deadbyte-mcp 0.8.7

package/src/text-policy.mjs

@@ -0,0 +1,9 @@
+const utf8FatalDecoder = new TextDecoder('utf-8', { fatal: true });
+
+export function decodeUtf8Strict(bytes) {
+  try {
+    return utf8FatalDecoder.decode(bytes);
+  } catch {
+    throw new Error('file is not valid UTF-8');
+  }
+}

package/src/tool-audit.mjs

@@ -0,0 +1,261 @@
+import { createHash, randomUUID, sign as cryptoSign, verify as cryptoVerify } from 'node:crypto';
+import { chmod, mkdir, open, readFile, readdir, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { canonicalJson } from './canonical-json.mjs';
+import { loadPrivateSigningKey } from './trust.mjs';
+
+export const AUDIT_EVENT_SCHEMA='deadbyte.tool-audit-event.v1';
+export const AUDIT_CHECKPOINT_SCHEMA='deadbyte.tool-audit-checkpoint.v1';
+const CHECKPOINT_DOMAIN=Buffer.from('DEADBYTE-AUDIT-CHECKPOINT-V1\0','utf8');
+const ZERO_SHA256='0'.repeat(64);
+const HEX64=/^[0-9a-f]{64}$/;
+const DEFAULT_MAX_SEGMENT_BYTES=10*1024*1024;
+const DEFAULT_MAX_SEGMENT_RECORDS=1000;
+const MAX_DEPTH=8;
+const MAX_ARRAY_ITEMS=64;
+const MAX_OBJECT_KEYS=128;
+const MAX_PLAIN_STRING_BYTES=2048;
+const secretExactKeys=new Set([
+  'authorization','password','passwd','secret','token','access_token','refresh_token','api_token','api_key','apikey',
+  'credential','credentials','cookie','cookies','private_key','recovery_code','environment','env'
+]);
+const secretSuffixes=['_password','_passwd','_secret','_token','_credential','_credentials','_cookie','_cookies','_private_key','_recovery_code','_api_key'];
+const payloadKeys=new Set(['content','file_text','text','body','new_string','old_string','raw_input','raw_text','data_base64']);
+const secretValuePattern=/(?:^|[^a-z])(bearer\s+\S+|(?:api[-_]?key|access[-_]?token|refresh[-_]?token|token|password|secret)\s*[=:]\s*\S+|-----BEGIN [^-]*PRIVATE KEY-----)/i;
+const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
+const utf8Bytes=value=>Buffer.from(typeof value==='string'?value:canonicalJson(value),'utf8');
+const byteCount=value=>utf8Bytes(value).length;
+const hashRedaction=(value,reason)=>({redacted:true,reason,byte_count:byteCount(value),sha256:sha256(utf8Bytes(value))});
+const secretRedaction=value=>({redacted:true,reason:'secret',byte_count:byteCount(value)});
+
+function secretKey(key){
+  const normalized=String(key).toLowerCase().replaceAll('-','_');
+  return secretExactKeys.has(normalized)||secretSuffixes.some(suffix=>normalized.endsWith(suffix));
+}
+function payloadKey(key){return payloadKeys.has(String(key).toLowerCase().replaceAll('-','_'));}
+function sanitizeValue(value,key='',depth=0){
+  if(secretKey(key)) return secretRedaction(value);
+  if(payloadKey(key)) return hashRedaction(value,'payload');
+  if(value===null||value===undefined||typeof value==='boolean'||typeof value==='number') return value;
+  if(typeof value==='string'){
+    const bytes=Buffer.byteLength(value,'utf8');
+    if(secretValuePattern.test(value)) return secretRedaction(value);
+    if(bytes>MAX_PLAIN_STRING_BYTES) return hashRedaction(value,'oversize');
+    return value;
+  }
+  if(depth>=MAX_DEPTH) return hashRedaction(value,'depth-limit');
+  if(Array.isArray(value)){
+    const out=value.slice(0,MAX_ARRAY_ITEMS).map(item=>sanitizeValue(item,'',depth+1));
+    if(value.length>MAX_ARRAY_ITEMS) out.push({truncated:true,omitted_items:value.length-MAX_ARRAY_ITEMS});
+    return out;
+  }
+  if(typeof value==='object'){
+    const out={};const entries=Object.entries(value);
+    for(const [childKey,childValue] of entries.slice(0,MAX_OBJECT_KEYS)) out[childKey]=sanitizeValue(childValue,childKey,depth+1);
+    if(entries.length>MAX_OBJECT_KEYS) out.__truncated__={omitted_keys:entries.length-MAX_OBJECT_KEYS};
+    return out;
+  }
+  return hashRedaction(String(value),'unsupported-type');
+}
+export function sanitizeAuditArgs(args){return sanitizeValue(args,'',0);}
+
+function jsonClone(value){return JSON.parse(canonicalJson(value));}
+function segmentName(index){return `segment-${String(index).padStart(8,'0')}.jsonl`;}
