deadbyte-mcp 0.11.2 → 0.12.0

package/test/cli-entrypoint.test.mjs

@@ -21,7 +21,7 @@ test('npx CLI reports the canonical package version through --version, -v and ve
   for(const arg of ['--version','-v','version']){
     const result=spawnSync(process.execPath,[cliPath,arg],{cwd:root,encoding:'utf8',windowsHide:true});
     assert.equal(result.status,0,result.stderr);
-    assert.equal(result.stdout.trim(),'0.11.2');
+    assert.equal(result.stdout.trim(),'0.12.0');
   }
 });
 

package/test/compact-catalog-r36.test.mjs

@@ -8,7 +8,7 @@ import path from 'node:path';
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
 const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
-const gatewayNames=['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'];
+const gatewayNames=['capability_manifest','coding_inspect','desktop_control','machine_fs','machine_observe','process_session'];
 
 test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
   const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
@@ -17,7 +17,7 @@ test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async(
     DEADBYTE_CAPABILITY_PROFILE:'compact',
     DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
     DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
-    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
   };
   const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
   try{

package/test/compact-gateway-r36.test.mjs

@@ -7,6 +7,7 @@ import {
   machineObserveInputSchema,
   registerCompactGatewayTools
 } from '../src/compact-gateway-mcp-tools.mjs';
+import { desktopControlInputSchema } from '../src/desktop-mcp-tools-r40.mjs';
 
 const fakeServer=()=>{
   const tools=new Map();
@@ -24,6 +25,7 @@ test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
   assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
   assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'call',tool_name:'host_exec'}).success,false);
 });
 
 test('R36 compact schemas preserve representative preconditions',()=>{
@@ -36,14 +38,15 @@ test('R36 compact schemas preserve representative preconditions',()=>{
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
 });
 
-test('R36 registers exactly five compact gateway names',()=>{
+test('R40 registers exactly six compact gateway names including desktop_control',()=>{
   const server=fakeServer();
   registerCompactGatewayTools(server,{
     profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
-    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
   });
   assert.deepEqual([...server.tools.keys()].sort(),[
-    'capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'
+    'capability_manifest','coding_inspect','desktop_control','machine_fs','machine_observe','process_session'
   ]);
 });
 
@@ -55,7 +58,8 @@ test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',
   const server=fakeServer();
   registerCompactGatewayTools(server,{
     profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
-    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
   });
   const tool=server.tools.get('coding_inspect');
   const result=await tool.handler({op:'stat',root_id:'core',path:'src/a.mjs',hash:false});
@@ -64,3 +68,51 @@ test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',
   assert.equal(result.structuredContent.op,'stat');
   assert.equal(result.structuredContent.result.path,'src/a.mjs');
 });
+
+test('R40 capability manifest v2 attests the exact registered compact catalog',async()=>{
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'a'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
+  });
+  const result=await server.tools.get('capability_manifest').handler({});
+  const manifest=result.structuredContent.result;
+  assert.equal(manifest.schema,'deadbyte.capability-manifest.v2');
+  assert.equal(manifest.profile,'compact');
+  assert.deepEqual(manifest.tool_catalog,[...server.tools.keys()].sort());
+  assert.equal(manifest.tool_count,server.tools.size);
+  assert.match(manifest.catalog_sha256,/^[0-9a-f]{64}$/);
+});
+
+
+test('R40 desktop_control is stable when runtime is absent and routes typed read-only operations when present',async()=>{
+  const server=fakeServer();
+  const calls=[];
+  const desktopRuntime={
+    status:async()=>{calls.push('status');return {status:'ok',configured:true,armed:false,reason:'disarmed',action_kinds:[],policy_sha256:'a'.repeat(64),observer_backend:'fake'};},
+    observe:async()=>{calls.push('observe');return {status:'ok',frame:{frame_id:'b'.repeat(64)}};}
+  };
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime,
+    catalogProvider:()=>[...server.tools.keys()]
+  });
+  const tool=server.tools.get('desktop_control');
+  const status=await tool.handler({op:'status'});
+  assert.equal(status.isError,false);
+  assert.equal(status.structuredContent.result.armed,false);
+  const observed=await tool.handler({op:'observe'});
+  assert.equal(observed.structuredContent.result.frame.frame_id,'b'.repeat(64));
+  assert.deepEqual(calls,['status','observe']);
+
+  const absent=fakeServer();
+  registerCompactGatewayTools(absent,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...absent.tools.keys()]
+  });
+  const unavailable=await absent.tools.get('desktop_control').handler({op:'status'});
+  assert.equal(unavailable.isError,true);
+  assert.equal(unavailable.structuredContent.status,'unavailable');
+});

