deadbyte-mcp 0.15.50 → 0.15.52

package/SBOM.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:cdx:deadbyte-mcp:r130:0.15.50",
+  "serialNumber": "urn:cdx:deadbyte-mcp:r143:0.15.52",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
       "name": "deadbyte-mcp",
-      "version": "0.15.50"
+      "version": "0.15.52"
     }
   },
   "components": [
     {
       "type": "library",
       "name": "@modelcontextprotocol/client",
-      "version": "2.1.0"
+      "version": "2.3.1"
     },
     {
       "type": "library",
       "name": "@modelcontextprotocol/server",
-      "version": "2.1.0"
+      "version": "2.3.1"
     },
     {
       "type": "library",
@@ -60,6 +60,11 @@
         }
       ],
       "evidence_status": "CANDIDATE_BINARY_PIN_ONLY_NOT_DEPLOYED"
+    },
+    {
+      "type": "library",
+      "name": "@modelcontextprotocol/core",
+      "version": "2.3.1"
     }
   ]
 }

package/TEST-MATRIX.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.test-matrix.v1",
-  "version": "0.15.50",
-  "train": "R130",
+  "version": "0.15.52",
+  "train": "R143",
   "primary_platform": "win32-x64",
   "reference": {
     "package": "@wonderwhy-er/desktop-commander",
@@ -10,6 +10,21 @@
     "schemas_sha256": "f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140"
   },
   "required": [
+    {
+      "id": "r143-protected-native-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs on exact R143 protected installed tree",
+      "expected": "Zero failures, 49 classified skips preserved, installed manifest PASS"
+    },
+    {
+      "id": "r143-package-verify-only",
+      "command": "node scripts/npm-release-r48.mjs --verify-only",
+      "expected": "Exact-version doctor, manifest verification, npm package and source lineage PASS"
+    },
+    {
+      "id": "r143-publication-reconciliation",
+      "command": "Publish only after prepublish gates PASS, then inspect npm registry and npx outside repo",
+      "expected": "Published version 0.15.52 matches preserved package identity; production not activated"
+    },
     {
       "id": "r71-full-regression",
       "command": "npm test",
@@ -34,6 +49,21 @@
       "id": "r71-owner-grant",
       "command": "Protected owner authentication and project scope",
       "expected": "BLOCK unless independently owner enrolled and scope verified"
+    },
+    {
+      "id": "r132-protected-full",
+      "command": "node --test --test-concurrency=4 test/*.test.mjs on exact R132 protected fixture",
+      "expected": "Zero failures, historical skips recorded, manifest verify-installed pass"
+    },
+    {
+      "id": "r132-independent-rollback",
+      "command": "isolated activation -> rollback -> restore smoke on scratch state root",
+      "expected": "No production mutation; runtime predecessor preserved"
+    },
+    {
+      "id": "r132-artifact-parity",
+      "command": "node scripts/npm-release-r48.mjs --verify-only + fresh npm audit",
+      "expected": "Verified exact 0.15.51 tarball, SDK 2.3.1 and 0 vulnerabilities"
     }
   ],
   "observed_pre_release_evidence": {

package/docs/R132-MANIFEST-PORTABILITY.md

@@ -0,0 +1,23 @@
+# R132 / deadbyte-mcp@0.15.51 — manifest portability
+
+Status: ISOLATED RELEASE CANDIDATE (no npm publish or production activation).
+This release train follows published 0.15.50 and the independently tested R131 developer successor.
+
+## Defect reproduced
+npm v12.1.0 built a package manifest on the source checkout that included `node_modules/which/CHANGELOG.md`. After installing into a separate protected Windows filesystem, a fresh `npm pack --dry-run` omitted that file even though its SHA-256 and bytes remained unchanged. Consequently the old development-package comparison failed in an installed environment (R130: 1,699 pass, 1 failure, 49 skipped). This is NOT evidence of a runtime executable/hash mutation.
+
+## Surgical fix (R131)
+- Keep `release-manifest.mjs verify` unchanged for authors creating an npm tarball: full npm-pack list equality, no path exceptions.
+- Introduce `release-manifest.mjs verify-installed` for protected installations: independently verify SHA-256 of EVERY manifested file and reject extraneous regular files unless their path is exactly `.npmignore` or `package-lock.json`. No directory-level exclusions; symlinks, unexpected runtime files and mutated bytes still fail.
+- `npm-prepublish-contract-r74.mjs` source/installed mode is explicit; defaults to strict source verification. On protected Windows the test selects installed mode via `DEADBYTE_TEST_PROTECTED_MANIFEST=installed`. It still tests pinned native hashes, predecessor separation and private file leakage.
+- R131 protected Windows full native 1,705 PASS, 0 FAIL, 49 SKIP (1,754 tests); source manifest 2,371 files PASS.
+- R132 adds honest 0.15.51 release metadata, current 2.3.1 client/server/core SBOM, and new source-predecessor identity tests. R132 exact-byte gates must run independently; R131 results are not R132 results.
+
+## Immutable lineage
+- npm published 0.15.50 tarball SHA-256 `133b9f4adedee14a3e4f2fd1c9433f7ebf102742a73398161b238fd68eb42d84`.
+- npm 0.15.50 source manifest SHA-256 `98dd37c71adae980856adc17b9c59d58d167a01d46c61106055956d0f306fede`.
+- R131 predecessor candidate source manifest SHA-256 `3e5edb9987aa7c9004dda3164a278da70a60495c0c128e2602426075a5222c10`.
+- Production runtime predecessor remains v0.15.45; its pointer must not change during isolated gates.
+
+## Remaining release gates
+Full Windows native regression on exact R132 protected fixture; isolated activation/rollback/restore tests with scratch state; npm pack manifest and independent doctor; SBOM parity and npm audit; no production activation, grant changes or npm publish until the respective gates and explicit actions.

