deadbyte-mcp 0.15.47 → 0.15.49

package/src/remote-session-guardian.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { lstat, readFile, rm } from 'node:fs/promises';
+import { lstat } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
@@ -7,8 +7,10 @@ import { setTimeout as sleep } from 'node:timers/promises';
 import { windowsPowerShellEnvironment } from './runtime-update.mjs';
 import { resolveStateRoot } from './state-root.mjs';
 import { AUTHORITY_PLANES, parseAuthorityObservation, assertAuthorityVector } from './remote-authority.mjs';
+import { readRemoteMarkerSnapshot, deletePinnedRemoteMarker } from './foreground-marker-cas-win32.mjs';
 
 const CLEANUP=['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost'];
+const TRUSTED_WINDOWS_ROOT='C:\\Windows';
 // This inherited IPC channel is an OS-owned parent lifetime handle, not a PID
 // poll. A reused PID cannot keep a new foreground guardian alive.
 let ownerDisconnected=false;
@@ -33,10 +35,8 @@ function pidAlive(pid){
   catch(error){return error?.code!=='ESRCH';}
 }
 async function readMarker(file){
-  let text;
-  try{text=await readFile(file,'utf8');}
-  catch(error){if(error?.code==='ENOENT') return null;throw error;}
-  try{return JSON.parse(text);}catch{return null;}
+  const snapshot=await readRemoteMarkerSnapshot(file);
+  return snapshot?.marker??null;
 }
 function markerMatches(marker,{ownerPid,nonce}){
   return marker?.schema==='deadbyte.remote-session.v2'&&
@@ -45,7 +45,7 @@ function markerMatches(marker,{ownerPid,nonce}){
 }
 function invokeCleanup(powershell,launcher,command,stateRoot,probeMode=null){
   const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{
-    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot,
+    stdio:'ignore',windowsHide:true,shell:false,env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,DEADBYTE_STATE_ROOT:stateRoot,
       ...(probeMode?{DEADBYTE_REMOTE_PROBE_MODE:probeMode}:{})}),timeout:probeMode?150000:30000
   });
   return !result.error&&result.status===0;
@@ -53,7 +53,7 @@ function invokeCleanup(powershell,launcher,command,stateRoot,probeMode=null){
 function verifyRevoked(powershell,launcher,stateRoot){
   const result=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status','-Json'],{
     stdio:['ignore','pipe','pipe'],encoding:'utf8',windowsHide:true,shell:false,
-    env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
+    env:windowsPowerShellEnvironment({...process.env,SystemRoot:TRUSTED_WINDOWS_ROOT,WINDIR:TRUSTED_WINDOWS_ROOT,DEADBYTE_STATE_ROOT:stateRoot}),timeout:30000
   });
   if(result.error||result.status!==0) return null;
   try{
@@ -74,9 +74,7 @@ async function main(){
   if(!/^[0-9a-f]{64}$/.test(nonce)) throw new Error('guardian session nonce invalid');
 
   const launcher=await requireRegular(path.join(root,'bin','DEADBYTE-MCP.ps1'),'stable DEADBYTE launcher');
-  const systemRoot=process.env.SystemRoot||process.env.WINDIR;
-  if(!systemRoot) throw new Error('SystemRoot/WINDIR missing');
-  const powershell=await requireRegular(path.join(systemRoot,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
+  const powershell=await requireRegular(path.join(TRUSTED_WINDOWS_ROOT,'System32','WindowsPowerShell','v1.0','powershell.exe'),'Windows PowerShell');
   const markerPath=path.join(root,'runtime','remote-session.json');
 
