deadbyte-mcp 0.15.47 → 0.15.49

package/src/foreground-marker-cas-win32.mjs

@@ -0,0 +1,284 @@
+// Windows-only, handle-bound conditional deletion. Never use pathname rm after a read.
+import {createHash} from 'node:crypto';
+import {lstat,readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const sameFile=(a,b)=>a&&b&&a.isFile()&&b.isFile()&&!a.isSymbolicLink()&&!b.isSymbolicLink()&&
+  a.dev===b.dev&&a.ino===b.ino&&a.size===b.size&&a.mtimeMs===b.mtimeMs&&a.ctimeMs===b.ctimeMs;
+
+export async function readRemoteMarkerSnapshot(file){
+  let before;
+  try{before=await lstat(file);}catch(error){if(error?.code==='ENOENT')return null;throw error;}
+  if(!before.isFile()||before.isSymbolicLink()||before.size>16384||before.size<2)
+    throw new Error('remote marker not a bounded regular file');
+  const bytes=await readFile(file);
+  const after=await lstat(file);
+  if(!sameFile(before,after)||bytes.length!==before.size)
+    throw new Error('remote marker identity changed during snapshot');
+  let marker;
+  try{marker=JSON.parse(bytes.toString('utf8').replace(/^\uFEFF/,''));}
+  catch{throw new Error('remote marker JSON invalid');}
+  return Object.freeze({marker,sha256:digest(bytes)});
+}
+
+// Native ancestor handles pin the non-reparse path chain, then a single leaf handle owns read/hash/deletion.
+// Open share=READ only: concurrent replace, rename, delete and writes must fail.
+// Do not replace this with a Node readFile()+rm(), rename(), or link()+unlink().
+const nativeCommand=String.raw`
+$ErrorActionPreference='Stop'
+$source=@'
+using System;
+using System.IO;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using Microsoft.Win32.SafeHandles;
+using System.Collections.Generic;
+public static class DeadbytePinnedDeleteV2 {
+  const uint FILE_READ_DATA = 0x0001;
+  const uint FILE_WRITE_DATA = 0x0002;
+  const uint FILE_READ_ATTRIBUTES = 0x0080;
+  const uint DELETE = 0x00010000;
+  const uint FILE_SHARE_READ = 0x00000001;
+  const uint OPEN_EXISTING = 3;
+  const uint CREATE_NEW = 1;
+  const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+  const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
+  const uint FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
+  const uint FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
+  [StructLayout(LayoutKind.Sequential)] struct FILE_ATTRIBUTE_TAG_INFO {
+    public uint FileAttributes;
+    public uint ReparseTag;
+  }
+  // FileIdInfo = 18, FILE_ID_INFO = 8-byte volume serial + 16-byte file ID.
+  // No fallback to filename, hashes, inode heuristics, or legacy 64-bit file index.
+  [StructLayout(LayoutKind.Sequential)] struct FILE_ID_INFO {
+    public ulong VolumeSerialNumber;
+    [MarshalAs(UnmanagedType.ByValArray, SizeConst=16)] public byte[] FileId;
+  }
+  [DllImport("kernel32.dll",EntryPoint="CreateFileW",CharSet=CharSet.Unicode,SetLastError=true)]
+  static extern SafeFileHandle CreateFile(string file,uint access,uint share,IntPtr security,uint creation,uint flags,IntPtr templateFile);
+  [DllImport("kernel32.dll",SetLastError=true)]
+  static extern bool GetFileInformationByHandleEx(SafeFileHandle file,int cls,out FILE_ATTRIBUTE_TAG_INFO info,uint size);
+  [DllImport("kernel32.dll",EntryPoint="GetFileInformationByHandleEx",SetLastError=true)]
+  static extern bool GetFileIdInformationByHandleEx(SafeFileHandle file,int cls,out FILE_ID_INFO info,uint size);
+  [DllImport("kernel32.dll",SetLastError=true)]
+  static extern bool SetFileInformationByHandle(SafeFileHandle file,int cls,IntPtr info,uint size);
+  // Pin the ENTIRE local-drive ancestor chain from the drive root to the leaf's parent.
+  // Share=READ only denies concurrent write/rename/delete of each pinned component.
+  // Checking names separately and closing each handle would reintroduce the race.
