deadbyte-mcp 0.11.3 → 0.13.0

package/test/desktop-adversarial-r40.test.mjs

@@ -0,0 +1,62 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createDesktopAction } from '../src/desktop-contract.mjs';
+import { captureNativeDesktop } from '../src/desktop-observer-r40.mjs';
+import { invokeNativeDesktopInput } from '../src/desktop-input-r40.mjs';
+import { invokeNativeDesktopGrounder } from '../src/desktop-uia-r40.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const WIN={hwnd:'0x1234',pid:99};
+const BOUNDS={left:0,top:0,width:1920,height:1080};
+function action(){
+  return createDesktopAction({
+    intentId:H('helper-substitution'),kind:'key_chord',
+    frameId:H('frame'),desktopEpoch:H('epoch'),topologySha256:H('topology'),
+    expectedWindow:WIN,keyChord:['SHIFT']
+  });
+}
+
+test('T9 observer helper substitution is detected before native process launch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-observer-pin-'));
+  try{
+    const fake=path.join(root,'observer.exe');
+    await writeFile(fake,'not the pinned observer');
+    await assert.rejects(captureNativeDesktop({
+      observerPath:fake,expectedObserverSha256:H('expected-observer'),maxFrameBytes:1024*1024,timeoutMs:1000
+    }),/observer executable hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('T9 input helper substitution is definite not_started before SendInput dispatch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-input-pin-'));
+  try{
+    const fake=path.join(root,'input.exe');
+    await writeFile(fake,'not the pinned input helper');
+    let error;
+    try{
+      await invokeNativeDesktopInput(action(),{
+        inputPath:fake,expectedInputSha256:H('expected-input'),timeoutMs:1000,
+        inputDesktop:'Default',expectedBounds:BOUNDS,expectedWindow:WIN
+      });
+    }catch(e){error=e;}
+    assert.ok(error);
+    assert.match(error.message,/input executable hash mismatch/);
+    assert.equal(error.side_effect_state,'not_started');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('T9 UIA helper substitution is detected before COM traversal process launch',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-t9-uia-pin-'));
+  try{
+    const fake=path.join(root,'uia.exe');
+    await writeFile(fake,'not the pinned UIA helper');
+    await assert.rejects(invokeNativeDesktopGrounder({
+      grounderPath:fake,expectedGrounderSha256:H('expected-uia'),timeoutMs:1000,
+      expectedWindow:WIN,expectedBounds:BOUNDS,query:{kind:'root',value:'',max_results:1,ordinal:0}
+    }),/UIA executable hash mismatch/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/desktop-contract-r40.test.mjs

@@ -0,0 +1,200 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import {
+  createDesktopAction,createDesktopFrame,createDesktopTarget,guardDesktopAction,
+  bindDesktopPostObservation,bindDesktopActionChain,verifyDesktopFrame,desktopActionKinds
+} from '../src/desktop-contract.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+const EPOCH=H('epoch-1');
+const TOPO=H('topology-1');
+const IMG1=H('image-1');
+const IMG2=H('image-2');
+const WIN={hwnd:'0x1234',pid:4242,process_image_sha256:H('app.exe'),title_sha256:H('Editor')};
+const NOW='2026-09-19T02:00:01.500Z';
+
+function frame(overrides={}){
+  return createDesktopFrame({
+    desktopEpoch:EPOCH,topologySha256:TOPO,observedAtUtc:'2026-09-19T02:00:00.000Z',
+    bounds:{left:-1920,top:0,width:3840,height:1080},activeWindow:WIN,imageSha256:IMG1,...overrides
+  });
+}
+function action(f,overrides={}){
+  return createDesktopAction({
+    intentId:H('intent-1'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:100,y:200},...overrides
+  });
+}
+
+test('desktop frame identity is deterministic and self-verifying',()=>{
+  const a=frame(),b=frame();
+  assert.equal(a.frame_id,b.frame_id);
+  assert.deepEqual(verifyDesktopFrame(a),{ok:true,frame:a});
+  const tampered={...a,image_sha256:IMG2};
+  const checked=verifyDesktopFrame(tampered);
+  assert.equal(checked.ok,false);
+  assert.match(checked.reason,/hash mismatch/);
+});
+