package/docs/R135-AUTONOMOUS-SCOPE.md

@@ -0,0 +1,21 @@
+# R135 — Autonomous scope isolation foundation
+
+Status: DEVELOPMENT / OFFLINE PROJECTION ONLY. Do not publish, deploy, arm any grant, or change the production pointer based on this candidate.
+
+## Observed 0.15.45 production conflict
+The manual Coding policy SHA-256 `63f2153517c2e1f3febc5e78ef7e9f766fac3483178ae098021746d5be6ba246` includes `local_c` (C:\\) and `local_d` (D:\\) with read/write/exec. The Autonomous policy names only `core`. The R70 controller rejects **any** broad Coding root at Autonomous metadata admission, even when Autonomous selects a project. This is deliberate defense against an Autonomous tool invoking the already-armed broad Coding capability. Removing only the controller assertion would be a security regression.
+
+## Isolated projection implementation
+`src/autonomous-scope-r135.mjs` exports `deriveIsolatedAutonomousScope`, a pure synchronous *policy preview* function. It takes trusted parsed manual Coding/Autonomous policies, one project root ID, and a separate existing project-scoped state root. It returns two **in-memory** JSON policy byte buffers and their SHA-256 digests, without touching manual or production policy files.
+
+The projected Coding policy retains only the nominated real project directory and commands referenced by the selected Autonomous profiles. The projected Autonomous policy is rebound to the SHA-256 of those exact projected Coding bytes. Both leases and evidence roots are redirected to the separate isolated state. The function refuses whole-drive roots, missing / redirected project roots, commands missing from Coding, profiles targeting other roots, overlapping existing manual lease storage, and preexisting child grant files.
+
+The previous R70 admission check is kept unchanged. `assertAutonomousBootstrapRoots` passes for the projected pair and still rejects the original broad manual Coding policy. The owner approval signature gate and all grant issuance/epoch controls are unchanged.
+
+## Security boundary not yet implemented
+An offline policy projection is **not** enforcement. A shared process with access to the broad manual Coding lease could still inherit broad authority. Do not install these policy bytes inside the existing production controller or arm Autonomous against its Coding policy. Before deployment, implement and test an independently hosted project-scoped runtime with its own distinct Coding grant, owner enrollment/signature, trust root, disjoint lifecycle and authority epoch, and proof of privilege noninheritance even if the manual runtime has broad roots. These policy bytes alone do not demonstrate such isolation.
+
+## Evidence and gates
+The R135 source is an isolated copy of R132B, still internally labeled version 0.15.51 and **must not republish**. R135 test files explicitly cover fail-closed scope projection, manual policy preservation, no inherited grants, and compatibility with the existing R70 whole-drive rejection. The independent production preflight R134 remains BLOCKED for live activation; unresolved historical transaction evidence remains immutable. The R135 candidate is not a 0.15.51 release artifact.
+
+Live signed owner approval and actual production activation/rollback are separate decisions. No modifications to the existing 0.15.45 runtime, grants, policies or active-release pointer are part of R135.

package/docs/R136-SCOPED-OBSERVER.md

@@ -0,0 +1,21 @@
+# R136 — Disarmed Scoped Observer Process / Coding Command-Root Closure
+
+Status: **DEV ONLY — NOT A PRIVILEGE SANDBOX, NOT READY FOR LIVE AUTONOMOUS EXECUTION**.
+
+## Predecessor and regression
+Source predecessor is R135 (development candidate), copied separately without changing the published `deadbyte-mcp@0.15.51` package or active production `0.15.45`. R135's projected Coding commands retained broad `root_ids` from parent manual Coding. This created a latent unsafe future integration path even though the R135 projection had only one root and no execution.
+
+R136 changes `deriveIsolatedAutonomousScope` to require that each selected command already allow the selected scoped root and then replace its `root_ids` with that root alone. The original manual Coding policy is byte-preserved. Tests were observed RED and then GREEN for both command closure and missing scope.
+
+## Child process
+`src/scoped-observer-launcher-r136.mjs` creates a separate Node child process running `src/scoped-observer-worker-r136.mjs` with an explicit tiny environment allowlist (Windows directory and temporary paths only). All `NODE_OPTIONS`, `DEADBYTE_*`, and other ambient user secrets are omitted. The worker verifies exact policy SHA-256 against its launch pins, checks that both policy files live under its declared isolated state, both grants are absent, Coding/Autonomous reference a single project root, and every Coding command has only the selected root. It exposes only a read-only `status` IPC response, explicit denials for privileged operations, and `shutdown`. IPC identity keys cannot be user overwritten. Exit/disposal is verified.
+
+This worker does **not** invoke `coding-plane` commands, issue grants, or access manual authority epochs. It does not attach to production or register tools with the live MCP server.
+
+## Security limitations and next gate
+A separate process with sanitized environment is NOT an OS-level security boundary. It still runs under the same Windows account and therefore potentially retains filesystem rights to broad manual Coding resources. The worker has no privileged action handlers, but adding any executor to it would require independent owner-signed grant enrollment, restricted Windows token / explicit filesystem ACL isolation, disjoint trust store and authority epoch, stronger IPC mutual authentication, process lifecycle and crash/recovery tests, and a proof that broad grants cannot be read or reused. Passing R136 does not authorize such execution.
+
+Historical 13 rollback/update records remain unchanged. R70 rejection of broad Coding roots remains unchanged and must continue passing. `0.15.51` is immutable and any deployable code requires a new version and full protected Windows release gate. No production grants, policies, pointer, running processes or settings are changed by this development patch.
+
+## Verification
+Tests: `test/r136-scoped-command-rights.test.mjs`, `test/r136-scoped-observer.test.mjs`, all prior R135 scope tests and R70 security tests. Windows real production policy fixture read only: `D:\Projects\deadbyte-mcp\testing\r136-scoped-runtime-dev\R136-LIVE-POLICY-PROBE.json`. It shows process PID, independent scope hash pins, action denials, environment scrubbing, no leases, original production SHA preservation. This is not an activation/rollback test.

