deadbyte-mcp 0.15.74 → 0.15.76

package/test/r196-desktop-postcondition.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {evaluateDesktopPostcondition,validateDesktopPostconditionExpectation} from '../src/desktop-postcondition-r196.mjs';
+
+const H=x=>createHash('sha256').update(String(x)).digest('hex');
+const frame=(id,img)=>Object.freeze({frame_id:H('frame-'+id),image_sha256:H(img)});
+const before=frame(1,'initial');
+const after=frame(2,'changed');
+
+test('R196 input delivery or changed pixels cannot silently confirm application effect',()=>{
+ const value=evaluateDesktopPostcondition({beforeFrame:before,afterFrame:after});
+ assert.equal(value.status,'unknown');
+ assert.equal(value.reason,'no_explicit_expectation');
+ assert.equal(value.kind,null);
+});
+
+test('R196 explicit fresh expected image can satisfy an observable postcondition',()=>{
+ const expectation={kind:'frame_image_sha256',expected_sha256:after.image_sha256};
+ const result=evaluateDesktopPostcondition({beforeFrame:before,afterFrame:after,expectation});
+ assert.equal(result.status,'satisfied');
+ assert.equal(result.reason,'exact_post_image_observed');
+ assert.equal(result.expected_sha256,after.image_sha256);
+ assert.equal(result.after_frame_id,after.frame_id);
+});
+
+test('R196 desired postcondition absent after input is unsatisfied',()=>{
+ const expected=frame(3,'desired').image_sha256;
+ const result=evaluateDesktopPostcondition({beforeFrame:before,afterFrame:after,
+  expectation:{kind:'frame_image_sha256',expected_sha256:expected}});
+ assert.equal(result.status,'unsatisfied');
+ assert.equal(result.reason,'post_image_differs_from_expected');
+});
+
+test('R196 pre-existing expected state cannot prove input caused an effect',()=>{
+ const result=evaluateDesktopPostcondition({beforeFrame:before,afterFrame:after,
+  expectation:{kind:'frame_image_sha256',expected_sha256:before.image_sha256}});
+ assert.equal(result.status,'unknown');
+ assert.equal(result.reason,'expected_state_already_present_before_action');
+});
+
+test('R196 forged or unsupported postcondition must be rejected before injection',()=>{
+ for(const value of [
+  {},{kind:'file_sha256',expected_sha256:H('anything')},
+  {kind:'frame_image_sha256',expected_sha256:'bogus'},
+  {kind:'frame_image_sha256',expected_sha256:H('valid'),_internal:true}
+ ])assert.throws(()=>validateDesktopPostconditionExpectation(value),/unsupported/);
+});
+
+test('R196 invalid frames never produce a satisfied or unknown false evidence result',()=>{
+ assert.throws(()=>evaluateDesktopPostcondition({beforeFrame:{},afterFrame:after,
+  expectation:{kind:'frame_image_sha256',expected_sha256:after.image_sha256}}),/frames invalid/);
+});

