@kortix/agent-tunnel 0.13.53 → 0.13.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kortix/agent-tunnel",
-  "version": "0.13.53",
+  "version": "0.13.55",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kortix-ai/suna.git",

package/src/agent/access.test.ts

@@ -5,7 +5,16 @@ import { join } from 'node:path';
 
 import {
   ACCESS_HOLD_MS,
+  accessCommand,
   accessFilePath,
+  accessView,
+  accessWidens,
+  applyAccess,
+  nextAccess,
+  parseAccessChange,
+  readAccessRequest,
+  type AccessChange,
+  type AccessState,
   accessRequestPath,
   decideAccess,
   keepAwakeCommand,
@@ -162,3 +171,83 @@ describe('keep awake', () => {
     expect(keepAwakeCommand('win32', 42)).toBeNull();
   });
 });
+
+describe('the access rules (one copy: the CLI, the agent, and the desktop app all use these)', () => {
+  const now = Date.parse('2030-01-01T12:00:00.000Z');
+  const ask = { mode: 'ask' as const, grantedUntil: null, deniedUntil: null, keepAwake: false };
+
+  test('grants (max 24 h), revokes, denies for 10 minutes, switches mode and keep awake', () => {
+    expect(nextAccess(ask, { grantMinutes: 60 }, now)).toMatchObject({ grantedUntil: '2030-01-01T13:00:00.000Z', deniedUntil: null });
+    expect(nextAccess(ask, { grantMinutes: 10_000 }, now).grantedUntil).toBe('2030-01-02T12:00:00.000Z');
+    expect(nextAccess({ ...ask, grantedUntil: 'x' }, { revoke: true }, now).grantedUntil).toBeNull();
+    expect(nextAccess(ask, { deny: true }, now)).toMatchObject({ grantedUntil: null, deniedUntil: '2030-01-01T12:10:00.000Z' });
+    expect(nextAccess(ask, { mode: 'off', keepAwake: true }, now)).toMatchObject({ mode: 'off', keepAwake: true });
+    expect(() => nextAccess(ask, { mode: 'sometimes' as never }, now)).toThrow(/mode/);
+    expect(() => nextAccess(ask, { grantMinutes: 0 }, now)).toThrow(/grantMinutes/);
+    // A mode change drops the old grant and denial: back to "Ask each time" asks again.
+    const granted = { mode: 'off' as const, grantedUntil: '2030-01-01T20:00:00.000Z', deniedUntil: '2030-01-01T12:05:00.000Z', keepAwake: false };
+    expect(nextAccess(granted, { mode: 'ask' }, now)).toMatchObject({ mode: 'ask', grantedUntil: null, deniedUntil: null });
+  });
+
+  test('only `always` and a longer grant widen access; everything else narrows', () => {
+    const widens = (current: typeof ask | AccessState, change: AccessChange) => accessWidens(current, nextAccess(current, change, now), now);
+    expect(widens(ask, { mode: 'always' })).toBe(true);
+    expect(widens(ask, { grantMinutes: 1440 })).toBe(true);
+    expect(widens({ ...ask, grantedUntil: '2030-01-01T18:00:00.000Z' }, { grantMinutes: 60 })).toBe(false);
+    expect(widens({ ...ask, mode: 'off' }, { mode: 'ask' })).toBe(false);
+    expect(widens({ ...ask, mode: 'always' }, { mode: 'ask' })).toBe(false);
+    expect(widens(ask, { mode: 'off' })).toBe(false);
+    expect(widens({ ...ask, grantedUntil: '2030-01-01T13:00:00.000Z' }, { revoke: true })).toBe(false);
+    expect(widens(ask, { keepAwake: true })).toBe(false);
+    expect(widens(ask, { deny: true })).toBe(false);
+  });
+
+  test('a relayed change keeps only known fields with their types', () => {
+    expect(parseAccessChange({ mode: 'off', keepAwake: false, extra: 1 })).toEqual({ mode: 'off', keepAwake: false });
+    expect(() => parseAccessChange({ mode: 'sometimes' })).toThrow(/mode/);
+    expect(() => parseAccessChange({ grantMinutes: '60' })).toThrow(/grantMinutes/);
+    expect(() => parseAccessChange({ revoke: 'yes' })).toThrow(/revoke/);
+    expect(() => parseAccessChange({})).toThrow(/No access change/);
+    expect(() => parseAccessChange(null)).toThrow(/No access change/);
+  });
+
+  test('names the terminal command for a change', () => {
+    expect(accessCommand({ mode: 'always' })).toBe('npx @kortix/agent-tunnel@latest access always');
+    expect(accessCommand({ grantMinutes: 60 })).toBe('npx @kortix/agent-tunnel@latest access --allow-for 60');
+    expect(accessCommand({ keepAwake: true })).toBe('npx @kortix/agent-tunnel@latest keep-awake on');
+  });
+
+  test('the view shows a pending request while it is fresh, and no lapsed grant or denial', () => {
+    const home = tempHome();
+    writeAccess({ ...ask, grantedUntil: '2030-01-01T11:00:00.000Z', deniedUntil: '2030-01-01T11:30:00.000Z' }, home);
+    const fresh = { id: 'r1', capability: 'filesystem', method: 'fs.list', requestedAt: new Date(now - 5_000).toISOString() };
+    writeFileSync(accessRequestPath(home), JSON.stringify(fresh));
+    expect(accessView(home, 'darwin', now)).toEqual({
+      ...ask,
+      keepAwakeSupported: true,
+      pendingRequest: { id: 'r1', capability: 'filesystem', requestedAt: fresh.requestedAt },
+    });
+    expect(accessView(home, 'darwin', now + 120_000).pendingRequest).toBeNull();
+    expect(accessView(home, 'win32', now).keepAwakeSupported).toBe(false);
+  });
+
+  test('applying a change answers the request asked before it; deny on a relayed change only declines it', () => {
+    const home = tempHome();
+    writeAccess(ask, home);
+    writeAccessRequest({ capability: 'filesystem', method: 'fs.list' }, home);
+    expect(applyAccess({ keepAwake: true }, home).pendingRequest).not.toBeNull();
+    expect(applyAccess({ grantMinutes: 60 }, home)).toMatchObject({ pendingRequest: null, keepAwake: true });
+    expect(readAccess(home).grantedUntil).not.toBeNull();
+
+    writeAccessRequest({ capability: 'access', method: 'tunnel.access.set', change: { mode: 'always' } }, home);
+    const declined = applyAccess({ deny: true }, home);
+    expect(declined.pendingRequest).toBeNull();
+    // Declining a change is not a denial of calls: the grant stays.
+    expect(declined.deniedUntil).toBeNull();
+    expect(declined.grantedUntil).not.toBeNull();
+
+    writeAccessRequest({ capability: 'shell', method: 'shell.exec' }, home);
+    expect(applyAccess({ deny: true }, home)).toMatchObject({ pendingRequest: null, grantedUntil: null });
+    expect(readAccess(home).deniedUntil).not.toBeNull();
+  });
+});

