deadbyte-mcp 0.15.60 → 0.15.62

package/test/r160-marker-proof.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {
+  selectLegacyMarkerEvidence,
+  verifyLocatedLegacyMarkerReceipt
+} from '../src/legacy-marker-evidence-r159.mjs';
+import {createMarkerReconciliationReceipt} from '../src/clean-activation-recovery-r153.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const id=value=>value.repeat(64);
+const pointer=Object.freeze({
+  release_id:'v0.15.61-CURRENT',version:'0.15.61',
+  manifest_sha256:id('1'),generation_manifest_sha256:id('2')
+});
+const policySha256=Object.freeze({
+  process:id('3'),coding:id('4'),autonomous:id('5'),desktop:id('6'),host:id('7')
+});
+const authority=Object.freeze({process:false,coding:false,autonomous:false,desktop:false,host:false});
+const proofFor=(markerSha256,policies=policySha256)=>digest(Buffer.from(canonicalJson({
+  pointer,policy_sha256:policies,marker_sha256:markerSha256,authority
+}),'utf8'));
+
+async function locatedFixture(t,{tamper}={}){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r160-located-'));
+  const evidenceDir=path.join(root,'legacy-migration');
+  await mkdir(evidenceDir);
+  t.after(()=>rm(root,{recursive:true,force:true}));
+  const markerSha256=id('a'),intentSha256=id('b');
+  const receipt=createMarkerReconciliationReceipt({
+    pointer,policySha256,markerSha256,
+    proofSha256:proofFor(markerSha256),
+    observedAtUtc:'2026-10-25T00:00:00.000Z',intentSha256
+  });
+  const terminal=tamper?tamper({...receipt}):receipt;
+  const terminalPath=path.join(evidenceDir,`marker-${markerSha256}.terminal.json`);
+  const terminalBytes=Buffer.from(`${JSON.stringify(terminal)}\n`,'utf8');
+  await writeFile(terminalPath,terminalBytes);
+  await writeFile(path.join(evidenceDir,'r153-pending-migration.json'),`${JSON.stringify({
+    schema:'deadbyte.r153-pending-migration.v1',marker_sha256:markerSha256,
+    receipt_path:terminalPath,receipt_sha256:digest(terminalBytes)
+  })}\n`);
+  return {evidenceDir,terminalPath};
+}
+
+test('R160 located receipt is accepted only after R153 proof binding verification',async t=>{
+  const fixture=await locatedFixture(t);
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  const verified=await verifyLocatedLegacyMarkerReceipt({located:selected,pointer,policySha256});
+  assert.equal(verified.state,'MARKER_RECONCILED');
+  assert.equal(verified.receipt_path,fixture.terminalPath);
+  assert.match(verified.receipt_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('R160 consistent locator and terminal hashes cannot hide a wrong proof subject',async t=>{
+  const fixture=await locatedFixture(t,{tamper:receipt=>({...receipt,proof_sha256:id('f')})});
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  assert.equal(selected.kind,'located','R159 selector alone accepts the internally consistent bytes');
+  await assert.rejects(
+    verifyLocatedLegacyMarkerReceipt({located:selected,pointer,policySha256}),
+    /proof binding mismatch|subject mismatch|predecessor drift/i
+  );
+});
+
+test('R160 located receipt verification rejects policy drift after selection',async t=>{
+  const fixture=await locatedFixture(t);
+  const selected=await selectLegacyMarkerEvidence({evidenceDir:fixture.evidenceDir,activePointer:pointer});
+  await assert.rejects(
+    verifyLocatedLegacyMarkerReceipt({
+      located:selected,pointer,policySha256:{...policySha256,coding:id('c')}
+    }),
+    /proof binding mismatch|predecessor drift/i
+  );
+});
+
+test('R160 CLI rechecks active pointer after located proof verification',async()=>{
+  const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  assert.match(source,/R160 active release changed after located marker verification/);
+  const verifyAt=source.indexOf('verifyLocatedLegacyMarkerReceipt({located:selected,pointer:readback,policySha256})');
+  const finalReadAt=source.indexOf('await readActiveRuntimeBinding(ctx.root)',verifyAt);
+  assert.ok(verifyAt>0&&finalReadAt>verifyAt,'final pointer read-back must follow proof verification');
+});
+

