deadbyte-mcp 0.15.59 → 0.15.61

package/test/r153-r65-signed-precondition-recovery.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync,sign as signBytes} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
+
+const sha=buffer=>createHash('sha256').update(buffer).digest('hex');
+const domain=Buffer.from('DEADBYTE-R27-SLOT-UPDATE-V1\0','utf8');
+const now=()=>new Date().toISOString();
+function seal(body,key,pub){
+  const payload=Buffer.from(canonicalJson(body));
+  const signature=signBytes(null,Buffer.concat([domain,payload]),key).toString('base64');
+  const e={body,body_sha256:sha(payload),attestation:{algorithm:'ed25519',domain:'DEADBYTE-R27-SLOT-UPDATE-V1',
+    key_id:sha(pub.export({type:'spki',format:'der'})),signature_base64:signature}};
+  return {...e,receipt_sha256:sha(Buffer.from(canonicalJson(e)))};
+}
+
+test('signed R27 initial precondition reject safely reconciles R65 unknown claim',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r153-precondition-'));
+  try{
+    const updates=path.join(root,'evidence','updates');
+    await mkdir(updates,{recursive:true});await mkdir(path.join(root,'trust'),{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(root,'trust','ed25519-public.pem'),publicKey.export({type:'spki',format:'pem'}));
+    const manager=createActivationClaimManager({stateRoot:root}),claim=await manager.claim('a'.repeat(64));
+    const pointer={schema:'deadbyte.active-release.v1',release_id:'predecessor-r153',version:'0.15.45',
+      manifest_sha256:'b'.repeat(64),generation_manifest_sha256:'c'.repeat(64)};
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify(pointer));
+    const dir=path.join(updates,'r27-'+'d'.repeat(16)+'-synthetic');
+    await mkdir(dir);
+    const failure=seal({schema:'deadbyte.r27-slot-update-failure.v1',update_id:path.basename(dir),
+      release_version:'0.15.61',candidate_manifest_sha256:'d'.repeat(64),failed_at_utc:now(),
+      result:'PRECONDITION_REJECTED',phase:'initial',error:{name:'Error',message:"host command 'powershell_script' executable pin drift detected; explicit approval required"},
+      prior_pointer:pointer,attempted_pointer:null,rollback:{attempted:false,errors:[]}},privateKey,publicKey);
+    await writeFile(path.join(dir,'failure-receipt.json'),JSON.stringify(failure));
+    await writeFile(path.join(updates,'r65-activation-outcome-test.json'),JSON.stringify({
+      schema:'deadbyte.r65-activation-outcome.v1',claim_operation_id:claim.operation_id,
+      preflight_subject_sha256:claim.subject_sha256,candidate_version:'0.15.61',
+      candidate_manifest_sha256:'d'.repeat(64),predecessor_release_id:pointer.release_id,
+      outcome:{state:'ACTIVATION_OUTCOME_UNKNOWN'},update_id:null,continuity_update_id:null,state_path:null,observed_at_utc:now()
+    }));
+    // A tampered signed envelope must not authorize reclaim.
+    const failurePath=path.join(dir,'failure-receipt.json');
+    await writeFile(failurePath,JSON.stringify({...failure,body:{...failure.body,phase:'committing'}}));
+    await assert.rejects(()=>manager.claim('e'.repeat(64)),/unresolved|in progress/);
+    await writeFile(failurePath,JSON.stringify(failure));
+    // Even a valid signature cannot authorize reclaim if the live pointer changed.
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify({...pointer,release_id:'foreign-runtime'}));
+    await assert.rejects(()=>manager.claim('e'.repeat(64)),/unresolved|in progress/);
+    await writeFile(path.join(root,'active-release.json'),JSON.stringify(pointer));
+    const next=await manager.claim('e'.repeat(64));
+    assert.notEqual(next.operation_id,claim.operation_id);
+    await next.release();
+  }finally{await rm(root,{recursive:true,force:true})}
+});

