deadbyte-mcp 0.15.61 → 0.15.62

package/docs/R157-ENGINEERING-HANDOFF.md

@@ -0,0 +1,71 @@
+# R157 verified checkpoint — 2026-10-25 (Asia/Bangkok)
+
+Candidate: D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.62-r157-reference-convergence
+Parent: D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.62-r156-loop-epoch
+Production: DEADBYTE MCP 0.15.61, release v0.15.61-055d1ff0aa99e60b. No npm publish, production activation, local authority/grants or trusted-root changes in this pass.
+Package metadata in isolated R157 still says 0.15.61. Do not label this an npm-ready 0.15.62 release.
+
+## Intake and scope
+
+Intent: Self-evolving Engineering Platform on the existing DEADBYTE runtime, not new nested agents.
+Constraints: no broad implicit authority, no unsupervised production mutation, avoid competitor code dumps, keep five planes independently revocable, verify exact bytes, respect R89/R70.
+Approach: inventory all local competitor references, inspect source paths and package constraints, implement one contained supervisor behavior change with RED/GREEN tests, then verify legacy R89/R153/R155 suites.
+
+## Observed baseline
+
+- Live connector mcp__DEADBYTE_MCP__machine_status: release 0.15.61, machine responded.
+- Coding and Autonomous status: both configured and DISARMED; planner backend client_sampling.
+- 12 reference root directories found, static scan found 7,886 source-like files and 3,012 test-like paths; exclusions recorded in R157-REFERENCE-INVENTORY.json.
+- Four Desktop Commander snapshot distributions contain 234 / 264 / 268 / 134 implementation files (respectively 0.2.52 / 0.3.0 / 0.3.1 / 0.3.1-alpha.2). Local snapshots contain no test files.
+- R157 isolated copy SHA checked against R156 for four critical files before mutation. R156 remains unchanged.
+
+## Root causes and changes
+
+1. Supervisor redundant status polling while provider retry is not due:
+   Before: second scan queried the same goal a second time. RED: statusCalls=2, expected 1.
+   Change: skip runtime.status while recorded retry_at is in the future; resumed scan when deadline reached.
+   After: backoff test GREEN. No lease scope change.
+
+2. Same goal dispatched twice when manual scan and continuous supervisor scan overlap:
+   Before: two simultaneous scanNow calls caused two runtime.run dispatches. RED: calls=2.
+   Change: single-flight scan with one in-flight promise, shared between auto polling and scanNow.
+   After: concurrent scan regression GREEN: one dispatch and one status read.
+   Source: src/autonomous-supervisor.mjs.
+   Tests: test/r156-supervisor-pacing.test.mjs, test/r157-supervisor-singleflight.test.mjs.
+
+3. Reference audit: source was packaged under dist for Desktop Commander snapshots. First scan mistakenly treated dist as ignorable generated files. Fixed scanner and re-ran successfully on all twelve roots. No imported or executed reference code.
+
+## Measured verification
+
+- R157 focused combined tests: **90 passed / 0 failed / 0 skipped**, process exit 0, log docs/R157-FOCUSED-VERIFICATION.log
+- Earlier targeted R157 supervisor tests: **33/33** GREEN.
+- R89/R153/R155/release generation focused tests: **57/57** GREEN.
+- Architecture graph: 225 top-level src/*.mjs modules, 467 literal relative import edges. It is a static graph, not process or network behavior proof.
+- File delta: 11 files new/changed vs R156 at audit time; exact SHA-256 in docs/R157-FILE-DELTA.json.
+
+## Reference decisions
+
+- docs/R157-REFERENCE-INVENTORY.json — 12 repositories, per-path manifests, bounded static feature matches, exclusions.
+- docs/R157-REFERENCE-CAPABILITY-MATRIX.md — generated repository capability inventory.
+- docs/R157-REFERENCE-DECISIONS.md — selective adaptation/rejection, licensing/security risks, Desktop Commander 0.2.52 through 0.3.1.
+- docs/R157-ARCHITECTURE-DEPENDENCIES.md — subsystem boundaries with source files and integration rules.
+- docs/R157-ARCHITECTURE-GRAPH.json — static dependency graph.
+
+## Known blockers (unresolved)
+
+- R89: OS-owned protected installation and owner-approved activation must bind AuthorityEpochRoot in release generation; production npm arm commands still fail UNTRUSTED_WRITE_ACE until fixed end-to-end. R157 did not arm or attempt to change ACL.
+- R155: default LiveLogs focused tests pass, but release full regression, exact tarball, current startup marker migration locator collision and protected-path integrated tests are not closed.
+- R70: independent Autonomous owner enrollment; project scope isolation unverified live.
+- R156/R157: isolated tests do not constitute live protected E2E or field benchmark.
+- Competitor: local dist snapshots have no tests. No parity or speed superiority claim until same-hardware benchmark.
+- Full regression and npm packaging for 0.15.62 remain NOT RUN in this checkpoint.
+
+## Next safe engineering work (bounded)
+
+1. Reproduce r153-pending-migration.json historical locator collision on a disposable stateRoot with exact predecessor/future marker states. Write a focused RED test; do not touch existing production marker or evidence. Preserve old terminal receipts and reject ambiguous multiple unlocated intents.
+2. Build R89 protected installation activation plan and independent owner approval flow; verify source+manifest ACL before exec. No implicit authority.
+3. Run protected full regression for exact staged 0.15.62 artifact, check default LiveLogs after reboot/reconnect, and verify rollback and signed release identity.
+4. Use a disposable project root and explicit owner-approved Coding/Autonomous grants to test planning→patch→test→replan→verify end-to-end; no production writes.
+5. Test reference-derived candidate algorithms under identical tool and hardware workloads; only adopt proven wins.
+
+Machine as left: production 0.15.61 unchanged; R156 unchanged; R157 only experimental changes. No deployment, npm publish, activation, git push or authority modifications.