+function checkpointName(index){return `checkpoint-${String(index).padStart(8,'0')}.json`;}
+function segmentIndexFromName(name){const m=/^segment-(\d{8})\.jsonl$/.exec(name);return m?Number(m[1]):null;}
+function eventHash(body){return sha256(Buffer.from(canonicalJson(body),'utf8'));}
+function checkpointHash(body){return sha256(Buffer.from(canonicalJson(body),'utf8'));}
+function checkpointSignedBytes(bodyWithHash){return Buffer.concat([CHECKPOINT_DOMAIN,Buffer.from(canonicalJson(bodyWithHash),'utf8')]);}
+function outcomeReceiptHashes(result){
+  const found=new Set();
+  const visit=(value,depth=0)=>{
+    if(depth>8||value===null||value===undefined) return;
+    if(Array.isArray(value)){for(const item of value.slice(0,64)) visit(item,depth+1);return;}
+    if(typeof value!=='object') return;
+    for(const [key,child] of Object.entries(value)){
+      const lower=key.toLowerCase();
+      if((lower==='receipt_sha256'||lower==='task_receipt_sha256'||(lower.includes('receipt')&&lower.endsWith('_sha256')))&&typeof child==='string'&&HEX64.test(child)) found.add(child);
+      else visit(child,depth+1);
+      if(found.size>=16) return;
+    }
+  };
+  visit(result?.structuredContent??result);
+  return [...found].sort();
+}
+function summarizeOutcome(result,error,durationMs){
+  const duration=Math.max(0,Math.round(Number(durationMs)||0));
+  if(error){
+    const message=String(error?.message??error);
+    return {status:'threw',is_error:true,duration_ms:duration,receipt_sha256s:[],error:{name:String(error?.name||'Error').slice(0,128),byte_count:Buffer.byteLength(message,'utf8'),sha256:sha256(Buffer.from(message,'utf8'))}};
+  }
+  const structured=result?.structuredContent;
+  const status=typeof structured?.status==='string'?structured.status:(result?.isError===true?'error':'ok');
+  return {status:String(status).slice(0,128),is_error:result?.isError===true,duration_ms:duration,receipt_sha256s:outcomeReceiptHashes(result)};
+}
+
+async function appendSynced(file,line){
+  const handle=await open(file,'a',0o600);
+  try{await handle.writeFile(line,'utf8');await handle.sync();}
+  finally{await handle.close();}
+  if(process.platform!=='win32') await chmod(file,0o600);
+}
+async function writeExclusiveSynced(file,text){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(text,'utf8');await handle.sync();}
+  finally{await handle.close();}
+  if(process.platform!=='win32') await chmod(file,0o600);
+}
+function parseLines(text,file){
+  if(!text) return [];
+  const lines=text.split(/\r?\n/);const out=[];
+  for(let i=0;i<lines.length;i++){
+    if(!lines[i]) continue;
+    try{out.push(JSON.parse(lines[i]));}catch(error){throw new Error(`audit ${file} line ${i+1} JSON invalid: ${error.message}`);}
+  }
+  return out;
+}
+function verifyEventBasic(event,expectedSeq,expectedPrev){
+  if(!event||event.schema!==AUDIT_EVENT_SCHEMA) throw new Error('audit event schema mismatch');
+  if(event.seq!==expectedSeq) throw new Error(`audit seq mismatch: expected ${expectedSeq}, found ${event.seq}`);
+  if(event.prev_sha256!==expectedPrev) throw new Error(`audit prev hash mismatch at seq ${event.seq}`);
+  if(!HEX64.test(event.event_sha256??'')) throw new Error(`audit event hash invalid at seq ${event.seq}`);
+  const {event_sha256,...body}=event;if(eventHash(body)!==event_sha256) throw new Error(`audit event hash mismatch at seq ${event.seq}`);
+}
+function checkpointBodyFrom(value){
+  const {checkpoint_sha256:_hash,attestation:_attestation,...body}=value;return body;
+}
+function verifyCheckpointBasic(value,{index,segmentBytes,segmentSha256,firstSeq,lastSeq,firstPrev,head,previousCheckpointSha,publicKey,keyId}){
+  if(!value||value.schema!==AUDIT_CHECKPOINT_SCHEMA) throw new Error(`audit checkpoint ${index} schema mismatch`);
+  const body=checkpointBodyFrom(value);const expectedHash=checkpointHash(body);
+  if(value.checkpoint_sha256!==expectedHash) throw new Error(`audit checkpoint ${index} self hash mismatch`);
+  if(value.segment_index!==index||value.segment_file!==segmentName(index)) throw new Error(`audit checkpoint ${index} segment identity mismatch`);