   for(;;){
@@ -99,8 +97,11 @@ async function main(){
     if(observed.state==='ONLINE'&&!invokeCleanup(powershell,launcher,'machinetest',root,'revoked'))
       throw new Error('guardian runtime enforcement cleanup unverified; ownership marker retained');
     if(!invokeCleanup(powershell,launcher,'park',root)) throw new Error('guardian park failed; ownership marker retained');
-    const current=await readMarker(markerPath);
-    if(current&&markerMatches(current,{ownerPid,nonce})) await rm(markerPath,{force:true});
+    const current=await readRemoteMarkerSnapshot(markerPath);
+    if(!current)return;
+    if(!markerMatches(current.marker,{ownerPid,nonce}))return;
+    if(deletePinnedRemoteMarker(markerPath,current.sha256)!=='REMOVED')
+      throw new Error('guardian marker changed before native deletion; marker retained');
     return;
   }
 }

package/src/runtime-update.mjs

@@ -21,6 +21,9 @@ import { resolveStateRoot } from './state-root.mjs';
 import {canonicalLauncherPaths,assertCanonicalLaunchers,renderStateBoundLauncherCmd} from './launcher-isolation.mjs';
 import {assertStageOwnedPath,assertStagingBootstrapInputs,assertStagingControlConfig} from './staging-input-isolation.mjs';
 import { verifyProjectOwnerApproval } from './r70-owner-approval.mjs';
+import {windowsPowerShellEnvironment} from './windows-powershell-environment.mjs';
+
+export {windowsPowerShellEnvironment};
 
 const HEX64=/^[0-9a-f]{64}$/;
 const SEMVER=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
@@ -216,31 +219,11 @@ export function parseRollbackArgs(argv){
 }
 
 function powershellPath(){
-  return path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
-}
-export function windowsPowerShellEnvironment(base=process.env){
-  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
-  const userProfile=base.USERPROFILE||os.homedir();
-  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
-  const environment={...base};
-  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath').flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
-  for(const key of Object.keys(environment)) if(key.toLowerCase()==='psmodulepath') delete environment[key];
-  const modules=[
-    path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
-    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
-    path.join(programFiles,'WindowsPowerShell','Modules'),
-    ...inherited
-  ];
-  const seen=new Set();
-  return {...environment,PSModulePath:modules.filter(modulePath=>{
-    const key=modulePath.toLowerCase();
-    if(seen.has(key)) return false;
-    seen.add(key);return true;
-  }).join(';')};
+  return 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
 }
 function commandEnvironment(exe,base=process.env){
   return path.resolve(exe).toLowerCase()===path.resolve(powershellPath()).toLowerCase()
-    ?windowsPowerShellEnvironment(base):base;
+    ?windowsPowerShellEnvironment({...base,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'}):base;
 }
 function runCaptured(exe,args,{cwd,env,timeoutMs=45000}={}){
   const baseEnv=env??process.env;

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.47';
+export const DEADBYTE_VERSION = '0.15.49';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/src/windows-powershell-environment.mjs

@@ -0,0 +1,24 @@
+// Dependency-light PowerShell child environment for security-critical process
+// identity and pinned-marker operations. Do not import the updater here.
+import os from 'node:os';
+import path from 'node:path';
+
+export function windowsPowerShellEnvironment(base=process.env){
+  const systemRoot=base.SystemRoot||base.SYSTEMROOT||'C:\\Windows';
+  const userProfile=base.USERPROFILE||os.homedir();
+  const programFiles=base.ProgramFiles||base.PROGRAMFILES||'C:\\Program Files';
+  const hasWindir=Object.keys(base).some(key=>key.toLowerCase()==='windir');
+  const environment={...base};
+  const inherited=Object.entries(base).filter(([key])=>key.toLowerCase()==='psmodulepath')
+    .flatMap(([,value])=>String(value??'').split(';')).filter(Boolean);
+  for(const key of Object.keys(environment))if(['psmodulepath','systemroot','windir'].includes(key.toLowerCase()))delete environment[key];
+  environment.SystemRoot=systemRoot;
+  if(hasWindir)environment.WINDIR=systemRoot;
+  const modules=[path.join(systemRoot,'System32','WindowsPowerShell','v1.0','Modules'),
+    path.join(userProfile,'Documents','WindowsPowerShell','Modules'),
+    path.join(programFiles,'WindowsPowerShell','Modules'),...inherited];
+  const seen=new Set();
+  return {...environment,PSModulePath:modules.filter(item=>{
+    const key=item.toLowerCase();if(seen.has(key))return false;seen.add(key);return true;
+  }).join(';')};
+}

