deadbyte-mcp 0.8.7

package/test/runtime-self-update.test.mjs

@@ -0,0 +1,280 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import {
+  assertDevelopmentRootSafe,
+  legacyContext,
+  loadPowerShellDataFile,
+  parseUpdateArgs,
+  prepareNamedTunnelCloudSpec,
+  runControllerStartNoCapture
+} from '../scripts/runtime-self-update.mjs';
+import * as runtimeUpdate from '../scripts/runtime-self-update.mjs';
+
+const hex = ch => ch.repeat(64);
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+
+test('R32 updater loads controller data with Windows PowerShell modules isolated from parent runtime paths', { skip: process.platform !== 'win32' }, async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r32-psdata-'));
+  const file=path.join(root,'controller-config.psd1');
+  await writeFile(file,"@{ Schema = 'deadbyte.controller.v1'; Enabled = $true; Count = 68 }\n");
+  const prior=process.env.PSModulePath;
+  process.env.PSModulePath='C:\\definitely-not-a-windows-powershell-module-root';
+  try {
+    const parsed=await loadPowerShellDataFile(file);
+    assert.deepEqual(parsed,{Count:68,Enabled:true,Schema:'deadbyte.controller.v1'});
+  } finally {
+    if(prior===undefined) delete process.env.PSModulePath; else process.env.PSModulePath=prior;
+  }
+});
+
+test('R32 updater applies the isolated Windows PowerShell environment to detached controller starts', async () => {
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/stdio:'ignore'/);
+  assert.match(source,/env:commandEnvironment\(exe,env\?\?process\.env\)/);
+  assert.match(source,/for\(let attempt=1;attempt<=3;attempt\+=1\)/);
+});
+
+test('R27 slot-update CLI requires exact stage/development/version/manifest bindings', () => {
+  assert.throws(() => parseUpdateArgs([]), /--stage/);
+  assert.throws(() => parseUpdateArgs(['--stage','x']), /--development-root/);
+  assert.throws(() => parseUpdateArgs(['--stage','x','--development-root','dev']), /--expected-version/);
+  assert.throws(() => parseUpdateArgs(['--stage','x','--development-root','dev','--expected-version','0.8.3']), /--expected-manifest/);
+  const parsed=parseUpdateArgs(['--stage','stage','--development-root','dev','--expected-version','0.8.3','--expected-manifest',hex('a'),'--source-root','old','--restore-standing-grants']);
+  assert.equal(parsed.expectedVersion,'0.8.3');
+  assert.equal(parsed.expectedManifest,hex('a'));
+  assert.equal(parsed.restoreStandingGrants,true);
+  assert.ok(path.isAbsolute(parsed.developmentRoot));
+});
+
+test('R27 development root is outside immutable/runtime state stores', async () => {
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-state-'));
+  const dev=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-dev-'));
+  assert.equal(assertDevelopmentRootSafe(dev,state),path.resolve(dev));
+  assert.throws(() => assertDevelopmentRootSafe(path.join(state,'releases','x'),state),/development root/);
+  assert.throws(() => assertDevelopmentRootSafe(path.join(state,'generations','x'),state),/development root/);
+  assert.throws(() => assertDevelopmentRootSafe(path.join(state,'runtime','x'),state),/development root/);
+});
+
+test('R27 controller start transport returns while its long-lived descendant is still alive', async t => {
+  if(process.platform!=='win32'){t.skip('Windows Start-Process regression');return;}
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r27-start-'));
+  const controllerDir=path.join(base,'controller'); await mkdir(controllerDir,{recursive:true});
+  const controller=path.join(controllerDir,'deadbyte-controller.ps1');
+  const log=path.join(base,'child.log'),pidFile=path.join(base,'child.pid');
+  const node=process.execPath.replaceAll("'","''"),escapedLog=log.replaceAll("'","''"),escapedPid=pidFile.replaceAll("'","''");
+  await writeFile(controller,`param([string]$Command)\nif($Command -ne 'start'){exit 9}\n$p=Start-Process -FilePath '${node}' -ArgumentList @('-e','setTimeout(()=>process.exit(0),10000)') -PassThru -WindowStyle Hidden -RedirectStandardOutput '${escapedLog}'\n[System.IO.File]::WriteAllText('${escapedPid}',[string]$p.Id)\n`);
+  const result=runControllerStartNoCapture(legacyContext(base),3000);
+  assert.equal(result.status,0,JSON.stringify(result)); assert.equal(result.error,null,JSON.stringify(result));