+  if(value.first_seq!==firstSeq||value.last_seq!==lastSeq||value.first_prev_sha256!==firstPrev||value.head_sha256!==head) throw new Error(`audit checkpoint ${index} event range mismatch`);
+  if(value.manifest?.segment_bytes!==segmentBytes||value.manifest?.segment_sha256!==segmentSha256||value.manifest?.segment_file!==segmentName(index)) throw new Error(`audit checkpoint ${index} manifest mismatch`);
+  if(value.previous_checkpoint_sha256!==previousCheckpointSha) throw new Error(`audit checkpoint ${index} previous checkpoint mismatch`);
+  if(value.attestation?.algorithm!=='ed25519'||value.attestation?.key_id!==keyId||typeof value.attestation?.signature_base64!=='string') throw new Error(`audit checkpoint ${index} attestation invalid`);
+  const signature=Buffer.from(value.attestation.signature_base64,'base64');
+  if(signature.length!==64||signature.toString('base64')!==value.attestation.signature_base64) throw new Error(`audit checkpoint ${index} signature encoding invalid`);
+  const signed={...body,checkpoint_sha256:value.checkpoint_sha256};
+  if(!cryptoVerify(null,checkpointSignedBytes(signed),publicKey,signature)) throw new Error(`audit checkpoint ${index} signature invalid`);
+}
+
+export async function createToolAudit({
+  stateRoot,signingKeyPath,contextProvider=async()=>({}),maxSegmentBytes=DEFAULT_MAX_SEGMENT_BYTES,
+  maxSegmentRecords=DEFAULT_MAX_SEGMENT_RECORDS,clock=()=>new Date()
+}={}){
+  if(!stateRoot) throw new Error('tool audit requires stateRoot');
+  if(!signingKeyPath) throw new Error('tool audit requires signingKeyPath');
+  if(typeof contextProvider!=='function') throw new Error('tool audit requires contextProvider');
+  if(!Number.isInteger(maxSegmentBytes)||maxSegmentBytes<128) throw new Error('tool audit maxSegmentBytes must be an integer >=128');
+  if(!Number.isInteger(maxSegmentRecords)||maxSegmentRecords<1) throw new Error('tool audit maxSegmentRecords must be >=1');
+  const auditDir=path.join(path.resolve(stateRoot),'audit');await mkdir(auditDir,{recursive:true});
+  const key=await loadPrivateSigningKey(signingKeyPath);
+  const names=await readdir(auditDir);
+  const segmentIndexes=names.map(segmentIndexFromName).filter(x=>x!==null).sort((a,b)=>a-b);
+  const checkpointIndexes=new Set(names.map(n=>{const m=/^checkpoint-(\d{8})\.json$/.exec(n);return m?Number(m[1]):null;}).filter(x=>x!==null));
+  let seq=0,head=ZERO_SHA256,previousCheckpointSha=ZERO_SHA256,currentIndex=1,currentRecords=0,currentBytes=0,currentFirstSeq=null,currentFirstPrev=null;
+  const pendingRequests=new Map();
+  for(let pos=0;pos<segmentIndexes.length;pos++){
+    const index=segmentIndexes[pos];if(index!==pos+1) throw new Error(`audit segment index gap before ${index}`);
+    const file=path.join(auditDir,segmentName(index));const bytes=await readFile(file);const parsed=parseLines(bytes.toString('utf8'),segmentName(index));
+    if(parsed.length<1) throw new Error(`audit segment ${index} is empty`);
+    const firstPrev=head;const firstSeq=seq+1;
+    for(const event of parsed){
+      verifyEventBasic(event,seq+1,head);
+      if(event.event_type==='tool.request') pendingRequests.set(event.request_id,{request_id:event.request_id,tool:event.tool});
+      else if(event.event_type==='tool.result') pendingRequests.delete(event.request_id);
+      seq=event.seq;head=event.event_sha256;
+    }
+    const hasCheckpoint=checkpointIndexes.has(index);
+    if(pos<segmentIndexes.length-1&&!hasCheckpoint) throw new Error(`audit segment ${index} is unsealed before a later segment`);
+    if(hasCheckpoint){
+      const cp=JSON.parse(await readFile(path.join(auditDir,checkpointName(index)),'utf8'));
+      verifyCheckpointBasic(cp,{index,segmentBytes:bytes.length,segmentSha256:sha256(bytes),firstSeq,lastSeq:seq,firstPrev,head,previousCheckpointSha,publicKey:key.publicKey,keyId:key.keyId});
+      previousCheckpointSha=cp.checkpoint_sha256;currentIndex=index+1;currentRecords=0;currentBytes=0;currentFirstSeq=null;currentFirstPrev=null;