+  static void PinAncestor(string directory,List<SafeFileHandle> pins) {
+    var handle=CreateFile(directory,FILE_READ_ATTRIBUTES,FILE_SHARE_READ,
+      IntPtr.Zero,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero);
+    if(handle.IsInvalid){
+      int error=Marshal.GetLastWin32Error();handle.Dispose();
+      throw new Win32Exception(error,"cannot pin path ancestor (fail closed)");
+    }
+    try {
+      FILE_ATTRIBUTE_TAG_INFO attr;
+      if(!GetFileInformationByHandleEx(handle,9,out attr,(uint)Marshal.SizeOf(typeof(FILE_ATTRIBUTE_TAG_INFO))))
+        throw new Win32Exception(Marshal.GetLastWin32Error(),"ancestor attributes unavailable");
+      if((attr.FileAttributes&FILE_ATTRIBUTE_DIRECTORY)==0 ||
+         (attr.FileAttributes&FILE_ATTRIBUTE_REPARSE_POINT)!=0)
+        throw new InvalidOperationException("ancestor is a junction, symlink, reparse point or non-directory");
+      pins.Add(handle);
+    } catch {handle.Dispose();throw;}
+  }
+  static string FileIdentity(SafeFileHandle handle) {
+    FILE_ID_INFO info;
+    if(!GetFileIdInformationByHandleEx(handle,18,out info,(uint)Marshal.SizeOf(typeof(FILE_ID_INFO))))
+      throw new Win32Exception(Marshal.GetLastWin32Error(),"128-bit native File ID unavailable; fail closed");
+    if(info.FileId==null||info.FileId.Length!=16)
+      throw new InvalidOperationException("native file identity unavailable");
+    bool allZero=true;
+    foreach(byte b in info.FileId)if(b!=0){allZero=false;break;}
+    if(allZero)throw new InvalidOperationException("zero native File ID; fail closed");
+    return info.VolumeSerialNumber.ToString("x16")+":"+BitConverter.ToString(info.FileId).Replace("-","").ToLowerInvariant();
+  }
+  public static string DeleteIfHash(string file,string expectedSha,string expectedId) {
+    return WithPinnedAncestors(file,"delete",expectedSha,expectedId,null);
+  }
+  public static string Snapshot(string file) {
+    return WithPinnedAncestors(file,"snapshot",null,null,null);
+  }
+  public static string CreateLock(string file,string encodedBytes) {
+    return WithPinnedAncestors(file,"create",null,null,encodedBytes);
+  }
+  static string WithPinnedAncestors(string file,string operation,string expectedSha,string expectedId,string encodedBytes) {
+    string full=Path.GetFullPath(file);
+    // No UNC paths, device paths, ADS or extended-path aliases in this safety boundary.
+    if(full.Length<4 || !Char.IsLetter(full[0]) || full[1]!=':' || full[2]!='\\' ||
+       full.IndexOf(':',2)>=0 || String.IsNullOrEmpty(Path.GetFileName(full)))
+      throw new InvalidOperationException("pinned deletion requires an ordinary local drive file path");
+    string root=Path.GetPathRoot(full);
+    string parent=Path.GetDirectoryName(full);
+    var pins=new List<SafeFileHandle>();
+    try {
+      string current=root;
+      PinAncestor(current,pins);
+      string tail=parent.Substring(root.Length);
+      foreach(string component in tail.Split(new[]{'\\'},StringSplitOptions.RemoveEmptyEntries)){
+        current=Path.Combine(current,component);
+        PinAncestor(current,pins);
+      }
+      if(operation=="snapshot")return SnapshotPinnedLeaf(full);
+      if(operation=="create")return CreatePinnedLeaf(full,encodedBytes);
+      return DeletePinnedLeaf(full,expectedSha,expectedId);
+    } finally {
+      for(int i=pins.Count-1;i>=0;i--)pins[i].Dispose();
+    }
+  }
+  static byte[] ReadBoundedLeaf(SafeFileHandle handle){
+    using(var stream=new FileStream(handle,FileAccess.Read)){
+      if(stream.Length<2||stream.Length>16384)throw new InvalidOperationException("pinned file size invalid");
+      byte[] content=new byte[(int)stream.Length];int index=0,read;
+      while(index<content.Length&&(read=stream.Read(content,index,content.Length-index))>0)index+=read;
+      if(index!=content.Length)throw new IOException("pinned file truncated");
+      return content;
+    }
+  }
+  static void ValidateLeaf(SafeFileHandle handle){
+    FILE_ATTRIBUTE_TAG_INFO attr;
+    if(!GetFileInformationByHandleEx(handle,9,out attr,(uint)Marshal.SizeOf(typeof(FILE_ATTRIBUTE_TAG_INFO))))
+      throw new Win32Exception(Marshal.GetLastWin32Error(),"pinned leaf attributes unavailable");
+    if((attr.FileAttributes&(FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_REPARSE_POINT))!=0)
+      throw new InvalidOperationException("pinned leaf is a reparse point or directory");
+  }
+  static string SnapshotPinnedLeaf(string file){
+    using(var handle=CreateFile(file,FILE_READ_DATA|FILE_READ_ATTRIBUTES,FILE_SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero)){
+      if(handle.IsInvalid){
+        int error=Marshal.GetLastWin32Error();
+        if(error==2||error==3)return "MISSING";
+        throw new Win32Exception(error,"epoch lock could not be pinned for identity snapshot");
+      }
+      ValidateLeaf(handle);
+      string id=FileIdentity(handle);
+      byte[] bytes=ReadBoundedLeaf(handle);
+      string hash=BitConverter.ToString(SHA256.Create().ComputeHash(bytes)).Replace("-","").ToLowerInvariant();
+      return "SNAPSHOT|"+id+"|"+hash+"|"+Convert.ToBase64String(bytes);
+    }
+  }