package/test/r196-handle-bound-read.test.mjs

@@ -0,0 +1,99 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm,open,rename,lstat} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {syncBuiltinESMExports} from 'node:module';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+import {createMachineFsRuntime} from '../src/machine-fs.mjs';
+import {readRangeFromHandle} from '../src/machine-fs-handle-read-r196.mjs';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function fixture(t){
+ const root=await mkdtemp(path.join(tmpdir(),'deadbyte-r196-fd-'));
+ t.after(()=>rm(root,{recursive:true,force:true}));
+ const project=path.join(root,'project');await mkdir(project);
+ const policyPath=path.join(root,'policy.json');
+ await writeFile(policyPath,JSON.stringify({
+  schema:'deadbyte.coding-policy.v1',enabled:true,
+  lease_file:path.join(root,'grant.json'),evidence_dir:path.join(root,'evidence'),
+  roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},
+  commands:{},max_read_bytes:4194304,max_write_bytes:65536
+ }));
+ const policy=await loadCodingPolicy(policyPath);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+ return {root,project,runtime:createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath})};
+}
+
+test('R196 read hash must not reopen path after reading different bytes',async t=>{
+ const f=await fixture(t),a=Buffer.from('original-fd-a'),b=Buffer.from('alternate-path-b');
+ await writeFile(path.join(f.project,'source.bin'),a);
+ await writeFile(path.join(f.project,'alternate.bin'),b);
+ const original=fs.createReadStream;
+ let calls=0;
+ fs.createReadStream=(_p,opts)=>{calls++;return original(path.join(f.project,'alternate.bin'),opts)};
+ syncBuiltinESMExports();
+ try{
+  const r=await f.runtime.read({rootId:'project',relativePath:'source.bin',offset:0,maxBytes:64,hashFile:true});
+  assert.deepEqual(Buffer.from(r.data_base64,'base64'),a,'range reads source bytes');
+  assert.equal(r.file_sha256,sha(a),'digest must belong to the same file object as returned data');
+  assert.equal(calls,0,'hash must not reopen a pathname through createReadStream');
+ }finally{
+  fs.createReadStream=original;syncBuiltinESMExports();
+ }
+});
+
+test('R196 standalone worker returns digest and bytes from source file',async t=>{
+ const f=await fixture(t),a=Buffer.from('worker-fd-identity\0\x01');
+ const p=path.join(f.project,'worker.bin');await writeFile(p,a);
+ const script=fileURLToPath(new URL('../src/machine-fs-read-worker.mjs',import.meta.url));
+ const run=spawnSync(process.execPath,[script,p,'0','32','1'],{encoding:'utf8',windowsHide:true,timeout:10000,shell:false});
+ assert.equal(run.status,0,run.stderr);
+ const v=JSON.parse(run.stdout);
+ assert.equal(v.schema,'deadbyte.machine-fs-read-worker.v1');
+ assert.deepEqual(Buffer.from(v.data_base64,'base64'),a);
+ assert.equal(v.file_sha256,sha(a));
+});
+
+test('R196 retained FileHandle survives same-size pathname replacement',async t=>{
+ const f=await fixture(t);
+ const name=path.join(f.project,'mutable.bin'),oldName=path.join(f.project,'old.bin'),replacement=path.join(f.project,'replacement.bin');
+ const a=Buffer.from('AAAAAAAA-ORIGINAL'),b=Buffer.from('BBBBBBBB-REPLACED');
+ assert.equal(a.length,b.length);
+ await writeFile(name,a);await writeFile(replacement,b);
+ const handle=await open(name,'r');
+ try{
+  const opened=await handle.stat({bigint:true});
+  await rename(name,oldName);
+  await rename(replacement,name);
+  const current=await lstat(name,{bigint:true});
+  assert.notEqual(opened.ino,current.ino,'test fixture did not replace the file object');
+  const v=await readRangeFromHandle(handle,{offset:0,length:32,hashFile:true});
+  assert.deepEqual(Buffer.from(v.data_base64,'base64'),a);
+  assert.equal(v.file_sha256,sha(a));
+  assert.equal(v.file_ino,String(opened.ino));
+ }finally{await handle.close()}
+});
+
+test('R196 in-place mutation between range and hash refuses mixed file epoch',async t=>{
+ const f=await fixture(t);
+ const file=path.join(f.project,'inplace.bin');
+ await writeFile(file,Buffer.from('old'));
+ const handle=await open(file,'r');
+ const proto=Object.getPrototypeOf(handle),original=proto.createReadStream;
+ let attempted=false;
+ proto.createReadStream=function(options){
+  attempted=true;
+  fs.writeFileSync(file,Buffer.from('new-bytes-with-different-size'));
+  return original.call(this,options);
+ };
+ try{
+  await assert.rejects(()=>readRangeFromHandle(handle,{offset:0,length:3,hashFile:true}),/opened file changed during read\/hash/);
+  assert.equal(attempted,true);
+ }finally{proto.createReadStream=original;await handle.close()}
+});