+    }else{
+      currentIndex=index;currentRecords=parsed.length;currentBytes=bytes.length;currentFirstSeq=firstSeq;currentFirstPrev=firstPrev;
+    }
+  }
+  for(const cpIndex of checkpointIndexes) if(!segmentIndexes.includes(cpIndex)) throw new Error(`audit checkpoint ${cpIndex} has no segment`);
+  let queue=Promise.resolve();
+  const enqueue=fn=>{const next=queue.then(fn);queue=next.catch(()=>{});return next;};
+
+  async function sealCurrent(){
+    if(currentRecords===0) return null;
+    const fileName=segmentName(currentIndex);const file=path.join(auditDir,fileName);const bytes=await readFile(file);
+    const body={
+      schema:AUDIT_CHECKPOINT_SCHEMA,created_at_utc:clock().toISOString(),segment_index:currentIndex,segment_file:fileName,
+      first_seq:currentFirstSeq,last_seq:seq,first_prev_sha256:currentFirstPrev,head_sha256:head,
+      previous_checkpoint_sha256:previousCheckpointSha,
+      manifest:{segment_file:fileName,segment_bytes:bytes.length,segment_sha256:sha256(bytes)}
+    };
+    const cpHash=checkpointHash(body);const signed={...body,checkpoint_sha256:cpHash};
+    const signature=cryptoSign(null,checkpointSignedBytes(signed),key.privateKey);
+    const checkpoint={...signed,attestation:{algorithm:'ed25519',key_id:key.keyId,signature_base64:signature.toString('base64')}};
+    await writeExclusiveSynced(path.join(auditDir,checkpointName(currentIndex)),`${JSON.stringify(checkpoint)}\n`);
+    previousCheckpointSha=cpHash;currentIndex++;currentRecords=0;currentBytes=0;currentFirstSeq=null;currentFirstPrev=null;
+    return checkpoint;
+  }
+
+  async function appendEvent(eventType,requestId,tool,payloadKeyName,payload){
+    if(!/^[A-Za-z0-9._-]{1,128}$/.test(tool)) throw new Error('invalid audited tool name');
+    const now=clock();if(!(now instanceof Date)||Number.isNaN(now.getTime())) throw new Error('audit clock returned invalid date');
+    const context=jsonClone(await contextProvider());
+    let body={schema:AUDIT_EVENT_SCHEMA,seq:seq+1,ts:now.toISOString(),event_type:eventType,request_id:requestId,tool,prev_sha256:head,context,[payloadKeyName]:payload};
+    let event={...body,event_sha256:eventHash(body)};let line=`${JSON.stringify(event)}\n`;let lineBytes=Buffer.byteLength(line,'utf8');
+    if(currentRecords>0&&(currentBytes+lineBytes>maxSegmentBytes||currentRecords>=maxSegmentRecords)){
+      await sealCurrent();
+      body={...body,seq:seq+1,prev_sha256:head};event={...body,event_sha256:eventHash(body)};line=`${JSON.stringify(event)}\n`;lineBytes=Buffer.byteLength(line,'utf8');
+    }
+    if(currentRecords===0){currentFirstSeq=seq+1;currentFirstPrev=head;}
+    await appendSynced(path.join(auditDir,segmentName(currentIndex)),line);
+    seq=event.seq;head=event.event_sha256;currentRecords++;currentBytes+=lineBytes;
+    if(currentRecords>=maxSegmentRecords||currentBytes>=maxSegmentBytes) await sealCurrent();
+    return event;
+  }
+
+  for(const pending of pendingRequests.values()){
+    await appendEvent('tool.result',pending.request_id,pending.tool,'outcome',{
+      status:'interrupted',is_error:true,duration_ms:0,receipt_sha256s:[],side_effect_state:'unknown',
+      recovery:{reason:'runtime_restart'}
+    });
+  }
+
+  async function recordRequest(tool,args){
+    return enqueue(async()=>{
+      const requestId=randomUUID();
+      const event=await appendEvent('tool.request',requestId,tool,'args',sanitizeAuditArgs(args??{}));
+      return Object.freeze({request_id:requestId,tool,request_seq:event.seq,request_event_sha256:event.event_sha256});
+    });
+  }
+  async function recordResult(token,result,error,durationMs){
+    if(!token||typeof token.request_id!=='string'||typeof token.tool!=='string') throw new Error('audit result token invalid');
+    return enqueue(()=>appendEvent('tool.result',token.request_id,token.tool,'outcome',summarizeOutcome(result,error,durationMs)));
+  }
+  async function seal(){return enqueue(()=>sealCurrent());}
+  async function status(){