package/src/agent/access.ts

@@ -1,6 +1,7 @@
 import { spawn } from 'child_process';
 import { randomUUID } from 'crypto';
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'fs';
+import { platform } from 'os';
 import { isAbsolute, join } from 'path';
 
 import { agentTunnelHome } from './service-paths';
@@ -8,9 +9,11 @@ import { agentTunnelHome } from './service-paths';
 /**
  * AnyDesk-style access control, enforced on this machine (contract v2 §A).
  *
- * `<home>/access.json` is the owner's standing answer. The desktop app writes
- * it (grant, deny, mode); the agent reads it before every call. A machine
- * without the file predates access control and stays `always`.
+ * `<home>/access.json` is the owner's standing answer. Only this package
+ * writes it: the `access` and `keep-awake` commands (the terminal, and the
+ * desktop app, which runs them), and the agent itself for a change relayed by
+ * Kortix. The agent reads it before every call. A machine without the file
+ * predates access control and stays `always`.
  */
 export type AccessMode = 'ask' | 'always' | 'off';
 
@@ -21,11 +24,34 @@ export interface AccessState {
   keepAwake: boolean;
 }
 
+/** One owner action. `deny` answers the pending request with No. */
+export interface AccessChange {
+  mode?: AccessMode;
+  /** Allow for this many minutes (at most 24 h). */
+  grantMinutes?: number;
+  /** End the current grant now. */
+  revoke?: boolean;
+  deny?: boolean;
+  keepAwake?: boolean;
+}
+
+/**
+ * A question for the owner on this machine: an agent call that waits for an
+ * answer, or (`change`) a wider access asked for through Kortix, which only
+ * the owner on this machine may confirm.
+ */
 export interface AccessRequest {
   id: string;
   requestedAt: string;
   capability: string;
   method: string;
+  change?: AccessChange;
+}
+
+/** What `access --json`, `status --json`, and the report to Kortix show. */
+export interface AccessView extends AccessState {
+  keepAwakeSupported: boolean;
+  pendingRequest: Pick<AccessRequest, 'id' | 'capability' | 'requestedAt' | 'change'> | null;
 }
 
