deadbyte-mcp 0.15.47 → 0.15.49

package/scripts/verify-authority-epoch-history.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import {lstat} from 'node:fs/promises';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const planes = new Set(['process', 'coding', 'autonomous', 'desktop', 'host']);
+const sha256 = /^[0-9a-f]{64}$/;
+
+function parse(argv) {
+  if(argv.length!==6)throw new Error('expected --runtime-dir, --plane, and --expected-head');
+  const args = {};
+  for(let i=0;i<argv.length;i+=2){
+    const flag=argv[i],value=argv[i+1];
+    if(!['--runtime-dir','--plane','--expected-head'].includes(flag)||
+        Object.hasOwn(args,flag)||typeof value!=='string'||value.length===0)
+      throw new Error('authority history audit arguments invalid');
+    args[flag]=value;
+  }
+  const runtimeDir=args['--runtime-dir'],plane=args['--plane'],expectedHead=args['--expected-head'];
+  if(!path.isAbsolute(runtimeDir)||!planes.has(plane)||!sha256.test(expectedHead))
+    throw new Error('authority history audit subject invalid');
+  return {runtimeDir,plane,expectedHead};
+}
+
+async function main() {
+  const {runtimeDir,plane,expectedHead}=parse(process.argv.slice(2));
+  const stat=await lstat(runtimeDir);
+  if(!stat.isDirectory()||stat.isSymbolicLink())throw new Error('authority history audit runtime root invalid');
+  const result=await createAuthorityEpochStore({runtimeDir}).auditHistory({plane});
+  if(result.status!=='PASS'||result.event_sha256!==expectedHead)
+    throw new Error('authority history audit expected head mismatch');
+  process.stdout.write(JSON.stringify(result)+'\n');
+}
+
+main().catch(error=>{
+  process.stderr.write(`AUTHORITY_HISTORY_AUDIT_FAIL ${String(error?.message??error)}\n`);
+  process.exitCode=1;
+});

package/scripts/verify-r70-full-regression.ps1

@@ -1,6 +1,6 @@
 #requires -Version 5.1
 # R70 verifier artifact: runs the candidate test suite without altering release manifests.
-param([switch]$SelfTest)
+param([switch]$SelfTest,[string]$EvidenceRoot='')
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Continue'
 Set-Location -LiteralPath (Split-Path -Parent $PSScriptRoot)
@@ -36,7 +36,17 @@ $selected = @($lines | Where-Object {
 $summary = @($selected | Select-Object -Last 140 | ForEach-Object {
     if ($_.Length -gt 512) { $_.Substring(0, 512) } else { $_ }
 })
-$artifactDir = Join-Path (Get-Location).Path 'testing\r70-verifier'
+if ($EvidenceRoot -and -not $SelfTest) { throw 'EvidenceRoot override is self-test only' }
+$artifactDir = if ($EvidenceRoot) {
+    if (-not [System.IO.Path]::IsPathRooted($EvidenceRoot)) { throw 'EvidenceRoot must be absolute' }
+    $resolved = [System.IO.Path]::GetFullPath($EvidenceRoot)
+    $checkout = [System.IO.Path]::GetFullPath((Get-Location).Path).TrimEnd('\')
+    if ($resolved.TrimEnd('\').Equals($checkout,[System.StringComparison]::OrdinalIgnoreCase) -or
+        $resolved.StartsWith($checkout + '\',[System.StringComparison]::OrdinalIgnoreCase)) {
+        throw 'EvidenceRoot self-test override must be outside the checkout'
+    }
+    $resolved
+} else { Join-Path (Get-Location).Path 'testing\r70-verifier' }
 if (-not (Test-Path -LiteralPath $artifactDir -PathType Container)) {
     New-Item -ItemType Directory -Path $artifactDir -Force | Out-Null
 }