+    return enqueue(async()=>({schema:'deadbyte.tool-audit-status.v1',audit_dir:auditDir,last_seq:seq,head_sha256:head,current_segment_index:currentIndex,current_segment_records:currentRecords,current_segment_bytes:currentBytes,previous_checkpoint_sha256:previousCheckpointSha,key_id:key.keyId}));
+  }
+  return Object.freeze({auditDir,recordRequest,recordResult,seal,status});
+}
+
+export function installToolAudit(server,audit){
+  if(!server||typeof server.registerTool!=='function') throw new Error('tool audit requires MCP server registerTool');
+  if(!audit||typeof audit.recordRequest!=='function'||typeof audit.recordResult!=='function') throw new Error('tool audit requires recordRequest()/recordResult()');
+  const original=server.registerTool.bind(server);
+  server.registerTool=(name,config,handler)=>original(name,config,async(...handlerArgs)=>{
+    const token=await audit.recordRequest(name,handlerArgs[0]??{});
+    const started=process.hrtime.bigint();
+    let result;
+    try{result=await handler(...handlerArgs);}
+    catch(error){
+      const durationMs=Number((process.hrtime.bigint()-started)/1000000n);
+      try{await audit.recordResult(token,null,error,durationMs);}catch(auditError){throw new AggregateError([error,auditError],'tool handler failed and audit result commit also failed');}
+      throw error;
+    }
+    const durationMs=Number((process.hrtime.bigint()-started)/1000000n);
+    await audit.recordResult(token,result,null,durationMs);
+    return result;
+  });
+  return server;
+}

package/src/trust-init.mjs

@@ -0,0 +1,21 @@
+import { generateTrustKeypair, defaultPrivateKeyPath, defaultPublicKeyPath } from './trust.mjs';
+
+const privateKeyPath = process.env.DEADBYTE_SIGNING_KEY ?? defaultPrivateKeyPath();
+const publicKeyPath = process.env.DEADBYTE_VERIFY_KEY ?? defaultPublicKeyPath();
+
+try {
+  const result = await generateTrustKeypair({ privateKeyPath, publicKeyPath });
+  console.log(JSON.stringify({
+    status: 'created',
+    algorithm: 'ed25519',
+    key_id: result.keyId,
+    private_key: result.privateKeyPath,
+    public_key: result.publicKeyPath
+  }, null, 2));
+} catch (error) {
+  if (error?.code === 'EEXIST') {
+    console.error('trust key already exists; refusing to overwrite');
+    process.exit(73);
+  }
+  throw error;
+}

package/src/trust.mjs

@@ -0,0 +1,82 @@
+import {
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign as cryptoSign,
+  verify as cryptoVerify
+} from 'node:crypto';
+import { mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { sha256Bytes } from './hash.mjs';
+
+const DOMAIN = Buffer.from('DEADBYTE-RECEIPT-V1\0', 'utf8');
+
+export function defaultTrustDir() {
+  return path.join(os.homedir(), '.deadbyte-mcp', 'trust');
+}
+
+export function defaultPrivateKeyPath() {
+  return path.join(defaultTrustDir(), 'ed25519-private.pem');
+}
+
+export function defaultPublicKeyPath() {
+  return path.join(defaultTrustDir(), 'ed25519-public.pem');
+}
+
+export function keyIdFromPublicKey(publicKey) {
+  const der = publicKey.export({ type: 'spki', format: 'der' });
+  return sha256Bytes(Buffer.from(der));
+}
+
+export async function generateTrustKeypair({ privateKeyPath = defaultPrivateKeyPath(), publicKeyPath = defaultPublicKeyPath() } = {}) {
+  const privateAbs = path.resolve(privateKeyPath);
+  const publicAbs = path.resolve(publicKeyPath);
+  await mkdir(path.dirname(privateAbs), { recursive: true });
+  await mkdir(path.dirname(publicAbs), { recursive: true });
+
+  const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+  const privatePem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  const publicPem = publicKey.export({ type: 'spki', format: 'pem' });
+
+  await writeFile(privateAbs, privatePem, { flag: 'wx', mode: 0o600 });
+  try {
+    await writeFile(publicAbs, publicPem, { flag: 'wx', mode: 0o644 });
+  } catch (error) {
+    await import('node:fs/promises').then(({ rm }) => rm(privateAbs, { force: true })).catch(() => {});
+    throw error;
+  }
+
+  return {
+    privateKeyPath: privateAbs,
+    publicKeyPath: publicAbs,