package/test/autonomous-local-supervisor.test.mjs

@@ -365,7 +365,7 @@ test('continuous standalone supervisor remains alive after READY and hard-stop o
     await new Promise(resolve=>child.once('exit',()=>resolve()));
     const stale=await observeSupervisor({markerPath:f.markerPath});
     assert.equal(stale.live,false);
-    assert.match(stale.reason,/process_unobservable|pid_reused|identity_mismatch/);
+    assert.match(stale.reason,/process_absent|pid_reused|identity_mismatch/);
     const claimed=await takeoverSupervisor({markerPath:f.markerPath});
     assert.equal(claimed.status,'claimed');
     await releaseSupervisor({markerPath:f.markerPath,instanceNonce:claimed.instance_nonce});

package/test/cli-entrypoint.test.mjs

@@ -44,7 +44,7 @@ test('npx CLI exposes local supervisor lifecycle without any supervisor arm comm
   assert.match(source,/supervisorstop/);
   assert.match(source,/supervisorstatus/);
   assert.match(source,/supervisorrecover/);
-  const mapping=source.match(/const SUPERVISOR_COMMANDS=.*?;\n/s)?.[0]??'';
+  const mapping=source.match(/const SUPERVISOR_COMMANDS=[^;]*;/s)?.[0]??'';
   assert.doesNotMatch(mapping,/arm(?:coding|autonomous|process|host)/i);
   assert.match(source,/npx -y \$\{exact\} supervisor status/);
 });

package/test/harness2-eval-context-isolation.test.mjs

@@ -0,0 +1,90 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { runIsolatedEvaluation } from '../src/agent-eval-r42.mjs';
+
+const caseBase = {
+  schema: 'deadbyte.agent-eval-case.v1',
+  case_id: 'harness2-context-boundary',
+  task: 'Return a bounded plan.',
+  acceptance: ['Bounded plan']
+};
+
+test('judge-only oracle token nested in allowed context is rejected before generator invocation', async () => {
+  const token = 'JUDGE_ONLY_38d0f04a8a7b4ae8';
+  let generatorCalls = 0;
+  await assert.rejects(runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {files: [{path: 'context.md', contents: `visible notes: ${token}`}]},
+      hidden_oracle: {graded: {token}}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  }), /judge-only.*context|oracle.*leak/i);
+  assert.equal(generatorCalls, 0);
+});
+
+test('judge-only secret in task or acceptance fails closed without echoing secret', async () => {
+  const token = 'SECRET_4f725e0e1cbe4a15';
+  for (const visible of [
+    {task: `Return ${token}`, acceptance: ['Bounded plan']},
+    {task: 'Return a bounded plan.', acceptance: [`Must not reveal ${token}`]}
+  ]) {
+    let generatorCalls = 0;
+    await assert.rejects(runIsolatedEvaluation({
+      caseSpec: {...caseBase, ...visible, allowed_context: {}, hidden_oracle: {secret: token}},
+      generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+      judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+    }), error => {
+      assert.match(error.message, /judge-only.*context/i);
+      assert.equal(error.message.includes(token), false);
+      return true;
+    });
+    assert.equal(generatorCalls, 0);
+  }
+});
+
+test('short explicit judge-only secret is not exempt from context isolation', async () => {
+  let generatorCalls = 0;
+  await assert.rejects(runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {note: 'Visible value K9 is forbidden here'},
+      hidden_oracle: {secret: 'K9'}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  }), /judge-only.*context/i);
+  assert.equal(generatorCalls, 0);
+});
+
+test('nested judge verdict objects cannot enter generator-visible context', async () => {
+  for (const forbidden of ['hidden_oracle', 'judge_result', 'grader_verdict', 'deterministic_eval_result']) {
+    let generatorCalls = 0;
+    await assert.rejects(runIsolatedEvaluation({
+      caseSpec: {
+        ...caseBase,
+        allowed_context: {fixture: {metadata: {[forbidden]: {verdict: 'pass'}}}},
+        hidden_oracle: {expected: 'bounded'}
+      },
+      generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+      judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+    }), /judge-only.*context|grader.*context/i);
+    assert.equal(generatorCalls, 0, `${forbidden} must reject before generator dispatch`);
+  }
+});
+
+test('ordinary shared acceptance terms do not trigger oracle isolation tripwire', async () => {
+  let generatorCalls = 0;
+  const result = await runIsolatedEvaluation({
+    caseSpec: {
+      ...caseBase,
+      allowed_context: {visible: 'bounded plan'},
+      hidden_oracle: {expected: 'bounded plan'}
+    },
+    generator: async () => { generatorCalls++; return {artifact: {plan: ['safe']}}; },
+    judge: async () => ({verdict: 'pass', findings: [], evidence_refs: ['a'.repeat(64)]})
+  });
+  assert.equal(result.verdict, 'pass');
+  assert.equal(generatorCalls, 1);
+});

