deadbyte-mcp 0.11.3 → 0.13.0

package/src/tool-audit.mjs

@@ -82,15 +82,42 @@ function outcomeReceiptHashes(result){
   visit(result?.structuredContent??result);
   return [...found].sort();
 }
+function safeOutcomeReason(value){
+  if(value===null||value===undefined) return null;
+  let text=typeof value==='string'?value:(value instanceof Error?String(value.message??value):null);
+  if(text===null) return null;
+  text=text.replace(/[\\r\\n\\t]+/g,' ').replace(/\\s{2,}/g,' ').trim();
+  if(!text) return null;
+  const originalBytes=Buffer.from(text,'utf8');
+  if(secretValuePattern.test(text)) return `<redacted reason bytes=${originalBytes.length} sha256=${sha256(originalBytes)}>`;
+  const max=240;
+  if(text.length>max) text=`${text.slice(0,max-1)}…`;
+  return text;
+}
+function resultOutcomeReason(result){
+  const structured=result?.structuredContent;
+  const candidates=[
+    structured?.error,structured?.message,structured?.reason,structured?.result?.error,structured?.result?.message,
+    ...(Array.isArray(result?.content)?result.content.filter(item=>item?.type==='text').map(item=>item.text):[])
+  ];
+  for(const candidate of candidates){
+    const reason=safeOutcomeReason(candidate);
+    if(reason) return reason;
+  }
+  return null;
+}
 function summarizeOutcome(result,error,durationMs){
   const duration=Math.max(0,Math.round(Number(durationMs)||0));
   if(error){
     const message=String(error?.message??error);
-    return {status:'threw',is_error:true,duration_ms:duration,receipt_sha256s:[],error:{name:String(error?.name||'Error').slice(0,128),byte_count:Buffer.byteLength(message,'utf8'),sha256:sha256(Buffer.from(message,'utf8'))}};
+    return {status:'threw',is_error:true,duration_ms:duration,receipt_sha256s:[],reason:safeOutcomeReason(message),
+      error:{name:String(error?.name||'Error').slice(0,128),byte_count:Buffer.byteLength(message,'utf8'),sha256:sha256(Buffer.from(message,'utf8'))}};
   }
   const structured=result?.structuredContent;
   const status=typeof structured?.status==='string'?structured.status:(result?.isError===true?'error':'ok');
-  return {status:String(status).slice(0,128),is_error:result?.isError===true,duration_ms:duration,receipt_sha256s:outcomeReceiptHashes(result)};
+  const isError=result?.isError===true;
+  return {status:String(status).slice(0,128),is_error:isError,duration_ms:duration,receipt_sha256s:outcomeReceiptHashes(result),
+    ...(isError?{reason:resultOutcomeReason(result)}:{})};
 }
 
 async function appendSynced(file,line){

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.11.3';
+export const DEADBYTE_VERSION = '0.13.0';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/autonomous-capability-r36.test.mjs

@@ -32,7 +32,11 @@ const typedCases=[
   ['machine_fs_delete',{kind:'machine_fs_delete',path:'empty',expected_source_identity:H}],
   ['observation_search_start',{kind:'observation_search_start',path:'.',pattern:'FAIL',case_sensitive:false,max_results:100,max_files:1000,max_bytes:1048576,max_file_bytes:262144}],
   ['observation_search_page',{kind:'observation_search_page',search_id:H,cursor:null,limit:50}],
-  ['observation_system_status',{kind:'observation_system_status'}]
+  ['observation_system_status',{kind:'observation_system_status'}],
+  ['desktop_status',{kind:'desktop_status'}],
+  ['desktop_observe',{kind:'desktop_observe'}],
+  ['desktop_target',{kind:'desktop_target',frame_id:H,uia_query:{kind:'root',value:'',max_results:1,ordinal:0}}],
+  ['desktop_action',{kind:'desktop_action',action_kind:'click_primary',expected_frame_id:H,target_id:null,point:{x:10,y:20},scroll_delta:null,key_chord:null,text:null}]
 ];
 
 test('R36 planner parses first-class capability actions without delegate wrapper',()=>{
@@ -44,6 +48,20 @@ test('R36 planner parses first-class capability actions without delegate wrapper
   }
 });
 
