');
+  const environment={...base};
+  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath')
+    .flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
+  for(const key of Object.keys(environment))if(['psmodulepath','systemroot','windir'].includes(key.toLowerCase()))delete environment[key];
+  environment.SystemRoot=systemRoot;
+  if(hasWindir)environment.WINDIR=systemRoot;
+  const modules=[path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
+    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
+    path.join(programFiles,'WindowsPowerShell','Modules'),...inherited];
+  const seen=new Set();
+  return {...environment,PSModulePath:modules.filter(item=>{
+    const key=item.toLowerCase();if(seen.has(key))return false;seen.add(key);return true;
+  }).join(';')};
+}

package/test/atomic-mutation.test.mjs

@@ -1,10 +1,13 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {createHash} from 'node:crypto';
-import {mkdtemp,readFile,rm,writeFile} from 'node:fs/promises';
+import {mkdtemp,readFile,rm,utimes,writeFile} from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import {atomicMutation} from '../src/atomic-mutation.mjs';
+import {pathToFileURL} from 'node:url';
+
+const modulePath=process.env.DEADBYTE_R73_ATOMIC_BASELINE;
+const {atomicMutation}=await import(modulePath?pathToFileURL(modulePath).href:'../src/atomic-mutation.mjs');
 
 const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
 
@@ -59,3 +62,66 @@ test('postcondition verifier loss after exact commit is explicit unknown effect'
     assert.equal(await readFile(target,'utf8'),'new');
   }finally{await rm(root,{recursive:true,force:true});}
 });
+
+test('an old lock owned by a live writer is not reclaimed by a concurrent writer',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-atomic-live-lock-'));
+  const target=path.join(root,'value.txt');await writeFile(target,'old');
+  const oldHash=digest(Buffer.from('old'));
+  const readState=async file=>{const bytes=await readFile(file);return {exists:true,sha256:digest(bytes)};};
+  let enter;
+  const entered=new Promise(resolve=>{enter=resolve;});
+  let release;
+  const held=new Promise(resolve=>{release=resolve;});
+  const first=atomicMutation({target,bytes:Buffer.from('first'),expected:oldHash,readState,
+    assertExpected(state,expected){assert.equal(state.sha256,expected);},
+    authorityCheck:async()=>{enter();await held;}
+  });
+  try{
+    await entered;
+    const lock=`${target}.deadbyte-mutation.lock`;
+    const stale=new Date(Date.now()-180000);
+    await utimes(lock,stale,stale);
+    const second=atomicMutation({target,bytes:Buffer.from('second'),expected:oldHash,readState,
+      assertExpected(state,expected){assert.equal(state.sha256,expected);}
+    }).then(()=>({status:'committed'}),error=>({status:'rejected',error}));
+    const early=await Promise.race([second,new Promise(resolve=>setTimeout(()=>resolve({status:'waiting'}),250))]);
+    release();
+    await first;
+    const result=await second;
+    assert.equal(early.status,'waiting','second writer entered while the first still owned the lock');
+    assert.equal(result.status,'rejected');
+    assert.equal(await readFile(target,'utf8'),'first');
+  }finally{release();await first.catch(()=>{});await rm(root,{recursive:true,force:true});}
+});
+
+test('an aged lock from a dead owner cannot be stolen without atomic ownership proof',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-atomic-dead-lock-'));
+  const target=path.join(root,'value.txt');await writeFile(target,'old');
+  const lock=`${target}.deadbyte-mutation.lock`;
+  await writeFile(lock,'999999999:0:abandoned');
+  const stale=new Date(Date.now()-180000);await utimes(lock,stale,stale);
+  const readState=async file=>{const bytes=await readFile(file);return {exists:true,sha256:digest(bytes)};};
+  try{
+    await assert.rejects(atomicMutation({target,bytes:Buffer.from('new'),expected:digest(Buffer.from('old')),readState,
+      assertExpected(state,expected){assert.equal(state.sha256,expected);}
+    }),/abandoned.*reconciliation/i);
+    assert.equal(await readFile(target,'utf8'),'old');
+    assert.equal(await readFile(lock,'utf8'),'999999999:0:abandoned');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('lock ownership loss after commit is classified as an unknown-effect failure',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-atomic-lock-loss-'));
+  const target=path.join(root,'value.txt');await writeFile(target,'old');
+  const readState=async file=>{const bytes=await readFile(file);return {exists:true,sha256:digest(bytes)};};
+  try{
+    const error=await atomicMutation({target,bytes:Buffer.from('new'),expected:digest(Buffer.from('old')),readState,
+      assertExpected(state,expected){assert.equal(state.sha256,expected);},
+      verifyPostcondition:async()=>{await writeFile(`${target}.deadbyte-mutation.lock`,'foreign-owner');}
+    }).then(()=>null,e=>e);
+    assert.equal(error?.outcome,'FAILED_AFTER_UNKNOWN_EFFECT');
+    assert.equal(error?.lock_cleanup_failed,true);
+    assert.equal(await readFile(target,'utf8'),'new');
+    assert.equal(await readFile(`${target}.deadbyte-mutation.lock`,'utf8'),'foreign-owner');
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/cli-entrypoint.test.mjs