package/test/helpers/r75-authority-proof.mjs

@@ -0,0 +1,9 @@
+// Unit fixtures use synthetic observations; integration tests verify real policy/grant files.
+export function withAuthorityProof(observation){
+  const authority_proof=Object.fromEntries(Object.entries(observation.authority).map(([plane,entry])=>{
+    const armed=typeof entry==='boolean'?entry:entry.armed;
+    return [plane,{state:armed?'VERIFIED_ARMED':'VERIFIED_DISARMED',
+      policy_sha256:observation.policy_sha256[plane],grant_absent:!armed}];
+  }));
+  return {...observation,authority_proof};
+}

package/test/r100-posix-owned-lock-race.test.mjs

@@ -0,0 +1,72 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,randomBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,readFile,rename,rm,access} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {pathToFileURL} from 'node:url';
+
+const source=process.env.R100_BASELINE_SOURCE
+  ?pathToFileURL(process.env.R100_BASELINE_SOURCE)
+  :new URL('../src/authority-continuity-r65.mjs',import.meta.url);
+const {createAuthorityEpochStore}=await import(source.href);
+
+test('R100 POSIX owned release cannot unlink a byte-identical successor lock',
+  {skip:process.platform==='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r100-posix-'));
+    try{
+      const runtimeDir=path.join(root,'runtime'),trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:nonce}));
+      const lock=path.join(runtimeDir,'authority-epochs','process','.lock');
+      let replaced=0,successor;
+      const store=createAuthorityEpochStore({runtimeDir,onLockDispositionStage:async(stage,file)=>{
+        if(stage!=='release_before_cas')return;
+        assert.equal(file,lock);
+        successor=await readFile(lock);
+        const other=lock+'.successor';
+        await writeFile(other,successor,{flag:'wx'});
+        await rename(other,lock);
+        replaced++;
+      }});
+      await assert.rejects(store.append({plane:'process',action:'grant',grantBytes,
+        grantInstanceNonce:nonce}),/authority epoch lock changed|ownership lost|POSIX.*unsupported/);
+      if(replaced===0){
+        await assert.rejects(access(path.join(runtimeDir,'authority-epochs','process','head.json')),{code:'ENOENT'});
+      }else{
+        assert.equal(replaced,1,'replacement interleave must execute at most once');
+        assert.deepEqual(await readFile(lock),successor,'byte-identical successor lock must survive');
+      }
+    }finally{await rm(root,{recursive:true,force:true});}
+  });
+
+test('R100 POSIX unsupported mutation makes no epoch directory and preserves an existing lock',
+  {skip:process.platform==='win32'},async()=>{
+    const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r100-no-side-effect-'));
+    try{
+      const runtimeDir=path.join(root,'runtime');
+      const trust=path.join(root,'trust');
+      await mkdir(runtimeDir);await mkdir(trust);
+      const keys=generateKeyPairSync('ed25519');
+      await writeFile(path.join(trust,'ed25519-private.pem'),keys.privateKey.export({type:'pkcs8',format:'pem'}),{flag:'wx'});
+      await writeFile(path.join(trust,'ed25519-public.pem'),keys.publicKey.export({type:'spki',format:'pem'}),{flag:'wx'});
+      const nonce=randomBytes(32).toString('hex');
+      const grantBytes=Buffer.from(JSON.stringify({instance_nonce:nonce}));
+      const operation=()=>createAuthorityEpochStore({runtimeDir}).append({plane:'process',action:'grant',
+        grantBytes,grantInstanceNonce:nonce});