+test('R40 T7 planner rejects ambiguous Desktop actions before runtime',()=>{
+  assert.throws(()=>parseR34PlannerDecision(wrap({
+    kind:'desktop_action',action_kind:'click_primary',expected_frame_id:H,
+    target_id:H,point:{x:1,y:2},scroll_delta:null,key_chord:null,text:null
+  }),policy),/exactly one/);
+  assert.throws(()=>parseR34PlannerDecision(wrap({
+    kind:'desktop_action',action_kind:'key_chord',expected_frame_id:H,
+    target_id:null,point:null,scroll_delta:null,key_chord:['CTRL','CTRL'],text:null
+  }),policy),/duplicate/);
+  assert.throws(()=>parseR34PlannerDecision(wrap({
+    kind:'desktop_target',frame_id:H,uia_query:{kind:'root',value:'not-empty',max_results:1,ordinal:0}
+  }),policy),/root query value/);
+});
+
 test('R36 legacy delegate is accepted only for a known operation and normalized into typed action',()=>{
   const parsed=parseR34PlannerDecision(wrap({kind:'delegate',operation:{kind:'process_status',session_id:H}}),policy);
   assert.equal(parsed.action.kind,'process_status');
@@ -62,6 +80,30 @@ test('R36 planner prompt exposes configured capability manifest and never advert
   assert.doesNotMatch(prompt,/host\.exec|host_file|host authority/i);
 });
 
+test('R40 T6 autonomous planner receives bounded Desktop memory projection as context only',async()=>{
+  let calls=0;
+  const desktopMemoryProvider={plannerContext:async()=>{
+    calls++;
+    return Object.freeze({
+      schema:'deadbyte.desktop-memory-planner.v1',
+      snapshot_sha256:'1'.repeat(64),memory_sha256:'2'.repeat(64),policy_sha256:'3'.repeat(64),
+      source_receipt_count:7,last_verified_desktop:{frame_id:'4'.repeat(64),desktop_epoch:'5'.repeat(64),topology_sha256:'6'.repeat(64)},
+      windows:[],grounded_targets:[],rejected_target_fingerprints:[],recent_effects:[],unresolved_unknown_effects:[]
+    });
+  }};
+  const f=await createR34Fixture({desktopMemoryProvider});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t6-memory',rootId:'project',title:'desktop memory context',goal:'inspect project',acceptance:'planner sees authenticated desktop summary'});
+    const result=await f.runtime.run({goalId:goal.goal_id,maxCycles:1});
+    assert.equal(result.status,'input_required');
+    assert.equal(calls,1);
+    assert.match(result.planner_request.prompt,/deadbyte\.desktop-memory-planner\.v1/);
+    assert.match(result.planner_request.prompt,/"desktop_memory"/);
+    assert.match(result.planner_request.prompt,/"source_receipt_count":7/);
+    assert.doesNotMatch(result.planner_request.prompt,/data_base64|authority_instance_nonce|SECRET/);
+  }finally{await f.cleanup();}
+});
+
 test('R36 progress fingerprint ignores rationale but binds capability, evidence, session and cursor identity',()=>{
   const base={before:{mutation_epoch:2},after:{mutation_epoch:2},decision:{kind:'process_read',rationale:'first'},evidence:{capability_id:'process.read',session_id:H,cursor:10,observation_sha256:'b'.repeat(64),receipt_sha256:'c'.repeat(64)}};
   const a=judgeProgress(base);