package/test/r160-package-decision-manifest.test.mjs

@@ -0,0 +1,67 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {
+  R160_STARTUP_DECISION_FILES,
+  verifyPackageDecisionManifest
+} from '../src/package-identity-r160.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function fixture(t){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r160-package-'));
+  t.after(()=>rm(root,{recursive:true,force:true}));
+  const bodies=new Map();
+  for(const rel of R160_STARTUP_DECISION_FILES){
+    const bytes=Buffer.from(rel==='package.json'
+      ? `${JSON.stringify({name:'deadbyte-mcp',version:'0.15.62'})}\n`
+      : `fixture:${rel}\n`,'utf8');
+    const file=path.join(root,...rel.split('/'));
+    await mkdir(path.dirname(file),{recursive:true});
+    await writeFile(file,bytes);
+    bodies.set(rel,bytes);
+  }
+  const manifest=Buffer.from([...bodies].map(([rel,bytes])=>`${sha(bytes)}  ${rel}`).join('\n')+'\n','utf8');
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  return {root,bodies,manifest};
+}
+
+test('R160 startup decision manifest binds every decision file and package identity',async t=>{
+  const f=await fixture(t);
+  const result=await verifyPackageDecisionManifest({root:f.root,expectedVersion:'0.15.62'});
+  assert.equal(result.files,R160_STARTUP_DECISION_FILES.length);
+  assert.equal(result.manifest_sha256,sha(f.manifest));
+});
+
+test('R160 startup decision manifest rejects changed bytes before foreground claim',async t=>{
+  const f=await fixture(t);
+  await writeFile(path.join(f.root,'src','deadbyte-cli.mjs'),'changed\n');
+  await assert.rejects(
+    verifyPackageDecisionManifest({root:f.root,expectedVersion:'0.15.62'}),
+    /startup decision file hash mismatch: src\/deadbyte-cli\.mjs/
+  );
+});
+
+test('R160 startup decision manifest rejects a newly required recovery module omitted from manifest',async t=>{
+  const f=await fixture(t);
+  const lines=(await readFile(path.join(f.root,'MANIFEST.SHA256'),'utf8')).split(/\r?\n/)
+    .filter(line=>!line.endsWith('  src/legacy-marker-evidence-r159.mjs'));
+  await writeFile(path.join(f.root,'MANIFEST.SHA256'),`${lines.join('\n')}\n`);
+  await assert.rejects(
+    verifyPackageDecisionManifest({root:f.root,expectedVersion:'0.15.62'}),
+    /startup decision manifest missing: src\/legacy-marker-evidence-r159\.mjs/
+  );
+});
+
+test('R160 remote startup verifies decision bytes before evidence recovery and foreground claim',async()=>{
+  const source=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
+  const verifyAt=source.indexOf('await verifyPackageDecisionManifest({root:CURRENT_PACKAGE_ROOT,expectedVersion:DEADBYTE_VERSION})');
+  const recoverAt=source.indexOf('const migrationContext=await recoverRemoteSession(ctx,{displayMode})');
+  const claimAt=source.indexOf('marker=await claimRemoteSession(ctx)');
+  assert.ok(verifyAt>0&&verifyAt<recoverAt&&recoverAt<claimAt,
+    'package decision manifest must be verified before recovery and claim');
+});
+

package/test/r160-release-contract.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async rel=>JSON.parse(await readFile(path.join(root,rel),'utf8'));
+
+test('R160 package identity separates source and live runtime predecessors',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,bom]=await Promise.all([
+    read('package.json'),read('package-lock.json'),read('bridge/package.json'),read('RELEASE.json'),
+    read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
+  for(const version of [pkg.version,lock.version,lock.packages[''].version,bridge.version,release.version,
+    provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION]) assert.equal(version,'0.15.62');
+  assert.equal(release.train,'R160');
+  assert.equal(matrix.train,'R160');
+  assert.equal(release.runtime_predecessor.version,'0.15.61');
+  assert.equal(release.runtime_predecessor.release_id,'v0.15.61-055d1ff0aa99e60b');
+  assert.equal(release.runtime_predecessor.manifest_sha256,'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf');
+  assert.equal(release.runtime_predecessor.generation_manifest_sha256,'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4');
+  assert.equal(release.source_predecessor.train,'R159');
+  assert.match(release.source_predecessor.source_path,/deadbyte-mcp-0\.15\.62-r159-marker-reconcile/i);
+  assert.equal(release.r160.public_tool_delta,0);
+  assert.equal(release.r160.authority_scope_delta,0);
+  assert.equal(release.r160.production_activation,'NOT_RUN');
+  assert.equal(release.r160.npm_publish,'NOT_RUN');
+  assert.equal(provenance.r160.source_bytes_copied_from_references,false);
+});