+      await assert.rejects(operation,/authority epoch POSIX mutation unsupported/);
+      const epochDir=path.join(runtimeDir,'authority-epochs','process');
+      await assert.rejects(access(epochDir),{code:'ENOENT'});
+      assert.equal(await createAuthorityEpochStore({runtimeDir}).readHead({plane:'process'}),null,
+        'read-only empty-head inspection remains available');
+      await mkdir(epochDir,{recursive:true});
+      const lock=path.join(epochDir,'.lock'),original=Buffer.from('not-an-owned-lock');
+      await writeFile(lock,original,{flag:'wx'});
+      await assert.rejects(operation,/authority epoch POSIX mutation unsupported/);
+      assert.deepEqual(await readFile(lock),original);
+    }finally{await rm(root,{recursive:true,force:true});}
+  });

package/test/r101-acl-probe-environment.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {createRequire, syncBuiltinESMExports} from 'node:module';
+import {pathToFileURL} from 'node:url';
+import path from 'node:path';
+
+const require=createRequire(import.meta.url);
+
+test('R101 privileged ACL probe excludes inherited module roots at child dispatch',
+  {skip:process.platform!=='win32'}, async()=>{
+    const childProcess=require('node:child_process');
+    const originalExecFile=childProcess.execFile;
+    const originalModulePath=process.env.PSModulePath;
+    const originalSystemRoot=process.env.SystemRoot;
+    let captured;
+    try {
+      childProcess.execFile=(executable,args,options,callback)=>{
+        captured={executable,args,environment:options.env};
+        callback(Object.assign(new Error('test stopped child before execution'),{code:'TEST_STOP'}));
+      };
+      syncBuiltinESMExports();
+      process.env.PSModulePath='C:\\r101-poisoned-module-root';
+      process.env.SystemRoot='C:\\r101-false-windows-root';
+      const target=process.env.R101_BASELINE_SOURCE
+        ? pathToFileURL(path.join(process.env.R101_BASELINE_SOURCE,'src','privileged-install-trust-r89.mjs'))
+        : new URL('../src/privileged-install-trust-r89.mjs',import.meta.url);
+      const {inspectTrustedInstallation}=await import(`${target.href}?r101-acl-probe`);
+      await assert.rejects(inspectTrustedInstallation(['C:\\Program Files\\Deadbyte\\bin\\addon.node']),
+        {code:'EPOCH_NATIVE_SLOT_UNTRUSTED'});
+      assert.ok(captured,'ACL child must have been dispatched');
+      assert.equal(captured.executable,'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+      assert.equal(captured.environment.PSModulePath,
+        'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules');
+      assert.equal(captured.environment.SystemRoot,'C:\\Windows');
+      assert.equal(captured.environment.WINDIR,'C:\\Windows');
+      const observed=spawnSync(captured.executable,['-NoLogo','-NoProfile','-NonInteractive',
+        '-Command',"(Get-Command Get-Acl -ErrorAction Stop).Module.Path"],
+        {env:captured.environment,encoding:'utf8',timeout:12000,windowsHide:true});
+      assert.equal(observed.status,0,observed.stderr);
+      assert.match(observed.stdout.trim(),
+        /^C:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\Modules\\Microsoft\.PowerShell\.Security\\/i);
+    } finally {
+      childProcess.execFile=originalExecFile;
+      syncBuiltinESMExports();
+      if(originalModulePath===undefined)delete process.env.PSModulePath;
+      else process.env.PSModulePath=originalModulePath;
+      if(originalSystemRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=originalSystemRoot;
+    }
+  });