+  static string CreatePinnedLeaf(string file,string encodedBytes){
+    byte[] bytes=Convert.FromBase64String(encodedBytes);
+    if(bytes.Length<2||bytes.Length>16384)throw new InvalidOperationException("epoch lock bytes invalid");
+    using(var handle=CreateFile(file,FILE_READ_DATA|FILE_WRITE_DATA|FILE_READ_ATTRIBUTES,
+      FILE_SHARE_READ,IntPtr.Zero,CREATE_NEW,FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero)){
+      if(handle.IsInvalid){
+        int error=Marshal.GetLastWin32Error();
+        if(error==80||error==183)return "EXISTS";
+        throw new Win32Exception(error,"epoch lock creation failed closed");
+      }
+      ValidateLeaf(handle);
+      string id=FileIdentity(handle);
+      using(var stream=new FileStream(handle,FileAccess.ReadWrite)){
+        stream.Write(bytes,0,bytes.Length);
+        stream.Flush(true);
+      }
+      string hash=BitConverter.ToString(SHA256.Create().ComputeHash(bytes)).Replace("-","").ToLowerInvariant();
+      return "CREATED|"+id+"|"+hash;
+    }
+  }
+  static string DeletePinnedLeaf(string file,string expectedSha,string expectedId) {
+    using(var handle=CreateFile(file,FILE_READ_DATA|FILE_READ_ATTRIBUTES|DELETE,FILE_SHARE_READ,IntPtr.Zero,OPEN_EXISTING,FILE_FLAG_OPEN_REPARSE_POINT,IntPtr.Zero)) {
+      if(handle.IsInvalid){
+        int error=Marshal.GetLastWin32Error();
+        if(error==2||error==3)return "MISSING";
+        throw new Win32Exception(error,"remote marker cannot be exclusively pinned");
+      }
+      ValidateLeaf(handle);
+      // PowerShell can marshal $null to an empty string for a C# string parameter.
+      // Only epoch-lock callers with an explicit File ID require this comparison.
+      string actualId=String.IsNullOrEmpty(expectedId)?null:FileIdentity(handle);
+      // Identity must be checked on the SAME handle used for hash and disposition.
+      if(!String.IsNullOrEmpty(expectedId)&&!String.Equals(actualId,expectedId,StringComparison.Ordinal))return "CHANGED";
+      using(var stream=new FileStream(handle,FileAccess.Read)){
+        if(stream.Length<2||stream.Length>16384)throw new InvalidOperationException("pinned file size invalid");
+        byte[] content=new byte[(int)stream.Length];int index=0,read;
+        while(index<content.Length&&(read=stream.Read(content,index,content.Length-index))>0)index+=read;
+        if(index!=content.Length)throw new IOException("pinned file truncated");
+        string actual=BitConverter.ToString(SHA256.Create().ComputeHash(content)).Replace("-","").ToLowerInvariant();
+        if(!String.Equals(actual,expectedSha,StringComparison.Ordinal))return "CHANGED";
+        IntPtr flag=Marshal.AllocHGlobal(4);
+        try {
+          Marshal.WriteInt32(flag,1);
+          if(!SetFileInformationByHandle(handle,4,flag,4))
+            throw new Win32Exception(Marshal.GetLastWin32Error(),"pinned file delete disposition denied");
+        } finally {Marshal.FreeHGlobal(flag);}
+        return "REMOVED";
+      }
+    }
+  }
+}
+'@
+Add-Type -TypeDefinition $source -Language CSharp -ErrorAction Stop | Out-Null
+$file=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:DEADBYTE_PINNED_MARKER_B64))
+$sha=$env:DEADBYTE_PINNED_MARKER_SHA
+$id=$env:DEADBYTE_PINNED_MARKER_FILE_ID
+if($env:DEADBYTE_PINNED_MARKER_OP -eq 'snapshot') {
+  [Console]::Out.WriteLine([DeadbytePinnedDeleteV2]::Snapshot($file))
+} elseif($env:DEADBYTE_PINNED_MARKER_OP -eq 'create') {
+  [Console]::Out.WriteLine([DeadbytePinnedDeleteV2]::CreateLock($file,$env:DEADBYTE_PINNED_MARKER_BYTES_B64))
+} else {
+  if([String]::IsNullOrEmpty($id)){$id=$null}
+  [Console]::Out.WriteLine([DeadbytePinnedDeleteV2]::DeleteIfHash($file,$sha,$id))
+}
+`;
+
+const FILE_ID_PATTERN=/^[0-9a-f]{16}:[0-9a-f]{32}$/;
+function invokePinnedNative(file,{op,sha=null,fileId=null,bytes=null}={}){
+  if(process.platform!=='win32')throw new Error('native pinned file I/O is Windows-only');
+  if(typeof file!=='string'||!path.isAbsolute(file)||!['snapshot','delete','create'].includes(op)||
+    (op==='delete'&&!HEX64.test(sha??''))||
+    (op==='create'&&(!Buffer.isBuffer(bytes)||bytes.length<2||bytes.length>16384))||
+    (fileId!==null&&!FILE_ID_PATTERN.test(fileId)))
+    throw new Error('native pinned file arguments invalid');
+  const powershell='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+  const result=spawnSync(powershell,['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',
+    Buffer.from(nativeCommand,'utf16le').toString('base64')],{
+    encoding:'utf8',windowsHide:true,shell:false,timeout:25000,maxBuffer:262144,
+    env:windowsPowerShellEnvironment({...process.env,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows',
+      DEADBYTE_PINNED_MARKER_B64:Buffer.from(file,'utf8').toString('base64'),
+      DEADBYTE_PINNED_MARKER_SHA:sha??'',
+      DEADBYTE_PINNED_MARKER_FILE_ID:fileId??'',
+      DEADBYTE_PINNED_MARKER_BYTES_B64:bytes?.toString('base64')??'',
+      DEADBYTE_PINNED_MARKER_OP:op})
+  });
+  if(result.error||result.status!==0)throw new Error('native pinned file I/O failed closed');
+  return result.stdout.trim();
+}
+
+// Snapshot locks using one native handle for owner bytes, SHA-256, and FileIdInfo.