package/test/r160-stable-launcher.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {renderStableLauncherCmd} from '../src/release-slot.mjs';
+
+test('R160 stable CMD launcher selects the native Windows PowerShell explicitly', () => {
+  const cmd=renderStableLauncherCmd();
+  assert.match(cmd,/if not defined SystemRoot exit \/b 1/i);
+  assert.match(cmd,/"%SystemRoot%\\System32\\WindowsPowerShell\\v1\.0\\powershell\.exe"/i);
+  assert.doesNotMatch(cmd,/(?:^|\r?\n)powershell\.exe\s/im);
+});

package/test/r163-isolated-slot-rollback-restore.test.mjs

@@ -0,0 +1,58 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {atomicWriteActivePointer,materializeReleaseSlot,parseActivePointer,parseManifest,renderStableLauncherPs1,verifyManifestTreeExact} from '../src/release-slot.mjs';
+
+const candidate=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const version='0.15.62';
+const parent=path.join(os.homedir(),'.deadbyte-mcp','releases','v0.15.61-055d1ff0aa99e60b');
+const parentDigest='055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf';
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+async function generation(state,label){
+  const root=path.join(state,'generations',label);
+  await mkdir(root,{recursive:true});
+  const config=Buffer.from(`@{ Label = '${label}' }\r\n`,'utf8');
+  await writeFile(path.join(root,'controller-config.psd1'),config,{flag:'wx'});
+  const manifest=Buffer.from(`${sha(config)}  controller-config.psd1\n`,'utf8');
+  await writeFile(path.join(root,'GENERATION.SHA256'),manifest,{flag:'wx'});
+  return {root,manifest_sha256:sha(manifest),config_path:path.join(root,'controller-config.psd1')};
+}
+test('R163 isolated immutable slot activates, rolls back, and restores 0.15.62 without authority or production mutation',async()=>{
+  const stateBase=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r163-isolated-'));
+  const state=path.join(stateBase,'state');
+  try{
+    const pkg=JSON.parse(await readFile(path.join(candidate,'package.json'),'utf8'));
+    assert.equal(pkg.version,version);
+    const parentManifest=await readFile(path.join(parent,'MANIFEST.SHA256'));
+    const nextManifest=await readFile(path.join(candidate,'MANIFEST.SHA256'));
+    assert.equal(sha(parentManifest),parentDigest);
+    const nextDigest=sha(nextManifest);
+    const parentSlot=await materializeReleaseSlot({source:parent,stateRoot:state,version:'0.15.61',manifestSha256:parentDigest});
+    const nextSlot=await materializeReleaseSlot({source:candidate,stateRoot:state,version,manifestSha256:nextDigest});
+    const pGen=await generation(state,'r163-parent');
+    const nGen=await generation(state,'r163-next');
+    const launcherSha=sha(Buffer.from(renderStableLauncherPs1(),'utf8'));
+    const pointerPath=path.join(state,'active-release.json');
+    const ptr=(slot,ver,g)=>({schema:'deadbyte.active-release.v1',release_id:slot.release_id,version:ver,
+      manifest_sha256:slot.manifest_sha256,release_root:slot.release_root,generation_root:g.root,
+      generation_manifest_sha256:g.manifest_sha256,launcher_sha256:launcherSha,config_path:g.config_path});
+    const activated=await atomicWriteActivePointer(pointerPath,ptr(nextSlot,version,nGen));
+    assert.equal(activated.release_id,nextSlot.release_id);
+    await verifyManifestTreeExact(nextSlot.release_root,parseManifest(nextManifest.toString('utf8')));
+    const rolled=await atomicWriteActivePointer(pointerPath,ptr(parentSlot,'0.15.61',pGen));
+    assert.equal(rolled.release_id,parentSlot.release_id);
+    assert.equal(rolled.manifest_sha256,parentDigest);
+    await verifyManifestTreeExact(parentSlot.release_root,parseManifest(parentManifest.toString('utf8')));
+    const restored=await atomicWriteActivePointer(pointerPath,ptr(nextSlot,version,nGen));
+    assert.deepEqual(restored,activated);
+    assert.deepEqual(parseActivePointer(await readFile(pointerPath,'utf8')),activated);
+    await verifyManifestTreeExact(nextSlot.release_root,parseManifest(nextManifest.toString('utf8')));
+    for(const n of ['process-grant.json','coding-grant.json','autonomous-grant.json','desktop-grant.json','host-grant.json']){
+      await assert.rejects(()=>lstat(path.join(state,'runtime',n)),{code:'ENOENT'});
+    }
+  }finally{await rm(stateBase,{recursive:true,force:true});}
+});