package/test/autonomous-desktop-r40.test.mjs

@@ -0,0 +1,188 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { createR34Fixture,sendPlannerDecision,inspectDecision } from './helpers/autonomous-r34-fixture.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const FRAME=H('desktop-frame');
+const GROUNDED_FRAME=H('desktop-grounded-frame');
+const TARGET=H('desktop-target');
+const POLICY=H('desktop-policy');
+const WIN={hwnd:'0x1234',pid:77,process_image_sha256:H('desktop-app'),title_sha256:H('desktop-title')};
+
+function fakeDesktopRuntime({armed=false,unknown=false}={}){
+  const calls={status:0,observe:0,ground:0,action:0,verify:0};
+  const receipts=new Map();
+  let seq=0;
+  const issue=kind=>{
+    const receipt_id=(++seq).toString(16).padStart(24,'0');
+    const receipt_sha256=H(kind+':'+receipt_id);
+    receipts.set(receipt_id,{ok:true,receipt_id,receipt_sha256,kind});
+    return {receipt_id,receipt_sha256};
+  };
+  const frame=id=>({frame_id:id,desktop_epoch:H('epoch'),topology_sha256:H('topology'),
+    observed_at_utc:'2026-09-19T10:00:00.000Z',bounds:{left:0,top:0,width:1920,height:1080},
+    active_window:WIN,image_sha256:H('image:'+id)});
+  return {
+    calls,
+    async status(){calls.status++;return {status:'ok',configured:true,armed,reason:armed?'standing-grant':'disarmed',
+      action_kinds:armed?['click_primary']:[],policy_sha256:POLICY,observer_backend:'fake'};},
+    async observe(){calls.observe++;const r=issue('desktop_observation');return {status:'ok',frame:frame(FRAME),backend:'fake',byte_length:4,...r};},
+    async ground({frameId,query}){calls.ground++;assert.equal(frameId,FRAME);assert.equal(query.kind,'root');
+      const r=issue('desktop_grounding');return {status:'ok',frame:frame(GROUNDED_FRAME),
+        target:{target_id:TARGET,frame_id:GROUNDED_FRAME,rect:{left:100,top:100,width:200,height:80},source:'uia'},
+        grounding:{query_sha256:H('query'),query_kind:'root',match_count:1,ordinal:0,provider_receipt_sha256:H('provider'),...r}};},
+    async action(args){calls.action++;
+      assert.equal(args.effectContext.goalId.length,64);
+      if(unknown){
+        assert.equal(args.expectedFrameId,FRAME);assert.equal(args.effectContext.observationHeadSha256,FRAME);
+        const e=new Error('transport lost after SendInput');e.side_effect_state='unknown';const r=issue('desktop_action_outcome_unknown');
+        e.receipt_id=r.receipt_id;e.receipt_sha256=r.receipt_sha256;throw e;
+      }
+      assert.equal(args.expectedFrameId,GROUNDED_FRAME);assert.equal(args.targetId,TARGET);
+      assert.equal(args.effectContext.observationHeadSha256,GROUNDED_FRAME);
+      const started=issue('desktop_action_started'),post=issue('desktop_post_observation'),done=issue('desktop_action_completed');
+      return {status:'ok',injected:true,side_effect_state:'confirmed_injected',
+        action:{intent_id:args.intentId,kind:'click_primary',frame_id:GROUNDED_FRAME,desktop_epoch:H('epoch'),
+          topology_sha256:H('topology'),expected_window:WIN,target_id:TARGET,point:{x:200,y:140},
+          scroll_delta:null,key_chord:null,text:null,text_sha256:null,action_sha256:H('action')},
+        guard:{guard_sha256:H('guard')},post_observation:{change_observed:true,window_changed:false,
+          post_observation_sha256:H('post-observation')},action_chain:{chain_sha256:H('chain')},
+        effect_id:H('effect'),effect_fingerprint:H('effect-fp'),effect_completion:{schema:'deadbyte.effect-completion.v1',result_sha256:H('effect-result')},
+        started_receipt_id:started.receipt_id,started_receipt_sha256:started.receipt_sha256,
+        post_receipt_id:post.receipt_id,post_receipt_sha256:post.receipt_sha256,
+        receipt_id:done.receipt_id,receipt_sha256:done.receipt_sha256};},
+    async verifyReceipt({receiptId}){calls.verify++;const r=receipts.get(receiptId);if(!r)throw new Error('unknown fake receipt');return r;}
+  };
+}
+
+const plan=steps=>({schema:'deadbyte.autonomous-decision.v2',kind:'plan_create',title:'Desktop flow',
+  reason:'prove bounded desktop loop',steps:steps.map(step_id=>({step_id,intent:step_id}))});
+const complete=(step_id,tag)=>({schema:'deadbyte.autonomous-decision.v2',kind:'step_complete',step_id,
+  evidence:[{kind:'desktop',id:tag,sha256:H(tag)}]});
+
+async function toAct(f,goal,result){
+  result=await sendPlannerDecision(f.runtime,goal.goal_id,result,inspectDecision());
+  assert.equal(result.loop.phase,'ACTING');
+  return result;
+}
+
+test('T7 capability manifest exposes Desktop only when runtime exists and never Host',async()=>{
+  const d=fakeDesktopRuntime();
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t7-manifest',rootId:'project',title:'desktop manifest',goal:'inspect desktop',acceptance:'desktop capability visible'});
+    const result=await f.runtime.run({goalId:goal.goal_id,maxCycles:1});
+    assert.equal(result.status,'input_required');
+    assert.match(result.planner_request.prompt,/"id":"desktop\.observe"/);
+    assert.match(result.planner_request.prompt,/"id":"desktop\.action"/);
+    assert.match(result.planner_request.prompt,/"authority":"desktop"/);
+    assert.doesNotMatch(result.planner_request.prompt,/host\.exec|host_file/);
