@remcp/runtime 0.2.236 → 0.2.237

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.2.237 — 2026-11-06
+
+- Detect Windows Session 0 without enumerating users or modifying Windows login/security settings, and report native desktop_session unavailable when no interactive process desktop exists.
+- Hide native Windows GUI, capture and recording tools from advertised capability lists in Session 0 while retaining terminal, filesystem, document and independently available CDP/browser tools.
+- Fail closed before invoking native desktop actions, screenshots and recording, including mixed action preflights.
+- Cache only capability discovery, never action authorization; emit one atomic tools/list_changed notification when browser availability changes.
+- Gate an experimental Linux WebRTC Stop acknowledgement on confirmed exit of its directly owned Python media worker, with bounded SIGTERM/SIGKILL escalation and fail-closed local admission. Do not equate this with signed process-tree or macOS/Windows native Stop proof; the feature remains off by default.
+- Preserve runtime protocol compatibility and the published 0.2.235/0.2.236 fixes. Locked-user and background service session transitions require further native validation.
+
 ## 0.2.236 — 2026-11-05
 
 - Report CDP readiness only for eligible page targets and classify configured unavailable CDP connections with bounded diagnostics.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remcp/runtime",
-  "version": "0.2.236",
+  "version": "0.2.237",
   "description": "First-party ReMCP local device runtime: filesystem, terminal, computer-use, browser, diagnostics and document tools over MCP.",
   "type": "module",
   "license": "MIT",

package/src/compact-catalog.mjs

@@ -1,5 +1,6 @@
-import { TEXT_OUTPUT_SCHEMA, supportedCoreTools, toolDefinitions } from './catalog.mjs';
-import { advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { TEXT_OUTPUT_SCHEMA, toolDefinitions } from './catalog.mjs';
+import { extendedToolDefinitions } from './extended/catalog.mjs';
+import { supportedRuntimeToolDefinitions } from './tool-availability.mjs';
 
 export const compactRuntimeGroups = Object.freeze({
   manage_files: Object.freeze([
@@ -126,11 +127,8 @@ function groupedDefinition(name, members) {
 }
 
 export async function supportedRuntimeOperationNames() {
-  const supportedExtended = new Set((await advertisedExtendedTools()).map(tool => tool.name));
-  return new Set([
-    ...supportedCoreTools().map(tool => tool.name),
-    ...extendedToolDefinitions.filter(tool => supportedExtended.has(tool.name)).map(tool => tool.name),
-  ]);
+  const { core, extended } = await supportedRuntimeToolDefinitions();
+  return new Set([...core, ...extended].map(tool => tool.name));
 }
 
 export async function compactRuntimeToolDefinitions() {

package/src/extended/catalog.mjs

@@ -11,6 +11,7 @@ import { isWaylandSession } from '../screenshot-portal.mjs';
 import { waylandPortalCandidate } from '../wayland-remote-desktop.mjs';
 import { commandExists, desktopSessionAvailable, runFile } from './common.mjs';
 import { desktopHandlers } from './desktop.mjs';
+import { cachedWindowsDesktopSessionStatus } from './desktop-windows-session.mjs';
 import { displayInventoryAvailable, regionScreenshotBackends } from './desktop-linux.mjs';
 import { hydrateLinuxDesktopEnv } from './desktop-linux-session-env.mjs';
 import { diagnosticHandlers, gnomeScreencastSupported, recordScreenAvailable } from './diagnostics.mjs';
@@ -254,6 +255,24 @@ export function documentCapabilitySnapshot({
   };
 }
 