package/src/activation-authority-proof-r75.mjs

@@ -0,0 +1,67 @@
+import {createHash} from 'node:crypto';
+import {lstat,open,realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+const FIELDS=Object.freeze({process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'});
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const within=(root,target)=>{const relative=path.relative(root,target);return relative!==''&&!relative.startsWith('..'+path.sep)&&relative!=='..'&&!path.isAbsolute(relative);};
+const sameFile=(left,right)=>left.isFile()&&right.isFile()&&!left.isSymbolicLink()&&!right.isSymbolicLink()&&
+  left.dev===right.dev&&left.ino===right.ino&&left.size===right.size&&left.mtimeMs===right.mtimeMs&&
+  left.ctimeMs===right.ctimeMs&&left.birthtimeMs===right.birthtimeMs;
+async function readRegularPinned(file,label){
+  const before=await lstat(file);
+  if(!before.isFile()||before.isSymbolicLink())throw new Error(`${label} file type invalid`);
+  const handle=await open(file,'r');
+  try{
+    const opened=await handle.stat();
+    if(!sameFile(before,opened))throw new Error(`${label} identity changed before read`);
+    const bytes=await handle.readFile();
+    const after=await handle.stat(),pathAfter=await lstat(file);
+    if(!sameFile(opened,after)||!sameFile(after,pathAfter))throw new Error(`${label} identity changed during read`);
+    return bytes;
+  }finally{await handle.close();}
+}
+
+export async function observeAuthorityEvidence({stateRoot,policyPaths,policySha256,authority}){
+  const runtimeRoot=await realpath(path.join(stateRoot,'runtime'));
+  const result={};
+  for(const [plane,field] of Object.entries(FIELDS)){
+    const policyPath=policyPaths?.[plane],expectedHash=policySha256?.[plane],entry=authority?.[plane];
+    if(typeof policyPath!=='string'||!path.isAbsolute(policyPath)||!(/^[0-9a-f]{64}$/).test(expectedHash??''))
+      throw new Error(`${plane} policy identity incomplete`);
+    const policyBytes=await readRegularPinned(policyPath,`${plane} policy`);
+    if(sha(policyBytes)!==expectedHash)throw new Error(`${plane} policy digest changed during observation`);
+    let policy;
+    try{policy=JSON.parse(policyBytes.toString('utf8').replace(/^\uFEFF/,''));}
+    catch{throw new Error(`${plane} policy JSON invalid`);}
+    const schemaOk=plane==='host'?['deadbyte.host-policy.v1','deadbyte.host-policy.v2'].includes(policy?.schema):
+      policy?.schema===`deadbyte.${plane}-policy.v1`;
+    if(!schemaOk||policy.enabled!==true||
+        typeof policy[field]!=='string'||!path.isAbsolute(policy[field]))
+      throw new Error(`${plane} policy grant path invalid`);
+    const grantPath=path.resolve(policy[field]);
+    const parent=await realpath(path.dirname(grantPath));
+    if(!within(runtimeRoot,parent)&&parent!==runtimeRoot)throw new Error(`${plane} policy grant path outside runtime`);
+    const checkedPath=path.join(parent,path.basename(grantPath));
+    let grantInfo;
+    try{grantInfo=await lstat(checkedPath);}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+    const grantAbsent=grantInfo===undefined;
+    if(grantInfo&&(!grantInfo.isFile()||grantInfo.isSymbolicLink()))throw new Error(`${plane} grant file type invalid`);
+    const validEntry=entry&&entry.configured===true&&typeof entry.armed==='boolean';
+    const validDisarmed=validEntry&&!entry.armed&&grantAbsent&&
+      (entry.reason==='disarmed'||(plane==='autonomous'&&entry.reason==='coding-disarmed'));
+    const validArmed=validEntry&&entry.armed&&!grantAbsent&&entry.reason==='standing-grant'&&
+      Number.isSafeInteger(entry.epoch_seq)&&entry.epoch_seq>0&&/^[0-9a-f]{64}$/.test(entry.epoch_sha256??'');
+    const grantSha=grantInfo?sha(await readRegularPinned(checkedPath,`${plane} grant`)):null;
+    let grantFinal;
+    try{grantFinal=await lstat(checkedPath);}
+    catch(error){if(error?.code!=='ENOENT')throw error;}
+    if(grantAbsent?grantFinal!==undefined:!grantFinal||!sameFile(grantInfo,grantFinal))
+      throw new Error(`${plane} grant identity changed during observation`);
+    result[plane]=Object.freeze({state:validDisarmed?'VERIFIED_DISARMED':validArmed?'VERIFIED_ARMED':'UNVERIFIED',
+      policy_sha256:expectedHash,grant_absent:grantAbsent,
+      ...(grantSha?{grant_sha256:grantSha}:{})});
+  }
+  return Object.freeze(result);
+}

