deadbyte-mcp 0.15.8 → 0.15.9

package/DEADBYTE-MCP.cmd

@@ -0,0 +1,5 @@
+@echo off
+setlocal EnableExtensions DisableDelayedExpansion
+set "HERE=%~dp0"
+"%HERE%controller\DEADBYTE-MCP.cmd" %*
+exit /b %ERRORLEVEL%

package/README.txt

@@ -7,12 +7,12 @@ NPX PRIMARY OPERATOR UX
 ------------------------
 Use the npm CLI entry point instead of the legacy CMD convenience wrapper:
 
-  npx -y deadbyte-mcp@0.15.5 mcp
-  npx -y deadbyte-mcp@0.15.5 remote
-  npx -y deadbyte-mcp@0.15.5 remote status
-  npx -y deadbyte-mcp@0.15.5 remote restart
-  npx -y deadbyte-mcp@0.15.5 audit status
-  npx -y deadbyte-mcp@0.15.5 audit verify
+  npx -y deadbyte-mcp@0.15.9 mcp
+  npx -y deadbyte-mcp@0.15.9 remote
+  npx -y deadbyte-mcp@0.15.9 remote status
+  npx -y deadbyte-mcp@0.15.9 remote restart
+  npx -y deadbyte-mcp@0.15.9 audit status
+  npx -y deadbyte-mcp@0.15.9 audit verify
 
 The `mcp` command is the quiet stdio server entry for local MCP clients; stdout is reserved for MCP.
 The remote CLI invokes the stable active-release PowerShell launcher directly with shell=false.

package/RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schema": "deadbyte.release.v1",
   "name": "deadbyte-mcp",
-  "version": "0.15.8",
+  "version": "0.15.9",
   "train": "R46",
   "label": "FILELESS POWERSHELL PRODUCT BASELINE",
   "protocol_revision": "2026-07-28",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deadbyte-mcp",
-  "version": "0.15.8",
+  "version": "0.15.9",
   "private": false,
   "type": "module",
   "description": "Authenticated MCP agentic runtime with signed skills, persistent model backends, identity-bound remote devices, durable job supervision, immutable release slots, and separately revocable machine authority.",

package/src/skill-plane-r44.mjs

@@ -170,19 +170,24 @@ export async function createSkillPlane({root,verifyKeyPath}={}){
   async function list(){
     const names=(await readdir(rootReal)).sort((a,b)=>a.localeCompare(b,'en'));
     const skills=[];
+    const invalid_skills=[];
     for(const name of names){
       const full=path.join(rootReal,name);
       const st=await lstat(full);
       insist(st.isDirectory()&&!st.isSymbolicLink(),`skill registry contains non-directory entry: ${name}`);
-      const item=await verified(name);
-      skills.push({
-        name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
-        manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
-        authority_planes:item.authorityPlanes,resource_count:item.resources.length,provenance:item.body.provenance,verified:true
-      });
+      try{
+        const item=await verified(name);
+        skills.push({
+          name:item.body.name,version:item.body.version,description:item.body.description,audience:item.body.audience,
+          manifest_sha256:item.envelope.manifest_sha256,required_capabilities:item.requiredCapabilities,
+          authority_planes:item.authorityPlanes,resource_count:item.resources.length,provenance:item.body.provenance,verified:true
+        });
+      }catch(error){
+        invalid_skills.push({name,error:String(error),verified:false});
+      }
     }
     const registrySha=sha(Buffer.from(canonicalJson(skills.map(item=>({name:item.name,manifest_sha256:item.manifest_sha256}))),'utf8'));
-    return {status:'ok',skills,registry_sha256:registrySha,verify_key_id:keyId};
+    return {status:'ok',skills,invalid_skills,registry_sha256:registrySha,verify_key_id:keyId};
   }
   async function load({name}={}){
     const item=await verified(name);

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.8';
+export const DEADBYTE_VERSION = '0.15.9';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/cli-entrypoint.test.mjs

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
 const packagePath=path.join(root,'package.json');
@@ -21,7 +22,7 @@ test('npx CLI reports the canonical package version through --version, -v and ve
   for(const arg of ['--version','-v','version']){
     const result=spawnSync(process.execPath,[cliPath,arg],{cwd:root,encoding:'utf8',windowsHide:true});
     assert.equal(result.status,0,result.stderr);
-    assert.equal(result.stdout.trim(),'0.15.5');
+    assert.equal(result.stdout.trim(),DEADBYTE_VERSION);
   }
 });
 
@@ -50,6 +51,6 @@ test('npx CLI exposes local supervisor lifecycle without any supervisor arm comm
 
 test('README makes npx the primary operator UX',async()=>{
   const readme=await readFile(path.join(root,'README.txt'),'utf8');
-  assert.match(readme,/npx -y deadbyte-mcp@0\.15\.5 remote/);
-  assert.match(readme,/npx -y deadbyte-mcp@0\.15\.5 audit verify/);
+  assert.match(readme,new RegExp(`npx -y deadbyte-mcp@${DEADBYTE_VERSION.replace(/\./g,'\\.')} remote`));
+  assert.match(readme,new RegExp(`npx -y deadbyte-mcp@${DEADBYTE_VERSION.replace(/\./g,'\\.')} audit verify`));
 });

package/test/core.test.mjs

@@ -14,6 +14,7 @@ import { PROOF_EXECUTION_POLICY } from '../src/operation-policy.mjs';
 import { createRequestIdentity, validateRequestIdentity } from '../src/request-identity.mjs';
 import { generateTrustKeypair } from '../src/trust.mjs';
 import { verifyReceipt } from '../src/verifier.mjs';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const verifierCli = fileURLToPath(new URL('../src/verifier-cli.mjs', import.meta.url));
 