+// A paired Windows service may be online in Session 0 while native desktop
+// tools are impossible. Keep computer_snapshot and CDP discoverable; they
+// provide their own unavailable status and/or browser-only operation.
+export const WINDOWS_SESSION_SCOPED_CAPABILITIES = Object.freeze([
+  'desktop_session', 'desktop_open', 'windows', 'ui', 'input', 'pointer',
+  'drag', 'clipboard', 'displays', 'screen_region', 'notifications', 'record',
+]);
+
+export function limitWindowsSessionCapabilities(capabilities, {
+  platform = process.platform,
+  sessionStatus = null,
+} = {}) {
+  if (platform !== 'win32' || sessionStatus?.available === true) return capabilities;
+  const bounded = { ...capabilities };
+  for (const name of WINDOWS_SESSION_SCOPED_CAPABILITIES) bounded[name] = false;
+  return bounded;
+}
+
 export async function capabilitySnapshot() {
   const win = process.platform === 'win32';
   const mac = process.platform === 'darwin';
@@ -270,7 +289,7 @@ export async function capabilitySnapshot() {
   const displayInventoryReady = linux && desktopSession ? await displayInventoryAvailable() : false;
   const browserCdp = browserRemoteEnabled() && await browserControlAvailable(undefined, 500);
   const documentCapabilities = documentCapabilitySnapshot();
-  return {
+  const capabilities = {
     ...desktopShellCapabilities,
     webrtc_pilot:linux && desktopSession && webRtcWorkerAvailable(),
     windows: win || mac || (desktopSession && (commandExists('wdotool') || commandExists('wmctrl') || (wayland && pyAtSpi))),
@@ -293,6 +312,12 @@ export async function capabilitySnapshot() {
     record: recordScreenAvailable({ platform:process.platform, wayland, gnomeSupported:gnomeRecord }),
     ...documentCapabilities,
   };
+  return win
+    ? limitWindowsSessionCapabilities(capabilities, {
+      platform:process.platform,
+      sessionStatus:await cachedWindowsDesktopSessionStatus(),
+    })
+    : capabilities;
 }
 
 function isSupported(definition, capabilities) {
@@ -308,9 +333,9 @@ export function allExtendedTools() {
   return extendedToolDefinitions.map(publicShape);
 }
 
-export async function advertisedExtendedTools() {
-  const capabilities = await capabilitySnapshot();
-  return extendedToolDefinitions.filter(definition => isSupported(definition, capabilities)).map(publicShape);
+export async function advertisedExtendedTools(capabilities = null) {
+  const current = capabilities ?? await capabilitySnapshot();
+  return extendedToolDefinitions.filter(definition => isSupported(definition, current)).map(publicShape);
 }
 
 export async function capabilityFingerprint() {

package/src/extended/desktop-computer-actions.mjs

@@ -16,6 +16,7 @@ import { clipboard, displayInventory, keyboard, listWindows, notification, point
 import { dragDrop, launchApp, openPath, revealPath, typeText, uiFind, waitForUi } from './desktop-ui-actions.mjs';
 import { clickOcrText } from './desktop-vision.mjs';
 import { computerSnapshot } from './desktop-computer-snapshot.mjs';
+import { assertWindowsInteractiveDesktop, guardWindowsDesktopTool } from './desktop-windows-session.mjs';
 
 export function browserComputerAction(args, action) {
   const mapped = {
@@ -368,3 +369,40 @@ export const desktopHandlers = {
   reveal_path: revealPath,
   notification,
 };
+
+// Explicit browser-only actions and non-UI waits remain usable with no Windows
+// desktop. Auto-targeted actions may need native input, so they fail closed.
+// Mixed batches must not execute early browser steps before later unsafe native
+// operations are rejected.
+export function computerActionRequiresDesktop(args = {}) {
+  const action = String(args?.action || '');
+  const target = String(args?.target || args?.target_type || 'auto');
+  if (action === 'wait') return false;
+  if (action === 'batch') {
+    return !Array.isArray(args.steps) || args.steps.some(computerActionRequiresDesktop);
+  }
+  if (action === 'keyboard') {
+    return !(target === 'browser' && args.key && !args.shortcut && !Array.isArray(args.keys));
+  }
+  if (['ui','pointer','window','drag','clipboard','launch_app','open_path',
+    'reveal_path','notification','multi_select','multi_edit','double_click',
+    'right_click','move','down','up','minimize','maximize','restore',
+    'move_resize','resize','close'].includes(action)) return true;
+  return target !== 'browser';
+}
+
+// Keep native desktop tools unavailable in Windows Session 0 without blocking
+// terminal, filesystem and explicitly browser-targeted CDP actions.
+const nativeDesktopTools = [
+  'list_windows', 'window_action', 'launch_app', 'ui_snapshot', 'ui_find',
+  'ui_action', 'type_text', 'keyboard', 'pointer', 'drag_drop', 'scroll',
+  'wait_for_ui', 'clipboard', 'display_inventory', 'screenshot_region',
+  'open_path', 'reveal_path', 'notification',
+];
+for (const name of nativeDesktopTools) {
+  desktopHandlers[name] = guardWindowsDesktopTool(desktopHandlers[name]);
+}
+desktopHandlers.computer_action = async (args = {}) => {
+  if (computerActionRequiresDesktop(args)) await assertWindowsInteractiveDesktop();
+  return computerAction(args);
+};