package/test/r153-staging-leaf-acl.test.mjs

@@ -20,28 +20,39 @@ test('R153 Windows ACL reproduction rejects stripped leaf ACE and restores direc
 $root = Join-Path $env:TEMP ('r153-native-acl-test-' + [guid]::NewGuid().ToString('N'))
 $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
 $leaf = Join-Path $root 'child\file.txt'
+function Read-Digest([string]$Path) {
+  try {
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try { return ([BitConverter]::ToString($sha.ComputeHash([IO.File]::ReadAllBytes($Path)))).Replace('-','') }
+    finally { $sha.Dispose() }
+  } catch [UnauthorizedAccessException] { return $null }
+}
 try {
   New-Item -ItemType Directory -Path (Split-Path -Parent $leaf) -Force | Out-Null
   [IO.File]::WriteAllText($leaf,'read-only regression fixture')
   & icacls.exe $root '/inheritance:r' '/grant:r' ('*'+$sid+':(OI)(CI)(F)') '/T' '/C' | Out-Null
   if($LASTEXITCODE -ne 0){throw 'REPRO_SETUP_FAILED'}
-  $blocked = Get-FileHash -LiteralPath $leaf -Algorithm SHA256 -ErrorAction SilentlyContinue
+  $blocked = Read-Digest $leaf
   if($null -ne $blocked){throw 'REPRO_DID_NOT_STRIP_LEAF_ACE'}
   & icacls.exe $root '/grant' ('*'+$sid+':(F)') '/T' '/C' | Out-Null
   if($LASTEXITCODE -ne 0){throw 'LEAF_REPAIR_FAILED'}
-  $restored = Get-FileHash -LiteralPath $leaf -Algorithm SHA256
-  if($null -eq $restored -or $restored.Hash.Length -ne 64){throw 'LEAF_NOT_READABLE_AFTER_REPAIR'}
-  $acl = Get-Acl -LiteralPath $leaf
-  $allow=@($acl.Access | Where-Object {$_.AccessControlType -eq 'Allow'})
+  $restored = Read-Digest $leaf
+  if($null -eq $restored -or $restored.Length -ne 64){throw 'LEAF_NOT_READABLE_AFTER_REPAIR'}
+  $acl = [IO.File]::GetAccessControl($leaf)
+  $allow=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier]) | Where-Object {$_.AccessControlType -eq 'Allow'})
   if($allow.Count -ne 1){throw 'LEAF_HAS_UNEXPECTED_ALLOW_ACE_COUNT'}
-  if($allow[0].IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -ne $sid){throw 'LEAF_HAS_UNEXPECTED_TRUSTEE'}
+  if($allow[0].IdentityReference.Value -ne $sid){throw 'LEAF_HAS_UNEXPECTED_TRUSTEE'}
   Write-Output 'R153_WIN32_LEAF_ACL_REPAIR_PASS'
 } finally {
-  if(Test-Path -LiteralPath $root){Remove-Item -LiteralPath $root -Force -Recurse}
+  if(Test-Path -LiteralPath $root){
+    & icacls.exe $root '/reset' '/T' '/C' | Out-Null
+    & icacls.exe $root '/inheritance:e' '/grant:r' ('*'+$sid+':(OI)(CI)(F)') '/T' '/C' | Out-Null
+    Remove-Item -LiteralPath $root -Force -Recurse
+  }
 }`;
   const encoded=Buffer.from(ps,'utf16le').toString('base64');
   const result=spawnSync('powershell.exe',['-NoLogo','-NoProfile','-NonInteractive','-EncodedCommand',encoded],
     {encoding:'utf8',timeout:30000,maxBuffer:256*1024});
   assert.equal(result.status,0,result.stderr||result.stdout||String(result.error));
   assert.match(result.stdout,/R153_WIN32_LEAF_ACL_REPAIR_PASS/);
-});
+});

