deadbyte-mcp 0.11.2 → 0.12.0

package/test/desktop-mcp-tools-r40.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,registerDesktopTools
+} from '../src/desktop-mcp-tools-r40.mjs';
+
+const H=c=>c.repeat(64);
+const frame=H('a');
+const intent=H('b');
+
+function fakeServer(){
+  const tools=new Map();
+  return {tools,registerTool(name,definition,handler){tools.set(name,{definition,handler});}};
+}
+
+test('R40 desktop action schema rejects ambiguous or authority-bypassing shapes',()=>{
+  assert.equal(desktopActionInputSchema.safeParse({
+    intent_id:intent,kind:'click_primary',expected_frame_id:frame,target_id:H('c'),point:{x:1,y:2}
+  }).success,false);
+  assert.equal(desktopActionInputSchema.safeParse({
+    intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'hello',point:{x:1,y:2}
+  }).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'action',intent_id:intent,kind:'key_chord',expected_frame_id:frame,key_chord:['CTRL','CTRL']}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'action',intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:1,y:2}}).success,true);
+});
+
+test('R40 T5 target schema supports local UIA query without arbitrary dispatch',()=>{
+  assert.equal(desktopTargetInputSchema.safeParse({frame_id:frame,uia_query:{kind:'name_exact',value:'Save',max_results:8,ordinal:0}}).success,true);
+  assert.equal(desktopTargetInputSchema.safeParse({frame_id:frame,uia_query:{kind:'root',value:'leak'}}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'target',frame_id:frame,uia_query:{kind:'control_type',value:'button',max_results:4,ordinal:0}}).success,true);
+});
+
+test('R40 full desktop surface registers four narrow typed tools',()=>{
+  const server=fakeServer();
+  const runtime={status(){},observe(){},target(){},action(){}};
+  registerDesktopTools(server,{runtime});
+  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target']);
+});
+
+test('R40 public desktop action output removes raw text while preserving content and action hashes',async()=>{
+  const server=fakeServer();
+  const action={
+    schema:'deadbyte.desktop-action.v1',intent_id:intent,kind:'text_input',frame_id:frame,
+    desktop_epoch:H('d'),topology_sha256:H('e'),expected_window:null,target_id:null,point:null,
+    scroll_delta:null,key_chord:null,text:'DO_NOT_ECHO_ME',text_sha256:H('f'),action_sha256:H('1')
+  };
+  const runtime={
+    action:async()=>({status:'ok',injected:true,task_success:null,action,guard:{guard_sha256:H('2')},
+      post_observation:{change_observed:true},started_receipt_id:'1'.repeat(24),started_receipt_sha256:H('3'),
+      receipt_id:'2'.repeat(24),receipt_sha256:H('4')})
+  };
+  registerDesktopTools(server,{runtime});
+  const result=await server.tools.get('desktop_action').handler({
+    intent_id:intent,kind:'text_input',expected_frame_id:frame,target_id:null,point:null,scroll_delta:null,key_chord:null,text:'DO_NOT_ECHO_ME'
+  });
+  const encoded=JSON.stringify(result.structuredContent);
+  assert.equal(encoded.includes('DO_NOT_ECHO_ME'),false);
+  assert.equal(result.structuredContent.result.action,undefined);
+  assert.equal(result.structuredContent.result.action_summary.text_sha256,H('f'));
+  assert.equal(result.structuredContent.result.action_summary.action_sha256,H('1'));
+});

package/test/desktop-memory-r40.test.mjs

@@ -0,0 +1,141 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, generateKeyPairSync, sign as cryptoSign } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import {
+  deriveDesktopMemory,signDesktopMemory,verifyDesktopMemorySnapshot,writeDesktopMemorySnapshot,
+  loadDesktopEvidenceReceipts,createDesktopMemoryProvider
+} from '../src/desktop-memory-r40.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const DOMAIN=Buffer.from('DEADBYTE-DESKTOP-RECEIPT-V1\0','utf8');
+const policy=H('policy');