+// Node lstat dev/ino is insufficient as the sole cross-API identity authority.
+export function readPinnedEpochLockSnapshot(file){
+  const result=invokePinnedNative(file,{op:'snapshot'});
+  if(result==='MISSING')return null;
+  const match=/^SNAPSHOT\|([0-9a-f]{16}:[0-9a-f]{32})\|([0-9a-f]{64})\|([A-Za-z0-9+/]+={0,2})$/.exec(result);
+  if(!match)throw new Error('native pinned epoch lock snapshot malformed');
+  const bytes=Buffer.from(match[3],'base64');
+  if(bytes.length<2||bytes.length>16384||bytes.toString('base64')!==match[3]||digest(bytes)!==match[2])
+    throw new Error('native pinned epoch lock snapshot content mismatch');
+  return Object.freeze({bytes,sha256:match[2],fileId:match[1]});
+}
+
+// Creation is pinned under the same non-reparse ancestor chain. The returned
+// File ID belongs to the handle that wrote and flushed the original lock bytes.
+export function createPinnedEpochLock(file,bytes){
+  const result=invokePinnedNative(file,{op:'create',bytes});
+  if(result==='EXISTS')return null;
+  const match=/^CREATED\|([0-9a-f]{16}:[0-9a-f]{32})\|([0-9a-f]{64})$/.exec(result);
+  if(!match||digest(bytes)!==match[2])throw new Error('native epoch lock creation identity invalid');
+  return Object.freeze({fileId:match[1],sha256:match[2]});
+}
+
+// Existing remote-marker API remains content-CAS for backward compatibility.
+// Epoch locks MUST pass an expected FileIdInfo captured from a native snapshot.
+export function deletePinnedRemoteMarker(file,expectedSha256,options={}){
+  const expectedFileId=options?.expectedFileId??null;
+  const answer=invokePinnedNative(file,{op:'delete',sha:expectedSha256,fileId:expectedFileId});
+  if(!['REMOVED','MISSING','CHANGED'].includes(answer))throw new Error('handle-bound deletion result invalid');
+  return answer;
+}

package/src/foreground-process-identity.mjs

@@ -1,7 +1,7 @@
 import {spawnSync} from 'node:child_process';
 import {createHash} from 'node:crypto';
 import path from 'node:path';
-import {windowsPowerShellEnvironment} from './runtime-update.mjs';
+import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
 
 export function validForegroundIdentity(value){
  return value?.schema==='deadbyte.foreground-process.v1'&&Number.isSafeInteger(value.pid)&&value.pid>0&&Number.isSafeInteger(value.parent_pid)&&value.parent_pid>=0&&typeof value.creation_utc==='string'&&/^\d{4}-\d\d-\d\dT.*Z$/.test(value.creation_utc)&&Number.isFinite(Date.parse(value.creation_utc))&&typeof value.executable_path==='string'&&path.isAbsolute(value.executable_path)&&/^[0-9a-f]{64}$/.test(value.command_line_sha256??'');
@@ -14,9 +14,9 @@ export function foregroundIdentityMatches(expected,observed){
 }
 export function queryForegroundIdentity(pid){
  if(process.platform!=='win32'||!Number.isSafeInteger(pid)||pid<1)throw new Error('foreground identity requires a positive Windows PID');
- const root=process.env.SystemRoot||process.env.WINDIR;if(!root)throw new Error('Windows system root missing');
+ const powershell='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
  const command=`$p=Get-CimInstance Win32_Process -Filter 'ProcessId=${pid}'; if ($null -eq $p) {Write-Output 'null';exit 0}; [pscustomobject]@{pid=$p.ProcessId;parent_pid=$p.ParentProcessId;creation_utc=$p.CreationDate.ToUniversalTime().ToString('o');executable_path=$p.ExecutablePath;command_line=$p.CommandLine} | ConvertTo-Json -Compress`;
- const result=spawnSync(path.join(root,'System32/WindowsPowerShell/v1.0/powershell.exe'),['-NoLogo','-NoProfile','-Command',command],{encoding:'utf8',windowsHide:true,env:windowsPowerShellEnvironment(process.env),timeout:15000,maxBuffer:1024*1024});
+ const result=spawnSync(powershell,['-NoLogo','-NoProfile','-Command',command],{encoding:'utf8',windowsHide:true,env:windowsPowerShellEnvironment({...process.env,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'}),timeout:15000,maxBuffer:1024*1024});
  if(result.error||result.status!==0)throw new Error('foreground process identity query failed');
  let raw;try{raw=JSON.parse(result.stdout);}catch{throw new Error('foreground process identity query malformed');}
  if(raw===null)return null;

package/src/privileged-install-trust-r89.mjs

@@ -0,0 +1,196 @@
+// R89 development: fail closed before requiring a privileged Windows native addon.
