deadbyte-mcp 0.15.74 → 0.15.75

package/test/r197-native-file-read.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {mkdtemp,mkdir,rm,writeFile,lstat,rename,symlink} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-fs-read-r197-fixed.exe',import.meta.url));
+const pinned='7477ca3d94168c8b75711b734df5b9c20a43ecbd9338cfc234700d7e27982b63';
+const hash=b=>createHash('sha256').update(b).digest('hex');
+function native(root,rel,offset='0',length='64',whole='1'){
+ assert.equal(hash(readFileSync(exe)),pinned,'native executable hash drift');
+ return spawnSync(exe,[root,rel,offset,length,whole],{windowsHide:true,shell:false,encoding:'utf8',timeout:10000,maxBuffer:9*1024*1024});
+}
+async function fixture(t){
+ const tmp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r197-fsread-'));
+ t.after(()=>rm(tmp,{force:true,recursive:true}));
+ const root=path.join(tmp,'root'),outside=path.join(tmp,'outside');
+ await mkdir(root);await mkdir(outside);await mkdir(path.join(root,'inner'));
+ const bytes=Buffer.from('R197-allowed-data');
+ await writeFile(path.join(root,'inner','read.bin'),bytes);
+ await writeFile(path.join(outside,'read.bin'),'OUTSIDE-private-data');
+ return {tmp,root,outside,bytes};
+}
+test('R197 native reader returns bounded bytes/hash and exact opened file identity',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=native(f.root,'inner/read.bin');
+ assert.equal(r.status,0,r.stderr);
+ const data=JSON.parse(r.stdout),info=await lstat(path.join(f.root,'inner','read.bin'),{bigint:true});
+ assert.deepEqual(Buffer.from(data.data_base64,'base64'),f.bytes);
+ assert.equal(data.file_sha256,hash(f.bytes));
+ assert.equal(data.file_size,f.bytes.length);
+ assert.equal(data.file_dev,String(info.dev));
+ assert.equal(data.file_ino,String(info.ino));
+});
+test('R197 native refuses a replaced directory junction before reading external file',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await rename(path.join(f.root,'inner'),path.join(f.root,'old'));
+ await symlink(f.outside,path.join(f.root,'inner'),'junction');
+ const r=native(f.root,'inner/read.bin');
+ assert.notEqual(r.status,0,'outside file was opened');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+ assert.doesNotMatch(r.stdout,/OUTSIDE/);
+});
+test('R197 native bounded offset and un-hashed read',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=native(f.root,'inner/read.bin','5','4','0');
+ assert.equal(r.status,0,r.stderr);
+ const data=JSON.parse(r.stdout);
+ assert.equal(Buffer.from(data.data_base64,'base64').toString('utf8'),f.bytes.subarray(5,9).toString('utf8'));
+ assert.equal(data.file_sha256,null);
+ const invalid=native(f.root,'inner/read.bin','0','4194305','0');
+ assert.notEqual(invalid.status,0);
+ assert.match(invalid.stderr,/range_budget/);
+});

package/test/r197-native-root-open.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {mkdtemp,mkdir,rm,writeFile,rename,symlink} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-root-relative-probe-r197.exe',import.meta.url));
+const expected='7cd989bd396a2871d322e1a9bb02fdbc299614e89d59d9b03d03e92a77038fd1';
+function probe(root,rel){
+ const h=createHash('sha256').update(readFileSync(exe)).digest('hex');
+ assert.equal(h,expected,'native executable SHA-256 changed');
+ return spawnSync(exe,[root,rel],{windowsHide:true,shell:false,encoding:'utf8',timeout:5000,maxBuffer:100000});
+}
+async function fixture(t){
+ const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r197-native-'));
+ t.after(()=>rm(scratch,{recursive:true,force:true}));
+ const root=path.join(scratch,'root'),outside=path.join(scratch,'outside');
+ await mkdir(root);await mkdir(outside);
+ await mkdir(path.join(root,'sub'));
+ await writeFile(path.join(root,'sub','x.bin'),'root-data');
+ await writeFile(path.join(outside,'x.bin'),'secret-data');
+ return {scratch,root,outside};
+}
+test('R197 anchored native open accepts a regular in-root file',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=probe(f.root,'sub/x.bin');
+ assert.equal(r.status,0,r.stderr);
+ assert.match(r.stdout,/R197_NATIVE_HANDLE_RELATIVE_OPEN_PASS bytes=9 components=2/);
+});
+test('R197 anchored native open refuses existing junction before any content read',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await symlink(f.outside,path.join(f.root,'link'),'junction');