package/docs/R137-DESKTOP-COMMANDER-FOUNDATION.md

@@ -0,0 +1,31 @@
+# R137 — Desktop Commander reference foundation (three pinned versions)
+
+Status: **isolated development, unsealed and unpublished**.
+
+## Purpose
+Use locally preserved Desktop Commander builds as engineering/compatibility baselines while keeping DEADBYTE MCP's compact native authority and runtime model. Do NOT embed or invoke three vendor servers, replace the existing MCP core, add network telemetry, or relax authority/grant checks. This is the small-interface strategy: preserve 26 known useful Commander tools and one reliable config file.
+
+Local reference snapshots:
+- `D:\\Projects\\deadbyte-mcp\\references\\desktop-commander v0.2.52`: package 0.2.52, MIT (package metadata). Tool schema SHA-256 `f342345e34e48769dabaefe1b932f09d41e2e207b422f7794a15ee50ffa8f140`, 27 toolArgSchemas including hidden `track_ui_event`, 26 public.
+- `D:\\Projects\\deadbyte-mcp\\references\\desktop-commander v0.3.0`: package 0.3.0, MIT (package metadata). Tool schema SHA-256 `7d4c62e2099d757d8fba68011cfe25d3088426f56c0b77d5b8fa3edb4ec49c2c`, 26 schemas incl hidden, 25 public; `get_prompts` absent. Has `config-recovery.js`, SHA-256 `f091cc7f0f62413cf9debb461f3777ee2e1d4c194501daa7ad2c4570d5ccc542`.
+- `D:\\Projects\\deadbyte-mcp\\references\\desktop-commander-0.3.1-alpha.2\\static`: package 0.3.1-alpha.2, MIT (actual LICENSE), 27 schemas incl hidden (26 public); schema SHA-256 `6a290497b29f9dc5f43d66008ea54fcf0c302edea5612af519ef52ab3816d29e`. Original tarball SHA-256 `faaf3f34f114589c0630ce4eaa7114ecc628ce2030822dfe67feac0e17fedc4b`. LICENSE SHA-256 `0fac4e4dfbd64a2a616b9ae2e14c4a3a5635d2a5fc9c43177fb834059afa58e3`.
+
+## What was actually implemented
+`src/commander-config-recovery-r137.mjs` implements a narrow recovery inspired by the 0.3.x feature but with stricter authority separation:
+- Recover only two fully parsed and bounded top-level display limits: `fileReadLineLimit` (1..1000) and `fileWriteLineLimit` (1..50).
+- Never salvage `allowedDirectories`, `blockedCommands`, `defaultShell`, `telemetryEnabled`, or any privileged or unknown setting from damaged bytes.
+- Save a distinct byte-exact `commander-config.json.corrupt.<timestamp>.<uuid>` backup before repairing; verify the original SHA on readback; replace with a new temporary file then atomic rename. Never repair oversized files silently.
+- Serialize parallel first reads to avoid duplicated recoveries; retain normal hash-preconditioned `setConfigValue` behavior.
+- Return recovery metadata as structured result of `get_config` only if recovery actually occurred.
+
+`test/r137-commander-three-version-contract.test.mjs` checks the pinned version-specific schemas and DEADBYTE normalization for each existing public name. `track_ui_event` remains deliberately hidden; no vendor telemetry is enabled. The original exhaustive R48 schema differential against 0.2.52 is preserved.
+
+This design is NOT a new filesystem or command authorization mechanism. Native DEADBYTE policy / sessions / hash-pinned mutations continue to govern actions, independent of the recovered compatibility settings.
+
+## License notice and provenance
+Desktop Commander copyright Eduard Ruzga / contributors; MIT License. The 0.3.1-alpha.2 package contains the license text in `static/LICENSE`; the other two locally retained package.json files state MIT but do not include standalone LICENSE files. The full MIT license text/notice for the reference design is included at `docs/THIRD-PARTY-DESKTOP-COMMANDER-MIT.md`. No dist scripts, vendor node_modules or telemetry SDK copied into DEADBYTE. No new runtime dependencies introduced.
+
+## Gates and operational boundary
+R137 source is an isolated copy of R136; its package.json still says `0.15.51`, a **published immutable version that must not be republished**. Full native regression should run from an independently copied protected Windows fixture with User RX ACLs, not mutable D:\\ source, as R89 native lock enforces installation trust.
+
+No production mutation; current active runtime stays 0.15.45, npm published latest stays 0.15.51, and R135/R136 autonomous process experiments are not activated. Further release requires a new version, full protected regression, owner-reviewed policy and independent activation/rollback gates.