+test('virtual desktop supports negative monitor coordinates but rejects overflow',()=>{
+  const f=frame();
+  const a=createDesktopAction({
+    intentId:H('negative-monitor'),kind:'pointer_move',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:-1000,y:500}
+  });
+  assert.equal(guardDesktopAction({frame:f,action:a,nowUtc:NOW}).frame_id,f.frame_id);
+  const outside=createDesktopAction({
+    intentId:H('outside'),kind:'pointer_move',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:1920,y:500}
+  });
+  assert.throws(()=>guardDesktopAction({frame:f,action:outside,nowUtc:NOW}),/outside frame bounds/);
+});
+
+test('T9 coordinate overflow and far-negative coordinates are denied before guard/effect',()=>{
+  const f=frame();
+  assert.throws(()=>createDesktopAction({
+    intentId:H('overflow-positive'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:Number.MAX_SAFE_INTEGER,y:1}
+  }),/action point\.x invalid/);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('overflow-negative'),kind:'click_primary',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,point:{x:-131073,y:1}
+  }),/action point\.x invalid/);
+});
+
+test('stale frame is denied before effect',()=>{
+  const f=frame();
+  assert.throws(()=>guardDesktopAction({
+    frame:f,action:action(f),nowUtc:'2026-09-19T02:00:03.001Z',maxFrameAgeMs:2000
+  }),/frame is stale/);
+});
+
+test('action is bound to exact frame identity',()=>{
+  const f=frame();
+  const another=frame({observedAtUtc:'2026-09-19T02:00:00.250Z'});
+  assert.notEqual(f.frame_id,another.frame_id);
+  assert.throws(()=>guardDesktopAction({frame:another,action:action(f),nowUtc:NOW}),/stale frame id/);
+});
+
+test('desktop epoch mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{desktopEpoch:H('other-epoch')});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/desktop epoch mismatch/);
+});
+
+test('topology mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{topologySha256:H('other-topology')});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/topology mismatch/);
+});
+
+test('foreground window mismatch is denied',()=>{
+  const f=frame();
+  const a=action(f,{expectedWindow:{...WIN,hwnd:'0xbeef'}});
+  assert.throws(()=>guardDesktopAction({frame:f,action:a,nowUtc:NOW}),/foreground window mismatch/);
+});
+
+test('target is frame-bound, bounded, and deterministic',()=>{
+  const f=frame();
+  const input={frame:f,rect:{left:50,top:50,width:200,height:100},source:'uia',confidence:0.99,semanticLabelSha256:H('Save'),windowBinding:f.active_window};
+  const a=createDesktopTarget(input),b=createDesktopTarget(input);
+  assert.equal(a.target_id,b.target_id);
+  assert.equal(a.frame_id,f.frame_id);
+  assert.throws(()=>createDesktopTarget({...input,rect:{left:1900,top:50,width:100,height:100}}),/outside desktop bounds/);
+});
+
+test('key chord is narrow and duplicate-free',()=>{
+  const f=frame();
+  const ok=createDesktopAction({
+    intentId:H('keys'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,keyChord:['CTRL','SHIFT','S']
+  });
+  assert.equal(guardDesktopAction({frame:f,action:ok,nowUtc:NOW}).action_sha256,ok.action_sha256);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('badkeys'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,keyChord:['CTRL','CTRL']
+  }),/duplicate key/);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('badkeys2'),kind:'key_chord',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,keyChord:['CTRL','POWER']
+  }),/unsupported key/);
+});
+
+test('text input is bounded and hash-bound',()=>{
+  const f=frame();
+  const a=createDesktopAction({
+    intentId:H('text'),kind:'text_input',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,expectedWindow:f.active_window,text:'hello'
+  });
+  assert.equal(a.text_sha256,H('hello'));
+  assert.equal(guardDesktopAction({frame:f,action:a,nowUtc:NOW}).action_sha256,a.action_sha256);
+  assert.throws(()=>createDesktopAction({
+    intentId:H('nul'),kind:'text_input',frameId:f.frame_id,desktopEpoch:f.desktop_epoch,
+    topologySha256:f.topology_sha256,text:'a\u0000b'
+  }),/text input invalid/);
