deadbyte-mcp 0.15.7 → 0.15.8

package/MANIFEST.SHA256

@@ -1329,7 +1329,7 @@ db605a698f917c4006462596e6526fe6a9c6eff9b8409e8472fe545d4b70027c  node_modules/z
 f67a25ded944912bd4621b68df17c7c70a52aae117278c076c0aabbc32a3abba  node_modules/zod/v4/mini/schemas.d.ts
 51b3a7869df2d3a1bd98acb9d5b6a61bbccc7653d7a3d8fca7f0e0db7e84e284  node_modules/zod/v4/mini/schemas.js
 3e3125b5a537a24c3632c1c5c09640ce7bcb3935901b127ad8ae3c37a27f133f  node_modules/zod/v4/package.json
-c2e60730f0406fc7dac480a0fe96f4e9b221d6937a43cc646b74ca0b99200a97  package.json
+79a1512703a88bc9d9347f26fa54ce0d0dbf52724bf3695e84dfa687f3c5a390  package.json
 8177e3a354721a73df889f386a97e7744a2e017d150aecf4bf309f5177d18690  proof/CONTAINMENT-BUILD.txt
 a8efa13e44ff50902aee64cfca542d19605a1ae23db95280ad2d44b324f3eae7  proof/MCP-SMOKE-STATUS.txt
 7c115069cc4a343ca21b0ebdee74bd8f544b02d4aa906ffa13308725825d891a  proof/NODE-SYNTAX.txt
@@ -1389,7 +1389,7 @@ d433aaea5cccd1e184775ac4d915f34e0b39c6c99916dddd009731ad5fd6443f  proof/V073-WIN
 bd0773a9e02e8ab11475c9cc5a7db29a8313233b7eab7f837922737e75ec5938  proof/VERIFY.txt
 2c821808d4596965c577f40191daee224d3aea81989778c4af97f53a83b487db  proof/WINDOWS-CONTAINED-STATUS.txt
 f8bc839c7b4fcb0ea7b7e7ad9448847c3beae6f95f2eb4d407d1b284aaa4ff68  proof/WINDOWS-CONTAINMENT-STATUS.txt
-2e08ebcd817f2472f0bca26025091eabe66629591f87df7993c403d55fbcf855  PROVENANCE.json
+60389fa2a0c7f699292cc731ecb33863ce1d38196195d38e8a48cae50228d8a1  PROVENANCE.json
 27ca0f3c9ee3a1b6374a9c8dd98008decdd0c7659c7a569c70ad7b9734c74655  R34-BASELINE.json
 0b7ec5ee347ddfa6cca59740fc7a8fe3fc5d51406265bb12189e82fa106319d2  R41-PARENT.json
 bd2a789b0aab5663f0d208af2ca8e4ec98179bc8c7b57e70a962d4e06a3dcfc4  R42-PARENT.json
@@ -1398,7 +1398,7 @@ f932ef78b7a72b1bb0d7aedb5fe42fbb9951c2492eb528b72442f46ddff81a6c  R44-DONORS.jso
 731b4c559fc0d25dea701e4474f02400b27e8e3f4cac9f230d5214497d4490a9  R44-PARENT.json
 d33ec5d167dd44800ba4e68372b08db43deb8d01df2ef71dd435ff004ac66c8b  R45-PARENT.json
 0ae37e1c40dff1a47f08ca5a0e9dcdddb3c8c3a8e478d69429e99a2f951f55ab  README.txt
-4c490e8bcc0c2ea977a8f839cde247680bead95f6bbfb90d9a98b4f0e4eb8921  RELEASE.json