package/docs/R157-FILE-DELTA.json

@@ -0,0 +1,80 @@
+{
+    "scope":  "exclude_self_only",
+    "candidate":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r157-reference-convergence",
+    "schema":  "deadbyte.r157-file-delta.v1",
+    "changed":  [
+                    {
+                        "path":  "docs\\R157-ARCHITECTURE-DEPENDENCIES.md",
+                        "sha256":  "ac304e8622f8dbfc8a1e56609703b85139612ab77d2f97b103a4e735d32a1125",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-ARCHITECTURE-GRAPH.json",
+                        "sha256":  "27c41c40e9214640ce20b3b43fde926f971da6ca360337dde147a2cf411f6881",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-ENGINEERING-HANDOFF.md",
+                        "sha256":  "baaca68e0cf52e43605cdb13ba0b1a62f69de1500aea7d00de2fc773cb161f4b",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-FOCUSED-VERIFICATION.log",
+                        "sha256":  "2fc30aa4714ea7c5aff9e58956e5e2ea96fb40ee2d3138271bdd93ab63ee639b",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-REFERENCE-CAPABILITY-MATRIX.md",
+                        "sha256":  "ad0ffca909ec32920e541057004692c98971b0c854a6b83bfec48e64b1261b78",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-REFERENCE-DECISIONS.md",
+                        "sha256":  "59c426e5a1e5166879013ae66c9e35fc79a87df73b9d2e7823b4b112fe52c6a7",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "docs\\R157-REFERENCE-INVENTORY.json",
+                        "sha256":  "54fd3744ee67461ab8305b801c24255987b348f3372f266573ff29802abbc9b7",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "src\\autonomous-supervisor.mjs",
+                        "sha256":  "a18297af1c84e9f60ec787c94217d73d1f282af11d06c8d576895c37e949ba65",
+                        "old_sha256":  "43a145440210ddd72b71ac4a601039f814f823933e341b3499077cc771392280",
+                        "kind":  "modified"
+                    },
+                    {
+                        "path":  "test\\r156-supervisor-pacing.test.mjs",
+                        "sha256":  "4db5e6a157f5696852bec85959c55ad3c931100abc851d03f12e8252ce14f8c8",
+                        "old_sha256":  "a1f561afcad0ad69bcb428c05e31f9970e902c1640e3de16170f628c5d688d11",
+                        "kind":  "modified"
+                    },
+                    {
+                        "path":  "test\\r157-architecture-map.mjs",
+                        "sha256":  "7850244da53273ebff2b2db9de6b19177c070df942e540db91e758c92d7a3ee6",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "test\\r157-reference-survey.mjs",
+                        "sha256":  "e5e37d36ce03a9a757f5cee8c1068099ae654839a73ddb4c8ea0ed83e9d9fd42",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    },
+                    {
+                        "path":  "test\\r157-supervisor-singleflight.test.mjs",
+                        "sha256":  "dc589ec4aeac16a4bb60d0366127594e6c7d4c86d188ed428808cf89ecb1808e",
+                        "old_sha256":  null,
+                        "kind":  "added"
+                    }
+                ],
+    "base":  "D:\\Projects\\deadbyte-mcp\\development\\deadbyte-mcp-0.15.62-r156-loop-epoch"
+}`n

package/docs/R157-REFERENCE-CAPABILITY-MATRIX.md

@@ -0,0 +1,207 @@
+# R157 reference matrix
+
+Source/token inventory only, not proof of runtime behavior. No reference code was executed or imported.
+
+| Repository | Files | Sources | Tests | License or manifest evidence | Source signals |
+|---|---:|---:|---:|---|---|
+| better-remote-commander | 139 | 109 | 1 | package.json: MIT; packages/agent/package.json: MIT; packages/agent/src/core/LICENSE-desktop-commander | protocol=38; sessions=35; filesystem=35; logs=27; authority=22 |
+| cua | 5411 | 2616 | 799 | .github/workflows/license-check.yml; libs/cua-bench/LICENSE; libs/cua-bench-s1/python/LICENSE | desktop=1576; tests=1102; sessions=967; filesystem=560; logs=511 |
+| desktop-commander v0.2.52 | 248 | 234 | 0 | package.json: MIT | sessions=55; protocol=54; filesystem=53; logs=31; recovery=18 |
+| desktop-commander v0.3.0 | 278 | 264 | 0 | package.json: MIT | sessions=66; protocol=65; filesystem=57; logs=41; recovery=25 |
+| desktop-commander v0.3.1 | 282 | 268 | 0 | package.json: MIT | protocol=71; sessions=68; filesystem=57; logs=42; recovery=25 |
+| desktop-commander-0.3.1-alpha.2 | 139 | 134 | 0 | static/package.json: MIT | sessions=45; filesystem=45; protocol=44; logs=31; recovery=20 |
+| harness2-main | 114 | 62 | 1 | LICENSE; third_party/jb_runner/LICENSE; third_party/lab_runner/LICENSE | tests=33; filesystem=28; logs=19; sessions=16; processes=16 |
+| open-remote-mcp | 30 | 9 | 2 | NOT FOUND | protocol=7; logs=5; sessions=4; filesystem=4; authority=4 |
+| rea-main | 4636 | 4013 | 2132 | LICENSE; package.json: MIT; third_party/evmole/LICENSE | tests=1631; filesystem=1549; sessions=1156; protocol=897; logs=492 |
+| remcp | 167 | 105 | 47 | package.json: MIT; packages/client/LICENSE; packages/client/package.json: MIT | tests=69; filesystem=44; recovery=31; protocol=29; sessions=29 |
+| secure-host-mcp | 65 | 41 | 14 | package.json: MIT | protocol=26; filesystem=22; logs=13; processes=10; sessions=8 |
+| winremote-mcp | 60 | 31 | 16 | NOT FOUND | tests=15; protocol=11; processes=10; desktop=6; authority=4 |
+
+## Per-repository source and test evidence
+
+### better-remote-commander
+
+Top directories: .git, .github, deploy, docs, packages, scripts.