+  }finally{await f.cleanup();}
+});
+
+test('T7 read-only Desktop observe works while Desktop mutation authority is DISARMED',async()=>{
+  const d=fakeDesktopRuntime({armed:false});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t7-observe',rootId:'project',title:'desktop observe',goal:'observe desktop',acceptance:'signed observation'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    assert.equal(result.loop.phase,'VERIFYING');
+    assert.equal(d.calls.observe,1);assert.equal(d.calls.action,0);assert.equal(d.calls.verify,1);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const completed=journal.events.find(e=>e.type==='delegated_action_completed'&&e.payload?.operation?.kind==='desktop_observe');
+    assert.equal(completed.payload.capability_id,'desktop.observe');
+    assert.equal(completed.payload.evidence.kind,'desktop_receipts');
+  }finally{await f.cleanup();}
+});
+
+test('T7 Autonomous authority cannot substitute for missing Desktop mutation grant',async()=>{
+  const d=fakeDesktopRuntime({armed:false});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t7-disarmed',rootId:'project',title:'desktop disarmed',goal:'click only if separately authorized',acceptance:'no input without Desktop grant'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['act']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_action',action_kind:'click_primary',expected_frame_id:FRAME,target_id:null,point:{x:20,y:20},
+      scroll_delta:null,key_chord:null,text:null
+    }});
+    assert.equal(result.status,'paused');
+    assert.equal(result.reason,'desktop_authority_unavailable');
+    assert.equal(d.calls.action,0);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    assert.ok(journal.events.some(e=>e.type==='waiting_entered'&&e.payload?.reason==='desktop_authority_unavailable'));
+    assert.equal(journal.events.some(e=>e.type==='delegated_action_started'&&e.payload?.operation?.kind==='desktop_action'),false);
+  }finally{await f.cleanup();}
+});
+
+test('T7 armed flow binds observe to UIA target to one Desktop action and verifies every Desktop receipt',async()=>{
+  const d=fakeDesktopRuntime({armed:true});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t7-flow',rootId:'project',title:'desktop flow',goal:'observe target click',acceptance:'one receipt-verified action'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe','target','act']));
+
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('observe','observe-proof'));
+
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_target',frame_id:FRAME,uia_query:{kind:'root',value:'',max_results:1,ordinal:0}
+    }});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('target','target-proof'));
+
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_action',action_kind:'click_primary',expected_frame_id:GROUNDED_FRAME,target_id:TARGET,point:null,
+      scroll_delta:null,key_chord:null,text:null
+    }});
+    assert.equal(result.loop.phase,'VERIFYING');
+    assert.equal(d.calls.observe,1);assert.equal(d.calls.ground,1);assert.equal(d.calls.action,1);
+    assert.equal(d.calls.verify,5);
+
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const completed=journal.events.filter(e=>e.type==='delegated_action_completed'&&String(e.payload?.operation?.kind).startsWith('desktop_'));
+    assert.deepEqual(completed.map(e=>e.payload.operation.kind),['desktop_observe','desktop_target','desktop_action']);
+    const action=completed.at(-1);
+    assert.equal(action.payload.capability_id,'desktop.action');
+    assert.equal(action.payload.evidence.kind,'desktop_receipts');
+    assert.deepEqual(action.payload.evidence.receipts.map(x=>x.kind),[
+      'desktop_action_started','desktop_post_observation','desktop_action_completed'
+    ]);
+    assert.equal(Object.hasOwn(action.payload.result.action_summary,'text'),false);
+  }finally{await f.cleanup();}
+});
+
+test('T7 UNKNOWN Desktop outcome pauses for critic/replan and is never replayed',async()=>{
+  const d=fakeDesktopRuntime({armed:true,unknown:true});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'r40-t7-unknown',rootId:'project',title:'desktop unknown',goal:'never replay unknown',acceptance:'pause on uncertain side effect'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe','act']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('observe','observe-proof-unknown'));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_action',action_kind:'click_primary',expected_frame_id:FRAME,target_id:null,point:{x:40,y:40},
+      scroll_delta:null,key_chord:null,text:null
+    }});
+    assert.equal(result.status,'paused');
+    assert.equal(result.reason,'desktop_outcome_unknown');
+    assert.equal(d.calls.action,1);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    assert.ok(journal.events.some(e=>e.type==='waiting_entered'&&e.payload?.reason==='desktop_outcome_unknown'&&e.payload?.resume_phase==='CRITIC'));
+    assert.ok(journal.events.some(e=>e.type==='goal_paused'&&e.payload?.side_effect_state==='unknown'));
+    const again=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    assert.equal(again.status,'paused');
+    assert.equal(d.calls.action,1,'UNKNOWN action was replayed');
+  }finally{await f.cleanup();}
+});

