ToolsEnabled Bench 0.3.3 (beta)

ToolsEnabled Bench 0.3.3 beta fixes four correctness and data-safety problems in the generic local benchmark builder. It is separate from Engine Bench and Head Gasket Bench. MIT licensed.

• Trusted analysis and reference generation refuse linked output paths and replace derived files atomically, preserving files outside received studies.
• Malformed received responses stop collection without redrawing an answer, with or without an observation plan. Real transport failures retain the frozen retry policy.
• Runnable exports require all pinned input bytes before reporting success.
• Incomplete or damaged run records remain visible with warnings while healthy runs stay available.

Installation now has Linux/macOS shell and Windows PowerShell instructions, local security/privacy notes, direct MCP registration and current version references. The previously documented marketplace is unavailable; no marketplace or native Desktop bundle is claimed. The exact MCP SDK pin is 1.32.1; its upstream OAuth-client advisory excludes Bench's stdio-server path, and the root application dependency audit reports no known vulnerabilities.

With Node.js 22.19 or later, download the runtime ZIP and its .sha256, verify it, extract into a fresh folder, and run node tools/release.mjs --verify inside the versioned directory. Follow README.md for your shell and choose a private data folder outside the installation. The prebuilt runtime needs no npm install or account. Both worked examples use authored recorded responses and make no live-model performance claim.

Qualification on the tagged source: 585/585 Node tests, no failures/cancellations/skips; full browser review and damaged-run browser regression; independent clean-folder dashboard, exported CLI and MCP workflows; two clean-source builds and extracted-runtime repack byte-identical. Safety/correctness regressions include deliberate RED/restored-GREEN mutation checks. No paid model API calls were used.

Linux qualified. Native macOS, Windows and Claude Desktop acceptance, optional native Lean/Docker campaigns, and live-model collection remain unverified. Declared execution has the current user's filesystem/network permissions; hashes and confirmation are not an OS sandbox. New freezes record generator 0.3.3; original frozen studies keep their own runtime and identities.

Optional Desktop build tooling is excluded from the runtime and is not installed by the root npm ci. Its tmp dependency is patched to 0.2.7. The separate toolchain still has an upstream node-forge signature-verification advisory with no patched release; Bench only invokes unsigned pack, and publishes no MCPB. See tools/mcpb-build/README.md in the tagged source for that open development-only limitation.

Source: 988e6705cfa66cbac7176f99b59b8e9760b2dd9d (main = tag v0.3.3).

Runtime ZIP SHA-256: ece76defcbd817262faff6a8391f5b77fe17343359733e1129c21677e7afdce2 (7859381 bytes).

Install and host notes · Security · Privacy · Optional build-tool advisory

The release includes the runtime ZIP and sidecar, complete source archive, SOURCE-MANIFEST.json, SOURCE-PINS.json, VERIFICATION.json and SHA256SUMS. Source and runtime exclude private owner coordination and research data. Checksums establish integrity, not publisher authentication.

Passing exact-source CI. Download-back verification is performed after publication.