 /** How long a call waits for the owner to answer the prompt. */
@@ -34,6 +60,13 @@ export const ACCESS_HOLD_MS = 20_000;
 export const DESKTOP_APP_HEARTBEAT_MS = 30_000;
 /** A grant never lasts longer than this, whatever the file says. */
 export const MAX_GRANT_MS = 24 * 3_600_000;
+/** "Deny" refuses calls for this long. */
+export const DENY_MS = 10 * 60_000;
+/**
+ * A request is shown to the owner this long. Longer than the hold: a late
+ * answer still applies to the agent's next try.
+ */
+export const REQUEST_FRESH_MS = 60_000;
 
 const MODES: readonly AccessMode[] = ['ask', 'always', 'off'];
 const COMPAT: AccessState = { mode: 'always', grantedUntil: null, deniedUntil: null, keepAwake: false };
@@ -90,8 +123,117 @@ export function decideAccess(state: AccessState, now = Date.now()): AccessDecisi
   return granted > now && granted - now <= MAX_GRANT_MS ? 'run' : 'ask';
 }
 
+const keepAwakeSupported = (os: NodeJS.Platform) => os === 'darwin' || os === 'linux';
+
+/** A change as Kortix relays it: only the known fields, each with its type. Throws otherwise. */
+export function parseAccessChange(params: unknown): AccessChange {
+  const raw = (params && typeof params === 'object' ? params : {}) as Record<string, unknown>;
+  const change: AccessChange = {};
+  if (raw.mode !== undefined) {
+    if (!MODES.includes(raw.mode as AccessMode)) throw new Error(`mode must be one of ${MODES.join(', ')}`);
+    change.mode = raw.mode as AccessMode;
+  }
+  if (raw.grantMinutes !== undefined) {
+    if (typeof raw.grantMinutes !== 'number' || !(raw.grantMinutes > 0)) throw new Error('grantMinutes must be a positive number');
+    change.grantMinutes = raw.grantMinutes;
+  }
+  for (const key of ['revoke', 'deny', 'keepAwake'] as const) {
+    if (raw[key] === undefined) continue;
+    if (typeof raw[key] !== 'boolean') throw new Error(`${key} must be true or false`);
+    change[key] = raw[key] as boolean;
+  }
+  if (Object.keys(change).length === 0) throw new Error('No access change given');
+  return change;
+}
+
+/** The terminal command that makes `change` on this machine. */
+export function accessCommand(change: AccessChange): string {
+  const npx = 'npx @kortix/agent-tunnel@latest';
+  if (change.keepAwake !== undefined && Object.keys(change).length === 1) return `${npx} keep-awake ${change.keepAwake ? 'on' : 'off'}`;
+  const args = [change.mode, change.grantMinutes !== undefined ? `--allow-for ${change.grantMinutes}` : undefined];
+  return [`${npx} access`, ...args.filter(Boolean)].join(' ');
+}
+
+/** One owner action applied to the current state. Throws on bad input. */
+export function nextAccess(current: AccessState, change: AccessChange, now = Date.now()): AccessState {
+  const next = { ...current };
+  if (change.mode !== undefined) {
+    if (!MODES.includes(change.mode)) throw new Error(`mode must be one of ${MODES.join(', ')}`);
+    // A grant or denial belongs to the mode it was given in: switching back
+    // to "Ask each time" must ask again.
+    if (change.mode !== current.mode) {
+      next.grantedUntil = null;
+      next.deniedUntil = null;
+    }
+    next.mode = change.mode;
+  }
+  if (change.grantMinutes !== undefined) {
+    const minutes = Number(change.grantMinutes);
+    if (!Number.isFinite(minutes) || minutes <= 0) throw new Error('grantMinutes must be a positive number');
+    next.grantedUntil = new Date(now + Math.min(minutes * 60_000, MAX_GRANT_MS)).toISOString();
+    next.deniedUntil = null;
+  }
+  if (change.revoke === true) next.grantedUntil = null;
+  if (change.deny === true) {
+    next.grantedUntil = null;
+    next.deniedUntil = new Date(now + DENY_MS).toISOString();
+  }