@@ -44,7 +44,7 @@ test('npx CLI exposes local supervisor lifecycle without any supervisor arm comm
   assert.match(source,/supervisorstop/);
   assert.match(source,/supervisorstatus/);
   assert.match(source,/supervisorrecover/);
-  const mapping=source.match(/const SUPERVISOR_COMMANDS=.*?;\n/s)?.[0]??'';
+  const mapping=source.match(/const SUPERVISOR_COMMANDS=[^;]*;/s)?.[0]??'';
   assert.doesNotMatch(mapping,/arm(?:coding|autonomous|process|host)/i);
   assert.match(source,/npx -y \$\{exact\} supervisor status/);
 });

package/test/commander-schema-differential-r48.test.mjs

@@ -5,7 +5,7 @@ import {readFile} from 'node:fs/promises';
 import {createCommanderWireAdapter} from '../src/commander-wire-adapter-r47.mjs';
 import {registerCommanderExtendedBridge} from '../src/commander-extended-bridge-r47.mjs';
 
-const referencePath='D:\\Projects\\deadbyte-mcp\\references\\desktop-commander\\dist\\tools\\schemas.js';
+const referencePath='D:\\Projects\\deadbyte-mcp\\references\\desktop-commander v0.2.52\\dist\\tools\\schemas.js';
 const expectedHash='f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140';
 async function referenceSchemas(){
   let source=await readFile(referencePath,'utf8');

package/test/helpers/r75-authority-proof.mjs

@@ -0,0 +1,9 @@
+// Unit fixtures use synthetic observations; integration tests verify real policy/grant files.
+export function withAuthorityProof(observation){
+  const authority_proof=Object.fromEntries(Object.entries(observation.authority).map(([plane,entry])=>{
+    const armed=typeof entry==='boolean'?entry:entry.armed;
+    return [plane,{state:armed?'VERIFIED_ARMED':'VERIFIED_DISARMED',
+      policy_sha256:observation.policy_sha256[plane],grant_absent:!armed}];
+  }));
+  return {...observation,authority_proof};
+}

package/test/r100-posix-owned-lock-race.test.mjs

@@ -0,0 +1,72 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rename,rm,access} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {pathToFileURL} from 'node:url';
+
+const source=process.env.R100_BASELINE_SOURCE
+  ?pathToFileURL(process.env.R100_BASELINE_SOURCE)
+  :new URL('../src/authority-continuity-r65.mjs',import.meta.url);
+const {createAuthorityEpochStore}=await import(source.href);
+
+test('R100 POSIX owned release cannot unlink a byte-identical successor lock',
+  {skip:process.platform==='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r100-posix-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:nonce}));
+      const lock=path.join(runtimeDir,'authority-epochs','process','.lock');
+      let replaced=0,successor;
+      const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,file)=>{
+        if(stage!=='release_before_cas')return;
+        assert.equal(file,lock);
+        successor=await readFile(lock);
+        const other=lock+'.successor';
+        await writeFile(other,successor,{flag:'wx'});
+        await rename(other,lock);
+        replaced++;
+      }});
+      await assert.rejects(store.append({plane:'process',action:'grant',grantBytes,
+        grantInstanceNonce:nonce}),/authority epoch lock changed|ownership lost|POSIX.*unsupported/);
+      if(replaced===0){
+        await assert.rejects(access(path.join(runtimeDir,'authority-epochs','process','head.json')),{code:'ENOENT'});
+      }else{
+        assert.equal(replaced,1,'replacement interleave must execute at most once');
+        assert.deepEqual(await readFile(lock),successor,'byte-identical successor lock must survive');
+      }
+    }finally{await rm(root,{recursive:true,force:true});}
+  });
+
+test('R100 POSIX unsupported mutation makes no epoch directory and preserves an existing lock',
+  {skip:process.platform==='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r100-no-side-effect-'));
+    try{
+      const runtimeDir=path.join(root,'runtime');
+      const trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:nonce}));
+      const operation=()=>createAuthorityEpochStore({runtimeDir}).append({plane:'process',action:'grant',
+        grantBytes,grantInstanceNonce:nonce});
+      await assert.rejects(operation,/authority epoch POSIX mutation unsupported/);
+      const epochDir=path.join(runtimeDir,'authority-epochs','process');
+      await assert.rejects(access(epochDir),{code:'ENOENT'});
+      assert.equal(await createAuthorityEpochStore({runtimeDir}).readHead({plane:'process'}),null,
+        'read-only empty-head inspection remains available');
+      await mkdir(epochDir,{recursive:true});
+      const lock=path.join(epochDir,'.lock'),original=Buffer.from('not-an-owned-lock');
+      await writeFile(lock,original,{flag:'wx'});
+      await assert.rejects(operation,/authority epoch POSIX mutation unsupported/);
+      assert.deepEqual(await readFile(lock),original);
+    }finally{await rm(root,{recursive:true,force:true});}
+  });

