deadbyte-mcp 0.15.70 → 0.15.72

package/test/r191-release-contract.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const json=async f=>JSON.parse(await readFile(path.join(root,f),'utf8'));
+const predecessor='v0.15.71-1818abc327478a96';
+const publishedManifest='1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c';
+const publishedTarball='20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27';
+test('R191 exact version identity includes bundled bridge, lock snapshot, SBOM, provenance and matrix',async()=>{
+ const [pkg,bridge,lock,release,provenance,matrix,bom]=await Promise.all(['package.json','bridge/package.json','docs/R184-package-lock.json','RELEASE.json','PROVENANCE.json','TEST-MATRIX.json','SBOM.cdx.json'].map(json));
+ for(const ver of [pkg.version,bridge.version,lock.version,lock.packages[''].version,release.version,provenance.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])assert.equal(ver,'0.15.72');
+ for(const train of [release.train,matrix.train])assert.equal(train,'R192');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r192:0.15.72');
+ assert.equal(release.parent.release_id,predecessor);
+ assert.equal(provenance.parent_release_id,predecessor);
+ assert.equal(release.source_predecessor.version,'0.15.71');
+ assert.equal(release.source_predecessor.manifest_sha256,publishedManifest);
+ assert.equal(release.source_predecessor.tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_version,'0.15.71');
+ assert.equal(provenance.parent_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_tarball_sha256,publishedTarball);
+ assert.equal(provenance.source_predecessor_manifest_file_sha256,publishedManifest);
+ assert.equal(release.r191_activation_repair.npm_publish,'NOT_RUN');
+ assert.equal(release.r191_activation_repair.production_activation,'NOT_RUN');
+ assert.equal(release.r190_foreground_recovery.status,'PREPUBLISH_VERIFIED');
+ assert.equal(release.r179.stable_final_claim,false);
+ assert.equal(matrix.required.some(x=>x.id==='r191-trusted-successor-epoch-root'),true);
+});

package/test/r192-live-log-hardening.test.mjs

@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {formatRuntimeDiagnosticLine,createLiveTimelineTracker,
+  pruneLiveLogReaders} from '../src/remote-live-log.mjs';
+
+const compact=(reason)=>'[TOOL] 2026-10-28T14:00:00.000Z #12 ✗ coding_command_run 10ms — '+reason;
+
+test('R192 runtime verbose diagnostics never disclose secret-bearing reasons',()=>{
+  const raw=compact('password=canaryNotForConsole123');
+  const out=formatRuntimeDiagnosticLine('bridge.stdout.log',raw,{verbose:true,displayMode:'ascii'});
+  assert.equal(typeof out,'string');
+  assert.match(out,/coding_command_run/);
+  assert.match(out,/REDACTED/);
+  assert.doesNotMatch(out,/canaryNotForConsole123/);
+  assert.equal(formatRuntimeDiagnosticLine('bridge.stdout.log',raw,{verbose:false}),null);
+});
+
+test('R192 runtime diagnostic detail is short, single-line and status-preserving',()=>{
+  const out=formatRuntimeDiagnosticLine('bridge.stdout.log',compact('slow write rejected '+('x'.repeat(800))),{verbose:true,displayMode:'ascii'});
+  assert.match(out,/\[BRIDGE.STDOUT.DEBUG\].*coding_command_run 10ms/);
+  assert.ok(out.length<350,'a single runtime diagnostic cannot flood the foreground');
+  assert.equal(out.split(/\r?\n/).length,1);
+});
+
+test('R192 audit result redacts secrets without hiding outcome classification',()=>{
+  const tracker=createLiveTimelineTracker({clock:()=>1000,displayMode:'ascii'});
+  tracker.observe({event_type:'tool.request',request_id:'123456789012',tool:'host_exec',args:{root_id:'core',mode:'native'}});
+  const out=tracker.observe({event_type:'tool.result',request_id:'123456789012',tool:'host_exec',
+    outcome:{status:'denied',is_error:true,duration_ms:24,reason:'authorization: Bearer supersensitive123456'}});
+  assert.match(out,/ERR/);
+  assert.doesNotMatch(out,/supersensitive123456/);
+  assert.match(out,/REDACTED/);
+});
+
+test('R192 rotation prunes stale cursors and partial line fragments without touching current streams',()=>{
+  const live=new Map([['current.log',{offset:12}],['gone.log',{offset:77}]]);
+  const fragments=new Map([['current.log','half'],['gone.log','secret']]);
+  const result=pruneLiveLogReaders(live,fragments,['current.log','other.log']);
+  assert.deepEqual(result,{cursors_removed:1,fragments_removed:1});
+  assert.deepEqual([...live.keys()],['current.log']);
+  assert.deepEqual([...fragments], [['current.log','half']]);
+});
+
+test('R192 reject malformed discovery before mutating any reader state',()=>{
+  const live=new Map([['current.log',{offset:12}]]);
+  const fragments=new Map([['current.log','half']]);
+  assert.throws(()=>pruneLiveLogReaders(live,fragments,[123]),/invalid/i);
+  assert.equal(live.has('current.log'),true);
+  assert.equal(fragments.get('current.log'),'half');
+});