package/src/extended/desktop-computer-snapshot.mjs

@@ -8,6 +8,7 @@ import { clamp, desktopSessionAvailable, jsonResult, optionalString, requireEnum
 import * as linux from './desktop-linux.mjs';
 import * as macos from './desktop-macos.mjs';
 import * as windows from './desktop-windows.mjs';
+import { windowsDesktopSessionStatus } from './desktop-windows-session.mjs';
 import { browserAction, browserCapabilityAvailable, browserSnapshot } from './browser.mjs';
 import { probeBrowserReadiness } from './browser-readiness.mjs';
 import { findOcrText, ocrImage } from './ocr.mjs';
@@ -43,8 +44,19 @@ export async function settleComputerSnapshotProbes(tasks, {
   return results;
 }
 
-export async function computerSnapshot(args = {}) {
-  const desktopAvailable = desktopSessionAvailable();
+export async function resolveComputerDesktopSession({
+  platform = process.platform,
+  available = desktopSessionAvailable(),
+  windowsProbe = windowsDesktopSessionStatus,
+} = {}) {
+  if (!available) return { status:'unavailable', available:false, reason:'no_graphical_session' };
+  if (platform !== 'win32') return { status:'available', available:true };
+  return windowsProbe();
+}
+
+export async function computerSnapshot(args = {}, { desktopSessionProbe = resolveComputerDesktopSession } = {}) {
+  const desktopSession = await desktopSessionProbe();
+  const desktopAvailable = desktopSession.available !== false;
   const screenshotRequested = args.include_screenshot !== false || args.include_ocr === true;
   const captureScreenshot = desktopAvailable && screenshotRequested;
   const includeUi = args.include_ui !== false;
@@ -86,7 +98,7 @@ export async function computerSnapshot(args = {}) {
     shapeErrors.push({ source:'cursor', message:'cursor position returned an invalid result shape' });
   }
   const parsedUi = includeUi ? parse(uiResult, null) : null;
-  const ui = objectRecord(parsedUi) || { platform:process.platform, count:0, nodes:[], ...(includeUi ? { unavailable:true } : { skipped:true }) };
+  const ui = objectRecord(parsedUi) || { platform:process.platform, count:0, nodes:[], ...(includeUi ? { unavailable:true, ...(desktopSession.available === false ? { reason:desktopSession.reason } : {}) } : { skipped:true }) };
   if (includeUi && parsedUi !== ui && parsedUi != null) {
     shapeErrors.push({ source:'ui', message:'accessibility snapshot returned an invalid result shape' });
   }
@@ -208,6 +220,7 @@ export async function computerSnapshot(args = {}) {
     device: { hostname: os.hostname(), platform: process.platform, arch: process.arch },
     platform: process.platform,
     hostname: os.hostname(),
+    desktop_session:desktopSession,
     active_app: activeApp,
     active_window: activeWindow,
     windows,
@@ -218,6 +231,7 @@ export async function computerSnapshot(args = {}) {
     ...(args.browser_readiness === true ? { browser_readiness:readiness || { status:'invalid_response', ready:false, candidate_pages:0, next_step:'use_native_accessibility' } } : {}),
     ...(ocr ? { ocr } : {}),
     fallback_chain: {
+      desktop_session:desktopSession,
       accessibility: { requested:includeUi, available:includeUi && desktopAvailable && uiResult.status === 'fulfilled' && Boolean(uiResult.value), nodes:uiNodes.length },
       native_browser_dom: {
         requested:includeUi && args.ui_browser_dom === true,