+const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+const keyId='memory-test-key';
+let seq=0;
+function receipt(kind,payload,at='2026-09-19T03:00:00.000Z',policySha256=policy){
+  const receipt_id=(++seq).toString(16).padStart(24,'0');
+  const body={schema:'deadbyte.desktop-receipt.v1',receipt_id,kind,policy_sha256:policySha256,observed_at_utc:at,payload};
+  const receipt_sha256=createHash('sha256').update(Buffer.from(canonicalJson(body),'utf8')).digest('hex');
+  const signed={...body,receipt_sha256};
+  const signature_base64=cryptoSign(null,Buffer.concat([DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),privateKey).toString('base64');
+  return {...signed,attestation:{algorithm:'ed25519',key_id:keyId,signature_base64}};
+}
+const win={hwnd:'0x1234',pid:55,process_image_sha256:H('app'),title_sha256:H('title')};
+
+test('T6 memory derives only authenticated compact Desktop facts and never carries raw payload or authority nonce',()=>{
+  const effect=H('effect'),fingerprint=H('fingerprint'),target=H('target');
+  const receipts=[
+    receipt('desktop_observation',{frame_id:H('f1'),desktop_epoch:H('epoch'),topology_sha256:H('topo'),active_window:win,
+      preview:{sha256:H('preview'),byte_length:100,width:10,height:10,encoding:'ppm-base64'}},'2026-09-19T03:00:00.000Z'),
+    receipt('desktop_grounding',{requested_frame_id:H('f1'),grounded_frame_id:H('f2'),target_id:target,
+      query_sha256:H('query'),query_kind:'name_exact',control_type:50000},'2026-09-19T03:00:01.000Z'),
+    receipt('desktop_action_started',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('action'),
+      target_id:target,kind:'click_primary',pre_frame_id:H('f2'),authority_instance_nonce:H('SECRET-NONCE')},'2026-09-19T03:00:02.000Z'),
+    receipt('desktop_post_observation',{frame_id:H('f3'),desktop_epoch:H('epoch'),topology_sha256:H('topo'),active_window:win},'2026-09-19T03:00:03.000Z'),
+    receipt('desktop_action_completed',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('action'),
+      effect:{side_effect_state:'confirmed_injected'},action_chain:{chain_sha256:H('chain')},
+      post_observation:{post_observation_sha256:H('post'),foreground_transition:{changed:false}}},'2026-09-19T03:00:04.000Z')
+  ];
+  const memory=deriveDesktopMemory(receipts,{policySha256:policy,publicKey,keyId});
+  assert.equal(memory.schema,'deadbyte.desktop-memory.v1');
+  assert.equal(memory.recent_effects.length,1);
+  assert.equal(memory.recent_effects[0].effect_id,effect);
+  assert.equal(memory.grounded_targets[0].target_id,target);
+  assert.equal(memory.windows.length,1);
+  assert.equal(memory.last_verified_desktop.frame_id,H('f3'));
+  const encoded=JSON.stringify(memory);
+  assert.equal(encoded.includes('SECRET-NONCE'),false);
+  assert.equal(encoded.includes('data_base64'),false);
+  assert.equal(encoded.includes('"query":"'),false);
+  assert.equal(encoded.includes('authority_instance_nonce'),false);
+});
+
+test('T6 memory keeps unknown effects unresolved until authenticated completion appears',()=>{
+  const effect=H('unknown-effect'),fingerprint=H('unknown-fp');
+  const started=receipt('desktop_action_started',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('a'),
+    target_id:H('t'),kind:'click_primary',pre_frame_id:H('f')});
+  const unknown=receipt('desktop_action_outcome_unknown',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('a'),side_effect_state:'unknown'});
+  const memory=deriveDesktopMemory([started,unknown],{policySha256:policy,publicKey,keyId});
+  assert.deepEqual(memory.unresolved_unknown_effects.map(x=>x.effect_id),[effect]);
+});
+
+test('T6 rejects receipt substitution before memory trust',()=>{
+  const r=receipt('desktop_observation',{frame_id:H('f'),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+  const forged=structuredClone(r);forged.payload.frame_id=H('forged');