+});
+
+test('post-observation binds before/action/after without claiming success',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const after=frame({
+    observedAtUtc:'2026-09-19T02:00:02.000Z',
+    imageSha256:IMG2,
+    activeWindow:{...WIN,title_sha256:H('Editor - changed')}
+  });
+  const post=bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:after});
+  assert.equal(post.change_observed,true);
+  assert.equal(post.window_changed,true);
+  assert.equal(post.foreground_transition.changed,true);
+  assert.deepEqual(post.foreground_transition.before,before.active_window);
+  assert.deepEqual(post.foreground_transition.after,after.active_window);
+  assert.equal(post.topology_changed,false);
+  assert.equal(post.desktop_epoch_changed,false);
+  assert.equal(post.success,null);
+  assert.match(post.post_observation_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('T4 action chain binds before action after post receipt and effect identity',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const after=frame({observedAtUtc:'2026-09-19T02:00:02.000Z',imageSha256:IMG2});
+  const post=bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:after});
+  const first=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('post-receipt'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  const again=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('post-receipt'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  assert.equal(first.chain_sha256,again.chain_sha256);
+  assert.match(first.chain_sha256,/^[0-9a-f]{64}$/);
+  const changed=bindDesktopActionChain({
+    beforeFrameId:before.frame_id,actionSha256:a.action_sha256,afterFrameId:after.frame_id,
+    guardSha256:guard.guard_sha256,postObservationSha256:post.post_observation_sha256,
+    postReceiptSha256:H('substituted'),effectId:H('effect-id'),effectFingerprint:H('effect-fingerprint')
+  });
+  assert.notEqual(changed.chain_sha256,first.chain_sha256);
+});
+
+test('post-observation rejects substitution and time travel',()=>{
+  const before=frame();
+  const a=action(before);
+  const guard=guardDesktopAction({frame:before,action:a,nowUtc:NOW});
+  const other=action(before,{intentId:H('other')});
+  const after=frame({observedAtUtc:'2026-09-19T02:00:02.000Z',imageSha256:IMG2});
+  assert.throws(()=>bindDesktopPostObservation({guard,beforeFrame:before,action:other,afterFrame:after}),/action mismatch/);
+  const tooOld=frame({observedAtUtc:'2026-09-19T02:00:01.000Z',imageSha256:IMG2});
+  assert.throws(()=>bindDesktopPostObservation({guard,beforeFrame:before,action:a,afterFrame:tooOld}),/predates guarded action/);
+});
+
+test('action vocabulary is fixed for R40-T1',()=>{
+  assert.deepEqual(desktopActionKinds(),[
+    'pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input'
+  ]);
+});

package/test/desktop-input-r40.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { createDesktopAction } from '../src/desktop-contract.mjs';
+import { serializeNativeDesktopInputRequest,parseNativeDesktopInputResponse } from '../src/desktop-input-r40.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+const bounds={left:-1920,top:0,width:3840,height:1080};
+const window={hwnd:'0x1234',pid:99};
+
+function action(kind,extra={}){
+  return createDesktopAction({
+    intentId:H('intent'),kind,frameId:H('frame'),desktopEpoch:H('epoch'),topologySha256:H('topology'),
+    expectedWindow:window,point:null,scrollDelta:null,keyChord:null,text:null,...extra
+  });
+}
+
+test('desktop native input protocol serializes one fixed click with frame-derived environment binding',()=>{
+  const value=serializeNativeDesktopInputRequest(action('click_primary',{point:{x:-100,y:200}}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  });
+  const text=value.toString('utf8');
+  assert.match(text,/^DEADBYTE_DESKTOP_INPUT_V1\n/);
+  assert.match(text,/kind=click_primary\n/);
+  assert.match(text,/expected_hwnd=0x1234\nexpected_pid=99\n/);
+  assert.match(text,/left=-1920\ntop=0\nwidth=3840\nheight=1080\n/);
+  assert.match(text,/x=-100\ny=200\n/);