package/src/activation-continuity-engine-r65.mjs

@@ -1,8 +1,9 @@
 import {createHash,randomBytes} from 'node:crypto';
-import {open,readFile,rm} from 'node:fs/promises';
+import {open,readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {canonicalJson} from './canonical-json.mjs';
 import {decodeUtf8Strict} from './text-policy.mjs';
+import {deletePinnedRemoteMarker} from './foreground-marker-cas-win32.mjs';
 import {
   captureStandingGrant,compareSecurityEnvelopes,createAuthorityEpochStore,deriveSecurityEnvelope
 } from './authority-continuity-r65.mjs';
@@ -41,11 +42,14 @@ async function writeExclusive(file,bytes){
   finally{await handle.close();}
 }
 async function removeIfExact(file,expectedSha256){
-  const current=await readOptional(file);
-  if(current===null)return {removed:false,reason:'absent'};
-  if(sha(current)!==expectedSha256)return {removed:false,reason:'replacement'};
-  await rm(file,{force:true});
-  return {removed:true,reason:'matched'};
+  // The Windows native disposition pins a single handle from read/hash through deletion.
+  // Never use a pathname removal after confirming only a previous snapshot.
+  if(process.platform!=='win32')throw new Error('authority grant POSIX disposition unsupported');
+  const verdict=deletePinnedRemoteMarker(file,expectedSha256);
+  if(verdict==='REMOVED')return {removed:true,reason:'matched'};
+  if(verdict==='MISSING')return {removed:false,reason:'absent'};
+  if(verdict==='CHANGED')return {removed:false,reason:'replacement'};
+  throw new Error('authority grant native deletion verdict invalid');
 }
 function validateCapture(capture){
   if(!plain(capture)||typeof capture.update_id!=='string'||!Array.isArray(capture.planes)||!plain(capture.records))throw new Error('authority continuity capture invalid');
@@ -88,6 +92,8 @@ function classifyConflict(head,record,updateId){
 }
 
 export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPaths,successorPolicyPaths,updateId}={}){
+  if(process.platform!=='win32')
+    throw new Error('authority continuity POSIX mutation unsupported: native disposition unavailable');
   const state=path.resolve(String(stateRoot??''));
   if(!stateRoot||!plain(predecessorPolicyPaths)||typeof successorPolicyPaths!=='function'||
       typeof updateId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(updateId))
@@ -193,10 +199,11 @@ export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPa
           if(conflict==='REVOKED_DURING_UPDATE')await removeIfExact(file,record.grant_sha256).catch(()=>{});
           outcomes[plane]=conflict;reauth.push(plane);continue;
         }
-        const existing=await readOptional(file);
-        if(existing===null){outcomes[plane]='REVOKED_DURING_UPDATE';reauth.push(plane);continue;}
-        if(sha(existing)!==record.grant_sha256){outcomes[plane]='REPLACED';reauth.push(plane);continue;}
-        await rm(file,{force:true});
+        const removed=await removeIfExact(file,record.grant_sha256);
+        if(!removed.removed){
+          outcomes[plane]=removed.reason==='absent'?'REVOKED_DURING_UPDATE':'REPLACED';
+          reauth.push(plane);continue;
+        }
         const prepared=buildSuccessorGrant({plane,record,successorPolicyBytes,successorPolicy});
         try{await writeExclusive(file,prepared.bytes);}
         catch(error){if(error?.code==='EEXIST'){outcomes[plane]='REPLACED';reauth.push(plane);continue;}throw error;}

package/src/activation-preflight-r65.mjs

@@ -47,6 +47,19 @@ export function classifyActivationPreflight({pointer,expectedParent,candidate,ex
   if(PLANES.some(plane=>typeof authority[plane]!=='boolean'))return Object.freeze({state:'UNKNOWN',safe_to_activate:false,reason:'authority observation incomplete'});
   const subject={pointer,expectedParent,candidate,expectedCandidate,observation};
   const bound={subject_sha256:digest(subject),authority:Object.freeze(authority)};
+  for(const plane of PLANES){
+    const entry=observation?.authority?.[plane],proof=observation?.authority_proof?.[plane];
+    if(entry&&typeof entry==='object'){
+      const knownReason=entry.armed?entry.reason==='standing-grant':entry.reason==='disarmed'||entry.reason==='coding-disarmed';
+      if(!knownReason)return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority reason unverified`,...bound});
+    }
+    if(!proof)
+      return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof missing`,...bound});
+    if(proof&&(proof.policy_sha256!==observation?.policy_sha256?.[plane]||
+        proof.state!==(authority[plane]?'VERIFIED_ARMED':'VERIFIED_DISARMED')||
+        (!authority[plane]&&proof.grant_absent!==true)))
+      return Object.freeze({state:'AUTHORITY_UNVERIFIED',safe_to_activate:false,reason:`${plane} authority proof unverified`,...bound});
+  }
   if(PLANES.some(plane=>!HEX64.test(String(observation?.policy_sha256?.[plane]))))
     return Object.freeze({state:'UNKNOWN',safe_to_activate:false,reason:'policy hash observation incomplete',...bound});
   if(pointer.release_id!==expectedParent.release_id||pointer.version!==expectedParent.version||