package/test/capability-ledger-r36.test.mjs

@@ -36,6 +36,7 @@ test('R36 capability ledger rejects duplicate ids', () => {
 
 test('R36 capability ledger validates authority and canonicalizes identity', () => {
   assert.throws(() => createCapabilityLedger([entry({authority:'root'})]), /authority/i);
+  assert.doesNotThrow(()=>createCapabilityLedger([entry({authority:'desktop'})]));
   const a=createCapabilityLedger([
     entry({id:'process.read',full_tool:'process_session_read',compact_tool:'process_session',compact_op:'read',runtime_flag:'DEADBYTE_PROCESS_RUNTIME',authority:'process'}),
     entry({})

package/test/cli-entrypoint.test.mjs

@@ -21,7 +21,7 @@ test('npx CLI reports the canonical package version through --version, -v and ve
   for(const arg of ['--version','-v','version']){
     const result=spawnSync(process.execPath,[cliPath,arg],{cwd:root,encoding:'utf8',windowsHide:true});
     assert.equal(result.status,0,result.stderr);
-    assert.equal(result.stdout.trim(),'0.11.3');
+    assert.equal(result.stdout.trim(),'0.13.0');
   }
 });
 

package/test/compact-catalog-r36.test.mjs

@@ -8,7 +8,7 @@ import path from 'node:path';
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
 const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
-const gatewayNames=['capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'];
+const gatewayNames=['capability_manifest','coding_inspect','desktop_control','machine_fs','machine_observe','process_session'];
 
 test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async()=>{
   const client=new Client({name:'deadbyte-r36-compact-test',version:'0.10.0-dev'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
@@ -17,7 +17,7 @@ test('R36 real compact stdio catalog stays <=42 and exposes all gateways',async(
     DEADBYTE_CAPABILITY_PROFILE:'compact',
     DEADBYTE_AUDIT_RUNTIME:'0',DEADBYTE_MACHINE_RUNTIME:'0',DEADBYTE_AGENT_RUNTIME:'0',
     DEADBYTE_PROCESS_RUNTIME:'0',DEADBYTE_CODING_RUNTIME:'0',DEADBYTE_MACHINE_FS_RUNTIME:'0',
-    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
+    DEADBYTE_OBSERVATION_RUNTIME:'0',DEADBYTE_DESKTOP_RUNTIME:'0',DEADBYTE_AUTONOMOUS_RUNTIME:'0'
   };
   const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
   try{

