deadbyte-mcp 0.15.48 → 0.15.50

package/node_modules/@modelcontextprotocol/server/dist/stdio.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require('./chunk-Bnu9O96Y.cjs');
-const require_mcp = require('./mcp-DUcCQSTW.cjs');
-const require_src = require('./src-CgFsfg3E.cjs');
+const require_mcp = require('./mcp-BumlNux0.cjs');
+const require_src = require('./src-BhnGYybN.cjs');
 let _modelcontextprotocol_server__shims = require("@modelcontextprotocol/server/_shims");
 
 //#region src/server/stdio.ts

package/node_modules/@modelcontextprotocol/server/dist/stdio.d.cts

@@ -1,4 +1,4 @@
-import { c as McpServerFactory, ft as Transport, vr as JSONRPCMessage } from "./createMcpHandler-BLVe3qmU.cjs";
+import { c as McpServerFactory, pt as Transport, yr as JSONRPCMessage } from "./createMcpHandler-DZmmlN8e.cjs";
 import { Readable, Writable } from "node:stream";
 
 //#region src/server/serveStdio.d.ts

package/node_modules/@modelcontextprotocol/server/dist/stdio.d.mts

@@ -1,4 +1,4 @@
-import { c as McpServerFactory, ft as Transport, vr as JSONRPCMessage } from "./createMcpHandler-Bt6U_Fqb.mjs";
+import { c as McpServerFactory, pt as Transport, yr as JSONRPCMessage } from "./createMcpHandler-D4NN8WsG.mjs";
 import { Readable, Writable } from "node:stream";
 
 //#region src/server/serveStdio.d.ts

package/node_modules/@modelcontextprotocol/server/dist/stdio.mjs

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_MAX_SUBSCRIPTIONS, i as installModernOnlyHandlers, o as serverIdentityOf, t as McpServer, v as StdioListenRouter } from "./mcp-Dw2OlZ1f.mjs";
-import { F as carriesValidModernEnvelopeClaim, J as isJSONRPCErrorResponse, Q as isJSONRPCResultResponse, R as modernOnlyStrictRejection, X as isJSONRPCRequest, Y as isJSONRPCNotification, at as requestMetaOf, c as ReadBuffer, d as serializeMessage, ft as UnsupportedProtocolVersionError, it as hasEnvelopeClaim, mt as ProtocolErrorCode, ot as validateEnvelopeMeta, rt as envelopeClaimVersion, vt as SUPPORTED_MODERN_PROTOCOL_VERSIONS, y as setNegotiatedProtocolVersion } from "./src-D-y6h4N7.mjs";
+import { _ as DEFAULT_MAX_SUBSCRIPTIONS, i as installModernOnlyHandlers, o as serverIdentityOf, t as McpServer, v as StdioListenRouter } from "./mcp-DIH4cS6P.mjs";
+import { F as carriesValidModernEnvelopeClaim, J as isJSONRPCErrorResponse, Q as isJSONRPCResultResponse, R as modernOnlyStrictRejection, X as isJSONRPCRequest, Y as isJSONRPCNotification, at as requestMetaOf, c as ReadBuffer, d as serializeMessage, ft as UnsupportedProtocolVersionError, it as hasEnvelopeClaim, mt as ProtocolErrorCode, ot as validateEnvelopeMeta, rt as envelopeClaimVersion, vt as SUPPORTED_MODERN_PROTOCOL_VERSIONS, y as setNegotiatedProtocolVersion } from "./src-Cqbh3MYc.mjs";
 import { process } from "@modelcontextprotocol/server/_shims";
 
 //#region src/server/stdio.ts

package/node_modules/@modelcontextprotocol/server/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@modelcontextprotocol/server",
-  "version": "2.1.0",
+  "version": "2.3.1",
   "description": "Model Context Protocol implementation for TypeScript - Server package",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",
   "homepage": "https://modelcontextprotocol.io",
   "bugs": "https://github.com/modelcontextprotocol/typescript-sdk/issues",
@@ -123,7 +123,7 @@
   ],
   "dependencies": {
     "zod": "^4.2.0",
-    "@modelcontextprotocol/core": "2.1.0"
+    "@modelcontextprotocol/core": "2.3.1"
   },
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
@@ -141,7 +141,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.1",
     "vitest": "^4.0.15",
-    "@modelcontextprotocol/core-internal": "^2.0.1",
+    "@modelcontextprotocol/core-internal": "^2.0.4",
     "@modelcontextprotocol/eslint-config": "^2.0.0",
     "@modelcontextprotocol/test-helpers": "^2.0.0",
     "@modelcontextprotocol/tsconfig": "^2.0.0",