+Scan truncated: false. Skipped 1 symlink/generated locations.
+Manifests: package.json [MIT] ; packages/agent/package.json [MIT] ; packages/agent/src/core/LICENSE-desktop-commander ; packages/relay/package.json [MIT] ; packages/shared/package.json [MIT]
+- protocol matched 38 sources, examples: packages/agent/src/cli.ts ; packages/agent/src/core/handlers/filesystem-handlers.ts ; packages/agent/src/core/terminal-manager.ts ; packages/agent/src/core/tool-definitions.ts ; packages/agent/src/core/tools/edit.ts
+- sessions matched 35 sources, examples: packages/agent/src/core/command-manager.ts ; packages/agent/src/core/config-manager.ts ; packages/agent/src/core/handlers/edit-search-handlers.ts ; packages/agent/src/core/handlers/filesystem-handlers.ts ; packages/agent/src/core/handlers/history-handlers.ts
+- processes matched 10 sources, examples: packages/agent/src/core/search-manager.ts ; packages/agent/src/core/terminal-manager.ts ; packages/agent/src/core/tools/filesystem.ts ; packages/agent/src/core/tools/improved-process-tools.ts ; packages/agent/src/core/tools/process.ts
+- filesystem matched 35 sources, examples: packages/agent/src/core/config-field-definitions.ts ; packages/agent/src/core/config-manager.ts ; packages/agent/src/core/config.ts ; packages/agent/src/core/handlers/edit-search-handlers.ts ; packages/agent/src/core/handlers/filesystem-handlers.ts
+- recovery matched 11 sources, examples: packages/agent/src/core/config-manager.ts ; packages/agent/src/core/handlers/filesystem-handlers.ts ; packages/agent/src/core/terminal-manager.ts ; packages/agent/src/core/utils/capture.ts ; packages/agent/src/core/utils/welcome-onboarding.ts
+- logs matched 27 sources, examples: packages/agent/src/context.ts ; packages/agent/src/core/config-field-definitions.ts ; packages/agent/src/core/config-manager.ts ; packages/agent/src/core/terminal-manager.ts ; packages/agent/src/core/tool-definitions.ts
+- authority matched 22 sources, examples: packages/agent/src/core/config-field-definitions.ts ; packages/agent/src/core/handlers/search-handlers.ts ; packages/agent/src/core/search-manager.ts ; packages/agent/src/core/tools/filesystem.ts ; packages/agent/src/core/utils/withTimeout.ts
+- tests matched 14 sources, examples: packages/agent/src/core/handlers/filesystem-handlers.ts ; packages/agent/src/core/search-manager.ts ; packages/agent/src/core/terminal-manager.ts ; packages/agent/src/core/utils/files/excel.ts ; packages/agent/src/core/utils/process-detection.ts
+
+### cua
+
+Top directories: .agents, .claude, .git, .github, .vscode, blog, changelog, clusters, docs, evidence, img, infra, libs, nix, rfcs, samples, scripts, skills, tests.
+Scan truncated: false. Skipped 3 symlink/generated locations.
+Manifests: docs/package.json ; docs/scripts/docs-mcp-server/pyproject.toml ; .github/scripts/cua-driver-mcp-compat/modern-client/package.json ; .github/scripts/cua-driver-mcp-compat/package.json ; .github/workflows/license-check.yml ; libs/cua-bench/datasets/cua-bench-basic/click-button/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/click-icon/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/color-picker/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/date-picker/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/drag-drop/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/drag-slider/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/fill-form/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/right-click-menu/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/select-dropdown/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/spreadsheet-cell/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/toggle-switch/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/typing-input/pyproject.toml ; libs/cua-bench/datasets/cua-bench-basic/video-player/pyproject.toml
+- protocol matched 372 sources, examples: docs/public/examples/local-models/cua-mcp-filter.py ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/crawl_docs.py ; docs/scripts/docs-mcp-server/docs_index.py ; docs/scripts/docs-mcp-server/main.py
+- sessions matched 967 sources, examples: blog/assets/omarchy-arm64-lume/install-omarchy.sh ; docs/public/scripts/omarchy-arm64-lume/install-omarchy.sh ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/check-links.test.ts ; docs/scripts/docs-mcp-server/docs_index.py
+- processes matched 447 sources, examples: docs/public/examples/local-models/cua-mcp-filter.py ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/modal_app.py ; docs/scripts/tests/test_sandbox_secret_example.py ; docs/scripts/verify-driver-first-run-linux.py
+- filesystem matched 560 sources, examples: docs/scripts/check-hygiene.ts ; docs/scripts/check-links.test.ts ; docs/scripts/check-links.ts ; docs/scripts/docs-mcp-server/sync_docs_index.py ; docs/scripts/fleet-navigation.test.ts
+- desktop matched 1576 sources, examples: docs/next.config.mjs ; docs/public/examples/local-models/cua-mcp-filter.py ; docs/public/scripts/first-cloud-fleet/first_cloud_fleet.py ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/check-links.test.ts
+- recovery matched 373 sources, examples: blog/assets/omarchy-arm64-lume/enable-rosetta.sh ; docs/public/scripts/omarchy-arm64-lume/enable-rosetta.sh ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/fleet-navigation.test.ts ; docs/scripts/tests/test_first_cloud_fleet_tutorial.py
+- logs matched 511 sources, examples: docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/scripts/docs-mcp-server/docs_index.py ; docs/scripts/docs-mcp-server/main.py ; docs/scripts/docs-mcp-server/sync_docs_index.py ; docs/scripts/tests/test_docs_index_sync.py
+- authority matched 388 sources, examples: docs/public/examples/local-models/cua-mcp-filter.py ; docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py ; docs/superpowers/specs/2026-08-09-periodic-cua-sandbox-live-e2e-design.md ; .github/scripts/github_release.py ; .github/scripts/macos-review-codesign.sh
+- tests matched 1102 sources, examples: docs/public/examples/local-models/cua-mcp-filter.py ; docs/scripts/check-hygiene.ts ; docs/scripts/check-links.test.ts ; docs/scripts/fixtures/link-checks/headings.mdx ; docs/scripts/fixtures/link-checks/invalid.mdx
+- agent_loop matched 266 sources, examples: docs/scripts/docs-mcp-server/main.py ; docs/scripts/modal_app.py ; .github/scripts/tests/test_nightly_release_wiring.py ; libs/cua-bench/cua_bench/agents/gemini.py ; libs/cua-bench/cua_bench/agents/opencua_agent.py
+
+### desktop-commander v0.2.52
+
+Top directories: dist, testemonials.