package/test/r192-release-identity.test.mjs

@@ -0,0 +1,40 @@
+import test from 'node:test';import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';import {createHash} from 'node:crypto';import path from 'node:path';import {fileURLToPath} from 'node:url';
+import {DEADBYTE_VERSION} from '../src/version.mjs';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const read=async name=>JSON.parse(await readFile(path.join(root,name),'utf8'));
+const prevHash='1818abc327478a96d935c200e25aad8515f15edc1842845b73bd0de57606da8c';
+const prevTar='20ed3b20e72b4e4226736a1e432b05b851e9fa265e9bc2966b74f266477b7e27';
+test('R192 exact package, bridge, lock, metadata and runtime version are 0.15.72',async()=>{
+ const [pkg,bridge,lock,release,prov,matrix,bom]=await Promise.all([
+ read('package.json'),read('bridge/package.json'),read('docs/R184-package-lock.json'),
+ read('RELEASE.json'),read('PROVENANCE.json'),read('TEST-MATRIX.json'),read('SBOM.cdx.json')]);
+ for(const actual of [pkg.version,bridge.version,lock.version,lock.packages[''].version,
+ release.version,prov.version,matrix.version,bom.metadata.component.version,DEADBYTE_VERSION])
+   assert.equal(actual,'0.15.72');
+ assert.equal(release.train,'R192');assert.equal(matrix.train,'R192');
+ assert.equal(bom.serialNumber,'urn:cdx:deadbyte-mcp:r192:0.15.72');
+ assert.equal(release.parent.release_id,'v0.15.71-1818abc327478a96');
+ assert.equal(release.parent.manifest_sha256,prevHash);
+ assert.equal(release.source_predecessor.tarball_sha256,prevTar);
+ assert.equal(release.source_predecessor.manifest_sha256,prevHash);
+ assert.equal(prov.parent_tarball_sha256,prevTar);
+ assert.equal(prov.parent_manifest_sha256,prevHash);
+ assert.equal(release.r192.production_activation,'NOT_RUN');
+ assert.equal(release.r192.public_tool_schema_changed,false);
+ assert.equal(release.r192.authority_grants_changed,false);
+});
+test('R192 foreground reader enforces caller-safe telemetry rather than changing authority',async()=>{
+ const [cli,log]=await Promise.all([
+ readFile(path.join(root,'src','deadbyte-cli.mjs'),'utf8'),
+ readFile(path.join(root,'src','remote-live-log.mjs'),'utf8')]);
+ assert.match(cli,/pruneLiveLogReaders\(activeOffsets,partialLines,liveFiles\)/);
+ assert.match(log,/export function pruneLiveLogReaders/);
+ assert.match(log,/sanitizeAuditArgs\(compact\[6\]\)/);
+ const [policy,release]=await Promise.all([
+ read('controller/deadbyte-process-policy.json'),read('RELEASE.json')]);
+ const approved=release.r192.development_policy_root;
+ assert.equal(typeof approved,'string');
+ assert.ok(path.isAbsolute(approved));
+ assert.equal(path.resolve(policy.roots.core.path),path.resolve(approved));
+});

package/test/r59-tool-surface-compat.test.mjs

@@ -83,7 +83,7 @@ test('R72 compact baseline permits only R64 read offset and authorized coding-on
   assert.deepEqual(diff.added,[]);
   assert.deepEqual(diff.removed,[]);
   const packageVersion=JSON.parse(await readFile(path.join(repoRoot,'package.json'),'utf8')).version;
-  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70'].includes(packageVersion)){
+  if(['0.15.41','0.15.42','0.15.43','0.15.44','0.15.45','0.15.46','0.15.47','0.15.48','0.15.49','0.15.50','0.15.51','0.15.52','0.15.53','0.15.54','0.15.55','0.15.56','0.15.57','0.15.58','0.15.59','0.15.60','0.15.61','0.15.62','0.15.63','0.15.64','0.15.65','0.15.66','0.15.67','0.15.68','0.15.69','0.15.70','0.15.71','0.15.72'].includes(packageVersion)){
     assert.deepEqual([...diff.schema_changed].sort(),['machine_fs','native_diff_preview']);
     assert.equal(diff.unchanged.length,41);
     const prior=baseline.tools.find(tool=>tool.name==='machine_fs');