+// Trust is an OS-owned installation property, not a manifest hash or npm version.
+// This checks an honest process against lower-trust filesystem principals; it is
+// NOT an attestation against a malicious actor already executing with equivalent
+// write/administrative rights, or against a compromised Node/PowerShell runtime.
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import path from 'node:path';
+
+const execFileAsync=promisify(execFile);
+function windowsPowerShellEnvironment(base=process.env){
+  const env={...base};
+  // The ACL probe must not autoload commands from caller-controlled module
+  // directories. Its executable is pinned to C:\Windows below, so use only
+  // that installation's built-in modules and matching OS-root variables.
+  for(const key of Object.keys(env)){
+    if(['psmodulepath','systemroot','windir'].includes(key.toLowerCase()))delete env[key];
+  }
+  env.SystemRoot='C:\\Windows';
+  env.WINDIR='C:\\Windows';
+  env.PSModulePath='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules';
+  return env;
+}
+const DRIVE=/^[A-Za-z]:\\/;
+const SYSTEM='S-1-5-18';
+const ADMINISTRATORS='S-1-5-32-544';
+const TRUSTED_INSTALLER='S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464';
+const TRUSTED=new Set([SYSTEM,ADMINISTRATORS,TRUSTED_INSTALLER]);
+// Block untrusted changes to an existing directory or file, including security
+// descriptor, content, attributes, or deletion. Create-child alone is not enough
+// to replace an existing child, but full Modify contains DELETE and is denied.
+const COMMON_MUTATION=0x000d0150;  // WRITE_EA, DELETE_CHILD, WRITE_ATTRIBUTES, DELETE, WRITE_DAC, WRITE_OWNER
+const FILE_MUTATION=COMMON_MUTATION|0x00000002|0x00000004; // WRITE_DATA / APPEND_DATA
+const DIR_MUTATION=COMMON_MUTATION;
+// Win32 ACEs may retain generic/indeterminate masks rather than expanded
+// FILE_GENERIC_WRITE/FILE_ALL_ACCESS. Do not treat those as harmless.
+const GENERIC_WRITE_OR_ALL=0x40000000|0x10000000;
+const INDETERMINATE_ACCESS=0x02000000; // MAXIMUM_ALLOWED is not a finite read-only grant
+const ANY_MUTATION_OR_UNDECIDABLE=(GENERIC_WRITE_OR_ALL|INDETERMINATE_ACCESS);
+// Windows ACE scope is not the same as ACE inheritance origin. INHERIT_ONLY
+// means the ACE does NOT apply to the currently inspected file/directory;
+// it may apply to children, which are checked separately in the path chain.
+// Missing / malformed scope must never silently become an allow.
+const INHERIT_ONLY=2; // .NET PropagationFlags.InheritOnly=2; NoPropagateInherit=1
+const KNOWN_INHERITANCE_FLAGS=3; // ContainerInherit | ObjectInherit
+const KNOWN_PROPAGATION_FLAGS=3; // InheritOnly | NoPropagateInherit
+
+function normalizeWindows(file){
+  if(typeof file!=='string'||!DRIVE.test(file)||file.includes('\0')||file.startsWith('\\\\'))
+    throw new Error('R89 privileged path must be a Windows drive-absolute path');
+  const normalized=path.win32.normalize(file);
+  if(!DRIVE.test(normalized))throw new Error('R89 privileged path normalization invalid');
+  return normalized.toLowerCase();
+}
+export function privilegedEpochInstallFiles(root,nodeExecutable){
+  const join=(...segments)=>path.win32.join(root,...segments);
+  return [nodeExecutable,
+    join('bin','deadbyte-epoch-lock-r85.node'),
+    join('docs','R85-EPOCH-LOCK-BINARY.json'),
+    join('native','deadbyte-epoch-lock-r85.cpp'),
+    join('src','epoch-lock-r85.mjs'),
+    join('src','privileged-install-trust-r89.mjs'),
+    join('src','authority-continuity-r65.mjs'),
+    join('src','canonical-json.mjs'),
+    join('src','text-policy.mjs'),
+    join('src','foreground-marker-cas-win32.mjs'),
+    join('src','foreground-process-identity.mjs'),
+    join('src','windows-powershell-environment.mjs')];
+}
+export function requiredAclPathChain(files){
+  if(!Array.isArray(files)||files.length<1||files.length>32)
+    throw new Error('R89 privileged path inventory invalid');
+  const seen=new Set();
+  for(const file of files){
+    let current=normalizeWindows(file);
+    for(let depth=0;depth<128;depth++){
+      seen.add(current);
+      const parent=path.win32.dirname(current);
+      if(parent===current)break;
+      if(depth===127)throw new Error('R89 privileged ancestor depth exceeded');
+      current=parent;
+    }
+  }
+  return [...seen].sort();
+}
+
+// Pure conservative evaluator. Records must come from Windows Get-Acl, never
+// from a writable package file, environment variable or release metadata.