+    keyId: keyIdFromPublicKey(publicKey)
+  };
+}
+
+export async function loadPrivateSigningKey(privateKeyPath) {
+  if (!privateKeyPath) throw new Error('missing signing key path');
+  const keyPath = await realpath(path.resolve(privateKeyPath));
+  const pem = await readFile(keyPath);
+  const privateKey = createPrivateKey(pem);
+  if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error('signing key must be Ed25519');
+  const publicKey = createPublicKey(privateKey);
+  return { keyPath, privateKey, publicKey, keyId: keyIdFromPublicKey(publicKey) };
+}
+
+export async function loadPublicVerifyKey(publicKeyPath) {
+  if (!publicKeyPath) throw new Error('missing verify key path');
+  const keyPath = await realpath(path.resolve(publicKeyPath));
+  const pem = await readFile(keyPath);
+  const publicKey = createPublicKey(pem);
+  if (publicKey.asymmetricKeyType !== 'ed25519') throw new Error('verify key must be Ed25519');
+  return { keyPath, publicKey, keyId: keyIdFromPublicKey(publicKey) };
+}
+
+export function signReceiptBytes(privateKey, bytes) {
+  return cryptoSign(null, Buffer.concat([DOMAIN, Buffer.from(bytes)]), privateKey);
+}
+
+export function verifyReceiptBytes(publicKey, bytes, signature) {
+  return cryptoVerify(null, Buffer.concat([DOMAIN, Buffer.from(bytes)]), publicKey, signature);
+}

package/src/tunnel-stdio-compat-smoke.mjs

@@ -0,0 +1,142 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, '..');
+const serverPath = path.join(repoRoot, 'src', 'mcp-server.mjs');
+const workspaceRoot = path.join(repoRoot, 'workspaces');
+const baseEnv = {
+  ...process.env,
+  DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+  DEADBYTE_TUNNEL_STDIO_PROBE_COMPAT: '1'
+};
+
+function readOneJsonLine(stream, timeoutMs = 5000) {
+  return new Promise((resolve, reject) => {
+    let buffered = '';
+    const timer = setTimeout(() => cleanup(new Error('timed out waiting for stdio JSON response')), timeoutMs);
+    const onData = chunk => {
+      buffered += Buffer.from(chunk).toString('utf8');
+      const nl = buffered.indexOf('\n');
+      if (nl < 0) return;
+      const line = buffered.slice(0, nl).replace(/\r$/, '');
+      try { cleanup(null, JSON.parse(line)); }
+      catch (error) { cleanup(error); }
+    };
+    const onEnd = () => cleanup(new Error('stdio closed before JSON response'));
+    const cleanup = (error, value) => {
+      clearTimeout(timer);
+      stream.off('data', onData);
+      stream.off('end', onEnd);
+      if (error) reject(error); else resolve(value);
+    };
+    stream.on('data', onData);
+    stream.once('end', onEnd);
+  });
+}
+
+async function rawLegacyProbe() {
+  const child = spawn(process.execPath, [serverPath], {
+    cwd: repoRoot,
+    env: baseEnv,
+    stdio: ['pipe', 'pipe', 'pipe']
+  });
+  const stderr = [];
+  child.stderr.on('data', chunk => stderr.push(Buffer.from(chunk)));
+  try {
+    child.stdin.write(JSON.stringify({
+      jsonrpc: '2.0',
+      id: 'tunnel-startup-probe',
+      method: 'initialize',
+      params: {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'tunnel-client-startup-probe', version: '0.0.11' }
+      }
+    }) + '\n');
+    const response = await readOneJsonLine(child.stdout);
+    if (response?.id !== 'tunnel-startup-probe' || response?.result?.protocolVersion !== '2025-06-18') {
+      throw new Error(`legacy startup probe response mismatch: ${JSON.stringify(response)}`);
+    }
+    child.stdin.write(JSON.stringify({
+      jsonrpc: '2.0',
+      method: 'notifications/initialized',
+      params: {}
+    }) + '\n');
+    await new Promise(resolve => setTimeout(resolve, 100));
+    if (child.exitCode !== null) throw new Error(`server exited after legacy startup probe rc=${child.exitCode}`);
+    return { selected_protocol: response.result.protocolVersion };
+  } finally {
+    child.stdin.end();
+    await new Promise(resolve => setTimeout(resolve, 100));
+    if (child.exitCode === null) {
+      const exitPromise = new Promise(resolve => child.once('exit', resolve));
+      child.kill('SIGTERM');