+  assert.match(text,/key_count=0\ntext_bytes=0\n$/);
+});
+
+test('desktop native input text protocol is byte-counted and preserves raw UTF-8 after bounded header',()=>{
+  const value=serializeNativeDesktopInputRequest(action('text_input',{text:'ไทย🙂'}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  });
+  const marker=Buffer.from('text_bytes=13\n','utf8');
+  const at=value.indexOf(marker);
+  assert.ok(at>0);
+  assert.equal(value.subarray(at+marker.length).toString('utf8'),'ไทย🙂');
+});
+
+test('desktop native input protocol rejects out-of-bounds point before process launch',()=>{
+  assert.throws(()=>serializeNativeDesktopInputRequest(action('click_primary',{point:{x:3000,y:1}}),{
+    inputDesktop:'Default',expectedBounds:bounds,expectedWindow:window
+  }),/outside bounds/);
+});
+
+test('desktop native input response is bound to exact action desktop and foreground identity',()=>{
+  const a=action('key_chord',{keyChord:['CTRL','A']});
+  const bytes=Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-native-input.v1',injected:true,backend:'win32-sendinput',
+    action_sha256:a.action_sha256,kind:'key_chord',event_count:4,input_desktop:'Default',
+    foreground_hwnd:'0x1234',foreground_pid:99
+  })+'\n','utf8');
+  const parsed=parseNativeDesktopInputResponse(bytes,{
+    actionSha256:a.action_sha256,kind:'key_chord',inputDesktop:'Default',expectedWindow:window
+  });
+  assert.equal(parsed.injected,true);
+  assert.equal(parsed.event_count,4);
+  assert.match(parsed.provider_receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.throws(()=>parseNativeDesktopInputResponse(bytes,{
+    actionSha256:H('other'),kind:'key_chord',inputDesktop:'Default',expectedWindow:window
+  }),/action mismatch/);
+});

package/test/desktop-mcp-tools-r40.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,registerDesktopTools
+} from '../src/desktop-mcp-tools-r40.mjs';
+
+const H=c=>c.repeat(64);
+const frame=H('a');
+const intent=H('b');
+
+function fakeServer(){
+  const tools=new Map();
+  return {tools,registerTool(name,definition,handler){tools.set(name,{definition,handler});}};
+}
+
+test('R40 desktop action schema rejects ambiguous or authority-bypassing shapes',()=>{
+  assert.equal(desktopActionInputSchema.safeParse({
+    intent_id:intent,kind:'click_primary',expected_frame_id:frame,target_id:H('c'),point:{x:1,y:2}
+  }).success,false);
+  assert.equal(desktopActionInputSchema.safeParse({
+    intent_id:intent,kind:'text_input',expected_frame_id:frame,text:'hello',point:{x:1,y:2}
+  }).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'action',intent_id:intent,kind:'key_chord',expected_frame_id:frame,key_chord:['CTRL','CTRL']}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'action',intent_id:intent,kind:'click_primary',expected_frame_id:frame,point:{x:1,y:2}}).success,true);
+});
+
+test('R40 T5 target schema supports local UIA query without arbitrary dispatch',()=>{
+  assert.equal(desktopTargetInputSchema.safeParse({frame_id:frame,uia_query:{kind:'name_exact',value:'Save',max_results:8,ordinal:0}}).success,true);
+  assert.equal(desktopTargetInputSchema.safeParse({frame_id:frame,uia_query:{kind:'root',value:'leak'}}).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({op:'target',frame_id:frame,uia_query:{kind:'control_type',value:'button',max_results:4,ordinal:0}}).success,true);
+});
+
+test('R40 full desktop surface registers four narrow typed tools',()=>{
+  const server=fakeServer();
+  const runtime={status(){},observe(){},target(){},action(){}};
+  registerDesktopTools(server,{runtime});
+  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target']);
+});
+
+test('R40 public desktop action output removes raw text while preserving content and action hashes',async()=>{
+  const server=fakeServer();
+  const action={
+    schema:'deadbyte.desktop-action.v1',intent_id:intent,kind:'text_input',frame_id:frame,
+    desktop_epoch:H('d'),topology_sha256:H('e'),expected_window:null,target_id:null,point:null,
+    scroll_delta:null,key_chord:null,text:'DO_NOT_ECHO_ME',text_sha256:H('f'),action_sha256:H('1')