+0a318974786d7e58185bd531e9f80de5f5681788b80bbf42d5b5329cdd17ebcb  RELEASE.json
 507a42441c8fbb0b1bef63a13fad9e1680262cd6d34cc176b7ed0c5423ddbcc7  SBOM.cdx.json
 bd138fe5a64088e8e1a7a5bf6104c5b17317bdc8cf3ad8191ea00ed82ace7d9b  scripts/agent-eval-r42.mjs
 8d90256a6863f3bbbff02e95cb12389fc6f9e8dbcb77bf1c20c902de371425e8  scripts/archive-source-zips.mjs
@@ -1485,7 +1485,8 @@ a0ad824eed1d8be051d5f731579f9bf4115b311f202b75ea0d03aa257b13a671  scripts/gate-w
 1a771b5b8a62d57f26762d53472ed68a3e733674b1c91e08becf0dc2e4325039  scripts/inspect-active-release-r45.mjs
 de6142bd5693cf4edb8725c9c43fc77e9bdc12f5b398a757006d778d3ee3f8ed  scripts/inspect-r46-active.mjs
 7ea8cf6bf094a1612603bc716228a3753e5f06fca8a0684d2da15a04d0710c64  scripts/list-source-zips.mjs
-50b333bf712062e951bcc933ebf1a0c3a761132e4ff736f1fc57a452e9cc50db  scripts/npm-release-r47.mjs
+9d12d15f7c83ddf272834072ed37d618a232bd8a3fd36c339761fe08bb9380d8  scripts/npm-publish-r47.ps1
+9799df2876e6f7851aeec04266b49a2fce58725cae281e58c73df1b4234e317a  scripts/npm-release-r47.mjs
 453dd636b452f4343a36f31a93a763e97f58ed5d6c9df3d2ba05b236934a3a1f  scripts/probe-source-zips.mjs
 8f9d97a4d23e9d05e7cadfb6a519b1ddb9da04894bca98bdc293fc3797e8423c  scripts/probe-zips.mjs
 e19a1d591ccd07af2e87d930ce23b0cc9b814bc2a395408045543847154097d7  scripts/r40-compact-ledger-probe.mjs
@@ -1703,7 +1704,7 @@ bac271c6f5218752ac5ff4decf5249e3893ddb35c63c092ce17238c27fc4d35b  src/trust-init
 16df134040e3ff1e73df722b568d3e8ac0a6923b097696cead7580da75aa8d2a  src/tunnel-stdio-compat.mjs
 642cb67d1854850e336ee73fbd71b329056bdcbdab35cea19c1a995a155ff5d9  src/verifier-cli.mjs
 8f818a4852ce3be3a380cd4736c3073a7a3e0e45cd7c7ca90588a6b843d3d022  src/verifier.mjs
-0ce4c08618f4e846d6c978e5d5b39229130d786c3b17c737dcf02010434d5afb  src/version.mjs
+75903ce9e7a221d3f6d163f6a908de58765291347f732ff5e1d2cea9f04010ac  src/version.mjs
 7e09c57a97289360aabfaf3d531208e54872efbfb3182f3c18203d2cb88c46b5  src/worker-registry.mjs
 76361d5ae9a710273cf64a7525082197b692236bf23689875e5fd1ef4aa96d2b  src/worker-scheduler.mjs
 4da1b32f5198bb089bc68b7eb6de21ea296678b5020018a73742bf0df57d62fa  src/workload-substrate.mjs