package/test/r196-remote-outcome.test.mjs

@@ -0,0 +1,94 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createRemoteDevicePlaneR44} from '../src/remote-device-r44.mjs';
+
+const hash=b=>createHash('sha256').update(b).digest('hex');
+function key(){
+ const {publicKey}=generateKeyPairSync('ed25519');
+ const der=Buffer.from(publicKey.export({type:'spki',format:'der'}));
+ return {id:hash(der),spki:der.toString('base64')};
+}
+async function fixture(t,relay,{timeoutMs=2000}={}){
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r196-remote-'));
+ t.after(()=>rm(dir,{recursive:true,force:true}));
+ const owner=key();
+ const factory=()=>createRemoteDevicePlaneR44({stateDir:dir,relay,authorizeCapability:async()=>true,
+  relayTimeoutMs:timeoutMs,probeRetries:0,reachableTtlMs:5000});
+ const plane=await factory();
+ await plane.pair({publicKeySpkiBase64:owner.spki,displayName:'R196'});
+ await plane.reportOnline({deviceId:owner.id,epoch:1,connectionId:'r196-disarmed'});
+ await plane.probe({deviceId:owner.id,epoch:1});
+ return {owner,plane,factory};
+}
+const req=(owner,id)=>({deviceId:owner.id,epoch:1,capabilityId:'machine.fs.write',payload:{file:'safe.txt',content:'one'},requestId:id.repeat(64)});
+
+test('R196 concurrent identical request ID has only one relay side effect',async t=>{
+ let release,started;
+ const entered=new Promise(resolve=>started=resolve);
+ const gate=new Promise(resolve=>release=resolve);
+ let effects=0;
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(x){effects++;started();await gate;return {ack:'accepted',request_id:x.request_id,terminal:{status:'completed',result_sha256:'a'.repeat(64)}};}
+ };
+ const {owner,plane}=await fixture(t,relay);
+ const one=plane.dispatch(req(owner,'1'));
+ const two=plane.dispatch(req(owner,'1'));
+ await entered;
+ await new Promise(resolve=>setTimeout(resolve,20));
+ release();
+ const [first,replay]=await Promise.all([one,two]);
+ assert.equal(effects,1,'duplicate side effect for concurrent same-ID dispatch');
+ assert.equal(first.state,'completed');
+ assert.equal(first.effect_state,'confirmed');
+ assert.equal(first.transport_state,'terminal_received');
+ assert.equal(replay.replay,true);
+ assert.equal(replay.request_sha256,first.request_sha256);
+});
+
+test('R196 lost reply after committed remote effect is UNKNOWN not a confirmed operation failure',async t=>{
+ let effects=0;
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(){effects++;return await new Promise(()=>{});}
+ };
+ const {owner,plane,factory}=await fixture(t,relay,{timeoutMs:100});
+ const args=req(owner,'2');
+ const result=await plane.dispatch(args);
+ assert.equal(result.state,'failed','legacy transport failure label remains for compatibility');
+ assert.equal(result.error_code,'transport_error');
+ assert.equal(result.transport_state,'timed_out');
+ assert.equal(result.effect_state,'unknown','transport timeout cannot prove no remote mutation');
+ assert.equal(effects,1);
+ const restarted=await factory();
+ const second=await restarted.dispatch(args);
+ assert.equal(second.replay,true);
+ assert.equal(second.effect_state,'unknown');
+ assert.equal(effects,1,'restart must never reexecute accepted unknown-outcome mutation');
+});
+
+test('R196 explicit missing ACK and terminal ACK preserve independent transport/effect facts',async t=>{
+ const relay={
+  async probe(x){return {device_id:x.device_id,epoch:x.epoch,nonce:x.nonce,ready:true};},
+  async request(){return null;}
+ };
+ const {owner,plane}=await fixture(t,relay);
+ const noAck=await plane.dispatch(req(owner,'3'));
+ assert.equal(noAck.error_code,'transport_no_ack');
+ assert.equal(noAck.transport_state,'ack_missing');
+ assert.equal(noAck.effect_state,'unknown');
+ relay.request=async x=>({ack:'accepted',request_id:x.request_id});
+ const noTerminal=await plane.dispatch(req(owner,'4'));
+ assert.equal(noTerminal.error_code,'transport_no_terminal');
+ assert.equal(noTerminal.transport_state,'acknowledged');
+ assert.equal(noTerminal.effect_state,'unknown');
+ relay.request=async x=>({ack:'accepted',request_id:x.request_id,terminal:{status:'completed',result_sha256:'b'.repeat(64)}});
+ const complete=await plane.dispatch(req(owner,'5'));
+ assert.equal(complete.transport_state,'terminal_received');
+ assert.equal(complete.effect_state,'confirmed');
+ assert.equal(complete.state,'completed');
+});

