deadbyte-mcp 0.11.3 → 0.12.0

package/acceptance/r40/desktop-live-input.mjs

@@ -0,0 +1,128 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, randomBytes } from 'node:crypto';
+import { access, mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { generateTrustKeypair, loadPrivateSigningKey, loadPublicVerifyKey } from '../../src/trust.mjs';
+import { loadDesktopPolicy, desktopSessionStatus } from '../../src/desktop-policy-r40.mjs';
+import { createDesktopObserverRuntime } from '../../src/desktop-observer-r40.mjs';
+import { createNativeDesktopInputProvider } from '../../src/desktop-input-r40.mjs';
+import { createDesktopRuntime, verifyDesktopReceiptObject } from '../../src/desktop-runtime-r40.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'../..');
+const sourcePolicyPath=path.join(root,'controller','deadbyte-desktop-policy.json');
+const sha=value=>createHash('sha256').update(value).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 guarded native input accepts one SHIFT press-release under scoped authority then revokes it',async()=>{
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-live-input-'));
+  let grantFile='';
+  let sourceGrant='';
+  try{
+    const raw=JSON.parse(await readFile(sourcePolicyPath,'utf8'));
+    sourceGrant=raw.grant_file;
+    assert.equal(await absent(sourceGrant),true,'source Desktop grant must remain absent');
+
+    grantFile=path.join(temp,'desktop-grant.json');
+    const evidenceDir=path.join(temp,'desktop-evidence');
+    const policyPath=path.join(temp,'desktop-policy.json');
+    raw.grant_file=grantFile;
+    raw.evidence_dir=evidenceDir;
+    raw.allowed_actions=['key_chord'];
+    await writeFile(policyPath,JSON.stringify(raw,null,2));
+
+    const policy=await loadDesktopPolicy(policyPath);
+    const trustDir=path.join(temp,'trust');
+    await mkdir(trustDir,{recursive:true});
+    const keys=await generateTrustKeypair({
+      privateKeyPath:path.join(trustDir,'private.pem'),
+      publicKeyPath:path.join(trustDir,'public.pem')
+    });
+    const signer=await loadPrivateSigningKey(keys.privateKeyPath);
+    const verifier=await loadPublicVerifyKey(keys.publicKeyPath);
+
+    await writeFile(grantFile,JSON.stringify({
+      schema:'deadbyte.desktop-grant.v1',
+      policy_sha256:policy.policy_sha256,
+      instance_nonce:randomBytes(32).toString('hex'),
+      action_kinds:['key_chord'],
+      granted_at_utc:new Date().toISOString()
+    }));
+    const authority=await desktopSessionStatus(policy);
+    assert.equal(authority.armed,true);
+    assert.deepEqual(authority.action_kinds,['key_chord']);
+
+    const observer=createDesktopObserverRuntime({
+      observerPath:policy.observer.executable,
+      expectedObserverSha256:policy.observer.sha256,
+      maxFrameBytes:policy.limits.max_frame_bytes,
+      timeoutMs:policy.limits.capture_timeout_ms,
+      allowInputDesktops:policy.allowed_input_desktops
+    });
+    const input=createNativeDesktopInputProvider({
+      inputPath:policy.input.executable,
+      expectedInputSha256:policy.input.sha256,
+      timeoutMs:policy.limits.input_timeout_ms
+    });
+    const runtime=createDesktopRuntime({
+      policy,observerRuntime:observer,inputProvider:input,
+      privateKey:signer.privateKey,keyId:signer.keyId
+    });
+