package/docs/R138-COMMANDER-WORKFLOW.md

@@ -0,0 +1,21 @@
+# R138 — Commander process, output, session workflow
+
+Status: DEVELOPMENT successor, not published, not deployed, no authority changes.
+
+The native DEADBYTE MCP runtime remains the sole executor; reference Desktop Commander 0.2.52/0.3.0/0.3.1-alpha.2 tool schemas, not vendor servers. This train focuses on making its existing Commander bridge practical without adding Autonomous privilege layers.
+
+## Process list integrity
+`src/commander-external-process-r48.mjs` now validates every observation page, including the SHA-256 snapshot identity, timestamp, max page size and cursor. It detects repeated cursors before re-querying, denies duplicate PIDs within a snapshot, denies changing timestamps or snapshot IDs, and bounds page count. A corrupt observation is rejected before the returned PID can be used for an external kill. The existing identity-bound external termination path is unchanged.
+
+## Output pagination and sessions
+`src/commander-wire-adapter-r47.mjs` now attaches byte-level resume and truncation metadata to the Commander-compatible `read_process_output` structured response. Incremental offset=0 reads return `next_byte_offset` and `more_unread`; historical offset reads return `next_byte_offset:null` because they do not consume the incremental cursor. `earliest_offset` and `truncated` report retention loss explicitly. The public tool input schemas remain exactly as before.
+
+`list_sessions` now displays child PID, profile, root, execution state and known exit outcome on one line; empty inventories are readable. Structured session data is untouched. No PID kill authority, raw command execution permissions or standing grants are expanded.
+
+## Tests and provenance
+TDD initial RED reproduced repeated cursor, duplicate PID, inconsistent snapshot timestamps, invalid cursor/identity, missing resume metadata and unreadable session list. The modified tests subsequently passed alongside the R48 Commander wire/managed/external-process regressions. The reference schema parity test for three pinned Desktop Commander versions remains present from R137.
+
+The predecessor R137 source manifest SHA-256 is `7fd24ceda2f9369293c79f8da2a12616af822fa4c1224833336e7271a662a643`. Active production pointer SHA-256 is `df926f14fca1c14478342dce5ed41aa1c4b67fb12ae733114f03c8c720ea61e9` (runtime `0.15.45`) and must remain unchanged. R138 still uses package version `0.15.51` for development and must not republish it. Any release requires a distinct version and independent full protected Windows gate.
+
+## Limits
+The Commander bridge has existing file editing/reading/search and process operations, not every Desktop Commander UX feature. R138 proves the named improvements, not full remote parity, production activation, all historical 49 skipped tests, or OS privilege isolation.

package/docs/R139-COMMANDER-ERGONOMICS.md

@@ -0,0 +1,17 @@
+# R139 — Practical Commander: large text, partial search, startup preview
+
+Status: DEVELOPMENT ONLY / not a new npm release / not production activation.
+
+Predecessor is R138 (2390 file manifest SHA-256 `8a60c3408dfc18f7593ff6a029a194ee2b503bcc2eed16c2b9ac020d490e863a`). Isolated source `D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-r139-commander-ergonomics-dev`. Runtime remains `0.15.45`; published npm latest remains `0.15.51`.
+
+## Four improvements
+- **Large text reading:** `read_file` for text exceeding the former native 4 MiB compatibility-read cap now uses `src/commander-large-text-r139.mjs` to scan at most 64 MiB with 256 KiB native pages (or the stricter policy cap). It verifies an identical native full-file SHA-256 across pages and rejects malformed cursors, file changes, oversized lines, invalid UTF-8, and oversized files. Only requested line ranges are retained in memory; the full-file scan is O(file size) and may require several native reads. Regular small files and document-specific readers remain unchanged.
+- **Large text edit:** plain-text `edit_block` can modify a uniquely matched string in a UTF-8 file up to 16 MiB (or tighter native policy limit) using the *existing* native hash-preconditioned atomic write. Count of replacements must match the caller. Binary/NUL and invalid UTF-8 targets are rejected; a UTF-8 BOM is preserved. Not an unbounded text writer; DOCX/XLSX native authoring paths are unchanged.
+- **Search results sooner:** `get_more_search_results` now returns discovered matches during an unfinished multi-page search, with `isComplete:false` and `hasMoreResults:true`; it does not disguise discovered matches as zero until all pages finish. Search runtime's existing signed cursor, abort policy and limits are unchanged.
+- **Initial output preview:** `start_process` performs one nonwaiting (`waitMs:0`) 16 KiB maximum read after the process has started and returns any *already available* UTF-8 data in `structuredContent.initial_output` and text. It does not advance the independent process output cursor, so `read_process_output` will still show those bytes again; consumers should deduplicate if mixing both outputs. A failed/binary output probe does **not** disguise a successfully started process as a failed start.
+
+## Security / compatibility
+No command policies, grants, project roots, owner authority, token permissions, npm dependencies, or public tool input schemas are broadened. Existing Desktop Commander 0.2.52, 0.3.0 and 0.3.1-alpha.2 public-schema tests stay in the suite. Most large-file failures remain fail-closed rather than attempting partial destructive edits. A changed file is not rewritten, and no unrestricted subprocess or external vendor server is introduced.
+
+## Evidence
+Observed TDD RED -> GREEN for each feature using `test/r139-*.test.mjs` and existing R47/R48 tests. The new tests include large 5 MiB read/edit, SHA change during paging, binary edit refusal, exact replacement, UTF-8 BOM preservation, oversized edit refusal, partial search and immediate process-output preview. This candidate retains package version `0.15.51` and must not republish that immutable version. Production activation requires a separate decision and live/rollback gates.