+ const r=probe(f.root,'link/x.bin');
+ assert.notEqual(r.status,0,'junction was followed');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+});
+test('R197 anchored native open refuses swapped directory junction after earlier nominal pathname',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await rename(path.join(f.root,'sub'),path.join(f.root,'sub-old'));
+ await symlink(f.outside,path.join(f.root,'sub'),'junction');
+ const r=probe(f.root,'sub/x.bin');
+ assert.notEqual(r.status,0,'swapped junction was followed');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+});
+test('R197 anchored native open refuses traversal syntax and root reparse',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const traversal=probe(f.root,'../outside/x.bin');
+ assert.notEqual(traversal.status,0);
+ assert.match(traversal.stderr,/invalid_segment/);
+ await symlink(f.root,path.join(f.scratch,'root-link'),'junction');
+ const reparseRoot=probe(path.join(f.scratch,'root-link'),'sub/x.bin');
+ assert.notEqual(reparseRoot.status,0);
+ assert.match(reparseRoot.stderr,/root_reparse_or_unverified/);
+});

package/test/r198-root-identity.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import cp from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,rm,writeFile,lstat} from 'node:fs/promises';
+import {syncBuiltinESMExports} from 'node:module';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+import {createMachineFsRuntime} from '../src/machine-fs.mjs';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+const exe=fileURLToPath(new URL('../bin/deadbyte-fs-read-r198.exe',import.meta.url));
+const digest=b=>createHash('sha256').update(b).digest('hex');
+const pinned='4325ae4f033bba195b34d2c49b48493a1a468f3443e369a9bb887a7a129eac16';
+const filename='leaf.bin';
+async function fixture(t){
+ const scratch=await mkdtemp(path.join(tmpdir(),'deadbyte-r198-root-'));
+ t.after(()=>rm(scratch,{force:true,recursive:true}));
+ const root=path.join(scratch,'allowed'),data=Buffer.from('R198-ALLOWED-DATA');
+ await mkdir(root);
+ await writeFile(path.join(root,filename),data);
+ const policyPath=path.join(scratch,'policy.json');
+ await writeFile(policyPath,JSON.stringify({
+  schema:'deadbyte.coding-policy.v1',enabled:true,
+  lease_file:path.join(scratch,'grant.json'),evidence_dir:path.join(scratch,'evidence'),
+  roots:{project:{path:root,read:true,write:false,exec:false,deny_paths:[]}},
+  commands:{},max_read_bytes:65536,max_write_bytes:65536
+ }));
+ const policy=await loadCodingPolicy(policyPath);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(scratch,'private.pem'),publicKeyPath:path.join(scratch,'public.pem')});
+ return {scratch,root,data,runtime:createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath})};
+}
+function native(args){
+ assert.equal(digest(fs.readFileSync(exe)),pinned,'R198 native binary hash drift');
+ return cp.spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:10000});
+}
+test('R198 native accepts exactly the root directory object prechecked by caller',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t),info=await lstat(f.root,{bigint:true});
+ const result=native([f.root,filename,'0','64','1',String(info.dev),String(info.ino)]);
+ assert.equal(result.status,0,result.stderr);
+ const response=JSON.parse(result.stdout);
+ assert.deepEqual(Buffer.from(response.data_base64,'base64'),f.data);
+ assert.equal(response.file_sha256,digest(f.data));
+});
+test('R198 native rejects a mismatched root identity BEFORE opening leaf',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t),info=await lstat(f.root,{bigint:true});
+ const result=native([f.root,filename,'0','64','1',String(info.dev),String(info.ino+1n)]);
+ assert.notEqual(result.status,0,'expected root identity did not gate native read');
+ assert.match(result.stderr,/root_identity_mismatch/);
+ assert.doesNotMatch(result.stdout,/data_base64|file_sha256/);
+});
+test('R198 runtime refuses root replacement after precheck before native open',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const external=path.join(f.scratch,'external');
+ await mkdir(external);
+ // Same file length, different bytes and object ID. Not a junction: this tests root identity.