+export function evaluatePrivilegedAclSnapshot(records,files){
+  const required=requiredAclPathChain(files);
+  if(!Array.isArray(records)||records.length!==required.length)
+    return Object.freeze({trusted:false,reason:'INCOMPLETE_ACL_SNAPSHOT'});
+  const byPath=new Map();
+  for(const rec of records){
+    let key;
+    try{key=normalizeWindows(rec?.path);}catch{return Object.freeze({trusted:false,reason:'INVALID_ACL_PATH'});}
+    if(byPath.has(key))return Object.freeze({trusted:false,reason:'DUPLICATE_ACL_PATH',path:key});
+    byPath.set(key,rec);
+  }
+  const leaves=new Set(files.map(normalizeWindows));
+  for(const file of required){
+    const rec=byPath.get(file);
+    if(!rec)return Object.freeze({trusted:false,reason:'MISSING_ACL_NODE',path:file});
+    if(rec.reparse!==false || typeof rec.directory!=='boolean' ||
+        !TRUSTED.has(rec.owner) || !Array.isArray(rec.aces))
+      return Object.freeze({trusted:false,reason:'UNTRUSTED_OWNER_OR_REPARSE',path:file});
+    if(leaves.has(file)&&rec.directory===true)
+      return Object.freeze({trusted:false,reason:'EXPECTED_FILE_NOT_FILE',path:file});
+    if(!leaves.has(file)&&rec.directory!==true)
+      return Object.freeze({trusted:false,reason:'EXPECTED_PARENT_NOT_DIRECTORY',path:file});
+    for(const ace of rec.aces){
+      if(!ace||typeof ace.sid!=='string'||!['Allow','Deny'].includes(ace.type)||
+         !Number.isSafeInteger(ace.mask)||ace.mask<0||ace.mask>0xffffffff)
+        return Object.freeze({trusted:false,reason:'UNKNOWN_ACL_RULE',path:file});
+      // These values are obtained directly from OS AccessRule fields below.
+      // An inheritance-only CREATOR OWNER placeholder is not an effective
+      // mutation grant on THIS object. An effective CREATOR OWNER ACE (or an
+      // untrusted effective GENERIC_ALL) is still rejected, not whitelisted.
+      if(!Number.isInteger(ace.inheritance)||ace.inheritance<0||
+         (ace.inheritance&~KNOWN_INHERITANCE_FLAGS)!==0||
+         !Number.isInteger(ace.propagation)||ace.propagation<0||
+         (ace.propagation&~KNOWN_PROPAGATION_FLAGS)!==0||
+         (ace.propagation!==0&&ace.inheritance===0)||
+         ((ace.propagation&INHERIT_ONLY)!==0&&(!rec.directory||ace.inheritance===0)))
+        return Object.freeze({trusted:false,reason:'UNKNOWN_ACL_SCOPE',path:file});
+      if((ace.propagation&INHERIT_ONLY)!==0)continue;
+      if(ace.type==='Allow'&&!TRUSTED.has(ace.sid)&&
+          (ace.mask&((rec.directory?DIR_MUTATION:FILE_MUTATION)|ANY_MUTATION_OR_UNDECIDABLE))!==0)
+        return Object.freeze({trusted:false,reason:'UNTRUSTED_WRITE_ACE',path:file,sid:ace.sid});
+    }
+  }
+  return Object.freeze({trusted:true,reason:'PROTECTED_INSTALLATION_ACL_SNAPSHOT'});
+}
+
+// This command is compiled into the module; it does NOT run a repo-local .ps1.
+// Errors, unknown ACEs/SIDs and inaccessible paths are fatal.