+  assert.throws(()=>deriveDesktopMemory([forged],{policySha256:policy,publicKey,keyId}),/unauthenticated receipt/);
+});
+
+test('T6 signed snapshot persists atomically and verifies independently',async()=>{
+  const r=receipt('desktop_observation',{frame_id:H('f'),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+  const memory=deriveDesktopMemory([r],{policySha256:policy,publicKey,keyId});
+  const snapshot=signDesktopMemory(memory,{privateKey,keyId});
+  const proof=verifyDesktopMemorySnapshot(snapshot,{publicKey,keyId,policySha256:policy});
+  assert.equal(proof.ok,true);
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-'));
+  const file=path.join(root,'desktop-memory.json');
+  const written=await writeDesktopMemorySnapshot(file,snapshot);
+  assert.equal(written.snapshot_sha256,snapshot.snapshot_sha256);
+  const disk=JSON.parse(await readFile(file,'utf8'));
+  assert.equal(verifyDesktopMemorySnapshot(disk,{publicKey,keyId,policySha256:policy}).ok,true);
+  const tampered=structuredClone(disk);tampered.memory.last_verified_desktop.frame_id=H('tamper');
+  assert.equal(verifyDesktopMemorySnapshot(tampered,{publicKey,keyId,policySha256:policy}).ok,false);
+});
+
+
+test('T6 evidence provider loads bounded signed receipts and emits compact planner projection',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-provider-'));
+  const evidence=path.join(root,'evidence');await mkdir(evidence);
+  const r1=receipt('desktop_observation',{frame_id:H('pf'),desktop_epoch:H('pe'),topology_sha256:H('pt'),active_window:win});
+  const r2=receipt('desktop_grounding',{requested_frame_id:H('pf'),grounded_frame_id:H('pg'),target_id:H('target'),
+    query_sha256:H('query'),query_kind:'root',control_type:50032});
+  for(const r of [r1,r2])await writeFile(path.join(evidence,r.receipt_id+'.json'),canonicalJson(r)+'\n');
+  await writeFile(path.join(evidence,'desktop-memory.json'),'{"ignored":true}\n');
+  const loaded=await loadDesktopEvidenceReceipts(evidence,{maxReceipts:4,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  assert.equal(loaded.length,2);
+  const provider=createDesktopMemoryProvider({
+    evidenceDir:evidence,snapshotPath:path.join(evidence,'desktop-memory.json'),policySha256:policy,
+    privateKey,publicKey,keyId,maxReceipts:4,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024
+  });
+  const refreshed=await provider.refresh();
+  assert.equal(refreshed.status,'ok');
+  assert.equal(refreshed.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.schema,'deadbyte.desktop-memory-planner.v1');
+  assert.equal(refreshed.planner_context.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.grounded_targets.length,1);
+  const encoded=JSON.stringify(refreshed.planner_context);
+  assert.equal(encoded.includes('data_base64'),false);
+  assert.equal(encoded.includes('authority_instance_nonce'),false);
+  const disk=JSON.parse(await readFile(path.join(evidence,'desktop-memory.json'),'utf8'));
+  assert.equal(verifyDesktopMemorySnapshot(disk,{publicKey,keyId,policySha256:policy}).ok,true);
+});
+
+test('T6 evidence loader fails closed instead of silently truncating receipt history',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-limit-'));
+  for(let i=0;i<3;i++){
+    const r=receipt('desktop_observation',{frame_id:H('limit-'+i),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+    await writeFile(path.join(root,r.receipt_id+'.json'),canonicalJson(r)+'\n');
+  }
+  await assert.rejects(loadDesktopEvidenceReceipts(root,{maxReceipts:2,maxDirectoryEntries:8}),/receipt limit exceeded/);
+});
+
+
+test('T6 current-policy memory rebuild ignores authenticated historical receipts from superseded Desktop policy',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-policy-rollover-'));
+  const stalePolicy=H('stale-policy');