package/test/r106-trusted-powershell-spawn.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {windowsPowerShellEnvironment} from '../src/windows-powershell-environment.mjs';
+
+const TRUSTED_POWERSHELL='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+
+test('PowerShell child environment collapses case-variant Windows root keys',()=>{
+  const environment=windowsPowerShellEnvironment({
+    SystemRoot:'C:\\Windows',SYSTEMROOT:'C:\\untrusted-root',
+    WINDIR:'C:\\Windows',windir:'C:\\untrusted-root',
+    PSModulePath:'C:\\custom-modules'
+  });
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='systemroot'),['SystemRoot']);
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='windir'),['WINDIR']);
+  assert.equal(environment.SystemRoot,'C:\\Windows');
+  assert.equal(environment.WINDIR,'C:\\Windows');
+});
+
+test('security-sensitive Windows probes cannot select PowerShell via caller environment',
+  {skip:process.platform!=='win32',concurrency:false},async()=>{
+    const originalSpawn=childProcess.spawnSync;
+    const originalRoot=process.env.SystemRoot;
+    const originalWindir=process.env.WINDIR;
+    const calls=[];
+    try{
+      process.env.SystemRoot='C:\\untrusted-root';
+      process.env.WINDIR='C:\\untrusted-root';
+      childProcess.spawnSync=(file,args,options)=>{
+        calls.push({file,options});
+        return {status:0,stdout:calls.length===1?'MISSING\n':'null\n',stderr:''};
+      };
+      syncBuiltinESMExports();
+      const marker=await import('../src/foreground-marker-cas-win32.mjs');
+      const identity=await import('../src/foreground-process-identity.mjs');
+      assert.equal(marker.readPinnedEpochLockSnapshot('C:\\scratch\\lock.json'),null);
+      assert.equal(identity.queryForegroundIdentity(12345),null);
+      assert.equal(calls.length,2);
+      for(const call of calls){
+        assert.equal(call.file,TRUSTED_POWERSHELL);
+        assert.equal(call.options.env.SystemRoot,'C:\\Windows');
+        assert.equal(call.options.env.WINDIR,'C:\\Windows');
+      }
+    }finally{
+      childProcess.spawnSync=originalSpawn;
+      syncBuiltinESMExports();
+      if(originalRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=originalRoot;
+      if(originalWindir===undefined)delete process.env.WINDIR;
+      else process.env.WINDIR=originalWindir;
+    }
+  });