package/test/r197-namespace-race.test.mjs

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,writeFile,readFile,rm,lstat} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+import {createMachineFsRuntime} from '../src/machine-fs.mjs';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+test('R197 legacy injectable pathname worker demonstrates escaped open but parent rejects data',async t=>{
+ if(process.platform!=='win32')return t.skip('native Windows reparse fixture');
+ const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r197-namespace-'));
+ t.after(()=>rm(scratch,{recursive:true,force:true}));
+ const project=path.join(scratch,'project'),external=path.join(scratch,'external');
+ await mkdir(project);await mkdir(external);await mkdir(path.join(project,'mutable'));
+ await writeFile(path.join(project,'mutable','sample.bin'),'INSIDE-1234');
+ await writeFile(path.join(external,'sample.bin'),'OUTSIDE-123');
+ const policyFile=path.join(scratch,'policy.json');
+ await writeFile(policyFile,JSON.stringify({
+  schema:'deadbyte.coding-policy.v1',enabled:true,
+  lease_file:path.join(scratch,'grant.json'),evidence_dir:path.join(scratch,'evidence'),
+  roots:{project:{path:project,read:true,write:false,exec:false,deny_paths:[]}},
+  commands:{},max_read_bytes:65536,max_write_bytes:65536
+ }));
+ const policy=await loadCodingPolicy(policyFile);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(scratch,'private.pem'),publicKeyPath:path.join(scratch,'public.pem')});
+ const worker=fileURLToPath(new URL('./fixtures/r197-junction-swap-worker.mjs',import.meta.url));
+ const runtime=createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,
+  verifyKeyPath:keys.publicKeyPath,readWorkerPath:worker});
+ let outcome;
+ try{outcome=await runtime.read({rootId:'project',relativePath:'mutable/sample.bin',offset:0,maxBytes:32,hashFile:true,timeoutMs:5000});}
+ catch(e){outcome={error:String(e?.message??e)}}
+ const marker=path.join(scratch,'r197-worker-entered.marker');
+ await lstat(marker); // Proves an actual post-precheck execution point was reached.
+ const escaped=path.join(scratch,'r197-escaped-open.marker');
+ const observed=await lstat(escaped).then(()=>true,()=>false);
+ // This deliberately characterizes the old injected-worker path. It is NOT a secure reader proof.
+ assert.equal(observed,true,'R197 diagnostic fixture must demonstrate the legacy escaped open');
+ assert.equal(outcome.error!==undefined,true,'raced request must fail closed');
+});