+  const stale=receipt('desktop_observation',{frame_id:H('stale-f'),desktop_epoch:H('stale-e'),topology_sha256:H('stale-t'),active_window:win},'2026-09-19T02:00:00.000Z',stalePolicy);
+  const current1=receipt('desktop_observation',{frame_id:H('current-f1'),desktop_epoch:H('current-e'),topology_sha256:H('current-t'),active_window:win});
+  const current2=receipt('desktop_grounding',{requested_frame_id:H('current-f1'),grounded_frame_id:H('current-f2'),target_id:H('current-target'),query_sha256:H('current-query'),query_kind:'root',control_type:50032});
+  for(const item of [stale,current1,current2]) await writeFile(path.join(root,item.receipt_id+'.json'),canonicalJson(item)+'\n');
+  const filtered=await loadDesktopEvidenceReceipts(root,{policySha256:policy,maxReceipts:2,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  assert.equal(filtered.length,2);
+  assert.ok(filtered.every(item=>item.policy_sha256===policy));
+  const provider=createDesktopMemoryProvider({evidenceDir:root,snapshotPath:path.join(root,'desktop-memory.json'),policySha256:policy,privateKey,publicKey,keyId,maxReceipts:2,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  const refreshed=await provider.refresh();
+  assert.equal(refreshed.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.policy_sha256,policy);
+});

package/test/desktop-observer-r40.test.mjs

@@ -0,0 +1,119 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { parseNativeDesktopFrame,createDesktopObserverRuntime,createDesktopPreview } from '../src/desktop-observer-r40.mjs';
+
+const H=value=>createHash('sha256').update(value).digest('hex');
+
+function packet(overrides={},pixelByte=0x23){
+  const header={
+    schema:'deadbyte.desktop-native-frame.v1',
+    backend:'gdi-bitblt-fallback',
+    pixel_format:'BGRA8',
+    left:-4,top:0,width:8,height:2,stride:32,byte_length:64,
+    system_dpi:96,session_id:1,input_desktop:'Default',
+    foreground_hwnd:'0x1234',foreground_pid:444,
+    foreground_title:'Editor',foreground_image:'C:\\Apps\\editor.exe',
+    monitors:[
+      {left:-4,top:0,width:4,height:2,primary:false,device:'DISPLAY2'},
+      {left:0,top:0,width:4,height:2,primary:true,device:'DISPLAY1'}
+    ],
+    ...overrides
+  };
+  const pixels=Buffer.alloc(header.byte_length,pixelByte);
+  return Buffer.concat([Buffer.from(JSON.stringify(header)+'\n','utf8'),pixels]);
+}
+
+test('native parser binds pixels, topology and foreground identity',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  assert.equal(parsed.image_sha256,H(Buffer.alloc(64,0x23)));
+  assert.match(parsed.topology_sha256,/^[0-9a-f]{64}$/);
+  assert.deepEqual(parsed.bounds,{left:-4,top:0,width:8,height:2});
+  assert.equal(parsed.active_window.hwnd,'0x1234');
+  assert.equal(parsed.active_window.pid,444);
+  assert.equal(parsed.active_window.title_sha256,H('Editor'));
+  assert.equal(parsed.active_window.process_image_sha256,H('C:\\Apps\\editor.exe'));
+  assert.equal(parsed.pixels.length,64);
+});
+
+test('native parser rejects payload length substitution',()=>{
+  const value=packet();
+  assert.throws(()=>parseNativeDesktopFrame(value.subarray(0,value.length-1)),/payload length mismatch/);
+});
+
+test('native parser rejects stride and byte length lies',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({stride:64,byte_length:128})),/stride mismatch/);
+  assert.throws(()=>parseNativeDesktopFrame(packet({byte_length:68})),/byte_length mismatch/);
+});
+
+test('native parser rejects monitor topology outside virtual desktop',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({monitors:[
+    {left:0,top:0,width:4,height:2,primary:true,device:'DISPLAY1'},
+    {left:10,top:0,width:4,height:2,primary:false,device:'BAD'}
+  ]})),/outside virtual desktop/);
+});
+
+test('native parser requires exactly one primary monitor',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({monitors:[