+    const expected=await runtime.observe();
+    const intentId=sha(Buffer.from('R40 guarded live acceptance: SHIFT press-release','utf8'));
+    const result=await runtime.action({
+      intentId,kind:'key_chord',expectedFrameId:expected.frame.frame_id,keyChord:['SHIFT']
+    });
+    assert.equal(result.status,'ok');
+    assert.equal(result.injected,true);
+    assert.equal(result.action.kind,'key_chord');
+    assert.deepEqual(result.action.key_chord,['SHIFT']);
+    assert.equal(result.side_effect_state,'confirmed_injected');
+    assert.match(result.started_receipt_id,/^[0-9a-f]{24}$/);
+    assert.match(result.post_receipt_id,/^[0-9a-f]{24}$/);
+    assert.match(result.post_receipt_sha256,/^[0-9a-f]{64}$/);
+    assert.match(result.action_chain.chain_sha256,/^[0-9a-f]{64}$/);
+    assert.match(result.effect_id,/^[0-9a-f]{64}$/);
+    assert.match(result.effect_fingerprint,/^[0-9a-f]{64}$/);
+    assert.equal(result.effect_completion.schema,'deadbyte.effect-completion.v1');
+    assert.match(result.receipt_id,/^[0-9a-f]{24}$/);
+
+    const ids=[expected.receipt_id,result.started_receipt_id,result.post_receipt_id,result.receipt_id];
+    const verified=[];
+    for(const id of ids){
+      const receipt=JSON.parse(await readFile(path.join(evidenceDir,id+'.json'),'utf8'));
+      const proof=verifyDesktopReceiptObject(receipt,{
+        policySha256:policy.policy_sha256,publicKey:verifier.publicKey,keyId:verifier.keyId
+      });
+      assert.equal(proof.ok,true,'receipt verification failed: '+id);
+      verified.push({id,kind:proof.kind,sha256:proof.receipt_sha256});
+    }
+    assert.deepEqual(verified.map(v=>v.kind),['desktop_observation','desktop_action_started','desktop_post_observation','desktop_action_completed']);
+    const postReceipt=JSON.parse(await readFile(path.join(evidenceDir,result.post_receipt_id+'.json'),'utf8'));
+    assert.equal(postReceipt.payload.post_observation_sha256,result.post_observation.post_observation_sha256);
+    const completed=JSON.parse(await readFile(path.join(evidenceDir,result.receipt_id+'.json'),'utf8'));
+    assert.equal(completed.payload.effect.injected,true);
+    assert.match(completed.payload.effect.provider_receipt_sha256,/^[0-9a-f]{64}$/);
+
+    console.log(JSON.stringify({
+      status:'PASS',action:'key_chord',keys:['SHIFT'],native_injected:true,
+      authority_scope:['key_chord'],expected_frame_id:expected.frame.frame_id,
+      action_sha256:result.action.action_sha256,guard_sha256:result.guard.guard_sha256,
+      provider_receipt_sha256:completed.payload.effect.provider_receipt_sha256,
+      action_chain_sha256:result.action_chain.chain_sha256,
+      effect_id:result.effect_id,effect_fingerprint:result.effect_fingerprint,
+      effect_completion_result_sha256:result.effect_completion.result_sha256,
+      observation_receipt:verified[0],started_receipt:verified[1],post_receipt:verified[2],completed_receipt:verified[3],
+      replay_performed:false
+    }));
+  } finally {
+    if(grantFile) await rm(grantFile,{force:true}).catch(()=>{});
+    if(sourceGrant) assert.equal(await absent(sourceGrant),true,'source Desktop grant changed during acceptance');
+    if(grantFile) assert.equal(await absent(grantFile),true,'temporary Desktop grant was not revoked');
+    await rm(temp,{recursive:true,force:true});
+  }
+});