package/test/r197-native-dispatch-race.test.mjs

@@ -0,0 +1,49 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import cp from 'node:child_process';
+import fs from 'node:fs';
+import {mkdtemp,mkdir,writeFile,rm,realpath} from 'node:fs/promises';
+import {syncBuiltinESMExports} from 'node:module';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+import {createMachineFsRuntime} from '../src/machine-fs.mjs';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+test('R197 default native read refuses a junction swapped after validation but before kernel open',async t=>{
+ if(process.platform!=='win32')return t.skip('Windows native test only');
+ const scratch=await mkdtemp(path.join(tmpdir(),'deadbyte-r197-native-race-'));
+ t.after(()=>rm(scratch,{recursive:true,force:true}));
+ const root=path.join(scratch,'project'),external=path.join(scratch,'external');
+ await mkdir(root);await mkdir(external);await mkdir(path.join(root,'mutable'));
+ await writeFile(path.join(root,'mutable','sample.bin'),'INSIDE-1234');
+ await writeFile(path.join(external,'sample.bin'),'OUTSIDE-123');
+ const file=path.join(scratch,'policy.json');
+ await writeFile(file,JSON.stringify({
+  schema:'deadbyte.coding-policy.v1',enabled:true,
+  lease_file:path.join(scratch,'grant.json'),evidence_dir:path.join(scratch,'evidence'),
+  roots:{project:{path:root,read:true,write:false,exec:false,deny_paths:[]}},
+  commands:{},max_read_bytes:65536,max_write_bytes:65536
+ }));
+ const policy=await loadCodingPolicy(file);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(scratch,'private.pem'),publicKeyPath:path.join(scratch,'public.pem')});
+ const runtime=createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+ const original=cp.spawn;
+ let intercepted=0;
+ cp.spawn=(command,args,options)=>{
+  if(path.basename(String(command)).toLowerCase()==='deadbyte-fs-read-r198.exe'){
+   intercepted++;
+   fs.renameSync(path.join(root,'mutable'),path.join(root,'mutable-original'));
+   fs.symlinkSync(external,path.join(root,'mutable'),'junction');
+  }
+  return original(command,args,options);
+ };
+ syncBuiltinESMExports();
+ try{
+  await assert.rejects(runtime.read({rootId:'project',relativePath:'mutable/sample.bin',
+   offset:0,maxBytes:32,hashFile:true,timeoutMs:5000}),/native root-relative read refused/);
+ }finally{cp.spawn=original;syncBuiltinESMExports();}
+ assert.equal(intercepted,1,'native operation was not reached after path precheck');
+ assert.equal((await realpath(path.join(root,'mutable','sample.bin'))).toLowerCase(),
+  path.join(external,'sample.bin').toLowerCase(),'fixture did not redirect the pathname outside root');
+});

package/test/r197-native-file-read.test.mjs

@@ -0,0 +1,60 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {mkdtemp,mkdir,rm,writeFile,lstat,rename,symlink} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-fs-read-r197-fixed.exe',import.meta.url));
+const pinned='7477ca3d94168c8b75711b734df5b9c20a43ecbd9338cfc234700d7e27982b63';
+const hash=b=>createHash('sha256').update(b).digest('hex');
+function native(root,rel,offset='0',length='64',whole='1'){
+ assert.equal(hash(readFileSync(exe)),pinned,'native executable hash drift');
+ return spawnSync(exe,[root,rel,offset,length,whole],{windowsHide:true,shell:false,encoding:'utf8',timeout:10000,maxBuffer:9*1024*1024});
+}
+async function fixture(t){
+ const tmp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r197-fsread-'));
+ t.after(()=>rm(tmp,{force:true,recursive:true}));
+ const root=path.join(tmp,'root'),outside=path.join(tmp,'outside');
+ await mkdir(root);await mkdir(outside);await mkdir(path.join(root,'inner'));
+ const bytes=Buffer.from('R197-allowed-data');
+ await writeFile(path.join(root,'inner','read.bin'),bytes);
+ await writeFile(path.join(outside,'read.bin'),'OUTSIDE-private-data');
+ return {tmp,root,outside,bytes};
+}
+test('R197 native reader returns bounded bytes/hash and exact opened file identity',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=native(f.root,'inner/read.bin');
+ assert.equal(r.status,0,r.stderr);
+ const data=JSON.parse(r.stdout),info=await lstat(path.join(f.root,'inner','read.bin'),{bigint:true});
+ assert.deepEqual(Buffer.from(data.data_base64,'base64'),f.bytes);
+ assert.equal(data.file_sha256,hash(f.bytes));
+ assert.equal(data.file_size,f.bytes.length);
+ assert.equal(data.file_dev,String(info.dev));
+ assert.equal(data.file_ino,String(info.ino));
+});
+test('R197 native refuses a replaced directory junction before reading external file',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await rename(path.join(f.root,'inner'),path.join(f.root,'old'));
+ await symlink(f.outside,path.join(f.root,'inner'),'junction');
+ const r=native(f.root,'inner/read.bin');
+ assert.notEqual(r.status,0,'outside file was opened');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+ assert.doesNotMatch(r.stdout,/OUTSIDE/);
+});
+test('R197 native bounded offset and un-hashed read',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=native(f.root,'inner/read.bin','5','4','0');
+ assert.equal(r.status,0,r.stderr);
+ const data=JSON.parse(r.stdout);
+ assert.equal(Buffer.from(data.data_base64,'base64').toString('utf8'),f.bytes.subarray(5,9).toString('utf8'));
+ assert.equal(data.file_sha256,null);
+ const invalid=native(f.root,'inner/read.bin','0','4194305','0');
+ assert.notEqual(invalid.status,0);
+ assert.match(invalid.stderr,/range_budget/);
+});