package/test/r107-updater-powershell-path.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import childProcess from 'node:child_process';
+import {syncBuiltinESMExports} from 'node:module';
+import {mkdtemp,writeFile,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {loadPowerShellDataFile,runControllerStartNoCapture,windowsPowerShellEnvironment} from '../src/runtime-update.mjs';
+
+test('updater PowerShell environment rejects case-colliding Windows root keys',()=>{
+  const environment=windowsPowerShellEnvironment({
+    SystemRoot:'C:\\Windows',SYSTEMROOT:'C:\\untrusted-root',
+    WINDIR:'C:\\Windows',windir:'C:\\untrusted-root'
+  });
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='systemroot'),['SystemRoot']);
+  assert.deepEqual(Object.keys(environment).filter(key=>key.toLowerCase()==='windir'),['WINDIR']);
+  assert.equal(environment.SystemRoot,'C:\\Windows');
+  assert.equal(environment.WINDIR,'C:\\Windows');
+});
+
+test('real updater PowerShell still loads read-only config under poisoned Windows roots',
+  {skip:process.platform!=='win32',concurrency:false},async()=>{
+    const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r107-ps-'));
+    const priorRoot=process.env.SystemRoot;
+    const priorWindir=process.env.WINDIR;
+    try{
+      const config=path.join(scratch,'config.psd1');
+      await writeFile(config,"@{ Schema = 'r107.test'; Enabled = $true }\n",{flag:'wx'});
+      process.env.SystemRoot='C:\\untrusted-root';
+      process.env.WINDIR='C:\\untrusted-root';
+      assert.deepEqual(await loadPowerShellDataFile(config),{Enabled:true,Schema:'r107.test'});
+    }finally{
+      if(priorRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=priorRoot;
+      if(priorWindir===undefined)delete process.env.WINDIR;
+      else process.env.WINDIR=priorWindir;
+      await rm(scratch,{recursive:true,force:true});
+    }
+  });
+
+test('runtime updater cannot launch caller-selected PowerShell for config and controller work',
+  {skip:process.platform!=='win32',concurrency:false},async()=>{
+    const originalSpawn=childProcess.spawnSync;
+    const originalRoot=process.env.SystemRoot;
+    const originalWindir=process.env.WINDIR;
+    let call=null;
+    try{
+      process.env.SystemRoot='C:\\untrusted-root';
+      process.env.WINDIR='C:\\untrusted-root';
+      childProcess.spawnSync=(file,args,options)=>{
+        call={file,args,options};
+        return {status:0,signal:null,error:null,stdout:'{}\n',stderr:''};
+      };
+      syncBuiltinESMExports();
+      assert.deepEqual(await loadPowerShellDataFile('C:\\scratch\\controller.psd1'),{});
+      assert.ok(call,'updater must dispatch its PowerShell subprocess');
+      assert.equal(call.file,'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+      assert.equal(call.options.env.SystemRoot,'C:\\Windows');
+      assert.equal(call.options.env.WINDIR,'C:\\Windows');
+      assert.equal(call.options.shell,undefined);
+      call=null;
+      const started=runControllerStartNoCapture({kind:'legacy',
+        controller_path:'C:\\scratch\\deadbyte-controller.ps1',cwd:'C:\\scratch'},1000);
+      assert.equal(started.status,0);
+      assert.equal(call.file,'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe');
+      assert.ok(call.args.includes('start'));
+      assert.equal(call.options.env.SystemRoot,'C:\\Windows');
+      assert.equal(call.options.env.WINDIR,'C:\\Windows');
+    }finally{
+      childProcess.spawnSync=originalSpawn;
+      syncBuiltinESMExports();
+      if(originalRoot===undefined)delete process.env.SystemRoot;
+      else process.env.SystemRoot=originalRoot;
+      if(originalWindir===undefined)delete process.env.WINDIR;
+      else process.env.WINDIR=originalWindir;
+    }
+  });