+ await writeFile(path.join(external,filename),Buffer.from('R198-ESCAPED-DATA'));
+ assert.equal(fs.statSync(path.join(external,filename)).size,f.data.length);
+ const original=cp.spawn;
+ let swaps=0;
+ cp.spawn=(command,args,opts)=>{
+  if(path.basename(String(command)).toLowerCase()==='deadbyte-fs-read-r198.exe'){
+   swaps++;
+   fs.renameSync(f.root,path.join(f.scratch,'original-root'));
+   fs.renameSync(external,f.root);
+  }
+  return original(command,args,opts);
+ };
+ syncBuiltinESMExports();
+ try{
+  await assert.rejects(f.runtime.read({rootId:'project',relativePath:filename,offset:0,
+   maxBytes:64,hashFile:true,timeoutMs:5000}),/root_identity_mismatch/);
+ }finally{cp.spawn=original;syncBuiltinESMExports();}
+ assert.equal(swaps,1,'root was not actually exchanged after precheck');
+});
+test('R198 ordinary runtime read remains operational with root pinned',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const result=await f.runtime.read({rootId:'project',relativePath:filename,maxBytes:64,hashFile:true});
+ assert.deepEqual(Buffer.from(result.data_base64,'base64'),f.data);
+ assert.equal(result.file_sha256,digest(f.data));
+});

package/test/r199-native-uia-worker.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-desktop-uia-r199-fixed.exe',import.meta.url));
+const pinned='583f5a2cdddb8640586d13c0066de4f872af543b467078b2e75a466092421972';
+const sha=v=>createHash('sha256').update(v).digest('hex');
+function run(args,options={}){
+ assert.equal(sha(readFileSync(exe)),pinned,'R199 native UIA executable changed');
+ return spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:10000,maxBuffer:500000,...options});
+}
+test('R199 native UIA worker pinned binary completes bounded selftest',t=>{
+ if(process.platform!=='win32')return t.skip('Windows only');
+ const r=run(['--selftest']);
+ assert.equal(r.status,0,r.stderr);
+ assert.deepEqual(JSON.parse(r.stdout),{schema:'deadbyte.desktop-uia-selftest.v1',status:'passed'});
+});
+test('R199 native UIA worker refuses malformed protocol before COM query',t=>{
+ if(process.platform!=='win32')return t.skip('Windows only');
+ for(const bad of ['', 'BAD_MAGIC\n', 'DEADBYTE_DESKTOP_UIA_V1\nexpected_hwnd=0x1\n']){
+  const r=run([],{input:bad});
+  assert.notEqual(r.status,0);
+  assert.match(r.stderr,/deadbyte-desktop-uia:/);
+  assert.equal(r.stdout,'');
+ }
+});

package/test/r199-uia-identity.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {bindUiaElementR199,assertFreshUiaElementR199,normalizeUiaRuntimeIdR199} from '../src/desktop-uia-identity-r199.mjs';
+
+const H=x=>createHash('sha256').update(x).digest('hex');
+const frame={frame_id:H('frame'),desktop_epoch:H('epoch'),active_window:{hwnd:'0x1234',pid:42}};
+const q={kind:'name_exact',value:'SECRET SAVE',max_results:8,ordinal:0};
+const rect={left:20,top:30,width:90,height:40};
+function ground(id=[1,-20,3],overrides={}){
+ return {status:'ok',query_kind:q.kind,query_sha256:H('query'),ordinal:0,truncated:false,visited:5,
+   matches:[{runtime_id:id,control_type:50000,rect,enabled:true,offscreen:false}],...overrides};
+}
+const binding=()=>bindUiaElementR199({frame,grounded:ground(),candidate:ground().matches[0],query:q});
+
+test('R199 identity binding is ephemeral, bounded and has content-addressed token',()=>{
+ const b=binding();assert.equal(b.schema,'deadbyte.uia-element-binding-r199.v1');
+ assert.match(b.token_sha256,/^[0-9a-f]{64}$/);
+ assert.deepEqual(b.runtime_id,[1,-20,3]);
+ assert.ok(Object.isFrozen(b.runtime_id));assert.ok(Object.isFrozen(b.query));
+ assert.equal(JSON.stringify({token:b.token_sha256}).includes('SECRET'),false);
+});
+test('R199 exact native RuntimeId permits read-only revalidation',()=>{
+ const proof=assertFreshUiaElementR199(binding(),ground());
+ assert.equal(proof.verified,true);assert.match(proof.runtime_id_sha256,/^[0-9a-f]{64}$/);
+});
+test('R199 recreated element with identical rectangle is refused',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground([1,-20,4])),/element identity changed/);