+const aclProbe=String.raw`
+$ErrorActionPreference='Stop'; Set-StrictMode -Version Latest
+try {
+  $utf8=[Text.Encoding]::UTF8
+  $files=ConvertFrom-Json -InputObject ($utf8.GetString([Convert]::FromBase64String('__PATHS_BASE64__')))
+  $seen=[System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+  $items=New-Object System.Collections.ArrayList
+  foreach($p in @($files)) {
+    $node=[IO.Path]::GetFullPath([string]$p)
+    while($true) {
+      if($seen.Add($node)) {
+        $item=Get-Item -LiteralPath $node -Force -ErrorAction Stop
+        $acl=Get-Acl -LiteralPath $node -ErrorAction Stop
+        $owner=$acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        $aces=New-Object System.Collections.ArrayList
+        foreach($entry in $acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])) {
+          [void]$aces.Add(@{sid=$entry.IdentityReference.Value;type=$entry.AccessControlType.ToString();mask=([int64]$entry.FileSystemRights -band [int64]4294967295);inheritance=[int]$entry.InheritanceFlags;propagation=[int]$entry.PropagationFlags})
+        }
+        [void]$items.Add(@{path=$node;owner=$owner;reparse=[bool]($item.Attributes -band [IO.FileAttributes]::ReparsePoint);directory=[bool]$item.PSIsContainer;aces=@($aces.ToArray())})
+      }
+      $parent=[IO.Directory]::GetParent($node)
+      if($null -eq $parent){break}
+      $node=$parent.FullName
+    }
+  }
+  ConvertTo-Json -InputObject @($items.ToArray()) -Depth 9 -Compress
+} catch { [Console]::Error.WriteLine('R89_ACL_PROBE_FAILED: '+$_.Exception.GetType().Name); exit 12 }
+`;
+
+export async function inspectTrustedInstallation(files){
+  if(process.platform!=='win32'||process.arch!=='x64')
+    throw new Error('R89 privileged native loading requires Windows x64');
+  const required=requiredAclPathChain(files);
+  // Absolute OS executable: do not resolve a user-controlled PATH, run a
+  // repo-owned helper, or honor a caller-provided tool override.
+  const ps='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+  const json=Buffer.from(JSON.stringify(files),'utf8').toString('base64');
+  const script=aclProbe.replace('__PATHS_BASE64__',json);
+  const encoded=Buffer.from(script,'utf16le').toString('base64');
+  let stdout;
+  try{
+    ({stdout}=await execFileAsync(ps,['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
+      {windowsHide:true,timeout:12000,maxBuffer:512*1024,encoding:'utf8',env:windowsPowerShellEnvironment()}));
+  }catch(error){
+    throw Object.assign(new Error('R89 privileged installation ACL inspection failed closed',{cause:error}),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+  }
+  let records;
+  try{records=JSON.parse(stdout);}catch{
+    throw Object.assign(new Error('R89 privileged installation ACL response invalid'),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+  }
+  const decision=evaluatePrivilegedAclSnapshot(records,files);
+  if(!decision.trusted){
+    throw Object.assign(new Error(`R89 privileged installation not protected: ${decision.reason}`),
+      {code:'EPOCH_NATIVE_SLOT_UNTRUSTED',reason:decision.reason});
+  }
+  if(required.length!==records.length)throw new Error('R89 ACL result cardinality changed');
+  return decision;
+}

package/src/remote-live-log.mjs

@@ -254,13 +254,20 @@ function traceText(meta,displayMode='unicode'){
 }
 function outcomeClass(event){
   const outcome=event?.outcome;
-  if(outcome?.side_effect_state==='unknown') return 'unknown';
-  const status=outcome?.status;
-  if(status==='timeout'||status==='timed_out') return 'unknown';
-  if(outcome?.is_error===true||
-     ['failed','denied','rejected','blocked','observed_failure','cancelled','canceled','unavailable','unsupported'].includes(status)) return 'error';
-  if(['pending','running','input_required','paused','processing','accepted'].includes(status)) return 'pending';
-  return 'ok';
+  // A terminal record is not evidence of success without a classified
+  // outcome. Never upgrade missing or new statuses to OK.
+  if(!outcome||typeof outcome!=='object'||Array.isArray(outcome))return 'unknown';
+  if(outcome.side_effect_state==='unknown')return 'unknown';
+  const status=outcome.status;
+  if(status==='timeout'||status==='timed_out'||status==='interrupted')return 'unknown';
+  if(outcome.is_error===true||
+     ['failed','threw','error','denied','rejected','blocked','observed_failure','cancelled','canceled','unavailable','unsupported'].includes(status))return 'error';
+  if(['pending','running','input_required','paused','processing','accepted'].includes(status))return 'pending';
+  if(['ok','success','succeeded','completed','committed','verified','passed','done'].includes(status))return 'ok';
+  // Legacy audit records with explicit is_error:false but no status remain
+  // supported; an unrecognized status is not evidence of success.