+    {left:-4,top:0,width:4,height:2,primary:false,device:'DISPLAY2'},
+    {left:0,top:0,width:4,height:2,primary:false,device:'DISPLAY1'}
+  ]})),/exactly one primary/);
+});
+
+test('observer runtime creates stable epoch family and distinct frame identities',async()=>{
+  let index=0;
+  const provider=async()=>parseNativeDesktopFrame(packet({},++index));
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:provider,expectedObserverSha256:H('observer'),runtimeNonce:'r40-test-runtime',
+    now:()=>index===1?'2026-09-19T02:10:00.000Z':'2026-09-19T02:10:00.500Z'
+  });
+  const a=await runtime.capture();
+  const b=await runtime.capture();
+  assert.equal(a.frame.desktop_epoch,b.frame.desktop_epoch);
+  assert.notEqual(a.frame.frame_id,b.frame.frame_id);
+  assert.notEqual(a.frame.image_sha256,b.frame.image_sha256);
+  assert.equal(runtime.frameStatus(b.frame.frame_id).generation,2);
+  assert.equal(runtime.framePixels(b.frame.frame_id).length,64);
+});
+
+test('observer runtime evicts old raw frames by bounded cache',async()=>{
+  let index=0;
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:async()=>parseNativeDesktopFrame(packet({},++index)),
+    expectedObserverSha256:H('observer'),runtimeNonce:'r40-cache',maxCachedFrames:2,
+    now:()=>new Date(1_700_000_000_000+index*100).toISOString()
+  });
+  const a=await runtime.capture();
+  await runtime.capture();
+  const c=await runtime.capture();
+  assert.throws(()=>runtime.frameStatus(a.frame.frame_id),/expired or unknown/);
+  assert.equal(runtime.framePixels(c.frame.frame_id).length,64);
+});
+
+test('observer runtime rejects secure or unexpected input desktop',async()=>{
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:async()=>parseNativeDesktopFrame(packet({input_desktop:'Winlogon'})),
+    expectedObserverSha256:H('observer'),runtimeNonce:'r40-secure'
+  });
+  await assert.rejects(runtime.capture(),/is not allowed/);
+});
+
+test('raw title and process image do not escape parsed active-window identity',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  assert.equal(Object.hasOwn(parsed.active_window,'title'),false);
+  assert.equal(Object.hasOwn(parsed.active_window,'image'),false);
+  assert.equal(JSON.stringify(parsed.active_window).includes('Editor'),false);
+  assert.equal(JSON.stringify(parsed.active_window).includes('editor.exe'),false);
+});
+
+test('T5 preview is deterministic PPM and hard-bounded by max_preview_bytes',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  const a=createDesktopPreview({pixels:parsed.pixels,width:8,height:2,stride:32,maxBytes:128});
+  const b=createDesktopPreview({pixels:parsed.pixels,width:8,height:2,stride:32,maxBytes:128});
+  assert.equal(a.schema,'deadbyte.desktop-preview.v1');
+  assert.equal(a.encoding,'ppm-base64');
+  assert.ok(a.byte_length<=128);
+  assert.equal(a.sha256,b.sha256);
+  assert.equal(a.data_base64,b.data_base64);
+  assert.equal(Buffer.from(a.data_base64,'base64').subarray(0,2).toString('ascii'),'P6');
+});

package/test/desktop-policy-r40.test.mjs

@@ -0,0 +1,111 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp,writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import {
+  DESKTOP_POLICY_SCHEMA,DESKTOP_GRANT_SCHEMA,DESKTOP_ACTION_KINDS,
+  loadDesktopPolicy,desktopSessionStatus,assertDesktopArmed
+} from '../src/desktop-policy-r40.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-policy-'));
+  const grant=path.join(root,'desktop-grant.json');
+  const evidence=path.join(root,'evidence');
+  const observer=path.join(root,'observer.exe');
+  const input=path.join(root,'input.exe');
+  const grounder=path.join(root,'grounder.exe');
+  await writeFile(observer,'observer');
+  await writeFile(input,'input');
+  await writeFile(grounder,'grounder');
+  const policyPath=path.join(root,'desktop-policy.json');
+  const raw={