package/test/compact-gateway-r36.test.mjs

@@ -7,6 +7,7 @@ import {
   machineObserveInputSchema,
   registerCompactGatewayTools
 } from '../src/compact-gateway-mcp-tools.mjs';
+import { desktopControlInputSchema } from '../src/desktop-mcp-tools-r40.mjs';
 
 const fakeServer=()=>{
   const tools=new Map();
@@ -24,6 +25,7 @@ test('R36 compact gateway schemas reject generic arbitrary dispatch',()=>{
   assert.equal(machineFsGatewayInputSchema.safeParse({op:'exec',command:'whoami'}).success,false);
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'stdin',session_id:'0'.repeat(64),input:'raw'}).success,false);
   assert.equal(machineObserveInputSchema.safeParse({op:'revoke',reason:'no'}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'call',tool_name:'host_exec'}).success,false);
 });
 
 test('R36 compact schemas preserve representative preconditions',()=>{
@@ -36,14 +38,15 @@ test('R36 compact schemas preserve representative preconditions',()=>{
   assert.equal(processSessionGatewayInputSchema.safeParse({op:'action',session_id:'b'.repeat(64),action_id:'ping'}).success,true);
 });
 
-test('R36 registers exactly five compact gateway names',()=>{
+test('R40 registers exactly six compact gateway names including desktop_control',()=>{
   const server=fakeServer();
   registerCompactGatewayTools(server,{
     profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
-    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
   });
   assert.deepEqual([...server.tools.keys()].sort(),[
-    'capability_manifest','coding_inspect','machine_fs','machine_observe','process_session'
+    'capability_manifest','coding_inspect','desktop_control','machine_fs','machine_observe','process_session'
   ]);
 });
 
@@ -55,7 +58,8 @@ test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',
   const server=fakeServer();
   registerCompactGatewayTools(server,{
     profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
-    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null
+    codingRuntime,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
   });
   const tool=server.tools.get('coding_inspect');
   const result=await tool.handler({op:'stat',root_id:'core',path:'src/a.mjs',hash:false});
@@ -64,3 +68,51 @@ test('R36 coding_inspect gateway calls runtime directly and never MCP-recurses',
   assert.equal(result.structuredContent.op,'stat');
   assert.equal(result.structuredContent.result.path,'src/a.mjs');
 });
+
+test('R40 capability manifest v2 attests the exact registered compact catalog',async()=>{
+  const server=fakeServer();
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'a'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...server.tools.keys()]
+  });
+  const result=await server.tools.get('capability_manifest').handler({});
+  const manifest=result.structuredContent.result;
+  assert.equal(manifest.schema,'deadbyte.capability-manifest.v2');
+  assert.equal(manifest.profile,'compact');
+  assert.deepEqual(manifest.tool_catalog,[...server.tools.keys()].sort());
+  assert.equal(manifest.tool_count,server.tools.size);
+  assert.match(manifest.catalog_sha256,/^[0-9a-f]{64}$/);
+});
+
+
+test('R40 desktop_control is stable when runtime is absent and routes typed read-only operations when present',async()=>{
+  const server=fakeServer();
+  const calls=[];
+  const desktopRuntime={
+    status:async()=>{calls.push('status');return {status:'ok',configured:true,armed:false,reason:'disarmed',action_kinds:[],policy_sha256:'a'.repeat(64),observer_backend:'fake'};},
+    observe:async()=>{calls.push('observe');return {status:'ok',frame:{frame_id:'b'.repeat(64)}};}
+  };
+  registerCompactGatewayTools(server,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime,
+    catalogProvider:()=>[...server.tools.keys()]
+  });
+  const tool=server.tools.get('desktop_control');
+  const status=await tool.handler({op:'status'});
+  assert.equal(status.isError,false);
+  assert.equal(status.structuredContent.result.armed,false);
+  const observed=await tool.handler({op:'observe'});
+  assert.equal(observed.structuredContent.result.frame.frame_id,'b'.repeat(64));
+  assert.deepEqual(calls,['status','observe']);
+
+  const absent=fakeServer();
+  registerCompactGatewayTools(absent,{
+    profile:'compact',ledger:{schema:'deadbyte.capability-ledger.v1',entries:[],ledger_sha256:'0'.repeat(64)},
+    codingRuntime:null,semanticRuntime:null,machineFsRuntime:null,processRuntime:null,observationRuntime:null,machineRuntime:null,desktopRuntime:null,
+    catalogProvider:()=>[...absent.tools.keys()]
+  });
+  const unavailable=await absent.tools.get('desktop_control').handler({op:'status'});
+  assert.equal(unavailable.isError,true);
+  assert.equal(unavailable.structuredContent.status,'unavailable');
+});