package/test/r197-native-root-open.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {mkdtemp,mkdir,rm,writeFile,rename,symlink} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-root-relative-probe-r197.exe',import.meta.url));
+const expected='7cd989bd396a2871d322e1a9bb02fdbc299614e89d59d9b03d03e92a77038fd1';
+function probe(root,rel){
+ const h=createHash('sha256').update(readFileSync(exe)).digest('hex');
+ assert.equal(h,expected,'native executable SHA-256 changed');
+ return spawnSync(exe,[root,rel],{windowsHide:true,shell:false,encoding:'utf8',timeout:5000,maxBuffer:100000});
+}
+async function fixture(t){
+ const scratch=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r197-native-'));
+ t.after(()=>rm(scratch,{recursive:true,force:true}));
+ const root=path.join(scratch,'root'),outside=path.join(scratch,'outside');
+ await mkdir(root);await mkdir(outside);
+ await mkdir(path.join(root,'sub'));
+ await writeFile(path.join(root,'sub','x.bin'),'root-data');
+ await writeFile(path.join(outside,'x.bin'),'secret-data');
+ return {scratch,root,outside};
+}
+test('R197 anchored native open accepts a regular in-root file',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const r=probe(f.root,'sub/x.bin');
+ assert.equal(r.status,0,r.stderr);
+ assert.match(r.stdout,/R197_NATIVE_HANDLE_RELATIVE_OPEN_PASS bytes=9 components=2/);
+});
+test('R197 anchored native open refuses existing junction before any content read',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await symlink(f.outside,path.join(f.root,'link'),'junction');
+ const r=probe(f.root,'link/x.bin');
+ assert.notEqual(r.status,0,'junction was followed');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+});
+test('R197 anchored native open refuses swapped directory junction after earlier nominal pathname',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ await rename(path.join(f.root,'sub'),path.join(f.root,'sub-old'));
+ await symlink(f.outside,path.join(f.root,'sub'),'junction');
+ const r=probe(f.root,'sub/x.bin');
+ assert.notEqual(r.status,0,'swapped junction was followed');
+ assert.match(r.stderr,/R197_NATIVE_REFUSE=/);
+});
+test('R197 anchored native open refuses traversal syntax and root reparse',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const traversal=probe(f.root,'../outside/x.bin');
+ assert.notEqual(traversal.status,0);
+ assert.match(traversal.stderr,/invalid_segment/);
+ await symlink(f.root,path.join(f.scratch,'root-link'),'junction');
+ const reparseRoot=probe(path.join(f.scratch,'root-link'),'sub/x.bin');
+ assert.notEqual(reparseRoot.status,0);
+ assert.match(reparseRoot.stderr,/root_reparse_or_unverified/);
+});