package/test/compact-max-catalog-r40.test.mjs

@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 real max-runtime compact stdio catalog is exactly 42 while all authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-max-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.equal(names.length,42,'expected exact compact max catalog 42, got '+names.length+': '+names.join(','));
+    for(const name of ['capability_manifest','desktop_control','coding_inspect','machine_fs','machine_observe','process_session',
+      'host_file_read','host_file_write','host_exec']) assert.ok(names.includes(name),'missing '+name);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    const m=manifest.structuredContent.result;
+    assert.equal(m.schema,'deadbyte.capability-manifest.v2');
+    assert.equal(m.profile,'compact');
+    assert.equal(m.tool_count,42);
+    assert.deepEqual(m.tool_catalog,names);
+    assert.match(m.catalog_sha256,/^[0-9a-f]{64}$/);
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/controller-desktop-r40.test.mjs

@@ -0,0 +1,85 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller=fileURLToPath(new URL('../controller/deadbyte-controller.ps1',import.meta.url));
+const example=fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example',import.meta.url));
+const init=fileURLToPath(new URL('../scripts/init-desktop-policy-r40.ps1',import.meta.url));
+
+test('R40 controller exposes Desktop runtime config but never auto-arms it',async()=>{
+  const source=await readFile(controller,'utf8');
+  const config=await readFile(example,'utf8');
+  for(const name of ['armdesktop','disarmdesktop','desktopstatus']) assert.match(source,new RegExp(name));
+  assert.match(source,/DesktopRuntimeEnabled must be boolean/);
+  assert.match(source,/DesktopRuntimeEnabled requires DesktopPolicyFile/);
+  assert.match(source,/DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(source,/DEADBYTE_DESKTOP_POLICY/);
+  assert.match(config,/DesktopRuntimeEnabled = \$false/);
+  assert.match(config,/DesktopPolicyFile = ''/);
+  const start=source.slice(source.indexOf('function Start-Deadbyte'),source.indexOf('function Park-Deadbyte'));
+  assert.doesNotMatch(start,/Arm-Desktop/);
+  const dispatch=source.slice(source.indexOf('function Run-Command'),source.indexOf("if ($Command -ne 'menu')"));
+  assert.doesNotMatch(dispatch,/'start'[^\n]*Arm-Desktop/);
+  assert.doesNotMatch(dispatch,/'resume'[^\n]*Arm-Desktop/);
+});
+
+test('R40 Desktop standing grant is policy-digest and action-scope bound',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/deadbyte\.desktop-policy\.v1/);
+  assert.match(source,/deadbyte\.desktop-grant\.v1/);
+  assert.match(source,/policy_sha256/);
+  assert.match(source,/instance_nonce/);
+  assert.match(source,/action_kinds/);
+  assert.match(source,/actions-outside-policy/);
+  assert.match(source,/desktop \$\(\$provider\.Name\) executable SHA-256 mismatch/);
+  assert.match(source,/Get-ExecutableHash \$provider\.Path/);
+  assert.match(source,/grant_file must live under controller runtime directory/);
+  assert.match(source,/evidence_dir must live under controller runtime directory/);
+});
+
+test('R40 Desktop environment reaches Bridge only and is restored after spawn',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_RUNTIME = if \(\[bool\]\$Cfg\.DesktopRuntimeEnabled\)/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_POLICY = \[string\]\$Cfg\.DesktopPolicyFile/);
+  assert.match(source,/Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(source,/Remove-Item Env:DEADBYTE_DESKTOP_POLICY/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_RUNTIME = \$previousDesktopRuntimeEnv/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_POLICY = \$previousDesktopPolicyEnv/);
+  const supervisor=source.slice(source.indexOf("} elseif ($Name -eq 'Supervisor'"),source.indexOf('} else {',source.indexOf("} elseif ($Name -eq 'Supervisor'")));
+  assert.match(supervisor,/Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(supervisor,/Remove-Item Env:DEADBYTE_DESKTOP_POLICY/);
+});
+
+test('R40 lifecycle revokes Desktop before park stop restart and supervisor recovery',async()=>{
+  const source=await readFile(controller,'utf8');
+  const park=source.slice(source.indexOf('function Park-Deadbyte'),source.indexOf('function Stop-Deadbyte'));
+  const stop=source.slice(source.indexOf('function Stop-Deadbyte'),source.indexOf('function Get-HostPolicyMetadata'));
+  const recover=source.slice(source.indexOf('function Recover-AutonomousSupervisor'),source.indexOf('function Show-State'));
+  assert.match(park,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Stop-OwnedComponent 'Bridge'/);
+  assert.match(stop,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Stop-OwnedComponent 'Bridge'/);
+  assert.match(recover,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Start-Deadbyte/);
+  assert.match(recover,/\$desktop = Get-DesktopGrantStatus \$Cfg/);
+  assert.match(recover,/\$desktop\.Armed/);
+  const dispatch=source.slice(source.indexOf('function Run-Command'),source.indexOf("if ($Command -ne 'menu')"));
+  assert.match(dispatch,/'restart'[^\n]*Stop-Deadbyte/);
+});
+
+test('R40 policy initializer pins current native observer and input and starts DISARMED',async()=>{
+  const source=await readFile(init,'utf8');
+  assert.match(source,/deadbyte-desktop-observer-r40\.exe/);
+  assert.match(source,/deadbyte-desktop-input-r40\.exe/);
+  assert.match(source,/deadbyte-desktop-uia-r40\.exe/);
+  assert.match(source,/Get-FileHash/);
+  assert.match(source,/Remove-Item -LiteralPath \$Grant/);
+  assert.match(source,/grant_state='DISARMED'/);
+  assert.match(source,/deadbyte\.desktop-policy\.v1/);
+  assert.match(source,/max_text_bytes=4096/);
+});
+
+test('R40 status exposes Desktop runtime and authority independently',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/Desktop runtime: \{0\}/);
+  assert.match(source,/Desktop plane : \{0\}/);
+  assert.match(source,/Show-DesktopStatus \$Cfg/);
+});

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.11.2');
+  assert.equal(result.receipt.runtime.package_version, '0.12.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);