+  const childPid=Number((await readFile(pidFile,'utf8')).trim()); assert.ok(Number.isInteger(childPid)&&childPid>0);
+  t.after(()=>{try{process.kill(childPid);}catch{}});
+  assert.doesNotThrow(()=>process.kill(childPid,0),'controller start returned only after descendant exited');
+});
+
+test('R28 slot-update CLI binds direct cloudflared plus external token file as one pinned contract', () => {
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.8.4','--expected-manifest',hex('a')];
+  assert.throws(() => parseUpdateArgs([...base,'--cloud-cloudflared','C:/cloudflared.exe']), /named tunnel bootstrap requires all|cloud/i);
+  const transport=[
+    '--cloud-cloudflared','C:/cloudflared.exe','--cloud-cloudflared-sha256',hex('3'),
+    '--cloud-token-file','C:/secret/tunnel-token.txt','--cloud-token-sha256',hex('4'),
+    '--cloud-child-working-directory','C:/bridge'];
+  assert.throws(() => parseUpdateArgs([...base,...transport]), /public origin/i);
+  const parsed=parseUpdateArgs([...base,...transport,'--cloud-public-origin','https://mcp.rigos.site']);
+  assert.equal(parsed.cloudTransport.cloudflared.sha256,hex('3'));
+  assert.equal(parsed.cloudTransport.tokenFile.sha256,hex('4'));
+  assert.equal(parsed.cloudTransport.publicOrigin,'https://mcp.rigos.site');
+  assert.ok(path.isAbsolute(parsed.cloudTransport.tokenFile.path));
+  assert.ok(path.isAbsolute(parsed.cloudTransport.childWorkingDirectory));
+  assert.throws(() => parseUpdateArgs([...base,...transport,'--cloud-public-origin','https://x.trycloudflare.com']), /persistent|trycloudflare/i);
+});
+
+test('R28 named tunnel bootstrap rebinds release host and verifies cloudflared plus token-file pins', async () => {
+  const base=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r28-tunnel-'));
+  const release=path.join(base,'release'),bin=path.join(release,'bin'),bridge=path.join(base,'bridge');
+  await mkdir(bin,{recursive:true}); await mkdir(bridge,{recursive:true});
+  const host=Buffer.from('host'),cloudflared=Buffer.from('cloudflared'),token=Buffer.from('opaque-tunnel-token');
+  await writeFile(path.join(bin,'deadbyte-tunnel-host.exe'),host);
+  const cloudPath=path.join(base,'cloudflared.exe'),tokenPath=path.join(base,'tunnel-token.txt');
+  await writeFile(cloudPath,cloudflared); await writeFile(tokenPath,token);
+  const bootstrap={cloudflared:{path:cloudPath,sha256:sha(cloudflared)},tokenFile:{path:tokenPath,sha256:sha(token)},childWorkingDirectory:bridge};
+  const result=await prepareNamedTunnelCloudSpec({Cloud:{}},{releaseRoot:release,bootstrap});
+  assert.equal(result.Cloud.Transport,'deadbyte.named-tunnel.v2');
+  assert.equal(result.Cloud.FileSha256,sha(host));
+  assert.deepEqual(result.Cloud.Dependencies.map(item=>item.Sha256),[sha(cloudflared),sha(token)]);
+  assert.doesNotMatch(result.Cloud.Arguments,/node\.exe|wrangler/i);
+  assert.match(result.Cloud.Arguments,/cloudflared\.exe/); assert.match(result.Cloud.Arguments,/tunnel-token\.txt/);
+  await assert.rejects(prepareNamedTunnelCloudSpec({Cloud:{}},{releaseRoot:release,bootstrap:{...bootstrap,tokenFile:{...bootstrap.tokenFile,sha256:hex('f')}}}),/token file SHA-256 mismatch/);
+});
+
+test('R28 derives and pins one stable full MCP URL from persistent origin plus external path token', async () => {
+  const runtime=await import('../src/runtime-update.mjs');
+  assert.equal(typeof runtime.ensureStableMcpUrl,'function');
+  const state=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r28-url-'));
+  const bridge=path.join(state,'bridge'); await mkdir(bridge,{recursive:true});
+  const mcpPathFile=path.join(bridge,'mcp-path.txt'),token=hex('a');
+  await writeFile(mcpPathFile,`/mcp/${token}\n`,'ascii');
+  const result=await runtime.ensureStableMcpUrl({stateRoot:state,publicOrigin:'https://mcp.rigos.site',mcpPathFile});
+  const expected=`https://mcp.rigos.site/mcp/${token}\n`;
+  assert.equal(result.origin,'https://mcp.rigos.site');
+  assert.equal(result.path,path.join(bridge,'mcp-url.txt'));
+  assert.equal(result.sha256,sha(Buffer.from(expected,'ascii')));
+  assert.equal(await readFile(result.path,'ascii'),expected);
+});
+