+});
+test('R199 runtime identity refuses query drift and incomplete scan',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{query_sha256:H('other')})),/query identity/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{truncated:true})),/scan invalid or incomplete/);
+});
+test('R199 state, disappearance and rectangle changes must refuse mutation',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[]})),/stale target/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[{...ground().matches[0],enabled:false}]})),/control state changed/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[{...ground().matches[0],rect:{...rect,left:21}}]})),/rectangle changed/);
+});
+test('R199 runtime identity refuses forged or oversized numeric arrays',()=>{
+ for(const id of [[],[1.5],[2147483648],Array(65).fill(1),['1'],null]){
+  assert.throws(()=>normalizeUiaRuntimeIdR199(id),/RuntimeId/);
+ }
+});

package/test/r200-remote-reconcile.test.mjs

@@ -0,0 +1,106 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash,sign} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createRemoteDevicePlaneR44} from '../src/remote-device-r44.mjs';
+import {canonicalJson} from '../src/canonical-json.mjs';
+import {REMOTE_TERMINAL_DOMAIN,REMOTE_TERMINAL_EVIDENCE_SCHEMA} from '../src/remote-terminal-evidence-r200.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function fixture(t){
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r200-terminal-'));
+ t.after(()=>rm(dir,{recursive:true,force:true}));
+ const keys=generateKeyPairSync('ed25519');
+ const der=Buffer.from(keys.publicKey.export({type:'spki',format:'der'}));
+ const owner={id:sha(der),spki:der.toString('base64'),privateKey:keys.privateKey};
+ let requestCalls=0,lookupCalls=0,latestProof=null;
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(){requestCalls++;return null;},
+  async lookupTerminal(){lookupCalls++;return latestProof;}
+ };
+ const makePlane=()=>createRemoteDevicePlaneR44({stateDir:dir,relay,authorizeCapability:async()=>true,
+  relayTimeoutMs:1000,probeRetries:0,reachableTtlMs:10000});
+ const plane=await makePlane();
+ await plane.pair({publicKeySpkiBase64:owner.spki,displayName:'R200 fixture'});
+ await plane.reportOnline({deviceId:owner.id,epoch:1,connectionId:'r200-virtual'});
+ await plane.probe({deviceId:owner.id,epoch:1});
+ const req={deviceId:owner.id,epoch:1,capabilityId:'machine.fs.write',
+  payload:{path:'file.bin',data:'one'},requestId:'a'.repeat(64)};
+ const initial=await plane.dispatch(req);
+ assert.equal(initial.effect_state,'unknown');
+ const proofFor=(terminal,bodyOverrides={})=>{
+   const evidence={schema:REMOTE_TERMINAL_EVIDENCE_SCHEMA,
+    device_id:owner.id,epoch:1,request_id:req.requestId,
+    request_sha256:initial.request_sha256,capability_id:req.capabilityId,
+    terminal,...bodyOverrides};
+   const signature=sign(null,Buffer.concat([REMOTE_TERMINAL_DOMAIN,
+    Buffer.from(canonicalJson(evidence),'utf8')]),owner.privateKey).toString('base64');
+   return {evidence,attestation:{algorithm:'ed25519',key_id:owner.id,signature_base64:signature}};
+ };
+ return {plane,makePlane,owner,req,initial,relay,proofFor,
+  setProof:p=>latestProof=p,
+  calls:()=>({requestCalls,lookupCalls})};
+}
+test('R200 signed terminal reconciles a lost ACK without sending mutation again',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'completed',result_sha256:'b'.repeat(64)}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.state,'completed');assert.equal(r.effect_state,'confirmed');
+ assert.equal(r.transport_state,'reconciled');
+ assert.equal(r.reconciliation_state,'signed_terminal');
+ assert.match(r.terminal_evidence_sha256,/^[0-9a-f]{64}$/);
+ assert.deepEqual(f.calls(),{requestCalls:1,lookupCalls:1});
+ const restarted=await f.makePlane();
+ const again=await restarted.dispatch(f.req);
+ assert.equal(again.replay,true);assert.equal(again.effect_state,'confirmed');