+Scan truncated: false. Skipped 0 symlink/generated locations.
+Manifests: package.json [MIT]
+- protocol matched 54 sources, examples: dist/custom-stdio.d.ts ; dist/custom-stdio.js ; dist/handlers/filesystem-handlers.js ; dist/index.js ; dist/npm-scripts/remote.js
+- sessions matched 55 sources, examples: dist/command-manager.js ; dist/config-manager.js ; dist/custom-stdio.js ; dist/handlers/edit-search-handlers.d.ts ; dist/handlers/edit-search-handlers.js
+- processes matched 11 sources, examples: dist/remote-device/desktop-commander-integration.js ; dist/remote-device/remote-channel.d.ts ; dist/remote-device/remote-channel.js ; dist/search-manager.js ; dist/terminal-manager.js
+- filesystem matched 53 sources, examples: dist/bootstrap.js ; dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config.js ; dist/config-manager.js
+- desktop matched 2 sources, examples: dist/ui/file-preview/src/markdown/conflict-dialog.d.ts ; dist/ui/file-preview/src/markdown/conflict-dialog.js
+- recovery matched 18 sources, examples: dist/config-manager.js ; dist/handlers/filesystem-handlers.js ; dist/index.js ; dist/remote-device/desktop-commander-integration.d.ts ; dist/remote-device/desktop-commander-integration.js
+- logs matched 31 sources, examples: dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config-manager.js ; dist/index.js ; dist/npm-scripts/remote.js
+- authority matched 13 sources, examples: dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/handlers/search-handlers.js ; dist/npm-scripts/remote.js ; dist/remote-device/device-authenticator.js
+- tests matched 12 sources, examples: dist/handlers/filesystem-handlers.js ; dist/remote-device/remote-channel.js ; dist/search-manager.js ; dist/terminal-manager.js ; dist/ui/file-preview/src/directory-controller.js
+
+### desktop-commander v0.3.0
+
+Top directories: dist, node_modules, testemonials, vendor.
+Scan truncated: false. Skipped 2 symlink/generated locations.
+Manifests: package.json [MIT]
+- protocol matched 65 sources, examples: dist/config.js ; dist/config-manager.js ; dist/custom-stdio.d.ts ; dist/custom-stdio.js ; dist/handlers/filesystem-handlers.js
+- sessions matched 66 sources, examples: dist/command-manager.js ; dist/config-manager.d.ts ; dist/config-manager.js ; dist/custom-stdio.js ; dist/handlers/edit-search-handlers.d.ts
+- processes matched 19 sources, examples: dist/remote-device/desktop-commander-integration.js ; dist/remote-device/diagnostics/device-log.js ; dist/remote-device/diagnostics/report.js ; dist/remote-device/remote-channel.d.ts ; dist/remote-device/remote-channel.js
+- filesystem matched 57 sources, examples: dist/bootstrap.js ; dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config.js ; dist/config-manager.js
+- desktop matched 2 sources, examples: dist/ui/file-preview/src/markdown/conflict-dialog.d.ts ; dist/ui/file-preview/src/markdown/conflict-dialog.js
+- recovery matched 25 sources, examples: dist/config-manager.js ; dist/handlers/filesystem-handlers.js ; dist/index.js ; dist/remote-device/desktop-commander-integration.d.ts ; dist/remote-device/desktop-commander-integration.js
+- logs matched 41 sources, examples: dist/command-manager.d.ts ; dist/command-manager.js ; dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config-manager.d.ts
+- authority matched 13 sources, examples: dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config-manager.js ; dist/npm-scripts/remote.js ; dist/remote-device/device-authenticator.js
+- tests matched 16 sources, examples: dist/remote-device/diagnostics/device-log.js ; dist/remote-device/diagnostics/report.js ; dist/remote-device/diagnostics/upload.js ; dist/remote-device/remote-channel.js ; dist/remote-device/transport-telemetry.js
+
+### desktop-commander v0.3.1
+
+Top directories: dist, node_modules, testemonials, vendor.
+Scan truncated: false. Skipped 2 symlink/generated locations.