package/test/r153-uac-approval-contract.test.mjs

@@ -4,12 +4,13 @@ import {createUacApproval,verifyUacApproval,validateApprovalWindow,requireTruste
 import {readFileSync} from 'node:fs';
 import {fileURLToPath} from 'node:url';
 const h=(n)=>n.repeat(64);
-const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.59',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
+const base=()=>({stateRoot:'C:\\Users\\DEADBYTE\\.deadbyte-mcp',candidateRoot:'C:\\Program Files\\DEADBYTE-R153-TEST',candidateVersion:'0.15.61',candidateManifestSha256:h('a'),tarballSha256:h('b'),markerReceiptSha256:h('c'),predecessorPointerSha256:h('d'),predecessorPolicySha256:{process:h('1'),coding:h('2'),autonomous:h('3'),desktop:h('4'),host:h('5')},preflightSubjectSha256:h('e'),nodeSha256:h('f'),deployScriptSha256:h('0'),hostCommandPins:[],nonce:h('6'),issuedAt:'2026-10-24T00:00:00.000Z',expiresAt:'2026-10-24T00:05:00.000Z'});
 test('R153 UAC receipt carries exact no-grants narrow migration subject',()=>{
-  const x=base(),receipt=createUacApproval(x);
+  const x={...base(),hostCommandPins:[{command_id:'powershell_script',sha256:h('a')},{command_id:'cmd_script',sha256:h('b')}]},receipt=createUacApproval(x);
   assert.equal(receipt.schema,'deadbyte.r153-uac-approval.v1');
   assert.equal(receipt.action,'narrow_legacy_policy_and_activate');
   assert.deepEqual(receipt.allowed_authority_after,{process:false,coding:false,autonomous:false,desktop:false,host:false});
+  assert.deepEqual(receipt.host_command_pins,[{command_id:'cmd_script',sha256:h('b')},{command_id:'powershell_script',sha256:h('a')}]);
   assert.match(receipt.subject_sha256,/^[0-9a-f]{64}$/);
   assert.deepEqual(verifyUacApproval(receipt,x,{now:'2026-10-24T00:02:00.000Z'}),receipt);
 });
@@ -19,6 +20,7 @@ test('R153 UAC receipt rejects drift across every authority/candidate/runtime in
     assert.throws(()=>verifyUacApproval(receipt,{...x,[key]:value},{now:'2026-10-24T00:02:00.000Z'}),undefined,key);
   }
   assert.throws(()=>verifyUacApproval(receipt,{...x,predecessorPolicySha256:{...x.predecessorPolicySha256,host:h('a')}},{now:'2026-10-24T00:02:00.000Z'}));
+  assert.throws(()=>verifyUacApproval(receipt,{...x,hostCommandPins:[{command_id:'cmd_script',sha256:h('a')}]},{now:'2026-10-24T00:02:00.000Z'}));
 });
 test('R153 UAC receipt fails closed on expiration, malformed, replay-like tamper and grant widening',()=>{
   const x=base(),receipt=createUacApproval(x);
@@ -31,7 +33,7 @@ test('R153 UAC receipt fails closed on expiration, malformed, replay-like tamper
   assert.throws(()=>createUacApproval({...x,issuedAt:'not-a-date'}));
   assert.throws(()=>createUacApproval({...x,nonce:'x'}));
 });
-test('R153 UAC scope only accepts protected root and exact v0.15.59',()=>{
+test('R154 UAC scope only accepts protected root and exact v0.15.61',()=>{
   assert.throws(()=>createUacApproval({...base(),candidateRoot:'C:\\Users\\DEADBYTE\\npm-cache'}),/protected/i);
   assert.throws(()=>createUacApproval({...base(),candidateVersion:'0.15.55'}),/candidate/i);
   assert.throws(()=>validateApprovalWindow('2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z','2026-10-24T00:00:00.000Z'));