package/test/r108-remote-powershell-path.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath,pathToFileURL} from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const systemPowerShell='C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+const winTest=process.platform==='win32'?test:test.skip;
+function poisonedRuntimeImport(source,args){
+  return `process.env.SystemRoot='C:\\\\untrusted-root';process.env.WINDIR='C:\\\\untrusted-root';`+
+    `process.argv=[process.execPath,${JSON.stringify(source)},...${JSON.stringify(args)}];`+
+    `await import(${JSON.stringify(pathToFileURL(source).href)});`;
+}
+
+winTest('remote supervisor dispatch ignores poisoned caller Windows roots',async()=>{
+  const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r108-cli-'));
+  try{
+    await mkdir(path.join(scratch,'bin'));
+    await writeFile(path.join(scratch,'bin','DEADBYTE-MCP.ps1'),
+      "Write-Output ('R108_CONTROLLER_EXECUTED root=' + $env:SystemRoot + ' windir=' + $env:WINDIR)\nexit 0\n",{flag:'wx'});
+    const source=path.join(root,'src','deadbyte-cli.mjs');
+    const result=spawnSync(process.execPath,['--input-type=module','-e',
+      poisonedRuntimeImport(source,['supervisor','status'])],{
+      cwd:root,encoding:'utf8',timeout:15000,windowsHide:true,
+      env:{...process.env,DEADBYTE_STATE_ROOT:scratch}
+    });
+    assert.equal(result.error,undefined,String(result.error));
+    assert.equal(result.status,0,result.stderr);
+    assert.match(result.stdout,/R108_CONTROLLER_EXECUTED root=C:\\Windows windir=C:\\Windows/);
+  }finally{await rm(scratch,{recursive:true,force:true});}
+});
+
+winTest('guardian startup ignores poisoned caller Windows roots before marker lookup',async()=>{
+  const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r108-guardian-'));
+  try{
+    await mkdir(path.join(scratch,'bin'));
+    await writeFile(path.join(scratch,'bin','DEADBYTE-MCP.ps1'),"exit 0\n",{flag:'wx'});
+    const source=path.join(root,'src','remote-session-guardian.mjs');
+    const result=spawnSync(process.execPath,['--input-type=module','-e',
+      poisonedRuntimeImport(source,['--state-root',scratch,'--owner-pid',String(process.pid),'--session-nonce','a'.repeat(64)])],{
+        cwd:root,encoding:'utf8',timeout:15000,windowsHide:true,
+        env:process.env
+      });
+    assert.equal(result.error,undefined,String(result.error));
+    assert.equal(result.status,0,`guardian startup failed under poisoned roots; stderr=${result.stderr}`);
+  }finally{await rm(scratch,{recursive:true,force:true});}
+});
+
+winTest('trusted Windows PowerShell binary exists for remote lifecycle tests',()=>{
+  const result=spawnSync(systemPowerShell,['-NoLogo','-NoProfile','-Command','exit 0'],{
+    encoding:'utf8',timeout:15000,windowsHide:true,
+    env:{...process.env,SystemRoot:'C:\\Windows',WINDIR:'C:\\Windows'}
+  });
+  assert.equal(result.error,undefined,String(result.error));
+  assert.equal(result.status,0);
+});

package/test/r110-supervisor-powershell-path.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {copyFile, mkdir, mkdtemp, rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {observeCurrentProcessIdentity} from '../src/autonomous-local-supervisor.mjs';
+
+test('supervisor identity observation ignores an inherited untrusted Windows root', {skip:process.platform!=='win32'}, async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r110-poisoned-root-'));
+  const shellDir=path.join(root,'System32','WindowsPowerShell','v1.0');
+  const priorRoot=process.env.SystemRoot;
+  const priorWindir=process.env.WINDIR;
+  try {
+    await mkdir(shellDir,{recursive:true});
+    await copyFile('C:\\Windows\\System32\\where.exe',path.join(shellDir,'powershell.exe'));
+    process.env.SystemRoot=root;
+    process.env.WINDIR=root;
+    const identity=await observeCurrentProcessIdentity();
+    assert.ok(identity,'a caller-provided Windows root must not redirect the trusted identity probe');
+    assert.equal(identity.pid,process.pid);
+  } finally {
+    if(priorRoot===undefined) delete process.env.SystemRoot;
+    else process.env.SystemRoot=priorRoot;
+    if(priorWindir===undefined) delete process.env.WINDIR;
+    else process.env.WINDIR=priorWindir;
+    await rm(root,{recursive:true,force:true});
+  }
+});