package/docs/THIRD-PARTY-DESKTOP-COMMANDER-MIT.md

@@ -0,0 +1,27 @@
+# Desktop Commander reference — MIT notice
+
+The reference design and compatibility tests draw on the Desktop Commander MCP project, by Eduard Ruzga and Desktop Commander Contributors. Source: https://github.com/wonderwhy-er/DesktopCommanderMCP. Exact reference snapshots are described in R137-DESKTOP-COMMANDER-FOUNDATION.md.
+
+The following text is the license notice found in the local 0.3.1-alpha.2 distribution. Include it if copying or redistributing covered Desktop Commander software.
+
+MIT License
+
+Copyright (c) 2024-2025 Eduard Ruzga and Desktop Commander Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.50",
+  "version": "0.15.52",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-prepublish-contract-r74.mjs

@@ -7,7 +7,8 @@ import {fileURLToPath} from 'node:url';
 const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const sha256Bytes = bytes => createHash('sha256').update(bytes).digest('hex');
 
-export async function verifyR74PrepublishContract({rootPath = root} = {}) {
+export async function verifyR74PrepublishContract({rootPath = root, manifestVerification = 'source'} = {}) {
+  if (!['source','installed'].includes(manifestVerification)) throw new Error('Unsupported prepublish manifest verification mode');
   const result = {
     schema: 'deadbyte.r74-prepublish-contract.v1',
     valid: false,
@@ -63,7 +64,11 @@ export async function verifyR74PrepublishContract({rootPath = root} = {}) {
   result.identities.manifest_sha256 = sha256Bytes(manifestBytes);
   result.checks.manifest_exists = true;
 
-  const manifestVerifyResult = spawnSync(process.execPath, [path.join(rootPath, 'scripts', 'release-manifest.mjs'), 'verify'], {
+  // Authoring/release packaging retains strict npm-pack manifest equality.
+  // Isolated protected installations instead validate every pinned byte and
+  // reject unlisted files except two fixed non-runtime packaging metadata files.
+  const manifestCommand = manifestVerification === 'installed' ? 'verify-installed' : 'verify';
+  const manifestVerifyResult = spawnSync(process.execPath, [path.join(rootPath, 'scripts', 'release-manifest.mjs'), manifestCommand], {
     cwd: rootPath,
     encoding: 'utf8',
     timeout: 60000,
@@ -73,6 +78,7 @@ export async function verifyR74PrepublishContract({rootPath = root} = {}) {
     throw new Error(`Prepublish contract failed: working tree manifest verification failed: ${manifestVerifyResult.stderr || manifestVerifyResult.stdout}`);
   }
   result.checks.manifest_verified = true;
+  result.checks.manifest_verification_mode = manifestVerification;
 
   // 4. Packaged files boundary (no leaks of private/testing trees)
   const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');

package/scripts/release-manifest.mjs

@@ -175,6 +175,19 @@ async function verifyTree() {
   console.log(`MANIFEST_VERIFY_TREE_OK files=${entries.size} sha256=${sha256(actual)}`);
 }
 
+// Installed-tree verification deliberately avoids regenerating the packlist
+// (npm pack has environment-sensitive inclusion behavior after installation).
+// Every manifested byte is still hash-checked; only precisely named
+// packaging metadata, excluded from npm payload, may appear additionally.
+async function verifyInstalled() {
+  const actual = await readFile(manifestPath);
+  const entries = parseSlotManifest(actual.toString('utf8'));
+  await verifyManifestTreeExact(root, entries, {
+    allowedExtraPaths:['.npmignore','package-lock.json']
+  });
+  console.log(`MANIFEST_VERIFY_INSTALLED_OK files=${entries.size} sha256=${sha256(actual)}`);
+}
+
 const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : '';
 if (invokedPath === fileURLToPath(import.meta.url)) {
   const command = process.argv[2] ?? 'verify';
@@ -182,7 +195,8 @@ if (invokedPath === fileURLToPath(import.meta.url)) {
     if (command === 'write') await writeManifest();
     else if (command === 'verify') await verifyManifest();
     else if (command === 'verify-tree') await verifyTree();
-    else throw new Error(`usage: node scripts/release-manifest.mjs [write|verify|verify-tree]`);
+    else if (command === 'verify-installed') await verifyInstalled();
+    else throw new Error(`usage: node scripts/release-manifest.mjs [write|verify|verify-tree|verify-installed]`);
   } catch (error) {
     console.error(`MANIFEST_${command.toUpperCase()}_FAIL ${error?.stack ?? error}`);
     process.exitCode = 1;