+test('R28 updater requires a stabilization window and public MCP smoke before completion receipt', async () => {
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/RUNTIME_STABILITY_MS\s*=\s*1[0-9]{4}/);
+  assert.match(source,/stabilizeRuntime/);
+  assert.match(source,/controllerCaptured\(ctx,'test'/);
+  assert.match(source,/stableMcpUrl\s*=\s*await ensureStableMcpUrl/);
+  assert.match(source,/McpUrlFileSha256\s*=\s*stableMcpUrl\.sha256/);
+  assert.match(source,/mcp_url_restored/);
+  const stableIndex=source.indexOf('stabilizeRuntime');
+  const receiptIndex=source.indexOf('const body={schema:UPDATE_SCHEMA');
+  assert.ok(stableIndex>=0&&receiptIndex>stableIndex,'stability/public gate must happen before update receipt');
+});
+
+
+test('R29 slot-update CLI requires explicit hash-bound host repins and offline recovery opt-in', () => {
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.8.5','--expected-manifest',hex('a')];
+  const parsed=parseUpdateArgs([...base,'--host-command-pin',`powershell_script=${hex('b')}`,'--host-command-pin',`cmd_script=${hex('c')}`,'--recover-offline-predecessor']);
+  assert.deepEqual(parsed.hostCommandPins,[{commandId:'powershell_script',sha256:hex('b')},{commandId:'cmd_script',sha256:hex('c')}]);
+  assert.equal(parsed.recoverOfflinePredecessor,true);
+  assert.throws(() => parseUpdateArgs([...base,'--host-command-pin','powershell_script=BAD']),/host command pin/i);
+  assert.throws(() => parseUpdateArgs([...base,'--host-command-pin',`powershell_script=${hex('b')}`,'--host-command-pin',`powershell_script=${hex('b')}`]),/duplicate host command pin/i);
+});
+
+test('R29 host policy repin changes only drifted executable hashes under exact operator pins', async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r29-host-repin-'));
+  const changed=path.join(root,'changed.exe'),stable=path.join(root,'stable.exe');
+  await writeFile(changed,Buffer.from('changed-current'));
+  await writeFile(stable,Buffer.from('stable-current'));
+  const policy={schema:'deadbyte.host-policy.v1',enabled:true,commands:{
+    powershell_script:{executable:changed,executable_sha256:hex('1')},
+    node_script:{executable:stable,executable_sha256:sha(Buffer.from('stable-current'))}
+  }};
+  await assert.rejects(runtimeUpdate.prepareHostPolicy(policy,{commandPins:[]}),/powershell_script.*pin drift.*explicit/i);
+  await assert.rejects(runtimeUpdate.prepareHostPolicy(policy,{commandPins:[{commandId:'powershell_script',sha256:hex('f')}]}),/repin.*mismatch/i);
+  const accepted=await runtimeUpdate.prepareHostPolicy(policy,{commandPins:[{commandId:'powershell_script',sha256:sha(Buffer.from('changed-current'))}]});
+  assert.equal(accepted.policy.commands.powershell_script.executable_sha256,sha(Buffer.from('changed-current')));
+  assert.equal(accepted.policy.commands.node_script.executable_sha256,policy.commands.node_script.executable_sha256);
+  assert.deepEqual(accepted.repinned.map(item=>item.command_id),['powershell_script']);
+  await assert.rejects(runtimeUpdate.prepareHostPolicy(policy,{commandPins:[
+    {commandId:'powershell_script',sha256:sha(Buffer.from('changed-current'))},
+    {commandId:'missing',sha256:hex('a')}
+  ]}),/unknown host command pin/i);
+});
+
+test('R29 authority repin propagates one exact observed executable hash across host and coding policies', async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r29-authority-repin-'));
+  const changed=path.join(root,'powershell.exe');
+  await writeFile(changed,Buffer.from('changed-current'));
+  const actual=sha(Buffer.from('changed-current'));
+  const hostPolicy={schema:'deadbyte.host-policy.v1',enabled:true,commands:{
+    powershell_script:{executable:changed,executable_sha256:hex('1')}
+  }};
+  const codingPolicy={schema:'deadbyte.coding-policy.v1',enabled:true,commands:{
+    powershell_script:{executable:changed,executable_sha256:hex('1')}
+  }};
+  const accepted=await runtimeUpdate.prepareAuthorityPolicies({hostPolicy,codingPolicy},{commandPins:[{commandId:'powershell_script',sha256:actual}]});
+  assert.equal(accepted.hostPolicy.commands.powershell_script.executable_sha256,actual);
+  assert.equal(accepted.codingPolicy.commands.powershell_script.executable_sha256,actual);