+  if (change.keepAwake !== undefined) next.keepAwake = change.keepAwake === true;
+  return next;
+}
+
+/**
+ * True when `next` lets calls run that `current` does not: `always` from
+ * another mode, or a grant that reaches further. Only the owner on this
+ * machine may widen access; Kortix may only narrow it.
+ */
+export function accessWidens(current: AccessState, next: AccessState, now = Date.now()): boolean {
+  if (next.mode === 'always') return current.mode !== 'always';
+  if (next.mode !== 'ask') return false;
+  const reach = (state: AccessState) =>
+    state.mode === 'ask' && decideAccess(state, now) === 'run' ? Date.parse(state.grantedUntil!) : 0;
+  return reach(next) > reach(current);
+}
+
+/** The pending request, while the owner can still usefully answer it. */
+export function pendingAccessRequest(home = agentTunnelHome(), now = Date.now()): AccessRequest | null {
+  const request = readAccessRequest(home);
+  return request && now - Date.parse(request.requestedAt) < REQUEST_FRESH_MS ? request : null;
+}
+
+export function accessView(home = agentTunnelHome(), os: NodeJS.Platform = platform(), now = Date.now()): AccessView {
+  const state = readAccess(home);
+  const request = pendingAccessRequest(home, now);
+  return {
+    ...state,
+    // A lapsed grant or denial is none: every reader sees the same answer.
+    grantedUntil: state.grantedUntil && Date.parse(state.grantedUntil) > now ? state.grantedUntil : null,
+    deniedUntil: state.deniedUntil && Date.parse(state.deniedUntil) > now ? state.deniedUntil : null,
+    keepAwakeSupported: keepAwakeSupported(os),
+    pendingRequest: request
+      ? { id: request.id, capability: request.capability, requestedAt: request.requestedAt, ...(request.change ? { change: request.change } : {}) }
+      : null,
+  };
+}
+
+/**
+ * One access change applied as given: the owner's own hand (the `access` and
+ * `keep-awake` commands), or a narrowing relayed by Kortix. It answers the
+ * pending request: a relayed change that `deny` declines is dropped without
+ * refusing calls; a call request is answered.
+ */
+export function applyAccess(change: AccessChange, home = agentTunnelHome(), now = Date.now()): AccessView {
+  const request = readAccessRequest(home);
+  const declinesChange = change.deny === true && Boolean(request?.change);
+  const own = declinesChange ? { ...change, deny: undefined } : change;
+  writeAccess(nextAccess(readAccess(home), own, now), home);
+  const answers = own.mode !== undefined || own.grantMinutes !== undefined || change.deny === true;
+  if (request && answers && !(Date.parse(request.requestedAt) > now)) rmSync(accessRequestPath(home), { force: true });
+  return accessView(home, platform(), now);
+}
+
 export function writeAccessRequest(
-  input: { capability: string; method: string },
+  input: { capability: string; method: string; change?: AccessChange },
   home = agentTunnelHome(),
 ): AccessRequest {
   const request: AccessRequest = { id: randomUUID(), requestedAt: new Date().toISOString(), ...input };

package/src/agent/agent.test.ts

@@ -135,11 +135,11 @@ describe('TunnelAgent auth close handling', () => {
 
 // ── v2: reliability (R1, R2, R4), access control (A2, A3) and X2 ───────────
 
-import { mkdtempSync, rmSync, existsSync as fileExists } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync, existsSync as fileExists } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { reconnectDelay } from './agent';
-import { writeAccess, accessRequestPath, readAccessRequest } from './access';
+import { applyAccess, writeAccess, accessRequestPath, readAccess, readAccessRequest } from './access';
 import { signMessage } from '../shared/crypto';
 