package/test/r198-root-identity.test.mjs

@@ -0,0 +1,88 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import cp from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,rm,writeFile,lstat} from 'node:fs/promises';
+import {syncBuiltinESMExports} from 'node:module';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {loadCodingPolicy} from '../src/coding-plane.mjs';
+import {createMachineFsRuntime} from '../src/machine-fs.mjs';
+import {generateTrustKeypair} from '../src/trust.mjs';
+
+const exe=fileURLToPath(new URL('../bin/deadbyte-fs-read-r198.exe',import.meta.url));
+const digest=b=>createHash('sha256').update(b).digest('hex');
+const pinned='4325ae4f033bba195b34d2c49b48493a1a468f3443e369a9bb887a7a129eac16';
+const filename='leaf.bin';
+async function fixture(t){
+ const scratch=await mkdtemp(path.join(tmpdir(),'deadbyte-r198-root-'));
+ t.after(()=>rm(scratch,{force:true,recursive:true}));
+ const root=path.join(scratch,'allowed'),data=Buffer.from('R198-ALLOWED-DATA');
+ await mkdir(root);
+ await writeFile(path.join(root,filename),data);
+ const policyPath=path.join(scratch,'policy.json');
+ await writeFile(policyPath,JSON.stringify({
+  schema:'deadbyte.coding-policy.v1',enabled:true,
+  lease_file:path.join(scratch,'grant.json'),evidence_dir:path.join(scratch,'evidence'),
+  roots:{project:{path:root,read:true,write:false,exec:false,deny_paths:[]}},
+  commands:{},max_read_bytes:65536,max_write_bytes:65536
+ }));
+ const policy=await loadCodingPolicy(policyPath);
+ const keys=await generateTrustKeypair({privateKeyPath:path.join(scratch,'private.pem'),publicKeyPath:path.join(scratch,'public.pem')});
+ return {scratch,root,data,runtime:createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath})};
+}
+function native(args){
+ assert.equal(digest(fs.readFileSync(exe)),pinned,'R198 native binary hash drift');
+ return cp.spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:10000});
+}
+test('R198 native accepts exactly the root directory object prechecked by caller',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t),info=await lstat(f.root,{bigint:true});
+ const result=native([f.root,filename,'0','64','1',String(info.dev),String(info.ino)]);
+ assert.equal(result.status,0,result.stderr);
+ const response=JSON.parse(result.stdout);
+ assert.deepEqual(Buffer.from(response.data_base64,'base64'),f.data);
+ assert.equal(response.file_sha256,digest(f.data));
+});
+test('R198 native rejects a mismatched root identity BEFORE opening leaf',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t),info=await lstat(f.root,{bigint:true});
+ const result=native([f.root,filename,'0','64','1',String(info.dev),String(info.ino+1n)]);
+ assert.notEqual(result.status,0,'expected root identity did not gate native read');
+ assert.match(result.stderr,/root_identity_mismatch/);
+ assert.doesNotMatch(result.stdout,/data_base64|file_sha256/);
+});
+test('R198 runtime refuses root replacement after precheck before native open',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const external=path.join(f.scratch,'external');
+ await mkdir(external);
+ // Same file length, different bytes and object ID. Not a junction: this tests root identity.
+ await writeFile(path.join(external,filename),Buffer.from('R198-ESCAPED-DATA'));
+ assert.equal(fs.statSync(path.join(external,filename)).size,f.data.length);
+ const original=cp.spawn;
+ let swaps=0;
+ cp.spawn=(command,args,opts)=>{
+  if(path.basename(String(command)).toLowerCase()==='deadbyte-fs-read-r198.exe'){
+   swaps++;
+   fs.renameSync(f.root,path.join(f.scratch,'original-root'));
+   fs.renameSync(external,f.root);
+  }
+  return original(command,args,opts);
+ };
+ syncBuiltinESMExports();
+ try{
+  await assert.rejects(f.runtime.read({rootId:'project',relativePath:filename,offset:0,
+   maxBytes:64,hashFile:true,timeoutMs:5000}),/root_identity_mismatch/);
+ }finally{cp.spawn=original;syncBuiltinESMExports();}
+ assert.equal(swaps,1,'root was not actually exchanged after precheck');
+});
+test('R198 ordinary runtime read remains operational with root pinned',async t=>{
+ if(process.platform!=='win32')return t.skip();
+ const f=await fixture(t);
+ const result=await f.runtime.read({rootId:'project',relativePath:filename,maxBytes:64,hashFile:true});
+ assert.deepEqual(Buffer.from(result.data_base64,'base64'),f.data);
+ assert.equal(result.file_sha256,digest(f.data));
+});