+Manifests: package.json [MIT]
+- protocol matched 71 sources, examples: dist/config.js ; dist/config-manager.js ; dist/custom-stdio.d.ts ; dist/custom-stdio.js ; dist/handlers/filesystem-handlers.js
+- sessions matched 68 sources, examples: dist/command-manager.js ; dist/config-manager.d.ts ; dist/config-manager.js ; dist/custom-stdio.js ; dist/handlers/edit-search-handlers.d.ts
+- processes matched 19 sources, examples: dist/remote-device/desktop-commander-integration.js ; dist/remote-device/diagnostics/device-log.js ; dist/remote-device/diagnostics/report.js ; dist/remote-device/remote-channel.d.ts ; dist/remote-device/remote-channel.js
+- filesystem matched 57 sources, examples: dist/bootstrap.js ; dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config.js ; dist/config-manager.js
+- desktop matched 2 sources, examples: dist/ui/file-preview/src/markdown/conflict-dialog.d.ts ; dist/ui/file-preview/src/markdown/conflict-dialog.js
+- recovery matched 25 sources, examples: dist/config-manager.js ; dist/handlers/filesystem-handlers.js ; dist/index.js ; dist/remote-device/desktop-commander-integration.d.ts ; dist/remote-device/desktop-commander-integration.js
+- logs matched 42 sources, examples: dist/command-manager.d.ts ; dist/command-manager.js ; dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config-manager.d.ts
+- authority matched 14 sources, examples: dist/config-field-definitions.d.ts ; dist/config-field-definitions.js ; dist/config-manager.js ; dist/npm-scripts/remote.js ; dist/remote-device/device-authenticator.js
+- tests matched 15 sources, examples: dist/remote-device/diagnostics/device-log.js ; dist/remote-device/diagnostics/report.js ; dist/remote-device/diagnostics/upload.js ; dist/remote-device/transport-telemetry.js ; dist/search-manager.js
+
+### desktop-commander-0.3.1-alpha.2
+
+Top directories: static.
+Scan truncated: false. Skipped 0 symlink/generated locations.
+Manifests: static/package.json [MIT]
+- protocol matched 44 sources, examples: static/dist/config.js ; static/dist/config-manager.js ; static/dist/custom-stdio.js ; static/dist/handlers/filesystem-handlers.js ; static/dist/index.js
+- sessions matched 45 sources, examples: static/dist/command-manager.js ; static/dist/config-manager.js ; static/dist/custom-stdio.js ; static/dist/handlers/edit-search-handlers.js ; static/dist/handlers/filesystem-handlers.js
+- processes matched 14 sources, examples: static/dist/remote-device/desktop-commander-integration.js ; static/dist/remote-device/diagnostics/device-log.js ; static/dist/remote-device/diagnostics/report.js ; static/dist/remote-device/remote-channel.js ; static/dist/search-manager.js
+- filesystem matched 45 sources, examples: static/dist/bootstrap.js ; static/dist/config-field-definitions.js ; static/dist/config.js ; static/dist/config-manager.js ; static/dist/config-recovery.js
+- desktop matched 1 sources, examples: static/dist/ui/file-preview/src/markdown/conflict-dialog.js
+- recovery matched 20 sources, examples: static/dist/config-manager.js ; static/dist/handlers/filesystem-handlers.js ; static/dist/index.js ; static/dist/remote-device/desktop-commander-integration.js ; static/dist/remote-device/device.js
+- logs matched 31 sources, examples: static/dist/command-manager.js ; static/dist/config-field-definitions.js ; static/dist/config-manager.js ; static/dist/index.js ; static/dist/npm-scripts/remote.js
+- authority matched 10 sources, examples: static/dist/config-field-definitions.js ; static/dist/config-manager.js ; static/dist/npm-scripts/remote.js ; static/dist/remote-device/device-authenticator.js ; static/dist/remote-device/device.js
+- tests matched 16 sources, examples: static/dist/remote-device/diagnostics/device-log.js ; static/dist/remote-device/diagnostics/report.js ; static/dist/remote-device/diagnostics/upload.js ; static/dist/remote-device/remote-channel.js ; static/dist/remote-device/transport-telemetry.js
+
+### harness2-main
+
+Top directories: assets, dependencies, docs, harness2, scripts, tests, third_party.
+Scan truncated: false. Skipped 0 symlink/generated locations.
+Manifests: LICENSE ; pyproject.toml ; third_party/jb_runner/LICENSE ; third_party/lab_runner/LICENSE ; third_party/wb_runner/LICENSE
+- protocol matched 3 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; third_party/jb_runner/run_benchmark_codex_cli_adapt.sh ; third_party/wb_runner/agents/codex_agent.py
+- sessions matched 16 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/lab.py ; harness2/benchmarks/workbuddy.py ; harness2/core/ledger.py
+- processes matched 16 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/lab.py ; harness2/benchmarks/wb_render.py ; harness2/benchmarks/workbuddy.py
+- filesystem matched 28 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/lab.py ; harness2/benchmarks/tasks.py ; harness2/benchmarks/wb_render.py
+- desktop matched 1 sources, examples: harness2/benchmarks/workbuddy.py
+- recovery matched 5 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/workbuddy.py ; harness2/core/recursion.py ; harness2/core/spec.py
+- logs matched 19 sources, examples: harness2/benchmarks/jb_opencode_runner.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/lab.py ; harness2/benchmarks/workbuddy.py ; harness2/cli/_common.py
+- authority matched 5 sources, examples: harness2/benchmarks/lab.py ; harness2/core/prompts.py ; harness2/substrate/opencode.py ; third_party/lab_runner/opencode/run_opencode.py ; third_party/wb_runner/agents/oc_agent.py
+- tests matched 33 sources, examples: harness2/benchmarks/__init__.py ; harness2/benchmarks/jobbench.py ; harness2/benchmarks/lab.py ; harness2/benchmarks/tasks.py ; harness2/benchmarks/workbuddy.py
+
+### open-remote-mcp
+
+Top directories: .git, .github, apps, docs, scripts.
+Scan truncated: false. Skipped 1 symlink/generated locations.