+  };
+  const runtime={
+    action:async()=>({status:'ok',injected:true,task_success:null,action,guard:{guard_sha256:H('2')},
+      post_observation:{change_observed:true},started_receipt_id:'1'.repeat(24),started_receipt_sha256:H('3'),
+      receipt_id:'2'.repeat(24),receipt_sha256:H('4')})
+  };
+  registerDesktopTools(server,{runtime});
+  const result=await server.tools.get('desktop_action').handler({
+    intent_id:intent,kind:'text_input',expected_frame_id:frame,target_id:null,point:null,scroll_delta:null,key_chord:null,text:'DO_NOT_ECHO_ME'
+  });
+  const encoded=JSON.stringify(result.structuredContent);
+  assert.equal(encoded.includes('DO_NOT_ECHO_ME'),false);
+  assert.equal(result.structuredContent.result.action,undefined);
+  assert.equal(result.structuredContent.result.action_summary.text_sha256,H('f'));
+  assert.equal(result.structuredContent.result.action_summary.action_sha256,H('1'));
+});

package/test/desktop-memory-r40.test.mjs

@@ -0,0 +1,141 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash, generateKeyPairSync, sign as cryptoSign } from 'node:crypto';
+import { mkdtemp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalJson } from '../src/canonical-json.mjs';
+import {
+  deriveDesktopMemory,signDesktopMemory,verifyDesktopMemorySnapshot,writeDesktopMemorySnapshot,
+  loadDesktopEvidenceReceipts,createDesktopMemoryProvider
+} from '../src/desktop-memory-r40.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const DOMAIN=Buffer.from('DEADBYTE-DESKTOP-RECEIPT-V1\0','utf8');
+const policy=H('policy');
+const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+const keyId='memory-test-key';
+let seq=0;
+function receipt(kind,payload,at='2026-09-19T03:00:00.000Z',policySha256=policy){
+  const receipt_id=(++seq).toString(16).padStart(24,'0');
+  const body={schema:'deadbyte.desktop-receipt.v1',receipt_id,kind,policy_sha256:policySha256,observed_at_utc:at,payload};
+  const receipt_sha256=createHash('sha256').update(Buffer.from(canonicalJson(body),'utf8')).digest('hex');
+  const signed={...body,receipt_sha256};
+  const signature_base64=cryptoSign(null,Buffer.concat([DOMAIN,Buffer.from(canonicalJson(signed),'utf8')]),privateKey).toString('base64');
+  return {...signed,attestation:{algorithm:'ed25519',key_id:keyId,signature_base64}};
+}
+const win={hwnd:'0x1234',pid:55,process_image_sha256:H('app'),title_sha256:H('title')};
+
+test('T6 memory derives only authenticated compact Desktop facts and never carries raw payload or authority nonce',()=>{
+  const effect=H('effect'),fingerprint=H('fingerprint'),target=H('target');
+  const receipts=[
+    receipt('desktop_observation',{frame_id:H('f1'),desktop_epoch:H('epoch'),topology_sha256:H('topo'),active_window:win,
+      preview:{sha256:H('preview'),byte_length:100,width:10,height:10,encoding:'ppm-base64'}},'2026-09-19T03:00:00.000Z'),
+    receipt('desktop_grounding',{requested_frame_id:H('f1'),grounded_frame_id:H('f2'),target_id:target,
+      query_sha256:H('query'),query_kind:'name_exact',control_type:50000},'2026-09-19T03:00:01.000Z'),
+    receipt('desktop_action_started',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('action'),
+      target_id:target,kind:'click_primary',pre_frame_id:H('f2'),authority_instance_nonce:H('SECRET-NONCE')},'2026-09-19T03:00:02.000Z'),
+    receipt('desktop_post_observation',{frame_id:H('f3'),desktop_epoch:H('epoch'),topology_sha256:H('topo'),active_window:win},'2026-09-19T03:00:03.000Z'),
+    receipt('desktop_action_completed',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('action'),
+      effect:{side_effect_state:'confirmed_injected'},action_chain:{chain_sha256:H('chain')},
+      post_observation:{post_observation_sha256:H('post'),foreground_transition:{changed:false}}},'2026-09-19T03:00:04.000Z')
+  ];
+  const memory=deriveDesktopMemory(receipts,{policySha256:policy,publicKey,keyId});
+  assert.equal(memory.schema,'deadbyte.desktop-memory.v1');
+  assert.equal(memory.recent_effects.length,1);
+  assert.equal(memory.recent_effects[0].effect_id,effect);