@@ -105,7 +106,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.15.5');
+  assert.equal(result.receipt.runtime.package_version, DEADBYTE_VERSION);
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/release-version.test.mjs

@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
+import { DEADBYTE_VERSION } from '../src/version.mjs';
 
 const root=new URL('../',import.meta.url);
 const text=rel=>readFile(new URL(rel,root),'utf8');
@@ -9,7 +10,7 @@ const PARENT_RELEASE='v0.15.2-0fb46542f6a4345f';
 const PARENT_MANIFEST='0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34';
 const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
 
-test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent identity',async()=>{
+test('R46 current authority agrees on the package release version and preserves exact V0.15.2 parent identity',async()=>{
   const pkg=JSON.parse(await text('package.json'));
   const release=JSON.parse(await text('RELEASE.json'));
   const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,processPolicy]=await Promise.all([
@@ -27,7 +28,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
     text('controller/deadbyte-process-policy.json')
   ]);
 
-  assert.equal(pkg.version,'0.15.5');
+  assert.equal(pkg.version,DEADBYTE_VERSION);
   assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r46.ps1');
   assert.equal(pkg.scripts['self-update:deferred'],'node scripts/deferred-slot-operation-r46.mjs');
   assert.equal(pkg.scripts['release:parity'],'node scripts/release-parity-r46.mjs');
@@ -36,7 +37,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
   assert.equal(pkg.scripts['r46:fileless:test'],"node --test --test-concurrency=1 test/process-policy.test.mjs test/process-policy-refresh.test.mjs test/release-generation.test.mjs test/process-runtime.test.mjs test/process-mcp-tools.test.mjs test/compact-gateway-r36.test.mjs test/capability-ledger-r36.test.mjs test/remote-device-r44.test.mjs test/observation-runtime.test.mjs test/observation-mcp-tools.test.mjs");
   assert.equal(pkg.scripts['r46:full:test'],'node scripts/full-regression-r46.mjs');
 
-  assert.match(version,/DEADBYTE_VERSION = '0\.15\.5'/);
+  assert.match(version,new RegExp(`DEADBYTE_VERSION = '${DEADBYTE_VERSION.replace(/\./g,'\\.')}'`));
   assert.match(controller,/CONTROLLER V0\.15\.5 \/ R46/);
   assert.match(gate,/DEADBYTE V0\.15\.5 \/ R46 FILELESS POWERSHELL WINDOWS BATCH GATE: PASS/);
   assert.match(readme,/^DEADBYTE MCP V0\.15\.5 \/ R46 FILELESS POWERSHELL PRODUCT BASELINE$/m);
@@ -59,7 +60,7 @@ test('R46 current authority agrees on V0.15.5 and preserves exact V0.15.2 parent
   assert.match(closureVerify,/DEADBYTE-R46-FINAL-CLOSURE-V1/);
   assert.match(windowsGate,/deadbyte\.r46-windows-gate\.v1/);
 
-  assert.equal(release.version,'0.15.5');
+  assert.equal(release.version,DEADBYTE_VERSION);
   assert.equal(release.train,'R46');
   assert.equal(release.label,'FILELESS POWERSHELL PRODUCT BASELINE');
   assert.equal(release.parent.release_id,PARENT_RELEASE);

package/test/skill-plane-r44.test.mjs

@@ -61,6 +61,26 @@ test('R44 skill catalog is metadata-only and load is signature/content bound',as
   }finally{await rm(f.root,{recursive:true,force:true});}
 });
 
+test('R44 skill plane reports malformed registry entries without hiding valid skills',async()=>{
+  const f=await fixture();
+  try{
+    await installSkill(f,{name:'good-skill'});
+    await installSkill(f,{name:'broken-skill'});
+    const broken=path.join(f.registry,'broken-skill','skill.json');
+    const envelope=JSON.parse(await readFile(broken,'utf8'));
+    envelope.body.description='tampered without resigning';
+    await writeFile(broken,JSON.stringify(envelope,null,2)+'\n','utf8');
+    const plane=await createSkillPlane({root:f.registry,verifyKeyPath:f.keys.publicKeyPath});
+    const listed=await plane.list();
+    assert.equal(listed.status,'ok');
+    assert.deepEqual(listed.skills.map(item=>item.name),['good-skill']);
+    assert.equal(listed.invalid_skills.length,1);
+    assert.equal(listed.invalid_skills[0].name,'broken-skill');
+    assert.match(listed.invalid_skills[0].error,/body hash mismatch/);
+    assert.equal(listed.invalid_skills[0].verified,false);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
 test('R44 skill plane fails closed on SKILL.md and resource tampering',async()=>{
   const f=await fixture();
   try{