package/test/r101-acl-probe-environment.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {createRequire, syncBuiltinESMExports} from 'node:module';
+import {pathToFileURL} from 'node:url';
+import path from 'node:path';
+
+const require=createRequire(import.meta.url);
+
+test('R101 privileged ACL probe excludes inherited module roots at child dispatch',
+  {skip:process.platform!=='win32'}, async()=>{
+    const childProcess=require('node:child_process');
+    const originalExecFile=childProcess.execFile;
+    const originalModulePath=process.env.PSModulePath;
+    const originalSystemRoot=process.env.SystemRoot;
+    let captured;
+    try {
+      childProcess.execFile=(executable,args,options,callback)=>{
+        captured={executable,args,environment:options.env};
+        callback(Object.assign(new Error('test stopped child before execution'),{code:'TEST_STOP'}));
+      };
+      syncBuiltinESMExports();
+      process.env.PSModulePath='C:\\r101-poisoned-module-root';
+      process.env.SystemRoot='C:\\r101-false-windows-root';
+      const target=process.env.R101_BASELINE_SOURCE
+        ? pathToFileURL(path.join(process.env.R101_BASELINE_SOURCE,'src','privileged-install-trust-r89.mjs'))
+        : new URL('../src/privileged-install-trust-r89.mjs',import.meta.url);
+      const {inspectTrustedInstallation}=await import(`${target.href}?r101-acl-probe`);
+      await assert.rejects(inspectTrustedInstallation(['C:\\Program Files\\Deadbyte\\bin\\addon.node']),
+        {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+      assert.ok(captured,'ACL child must have been dispatched');
+      assert.equal(captured.executable,'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+      assert.equal(captured.environment.PSModulePath,
+        'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules');
+      assert.equal(captured.environment.SystemRoot,'C:\\Windows');
+      assert.equal(captured.environment.WINDIR,'C:\\Windows');
+      const observed=spawnSync(captured.executable,['-NoLogo','-NoProfile','-NonInteractive',
+        '-Command',"(Get-Command Get-Acl -ErrorAction Stop).Module.Path"],
+        {env:captured.environment,encoding:'utf8',timeout:12000,windowsHide:true});
+      assert.equal(observed.status,0,observed.stderr);
+      assert.match(observed.stdout.trim(),
+        /^C:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\Modules\\Microsoft\.PowerShell\.Security\\/i);
+    } finally {
+      childProcess.execFile=originalExecFile;
+      syncBuiltinESMExports();
+      if(originalModulePath===undefined)delete process.env.PSModulePath;
+      else process.env.PSModulePath=originalModulePath;
+      if(originalSystemRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=originalSystemRoot;
+    }
+  });

package/test/r106-trusted-powershell-spawn.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {windowsPowerShellEnvironment} from '../src/windows-powershell-environment.mjs';
+
+const TRUSTED_POWERSHELL='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+
+test('PowerShell child environment collapses case-variant Windows root keys',()=>{
+  const environment=windowsPowerShellEnvironment({
+    SystemRoot:'C:\\Windows',SYSTEMROOT:'C:\\untrusted-root',
+    WINDIR:'C:\\Windows',windir:'C:\\untrusted-root',
+    PSModulePath:'C:\\custom-modules'
+  });
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='systemroot'),['SystemRoot']);
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='windir'),['WINDIR']);
+  assert.equal(environment.SystemRoot,'C:\\Windows');
+  assert.equal(environment.WINDIR,'C:\\Windows');
+});
+
+test('security-sensitive Windows probes cannot select PowerShell via caller environment',
+  {skip:process.platform!=='win32',concurrency:false},async()=>{
+    const originalSpawn=childProcess.spawnSync;
+    const originalRoot=process.env.SystemRoot;
+    const originalWindir=process.env.WINDIR;
+    const calls=[];
+    try{
+      process.env.SystemRoot='C:\\untrusted-root';
+      process.env.WINDIR='C:\\untrusted-root';
+      childProcess.spawnSync=(file,args,options)=>{
+        calls.push({file,options});
+        return {status:0,stdout:calls.length===1?'MISSING\n':'null\n',stderr:''};
+      };
+      syncBuiltinESMExports();
+      const marker=await import('../src/foreground-marker-cas-win32.mjs');
+      const identity=await import('../src/foreground-process-identity.mjs');
+      assert.equal(marker.readPinnedEpochLockSnapshot('C:\\scratch\\lock.json'),null);
+      assert.equal(identity.queryForegroundIdentity(12345),null);
+      assert.equal(calls.length,2);
+      for(const call of calls){
+        assert.equal(call.file,TRUSTED_POWERSHELL);
+        assert.equal(call.options.env.SystemRoot,'C:\\Windows');
+        assert.equal(call.options.env.WINDIR,'C:\\Windows');
+      }
+    }finally{
+      childProcess.spawnSync=originalSpawn;
+      syncBuiltinESMExports();
+      if(originalRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=originalRoot;
+      if(originalWindir===undefined)delete process.env.WINDIR;
+      else process.env.WINDIR=originalWindir;
+    }
+  });