package/test/r153-uac-launch-parameter-contract.test.mjs

@@ -45,7 +45,7 @@ test('R153 RED: mutable npx entrypoint stages exact registry package before priv
   assert.doesNotMatch(script,/npm-cli\.js|npm install/i);
   assert.match(script,/Get-FileHash -LiteralPath \$file -Algorithm SHA256/);
   assert.match(script,/NODE_OPTIONS/);
-  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.59/);
+  assert.match(script,/https:\/\/registry\.npmjs\.org\/deadbyte-mcp\/0\.15\.61/);
   assert.match(script,/live npm registry tarball SHA-256 mismatch/);
   assert.match(script,/live npm registry tarball integrity mismatch/);
   assert.match(script,/DEADBYTE-R153-Stage-/);
@@ -54,6 +54,7 @@ test('R153 RED: mutable npx entrypoint stages exact registry package before priv
   assert.match(script,/'\/inheritance:r'/);
   assert.match(script,/verify-protected-stage-r153\.mjs/);
   assert.match(script,/request-uac-migration-r153\.ps1/);
-  assert.match(script,/& \$helper -Elevated/);
+  assert.match(script,/\$helperArgs\s*=\s*@\('-Elevated'/);
+  assert.match(script,/& \$helper @helperArgs/);
   assert.match(script,/Remove-Item -LiteralPath \$prefix -Recurse -Force/);
 });

package/test/r154-multipin-recovery.test.mjs

@@ -0,0 +1,45 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {
+  normalizeHostCommandPins,
+  encodeHostCommandPins,
+  decodeHostCommandPins
+} from '../src/host-command-pins-r154.mjs';
+
+const h=value=>value.repeat(64);
+
+test('R154 accepts a bounded set of distinct existing-command repins',()=>{
+  const pins=normalizeHostCommandPins([
+    `powershell_script=${h('a')}`,
+    `cmd_script=${h('b')}`,
+    `cmd_inline=${h('b')}`
+  ]);
+  assert.deepEqual(pins,[
+    {command_id:'cmd_inline',sha256:h('b')},
+    {command_id:'cmd_script',sha256:h('b')},
+    {command_id:'powershell_script',sha256:h('a')}
+  ]);
+  assert.deepEqual(decodeHostCommandPins(encodeHostCommandPins(pins)),pins);
+});
+
+test('R154 rejects duplicate, malformed, oversized, and delimiter-injected repins',()=>{
+  assert.throws(()=>normalizeHostCommandPins([`cmd_script=${h('a')}`,`cmd_script=${h('a')}`]),/duplicate/i);
+  assert.throws(()=>normalizeHostCommandPins([`unrelated_command=${h('a')}`]),/not repinnable/i);
+  assert.throws(()=>normalizeHostCommandPins([`bad/name=${h('a')}`]),/contract/i);
+  assert.throws(()=>normalizeHostCommandPins([`cmd_script=${h('A')}`]),/contract/i);
+  assert.throws(()=>normalizeHostCommandPins(Array.from({length:17},(_,i)=>`cmd_${i}=${h('a')}`)),/limit/i);
+  assert.throws(()=>decodeHostCommandPins('["cmd_script='+h('a')+'","evil"]'),/contract/i);
+});
+
+test('R154 CLI no longer rejects the second explicit command repin in parsing',()=>{
+  const cli=fileURLToPath(new URL('../src/deadbyte-cli.mjs',import.meta.url));
+  const run=spawnSync(process.execPath,[cli,'remote',
+    '--host-command-pin',`powershell_script=${h('a')}`,
+    '--host-command-pin',`cmd_script=${h('b')}`,
+    'status'],{encoding:'utf8',timeout:8000});
+  assert.equal(run.status,1);
+  assert.doesNotMatch(run.stderr,/may be specified once|requires powershell_script/);
+  assert.match(run.stderr,/presentation flags are valid only for foreground session/);
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');