package/acceptance/r40/desktop-live-observe.mjs

@@ -0,0 +1,100 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { access, mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { generateTrustKeypair, loadPrivateSigningKey, loadPublicVerifyKey } from '../../src/trust.mjs';
+import { loadDesktopPolicy } from '../../src/desktop-policy-r40.mjs';
+import { createDesktopObserverRuntime } from '../../src/desktop-observer-r40.mjs';
+import { createNativeDesktopInputProvider } from '../../src/desktop-input-r40.mjs';
+import { createDesktopRuntime, verifyDesktopReceiptObject } from '../../src/desktop-runtime-r40.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'../..');
+const sourcePolicyPath=path.join(root,'controller','deadbyte-desktop-policy.json');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 live native Desktop status and observation succeed while mutation authority stays DISARMED',async()=>{
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-live-observe-'));
+  try{
+    const raw=JSON.parse(await readFile(sourcePolicyPath,'utf8'));
+    const sourceGrant=raw.grant_file;
+    assert.equal(await absent(sourceGrant),true,'source Desktop grant must be absent before live observation');
+
+    const grantFile=path.join(temp,'desktop-grant.json');
+    const evidenceDir=path.join(temp,'desktop-evidence');
+    const policyPath=path.join(temp,'desktop-policy.json');
+    await mkdir(evidenceDir,{recursive:true});
+    raw.grant_file=grantFile;
+    raw.evidence_dir=evidenceDir;
+    await writeFile(policyPath,JSON.stringify(raw,null,2));
+
+    const policy=await loadDesktopPolicy(policyPath);
+    const trustDir=path.join(temp,'trust');
+    await mkdir(trustDir,{recursive:true});
+    const keys=await generateTrustKeypair({
+      privateKeyPath:path.join(trustDir,'private.pem'),
+      publicKeyPath:path.join(trustDir,'public.pem')
+    });
+    const signer=await loadPrivateSigningKey(keys.privateKeyPath);
+    const verifier=await loadPublicVerifyKey(keys.publicKeyPath);
+
+    const observer=createDesktopObserverRuntime({
+      observerPath:policy.observer.executable,
+      expectedObserverSha256:policy.observer.sha256,
+      maxFrameBytes:policy.limits.max_frame_bytes,
+      timeoutMs:policy.limits.capture_timeout_ms,
+      allowInputDesktops:policy.allowed_input_desktops
+    });
+    const input=createNativeDesktopInputProvider({
+      inputPath:policy.input.executable,
+      expectedInputSha256:policy.input.sha256,
+      timeoutMs:policy.limits.input_timeout_ms
+    });
+    const runtime=createDesktopRuntime({
+      policy,observerRuntime:observer,inputProvider:input,
+      privateKey:signer.privateKey,keyId:signer.keyId
+    });
+
+    const status=await runtime.status();
+    assert.equal(status.status,'ok');
+    assert.equal(status.armed,false);
+    assert.equal(status.reason,'disarmed');
+    assert.deepEqual(status.action_kinds,[]);
+    assert.equal(await absent(grantFile),true);
+
+    const observed=await runtime.observe();
+    assert.equal(observed.status,'ok');
+    assert.match(observed.frame.frame_id,/^[0-9a-f]{64}$/);
+    assert.match(observed.frame.image_sha256,/^[0-9a-f]{64}$/);
+    assert.match(observed.frame.topology_sha256,/^[0-9a-f]{64}$/);
+    assert.ok(observed.byte_length>0);
+    assert.equal(Object.hasOwn(observed,'pixels'),false,'public observation must not expose raw frame pixels');
+    assert.match(observed.receipt_id,/^[0-9a-f]{24}$/);
+    assert.match(observed.receipt_sha256,/^[0-9a-f]{64}$/);
+
+    const receipt=JSON.parse(await readFile(path.join(evidenceDir,observed.receipt_id+'.json'),'utf8'));
+    const proof=verifyDesktopReceiptObject(receipt,{
+      policySha256:policy.policy_sha256,publicKey:verifier.publicKey,keyId:verifier.keyId
+    });
+    assert.equal(proof.ok,true);
+    assert.equal(proof.kind,'desktop_observation');
+
+    assert.equal(await absent(grantFile),true,'live observe must not create mutation authority');
+    assert.equal(await absent(sourceGrant),true,'live observe must not touch source Desktop grant');
+
+    const w=observed.frame.active_window;
+    console.log(JSON.stringify({
+      status:'PASS',desktop_authority:'DISARMED',observer_backend:observed.backend,
+      frame_id:observed.frame.frame_id,desktop_epoch:observed.frame.desktop_epoch,
+      topology_sha256:observed.frame.topology_sha256,image_sha256:observed.frame.image_sha256,
+      bounds:observed.frame.bounds,byte_length:observed.byte_length,
+      active_window:w?{hwnd:w.hwnd,pid:w.pid,process_image_sha256:w.process_image_sha256??null,title_sha256:w.title_sha256??null}:null,
+      receipt_id:observed.receipt_id,receipt_sha256:observed.receipt_sha256,receipt_verified:true,
+      raw_pixels_exposed:false
+    }));
+  } finally {
+    await rm(temp,{recursive:true,force:true});
+  }
+});