package/test/r163-publish-fence.test.mjs

@@ -0,0 +1,13 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {assertR163NpmPublishReady} from '../scripts/npm-release-readiness-r163.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const release={name:'deadbyte-mcp',version:'0.15.62',train:'R160',r163:{publication_mode:'PUBLISH_ONLY'},parent:{release_id:'v0.15.61-055d1ff0aa99e60b',manifest_sha256:'055d1ff0aa99e60bbf9e9f136b02ebd4fffb8391712560f7607cff30af94dcdf',generation_manifest_sha256:'f940e794daac2dda097a66301c4b85c4b29a2df7c669e549503c05a2a55ff6c4'},runtime_predecessor:{release_id:'v0.15.61-055d1ff0aa99e60b'}};
+test('R163 publish gate fails closed with missing evidence',async()=>{
+ await assert.rejects(()=>assertR163NpmPublishReady(release,{root,evidenceRoot:null}),/PUBLISH_BLOCKED R163/);
+});
+test('R163 publish gate rejects changed parent identity before evidence read',async()=>{
+ await assert.rejects(()=>assertR163NpmPublishReady({...release,parent:{...release.parent,release_id:'v0.15.60-wrong'}},{root}),/predecessor lineage mismatch/);
+});

package/test/r48-release-contract.test.mjs

@@ -30,5 +30,11 @@ test('R48 compatibility release contract remains coherent in the current success
   assert.equal(provenance.parent_release_id, release.parent.release_id);
   assert.equal(provenance.parent_manifest_sha256, release.parent.manifest_sha256);
   assert.equal(provenance.parent_generation_manifest_sha256, release.parent.generation_manifest_sha256);
-  assert.equal(provenance.source_predecessor_tarball_sha256, release.source_predecessor.tarball_sha256);
+  if(release.train==='R160'){
+    assert.equal(release.source_predecessor.train,'R159');
+    assert.equal(release.source_predecessor.manifest_status,'STALE_REJECTED');
+    assert.equal(provenance.r160.source_predecessor_manifest_status,'STALE_REJECTED');
+  }else{
+    assert.equal(provenance.source_predecessor_tarball_sha256, release.source_predecessor.tarball_sha256);
+  }
 });

package/test/r58-launcher-shell.test.mjs

@@ -4,6 +4,7 @@ import { mkdir, mkdtemp, writeFile } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { renderStableLauncherPs1 } from '../src/release-slot.mjs';
+import { windowsPowerShellEnvironment } from '../src/runtime-update.mjs';
 
 test('R58 launcher dispatch uses native Windows PowerShell even when entered from pwsh', async () => {
   const base = 'D:/Projects/deadbyte-mcp/testing/0.15.35/fixtures';
@@ -20,7 +21,9 @@ test('R58 launcher dispatch uses native Windows PowerShell even when entered fro
   const native = path.join(process.env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
   const modern = path.join(process.env.USERPROFILE, '.cache', 'codex-runtimes', 'codex-primary-runtime', 'dependencies', 'native', 'powershell', 'pwsh.exe');
   for (const executable of [native, modern]) {
-    const observed = spawnSync(executable, ['-NoProfile', '-File', dispatch], { encoding: 'utf8', timeout: 20000 });
+    const observed = spawnSync(executable, ['-NoProfile', '-File', dispatch], {
+      env: windowsPowerShellEnvironment(process.env), encoding: 'utf8', timeout: 20000
+    });
     assert.ifError(observed.error);
     assert.equal(observed.status, 7, observed.stderr);
     assert.match(observed.stdout, /FIXTURE:status/);