+  assert.deepEqual(accepted.hostRepinned.map(item=>item.command_id),['powershell_script']);
+  assert.deepEqual(accepted.codingRepinned.map(item=>item.command_id),['powershell_script']);
+  await assert.rejects(runtimeUpdate.prepareAuthorityPolicies({hostPolicy,codingPolicy},{commandPins:[{commandId:'powershell_script',sha256:hex('f')}]}),/repin.*mismatch/i);
+});
+
+test('R29 slot-update CLI accepts bridge rebind only as an exact root plus script hash pair', () => {
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.8.5','--expected-manifest',hex('a')];
+  assert.throws(() => parseUpdateArgs([...base,'--bridge-root','C:/bridge']), /bridge.*requires.*root.*hash|bridge.*pair/i);
+  assert.throws(() => parseUpdateArgs([...base,'--bridge-script-sha256',hex('b')]), /bridge.*requires.*root.*hash|bridge.*pair/i);
+  const parsed=parseUpdateArgs([...base,'--bridge-root','C:/bridge','--bridge-script-sha256',hex('b')]);
+  assert.equal(parsed.bridgeBootstrap.root,path.resolve('C:/bridge'));
+  assert.equal(parsed.bridgeBootstrap.scriptSha256,hex('b'));
+});
+
+test('R31 slot-update CLI binds process-policy bootstrap and machine-FS enable explicitly', () => {
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.8.6','--expected-manifest',hex('a')];
+  assert.throws(() => parseUpdateArgs([...base,'--process-policy','C:/candidate/process-policy.json']), /process policy.*pair/i);
+  assert.throws(() => parseUpdateArgs([...base,'--process-policy-sha256',hex('b')]), /process policy.*pair/i);
+  const parsed=parseUpdateArgs([...base,'--process-policy','C:/candidate/process-policy.json','--process-policy-sha256',hex('b'),'--enable-machine-fs']);
+  assert.equal(parsed.processPolicyBootstrap.path,path.resolve('C:/candidate/process-policy.json'));
+  assert.equal(parsed.processPolicyBootstrap.sha256,hex('b'));
+  assert.equal(parsed.enableMachineFs,true);
+});
+
+test('R32 slot-update CLI enables observation only by explicit flag', () => {
+  const base=['--stage','stage','--development-root','dev','--expected-version','0.8.6','--expected-manifest',hex('a')];
+  const plain=parseUpdateArgs(base);
+  assert.equal(plain.enableObservation,false);
+  const enabled=parseUpdateArgs([...base,'--enable-observation']);
+  assert.equal(enabled.enableObservation,true);
+  assert.throws(() => parseUpdateArgs([...base,'--enable-observation','--enable-observation']),/duplicate self-update argument/i);
+});
+
+test('R31 process-policy bootstrap accepts only an exact pinned enabled process policy', async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r31-process-bootstrap-'));
+  const file=path.join(root,'process-policy.json');
+  const policy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:'C:/old/grant.json',state_dir:'C:/old/state',native_host:{path:'C:/old/host.exe',sha256:hex('1')},roots:{core:{path:'C:/old/core',deny_paths:[]}},profiles:{probe:{executable:'C:/Windows/System32/ping.exe',executable_sha256:hex('2'),root_ids:['core'],prefix_args:[],max_args:0,max_arg_bytes:256,max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:[],input_actions:{}}}};
+  const bytes=Buffer.from(`${JSON.stringify(policy)}\n`,'utf8'); await writeFile(file,bytes);
+  assert.equal(typeof runtimeUpdate.prepareProcessPolicyBootstrap,'function');
+  const accepted=await runtimeUpdate.prepareProcessPolicyBootstrap({path:file,sha256:sha(bytes)});
+  assert.equal(accepted.sha256,sha(bytes));
+  assert.deepEqual(accepted.policy,policy);
+  await assert.rejects(runtimeUpdate.prepareProcessPolicyBootstrap({path:file,sha256:hex('f')}),/process policy.*SHA-256 mismatch/i);
+  const bad=path.join(root,'bad.json'); await writeFile(bad,JSON.stringify({...policy,enabled:false}));
+  await assert.rejects(runtimeUpdate.prepareProcessPolicyBootstrap({path:bad,sha256:sha(await readFile(bad))}),/process policy schema\/enabled/i);
+});
+
+test('R29 bridge bootstrap rebinds only the pinned external bridge script', async () => {
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r29-bridge-'));
+  const src=path.join(root,'src'); await mkdir(src,{recursive:true});
+  const script=Buffer.from('console.log("bridge-r29")\n','utf8');
+  await writeFile(path.join(src,'bridge.mjs'),script);
+  await writeFile(path.join(root,'package.json'),JSON.stringify({name:'deadbyte-chatgpt-bridge',version:'0.1.0'}));