+Manifests: apps/agent/package.json ; apps/server/package.json ; apps/web/package.json ; package.json
+- protocol matched 7 sources, examples: apps/agent/src/index.ts ; apps/server/src/index.ts ; apps/server/src/lib/db.test.ts ; apps/server/src/lib/db.ts ; apps/web/src/main.tsx
+- sessions matched 4 sources, examples: apps/agent/src/index.ts ; apps/server/src/index.ts ; apps/server/src/lib/security.test.ts ; apps/web/src/main.tsx
+- processes matched 1 sources, examples: scripts/e2e.mjs
+- filesystem matched 4 sources, examples: apps/agent/src/index.ts ; apps/server/src/index.ts ; apps/web/src/main.tsx ; scripts/e2e.mjs
+- logs matched 5 sources, examples: apps/server/src/index.ts ; apps/server/src/lib/db.test.ts ; apps/server/src/lib/db.ts ; apps/web/src/main.tsx ; scripts/e2e.mjs
+- authority matched 4 sources, examples: apps/agent/src/index.ts ; apps/server/src/index.ts ; apps/web/src/main.tsx ; scripts/e2e.mjs
+- tests matched 4 sources, examples: apps/agent/src/index.ts ; apps/server/src/lib/db.test.ts ; apps/server/src/lib/security.test.ts ; scripts/e2e.mjs
+- LICENSE UNVERIFIED: do not reuse source code without separate review.
+
+### rea-main
+
+Top directories: .agents, .github, .husky, bridge, docs, experiments, licenses, native, scripts, src, tests, third_party, website.
+Scan truncated: false. Skipped 0 symlink/generated locations.
+Manifests: LICENSE ; package.json [MIT] ; tests/conformance/readiness/electron/package.json ; tests/conformance/readiness/javascript-cli/package.json ; third_party/evmole/LICENSE ; third_party/pwndbg/LICENSE.md ; website/public/examples/notes-electron/package.json ; website/requirements.txt
+- protocol matched 897 sources, examples: docs/specs/2356-wasm-interface-comparison/plan.md ; docs/specs/2356-wasm-interface-comparison/spec.md ; docs/specs/2356-wasm-interface-comparison/tasks.md ; docs/specs/2356-wasm-interface-comparison/verification.md ; docs/specs/agent-environments/environment-export/spec.md
+- sessions matched 1156 sources, examples: bridge/cutter/rea_bridge.py ; bridge/hopper_bridge.py ; bridge/mitmproxy/capture.py ; bridge/native/rea_lldb_tracer.py ; bridge/pwndbg/core_context.py
+- processes matched 476 sources, examples: bridge/native/rea_lldb_tracer.py ; docs/specs/agent-environments/environment-serve/plan.md ; experiments/analysis-efficiency/agent-trial.py ; experiments/analysis-efficiency/drawio-electron-lifecycle-oracles.py ; experiments/analysis-efficiency/electron-cancellation-oracles.py
+- filesystem matched 1549 sources, examples: bridge/cutter/rea_bridge.py ; bridge/mitmproxy/capture.py ; bridge/native/rea_lldb_tracer.py ; bridge/native/test_rea_lldb_tracer.py ; bridge/pwndbg/core_context.py
+- desktop matched 52 sources, examples: scripts/fixtures/browser-verifier-site.mjs ; scripts/lib/browser-scenario-verifier.mjs ; scripts/lib/browser-screenshot-e2e.mjs ; scripts/verify-native-ui.mjs ; scripts/verify-real-browser.mjs
+- recovery matched 440 sources, examples: bridge/cutter/rea_bridge.py ; bridge/pwntools/recorded_crash_impl.py ; docs/specs/agent-environments/environment-export/verification.md ; docs/specs/agent-environments/environment-serve/verification.md ; docs/specs/agent-environments/http-transport/plan.md
+- logs matched 492 sources, examples: bridge/cutter/rea_bridge.py ; bridge/native/rea_lldb_tracer.py ; bridge/native/test_rea_lldb_tracer.py ; bridge/pwntools/recorded_crash_impl.py ; docs/specs/2356-wasm-interface-comparison/plan.md
+- authority matched 216 sources, examples: bridge/cutter/rea_bridge.py ; bridge/hopper_bridge.py ; bridge/mitmproxy/capture.py ; bridge/pwntools/layout_impl.py ; docs/specs/agent-environments/environment-export/verification.md
+- tests matched 1631 sources, examples: bridge/mitmproxy/test_capture.py ; bridge/native/test_rea_lldb_tracer.py ; bridge/pwndbg/test_core_context.py ; docs/specs/agent-environments/environment-export/spec.md ; docs/specs/agent-environments/environment-export/verification.md
+- agent_loop matched 156 sources, examples: docs/specs/solidity/cbor-metadata/plan.md ; docs/specs/solidity/cbor-metadata/verification.md ; experiments/analysis-efficiency/agent-trial.py ; experiments/analysis-efficiency/drawio-electron-lifecycle.mjs ; experiments/analysis-efficiency/drawio-electron-lifecycle-oracles.py
+
+### remcp
+
+Top directories: .agents, .claude-plugin, .cursor-plugin, .git, .github, assets, docs, packages, scripts, skills, submission.
+Scan truncated: false. Skipped 1 symlink/generated locations.