package/test/desktop-adversarial-r40.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createDesktopAction } from '../src/desktop-contract.mjs';
+import { captureNativeDesktop } from '../src/desktop-observer-r40.mjs';
+import { invokeNativeDesktopInput } from '../src/desktop-input-r40.mjs';
+import { invokeNativeDesktopGrounder } from '../src/desktop-uia-r40.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const WIN={hwnd:'0x1234',pid:99};
+const BOUNDS={left:0,top:0,width:1920,height:1080};
+function action(){
+  return createDesktopAction({
+    intentId:H('helper-substitution'),kind:'key_chord',
+    frameId:H('frame'),desktopEpoch:H('epoch'),topologySha256:H('topology'),
+    expectedWindow:WIN,keyChord:['SHIFT']
+  });
+}
+
+test('T9 observer helper substitution is detected before native process launch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-observer-pin-'));
+  try{
+    const fake=path.join(root,'observer.exe');
+    await writeFile(fake,'not the pinned observer');
+    await assert.rejects(captureNativeDesktop({
+      observerPath:fake,expectedObserverSha256:H('expected-observer'),maxFrameBytes:1024*1024,timeoutMs:1000
+    }),/observer executable hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('T9 input helper substitution is definite not_started before SendInput dispatch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-input-pin-'));
+  try{
+    const fake=path.join(root,'input.exe');
+    await writeFile(fake,'not the pinned input helper');
+    let error;
+    try{
+      await invokeNativeDesktopInput(action(),{
+        inputPath:fake,expectedInputSha256:H('expected-input'),timeoutMs:1000,
+        inputDesktop:'Default',expectedBounds:BOUNDS,expectedWindow:WIN
+      });
+    }catch(e){error=e;}
+    assert.ok(error);
+    assert.match(error.message,/input executable hash mismatch/);
+    assert.equal(error.side_effect_state,'not_started');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('T9 UIA helper substitution is detected before COM traversal process launch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-uia-pin-'));
+  try{
+    const fake=path.join(root,'uia.exe');
+    await writeFile(fake,'not the pinned UIA helper');
+    await assert.rejects(invokeNativeDesktopGrounder({
+      grounderPath:fake,expectedGrounderSha256:H('expected-uia'),timeoutMs:1000,
+      expectedWindow:WIN,expectedBounds:BOUNDS,query:{kind:'root',value:'',max_results:1,ordinal:0}
+    }),/UIA executable hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/desktop-contract-r40.test.mjs