package/test/compact-max-catalog-r40.test.mjs

@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 real max-runtime compact stdio catalog is exactly 42 while all authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-max-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'compact',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'0',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.equal(names.length,42,'expected exact compact max catalog 42, got '+names.length+': '+names.join(','));
+    for(const name of ['capability_manifest','desktop_control','coding_inspect','machine_fs','machine_observe','process_session',
+      'host_file_read','host_file_write','host_exec']) assert.ok(names.includes(name),'missing '+name);
+    const manifest=await client.callTool({name:'capability_manifest',arguments:{}});
+    assert.equal(manifest.isError,false);
+    const m=manifest.structuredContent.result;
+    assert.equal(m.schema,'deadbyte.capability-manifest.v2');
+    assert.equal(m.profile,'compact');
+    assert.equal(m.tool_count,42);
+    assert.deepEqual(m.tool_catalog,names);
+    assert.match(m.catalog_sha256,/^[0-9a-f]{64}$/);
+    console.log(JSON.stringify({tool_count:m.tool_count,catalog_sha256:m.catalog_sha256,ledger_sha256:m.ledger_sha256,desktop:true,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/controller-desktop-r40.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+
+const controller=fileURLToPath(new URL('../controller/deadbyte-controller.ps1',import.meta.url));
+const example=fileURLToPath(new URL('../controller/deadbyte-controller.config.psd1.example',import.meta.url));
+const init=fileURLToPath(new URL('../scripts/init-desktop-policy-r40.ps1',import.meta.url));
+
+test('R40 controller exposes Desktop runtime config but never auto-arms it',async()=>{
+  const source=await readFile(controller,'utf8');
+  const config=await readFile(example,'utf8');
+  for(const name of ['armdesktop','disarmdesktop','desktopstatus']) assert.match(source,new RegExp(name));
+  assert.match(source,/DesktopRuntimeEnabled must be boolean/);
+  assert.match(source,/DesktopRuntimeEnabled requires DesktopPolicyFile/);
+  assert.match(source,/DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(source,/DEADBYTE_DESKTOP_POLICY/);
+  assert.match(config,/DesktopRuntimeEnabled = \$false/);
+  assert.match(config,/DesktopPolicyFile = ''/);
+  const start=source.slice(source.indexOf('function Start-Deadbyte'),source.indexOf('function Park-Deadbyte'));
+  assert.doesNotMatch(start,/Arm-Desktop/);
+  const dispatch=source.slice(source.indexOf('function Run-Command'),source.indexOf("if ($Command -ne 'menu')"));
+  assert.doesNotMatch(dispatch,/'start'[^\n]*Arm-Desktop/);
+  assert.doesNotMatch(dispatch,/'resume'[^\n]*Arm-Desktop/);
+});
+
+test('R40 Desktop standing grant is policy-digest and action-scope bound',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/deadbyte\.desktop-policy\.v1/);
+  assert.match(source,/deadbyte\.desktop-grant\.v1/);
+  assert.match(source,/policy_sha256/);
+  assert.match(source,/instance_nonce/);
+  assert.match(source,/action_kinds/);
+  assert.match(source,/actions-outside-policy/);
+  assert.match(source,/desktop \$\(\$provider\.Name\) executable SHA-256 mismatch/);
+  assert.match(source,/Get-ExecutableHash \$provider\.Path/);
+  assert.match(source,/grant_file must live under controller runtime directory/);
+  assert.match(source,/evidence_dir must live under controller runtime directory/);
+});
+