+Manifests: package.json [MIT] ; packages/client/LICENSE ; packages/client/package.json [MIT] ; packages/runtime/LICENSE ; packages/runtime/package.json [MIT]
+- protocol matched 29 sources, examples: packages/client/src/agent.mjs ; packages/client/src/cli/doctor.mjs ; packages/client/src/cli.mjs ; packages/client/src/cli/service.mjs ; packages/client/test/agent-auto-update.test.mjs
+- sessions matched 29 sources, examples: packages/client/src/agent.mjs ; packages/client/src/cli/connect.mjs ; packages/client/src/cli.mjs ; packages/client/test/agent-disabled-reconnect.test.mjs ; packages/client/test/agent-transient-handshake-reconnect.test.mjs
+- processes matched 14 sources, examples: packages/client/src/agent.mjs ; packages/client/src/agent-update.mjs ; packages/client/src/cli/connect.mjs ; packages/runtime/src/extended/common.mjs ; packages/runtime/src/extended/desktop-windows.mjs
+- filesystem matched 44 sources, examples: install.ps1 ; packages/client/src/agent-update.mjs ; packages/client/src/cli/doctor.mjs ; packages/client/src/cli.mjs ; packages/client/src/cli/service.mjs
+- desktop matched 21 sources, examples: packages/runtime/src/catalog.mjs ; packages/runtime/src/compact-catalog.mjs ; packages/runtime/src/extended/browser.mjs ; packages/runtime/src/extended/catalog.mjs ; packages/runtime/src/extended/desktop-linux.mjs
+- recovery matched 31 sources, examples: install.ps1 ; packages/client/src/agent.mjs ; packages/client/src/agent-update.mjs ; packages/client/src/cli/service.mjs ; packages/client/src/cli/update.mjs
+- logs matched 26 sources, examples: install.ps1 ; packages/client/src/agent.mjs ; packages/client/src/cli.mjs ; packages/client/src/cli/service.mjs ; packages/client/test/cli-lifecycle.test.mjs
+- authority matched 20 sources, examples: packages/client/src/agent.mjs ; packages/client/src/cli/connect.mjs ; packages/client/src/cli.mjs ; packages/client/src/fs-access.mjs ; packages/client/test/connect-browser.test.mjs
+- tests matched 69 sources, examples: packages/client/src/agent-update.mjs ; packages/client/src/cli/config.mjs ; packages/client/src/cli/service.mjs ; packages/client/src/runtime.mjs ; packages/client/test/agent-auto-update.test.mjs
+- agent_loop matched 7 sources, examples: packages/client/src/agent-update.mjs ; packages/client/src/cli.mjs ; packages/client/src/cli/service.mjs ; packages/client/src/cli/update.mjs ; packages/client/test/cli-lifecycle.test.mjs
+
+### secure-host-mcp
+
+Top directories: .git, .github, examples, mcp-app, packaging, scripts, src, test, web.
+Scan truncated: false. Skipped 1 symlink/generated locations.
+Manifests: package.json [MIT]
+- protocol matched 26 sources, examples: eslint.config.js ; mcp-app/runtime-status.js ; packaging/windows-launcher/Program.cs ; scripts/build-mcp-app.mjs ; scripts/package-standalone.mjs
+- sessions matched 8 sources, examples: src/cli.ts ; src/mcp.ts ; src/privilege.ts ; src/server.ts ; src/service.ts
+- processes matched 10 sources, examples: scripts/package-standalone.mjs ; scripts/smoke-pty.mjs ; src/executor.ts ; src/privilege.ts ; src/service.ts
+- filesystem matched 22 sources, examples: scripts/build-mcp-app.mjs ; scripts/package-standalone.mjs ; src/cli.ts ; src/config.ts ; src/files.ts
+- recovery matched 7 sources, examples: src/cli.ts ; src/mcp.ts ; src/privilege.ts ; src/service.ts ; src/setup.ts
+- logs matched 13 sources, examples: src/audit.ts ; src/config.ts ; src/mcp.ts ; src/privilege.ts ; src/server.ts
+- authority matched 7 sources, examples: src/auth.ts ; src/config.ts ; src/privilege.ts ; src/server.ts ; test/audit.test.ts
+- tests matched 8 sources, examples: src/auth.ts ; src/server.ts ; src/terminal.ts ; src/tunnels.ts ; src/workspace.ts
+
+### winremote-mcp
+
+Top directories: .git, .github, docs, skill, src, tests.
+Scan truncated: false. Skipped 1 symlink/generated locations.
+Manifests: pyproject.toml
+- protocol matched 11 sources, examples: src/winremote/config.py ; src/winremote/desktop.py ; src/winremote/__init__.py ; src/winremote/__main__.py ; src/winremote/oauth.py
+- sessions matched 3 sources, examples: src/winremote/desktop.py ; src/winremote/__main__.py ; tests/test_desktop_tools.py
+- processes matched 10 sources, examples: src/winremote/desktop.py ; src/winremote/__main__.py ; src/winremote/network.py ; src/winremote/ocr.py ; src/winremote/services.py
+- filesystem matched 1 sources, examples: src/winremote/__main__.py
+- desktop matched 6 sources, examples: src/winremote/desktop.py ; src/winremote/__main__.py ; src/winremote/ocr.py ; src/winremote/taskmanager.py ; tests/conftest.py
+- recovery matched 1 sources, examples: src/winremote/__main__.py
+- logs matched 3 sources, examples: src/winremote/__main__.py ; src/winremote/ocr.py ; src/winremote/taskmanager.py
+- authority matched 4 sources, examples: src/winremote/auth.py ; src/winremote/oauth.py ; tests/test_auth.py ; tests/test_oauth.py
+- tests matched 15 sources, examples: tests/conftest.py ; tests/test_auth.py ; tests/test_config_and_tiers.py ; tests/test_desktop_tools.py ; tests/test_helpers.py
+- LICENSE UNVERIFIED: do not reuse source code without separate review.
+
+## Triage and boundary
+
+Inspect matched source plus tests before asserting any capability. Prefer algorithm redesign and benchmarked adaptation to bulk code copying.
+Preserve DEADBYTE machine identity, explicit authority, native diff, signed receipts, existing tool count and rollback. No third-party runtime imports until security and license review.
+R89/R155 release blockers still precede new features. Next: inspect concrete Desktop Commander implementation paths; test one candidate improvement on an isolated R157 fixture.

package/docs/R157-REFERENCE-DECISIONS.md

@@ -0,0 +1,46 @@
+# R157 Reference Decisions — DEADBYTE MCP
+
+Evidence base: `R157-REFERENCE-INVENTORY.json`, `R157-ARCHITECTURE-GRAPH.json` and static source inspection of the local snapshots. No reference executables or third-party dependencies were run.
+
+The file inventory walked all 12 repository roots and non-generated subdirectories. Exclusions (node_modules, vendor, Git metadata, build caches and symbolic links) are explicitly recorded in the JSON. This is not a line-by-line security audit of every source file.