+  assert.equal(memory.grounded_targets[0].target_id,target);
+  assert.equal(memory.windows.length,1);
+  assert.equal(memory.last_verified_desktop.frame_id,H('f3'));
+  const encoded=JSON.stringify(memory);
+  assert.equal(encoded.includes('SECRET-NONCE'),false);
+  assert.equal(encoded.includes('data_base64'),false);
+  assert.equal(encoded.includes('"query":"'),false);
+  assert.equal(encoded.includes('authority_instance_nonce'),false);
+});
+
+test('T6 memory keeps unknown effects unresolved until authenticated completion appears',()=>{
+  const effect=H('unknown-effect'),fingerprint=H('unknown-fp');
+  const started=receipt('desktop_action_started',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('a'),
+    target_id:H('t'),kind:'click_primary',pre_frame_id:H('f')});
+  const unknown=receipt('desktop_action_outcome_unknown',{effect_id:effect,effect_fingerprint:fingerprint,action_sha256:H('a'),side_effect_state:'unknown'});
+  const memory=deriveDesktopMemory([started,unknown],{policySha256:policy,publicKey,keyId});
+  assert.deepEqual(memory.unresolved_unknown_effects.map(x=>x.effect_id),[effect]);
+});
+
+test('T6 rejects receipt substitution before memory trust',()=>{
+  const r=receipt('desktop_observation',{frame_id:H('f'),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+  const forged=structuredClone(r);forged.payload.frame_id=H('forged');
+  assert.throws(()=>deriveDesktopMemory([forged],{policySha256:policy,publicKey,keyId}),/unauthenticated receipt/);
+});
+
+test('T6 signed snapshot persists atomically and verifies independently',async()=>{
+  const r=receipt('desktop_observation',{frame_id:H('f'),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+  const memory=deriveDesktopMemory([r],{policySha256:policy,publicKey,keyId});
+  const snapshot=signDesktopMemory(memory,{privateKey,keyId});
+  const proof=verifyDesktopMemorySnapshot(snapshot,{publicKey,keyId,policySha256:policy});
+  assert.equal(proof.ok,true);
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-'));
+  const file=path.join(root,'desktop-memory.json');
+  const written=await writeDesktopMemorySnapshot(file,snapshot);
+  assert.equal(written.snapshot_sha256,snapshot.snapshot_sha256);
+  const disk=JSON.parse(await readFile(file,'utf8'));
+  assert.equal(verifyDesktopMemorySnapshot(disk,{publicKey,keyId,policySha256:policy}).ok,true);
+  const tampered=structuredClone(disk);tampered.memory.last_verified_desktop.frame_id=H('tamper');
+  assert.equal(verifyDesktopMemorySnapshot(tampered,{publicKey,keyId,policySha256:policy}).ok,false);
+});
+
+
+test('T6 evidence provider loads bounded signed receipts and emits compact planner projection',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-provider-'));
+  const evidence=path.join(root,'evidence');await mkdir(evidence);
+  const r1=receipt('desktop_observation',{frame_id:H('pf'),desktop_epoch:H('pe'),topology_sha256:H('pt'),active_window:win});
+  const r2=receipt('desktop_grounding',{requested_frame_id:H('pf'),grounded_frame_id:H('pg'),target_id:H('target'),
+    query_sha256:H('query'),query_kind:'root',control_type:50032});
+  for(const r of [r1,r2])await writeFile(path.join(evidence,r.receipt_id+'.json'),canonicalJson(r)+'\n');
+  await writeFile(path.join(evidence,'desktop-memory.json'),'{"ignored":true}\n');
+  const loaded=await loadDesktopEvidenceReceipts(evidence,{maxReceipts:4,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  assert.equal(loaded.length,2);
+  const provider=createDesktopMemoryProvider({
+    evidenceDir:evidence,snapshotPath:path.join(evidence,'desktop-memory.json'),policySha256:policy,
+    privateKey,publicKey,keyId,maxReceipts:4,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024
+  });
+  const refreshed=await provider.refresh();
+  assert.equal(refreshed.status,'ok');
+  assert.equal(refreshed.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.schema,'deadbyte.desktop-memory-planner.v1');
+  assert.equal(refreshed.planner_context.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.grounded_targets.length,1);