+  const config={Bridge:{FilePath:process.execPath,FileSha256:sha(await readFile(process.execPath)),Arguments:'src\\bridge.mjs',WorkingDirectory:'C:/old',ScriptPath:'C:/old/src/bridge.mjs',ScriptSha256:hex('1')}};
+  assert.equal(typeof runtimeUpdate.prepareBridgeSpec,'function');
+  const rebound=await runtimeUpdate.prepareBridgeSpec(config,{root,scriptSha256:sha(script)});
+  assert.equal(rebound.Bridge.WorkingDirectory,path.resolve(root));
+  assert.equal(rebound.Bridge.Arguments,'src\\bridge.mjs');
+  assert.equal(rebound.Bridge.ScriptPath,path.join(path.resolve(root),'src','bridge.mjs'));
+  assert.equal(rebound.Bridge.ScriptSha256,sha(script));
+  assert.equal(rebound.Bridge.FilePath,config.Bridge.FilePath);
+  await assert.rejects(runtimeUpdate.prepareBridgeSpec(config,{root,scriptSha256:hex('f')}),/bridge script SHA-256 mismatch/i);
+});
+
+test('R31 updater threads pinned process policy and machine-FS enable into successor generation', async () => {
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/prepareProcessPolicyBootstrap\(processPolicyBootstrap\)/);
+  assert.match(source,/control\.processPolicy=.*\.policy/);
+  assert.match(source,/control\.config\.MachineFsRuntimeEnabled=true/);
+  assert.match(source,/processPolicy:control\.processPolicy/);
+  assert.match(source,/processPolicyBootstrap:args\.processPolicyBootstrap/);
+  assert.match(source,/enableMachineFs:args\.enableMachineFs/);
+});
+
+test('R31 rollback CLI requires one exact activation receipt without update arguments', () => {
+  assert.equal(typeof runtimeUpdate.parseRollbackArgs,'function');
+  assert.throws(() => runtimeUpdate.parseRollbackArgs([]), /--rollback-receipt/);
+  const parsed=runtimeUpdate.parseRollbackArgs(['--rollback-receipt','C:/evidence/receipt.json']);
+  assert.equal(parsed.activationReceipt,path.resolve('C:/evidence/receipt.json'));
+  assert.throws(() => runtimeUpdate.parseRollbackArgs(['--rollback-receipt','C:/evidence/receipt.json','--stage','x']), /unknown rollback argument/i);
+});
+
+test('R31 explicit rollback restores the exact signed prior pointer instead of regenerating it', async () => {
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/verifySlotUpdateEnvelope\(activationEnvelope,key\.publicKey\)/);
+  assert.match(source,/activationEnvelope\.body\.prior_pointer/);
+  assert.match(source,/verifyActiveInstallation\(state,priorPointer\)/);
+  assert.match(source,/atomicWriteActivePointer\(pointerInfo\.file,priorPointer\)/);
+  assert.match(source,/rollback_performed:true/);
+});
+
+test('R29 signed activation receipt preserves observed prior host authority', async () => {
+  const source=await readFile(new URL('../src/runtime-update.mjs',import.meta.url),'utf8');
+  assert.match(source,/host_armed:priorStatus\.host_armed/);
+  assert.doesNotMatch(source,/authority:\{prior:\{[^}]*host_armed:false/s);
+});

package/test/standing-grants.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { loadCodingPolicy, codingSessionStatus } from '../src/coding-plane.mjs';
+import { loadAutonomousPolicy, autonomousSessionStatus } from '../src/autonomous-policy.mjs';
+import { loadHostPolicy, assertHostArmed } from '../src/host-plane.mjs';
+import { createHash } from 'node:crypto';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const farFuture = new Date('2099-01-01T00:00:00Z');
+
+async function fixture() {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-standing-'));
+  const project = path.join(root, 'project');
+  await mkdir(project);
+  const codingPath = path.join(root, 'coding.json');
+  await writeFile(codingPath, JSON.stringify({ schema:'deadbyte.coding-policy.v1', enabled:true,
+    lease_file:path.join(root,'coding-grant.json'), evidence_dir:path.join(root,'coding-evidence'),
+    roots:{ project:{ path:project, read:true, write:true, exec:false, deny_paths:[] } }, commands:{} }));
+  const coding = await loadCodingPolicy(codingPath);
+  return { root, project, coding, codingPath };
+}
+test('coding standing grant remains armed until explicit revocation', async () => {
+  const { coding } = await fixture();
+  await writeFile(coding.lease_file, JSON.stringify({ schema:'deadbyte.coding-grant.v2',