+
+| Source | Evidence files inspected / inventory anchors | Candidate engineering idea | DEADBYTE baseline and decision |
+|---|---|---|---|
+| better-remote-commander | `packages/agent/src/core/terminal-manager.ts`, `packages/agent/src/core/search-manager.ts`, agent/relay/shared package manifests | Split agent/relay, streaming terminal tool lifecycle | Existing cloud/bridge/supervisor and typed process plane. **Compare protocols, do not replace** |
+| cua | `docs/public/examples/local-models/cua-mcp-filter.py`, `docs/public/scripts/openai-agents-fleet/run_openai_agents_fleet.py` and test inventory | UI action provenance, driver conformance and computer-control fixtures | Typed desktop scope already exists; **adapt isolation/evaluation tests** only |
+| desktop-commander v0.2.52 | `dist/terminal-manager.js`, `dist/remote-device/remote-channel.js`, `dist/utils/withTimeout.js` | Foreground terminal streams and visible command lifecycle | Default per-call LiveLogs R155 already has START/DONE and diagnostics. **Prefer regression/latency benchmark** |
+| desktop-commander v0.3.0 | `dist/utils/atomic-write.js`, `dist/utils/process-tree.js`, `dist/remote-device/diagnostics/redact.js`, `dist/remote-device/transport-telemetry.js` | Atomic changes, parent/child process tracking, sensitive-data redaction, diagnostics | DEADBYTE has Native Diff receipts, foreground PID+creation identity, bounded logs. **Adapt diagnostic tests, not authority paths** |
+| desktop-commander v0.3.1 | Same process-tree/atomic-write/redact hashes as 0.3.0; `dist/remote-device/remote-channel.js` and `dist/utils/files/text.js` have different SHA-256 | Regression analysis across transport and text read updates | **Compare event ordering and throughput** under identical workloads before claiming advantage |
+| desktop-commander-0.3.1-alpha.2 | `static/dist/remote-device/remote-channel.js`, `static/dist/remote-device/diagnostics/device-log.js`, `static/dist/utils/process-tree.js` | Diagnostic journal and event grouping | **Adapt observability test ideas**, preserve DEADBYTE signed audit chain |
+| harness2-main | `harness2/benchmarks/jobbench.py`, `harness2/benchmarks/lab.py` | Repeatable agent engineering benchmarks | **Adapt measurement contract**, avoid claims from unmatched hardware/test fixtures |
+| open-remote-mcp | `apps/agent/src/index.ts`, `apps/server/src/index.ts`, `scripts/e2e.mjs` | Simple agent/server split and integration startup | Already split in DEADBYTE; **reference E2E contracts only** |
+| rea-main | `bridge/native/rea_lldb_tracer.py`, `bridge/cutter/rea_bridge.py`, conformance fixtures | Reverse-engineering artifacts and tool adapter tests | **Defer integration** until sandboxing, file licensing and approved RE project scope |
+| remcp | `packages/client/src/agent.mjs`, `packages/runtime/src/catalog.mjs` | Client/runtime packaging and catalog | DEADBYTE compact/full capability manifest already exists; **compare catalog drift tests** |
+| secure-host-mcp | `src/auth.ts`, `src/audit.ts`, `src/mcp.ts` | Host identity and audit boundary | Keep R89 and Ed25519 authority stricter; **adopt negative security tests** |
+| winremote-mcp | `src/winremote/desktop.py`, `src/winremote/auth.py`, `src/winremote/oauth.py` | Windows desktop actions, authentication | **Test CUA conformance** behind DEADBYTE Desktop authority, no generic credential/exec authority |
+
+## Version and license constraints
+
+- Desktop Commander versions in these local snapshots report MIT in their package metadata. The 0.2.52 snapshot has Node >=18 and MCP SDK ^1.9.0. The later snapshots list Node >=22.12.0 and MCP SDK ^1.32.1. This alone is not permission to redistribute bundled transitive dependencies.
+- The Desktop Commander folders are bundled distribution snapshots, **not source/test checkouts**. The inventory found no test files under those four local snapshots. No upstream tests have been executed here.
+- Other references contain mixed license and dependency evidence; their per-path manifests are in the inventory. Where a particular file's license is unknown, do not copy its implementation.
+- No reference source was copied or imported in R157. This preserves the DEADBYTE architecture and avoids unnecessary dependencies.
+
+## Actual R157 adoption decision
+
+Rather than importing a competitor's process manager, improve DEADBYTE's own durable supervisor where direct tests exposed defects:
+1. Backoff-blocked goal status was redundantly queried. Before: two reads, after: one. Only resume status observation at the authorized retry deadline.
+2. Concurrent manual and scheduled supervisor scans could dispatch one goal twice. Before: 2 calls, after: 1 via single-flight.
+3. Preserve R156 Codex backend dispatch and owner approval WAITING. No new public tool, native grant, or hidden standing authority.
+
+This improvement is measured in avoided status reads and duplicate dispatch **in isolated tests**. Production latency/CPU improvement is not yet benchmarked.
+
+## Security and release priority
+
+1. R89 live protected epoch root deployment with OS-owned path and independently approved action; development code must not bypass ACL checks.
+2. R155 startup reconciliation, single-locator collision, full regression and exact 0.15.62 tarball.
+3. R156/R157 restart, provider backoff, duplicate-dispatch and owner-approval E2E under an isolated authorized test project.
+4. Benchmarks of Desktop Commander and DEADBYTE on the same hardware, tool set, inputs, and scope.
+5. Only then consider extra protocol/desktop improvements. Prefer no new public tools until a capability gap is proven.
+
+Final decision: **ADAPT SELECTIVELY / DO NOT BULK REUSE.** Identity, authority, provenance and rollback outrank feature count.