+  const encoded=JSON.stringify(refreshed.planner_context);
+  assert.equal(encoded.includes('data_base64'),false);
+  assert.equal(encoded.includes('authority_instance_nonce'),false);
+  const disk=JSON.parse(await readFile(path.join(evidence,'desktop-memory.json'),'utf8'));
+  assert.equal(verifyDesktopMemorySnapshot(disk,{publicKey,keyId,policySha256:policy}).ok,true);
+});
+
+test('T6 evidence loader fails closed instead of silently truncating receipt history',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-limit-'));
+  for(let i=0;i<3;i++){
+    const r=receipt('desktop_observation',{frame_id:H('limit-'+i),desktop_epoch:H('e'),topology_sha256:H('t'),active_window:win});
+    await writeFile(path.join(root,r.receipt_id+'.json'),canonicalJson(r)+'\n');
+  }
+  await assert.rejects(loadDesktopEvidenceReceipts(root,{maxReceipts:2,maxDirectoryEntries:8}),/receipt limit exceeded/);
+});
+
+
+test('T6 current-policy memory rebuild ignores authenticated historical receipts from superseded Desktop policy',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-desktop-memory-policy-rollover-'));
+  const stalePolicy=H('stale-policy');
+  const stale=receipt('desktop_observation',{frame_id:H('stale-f'),desktop_epoch:H('stale-e'),topology_sha256:H('stale-t'),active_window:win},'2026-09-19T02:00:00.000Z',stalePolicy);
+  const current1=receipt('desktop_observation',{frame_id:H('current-f1'),desktop_epoch:H('current-e'),topology_sha256:H('current-t'),active_window:win});
+  const current2=receipt('desktop_grounding',{requested_frame_id:H('current-f1'),grounded_frame_id:H('current-f2'),target_id:H('current-target'),query_sha256:H('current-query'),query_kind:'root',control_type:50032});
+  for(const item of [stale,current1,current2]) await writeFile(path.join(root,item.receipt_id+'.json'),canonicalJson(item)+'\n');
+  const filtered=await loadDesktopEvidenceReceipts(root,{policySha256:policy,maxReceipts:2,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  assert.equal(filtered.length,2);
+  assert.ok(filtered.every(item=>item.policy_sha256===policy));
+  const provider=createDesktopMemoryProvider({evidenceDir:root,snapshotPath:path.join(root,'desktop-memory.json'),policySha256:policy,privateKey,publicKey,keyId,maxReceipts:2,maxDirectoryEntries:8,maxReceiptBytes:64*1024,maxTotalBytes:128*1024});
+  const refreshed=await provider.refresh();
+  assert.equal(refreshed.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.source_receipt_count,2);
+  assert.equal(refreshed.planner_context.policy_sha256,policy);
+});

package/test/desktop-observer-r40.test.mjs

@@ -0,0 +1,119 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { parseNativeDesktopFrame,createDesktopObserverRuntime,createDesktopPreview } from '../src/desktop-observer-r40.mjs';
+
+const H=value=>createHash('sha256').update(value).digest('hex');
+
+function packet(overrides={},pixelByte=0x23){
+  const header={
+    schema:'deadbyte.desktop-native-frame.v1',
+    backend:'gdi-bitblt-fallback',
+    pixel_format:'BGRA8',
+    left:-4,top:0,width:8,height:2,stride:32,byte_length:64,
+    system_dpi:96,session_id:1,input_desktop:'Default',
+    foreground_hwnd:'0x1234',foreground_pid:444,
+    foreground_title:'Editor',foreground_image:'C:\\Apps\\editor.exe',
+    monitors:[
+      {left:-4,top:0,width:4,height:2,primary:false,device:'DISPLAY2'},
+      {left:0,top:0,width:4,height:2,primary:true,device:'DISPLAY1'}
+    ],
+    ...overrides
+  };
+  const pixels=Buffer.alloc(header.byte_length,pixelByte);
+  return Buffer.concat([Buffer.from(JSON.stringify(header)+'\n','utf8'),pixels]);
+}
+
+test('native parser binds pixels, topology and foreground identity',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  assert.equal(parsed.image_sha256,H(Buffer.alloc(64,0x23)));
+  assert.match(parsed.topology_sha256,/^[0-9a-f]{64}$/);
+  assert.deepEqual(parsed.bounds,{left:-4,top:0,width:8,height:2});
+  assert.equal(parsed.active_window.hwnd,'0x1234');
+  assert.equal(parsed.active_window.pid,444);
+  assert.equal(parsed.active_window.title_sha256,H('Editor'));