@@ -0,0 +1,200 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import {
+  createDesktopAction,createDesktopFrame,createDesktopTarget,guardDesktopAction,
+  bindDesktopPostObservation,bindDesktopActionChain,verifyDesktopFrame,desktopActionKinds
+} from '../src/desktop-contract.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+const EPOCH=H('epoch-1');
+const TOPO=H('topology-1');
+const IMG1=H('image-1');
+const IMG2=H('image-2');
+const WIN={hwnd:'0x1234',pid:4242,process_image_sha256:H('app.exe'),title_sha256:H('Editor')};
+const NOW='2026-09-19T02:00:01.500Z';
+
+function frame(overrides={}){
+  return createDesktopFrame({
+    desktopEpoch:EPOCH,topologySha256:TOPO,observedAtUtc:'2026-09-19T02:00:00.000Z',
+    bounds:{left:-1920,top:0,width:3840,height:1080},activeWindow:WIN,imageSha256:IMG1,...overrides
+  });
+}
+function action(f,overrides={}){
+  return createDesktopAction({
+    intentId:H('intent-1'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:100,y:200},...overrides
+  });
+}
+
+test('desktop frame identity is deterministic and self-verifying',()=>{
+  const a=frame(),b=frame();
+  assert.equal(a.frame_id,b.frame_id);
+  assert.deepEqual(verifyDesktopFrame(a),{ok:true,frame:a});
+  const tampered={...a,image_sha256:IMG2};
+  const checked=verifyDesktopFrame(tampered);
+  assert.equal(checked.ok,false);
+  assert.match(checked.reason,/hash mismatch/);
+});
+
+test('virtual desktop supports negative monitor coordinates but rejects overflow',()=>{
+  const f=frame();
+  const a=createDesktopAction({
+    intentId:H('negative-monitor'),kind:'pointer_move',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:-1000,y:500}
+  });
+  assert.equal(guardDesktopAction({frame:f,action:a,nowUtc:NOW}).frame_id,f.frame_id);
+  const outside=createDesktopAction({
+    intentId:H('outside'),kind:'pointer_move',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:1920,y:500}
+  });
+  assert.throws(()=>guardDesktopAction({frame:f,action:outside,nowUtc:NOW}),/outside frame bounds/);
+});
+
+test('T9 coordinate overflow and far-negative coordinates are denied before guard/effect',()=>{
+  const f=frame();
+  assert.throws(()=>createDesktopAction({
+    intentId:H('overflow-positive'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:Number.MAX_SAFE_INTEGER,y:1}
+  }),/action point\.x invalid/);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('overflow-negative'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:-131073,y:1}
+  }),/action point\.x invalid/);
+});
+
+test('stale frame is denied before effect',()=>{
+  const f=frame();
+  assert.throws(()=>guardDesktopAction({
+    frame:f,action:action(f),nowUtc:'2026-09-19T02:00:03.001Z',maxFrameAgeMs:2000
+  }),/frame is stale/);
+});
+
+test('action is bound to exact frame identity',()=>{
+  const f=frame();
+  const another=frame({observedAtUtc:'2026-09-19T02:00:00.250Z'});
+  assert.notEqual(f.frame_id,another.frame_id);
+  assert.throws(()=>guardDesktopAction({frame:another,action:action(f),nowUtc:NOW}),/stale frame id/);
+});
+
+test('desktop epoch mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{desktopEpoch:H('other-epoch')});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/desktop epoch mismatch/);
+});
+
+test('topology mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{topologySha256:H('other-topology')});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/topology mismatch/);
+});
+
+test('foreground window mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{expectedWindow:{...WIN,hwnd:'0xbeef'}});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/foreground window mismatch/);
+});
+
+test('target is frame-bound, bounded, and deterministic',()=>{
+  const f=frame();
+  const input={frame:f,rect:{left:50,top:50,width:200,height:100},source:'uia',confidence:0.99,semanticLabelSha256:H('Save'),windowBinding:f.active_window};
+  const a=createDesktopTarget(input),b=createDesktopTarget(input);