package/src/autonomous-scope-r135.mjs

@@ -0,0 +1,91 @@
+import {createHash} from 'node:crypto';
+import {existsSync,lstatSync,realpathSync} from 'node:fs';
+import path from 'node:path';
+
+// R135 is an offline POLICY PROJECTION only. It cannot mint a lease or grant,
+// modify an active generation, or make a broad manual Coding grant safe to
+// inherit in the same process. Execution requires a separate proven boundary.
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const clone=value=>structuredClone(value);
+function realProjectRoot(input){
+ if(typeof input!=='string'||!path.isAbsolute(input))throw new Error('real project directory required');
+ const candidate=path.resolve(input),disk=path.parse(candidate).root;
+ const eq=(a,b)=>process.platform==='win32'?a.toLowerCase()===b.toLowerCase():a===b;
+ if(eq(candidate,disk))throw new Error('project-scoped root required');
+ try{
+  const info=lstatSync(candidate);
+  if(!info.isDirectory()||info.isSymbolicLink()||!eq(realpathSync(candidate),candidate)){
+   throw new Error('path redirected');
+  }
+  let cursor=candidate;
+  for(;;){
+   if(lstatSync(cursor).isSymbolicLink())throw new Error('linked ancestor');
+   const parent=path.dirname(cursor);
+   if(parent===cursor)break;
+   cursor=parent;
+  }
+ }catch{throw new Error('real project directory required')}
+ return candidate;
+}
+export function deriveIsolatedAutonomousScope({manualCodingPolicy,autonomousPolicy,scopeRootId,isolatedStateRoot}={}){
+ if(manualCodingPolicy?.schema!=='deadbyte.coding-policy.v1'||manualCodingPolicy.enabled!==true)
+  throw new Error('manual Coding policy schema invalid');
+ if(autonomousPolicy?.schema!=='deadbyte.autonomous-policy.v1'||autonomousPolicy.enabled!==true)
+  throw new Error('Autonomous policy schema invalid');
+ if(!/^[A-Za-z0-9._-]{1,64}$/.test(scopeRootId??''))throw new Error('invalid project scope');
+ if(!path.isAbsolute(isolatedStateRoot??''))throw new Error('isolated state root must be absolute');
+ const scopedRoot=manualCodingPolicy.roots?.[scopeRootId];
+ if(!scopedRoot)throw new Error('approved project root missing from Coding policy');
+ if(!Array.isArray(autonomousPolicy.root_ids)||autonomousPolicy.root_ids.length!==1||
+   autonomousPolicy.root_ids[0]!==scopeRootId)throw new Error('Autonomous root outside approved scope');
+ const safeRoot=realProjectRoot(scopedRoot.path);
+ const isolated=realProjectRoot(isolatedStateRoot);
+ const eq=(a,b)=>process.platform==='win32'?a.toLowerCase()===b.toLowerCase():a===b;
+ const manualLease=manualCodingPolicy.lease_file,autonLease=autonomousPolicy.lease_file;
+ for(const lease of [manualLease,autonLease]){
+  if(typeof lease!=='string'||!path.isAbsolute(lease))throw new Error('manual policy lease invalid');
+  const rel=path.relative(isolated,path.resolve(lease));
+  if(rel===''||(!path.isAbsolute(rel)&&rel!=='..'&&!rel.startsWith('..'+path.sep))){
+   throw new Error('isolated state root overlaps manual Coding lease');
+  }
+ }
+ // Fail closed for any profiles referencing another root or missing command.
+ const selectedCommands={};
+ for(const [id,profile] of Object.entries(autonomousPolicy.profiles??{})){
+  if(profile?.root_id!==scopeRootId)throw new Error('Autonomous profile '+id+' root outside approved scope');
+  const command=profile.command_id;
+  if(typeof command!=='string'||!Object.hasOwn(manualCodingPolicy.commands??{},command)){
+   throw new Error('Autonomous command missing from Coding policy');
+  }
+  const selected=clone(manualCodingPolicy.commands[command]);
+  if(!Array.isArray(selected.root_ids)||!selected.root_ids.includes(scopeRootId)){
+   throw new Error('Autonomous command '+command+' outside approved scope');
+  }
+  selected.root_ids=[scopeRootId];
+  selectedCommands[command]=selected;
+ }
+ if(autonomousPolicy.planner?.backend==='codex_app_server'&&
+     autonomousPolicy.planner.root_id!==scopeRootId)throw new Error('planner root outside approved scope');
+ const codingPolicy=clone(manualCodingPolicy);
+ codingPolicy.roots={[scopeRootId]:{...clone(scopedRoot),path:safeRoot}};
+ codingPolicy.commands=selectedCommands;
+ codingPolicy.lease_file=path.join(isolated,'runtime','coding-grant.json');
+ codingPolicy.evidence_dir=path.join(isolated,'evidence','coding');
+ if(existsSync(codingPolicy.lease_file)||existsSync(path.join(isolated,'runtime','autonomous-grant.json'))){
+  throw new Error('isolated grant file already present');
+ }
+ const codingBytes=Buffer.from(JSON.stringify(codingPolicy,null,2)+'\n','utf8');
+ const nextAutonomous=clone(autonomousPolicy);
+ nextAutonomous.root_ids=[scopeRootId];
+ nextAutonomous.coding_policy_sha256=sha(codingBytes);
+ nextAutonomous.lease_file=path.join(isolated,'runtime','autonomous-grant.json');
+ nextAutonomous.evidence_dir=path.join(isolated,'evidence','autonomous');
+ const autonomousBytes=Buffer.from(JSON.stringify(nextAutonomous,null,2)+'\n','utf8');
+ return Object.freeze({
+  scope_root_id:scopeRootId,isolated_state_root:isolated,
+  codingBytes,autonomousBytes,
+  codingPolicy,autonomousPolicy:nextAutonomous,
+  coding_sha256:sha(codingBytes),autonomous_sha256:sha(autonomousBytes),
+  status:'OFFLINE_UNAUTHORIZED_PROJECTION'
+ });
+}