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');

package/test/release-generation.test.mjs

@@ -156,6 +156,22 @@ test('R27 generation bundle rebinds authority and mutable state outside the rele
   const second=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:changedConfig,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
   assert.notEqual(second.generation_root,result.generation_root);
   assert.notEqual(second.generation_seed_sha256,result.generation_seed_sha256);
+  // R158 regression: changing the trusted Epoch source changes generation identity.
+  const epochA=structuredClone(currentConfig);
+  epochA.AuthorityEpochRoot='C:\\Program Files\\DEADBYTE-R158-Epoch-A';
+  const generationA=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:epochA,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  assert.notEqual(generationA.generation_root,result.generation_root);
+  assert.match(await readFile(generationA.config_path,'utf8'),/AuthorityEpochRoot = 'C:\\Program Files\\DEADBYTE-R158-Epoch-A'/);
+  const epochB=structuredClone(epochA);
+  epochB.AuthorityEpochRoot='C:\\Program Files\\DEADBYTE-R158-Epoch-B';
+  const generationB=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:epochB,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});
+  assert.notEqual(generationB.generation_root,generationA.generation_root);
+  assert.notEqual(generationB.generation_seed_sha256,generationA.generation_seed_sha256);
+  for(const invalidRoot of ['relative\\epoch','\\\\server\\share\\epoch','C:relative','']){
+    const invalid=structuredClone(currentConfig);
+    invalid.AuthorityEpochRoot=invalidRoot;
+    await assert.rejects(build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:invalid,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy}),/AuthorityEpochRoot.*drive-absolute/i);
+  }
   const endpointChanged=structuredClone(currentConfig);
   endpointChanged.McpUrlFileSha256='2'.repeat(64);
   const third=await build({stateRoot:state,releaseRoot:release,developmentRoot:development,workspaceRoot:workspace,releaseId:'v0.8.3-aaaaaaaaaaaaaaaa',currentConfig:endpointChanged,codingPolicy:coding,autonomousPolicy:autonomous,hostPolicy:host,processPolicy,desktopPolicy});

package/test/remote-live-log-r37.test.mjs

@@ -72,13 +72,15 @@ test('R40 CLI exposes explicit verbose mode while keeping default live mode comp
   const {readFile}=await import('node:fs/promises');
   const src=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
   assert.match(src,/readLiveRootPaths\(ctx\.root\)/);
-  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose\}\)/);
+  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace,\.\.\.defaultForegroundTimelineOptions\(\{verbose\}\)\}\)/);
+  assert.deepEqual(live.defaultForegroundTimelineOptions({verbose:false}),{commanderStyle:true,foldHeartbeats:false});
+  assert.deepEqual(live.defaultForegroundTimelineOptions({verbose:true}),{commanderStyle:false,foldHeartbeats:false});
   assert.match(src,/createLiveTimelineFilter\(filterExpression\)/);
   assert.match(src,/createLiveTimelineWriter\(\{stream:process\.stdout,displayMode,rewrite:false\}\)/);
   assert.match(src,/arg==='--verbose'\|\|arg==='-v'/);
   assert.match(src,/arg==='--trace'/);
   assert.match(src,/arg==='--filter'/);
-  assert.match(src,/Transport IN\/OUT hidden/);
+  assert.match(src,/Transport hidden; signed audit remains on disk/);
   assert.doesNotMatch(src,/\[cursor \$\{recorded\.cursor\}\]/);
 });
 
@@ -232,7 +234,7 @@ test('human mutation span labels START and preserves terminal audit status',()=>
 test('foreground human log keeps START and DONE separate and folds heartbeat noise',async()=>{
   const {readFile}=await import('node:fs/promises');
   const src=await readFile(new URL('../src/deadbyte-cli.mjs',import.meta.url),'utf8');
-  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace,foldHeartbeats:!verbose\}\)/);
+  assert.match(src,/createLiveTimelineTracker\(\{verbose,displayMode,rootPaths,trace,\.\.\.defaultForegroundTimelineOptions\(\{verbose\}\)\}\)/);
   assert.match(src,/createLiveTimelineWriter\(\{stream:process\.stdout,displayMode,rewrite:false\}\)/);
 });
 