package/src/extended/desktop-webrtc-bridge.mjs

@@ -34,9 +34,16 @@ export function webRtcWorkerAvailable(env=process.env,platform=process.platform)
 export function createDesktopWebRtcBridge({
   env=process.env,platform=process.platform,spawnChild=spawn,
   now=Date.now,setIntervalFn=setInterval,clearIntervalFn=clearInterval,
+  stopExitTimeoutMs=5_000,terminationEscalationMs=3_000,
 }={}){
+  if(!Number.isSafeInteger(stopExitTimeoutMs)||stopExitTimeoutMs<100||
+     stopExitTimeoutMs>10_000||
+     !Number.isSafeInteger(terminationEscalationMs)||
+     terminationEscalationMs<100||terminationEscalationMs>10_000)
+    throw new RangeError('Invalid WebRTC native Stop exit deadline');
   let child=null, current=null, active=false, started=0, seen=0;
-  let stdout='', sequence=0, clock=null;
+  let stdout='', sequence=0, clock=null, pendingExit=null;
+  let lastExitedSession=null;
   const waits=new Map();
 
   function rejectWaits(){
@@ -46,14 +53,45 @@ export function createDesktopWebRtcBridge({
     }
     waits.clear();
   }
-  function shutdown(){
+  // A SIGTERM request or stdio Stop ACK is NOT evidence of process exit.
+  // Hold a local admission fence until the kernel reports the child exit.
+  // This covers the direct child only, not escaped descendants: production
+  // still requires separate verified process-tree containment.
+  function shutdown(alreadyExited=false){
     if(clock){clearIntervalFn(clock);clock=null;}
-    const target=child;
+    const target=child,session=current;
     child=null;current=null;active=false;stdout='';
     rejectWaits();
-    if(target&&!target.killed){
-      try{target.stdin.end();target.kill('SIGTERM');}catch{}
+    if(!target)return pendingExit?.promise??Promise.resolve(false);
+    let confirmExit;
+    const exited=new Promise(resolve=>{confirmExit=resolve;});
+    const marker={target,promise:exited};
+    pendingExit=marker;
+    let escalation;
+    const onExit=()=>{
+      target.removeListener('exit',onExit);
+      if(escalation)clearTimeout(escalation);
+      if(pendingExit===marker)pendingExit=null;
+      lastExitedSession=session;
+      confirmExit(true);
+    };
+    target.once('exit',onExit);
+    if(alreadyExited||target.exitCode!==null&&target.exitCode!==undefined||
+       target.signalCode!==null&&target.signalCode!==undefined){
+      onExit();
+    }else{
+      // Only signal the child spawned by this bridge. SIGKILL is a bounded
+      // escalation, not a Stop proof: never release the fence without exit.
+      escalation=setTimeout(()=>{
+        if(pendingExit!==marker)return;
+        try{target.kill('SIGKILL');}catch{}
+      },terminationEscalationMs);
+      escalation.unref?.();
+      if(!target.killed){
+        try{target.stdin.end();target.kill('SIGTERM');}catch{}
+      }
     }
+    return exited;
   }
   function receive(chunk){
     stdout+=chunk.toString('utf8');
@@ -140,14 +178,16 @@ export function createDesktopWebRtcBridge({
     child=worker;stdout='';
     worker.stdout.on('data',chunk=>{if(child===worker)receive(chunk);});
     worker.once('error',()=>{if(child===worker)shutdown();});
-    worker.once('exit',()=>{if(child===worker)shutdown();});
+    worker.once('exit',()=>{if(child===worker)shutdown(true);});
   }
 