+  assert.equal(a.target_id,b.target_id);
+  assert.equal(a.frame_id,f.frame_id);
+  assert.throws(()=>createDesktopTarget({...input,rect:{left:1900,top:50,width:100,height:100}}),/outside desktop bounds/);
+});
+
+test('key chord is narrow and duplicate-free',()=>{
+  const f=frame();
+  const ok=createDesktopAction({
+    intentId:H('keys'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,keyChord:['CTRL','SHIFT','S']
+  });
+  assert.equal(guardDesktopAction({frame:f,action:ok,nowUtc:NOW}).action_sha256,ok.action_sha256);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('badkeys'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,keyChord:['CTRL','CTRL']
+  }),/duplicate key/);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('badkeys2'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,keyChord:['CTRL','POWER']
+  }),/unsupported key/);
+});
+
+test('text input is bounded and hash-bound',()=>{
+  const f=frame();
+  const a=createDesktopAction({
+    intentId:H('text'),kind:'text_input',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,text:'hello'
+  });
+  assert.equal(a.text_sha256,H('hello'));
+  assert.equal(guardDesktopAction({frame:f,action:a,nowUtc:NOW}).action_sha256,a.action_sha256);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('nul'),kind:'text_input',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,text:'a\u0000b'
+  }),/text input invalid/);
+});
+
+test('post-observation binds before/action/after without claiming success',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const after=frame({
+    observedAtUtc:'2026-09-19T02:00:02.000Z',
+    imageSha256:IMG2,
+    activeWindow:{...WIN,title_sha256:H('Editor - changed')}
+  });
+  const post=bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:after});
+  assert.equal(post.change_observed,true);
+  assert.equal(post.window_changed,true);
+  assert.equal(post.foreground_transition.changed,true);
+  assert.deepEqual(post.foreground_transition.before,before.active_window);
+  assert.deepEqual(post.foreground_transition.after,after.active_window);
+  assert.equal(post.topology_changed,false);
+  assert.equal(post.desktop_epoch_changed,false);
+  assert.equal(post.success,null);
+  assert.match(post.post_observation_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('T4 action chain binds before action after post receipt and effect identity',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const after=frame({observedAtUtc:'2026-09-19T02:00:02.000Z',imageSha256:IMG2});
+  const post=bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:after});
+  const first=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('post-receipt'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  const again=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('post-receipt'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  assert.equal(first.chain_sha256,again.chain_sha256);
+  assert.match(first.chain_sha256,/^[0-9a-f]{64}$/);
+  const changed=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('substituted'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  assert.notEqual(changed.chain_sha256,first.chain_sha256);
+});
+
+test('post-observation rejects substitution and time travel',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const other=action(before,{intentId:H('other')});
+  const after=frame({observedAtUtc:'2026-09-19T02:00:02.000Z',imageSha256:IMG2});
+  assert.throws(()=>bindDesktopPostObservation({guard,beforeFrame:before,action:other,afterFrame:after}),/action mismatch/);
+  const tooOld=frame({observedAtUtc:'2026-09-19T02:00:01.000Z',imageSha256:IMG2});
+  assert.throws(()=>bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:tooOld}),/predates guarded action/);
+});
+
+test('action vocabulary is fixed for R40-T1',()=>{
+  assert.deepEqual(desktopActionKinds(),[
+    'pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input'
+  ]);
+});