package/PROVENANCE.json

@@ -1,6 +1,6 @@
 {
   "schema": "deadbyte.provenance.v1",
-  "version": "0.15.5",
+  "version": "0.15.8",
   "builder": "deadbyte-r46-fileless-powershell",
   "source_model": "development-root -> MANIFEST.SHA256 -> immutable release slot -> generation bundle -> signed final closure",
   "signing": "ed25519",

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.5",
+  "version": "0.15.8",
   "train": "R46",
   "label": "FILELESS POWERSHELL PRODUCT BASELINE",
   "protocol_revision": "2026-07-28",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.7",
+  "version": "0.15.8",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/scripts/npm-publish-r47.ps1

@@ -1,22 +1,6 @@
 $ErrorActionPreference = 'Stop'
-Set-Location (Join-Path $PSScriptRoot '..')
-$pkg = Get-Content package.json -Raw | ConvertFrom-Json
-$version = [string]$pkg.version
-if ($pkg.name -ne 'deadbyte-mcp') { throw 'unexpected package name' }
-$existing = $null
-try { $existing = & npm.cmd view "deadbyte-mcp@$version" version --json 2>$null } catch { $existing = $null }
-if ($LASTEXITCODE -eq 0 -and $existing) { throw "deadbyte-mcp@$version is already published: $existing" }
-$pack = (& npm.cmd pack --json 2>&1 | Out-String)
-if ($LASTEXITCODE -ne 0) { throw 'npm pack failed' }
-$packObj = $pack | ConvertFrom-Json
-$filename = [string]$packObj.'deadbyte-mcp'.filename
-if ([string]::IsNullOrWhiteSpace($filename)) { throw "npm pack did not return tarball filename. output=$pack" }
-$tarball = Join-Path (Get-Location) $filename
-& npm.cmd publish $tarball --access public
-if ($LASTEXITCODE -ne 0) { throw 'npm publish failed' }
-$published = (& npm.cmd view "deadbyte-mcp@$version" version dist.integrity dist.tarball --json | ConvertFrom-Json)
-$tags = (& npm.cmd view deadbyte-mcp dist-tags --json | ConvertFrom-Json)
-$npx = & npx.cmd --yes "deadbyte-mcp@$version" -- --version
-if ($LASTEXITCODE -ne 0) { throw 'npx verification failed' }
-Remove-Item -LiteralPath $tarball -Force -ErrorAction SilentlyContinue
-[pscustomobject]@{ status='published'; name=$pkg.name; version=$version; tarball=$filename; published=$published; dist_tags=$tags; npx_version_output=($npx -join "`n") } | ConvertTo-Json -Depth 8
+$script = Join-Path $PSScriptRoot 'npm-release-r47.mjs'
+& node $script
+if ($LASTEXITCODE -ne 0) {
+    throw "Release pipeline failed with exit code $LASTEXITCODE"
+}

package/scripts/npm-release-r47.mjs

@@ -1,39 +1,189 @@
 import { spawnSync } from 'node:child_process';
-import { readFile, unlink } from 'node:fs/promises';
+import { mkdtemp, readFile, rm, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
+import { fileURLToPath } from 'node:url';
 
-const root=path.resolve(new URL('..',import.meta.url).pathname.replace(/^\/(?:[A-Za-z]:)/,''));
-const npm=process.platform==='win32'?'npm.exe':'npm';
+const root = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const node = process.execPath;
+const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
 
-function run(args,timeout=180000){
-  const r=spawnSync(npm,args,{cwd:root,encoding:'utf8',timeout,stdio:['ignore','pipe','pipe'],shell:false,windowsHide:true});
-  if(r.error) throw r.error;
-  if(r.status!==0) throw new Error('npm '+args.join(' ')+' failed exit='+r.status+'\n'+(r.stderr||r.stdout||'').slice(-12000));
-  return (r.stdout||'').trim();
+function run(command, args, options = {}) {
+  const { cwd = root, timeout = 180000 } = options;
+  const r = spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    timeout,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    shell: false,
+    windowsHide: true,
+  });
+  if (r.error) throw r.error;
+  if (r.status !== 0) {
+    const detail = (r.stderr || r.stdout || '').slice(-12000);
+    throw new Error(`${command} ${args.join(' ')} failed (exit=${r.status}, cwd=${cwd}):\n${detail}`);
+  }
+  return (r.stdout || '').trim();
 }
-function parseJson(text){
-  const start=Math.min(...[text.indexOf('{'),text.indexOf('[')].filter(n=>n>=0));
-  if(!Number.isFinite(start)) throw new Error('npm JSON output missing');
+
+function runNpm(args, options = {}) {
+  return run(node, [npmCli, ...args], options);
+}
+
+function parseJson(text) {
+  const start = Math.min(...[text.indexOf('{'), text.indexOf('[')].filter(n => n >= 0));
+  if (!Number.isFinite(start)) throw new Error('Command JSON output missing:\n' + text.slice(0, 1000));
   return JSON.parse(text.slice(start));
 }
 