package/src/agent-eval-r42.mjs

@@ -4,6 +4,11 @@ import { canonicalJson } from './canonical-json.mjs';
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,96}$/;
 const SEVERITY=new Set(['info','low','medium','high','critical']);
+const JUDGE_ONLY_KEY=/(?:secret|token|password|answer[_-]?key|ground[_-]?truth)/i;
+const JUDGE_ONLY_CONTEXT_KEYS=new Set([
+  'hidden_oracle','judge_result','grader_verdict','deterministic_eval_result',
+  'deterministic_eval_summary','judge_scope_and_deterministic_status'
+]);
 const sha=value=>createHash('sha256').update(Buffer.from(canonicalJson(value),'utf8')).digest('hex');
 function object(value,label){if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} invalid`);return value;}
 function keys(value,allowed,label){const extra=Object.keys(value).filter(key=>!allowed.includes(key));if(extra.length)throw new Error(`${label} unknown field '${extra[0]}'`);}
@@ -11,6 +16,30 @@ function id(value,label){if(typeof value!=='string'||!ID.test(value))throw new E
 function text(value,label,max=8192){if(typeof value!=='string'||value.length<1||value.length>max||value.includes('\0'))throw new Error(`${label} invalid`);return value;}
 function textList(value,label,maxItems=32,maxLength=1024){if(!Array.isArray(value)||value.length>maxItems||value.some(item=>typeof item!=='string'||item.length<1||item.length>maxLength))throw new Error(`${label} invalid`);return [...value];}
 
+function assertNoJudgeOnlyContextLeak(core){
+  const checkKeys=(value,depth=0)=>{
+    if(depth>32)throw new Error('eval visible context nesting exceeds safe limit');
+    if(Array.isArray(value)){for(const item of value)checkKeys(item,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value)){
+      if(JUDGE_ONLY_CONTEXT_KEYS.has(key.toLowerCase()))throw new Error('judge-only result leaked into generator context');
+      checkKeys(item,depth+1);
+    }
+  };
+  checkKeys(core.allowed_context);
+  const visible=canonicalJson({task:core.task,allowed_context:core.allowed_context,acceptance:core.acceptance});
+  const visit=(value,secretKey=false,depth=0)=>{
+    if(depth>32)throw new Error('eval hidden oracle nesting exceeds safe limit');
+    if(typeof value==='string'){
+      if(secretKey&&value.length>0&&visible.includes(JSON.stringify(value).slice(1,-1)))
+        throw new Error('judge-only oracle value leaked into generator context');
+      return;
+    }
+    if(Array.isArray(value)){for(const item of value)visit(item,secretKey,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value))visit(item,secretKey||JUDGE_ONLY_KEY.test(key),depth+1);
+  };
+  visit(core.hidden_oracle);
+}
+
 function normalizeCase(raw){
   const value=object(raw,'agent eval case');keys(value,['schema','case_id','task','allowed_context','hidden_oracle','acceptance'],'agent eval case');
   if(value.schema!=='deadbyte.agent-eval-case.v1')throw new Error('agent eval case schema invalid');
@@ -18,6 +47,7 @@ function normalizeCase(raw){
     allowed_context:structuredClone(object(value.allowed_context,'eval allowed_context')),
     hidden_oracle:structuredClone(object(value.hidden_oracle,'eval hidden_oracle')),
     acceptance:textList(value.acceptance,'eval acceptance')};
+  assertNoJudgeOnlyContextLeak(core);
   return Object.freeze({...core,case_sha256:sha(core)});
 }