package/test/desktop-input-r40.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { createDesktopAction } from '../src/desktop-contract.mjs';
+import { serializeNativeDesktopInputRequest,parseNativeDesktopInputResponse } from '../src/desktop-input-r40.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+const bounds={left:-1920,top:0,width:3840,height:1080};
+const window={hwnd:'0x1234',pid:99};
+
+function action(kind,extra={}){
+  return createDesktopAction({
+    intentId:H('intent'),kind,frameId:H('frame'),desktopEpoch:H('epoch'),topologySha256:H('topology'),
+    expectedWindow:window,point:null,scrollDelta:null,keyChord:null,text:null,...extra
+  });
+}
+
+test('desktop native input protocol serializes one fixed click with frame-derived environment binding',()=>{
+  const value=serializeNativeDesktopInputRequest(action('click_primary',{point:{x:-100,y:200}}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  });
+  const text=value.toString('utf8');
+  assert.match(text,/^DEADBYTE_DESKTOP_INPUT_V1\n/);
+  assert.match(text,/kind=click_primary\n/);
+  assert.match(text,/expected_hwnd=0x1234\nexpected_pid=99\n/);
+  assert.match(text,/left=-1920\ntop=0\nwidth=3840\nheight=1080\n/);
+  assert.match(text,/x=-100\ny=200\n/);
+  assert.match(text,/key_count=0\ntext_bytes=0\n$/);
+});
+
+test('desktop native input text protocol is byte-counted and preserves raw UTF-8 after bounded header',()=>{
+  const value=serializeNativeDesktopInputRequest(action('text_input',{text:'ไทย🙂'}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  });
+  const marker=Buffer.from('text_bytes=13\n','utf8');
+  const at=value.indexOf(marker);
+  assert.ok(at>0);
+  assert.equal(value.subarray(at+marker.length).toString('utf8'),'ไทย🙂');
+});
+
+test('desktop native input protocol rejects out-of-bounds point before process launch',()=>{
+  assert.throws(()=>serializeNativeDesktopInputRequest(action('click_primary',{point:{x:3000,y:1}}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  }),/outside bounds/);
+});
+
+test('desktop native input response is bound to exact action desktop and foreground identity',()=>{
+  const a=action('key_chord',{keyChord:['CTRL','A']});
+  const bytes=Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-native-input.v1',injected:true,backend:'win32-sendinput',
+    action_sha256:a.action_sha256,kind:'key_chord',event_count:4,input_desktop:'Default',
+    foreground_hwnd:'0x1234',foreground_pid:99
+  })+'\n','utf8');
+  const parsed=parseNativeDesktopInputResponse(bytes,{
+    actionSha256:a.action_sha256,kind:'key_chord',inputDesktop:'Default',expectedWindow:window
+  });
+  assert.equal(parsed.injected,true);
+  assert.equal(parsed.event_count,4);
+  assert.match(parsed.provider_receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.throws(()=>parseNativeDesktopInputResponse(bytes,{
+    actionSha256:H('other'),kind:'key_chord',inputDesktop:'Default',expectedWindow:window
+  }),/action mismatch/);
+});