+      await Promise.race([
+        exitPromise,
+        new Promise(resolve => setTimeout(resolve, 2000))
+      ]);
+      if (child.exitCode === null) child.kill('SIGKILL');
+    }
+    if (child.exitCode && child.exitCode !== 0) {
+      const text = Buffer.concat(stderr).toString('utf8').trim();
+      if (text) process.stderr.write(`legacy-probe server stderr:\n${text}\n`);
+    }
+  }
+}
+
+async function modernPassThrough() {
+  const client = new Client(
+    { name: 'deadbyte-tunnel-compat-modern-smoke', version: '0.8.0' },
+    { versionNegotiation: { mode: { pin: '2026-07-28' } } }
+  );
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: [serverPath],
+    cwd: repoRoot,
+    env: {
+      ...getDefaultEnvironment(),
+      DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+      DEADBYTE_TUNNEL_STDIO_PROBE_COMPAT: '1'
+    },
+    stderr: 'pipe'
+  });
+  const serverStderr = [];
+  transport.stderr?.on('data', chunk => serverStderr.push(Buffer.from(chunk)));
+  try {
+    await client.connect(transport);
+    const era = client.getProtocolEra();
+    if (era !== 'modern') throw new Error(`expected modern era through compat prefilter, got ${String(era)}`);
+    const listed = await client.listTools();
+    const names = listed.tools.map(tool => tool.name).sort();
+    const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open'];
+    const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
+    const allowedCatalogs = [
+      baseTools,
+      [...baseTools, ...privilegedTools]
+    ].map(items => [...items].sort());
+    if (!allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected))) {
+      throw new Error(`modern catalog changed through compat prefilter: ${JSON.stringify(names)}`);
+    }
+    return { protocol_revision: '2026-07-28', protocol_era: era, tools: names };
+  } catch (error) {
+    const stderr = Buffer.concat(serverStderr).toString('utf8').trim();
+    if (stderr) process.stderr.write(`modern-pass-through server stderr:\n${stderr}\n`);
+    throw error;
+  } finally {
+    await client.close().catch(() => {});
+  }
+}
+
+const legacy = await rawLegacyProbe();
+const modern = await modernPassThrough();
+console.log(JSON.stringify({
+  status: 'passed',
+  adapter: 'tunnel-stdio-probe-compat-v1',
+  legacy_startup_probe: legacy,
+  modern_pass_through: modern,
+  legacy_capability_translation: false
+}, null, 2));

package/src/tunnel-stdio-compat.mjs

@@ -0,0 +1,126 @@
+const LEGACY_PROTOCOLS = new Set(['2025-11-25', '2025-06-18', '2025-03-26', '2024-11-05']);
+const LEGACY_INITIALIZED_NOTIFICATION = 'notifications/initialized';
+const MAX_BUFFER_BYTES = 1024 * 1024;
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+export function createTunnelStdioProbeTranslator({ version }) {
+  return function translate(message) {
+    if (!isRecord(message) || typeof message.method !== 'string') {
+      return { action: 'forward', message, classification: 'unchanged' };
+    }
+
+    if (message.method === 'initialize' && Object.prototype.hasOwnProperty.call(message, 'id')) {
+      const requested = message.params?.protocolVersion;
+      const selected = LEGACY_PROTOCOLS.has(requested) ? requested : '2025-11-25';
+      return {
+        action: 'respond',
+        response: {
+          jsonrpc: '2.0',
+          id: message.id,
+          result: {
+            protocolVersion: selected,
+            capabilities: { tools: {} },
+            serverInfo: { name: 'deadbyte-mcp', version }
+          }
+        },
+        classification: 'legacy_initialize_probe'
+      };
+    }
+
+    if (message.method === LEGACY_INITIALIZED_NOTIFICATION &&
+        !Object.prototype.hasOwnProperty.call(message, 'id')) {
+      return { action: 'drop', classification: 'legacy_initialized_probe' };
+    }
+
+    // Deliberately do not modernize legacy tools/list, tools/call, ping, logging,
+    // cancellation, or any other request. Actual capability traffic must reach the
+    // strict 2026-07-28 SDK boundary unchanged and satisfy that boundary itself.