+    policy_sha256:coding.policy_sha256, instance_nonce:'a'.repeat(64), root_ids:['project'],
+    granted_at_utc:'2026-09-04T00:00:00Z' }));
+  const status = await codingSessionStatus(coding, farFuture);
+  assert.equal(status.armed, true);
+  assert.equal(status.reason, 'standing-grant');
+  assert.equal(status.expires_at_utc, null);
+});
+
+test('autonomous standing grant remains armed until explicit revocation', async () => {
+  const { root, coding } = await fixture();
+  const policyPath = path.join(root, 'autonomous.json');
+  await writeFile(policyPath, JSON.stringify({ schema:'deadbyte.autonomous-policy.v1', enabled:true,
+    lease_file:path.join(root,'autonomous-grant.json'), evidence_dir:path.join(root,'autonomous-evidence'),
+    coding_policy_sha256:coding.policy_sha256, root_ids:['project'], planner:{backend:'client_sampling'},
+    limits:{max_iterations:4,max_mutations:4,max_wall_ms:null}, profiles:{} }));
+  const policy = await loadAutonomousPolicy(policyPath, coding);
+  await writeFile(policy.lease_file, JSON.stringify({ schema:'deadbyte.autonomous-grant.v2',
+    policy_sha256:policy.policy_sha256, coding_policy_sha256:coding.policy_sha256,
+    instance_nonce:'b'.repeat(64), root_ids:['project'], granted_at_utc:'2026-09-04T00:00:00Z' }));
+  const status = await autonomousSessionStatus(policy, farFuture);
+  assert.equal(status.armed, true);
+  assert.equal(status.reason, 'standing-grant');
+  assert.equal(status.expires_at_utc, null);
+});
+test('host standing grant remains armed until explicit revocation', async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), 'deadbyte-host-standing-'));
+  const project = path.join(root, 'project');
+  await mkdir(project);
+  const policyPath = path.join(root, 'host.json');
+  await writeFile(policyPath, JSON.stringify({ schema:'deadbyte.host-policy.v1', enabled:true,
+    arm_file:path.join(root,'host-grant.json'), roots:{ project:{path:project,read:true,write:true,exec:false} },
+    commands:{} }));
+  const policy = await loadHostPolicy(policyPath);
+  await writeFile(policy.arm_file, JSON.stringify({ schema:'deadbyte.host-grant.v2',
+    policy_sha256:policy.policy_sha256, instance_nonce:'c'.repeat(64), granted_at_utc:'2026-09-04T00:00:00Z' }));
+  const status = await assertHostArmed(policy, farFuture);
+  assert.equal(status.standing, true);
+  assert.equal(status.remaining_ms, null);
+});
+
+test('controller emits standing grants and hides expiry UX', async () => {
+  const controller = await import('node:fs/promises').then(fs => fs.readFile(
+    new URL('../controller/deadbyte-controller.ps1', import.meta.url), 'utf8'));
+  assert.match(controller, /deadbyte\.host-grant\.v2/);
+  assert.match(controller, /deadbyte\.coding-grant\.v2/);
+  assert.match(controller, /deadbyte\.autonomous-grant\.v2/);
+  assert.doesNotMatch(controller, /expires_at_utc/);
+  assert.doesNotMatch(controller, /AddMinutes\((?:15|30|60)\)/);
+  assert.doesNotMatch(controller, /expires=/);
+});

package/test/tool-audit.test.mjs

@@ -0,0 +1,134 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, readdir, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { createToolAudit, installToolAudit, sanitizeAuditArgs } from '../src/tool-audit.mjs';
+
+const Z='0'.repeat(64);
+const H1='1'.repeat(64);
+const H2='2'.repeat(64);
+const H3='3'.repeat(64);
+const H4='4'.repeat(64);
+const temp=()=>mkdtemp(path.join(os.tmpdir(),'deadbyte-audit-chain-'));
+const context=()=>({
+  release_id:'v0.8.7-test',release_manifest_sha256:H1,generation_id:'v0.8.7-test-gabc',generation_manifest_sha256:H2,
+  machine_id:H3,identity_generation:7,online_epoch:H4,
+  authority:{
+    process:{configured:true,armed:false,reason:'disarmed'},
+    coding:{configured:true,armed:true,reason:'standing-grant'},
+    autonomous:{configured:true,armed:true,reason:'standing-grant'},
+    host:{configured:true,armed:false,reason:'disarmed'}
+  }
+});
+async function keys(root){return generateTrustKeypair({privateKeyPath:path.join(root,'trust','private.pem'),publicKeyPath:path.join(root,'trust','public.pem')});}
+async function segmentFiles(root){return (await readdir(path.join(root,'audit'))).filter(n=>/^segment-\d{8}\.jsonl$/.test(n)).sort();}