+    schema:DESKTOP_POLICY_SCHEMA,enabled:true,grant_file:grant,evidence_dir:evidence,
+    observer:{executable:observer,sha256:H('observer'),backend:'gdi-bitblt-fallback'},
+    input:{executable:input,sha256:H('input')},
+    grounder:{executable:grounder,sha256:H('grounder')},
+    allowed_input_desktops:['Default'],
+    allowed_actions:DESKTOP_ACTION_KINDS,
+    limits:{max_frame_age_ms:2000,max_frame_bytes:8*1024*1024,capture_timeout_ms:5000,input_timeout_ms:2000,ground_timeout_ms:2000,post_observe_timeout_ms:5000,max_preview_bytes:512*1024,max_text_bytes:4096}
+  };
+  await writeFile(policyPath,JSON.stringify(raw));
+  const policy=await loadDesktopPolicy(policyPath);
+  return {root,grant,policyPath,policy};
+}
+
+test('desktop policy loads bounded observer/input authority metadata',async()=>{
+  const {policy}=await fixture();
+  assert.equal(policy.schema,DESKTOP_POLICY_SCHEMA);
+  assert.equal(policy.allowed_input_desktops[0],'Default');
+  assert.deepEqual(policy.allowed_actions,DESKTOP_ACTION_KINDS);
+  assert.equal(policy.limits.max_frame_age_ms,2000);
+  assert.equal(policy.limits.ground_timeout_ms,2000);
+  assert.equal(policy.grounder.sha256,H('grounder'));
+  assert.match(policy.policy_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('desktop plane is fail-closed when no grant exists',async()=>{
+  const {policy}=await fixture();
+  assert.deepEqual(await desktopSessionStatus(policy),{
+    configured:true,armed:false,reason:'disarmed',standing:false,action_kinds:[]
+  });
+  await assert.rejects(assertDesktopArmed(policy,'click_primary'),/desktop plane is disarmed/);
+});
+
+test('desktop standing grant is policy-hash-bound and action-scoped',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['pointer_move','click_primary']
+  }));
+  const status=await desktopSessionStatus(policy);
+  assert.equal(status.armed,true);
+  assert.equal(status.reason,'standing-grant');
+  assert.deepEqual(status.action_kinds,['pointer_move','click_primary']);
+  assert.equal((await assertDesktopArmed(policy,'click_primary')).armed,true);
+  await assert.rejects(assertDesktopArmed(policy,'text_input'),/outside active grant/);
+});
+
+test('desktop grant rejects policy substitution',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:H('wrong-policy'),instance_nonce:H('nonce'),
+    action_kinds:['click_primary']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'policy-digest');
+});
+
+test('desktop grant rejects unknown or duplicate action kinds',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['click_primary','click_primary']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'actions-invalid');
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['click_primary','power_off']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'actions-invalid');
+});
+
+test('desktop policy rejects unsafe limits and malformed desktops',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-policy-bad-'));
+  const base={
+    schema:DESKTOP_POLICY_SCHEMA,enabled:true,
+    grant_file:path.join(root,'grant.json'),evidence_dir:path.join(root,'evidence'),
+    observer:{executable:path.join(root,'observer.exe'),sha256:H('observer')},
+    input:{executable:path.join(root,'input.exe'),sha256:H('input')},
+    grounder:{executable:path.join(root,'grounder.exe'),sha256:H('grounder')},
+    allowed_actions:['click_primary']
+  };
+  const p1=path.join(root,'bad-limit.json');
+  await writeFile(p1,JSON.stringify({...base,allowed_input_desktops:['Default'],limits:{max_frame_age_ms:999999}}));
+  await assert.rejects(loadDesktopPolicy(p1),/max_frame_age_ms/);
+  const p2=path.join(root,'bad-desktop.json');
+  await writeFile(p2,JSON.stringify({...base,allowed_input_desktops:['Default','Default']}));
+  await assert.rejects(loadDesktopPolicy(p2),/allowed_input_desktops invalid/);
+});