-const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
-const version=pkg.version;
-if(pkg.name!=='deadbyte-mcp') throw new Error('unexpected package name');
-const existing=spawnSync(npm,['view',`deadbyte-mcp@${version}`,'version','--json'],{cwd:root,encoding:'utf8',stdio:['ignore','pipe','pipe'],shell:false,windowsHide:true});
-const existingText=(existing.stdout||'').trim();
-if(existing.status===0 && existingText && existingText!=='null'){
-  throw new Error(`deadbyte-mcp@${version} is already published: ${existingText}`);
+const allowedUnmanifested = new Set([
+  'MANIFEST.SHA256',
+  'controller/deadbyte-host-policy.json',
+  'controller/deadbyte-coding-policy.json',
+]);
+
+async function main() {
+  const isVerifyOnly = process.argv.includes('--verify-only') || process.argv.includes('--dry-run');
+
+  console.log(`[1/7] Reading package.json and checking registry publication status... ${isVerifyOnly ? '(MODE: VERIFY-ONLY / DRY-RUN)' : '(MODE: PUBLISH)'}`);
+  const pkg = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+  const version = pkg.version;
+  if (pkg.name !== 'deadbyte-mcp') throw new Error(`unexpected package name: ${pkg.name}`);
+
+  const existing = spawnSync(node, [npmCli, 'view', `deadbyte-mcp@${version}`, 'version', '--json'], {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], shell: false, windowsHide: true,
+  });
+  const existingText = (existing.stdout || '').trim();
+  const isAlreadyPublished = existing.status === 0 && existingText && existingText !== 'null';
+
+  if (isAlreadyPublished) {
+    if (!isVerifyOnly) {
+      throw new Error(`deadbyte-mcp@${version} is already published on registry: ${existingText}`);
+    } else {
+      console.log(`Notice: deadbyte-mcp@${version} is already published on registry (${existingText}), proceeding with pre-publish verification only.`);
+    }
+  }
+
+  console.log('[2/7] Pre-pack gates: verifying working tree manifest and doctor...');
+  run(node, [path.join(root, 'scripts', 'release-manifest.mjs'), 'verify']);
+  run(node, [path.join(root, 'src', 'deadbyte-cli.mjs'), 'doctor']);
+
+  console.log('[3/7] Packing artifact with npm pack...');
+  const packed = parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
+  const filename = packed?.[0]?.filename;
+  if (!filename) throw new Error('npm pack did not return a tarball filename');
+  const tarball = path.join(root, filename);
+
+  try {
+    console.log('[4/7] Verifying packed artifact file surface against MANIFEST.SHA256 and packaging contract...');
+    const manifestText = await readFile(path.join(root, 'MANIFEST.SHA256'), 'utf8');
+    const manifestEntries = new Set();
+    for (const line of manifestText.split(/\r?\n/)) {
+      if (!line) continue;
+      const m = /^([0-9a-f]{64})\s+(.+)$/.exec(line);
+      if (m) manifestEntries.add(m[2]);
+    }
+
+    const tarListing = run('tar', ['-tf', tarball], { timeout: 60000 });
+    const tarFiles = new Set(
+      tarListing
+        .split(/\r?\n/)
+        .map(s => s.trim().replaceAll('\\', '/'))
+        .filter(s => s.startsWith('package/') && s.length > 'package/'.length && !s.endsWith('/'))
+        .map(s => s.slice('package/'.length))
+    );
+
+    const missingInTarball = [];
+    for (const rel of manifestEntries) {
+      if (!tarFiles.has(rel)) missingInTarball.push(rel);
+    }
+    if (missingInTarball.length > 0) {
+      throw new Error(`Tarball missing files declared in manifest (${missingInTarball.length}): ${missingInTarball.slice(0, 10).join(', ')}`);
+    }
+
+    const unexpectedInTarball = [];
+    for (const rel of tarFiles) {
+      if (!manifestEntries.has(rel) && !allowedUnmanifested.has(rel)) {
+        unexpectedInTarball.push(rel);
+      }
+    }
+    if (unexpectedInTarball.length > 0) {
+      throw new Error(`Tarball contains unexpected files not in manifest or allowlist (${unexpectedInTarball.length}): ${unexpectedInTarball.slice(0, 10).join(', ')}`);
+    }
+