+  assert.equal(parsed.active_window.process_image_sha256,H('C:\\Apps\\editor.exe'));
+  assert.equal(parsed.pixels.length,64);
+});
+
+test('native parser rejects payload length substitution',()=>{
+  const value=packet();
+  assert.throws(()=>parseNativeDesktopFrame(value.subarray(0,value.length-1)),/payload length mismatch/);
+});
+
+test('native parser rejects stride and byte length lies',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({stride:64,byte_length:128})),/stride mismatch/);
+  assert.throws(()=>parseNativeDesktopFrame(packet({byte_length:68})),/byte_length mismatch/);
+});
+
+test('native parser rejects monitor topology outside virtual desktop',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({monitors:[
+    {left:0,top:0,width:4,height:2,primary:true,device:'DISPLAY1'},
+    {left:10,top:0,width:4,height:2,primary:false,device:'BAD'}
+  ]})),/outside virtual desktop/);
+});
+
+test('native parser requires exactly one primary monitor',()=>{
+  assert.throws(()=>parseNativeDesktopFrame(packet({monitors:[
+    {left:-4,top:0,width:4,height:2,primary:false,device:'DISPLAY2'},
+    {left:0,top:0,width:4,height:2,primary:false,device:'DISPLAY1'}
+  ]})),/exactly one primary/);
+});
+
+test('observer runtime creates stable epoch family and distinct frame identities',async()=>{
+  let index=0;
+  const provider=async()=>parseNativeDesktopFrame(packet({},++index));
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:provider,expectedObserverSha256:H('observer'),runtimeNonce:'r40-test-runtime',
+    now:()=>index===1?'2026-09-19T02:10:00.000Z':'2026-09-19T02:10:00.500Z'
+  });
+  const a=await runtime.capture();
+  const b=await runtime.capture();
+  assert.equal(a.frame.desktop_epoch,b.frame.desktop_epoch);
+  assert.notEqual(a.frame.frame_id,b.frame.frame_id);
+  assert.notEqual(a.frame.image_sha256,b.frame.image_sha256);
+  assert.equal(runtime.frameStatus(b.frame.frame_id).generation,2);
+  assert.equal(runtime.framePixels(b.frame.frame_id).length,64);
+});
+
+test('observer runtime evicts old raw frames by bounded cache',async()=>{
+  let index=0;
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:async()=>parseNativeDesktopFrame(packet({},++index)),
+    expectedObserverSha256:H('observer'),runtimeNonce:'r40-cache',maxCachedFrames:2,
+    now:()=>new Date(1_700_000_000_000+index*100).toISOString()
+  });
+  const a=await runtime.capture();
+  await runtime.capture();
+  const c=await runtime.capture();
+  assert.throws(()=>runtime.frameStatus(a.frame.frame_id),/expired or unknown/);
+  assert.equal(runtime.framePixels(c.frame.frame_id).length,64);
+});
+
+test('observer runtime rejects secure or unexpected input desktop',async()=>{
+  const runtime=createDesktopObserverRuntime({
+    captureProvider:async()=>parseNativeDesktopFrame(packet({input_desktop:'Winlogon'})),
+    expectedObserverSha256:H('observer'),runtimeNonce:'r40-secure'
+  });
+  await assert.rejects(runtime.capture(),/is not allowed/);
+});
+
+test('raw title and process image do not escape parsed active-window identity',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  assert.equal(Object.hasOwn(parsed.active_window,'title'),false);
+  assert.equal(Object.hasOwn(parsed.active_window,'image'),false);
+  assert.equal(JSON.stringify(parsed.active_window).includes('Editor'),false);
+  assert.equal(JSON.stringify(parsed.active_window).includes('editor.exe'),false);
+});
+
+test('T5 preview is deterministic PPM and hard-bounded by max_preview_bytes',()=>{
+  const parsed=parseNativeDesktopFrame(packet());
+  const a=createDesktopPreview({pixels:parsed.pixels,width:8,height:2,stride:32,maxBytes:128});
+  const b=createDesktopPreview({pixels:parsed.pixels,width:8,height:2,stride:32,maxBytes:128});
+  assert.equal(a.schema,'deadbyte.desktop-preview.v1');
+  assert.equal(a.encoding,'ppm-base64');
+  assert.ok(a.byte_length<=128);
+  assert.equal(a.sha256,b.sha256);
+  assert.equal(a.data_base64,b.data_base64);
+  assert.equal(Buffer.from(a.data_base64,'base64').subarray(0,2).toString('ascii'),'P6');
+});