 const SIGNING_KEY = 'test-signing-key';
@@ -527,11 +527,19 @@ describe('machine-side access control (A2, A3, X1, X2)', () => {
       writeAccess({ mode: 'ask', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
       await withOnlineAgent(home, async (relay) => {
         await until(() => relay.notifications('tunnel.access.state').length === 1);
-        expect(relay.notifications('tunnel.access.state')[0].params).toEqual({ mode: 'ask', grantedUntil: null });
+        expect(relay.notifications('tunnel.access.state')[0].params).toEqual({
+          mode: 'ask',
+          grantedUntil: null,
+          deniedUntil: null,
+          keepAwake: false,
+          keepAwakeSupported: process.platform !== 'win32',
+          pendingRequest: null,
+          desktopPermissions: null,
+        });
         expect(typeof relay.notifications('tunnel.access.state')[0]._sig).toBe('string');
         writeAccess({ mode: 'off', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
         await until(() => relay.notifications('tunnel.access.state').length === 2);
-        expect(relay.notifications('tunnel.access.state')[1].params).toEqual({ mode: 'off', grantedUntil: null });
+        expect(relay.notifications('tunnel.access.state')[1].params).toMatchObject({ mode: 'off', grantedUntil: null });
       });
     } finally {
       rmSync(home, { recursive: true, force: true });
@@ -539,6 +547,128 @@ describe('machine-side access control (A2, A3, X1, X2)', () => {
   });
 });
 