package/test/r199-native-uia-worker.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+const exe=fileURLToPath(new URL('../bin/deadbyte-desktop-uia-r199-fixed.exe',import.meta.url));
+const pinned='583f5a2cdddb8640586d13c0066de4f872af543b467078b2e75a466092421972';
+const sha=v=>createHash('sha256').update(v).digest('hex');
+function run(args,options={}){
+ assert.equal(sha(readFileSync(exe)),pinned,'R199 native UIA executable changed');
+ return spawnSync(exe,args,{windowsHide:true,shell:false,encoding:'utf8',timeout:10000,maxBuffer:500000,...options});
+}
+test('R199 native UIA worker pinned binary completes bounded selftest',t=>{
+ if(process.platform!=='win32')return t.skip('Windows only');
+ const r=run(['--selftest']);
+ assert.equal(r.status,0,r.stderr);
+ assert.deepEqual(JSON.parse(r.stdout),{schema:'deadbyte.desktop-uia-selftest.v1',status:'passed'});
+});
+test('R199 native UIA worker refuses malformed protocol before COM query',t=>{
+ if(process.platform!=='win32')return t.skip('Windows only');
+ for(const bad of ['', 'BAD_MAGIC\n', 'DEADBYTE_DESKTOP_UIA_V1\nexpected_hwnd=0x1\n']){
+  const r=run([],{input:bad});
+  assert.notEqual(r.status,0);
+  assert.match(r.stderr,/deadbyte-desktop-uia:/);
+  assert.equal(r.stdout,'');
+ }
+});

package/test/r199-uia-identity.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {bindUiaElementR199,assertFreshUiaElementR199,normalizeUiaRuntimeIdR199} from '../src/desktop-uia-identity-r199.mjs';
+
+const H=x=>createHash('sha256').update(x).digest('hex');
+const frame={frame_id:H('frame'),desktop_epoch:H('epoch'),active_window:{hwnd:'0x1234',pid:42}};
+const q={kind:'name_exact',value:'SECRET SAVE',max_results:8,ordinal:0};
+const rect={left:20,top:30,width:90,height:40};
+function ground(id=[1,-20,3],overrides={}){
+ return {status:'ok',query_kind:q.kind,query_sha256:H('query'),ordinal:0,truncated:false,visited:5,
+   matches:[{runtime_id:id,control_type:50000,rect,enabled:true,offscreen:false}],...overrides};
+}
+const binding=()=>bindUiaElementR199({frame,grounded:ground(),candidate:ground().matches[0],query:q});
+
+test('R199 identity binding is ephemeral, bounded and has content-addressed token',()=>{
+ const b=binding();assert.equal(b.schema,'deadbyte.uia-element-binding-r199.v1');
+ assert.match(b.token_sha256,/^[0-9a-f]{64}$/);
+ assert.deepEqual(b.runtime_id,[1,-20,3]);
+ assert.ok(Object.isFrozen(b.runtime_id));assert.ok(Object.isFrozen(b.query));
+ assert.equal(JSON.stringify({token:b.token_sha256}).includes('SECRET'),false);
+});
+test('R199 exact native RuntimeId permits read-only revalidation',()=>{
+ const proof=assertFreshUiaElementR199(binding(),ground());
+ assert.equal(proof.verified,true);assert.match(proof.runtime_id_sha256,/^[0-9a-f]{64}$/);
+});
+test('R199 recreated element with identical rectangle is refused',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground([1,-20,4])),/element identity changed/);
+});
+test('R199 runtime identity refuses query drift and incomplete scan',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{query_sha256:H('other')})),/query identity/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{truncated:true})),/scan invalid or incomplete/);
+});
+test('R199 state, disappearance and rectangle changes must refuse mutation',()=>{
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[]})),/stale target/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[{...ground().matches[0],enabled:false}]})),/control state changed/);
+ assert.throws(()=>assertFreshUiaElementR199(binding(),ground(undefined,{matches:[{...ground().matches[0],rect:{...rect,left:21}}]})),/rectangle changed/);
+});
+test('R199 runtime identity refuses forged or oversized numeric arrays',()=>{
+ for(const id of [[],[1.5],[2147483648],Array(65).fill(1),['1'],null]){
+  assert.throws(()=>normalizeUiaRuntimeIdR199(id),/RuntimeId/);
+ }
+});