+test('R40 Desktop environment reaches Bridge only and is restored after spawn',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_RUNTIME = if \(\[bool\]\$Cfg\.DesktopRuntimeEnabled\)/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_POLICY = \[string\]\$Cfg\.DesktopPolicyFile/);
+  assert.match(source,/Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(source,/Remove-Item Env:DEADBYTE_DESKTOP_POLICY/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_RUNTIME = \$previousDesktopRuntimeEnv/);
+  assert.match(source,/\$env:DEADBYTE_DESKTOP_POLICY = \$previousDesktopPolicyEnv/);
+  const supervisor=source.slice(source.indexOf("} elseif ($Name -eq 'Supervisor'"),source.indexOf('} else {',source.indexOf("} elseif ($Name -eq 'Supervisor'")));
+  assert.match(supervisor,/Remove-Item Env:DEADBYTE_DESKTOP_RUNTIME/);
+  assert.match(supervisor,/Remove-Item Env:DEADBYTE_DESKTOP_POLICY/);
+});
+
+test('R40 lifecycle revokes Desktop before park stop restart and supervisor recovery',async()=>{
+  const source=await readFile(controller,'utf8');
+  const park=source.slice(source.indexOf('function Park-Deadbyte'),source.indexOf('function Stop-Deadbyte'));
+  const stop=source.slice(source.indexOf('function Stop-Deadbyte'),source.indexOf('function Get-HostPolicyMetadata'));
+  const recover=source.slice(source.indexOf('function Recover-AutonomousSupervisor'),source.indexOf('function Show-State'));
+  assert.match(park,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Stop-OwnedComponent 'Bridge'/);
+  assert.match(stop,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Stop-OwnedComponent 'Bridge'/);
+  assert.match(recover,/Disarm-Desktop \$Cfg -Quiet[\s\S]*Start-Deadbyte/);
+  assert.match(recover,/\$desktop = Get-DesktopGrantStatus \$Cfg/);
+  assert.match(recover,/\$desktop\.Armed/);
+  const dispatch=source.slice(source.indexOf('function Run-Command'),source.indexOf("if ($Command -ne 'menu')"));
+  assert.match(dispatch,/'restart'[^\n]*Stop-Deadbyte/);
+});
+
+test('R40 policy initializer pins current native observer and input and starts DISARMED',async()=>{
+  const source=await readFile(init,'utf8');
+  assert.match(source,/deadbyte-desktop-observer-r40\.exe/);
+  assert.match(source,/deadbyte-desktop-input-r40\.exe/);
+  assert.match(source,/deadbyte-desktop-uia-r40\.exe/);
+  assert.match(source,/System\.Security\.Cryptography\.SHA256/);
+  assert.match(source,/Get-Sha256Hex -Path \$Observer/);
+  assert.match(source,/Remove-Item -LiteralPath \$Grant/);
+  assert.match(source,/grant_state='DISARMED'/);
+  assert.match(source,/deadbyte\.desktop-policy\.v1/);
+  assert.match(source,/max_text_bytes=4096/);
+});
+
+test('R40 status exposes Desktop runtime and authority independently',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/Desktop runtime: \{0\}/);
+  assert.match(source,/Desktop plane : \{0\}/);
+  assert.match(source,/Show-DesktopStatus \$Cfg/);
+});

package/test/core.test.mjs

@@ -105,7 +105,7 @@ test('proof execution creates deterministic output and signed verifiable receipt
   assert.equal(result.receipt.request.schema, 'deadbyte.request.v1');
   assert.match(result.receipt.request.nonce, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.request.sha256, /^[0-9a-f]{64}$/);
-  assert.equal(result.receipt.runtime.package_version, '0.11.3');
+  assert.equal(result.receipt.runtime.package_version, '0.13.0');
   assert.match(result.receipt.runtime.mcp_ingress_adapter, /^(?:none|tunnel-stdio-probe-compat-v1)$/);
   assert.match(result.receipt.runtime.mcp_ingress_adapter_sha256, /^[0-9a-f]{64}$/);
   assert.match(result.receipt.runtime.mcp_ingress_mode_source_sha256, /^[0-9a-f]{64}$/);