   async function offer({session_id:sid,mode,sdp},extra={}){
     if(!UUID.test(String(sid))||mode!=='view'||typeof sdp!=='string'||
        Buffer.byteLength(sdp)>MAX_SDP||sdp.length<100)
       throw new Error('Invalid view-only WebRTC offer');
-    if(current!==null||child)throw new Error('Another WebRTC session is active');
+    if(current!==null||child||pendingExit)
+      throw new Error('Another WebRTC session is active');
+    lastExitedSession=null;
     current=sid;started=seen=now();active=false;
     let cancelled=false;
     const cancel=()=>{cancelled=true;shutdown();};
@@ -189,10 +229,19 @@ export function createDesktopWebRtcBridge({
     try{
       const reply=await send('stop',sid,{},4000);
       if(reply.sessionId!==sid)throw new Error('Invalid WebRTC stop acknowledgement');
-      return jsonResult({ok:true,sessionId:sid});
-    }finally{shutdown();}
+    }catch(error){shutdown();throw error;}
+    const exited=shutdown();
+    let timer;
+    const confirmed=lastExitedSession===sid||await Promise.race([
+      exited,
+      new Promise(resolve=>{timer=setTimeout(()=>resolve(false),stopExitTimeoutMs);}),
+    ]).finally(()=>clearTimeout(timer));
+    if(!confirmed)
+      throw new Error('WebRTC worker Stop unconfirmed: native process still running');
+    return jsonResult({ok:true,sessionId:sid});
   }
-  return {offer,heartbeat,stop,shutdown,
+  // Do not expose the internal alreadyExited override to callers.
+  return {offer,heartbeat,stop,shutdown:()=>shutdown(),
     get activeSession(){return current;},
   };
 }

package/src/extended/desktop-windows-session.mjs

@@ -0,0 +1,89 @@
+// Windows native UI runs in a user's interactive session, never in Session 0.
+// This only examines the current probe process; it does not enumerate users,
+// request a login, open the secure desktop or change Windows permissions.
+import { runPowerShell } from './common.mjs';
+
+export const WINDOWS_DESKTOP_PROBE = String.raw`
+$ErrorActionPreference='Stop'
+$p=[System.Diagnostics.Process]::GetCurrentProcess()
+[pscustomobject]@{
+  sessionId=$p.SessionId
+  userInteractive=[Environment]::UserInteractive
+} | ConvertTo-Json -Compress
+`;
+
+export function classifyWindowsDesktopSession(value) {
+  const sessionId = value?.sessionId;
+  const interactive = value?.userInteractive;
+  if (!Number.isSafeInteger(sessionId) || sessionId < 0 || typeof interactive !== 'boolean') {
+    return { status:'unknown', available:null, reason:'invalid_session_probe' };
+  }
+  if (sessionId === 0 || !interactive) {
+    return {
+      status:'unavailable',
+      available:false,
+      reason:sessionId === 0 ? 'windows_session_0' : 'noninteractive_process',
+      next_step:'sign_in_to_interactive_desktop',
+    };
+  }
+  return { status:'available', available:true };
+}
+
+export async function windowsDesktopSessionStatus({ runPowerShellFn = runPowerShell } = {}) {
+  try {
+    const result = await runPowerShellFn(WINDOWS_DESKTOP_PROBE, {
+      label:'Windows interactive desktop readiness',
+      timeout:6000,
+    });
+    return classifyWindowsDesktopSession(JSON.parse(String(result?.stdout || '').trim()));
+  } catch {
+    // A failed OS query is not proof that no user is signed in.
+    return { status:'unknown', available:null, reason:'session_probe_failed' };
+  }
+}
+
+// Tool discovery can request the same session status several times per second.
+// Cache only advertised capabilities; native actions always use a fresh probe.
+export function createWindowsDesktopSessionCache({
+  probe = windowsDesktopSessionStatus,
+  ttlMs = 2500,
+  nowFn = Date.now,
+} = {}) {
+  let cached = null;
+  let expiresAt = 0;
+  let inFlight = null;
+  return async () => {
+    if (cached && nowFn() < expiresAt) return cached;
+    if (inFlight) return inFlight;
+    inFlight = Promise.resolve().then(probe).catch(() => ({
+      status:'unknown', available:null, reason:'session_probe_failed',
+    })).then(result => {
+      cached = result && typeof result.available === 'boolean'
+        ? result
+        : { status:'unknown', available:null, reason:'session_probe_failed' };
+      expiresAt = nowFn() + Math.max(0, ttlMs);
+      return cached;
+    }).finally(() => { inFlight = null; });
+    return inFlight;
+  };
+}
+
+export const cachedWindowsDesktopSessionStatus = createWindowsDesktopSessionCache();
+
+export async function assertWindowsInteractiveDesktop({
+  platform = process.platform,
+  probe = windowsDesktopSessionStatus,
+} = {}) {
+  if (platform !== 'win32') return;
+  const status = await probe();
+  if (status?.available === true) return;
+  const reason = status?.reason || 'session_probe_failed';
+  throw new Error(`Windows desktop unavailable (${reason}): sign in to an interactive Windows desktop before using native screen or input tools.`);
+}
+
+export function guardWindowsDesktopTool(handler, options = {}) {
+  return async (...args) => {
+    await assertWindowsInteractiveDesktop(options);
+    return handler(...args);
+  };
+}