+  if((status===undefined||status===null)&&outcome.is_error===false)return 'ok';
+  return 'unknown';
 }
 export function classifyRemoteAuditOutcome(event){return outcomeClass(event);}
 function parseFilterExpression(expression){
@@ -391,7 +398,7 @@ export function createLiveTimelineTracker({clock=()=>Date.now(),verbose=false,fo
     const category=categoryForTool(displayTool);
     const receipt=Array.isArray(event.outcome?.receipt_sha256s)&&typeof event.outcome.receipt_sha256s[0]==='string'
       ?shortValue(event.outcome.receipt_sha256s[0],8):'';
-    const marker=unknown?'FAILED_AFTER_UNKNOWN_EFFECT':
+    const marker=unknown?(event.outcome?.side_effect_state==='unknown'?'FAILED_AFTER_UNKNOWN_EFFECT':'OUTCOME_UNKNOWN'):
       error?(displayMode==='ascii'?'ERR':'✗'):
       pendingResult?'PENDING':
       ['write','edit','run'].includes(category)?(displayMode==='ascii'?'SUCCEEDED':'✅ SUCCEEDED'):

package/src/remote-log-decode-r60.mjs

@@ -1,4 +1,6 @@
 import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {open} from 'node:fs/promises';
 
 export function safeRemoteLogPrefixLength(bytes,encoding='utf8'){
   if(!Buffer.isBuffer(bytes))throw new Error('remote log prefix bytes invalid');
@@ -30,3 +32,66 @@ export function boundedRemoteDiagnostic(value,maxChars=2048){
   const line=String(value??'').replace(/\x1b\[[0-9;]*[A-Za-z]/g,'').replace(/[\x00-\x1f\x7f]+/g,' ').replace(/\s{2,}/g,' ').trim();
   return line.length<=maxChars?line:`${line.slice(0,maxChars)}...`;
 }
+ 
+// Cursor pinned to the file handle's observed identity. We never use a path
+// stat's size to allocate or seek on a separately opened file.
+export async function readRemoteLogAppend(file,cursor=null,{startAtEnd=false,maxBytes=1048576}={}){
+  if(typeof file!=='string'||!file||!Number.isInteger(maxBytes)||maxBytes<4||maxBytes>1048576)
+    throw new Error('remote live log append arguments invalid');
+  if(cursor!==null&&(!Number.isSafeInteger(cursor.offset)||cursor.offset<0))
+    throw new Error('remote live log cursor invalid');
+  let handle;
+  try{handle=await open(file,'r');}
+  catch(error){
+    if(error?.code==='ENOENT')return {cursor:null,offset:0,text:'',reset:cursor!==null,resetReason:'file disappeared'};
+    throw error;
+  }
+  try{
+    const st=await handle.stat({bigint:true});
+    if(!st.isFile()||st.size<0n||st.size>BigInt(Number.MAX_SAFE_INTEGER))
+      throw new Error('remote live log regular file/size invalid');
+    const size=Number(st.size);
+    const identity=st.ino!==0n?st.dev.toString()+':'+st.ino.toString():null;
+    const mtimeNs=(st.mtimeNs??BigInt(Math.trunc(Number(st.mtimeMs)*1000000))).toString();
+    const gone=cursor!==null&&cursor.identity&&identity&&cursor.identity!==identity;
+    const shrunk=cursor!==null&&size<cursor.offset;
+    // NTFS may report the same timestamp for rapid same-size rewrites.
+    // Compare a bounded suffix fingerprint on the idle cursor as well.
+    // This is best-effort rewrite detection, NOT complete file integrity.
+    async function tailFingerprint(offset){
+      if(offset===0)return null;
+      const length=Math.min(offset,64),bytes=Buffer.allocUnsafe(length);
+      const {bytesRead}=await handle.read(bytes,0,length,offset-length);
+      if(bytesRead!==length)throw new Error('remote live log changed during fingerprint');
+      return createHash('sha256').update(bytes).digest('hex');
+    }
+    const priorTailChanged=cursor!==null&&!gone&&!shrunk&&size===cursor.offset&&
+      typeof cursor.tail_sha256==='string'&&
+      (await tailFingerprint(cursor.offset))!==cursor.tail_sha256;
+    const rewritten=cursor!==null&&!gone&&!shrunk&&size===cursor.offset&&
+      ((typeof cursor.mtimeNs==='string'&&cursor.mtimeNs!==mtimeNs)||priorTailChanged);
+    const reset=Boolean(gone||shrunk||rewritten);
+    let start=reset?0:(cursor?.offset??0);
+    const makeCursor=async offset=>Object.freeze({offset,identity,mtimeNs,tail_sha256:await tailFingerprint(offset)});
+    if(startAtEnd&&cursor===null)
+      return {cursor:await makeCursor(size),offset:size,text:'',reset:false,resetReason:null};
+    let encoding=null;
+    if(/\.log$/i.test(file)){
+      const bom=Buffer.allocUnsafe(2);
+      const header=await handle.read(bom,0,2,0);
+      if(header.bytesRead===2&&bom[0]===0xff&&bom[1]===0xfe){
+        encoding='utf16le';
+        if(start%2!==0)start--;
+      }
+    }
+    if(start>=size)
+      return {cursor:await makeCursor(start),offset:start,text:'',reset,resetReason:gone?'file identity changed':shrunk?'file shrank':rewritten?'same-size rewrite':null};
+    const buffer=Buffer.allocUnsafe(Math.min(maxBytes,size-start));
+    const {bytesRead}=await handle.read(buffer,0,buffer.length,start);
+    const complete=safeRemoteLogPrefixLength(buffer.subarray(0,bytesRead),encoding??'utf8');
+    const next=start+complete;
+    return {cursor:await makeCursor(next),offset:next,
+      text:decodeRemoteLogBytes(file,buffer.subarray(0,complete),{encoding}),
+      reset,resetReason:gone?'file identity changed':shrunk?'file shrank':rewritten?'same-size rewrite':null};
+  }finally{await handle.close();}
+}