package/node_modules/which/CHANGELOG.md

@@ -0,0 +1,166 @@
+# Changes
+
+
+## 2.0.2
+
+* Rename bin to `node-which`
+
+## 2.0.1
+
+* generate changelog and publish on version bump
+* enforce 100% test coverage
+* Promise interface
+
+## 2.0.0
+
+* Parallel tests, modern JavaScript, and drop support for node < 8
+
+## 1.3.1
+
+* update deps
+* update travis
+
+## v1.3.0
+
+* Add nothrow option to which.sync
+* update tap
+
+## v1.2.14
+
+* appveyor: drop node 5 and 0.x
+* travis-ci: add node 6, drop 0.x
+
+## v1.2.13
+
+* test: Pass missing option to pass on windows
+* update tap
+* update isexe to 2.0.0
+* neveragain.tech pledge request
+
+## v1.2.12
+
+* Removed unused require
+
+## v1.2.11
+
+* Prevent changelog script from being included in package
+
+## v1.2.10
+
+* Use env.PATH only, not env.Path
+
+## v1.2.9
+
+* fix for paths starting with ../
+* Remove unused `is-absolute` module
+
+## v1.2.8
+
+* bullet items in changelog that contain (but don't start with) #
+
+## v1.2.7
+
+* strip 'update changelog' changelog entries out of changelog
+
+## v1.2.6
+
+* make the changelog bulleted
+
+## v1.2.5
+
+* make a changelog, and keep it up to date
+* don't include tests in package
+* Properly handle relative-path executables
+* appveyor
+* Attach error code to Not Found error
+* Make tests pass on Windows
+
+## v1.2.4
+
+* Fix typo
+
+## v1.2.3
+
+* update isexe, fix regression in pathExt handling
+
+## v1.2.2
+
+* update deps, use isexe module, test windows
+
+## v1.2.1
+
+* Sometimes windows PATH entries are quoted
+* Fixed a bug in the check for group and user mode bits. This bug was introduced during refactoring for supporting strict mode.
+* doc cli
+
+## v1.2.0
+
+* Add support for opt.all and -as cli flags
+* test the bin
+* update travis
+* Allow checking for multiple programs in bin/which
+* tap 2
+
+## v1.1.2
+
+* travis
+* Refactored and fixed undefined error on Windows
+* Support strict mode
+
+## v1.1.1
+
+* test +g exes against secondary groups, if available
+* Use windows exe semantics on cygwin & msys
+* cwd should be first in path on win32, not last
+* Handle lower-case 'env.Path' on Windows
+* Update docs
+* use single-quotes
+
+## v1.1.0
+
+* Add tests, depend on is-absolute
+
+## v1.0.9
+
+* which.js: root is allowed to execute files owned by anyone
+
+## v1.0.8
+
+* don't use graceful-fs
+
+## v1.0.7
+
+* add license to package.json
+
+## v1.0.6
+
+* isc license
+
+## 1.0.5
+
+* Awful typo
+
+## 1.0.4
+
+* Test for path absoluteness properly
+* win: Allow '' as a pathext if cmd has a . in it
+
+## 1.0.3
+
+* Remove references to execPath
+* Make `which.sync()` work on Windows by honoring the PATHEXT variable.
+* Make `isExe()` always return true on Windows.
+* MIT
+
+## 1.0.2
+
+* Only files can be exes
+
+## 1.0.1
+
+* Respect the PATHEXT env for win32 support
+* should 0755 the bin
+* binary
+* guts
+* package
+* 1st