+    return { action: 'forward', message, classification: 'unchanged' };
+  };
+}
+
+export function installTunnelStdioProbeCompat({ enabled, version, diagnostic = false }) {
+  if (!enabled) return { enabled: false };
+  const translate = createTunnelStdioProbeTranslator({ version });
+  const originalEmit = process.stdin.emit;
+  let buffered = Buffer.alloc(0);
+  let bypass = false;
+
+  const diag = (classification, method) => {
+    if (!diagnostic) return;
+    try {
+      process.stderr.write(
+        `DEADBYTE STDIO PROBE COMPAT classification=${classification} method=${method ?? '<none>'}\n`
+      );
+    } catch {}
+  };
+
+  const forwardBytes = (bytes) => {
+    bypass = true;
+    try {
+      Reflect.apply(originalEmit, process.stdin, ['data', Buffer.from(bytes)]);
+    } finally {
+      bypass = false;
+    }
+  };
+
+  const handleFrame = (frame, hasNewline) => {
+    let payloadEnd = frame.length - (hasNewline ? 1 : 0);
+    if (payloadEnd > 0 && frame[payloadEnd - 1] === 0x0d) payloadEnd -= 1;
+    const payload = frame.subarray(0, payloadEnd);
+    if (payload.length === 0) {
+      forwardBytes(frame);
+      return;
+    }
+
+    let parsed;
+    try {
+      parsed = JSON.parse(utf8Decoder.decode(payload));
+    } catch {
+      // Invalid UTF-8, malformed JSON, or non-JSON input is not ours to reinterpret.
+      // Preserve the original transport bytes exactly for the strict SDK consumer.
+      forwardBytes(frame);
+      return;
+    }
+
+    const outcome = translate(parsed);
+    diag(outcome.classification, parsed?.method);
+    if (outcome.action === 'drop') return;
+    if (outcome.action === 'respond') {
+      process.stdout.write(JSON.stringify(outcome.response) + '\n');
+      return;
+    }
+    forwardBytes(frame);
+  };
+
+  process.stdin.emit = function patchedEmit(event, ...args) {
+    if (event !== 'data' || bypass) return Reflect.apply(originalEmit, this, [event, ...args]);
+    const chunk = Buffer.isBuffer(args[0]) ? Buffer.from(args[0]) : Buffer.from(String(args[0] ?? ''), 'utf8');
+    buffered = buffered.length === 0 ? chunk : Buffer.concat([buffered, chunk]);
+    if (buffered.length > MAX_BUFFER_BYTES) {
+      throw new Error('tunnel stdio probe compatibility input buffer exceeded 1 MiB');
+    }
+    for (;;) {
+      const nl = buffered.indexOf(0x0a);
+      if (nl < 0) break;
+      const frame = buffered.subarray(0, nl + 1);
+      buffered = buffered.subarray(nl + 1);
+      handleFrame(frame, true);
+    }
+    return true;
+  };
+
+  process.stdin.on('end', () => {
+    if (buffered.length > 0) {
+      const frame = buffered;
+      buffered = Buffer.alloc(0);
+      handleFrame(frame, false);
+    }
+  });
+
+  return { enabled: true };
+}

package/src/verifier-cli.mjs

@@ -0,0 +1,13 @@
+import { verifyReceipt } from './verifier.mjs';
+import { defaultPublicKeyPath } from './trust.mjs';
+
+const [workspacePath, receiptPath] = process.argv.slice(2);
+if (!workspacePath || !receiptPath) {
+  console.error('usage: verifier-cli <workspace> <receipt-relative-path>');
+  process.exit(64);
+}
+
+const verifyKeyPath = process.env.DEADBYTE_VERIFY_KEY ?? defaultPublicKeyPath();
+const result = await verifyReceipt({ workspacePath, receiptPath, verifyKeyPath });
+console.log(JSON.stringify(result));
+process.exit(result.ok ? 0 : 1);