+ assert.deepEqual(f.calls(),{requestCalls:1,lookupCalls:1},'no duplicate remote mutation');
+});
+test('R200 unavailable signed journal entry remains UNKNOWN and cannot be called success',async t=>{
+ const f=await fixture(t);
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.reconciliation,'unresolved');
+ assert.equal(r.effect_state,'unknown');
+ assert.equal(f.calls().requestCalls,1);
+ const snap=(await f.plane.list()).requests[f.req.requestId];
+ assert.equal(snap.effect_state,'unknown');assert.equal(snap.transport_state,'ack_missing');
+});
+test('R200 invalid Ed25519 and mismatched request hashes never alter original outcome',async t=>{
+ const f=await fixture(t);
+ const proper=f.proofFor({status:'completed',result_sha256:'d'.repeat(64)});
+ proper.evidence.terminal.result_sha256='e'.repeat(64);
+ f.setProof(proper);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/signature invalid/);
+ const wrong=f.proofFor({status:'completed',result_sha256:'d'.repeat(64)},
+  {request_sha256:'f'.repeat(64)});
+ f.setProof(wrong);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/request hash mismatch/);
+ assert.equal((await f.plane.list()).requests[f.req.requestId].effect_state,'unknown');
+ assert.equal(f.calls().requestCalls,1);
+});
+test('R200 signed failure with unresolved side effects stays UNKNOWN',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'failed',error_code:'process_exit',effect_state:'unknown'}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.state,'failed');assert.equal(r.effect_state,'unknown');
+ assert.equal(r.reconciliation_state,'signed_terminal_effect_unknown');
+ assert.equal(r.transport_state,'reconciled');
+});
+test('R200 signed not_started failure is a terminal failed effect',async t=>{
+ const f=await fixture(t);
+ f.setProof(f.proofFor({status:'failed',error_code:'rejected_before_dispatch',effect_state:'not_started'}));
+ const r=await f.plane.reconcile({requestId:f.req.requestId});
+ assert.equal(r.effect_state,'failed');
+ assert.equal(r.reconciliation_state,'signed_terminal');
+ assert.equal(r.error_code,'rejected_before_dispatch');
+});
+test('R200 malformed terminal envelope and unexpected fields fail closed',async t=>{
+ const f=await fixture(t);
+ const proof=f.proofFor({status:'completed',result_sha256:'c'.repeat(64)});
+ proof.evidence.untrusted_internal=true;
+ f.setProof(proof);
+ await assert.rejects(f.plane.reconcile({requestId:f.req.requestId}),/unexpected or missing fields/);
+ assert.equal((await f.plane.list()).requests[f.req.requestId].effect_state,'unknown');
+});

package/test/r201-payload-boundary.test.mjs

@@ -0,0 +1,78 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createRemoteDevicePlaneR44,payloadHash} from '../src/remote-device-r44.mjs';
+
+const hash=b=>createHash('sha256').update(b).digest('hex');
+const context={deviceId:'a'.repeat(64),epoch:1,capabilityId:'machine.fs.write'};
+const digest=payload=>payloadHash({...context,payload});
+
+test('R201 remote canonical payload rejects non-finite numbers rather than aliasing null',()=>{
+  assert.throws(()=>digest({n:NaN}),/remote payload/i);
+  assert.throws(()=>digest({n:Infinity}),/remote payload/i);
+  assert.throws(()=>digest({n:-Infinity}),/remote payload/i);
+  assert.notEqual(digest({n:null}),digest({n:0}));
+});
+test('R201 remote canonical payload rejects undefined, sparse arrays and unsupported values',()=>{
+  assert.throws(()=>digest({n:undefined}),/remote payload/i);
+  assert.throws(()=>digest({n:()=>{}}),/remote payload/i);
+  assert.throws(()=>digest({n:Symbol('x')}),/remote payload/i);
+  assert.throws(()=>digest({n:1n}),/remote payload/i);
+  assert.throws(()=>digest({a:[,]}),/remote payload/i);
+  assert.throws(()=>digest({a:new Date(0)}),/remote payload/i);
+  assert.throws(()=>digest({a:new Map()}),/remote payload/i);
+});
+test('R201 remote canonical payload rejects getters, toJSON hooks, cycles before evaluation',()=>{
+  let getters=0,serializers=0;
+  const tricky={};Object.defineProperty(tricky,'x',{enumerable:true,get(){getters++;return 1;}});