package/acceptance/r40/desktop-live-uia.mjs

@@ -0,0 +1,121 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { access, mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { generateTrustKeypair, loadPrivateSigningKey, loadPublicVerifyKey } from '../../src/trust.mjs';
+import { loadDesktopPolicy } from '../../src/desktop-policy-r40.mjs';
+import { createDesktopObserverRuntime } from '../../src/desktop-observer-r40.mjs';
+import { createNativeDesktopGrounder } from '../../src/desktop-uia-r40.mjs';
+import { createDesktopRuntime, verifyDesktopReceiptObject } from '../../src/desktop-runtime-r40.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const root=path.resolve(here,'../..');
+const sourcePolicyPath=path.join(root,'controller','deadbyte-desktop-policy.json');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 T5 live UIA root grounding and bounded preview stay read-only and signed',async()=>{
+  const temp=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-live-uia-'));
+  let sourceGrant='';
+  try{
+    const raw=JSON.parse(await readFile(sourcePolicyPath,'utf8'));
+    sourceGrant=raw.grant_file;
+    assert.equal(await absent(sourceGrant),true,'source Desktop grant must be absent');
+
+    const grantFile=path.join(temp,'desktop-grant.json');
+    const evidenceDir=path.join(temp,'desktop-evidence');
+    const policyPath=path.join(temp,'desktop-policy.json');
+    raw.grant_file=grantFile;
+    raw.evidence_dir=evidenceDir;
+    await writeFile(policyPath,JSON.stringify(raw,null,2));
+    const policy=await loadDesktopPolicy(policyPath);
+
+    const trustDir=path.join(temp,'trust');
+    await mkdir(trustDir,{recursive:true});
+    const keys=await generateTrustKeypair({
+      privateKeyPath:path.join(trustDir,'private.pem'),
+      publicKeyPath:path.join(trustDir,'public.pem')
+    });
+    const signer=await loadPrivateSigningKey(keys.privateKeyPath);
+    const verifier=await loadPublicVerifyKey(keys.publicKeyPath);
+
+    const observer=createDesktopObserverRuntime({
+      observerPath:policy.observer.executable,
+      expectedObserverSha256:policy.observer.sha256,
+      maxFrameBytes:policy.limits.max_frame_bytes,
+      timeoutMs:policy.limits.capture_timeout_ms,
+      allowInputDesktops:policy.allowed_input_desktops,
+      maxCachedFrames:4
+    });
+    const grounder=createNativeDesktopGrounder({
+      grounderPath:policy.grounder.executable,
+      expectedGrounderSha256:policy.grounder.sha256,
+      timeoutMs:policy.limits.ground_timeout_ms
+    });
+    const runtime=createDesktopRuntime({
+      policy,observerRuntime:observer,
+      inputProvider:async()=>{throw new Error('input must not be called by T5 live grounding');},
+      grounderProvider:grounder,
+      privateKey:signer.privateKey,keyId:signer.keyId
+    });
+
+    const status=await runtime.status();
+    assert.equal(status.armed,false);
+    assert.equal(await absent(grantFile),true);
+
+    const observed=await runtime.observe({preview:true});
+    assert.equal(observed.status,'ok');
+    assert.ok(observed.frame.active_window,'T5 live UIA acceptance requires one foreground window');
+    assert.equal(observed.preview.schema,'deadbyte.desktop-preview.v1');
+    assert.equal(observed.preview.encoding,'ppm-base64');
+    assert.ok(observed.preview.byte_length<=policy.limits.max_preview_bytes);
+    assert.match(observed.preview.sha256,/^[0-9a-f]{64}$/);
+    assert.ok(Buffer.from(observed.preview.data_base64,'base64').length===observed.preview.byte_length);
+
+    const grounded=await runtime.ground({
+      frameId:observed.frame.frame_id,
+      query:{kind:'root',value:'',max_results:1,ordinal:0}
+    });
+    assert.equal(grounded.status,'ok');
+    assert.equal(grounded.target.source,'uia');
+    assert.equal(grounded.target.frame_id,grounded.frame.frame_id);
+    assert.equal(grounded.grounding.query_kind,'root');
+    assert.equal(grounded.grounding.match_count,1);
+    assert.equal(grounded.grounding.ordinal,0);
+    assert.match(grounded.target.target_id,/^[0-9a-f]{64}$/);
+    assert.match(grounded.grounding.provider_receipt_sha256,/^[0-9a-f]{64}$/);
+
+    const b=grounded.frame.bounds,r=grounded.target.rect;
+    assert.ok(r.left>=b.left&&r.top>=b.top&&r.left+r.width<=b.left+b.width&&r.top+r.height<=b.top+b.height);
+
+    const receipt=JSON.parse(await readFile(path.join(evidenceDir,grounded.grounding.receipt_id+'.json'),'utf8'));
+    const proof=verifyDesktopReceiptObject(receipt,{
+      policySha256:policy.policy_sha256,publicKey:verifier.publicKey,keyId:verifier.keyId
+    });
+    assert.equal(proof.ok,true);
+    assert.equal(proof.kind,'desktop_grounding');
+    assert.equal(receipt.payload.target_id,grounded.target.target_id);
+    assert.equal(receipt.payload.query_sha256,grounded.grounding.query_sha256);
+
+    assert.equal(await absent(grantFile),true,'T5 grounding must not create Desktop mutation grant');
+    assert.equal(await absent(sourceGrant),true,'source Desktop grant changed');
+
+    console.log(JSON.stringify({
+      status:'PASS',authority:'DISARMED',preview:{
+        width:observed.preview.width,height:observed.preview.height,
+        byte_length:observed.preview.byte_length,sha256:observed.preview.sha256
+      },
+      foreground:{hwnd:grounded.frame.active_window?.hwnd??null,pid:grounded.frame.active_window?.pid??null},
+      target_id:grounded.target.target_id,rect:grounded.target.rect,
+      query_sha256:grounded.grounding.query_sha256,
+      provider_receipt_sha256:grounded.grounding.provider_receipt_sha256,
+      grounding_receipt_id:grounded.grounding.receipt_id,
+      grounding_receipt_sha256:grounded.grounding.receipt_sha256,
+      receipt_verified:true,mutation:false
+    }));
+  }finally{
+    if(sourceGrant) assert.equal(await absent(sourceGrant),true,'source Desktop grant changed during cleanup');
+    await rm(temp,{recursive:true,force:true});
+  }
+});