package/src/extended/diagnostics-recording.mjs

@@ -9,6 +9,7 @@ import { isWaylandSession } from '../screenshot-portal.mjs';
 import { openDirectoryPath } from '../tools/files.mjs';
 import { resolveSafePath } from '../util.mjs';
 import { clamp, commandExists, jsonResult, runFile, unavailable } from './common.mjs';
+import { assertWindowsInteractiveDesktop } from './desktop-windows-session.mjs';
 
 export function resolveRecordScreenFfmpeg({
   platform = process.platform,
@@ -330,6 +331,8 @@ async function copyRecordingFile(source, destination) {
 }
 
 export async function recordScreen(args) {
+  // Reject Windows Session 0 before creating temporary files or starting ffmpeg.
+  await assertWindowsInteractiveDesktop();
   const seconds = clamp(args.duration_seconds, 5, 1, 120);
   const fps = clamp(args.fps, 15, 1, 60);
   const wayland = process.platform === 'linux' && isWaylandSession();

package/src/index.mjs

@@ -2,8 +2,9 @@
 import process from 'node:process';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { advertisedTools as advertisedCoreTools, supportedCoreTools, toolDefinitions as coreToolDefinitions } from './catalog.mjs';
-import { allExtendedTools, advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { advertisedTools as advertisedCoreTools, toolDefinitions as coreToolDefinitions } from './catalog.mjs';
+import { allExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { supportedRuntimeToolDefinitions } from './tool-availability.mjs';
 import { describeConfig, configurationError, runtimeConfigDir } from './config.mjs';
 import { shutdownSessions, startSessionSweeper } from './sessions.mjs';
 import { flush, setTelemetrySink, shutdownTelemetry, telemetryEnabled } from './telemetry.mjs';
@@ -13,7 +14,8 @@ const args = process.argv.slice(2);
 const allToolDefinitions = [...coreToolDefinitions, ...extendedToolDefinitions];
 
 async function advertisedRuntimeTools() {
-  return [...supportedCoreTools(), ...await advertisedExtendedTools()];
+  const { core, extended } = await supportedRuntimeToolDefinitions();
+  return [...core, ...extended];
 }
 
 async function writeStdout(value) {

package/src/mcp-v2.mjs

@@ -1,6 +1,7 @@
 import process from 'node:process';
-import { supportedCoreTools, toolDefinitions, TEXT_OUTPUT_SCHEMA } from './catalog.mjs';
-import { advertisedExtendedTools, extendedToolDefinitions } from './extended/catalog.mjs';
+import { toolDefinitions, TEXT_OUTPUT_SCHEMA } from './catalog.mjs';
+import { extendedToolDefinitions } from './extended/catalog.mjs';
+import { supportedRuntimeToolDefinitions } from './tool-availability.mjs';
 import { invokeTool } from './invoke.mjs';
 
 const DEFAULT_CAPABILITY_POLL_MS = 3000;
@@ -26,10 +27,8 @@ export async function startRuntimeMcpServer({ version, instructions, onError = (
     import('@modelcontextprotocol/server/stdio'),
   ]);
 