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.48",
+  "version": "0.15.50",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",
@@ -103,8 +103,8 @@
     "zod"
   ],
   "dependencies": {
-    "@modelcontextprotocol/client": "2.1.0",
-    "@modelcontextprotocol/server": "2.1.0",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/server": "2.3.1",
     "typescript": "5.9.3",
     "zod": "4.4.3"
   },

package/scripts/npm-release-r48.mjs

@@ -95,10 +95,6 @@ async function main() {
   if (!isVerifyOnly && version==='0.15.45') assertR71NpmPublishReady(release);
   if (!isVerifyOnly && version==='0.15.46') await assertR72NpmPublishReady(release,{root});
   if (!isVerifyOnly && version==='0.15.47') await assertR74NpmPublishReady(release,{root});
-  if (version==='0.15.48') {
-    const {assertR108NpmPublishReady} = await import('./npm-release-readiness-r108.mjs');
-    await assertR108NpmPublishReady(release,{root,provenance});
-  }
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {

package/scripts/verify-authority-epoch-history.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import {lstat} from 'node:fs/promises';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+
+const planes = new Set(['process', 'coding', 'autonomous', 'desktop', 'host']);
+const sha256 = /^[0-9a-f]{64}$/;
+
+function parse(argv) {
+  if(argv.length!==6)throw new Error('expected --runtime-dir, --plane, and --expected-head');
+  const args = {};
+  for(let i=0;i<argv.length;i+=2){
+    const flag=argv[i],value=argv[i+1];
+    if(!['--runtime-dir','--plane','--expected-head'].includes(flag)||
+        Object.hasOwn(args,flag)||typeof value!=='string'||value.length===0)
+      throw new Error('authority history audit arguments invalid');
+    args[flag]=value;
+  }
+  const runtimeDir=args['--runtime-dir'],plane=args['--plane'],expectedHead=args['--expected-head'];
+  if(!path.isAbsolute(runtimeDir)||!planes.has(plane)||!sha256.test(expectedHead))
+    throw new Error('authority history audit subject invalid');
+  return {runtimeDir,plane,expectedHead};
+}
+
+async function main() {
+  const {runtimeDir,plane,expectedHead}=parse(process.argv.slice(2));
+  const stat=await lstat(runtimeDir);
+  if(!stat.isDirectory()||stat.isSymbolicLink())throw new Error('authority history audit runtime root invalid');
+  const result=await createAuthorityEpochStore({runtimeDir}).auditHistory({plane});
+  if(result.status!=='PASS'||result.event_sha256!==expectedHead)
+    throw new Error('authority history audit expected head mismatch');
+  process.stdout.write(JSON.stringify(result)+'\n');
+}
+
+main().catch(error=>{
+  process.stderr.write(`AUTHORITY_HISTORY_AUDIT_FAIL ${String(error?.message??error)}\n`);
+  process.exitCode=1;
+});

package/src/activation-continuity-engine-r65.mjs

@@ -1,5 +1,5 @@
 import {createHash,randomBytes} from 'node:crypto';
-import {open,readFile,rm} from 'node:fs/promises';
+import {open,readFile} from 'node:fs/promises';
 import path from 'node:path';
 import {canonicalJson} from './canonical-json.mjs';
 import {decodeUtf8Strict} from './text-policy.mjs';
@@ -44,20 +44,12 @@ async function writeExclusive(file,bytes){
 async function removeIfExact(file,expectedSha256){
   // The Windows native disposition pins a single handle from read/hash through deletion.
   // Never use a pathname removal after confirming only a previous snapshot.
-  if(process.platform==='win32'){
-    const verdict=deletePinnedRemoteMarker(file,expectedSha256);
-    if(verdict==='REMOVED')return {removed:true,reason:'matched'};
-    if(verdict==='MISSING')return {removed:false,reason:'absent'};
-    if(verdict==='CHANGED')return {removed:false,reason:'replacement'};
-    throw new Error('authority grant native deletion verdict invalid');
-  }
-  // Legacy non-Windows behavior is retained for source/test compatibility.
-  // It is NOT a cross-platform pinned-deletion security guarantee.
-  const current=await readOptional(file);
-  if(current===null)return {removed:false,reason:'absent'};
-  if(sha(current)!==expectedSha256)return {removed:false,reason:'replacement'};
-  await rm(file,{force:true});
-  return {removed:true,reason:'matched'};
+  if(process.platform!=='win32')throw new Error('authority grant POSIX disposition unsupported');
+  const verdict=deletePinnedRemoteMarker(file,expectedSha256);
+  if(verdict==='REMOVED')return {removed:true,reason:'matched'};
+  if(verdict==='MISSING')return {removed:false,reason:'absent'};
+  if(verdict==='CHANGED')return {removed:false,reason:'replacement'};
+  throw new Error('authority grant native deletion verdict invalid');
 }
 function validateCapture(capture){
   if(!plain(capture)||typeof capture.update_id!=='string'||!Array.isArray(capture.planes)||!plain(capture.records))throw new Error('authority continuity capture invalid');
@@ -100,6 +92,8 @@ function classifyConflict(head,record,updateId){
 }
 