package/controller/README.TXT

@@ -1,4 +1,4 @@
-DEADBYTE MCP V0.11.3 / R39 CONTROLLER
+DEADBYTE MCP V0.12.0 / R40 CONTROLLER
 ====================================
 
 ENTRY POINT
@@ -8,12 +8,14 @@ Primary operator entry point:
   npx deadbyte-mcp@latest remote
 
 Bare `remote` is a foreground device session. It starts the verified runtime, arms process,
-coding, and autonomous authority, verifies those three planes are ARMED, and requires Host to stay
-DISARMED. The production Bridge uses the R37 compact capability profile (<=42 tools) while local
-stdio MCP keeps the exact full 76-tool profile. The compact console shows request-before-result
+coding, and autonomous authority, verifies those three planes are ARMED, and requires Desktop and Host
+to stay DISARMED. R40 Desktop observation/UIA grounding remains available read-only; GUI mutation needs
+the separate explicit Desktop standing grant and Autonomous authority cannot substitute for it.
+The production Bridge uses the compact capability profile (exact 42 tools / 6 gateways) while local
+stdio MCP keeps the exact full 80-tool profile. The compact console shows request-before-result
 Live Activity without raw SHA text, request IDs, payload JSON, or duplicate Bridge stdout by
 default; use `remote --verbose` for the detailed audit/runtime stream. Ctrl+C/SIGTERM or foreground
-input closure revokes process/coding/autonomous authority, applies fail-safe Host disarm, and parks
+input closure revokes Desktop/process/coding/autonomous authority, applies fail-safe Host disarm, and parks
 the Bridge. A detached nonce-bound guardian performs the same fixed revoke+park cleanup if the
 foreground owner is hard-killed. The v2 session marker records owner PID, guardian PID, and random
 256-bit nonce so a guardian cannot remove a replacement session marker; a later start recovers only

package/controller/deadbyte-controller.config.psd1.example

@@ -17,6 +17,9 @@
     MachineFsRuntimeEnabled = $false
     # R32 observation is read-only over registered roots/local runtime and never arms coding mutation authority.
     ObservationRuntimeEnabled = $false
+    # R40 Desktop observation/mutation runtime. Enabling runtime never arms mutation authority.
+    DesktopRuntimeEnabled = $false
+    DesktopPolicyFile = ''
     CodingPolicyFile = ''
     # Optional R35 multi-language semantic LSP config. Path and SHA-256 must be supplied together.
     # The release generator copies these exact bytes into the immutable generation when configured.