+  assert.throws(()=>digest(tricky),/remote payload/i);
+  assert.equal(getters,0,'untrusted getter ran inside remote request hashing');
+  const hook={toJSON(){serializers++;return {x:1};}};
+  assert.throws(()=>digest({hook}),/remote payload/i);
+  assert.equal(serializers,0,'untrusted toJSON ran inside remote request hashing');
+  const cycle={};cycle.loop=cycle;
+  assert.throws(()=>digest(cycle),/remote payload/i);
+});
+test('R201 remote canonical payload enforces depth, byte and node budgets',()=>{
+  let deeply={end:true};for(let i=0;i<45;i++)deeply={child:deeply};
+  assert.throws(()=>digest(deeply),/remote payload/i);
+  assert.throws(()=>digest({string:'z'.repeat(1024*1024+1)}),/remote payload/i);
+  assert.throws(()=>digest({array:Array.from({length:4100},(_,i)=>i)}),/remote payload/i);
+});
+test('R201 plain JSON payload stays order-stable and distinguishes nested contents',()=>{
+  assert.equal(digest({a:1,b:{x:true,y:[1,null,'ok']}}),digest({b:{y:[1,null,'ok'],x:true},a:1}));
+  assert.notEqual(digest({a:1}),digest({a:2}));
+});
+test('R201 caller mutation during async authorization cannot alter payload sent to relay',async t=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r201-payload-'));
+  t.after(()=>rm(dir,{recursive:true,force:true}));
+  const {publicKey}=generateKeyPairSync('ed25519');
+  const der=Buffer.from(publicKey.export({type:'spki',format:'der'}));
+  const id=hash(der),seen=[];
+  let entered,release;
+  const atAuth=new Promise(resolve=>entered=resolve);
+  const gate=new Promise(resolve=>release=resolve);
+  const relay={
+    async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+    async request(x){seen.push(structuredClone(x));return {ack:'accepted',request_id:x.request_id,terminal:{status:'completed',result_sha256:'b'.repeat(64)}};}
+  };
+  const plane=await createRemoteDevicePlaneR44({stateDir:dir,relay,authorizeCapability:async()=>{entered();await gate;return true;},probeRetries:0,reachableTtlMs:10000});
+  await plane.pair({publicKeySpkiBase64:der.toString('base64'),displayName:'R201 fake'});
+  await plane.reportOnline({deviceId:id,epoch:1,connectionId:'fixture'});
+  await plane.probe({deviceId:id,epoch:1});
+  const payload={path:'allowed.txt',nested:{value:'old'}};
+  const req={deviceId:id,epoch:1,capabilityId:'machine.fs.write',payload,requestId:'c'.repeat(64)};
+  const expectedHash=payloadHash({deviceId:id,epoch:1,capabilityId:'machine.fs.write',payload});
+  const resultPromise=plane.dispatch(req);
+  await atAuth;
+  payload.path='other.txt';payload.nested.value='new';
+  release();
+  const result=await resultPromise;
+  assert.equal(result.request_sha256,expectedHash);
+  assert.equal(seen.length,1);
+  assert.deepEqual(seen[0].payload,{path:'allowed.txt',nested:{value:'old'}});
+  assert.equal(result.state,'completed');
+});

package/test/r201-payload-fuzz.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {payloadHash} from '../src/remote-device-r44.mjs';
+
+const ctx={deviceId:'b'.repeat(64),epoch:1,capabilityId:'coding.file_write'};
+const hash=payload=>payloadHash({...ctx,payload});
+test('R201 symbol keys, negative zero and unsafe integers are rejected at the typed boundary',()=>{
+ const withSymbol={x:1};withSymbol[Symbol('shadow')]=42;
+ assert.throws(()=>hash(withSymbol),/remote payload/i);
+ assert.throws(()=>hash({offset:-0}),/remote payload/i);
+ assert.throws(()=>hash({offset:Number.MAX_SAFE_INTEGER+1}),/remote payload/i);
+});
+test('R201 deterministic malformed-boundary corpus is fully rejected',()=>{
+ const cases=[
+  Object.create({inherited:true}),
+  {x:NaN},{x:Infinity},{x:undefined},{x:()=>0},{x:1n},{x:Symbol('x')},
+  {x:new Date(0)},{x:new Uint8Array([1])},{x:new Map([[1,1]])},
+  {x:[]},{x:[,1]},{x:[1,,2]},{x:Array(4097).fill(1)},
+  {x:{constructor:0}},{x:{prototype:0}},{x:{toJSON:0}},
+  {x:{get y(){throw Error('must not execute')}}}
+ ];
+ // A dense array is legal; all other fixture values must be invalid.