+    console.log(`Packed artifact surface verified OK: ${tarFiles.size} package files, all ${manifestEntries.size} manifest entries present.`);
+
+    console.log('[5/7] Pre-publish artifact isolation gate in sandbox...');
+    const sandbox = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-release-verify-'));
+    try {
+      run('tar', ['-xzf', tarball, '-C', sandbox]);
+      const extractedPackage = path.join(sandbox, 'package');
+
+      const extractedVersion = run(node, [path.join(extractedPackage, 'src', 'deadbyte-cli.mjs'), '--version'], {
+        cwd: extractedPackage,
+      });
+      if (extractedVersion !== version) {
+        throw new Error(`Isolated package version mismatch: expected=${version} got=${extractedVersion}`);
+      }
+
+      run(node, [path.join(extractedPackage, 'src', 'deadbyte-cli.mjs'), 'doctor'], {
+        cwd: extractedPackage,
+      });
+
+      console.log('Artifact isolation gate PASS (clean doctor and version check on unpacked tarball in sandbox)');
+    } finally {
+      await rm(sandbox, { recursive: true, force: true }).catch(() => {});
+    }
+
+    if (isVerifyOnly) {
+      console.log('[6/7] [VERIFY-ONLY] Skipping npm publish.');
+      console.log('[7/7] [VERIFY-ONLY] Skipping external registry smoke test.');
+      console.log('\nVERIFY-ONLY PIPELINE PASS: All pre-pack, artifact surface, and isolated sandbox gates passed successfully.');
+      return;
+    }
+
+    console.log('[6/7] Publishing artifact to npm registry...');
+    const publishOut = runNpm(['publish', tarball, '--access', 'public'], { timeout: 300000 });
+    const published = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.tarball', '--json'], { timeout: 120000 }));
+    const tags = parseJson(runNpm(['view', 'deadbyte-mcp', 'dist-tags', '--json'], { timeout: 120000 }));
+
+    console.log('[7/7] Post-publish external registry smoke test (executed outside repo in temp)...');
+    const tempDir = os.tmpdir();
+    const externalVersion = runNpm(['exec', '--yes', `--package=deadbyte-mcp@${version}`, '--', 'deadbyte-mcp', '--version'], {
+      cwd: tempDir,
+      timeout: 300000,
+    });
+    if (externalVersion !== version) {
+      throw new Error(`External registry smoke test version mismatch: expected=${version} got=${externalVersion}`);
+    }
+
+    const externalDoctor = runNpm(['exec', '--yes', `--package=deadbyte-mcp@${version}`, '--', 'deadbyte-mcp', 'doctor'], {
+      cwd: tempDir,
+      timeout: 300000,
+    });
+
+    console.log('\nRELEASE SUCCESSFUL:');
+    console.log(JSON.stringify({
+      status: 'published',
+      name: pkg.name,
+      version,
+      tarball: filename,
+      published,
+      published_output_tail: publishOut.slice(-2000),
+      dist_tags: tags,
+      external_smoke: {
+        version_output: externalVersion,
+        doctor_status: 'ok',
+      },
+    }, null, 2));
+
+  } finally {
+    await unlink(tarball).catch(() => {});
+  }
 }
 
-const packed=parseJson(run(['pack','--json'],180000));
-const filename=packed?.[0]?.filename;
-if(!filename) throw new Error('npm pack did not return a tarball filename');
-const tarball=path.join(root,filename);
-const publishOut=run(['publish',tarball,'--access','public'],300000);
-const published=parseJson(run(['view',`deadbyte-mcp@${version}`,'version','dist.integrity','dist.tarball','--json'],120000));
-const tags=parseJson(run(['view','deadbyte-mcp','dist-tags','--json'],120000));
-const npxOut=run(['exec','--yes',`deadbyte-mcp@${version}`,'--','--version'],300000);
-await unlink(tarball).catch(()=>{});
-console.log(JSON.stringify({status:'published',name:pkg.name,version,tarball:filename,published,published_output_tail:publishOut.slice(-2000),dist_tags:tags,npx_version_output:npxOut},null,2));
+main().catch(err => {
+  console.error('\nRELEASE ABORTED / FAILED:');
+  console.error(err?.stack || err);
+  process.exitCode = 1;
+});

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.7';
+export const DEADBYTE_VERSION = '0.15.8';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';