 export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPaths,successorPolicyPaths,updateId}={}){
+  if(process.platform!=='win32')
+    throw new Error('authority continuity POSIX mutation unsupported: native disposition unavailable');
   const state=path.resolve(String(stateRoot??''));
   if(!stateRoot||!plain(predecessorPolicyPaths)||typeof successorPolicyPaths!=='function'||
       typeof updateId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(updateId))

package/src/agent-eval-r42.mjs

@@ -4,6 +4,11 @@ import { canonicalJson } from './canonical-json.mjs';
 const HEX64=/^[0-9a-f]{64}$/;
 const ID=/^[A-Za-z0-9._-]{1,96}$/;
 const SEVERITY=new Set(['info','low','medium','high','critical']);
+const JUDGE_ONLY_KEY=/(?:secret|token|password|answer[_-]?key|ground[_-]?truth)/i;
+const JUDGE_ONLY_CONTEXT_KEYS=new Set([
+  'hidden_oracle','judge_result','grader_verdict','deterministic_eval_result',
+  'deterministic_eval_summary','judge_scope_and_deterministic_status'
+]);
 const sha=value=>createHash('sha256').update(Buffer.from(canonicalJson(value),'utf8')).digest('hex');
 function object(value,label){if(!value||typeof value!=='object'||Array.isArray(value))throw new Error(`${label} invalid`);return value;}
 function keys(value,allowed,label){const extra=Object.keys(value).filter(key=>!allowed.includes(key));if(extra.length)throw new Error(`${label} unknown field '${extra[0]}'`);}
@@ -11,6 +16,30 @@ function id(value,label){if(typeof value!=='string'||!ID.test(value))throw new E
 function text(value,label,max=8192){if(typeof value!=='string'||value.length<1||value.length>max||value.includes('\0'))throw new Error(`${label} invalid`);return value;}
 function textList(value,label,maxItems=32,maxLength=1024){if(!Array.isArray(value)||value.length>maxItems||value.some(item=>typeof item!=='string'||item.length<1||item.length>maxLength))throw new Error(`${label} invalid`);return [...value];}
 
+function assertNoJudgeOnlyContextLeak(core){
+  const checkKeys=(value,depth=0)=>{
+    if(depth>32)throw new Error('eval visible context nesting exceeds safe limit');
+    if(Array.isArray(value)){for(const item of value)checkKeys(item,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value)){
+      if(JUDGE_ONLY_CONTEXT_KEYS.has(key.toLowerCase()))throw new Error('judge-only result leaked into generator context');
+      checkKeys(item,depth+1);
+    }
+  };
+  checkKeys(core.allowed_context);
+  const visible=canonicalJson({task:core.task,allowed_context:core.allowed_context,acceptance:core.acceptance});
+  const visit=(value,secretKey=false,depth=0)=>{
+    if(depth>32)throw new Error('eval hidden oracle nesting exceeds safe limit');
+    if(typeof value==='string'){
+      if(secretKey&&value.length>0&&visible.includes(JSON.stringify(value).slice(1,-1)))
+        throw new Error('judge-only oracle value leaked into generator context');
+      return;
+    }
+    if(Array.isArray(value)){for(const item of value)visit(item,secretKey,depth+1);return;}
+    if(value&&typeof value==='object')for(const [key,item] of Object.entries(value))visit(item,secretKey||JUDGE_ONLY_KEY.test(key),depth+1);
+  };
+  visit(core.hidden_oracle);
+}
+
 function normalizeCase(raw){
   const value=object(raw,'agent eval case');keys(value,['schema','case_id','task','allowed_context','hidden_oracle','acceptance'],'agent eval case');
   if(value.schema!=='deadbyte.agent-eval-case.v1')throw new Error('agent eval case schema invalid');
@@ -18,6 +47,7 @@ function normalizeCase(raw){
     allowed_context:structuredClone(object(value.allowed_context,'eval allowed_context')),
     hidden_oracle:structuredClone(object(value.hidden_oracle,'eval hidden_oracle')),
     acceptance:textList(value.acceptance,'eval acceptance')};
+  assertNoJudgeOnlyContextLeak(core);
   return Object.freeze({...core,case_sha256:sha(core)});
 }