package/test/remote-session-cli.test.mjs

@@ -330,7 +330,7 @@ winTest('bare remote uses one unified live timeline, keeps authority semantics,
     assert.match(output.stdout,/\[OK\] ONLINE/);
     assert.match(output.stdout,/\[READY\] DEADBYTE MCP online/);
     assert.match(output.stdout,/\[AUTH\] process ARMED \| coding ARMED \| autonomous ARMED \| desktop DISARMED \| host DISARMED/);
-    assert.match(output.stdout,/\[LOG\] Human live timeline\. Transport IN\/OUT hidden; full replay\/audit detail remains on disk\./);
+    assert.match(output.stdout,/\[LOG\] Live tool calls with individual START\/DONE, sanitized arguments and results\. Transport hidden; signed audit remains on disk\./);
     assert.doesNotMatch(output.stdout,/Process plane\s*:/);
     assert.doesNotMatch(output.stdout,/Coding plane\s*:/);
     const auditDir=path.join(fx.state,'audit');
@@ -353,11 +353,11 @@ winTest('bare remote uses one unified live timeline, keeps authority semantics,
       '[TOOL OUT] 2026-09-16T00:00:00.002Z #000002 coding_file_read {"is_error":true}'
     ].join('\n')+'\n','utf8');
     const logDeadline=Date.now()+fixtureTimeoutMs;
-    while(Date.now()<logDeadline&&!/^R  .*#4  \[fedcba98\]  coding_file_read  projects:src\/deadbyte-cli\.mjs  1\.73s  \[SLOW\]  ERR$/m.test(output.stdout)) await sleep(50);
-    assert.doesNotMatch(output.stdout,/\| Arguments:/,'default human view must not print request JSON');
-    assert.match(output.stdout,/^S  .*#2  \[abcdef12\]  coding_tree  projects:src  42ms  OK$/m);
-    assert.match(output.stdout,/^R  .*#4  \[fedcba98\]  coding_file_read  projects:src\/deadbyte-cli\.mjs  1\.73s  \[SLOW\]  ERR$/m);
-    assert.equal((output.stdout.match(/\[abcdef12\].*coding_tree.*42ms.*OK/g)||[]).length,1,'duplicate terminal result must print once');
+    while(Date.now()<logDeadline&&!/^\[.*\] \[FAIL\] Tool call coding_file_read failed \[fedcba98\] 1\.73s$/m.test(output.stdout)) await sleep(50);
+    assert.match(output.stdout,/\[CALL\] Received tool call \[abcdef12\] coding_tree Arguments:/,'default human view must show bounded sanitized arguments');
+    assert.match(output.stdout,/^\[.*\] \[DONE\] Tool call coding_tree completed \[abcdef12\] 42ms$/m);
+    assert.match(output.stdout,/^\[.*\] \[FAIL\] Tool call coding_file_read failed \[fedcba98\] 1\.73s$/m);
+    assert.equal((output.stdout.match(/\[DONE\] Tool call coding_tree completed \[abcdef12\] 42ms/g)||[]).length,1,'duplicate terminal result must print once');
     assert.doesNotMatch(output.stdout,/\[cursor r1:/,'full replay cursor belongs in the journal, not every human line');
     const resultJournal=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-results',`${marker.result_session_id}.json`),'utf8'));
     assert.deepEqual(resultJournal.events.map(event=>event.seq),[1,2,3,4]);
@@ -377,7 +377,7 @@ winTest('bare remote uses one unified live timeline, keeps authority semantics,
     const commands=await traceCommands(fx.trace);
     assert.deepEqual(commands.slice(-8),['disarmautonomous','disarmcoding','disarmprocess','disarmdesktop','disarmhost','status','machinetest','park']);
     assert.match(output.stdout,/^DEADBYTE MCP$/m);
-    assert.match(output.stdout,/Human live timeline/i);
+    assert.match(output.stdout,/Live tool calls with individual START\/DONE/i);
     assert.match(output.stdout,/\[AUTH\] Revoking session authority/);
     assert.doesNotMatch(output.stdout,/disarmautonomous OK|disarmcoding OK|disarmprocess OK|disarmdesktop OK|disarmhost OK|DEADBYTE MCP = PARKED/);
     assert.doesNotMatch(output.stdout,/\p{Extended_Pictographic}/u,'piped Windows fallback must remain ASCII-safe');
@@ -395,7 +395,7 @@ winTest('remote --resume replays sanitized tool-call and terminal result events
     const firstOutput=await collect(first);
     await waitFor(fx.trace,commands=>commands.filter(x=>x==='status').length>=4);
     const liveDeadline=Date.now()+3000;