+async function events(root){const out=[];for(const file of await segmentFiles(root)){const text=await readFile(path.join(root,'audit',file),'utf8');for(const line of text.trim().split(/\r?\n/)){if(line) out.push(JSON.parse(line));}}return out;}
+
+function fakeServer(){return {handlers:new Map(),registerTool(name,config,handler){this.handlers.set(name,handler);return {name,config};}};}
+
+test('sanitizer keeps useful identifiers, redacts secrets, and hashes payload/oversized values',()=>{
+  const huge='x'.repeat(3000);
+  const v=sanitizeAuditArgs({
+    root_id:'core',path:'src/main.js',command_id:'node_script',expected_sha256:H1,
+    content:'source bytes',old_string:'old bytes',nested:{api_token:'secret-token',authorization:'Bearer abc',safe:'yes'},huge
+  });
+  assert.equal(v.root_id,'core');
+  assert.equal(v.path,'src/main.js');
+  assert.equal(v.command_id,'node_script');
+  assert.equal(v.expected_sha256,H1);
+  assert.deepEqual(v.nested.api_token,{redacted:true,reason:'secret',byte_count:12});
+  assert.deepEqual(v.nested.authorization,{redacted:true,reason:'secret',byte_count:10});
+  assert.equal(v.nested.safe,'yes');
+  assert.equal(v.content.redacted,true);assert.equal(v.content.reason,'payload');assert.equal(v.content.byte_count,12);assert.match(v.content.sha256,/^[0-9a-f]{64}$/);
+  assert.equal(v.old_string.reason,'payload');assert.match(v.old_string.sha256,/^[0-9a-f]{64}$/);
+  assert.equal(v.huge.reason,'oversize');assert.equal(v.huge.byte_count,3000);assert.match(v.huge.sha256,/^[0-9a-f]{64}$/);
+});
+
+test('tool wrapper durably records request before handler and writes correlated result without raw output',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);let observedAuditBeforeHandler=false;
+    const audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context(),maxSegmentRecords:100});
+    const server=fakeServer();installToolAudit(server,audit);
+    server.registerTool('coding_file_write',{},async args=>{
+      const now=await events(root);observedAuditBeforeHandler=now.length===1&&now[0].event_type==='tool.request';
+      return {isError:false,structuredContent:{status:'committed',receipt_sha256:H2,content:'RAW RESULT MUST NOT APPEAR'},content:[{type:'text',text:'RAW RESULT MUST NOT APPEAR'}]};
+    });
+    await server.handlers.get('coding_file_write')({root_id:'core',path:'x',content:'TOP SECRET SOURCE'});
+    assert.equal(observedAuditBeforeHandler,true);
+    const all=await events(root);assert.equal(all.length,2);
+    assert.equal(all[0].seq,1);assert.equal(all[0].prev_sha256,Z);assert.equal(all[0].event_type,'tool.request');
+    assert.equal(all[1].seq,2);assert.equal(all[1].prev_sha256,all[0].event_sha256);assert.equal(all[1].event_type,'tool.result');
+    assert.equal(all[0].request_id,all[1].request_id);assert.equal(all[0].tool,'coding_file_write');assert.equal(all[1].tool,'coding_file_write');
+    assert.equal(all[0].context.release_manifest_sha256,H1);assert.equal(all[0].context.authority.coding.armed,true);
+    assert.equal(all[0].args.content.reason,'payload');
+    assert.equal(all[1].outcome.status,'committed');assert.equal(all[1].outcome.is_error,false);assert.deepEqual(all[1].outcome.receipt_sha256s,[H2]);
+    assert.ok(Number.isInteger(all[1].outcome.duration_ms)&&all[1].outcome.duration_ms>=0);
+    const bytes=await readFile(path.join(root,'audit',(await segmentFiles(root))[0]),'utf8');
+    assert.equal(bytes.includes('RAW RESULT MUST NOT APPEAR'),false);assert.equal(bytes.includes('TOP SECRET SOURCE'),false);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('audit failure before request commit prevents handler side effects',async()=>{
+  const server=fakeServer();let sideEffect=false;
+  installToolAudit(server,{async recordRequest(){throw new Error('audit unavailable');},async recordResult(){throw new Error('unexpected');}});
+  server.registerTool('mutate',{},async()=>{sideEffect=true;return {isError:false,structuredContent:{status:'ok'}};});
+  await assert.rejects(server.handlers.get('mutate')({path:'x'}),/audit unavailable/);
+  assert.equal(sideEffect,false);
+});
+
+test('thrown handler writes a hashed error outcome without raw error text',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);const audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context()});