+ for(let i=0;i<cases.length;i++){
+  if(i===10)continue;
+  assert.throws(()=>hash(cases[i]),/remote payload/i,'case '+i);
+ }
+});
+test('R201 seeded valid JSON corpus is deterministic independent of key ordering',()=>{
+ let seed=0x6db201;const rand=()=>{seed^=seed<<13;seed^=seed>>>17;seed^=seed<<5;return seed>>>0;};
+ for(let i=0;i<200;i++){
+  const n=rand()%100000,flag=(rand()&1)!==0,word='v'+(rand()%9999);
+  const a={left:n,right:{enabled:flag,name:word,items:[0,1,null,'ok']}};
+  const b={right:{items:[0,1,null,'ok'],name:word,enabled:flag},left:n};
+  assert.equal(hash(a),hash(b),'semantic hash mismatch case '+i);
+  assert.notEqual(hash(a),hash({...a,left:n+1}),'hash collision case '+i);
+ }
+});

package/test/r201-tool-boundary-fuzz.test.mjs

@@ -0,0 +1,120 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {registerDesktopTools} from '../src/desktop-mcp-tools-r40.mjs';
+import {registerMachineFsTools} from '../src/machine-fs-mcp-tools.mjs';
+import {registerProcessTools} from '../src/process-mcp-tools.mjs';
+
+const H=c=>c.repeat(64);
+const frame=H('a'),intent=H('b'),session=H('c'),digest=H('d');
+class FakeServer{
+ constructor(){this.tools=new Map();}
+ registerTool(name,definition,handler){
+   assert.equal(this.tools.has(name),false,'duplicate tool '+name);
+   this.tools.set(name,{schema:definition.inputSchema,handler});
+ }
+}
+const server=new FakeServer();
+const runtime=new Proxy({}, {get(_,field){return ()=>{throw new Error('R201_PROVIDER_MUST_NOT_BE_CALLED '+String(field));};}});
+registerDesktopTools(server,{runtime});
+registerMachineFsTools(server,{runtime});
+registerProcessTools(server,{runtime});
+
+const fixtures={
+ desktop_status:{},desktop_observe:{preview:false},
+ desktop_wait:{baseline_frame_id:frame,until:'frame_changed'},
+ desktop_target:{frame_id:frame,uia_query:{kind:'name_exact',value:'Save',ordinal:0,max_results:8}},
+ desktop_action:{intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:10,y:20}},
+ machine_fs_stat:{root_id:'projects',path:'.'},
+ machine_fs_list:{root_id:'projects',path:'.'},
+ machine_fs_read:{root_id:'projects',path:'test.bin',offset:0,max_bytes:32},
+ machine_fs_write:{root_id:'projects',path:'test.bin',content:'x',expected_sha256:'absent'},
+ machine_fs_edit_exact:{root_id:'projects',path:'test.bin',old_string:'x',new_string:'y',expected_sha256:digest},
+ machine_fs_mkdir:{root_id:'projects',path:'tmp-dir'},
+ machine_fs_move:{root_id:'projects',source_path:'old',destination_path:'new',expected_source_identity:digest},
+ machine_fs_delete:{root_id:'projects',path:'test.bin',expected_source_identity:digest},
+ process_session_start:{profile_id:'node',root_id:'projects'},
+ process_session_read:{session_id:session},
+ process_session_write:{session_id:session,input:'x'},
+ process_session_status:{session_id:session},
+ process_session_list:{},
+ process_session_cancel:{session_id:session},
+ process_session_terminate:{session_id:session},
+ process_session_action:{session_id:session,action_id:'ping'}
+};
+const reserved=[
+ '_internal','__internal','__proto__','constructor','prototype',
+ 'authority','grant','grant_token','policy_override','allow_unsafe',
+ 'exec','executable','shell','command','pid','process_id','host_root_id',
+ 'endpoint','network','capability_override','admin','on_behalf_of','proof'
+];
+function polluted(base,key,value){
+ const obj=Object.create(null);
+ for(const [k,v] of Object.entries(base))obj[k]=structuredClone(v);
+ obj[key]=value;
+ return obj;
+}
+test('R201 entire native tool catalog stays 21 strict schemas with valid defaults',()=>{