+describe('access changes relayed by Kortix (tunnel.access.set)', () => {
+  async function withAgent(home: string, run: (relay: FakeRelay) => Promise<void>, registry = new CapabilityRegistry()) {
+    FakeRelay.sockets = [];
+    globalThis.WebSocket = FakeRelay as unknown as typeof WebSocket;
+    const agent = new TunnelAgent(loadConfig(TEST_CONFIG), registry, {}, { home, accessHoldMs: 600, watchdogIntervalMs: 20 });
+    await quiet(async () => {
+      try {
+        agent.connect();
+        await until(() => FakeRelay.sockets[0]?.sent.some((m) => m.type === 'auth') === true);
+        await until(() => FakeRelay.sockets[0]!.notifications('tunnel.access.state').length >= 1);
+        await run(FakeRelay.sockets[0]!);
+      } finally {
+        agent.disconnect();
+        rmSync(home, { recursive: true, force: true });
+      }
+    });
+  }
+  const set = (relay: FakeRelay, id: string, params: Record<string, unknown>) =>
+    relay.deliverSigned({ jsonrpc: '2.0', id, method: 'tunnel.access.set', params });
+  /** A desktop app that is running: the agent will not launch anything. */
+  const runningApp = (home: string) =>
+    writeFileSync(join(home, 'desktop-app.json'), JSON.stringify({ command: process.execPath, args: [], pid: process.pid, env: {} }));
+
+  test('says in its handshake that it serves access changes', async () => {
+    await withAgent(mkdtempSync(join(tmpdir(), 'agent-tunnel-set-')), async (relay) => {
+      expect(relay.sent.find((m) => m.type === 'auth')).toMatchObject({ reportsAccess: true, controlsAccess: true });
+    });
+  });
+
+  test('a narrowing applies at once, even while access is off, and reports the new state', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'agent-tunnel-set-'));
+    writeAccess({ mode: 'off', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
+    await withAgent(home, async (relay) => {
+      set(relay, 's1', { mode: 'ask', keepAwake: true });
+      await until(() => relay.responses('s1').length === 1);
+      expect(relay.responses('s1')[0].result).toMatchObject({ mode: 'ask', keepAwake: true, pendingRequest: null });
+      expect(readAccess(home)).toMatchObject({ mode: 'ask', keepAwake: true });
+      await until(() => relay.notifications('tunnel.access.state').some((n) => n.params.mode === 'ask'));
+    });
+  });
+
+  test('a widening without the desktop app is refused with the command to run on the computer', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'agent-tunnel-set-'));
+    writeAccess({ mode: 'ask', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
+    await withAgent(home, async (relay) => {
+      set(relay, 's1', { mode: 'always' });
+      await until(() => relay.responses('s1').length === 1);
+      expect(relay.responses('s1')[0].error.code).toBe(-32014);
+      expect(relay.responses('s1')[0].error.message).toContain('npx @kortix/agent-tunnel@latest access always');
+      expect(readAccess(home).mode).toBe('ask');
+      expect(readAccessRequest(home)).toBeNull();
+    });
+  });
+
+  test('a widening waits for the owner on the computer: allowed there, it returns the new state', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'agent-tunnel-set-'));
+    writeAccess({ mode: 'ask', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
+    runningApp(home);
+    await withAgent(home, async (relay) => {
+      set(relay, 's1', { mode: 'always' });
+      await until(() => readAccessRequest(home)?.change?.mode === 'always');
+      // Kortix sees what the owner is asked.
+      await until(() => relay.notifications('tunnel.access.state').some((n) => n.params.pendingRequest?.change?.mode === 'always'));
+      // The desktop app runs `access always` after the owner clicks Allow.
+      applyAccess({ mode: 'always' }, home);
+      await until(() => relay.responses('s1').length === 1);
+      expect(relay.responses('s1')[0].result).toMatchObject({ mode: 'always', pendingRequest: null });
+    });
+  });
+
+  test('a widening the owner declines, or nobody answers, is refused and changes nothing', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'agent-tunnel-set-'));
+    writeAccess({ mode: 'ask', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
+    runningApp(home);
+    await withAgent(home, async (relay) => {
+      set(relay, 's1', { grantMinutes: 60 });
+      await until(() => readAccessRequest(home) !== null);
+      applyAccess({ deny: true }, home);
+      await until(() => relay.responses('s1').length === 1);
+      expect(relay.responses('s1')[0].error).toMatchObject({ code: -32014 });
+      expect(relay.responses('s1')[0].error.message).toContain('declined');
+      // Declining a change does not refuse calls.
+      expect(readAccess(home)).toMatchObject({ grantedUntil: null, deniedUntil: null });
+
+      set(relay, 's2', { mode: 'always' });
+      await until(() => relay.responses('s2').length === 1, 3_000);
+      expect(relay.responses('s2')[0].error.message).toContain('Nobody confirmed');
+      expect(readAccessRequest(home)).toBeNull();
+      expect(readAccess(home).mode).toBe('ask');
+    });
+  });
+
+  test('bad input is refused without touching access.json', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'agent-tunnel-set-'));
+    writeAccess({ mode: 'ask', grantedUntil: null, deniedUntil: null, keepAwake: false }, home);
+    await withAgent(home, async (relay) => {
+      set(relay, 's1', { mode: 'sometimes' });
+      await until(() => relay.responses('s1').length === 1);
+      expect(relay.responses('s1')[0].error.message).toContain('mode');
+      expect(readAccess(home).mode).toBe('ask');
+    });
+  });
+
+  test('reports the macOS permissions as this process holds them', async () => {
+    const registry = new CapabilityRegistry();
+    registry.register({
+      name: 'desktop',
+      methods: new Map([
+        ['desktop.cua.call', async (params: Record<string, unknown>) => {
+          expect(params).toMatchObject({ tool: 'check_permissions', __permission: { capability: 'desktop' } });
+          return { accessibility: true, screen_recording: false };
+        }],
+      ]),
+    });
+    await withAgent(mkdtempSync(join(tmpdir(), 'agent-tunnel-probe-')), async (relay) => {
+      await until(() => relay.notifications('tunnel.access.state').some((n) => n.params.desktopPermissions));
+      const last = relay.notifications('tunnel.access.state').at(-1)!;
+      expect(last.params.desktopPermissions).toEqual({ accessibility: true, screenRecording: false });
+    }, registry);
+  });
+});
+
 describe('contract v2 review fixes', () => {
   test('standby backs off, doubling, so two holders of one credential stop trading the socket', async () => {
     globalThis.WebSocket = closingWebSocket(4004, 'replaced') as unknown as typeof WebSocket;
@@ -624,9 +754,9 @@ describe('contract v2 review fixes', () => {
       try {
         agent.connect();
         await until(() => FakeRelay.sockets[0]?.notifications('tunnel.access.state').length === 1);
-        expect(FakeRelay.sockets[0]!.notifications('tunnel.access.state')[0].params).toEqual({ mode: 'ask', grantedUntil: grant });
+        expect(FakeRelay.sockets[0]!.notifications('tunnel.access.state')[0].params).toMatchObject({ mode: 'ask', grantedUntil: grant });
         await until(() => FakeRelay.sockets[0]!.notifications('tunnel.access.state').length === 2, 2_000);
-        expect(FakeRelay.sockets[0]!.notifications('tunnel.access.state')[1].params).toEqual({ mode: 'ask', grantedUntil: null });
+        expect(FakeRelay.sockets[0]!.notifications('tunnel.access.state')[1].params).toMatchObject({ mode: 'ask', grantedUntil: null });
       } finally {
         agent.disconnect();
         rmSync(home, { recursive: true, force: true });