package/src/commander-config-recovery-r137.mjs

@@ -0,0 +1,67 @@
+import {createHash,randomUUID} from 'node:crypto';
+import {readFile,writeFile,rename} from 'node:fs/promises';
+import path from 'node:path';
+
+// Reference design: Desktop Commander 0.3.0 MIT config-recovery.
+// DEADBYTE independently restricts salvage to NON-AUTHORITY display limits;
+// privileged configuration never flows into this recovery path.
+const MAX_BYTES=1024*1024;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const isObject=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
+
+export function salvageSafeCommanderLimits(raw){
+ if(typeof raw!=='string'||Buffer.byteLength(raw,'utf8')>MAX_BYTES)return {};
+ let str=raw.charCodeAt(0)===0xfeff?raw.slice(1):raw;
+ if(!str.trimStart().startsWith('{'))return {};
+ const base=str.indexOf('{'),ends=[];
+ let depth=0,quoted=false,escaped=false;
+ for(let i=base;i<str.length;i++){
+  const c=str[i];
+  if(quoted){if(escaped)escaped=false;else if(c==='\\')escaped=true;else if(c==='"')quoted=false;continue;}
+  if(c==='"'){quoted=true;continue;}
+  if(c==='{'||c==='['){depth++;continue;}
+  if(c==='}'||c===']'){depth--;if(depth===0){ends.push({index:i+1,complete:true});break;}if(depth<0)break;continue;}
+  if(c===','&&depth===1)ends.push({index:i,complete:false});
+ }
+ let obj={};
+ for(const item of ends.reverse()){
+  try{
+   const v=JSON.parse(str.slice(base,item.index)+(item.complete?'':'}'));
+   if(isObject(v)){obj=v;break;}
+  }catch{}
+ }
+ const safe={};
+ for(const [key,max] of [['fileReadLineLimit',1000],['fileWriteLineLimit',50]]){
+  const value=obj[key];
+  if(Number.isSafeInteger(value)&&value>=1&&value<=max)safe[key]=value;
+ }
+ return safe;
+}
+
+export async function recoverCorruptCommanderConfig(file,bytes,defaults){
+ if(!Buffer.isBuffer(bytes)||bytes.length>MAX_BYTES)throw new Error('Commander config corrupt or oversized; manual inspection required');
+ if(!isObject(defaults))throw new Error('recovery defaults invalid');
+ const safe=salvageSafeCommanderLimits(bytes.toString('utf8'));
+ const next={...structuredClone(defaults),...safe};
+ // The only trusted recovered settings are bounded display limits.
+ next.telemetryEnabled=false;
+ next.allowedDirectories=[];
+ next.blockedCommands=structuredClone(defaults.blockedCommands);
+ const current=await readFile(file);
+ if(sha(current)!==sha(bytes))throw new Error('Commander config changed during recovery; stop');
+ const backup=path.basename(file)+'.corrupt.'+Date.now()+'.'+randomUUID();
+ const backupPath=path.join(path.dirname(file),backup);
+ await writeFile(backupPath,bytes,{flag:'wx',mode:0o600});
+ const tmp=file+'.recover-'+randomUUID();
+ try{
+  await writeFile(tmp,JSON.stringify(next)+'\n',{flag:'wx',mode:0o600});
+  const verify=await readFile(file);
+  if(sha(verify)!==sha(bytes))throw new Error('Commander config changed during recovery; stop');
+  await rename(tmp,file);
+ }catch(error){
+  const {rm}=await import('node:fs/promises');
+  await rm(tmp,{force:true}).catch(()=>{});
+  throw error;
+ }
+ return {config:next,recovery:{status:'recovered',backup_filename:backup,corrupt_sha256:sha(bytes),salvaged_keys:Object.keys(safe)}};
+}

package/src/commander-extended-runtime.mjs

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { canonicalJson } from './canonical-json.mjs';
 import { createDeadbytePdf } from './commander-pdf-r48.mjs';
 import { DEADBYTE_VERSION } from './version.mjs';
+import {recoverCorruptCommanderConfig} from './commander-config-recovery-r137.mjs';
 