+ assert.deepEqual([...server.tools.keys()].sort(),Object.keys(fixtures).sort());
+ for(const [name,value] of Object.entries(fixtures)){
+  const parsed=server.tools.get(name).schema.safeParse(value);
+  assert.equal(parsed.success,true,name+' valid input was incorrectly rejected: '+JSON.stringify(parsed.error?.issues));
+ }
+});
+test('R201 deterministic reserved-field forgery corpus rejects before provider dispatch',()=>{
+ let rejected=0;
+ for(const [name,{schema}] of server.tools){
+  for(const k of reserved){
+   const forged=polluted(fixtures[name],k,k==='__proto__'?{isAdmin:true}:true);
+   const result=schema.safeParse(forged);
+   if(k==='__proto__'&&result.success){
+     // Some Zod versions safely discard this hostile own property rather
+     // than rejecting it. Sanitization must never leak to provider output.
+     assert.equal(Object.hasOwn(result.data,'__proto__'),false,name+' leaked __proto__');
+     assert.equal(Object.getPrototypeOf(result.data),Object.prototype,name+' changed parsed prototype');
+     assert.equal(({}).isAdmin,undefined,'global prototype was polluted');
+   }else{
+     assert.equal(result.success,false,name+' accepted forged key '+k);
+   }
+   rejected++;
+  }
+ }
+ assert.equal(rejected,21*reserved.length);
+});
+test('R201 malformed type corpus and unknown nested fields fail closed',()=>{
+ const invalidValues=[null,undefined,false,true,0,-1,1.5,'',[],[1],{},Object.create(null),Number.NaN,Infinity,-Infinity];
+ let covered=0;
+ for(const [name,{schema}] of server.tools){
+  const base=fixtures[name];
+  for(const field of Object.keys(base)){
+   for(const value of invalidValues){
+    const altered={...base,[field]:value};
+    const result=schema.safeParse(altered);
+    if(value===undefined || field==='preview')continue; // some schema defaults/boolean are intentional
+    if(result.success)continue; // schema-specific legitimate optionality, not a security failure
+    covered++;
+   }
+  }
+ }
+ assert.ok(covered>=400,'R201 malformed-input corpus insufficient '+covered);
+ const target=server.tools.get('desktop_target').schema;
+ assert.equal(target.safeParse({frame_id:frame,uia_query:{kind:'name_exact',value:'Save',__internal:true}}).success,false);
+ assert.equal(target.safeParse({frame_id:frame,rect:{left:1,top:1,width:10,height:10,admin:true},source:'visual',confidence:1}).success,false);
+ const action=server.tools.get('desktop_action').schema;
+ assert.equal(action.safeParse({intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:1,y:2,pid:123}}).success,false);
+ assert.equal(action.safeParse({intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'hello\0world'}).success,false);
+});
+test('R201 incomplete or wrong authority preconditions cannot be normalized into valid mutations',()=>{
+ const checks=[
+  ['machine_fs_write',{root_id:'projects',path:'x',content:'y'}],
+  ['machine_fs_delete',{root_id:'projects',path:'x'}],
+  ['machine_fs_move',{root_id:'projects',source_path:'a',destination_path:'b'}],
+  ['machine_fs_edit_exact',{root_id:'projects',path:'x',expected_sha256:'absent',old_string:'a',new_string:'b'}],
+  ['desktop_action',{intent_id:intent,kind:'click_primary',expected_frame_id:frame}],
+  ['desktop_action',{intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'x',target_id:session}],
+  ['process_session_terminate',{pid:123}],
+  ['process_session_start',{profile_id:'node',root_id:'projects',executable:'cmd.exe'}]
+ ];
+ for(const [name,input] of checks){
+  assert.equal(server.tools.get(name).schema.safeParse(input).success,false,name+' bypass accepted');
+ }
+});