-  const initiallySupported = new Set([
-    ...supportedCoreTools().map(tool => tool.name),
-    ...(await advertisedExtendedTools()).map(tool => tool.name),
-  ]);
+  const initial = await supportedRuntimeToolDefinitions();
+  const initiallySupported = new Set([...initial.core, ...initial.extended].map(tool => tool.name));
   let activeServer = null;
   let capabilityTimer = null;
   let capabilityPollRunning = false;
@@ -69,9 +68,10 @@ export async function startRuntimeMcpServer({ version, instructions, onError = (
       if (closed || capabilityPollRunning) return;
       capabilityPollRunning = true;
       try {
-        const next = new Set((await advertisedExtendedTools()).map(tool => tool.name));
+        const updated = await supportedRuntimeToolDefinitions();
+        const next = new Set([...updated.core, ...updated.extended].map(tool => tool.name));
         let changed = false;
-        for (const definition of extendedToolDefinitions) {
+        for (const definition of [...toolDefinitions, ...extendedToolDefinitions]) {
           const before = lastSupported.has(definition.name);
           const after = next.has(definition.name);
           if (before === after) continue;

package/src/tool-availability.mjs

@@ -0,0 +1,23 @@
+import process from 'node:process';
+import { supportedCoreTools } from './catalog.mjs';
+import { advertisedExtendedTools, capabilitySnapshot } from './extended/catalog.mjs';
+
+// The core screenshot tool is distinct from extended screenshot_region, but
+// both require a real Windows user desktop. Keep read_image and all other
+// filesystem tools available to Session 0 service agents.
+export function filterCoreToolsForLiveDesktop(tools, {
+  platform = process.platform,
+  capabilities = {},
+} = {}) {
+  if (platform !== 'win32' || capabilities.desktop_session === true) return tools;
+  return tools.filter(tool => tool.name !== 'take_screenshot');
+}
+
+export async function supportedRuntimeToolDefinitions() {
+  // One consistent OS capability snapshot for ordinary and compact MCP lists.
+  const capabilities = await capabilitySnapshot();
+  return {
+    core:filterCoreToolsForLiveDesktop(supportedCoreTools(), { capabilities }),
+    extended:await advertisedExtendedTools(capabilities),
+  };
+}

package/src/tools/files-screenshots.mjs

@@ -11,6 +11,7 @@ import { documentKind, readDocxText, readPdfText } from '../documents.mjs';
 import { diffStats, unifiedDiff } from '../diff.mjs';
 import { describeFilesystemFailure } from '../permissions.mjs';
 import { capturePortalScreenshot, isWaylandSession } from '../screenshot-portal.mjs';
+import { assertWindowsInteractiveDesktop } from '../extended/desktop-windows-session.mjs';
 import { applyHunks, parseUnifiedDiff } from '../patch.mjs';
 import { countEvent, recordEvent } from '../telemetry.mjs';
 import { clampInteger, decodeText, displayPath, fail, fitsOutput, globToRegExp, image, isInsideRoot, looksBinary, multi, pageLines, resolveSafePath, splitLines, text, throwIfCancelled } from '../util.mjs';
@@ -98,6 +99,8 @@ export async function runWindowsScreenshot(file, runProcess = execFileAsync) {
 }
 
 export async function takeScreenshotTool(args) {
+  // Reject Windows Session 0 before allocating files or running pixel capture.
+  await assertWindowsInteractiveDesktop();
   const requestedDirectory = args.directory ? await resolveSafePath(args.directory, 'directory') : '';
   const temporaryDirectory = requestedDirectory ? '' : await mkdtemp(path.join(os.tmpdir(), 'remcp-screenshot-'));
   const directory = requestedDirectory || temporaryDirectory;