 export const COMMANDER_EXTENDED_SCHEMA='deadbyte.commander-extended.v1';
 const MAX_VALUE=16384,MAX_FEEDBACK=4096,MAX_PREVIEW=65536;
@@ -44,17 +45,33 @@ function makePdf(text){
 export function createCommanderExtendedRuntime({stateRoot,history=null,prompts=DEFAULT_PROMPTS,resources=[]}={}){
   if(typeof stateRoot!=='string'||!stateRoot)throw new Error('extended runtime stateRoot required');
   const configPath=path.join(stateRoot,'commander-config.json'),feedbackDir=path.join(stateRoot,'feedback');
-  let configCache=null;
+  let configCache=null,recovery=null,loadPromise=null;
   async function loadConfig(){
     if(configCache)return configCache;
-    try{configCache={...structuredClone(COMPAT_CONFIG_DEFAULTS),...JSON.parse(await readFile(configPath,'utf8'))};}
-    catch(e){if(e?.code!=='ENOENT')throw e;configCache=structuredClone(COMPAT_CONFIG_DEFAULTS);}
-    return configCache;
+    if(!loadPromise)loadPromise=(async()=>{
+      let bytes;
+      try{bytes=await readFile(configPath);}
+      catch(e){
+        if(e?.code!=='ENOENT')throw e;
+        configCache=structuredClone(COMPAT_CONFIG_DEFAULTS);return configCache;
+      }
+      try{
+        const parsed=JSON.parse(bytes.toString('utf8'));
+        if(!parsed||typeof parsed!=='object'||Array.isArray(parsed))throw new SyntaxError('config must be an object');
+        configCache={...structuredClone(COMPAT_CONFIG_DEFAULTS),...parsed};
+      }catch(e){
+        if(!(e instanceof SyntaxError))throw e;
+        const result=await recoverCorruptCommanderConfig(configPath,bytes,COMPAT_CONFIG_DEFAULTS);
+        configCache=result.config;recovery=result.recovery;
+      }
+      return configCache;
+    })();
+    try{return await loadPromise;}finally{loadPromise=null;}
   }
   async function getConfig({key=null}={}){
     const cfg=await loadConfig();
     if(key!==null&&!keyOk(key))throw new Error('config key invalid');
-    return {schema:COMMANDER_EXTENDED_SCHEMA,status:'ok',config:key===null?structuredClone(cfg):{[key]:cfg[key]},config_sha256:sha256(cfg)};
+    return {schema:COMMANDER_EXTENDED_SCHEMA,status:'ok',config:key===null?structuredClone(cfg):{[key]:cfg[key]},config_sha256:sha256(cfg),...(recovery?{recovery:structuredClone(recovery)}:{})};
   }
   async function setConfigValue({key,value,expected_sha256}){
     if(!keyOk(key))throw new Error('config key invalid');

package/src/commander-external-process-r48.mjs

@@ -61,17 +61,39 @@ export function createCommanderExternalProcessRuntime({observationRuntime,hostPo
     let cursor=null,first=null;
     const processes=[];
     const receiptIds=[];
+    const cursorSet=new Set(),pidSet=new Set();
     do{
       const page=await observationRuntime.processList({limit:PAGE_SIZE,includeExternal:true,cursor});
       if(page?.status!=='ok'||!Array.isArray(page.processes)) throw new Error('external process observation failed');
+      if(typeof page.snapshot_id!=='string'||!/^[0-9a-f]{64}$/.test(page.snapshot_id))
+        throw new Error('external process observation snapshot identity invalid');
+      if(typeof page.observed_at_utc!=='string'||!ISO_UTC.test(page.observed_at_utc)||
+         !Number.isFinite(Date.parse(page.observed_at_utc)))
+        throw new Error('external process observation timestamp invalid');
       if(!first) first=page;
-      else if(page.snapshot_id!==first.snapshot_id) throw new Error('external process observation snapshot changed during pagination');
+      else{
+        if(page.snapshot_id!==first.snapshot_id) throw new Error('external process observation snapshot changed during pagination');
+        if(page.observed_at_utc!==first.observed_at_utc)
+          throw new Error('external process observation time changed during pagination');
+      }
+      if(page.processes.length>PAGE_SIZE)throw new Error('external process observation page exceeds bounded limit');
       for(const item of page.processes){
         if(processes.length>=MAX_PROCESSES) throw new Error('external process observation exceeds bounded process cap');
-        processes.push(normalizeIdentity(item));
+        const identity=normalizeIdentity(item);
+        if(pidSet.has(identity.pid))throw new Error('external process observation duplicate PID');
+        pidSet.add(identity.pid);
+        processes.push(identity);
       }
       if(typeof page.receipt_id==='string') receiptIds.push(page.receipt_id);
-      cursor=page.next_cursor??null;
+      const next=page.next_cursor??null;
+      if(next!==null){
+        if(typeof next!=='string'||next.length<1||next.length>8192)throw new Error('external process observation cursor invalid');
+        if(cursorSet.has(next))throw new Error('external process pagination cursor repeated');
+        cursorSet.add(next);
+        if(cursorSet.size>Math.ceil(MAX_PROCESSES/PAGE_SIZE)+1)
+          throw new Error('external process pagination exceeded page limit');
+      }
+      cursor=next;
     }while(cursor!==null);
     return {
       status:'ok',