-    while(Date.now()<liveDeadline&&!/\[LOG\] Human live timeline/.test(firstOutput.stdout)) await sleep(50);
+    while(Date.now()<liveDeadline&&!/\[LOG\] Live tool calls/.test(firstOutput.stdout)) await sleep(50);
     const marker=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-session.json'),'utf8'));
     assert.match(String(marker.result_session_id||''),/^[0-9a-f]{24}$/);
     const auditDir=path.join(fx.state,'audit');await mkdir(auditDir,{recursive:true});
@@ -428,7 +428,7 @@ winTest('remote --resume replays sanitized tool-call and terminal result events
     deadline=Date.now()+5000;
     while(Date.now()<deadline&&(!/coding_file_read\s+\| Arguments: .*\| REPLAY #3/.test(secondOutput.stdout)||
       !/\[REPLAY\] #4 coding_file_read OK/.test(secondOutput.stdout)||
-      !/\[LOG\] Human live timeline/.test(secondOutput.stdout))) await sleep(50);
+      !/\[LOG\] Live tool calls/.test(secondOutput.stdout))) await sleep(50);
     assert.match(secondOutput.stdout,/^2026-09-18T23:30:01\.000\+07:00 \| coding_file_read\s+\| Arguments: .*"path":"src\/deadbyte-cli\.mjs".*\| REPLAY #3$/m);
     assert.match(secondOutput.stdout,/\[REPLAY\] #4 coding_file_read OK/);
     assert.match(secondOutput.stdout,/\[SESSION\] Previous result stream replayed/);
@@ -438,7 +438,7 @@ winTest('remote --resume replays sanitized tool-call and terminal result events
     assert.equal((secondOutput.stdout.match(/\[REPLAY\] #4 coding_file_read OK/g)||[]).length,1,'terminal replay duplicated');
     const callReplayIndex=secondOutput.stdout.indexOf('| coding_file_read');
     const resultReplayIndex=secondOutput.stdout.indexOf('[REPLAY] #4 coding_file_read OK');
-    const liveIndex=secondOutput.stdout.indexOf('[LOG] Human live timeline');
+    const liveIndex=secondOutput.stdout.indexOf('[LOG] Live tool calls');
     assert.ok(callReplayIndex>=0&&resultReplayIndex>callReplayIndex&&liveIndex>resultReplayIndex,'resume ordering must be call -> result -> live tail');
     second.stdin.end();
     const secondEnded=await boundedCompletion(secondOutput.closed);
@@ -811,7 +811,7 @@ winTest('remote --trace --filter selects presentation without dropping journaled
     await writeFile(path.join(auditDir,'segment-00000001.jsonl'),audit.map(JSON.stringify).join('\n')+'\n','utf8');
     const deadline=Date.now()+4000;
     while(Date.now()<deadline&&!/machine_fs\.write.*trace=goal-1234/.test(output.stdout)) await sleep(50);
-    assert.match(output.stdout,/machine_fs\.write.*trace=goal-123\.\.\. span=filter-w\.\.\..*10ms.*ERR - denied/);
+    assert.match(output.stdout,/Tool call machine_fs\.write failed \[filter-w\].*trace=goal-123\.\.\. span=filter-w\.\.\..*10ms.*denied/i);
     assert.doesNotMatch(output.stdout,/coding_file_read.*missing/);
     assert.doesNotMatch(output.stdout,/SECRET/);
     const journal=JSON.parse(await readFile(path.join(fx.state,'runtime','remote-results',marker.result_session_id+'.json'),'utf8'));

package/test/stabilization-state-root.test.mjs

@@ -54,7 +54,8 @@ test('CMD launcher transports explicit root with spaces to nested Node child',as
   await writeFile(path.join(isolated,'bin','DEADBYTE-MCP.ps1'),`& '${process.execPath.replaceAll("'","''")}' -e 'console.log(process.env.DEADBYTE_STATE_ROOT)'\nexit $LASTEXITCODE\n`);
   const cmd=path.join(fixture,'launcher.cmd');
   await writeFile(cmd,renderStableLauncherCmd());
-  const r=spawnSync(process.env.ComSpec,['/d','/c',cmd,'status'],{encoding:'utf8',timeout:20000,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:isolated,USERPROFILE:fixture})});
+  const nativeCmd=path.join(process.env.SystemRoot,'System32','cmd.exe');
+  const r=spawnSync(nativeCmd,['/d','/c',cmd,'status'],{encoding:'utf8',timeout:20000,env:windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:isolated,USERPROFILE:fixture})});
   assert.equal(r.status,0,r.stderr);
   assert.equal(r.stdout.trim(),isolated);
 });