+    const server=fakeServer();installToolAudit(server,audit);
+    server.registerTool('explode',{},async()=>{throw new Error('token=never-write-this');});
+    await assert.rejects(server.handlers.get('explode')({safe:'x'}),/never-write-this/);
+    const all=await events(root);assert.equal(all.length,2);const result=all[1];
+    assert.equal(result.outcome.status,'threw');assert.equal(result.outcome.is_error,true);assert.equal(result.outcome.error.name,'Error');
+    assert.match(result.outcome.error.sha256,/^[0-9a-f]{64}$/);assert.ok(result.outcome.error.byte_count>0);
+    const raw=JSON.stringify(result);assert.equal(raw.includes('never-write-this'),false);assert.equal(raw.includes('token='),false);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('record threshold seals immutable segment with signed checkpoint and preserves cross-segment chain',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);const audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context(),maxSegmentRecords:2,maxSegmentBytes:1024*1024});
+    const server=fakeServer();installToolAudit(server,audit);server.registerTool('read',{},async()=>({isError:false,structuredContent:{status:'ok'}}));
+    await server.handlers.get('read')({path:'a'});await server.handlers.get('read')({path:'b'});
+    const files=await segmentFiles(root);assert.deepEqual(files,['segment-00000001.jsonl','segment-00000002.jsonl']);
+    const cpFiles=(await readdir(path.join(root,'audit'))).filter(n=>/^checkpoint-\d{8}\.json$/.test(n)).sort();assert.deepEqual(cpFiles,['checkpoint-00000001.json','checkpoint-00000002.json']);
+    const first=(await readFile(path.join(root,'audit',files[0]),'utf8')).trim().split(/\r?\n/).map(JSON.parse);
+    const second=(await readFile(path.join(root,'audit',files[1]),'utf8')).trim().split(/\r?\n/).map(JSON.parse);
+    assert.equal(first.length,2);assert.equal(second.length,2);assert.equal(second[0].prev_sha256,first[1].event_sha256);
+    const cp1=JSON.parse(await readFile(path.join(root,'audit',cpFiles[0]),'utf8'));const cp2=JSON.parse(await readFile(path.join(root,'audit',cpFiles[1]),'utf8'));
+    assert.equal(cp1.schema,'deadbyte.tool-audit-checkpoint.v1');assert.equal(cp1.first_seq,1);assert.equal(cp1.last_seq,2);assert.equal(cp1.head_sha256,first[1].event_sha256);
+    assert.equal(cp2.first_seq,3);assert.equal(cp2.last_seq,4);assert.equal(cp2.previous_checkpoint_sha256,cp1.checkpoint_sha256);
+    assert.equal(cp1.attestation.algorithm,'ed25519');assert.match(cp1.attestation.signature_base64,/^[A-Za-z0-9+/]+=*$/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('writer restart resumes an unsealed segment without resetting seq or chain head',async()=>{
+  const root=await temp();
+  try{
+    const k=await keys(root);
+    let audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context(),maxSegmentRecords:100});
+    let token=await audit.recordRequest('one',{x:1});await audit.recordResult(token,{isError:false,structuredContent:{status:'ok'}},null,1);
+    audit=await createToolAudit({stateRoot:root,signingKeyPath:k.privateKeyPath,contextProvider:async()=>context(),maxSegmentRecords:100});
+    token=await audit.recordRequest('two',{x:2});await audit.recordResult(token,{isError:false,structuredContent:{status:'ok'}},null,1);
+    const all=await events(root);assert.deepEqual(all.map(e=>e.seq),[1,2,3,4]);assert.equal(all[2].prev_sha256,all[1].event_sha256);assert.equal(all[2].request_id,all[3].request_id);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+
+test('controller enables audit only for Bridge child and restores parent audit environment',async()=>{
+  const source=await readFile(path.resolve('controller/deadbyte-controller.ps1'),'utf8');
+  assert.match(source,/\$hadAuditRuntimeEnv = Test-Path Env:DEADBYTE_AUDIT_RUNTIME/);
+  assert.match(source,/if \(\$Name -eq 'Bridge' -and \$Cfg\)/);
+  assert.match(source,/\$env:DEADBYTE_AUDIT_RUNTIME = '1'/);
+  assert.match(source,/if \(\$hadAuditRuntimeEnv\) \{ \$env:DEADBYTE_AUDIT_RUNTIME = \$previousAuditRuntimeEnv \}/);
+  assert.match(source,/else \{ Remove-Item Env:DEADBYTE_AUDIT_RUNTIME -ErrorAction SilentlyContinue \}/);
+});