deadbyte-mcp 0.11.3 → 0.13.0

package/test/desktop-policy-r40.test.mjs

@@ -0,0 +1,111 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp,writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import {
+  DESKTOP_POLICY_SCHEMA,DESKTOP_GRANT_SCHEMA,DESKTOP_ACTION_KINDS,
+  loadDesktopPolicy,desktopSessionStatus,assertDesktopArmed
+} from '../src/desktop-policy-r40.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-policy-'));
+  const grant=path.join(root,'desktop-grant.json');
+  const evidence=path.join(root,'evidence');
+  const observer=path.join(root,'observer.exe');
+  const input=path.join(root,'input.exe');
+  const grounder=path.join(root,'grounder.exe');
+  await writeFile(observer,'observer');
+  await writeFile(input,'input');
+  await writeFile(grounder,'grounder');
+  const policyPath=path.join(root,'desktop-policy.json');
+  const raw={
+    schema:DESKTOP_POLICY_SCHEMA,enabled:true,grant_file:grant,evidence_dir:evidence,
+    observer:{executable:observer,sha256:H('observer'),backend:'gdi-bitblt-fallback'},
+    input:{executable:input,sha256:H('input')},
+    grounder:{executable:grounder,sha256:H('grounder')},
+    allowed_input_desktops:['Default'],
+    allowed_actions:DESKTOP_ACTION_KINDS,
+    limits:{max_frame_age_ms:2000,max_frame_bytes:8*1024*1024,capture_timeout_ms:5000,input_timeout_ms:2000,ground_timeout_ms:2000,post_observe_timeout_ms:5000,max_preview_bytes:512*1024,max_text_bytes:4096}
+  };
+  await writeFile(policyPath,JSON.stringify(raw));
+  const policy=await loadDesktopPolicy(policyPath);
+  return {root,grant,policyPath,policy};
+}
+
+test('desktop policy loads bounded observer/input authority metadata',async()=>{
+  const {policy}=await fixture();
+  assert.equal(policy.schema,DESKTOP_POLICY_SCHEMA);
+  assert.equal(policy.allowed_input_desktops[0],'Default');
+  assert.deepEqual(policy.allowed_actions,DESKTOP_ACTION_KINDS);
+  assert.equal(policy.limits.max_frame_age_ms,2000);
+  assert.equal(policy.limits.ground_timeout_ms,2000);
+  assert.equal(policy.grounder.sha256,H('grounder'));
+  assert.match(policy.policy_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('desktop plane is fail-closed when no grant exists',async()=>{
+  const {policy}=await fixture();
+  assert.deepEqual(await desktopSessionStatus(policy),{
+    configured:true,armed:false,reason:'disarmed',standing:false,action_kinds:[]
+  });
+  await assert.rejects(assertDesktopArmed(policy,'click_primary'),/desktop plane is disarmed/);
+});
+
+test('desktop standing grant is policy-hash-bound and action-scoped',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['pointer_move','click_primary']
+  }));
+  const status=await desktopSessionStatus(policy);
+  assert.equal(status.armed,true);
+  assert.equal(status.reason,'standing-grant');
+  assert.deepEqual(status.action_kinds,['pointer_move','click_primary']);
+  assert.equal((await assertDesktopArmed(policy,'click_primary')).armed,true);
+  await assert.rejects(assertDesktopArmed(policy,'text_input'),/outside active grant/);
+});
+
+test('desktop grant rejects policy substitution',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:H('wrong-policy'),instance_nonce:H('nonce'),
+    action_kinds:['click_primary']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'policy-digest');
+});
+
+test('desktop grant rejects unknown or duplicate action kinds',async()=>{
+  const {policy,grant}=await fixture();
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['click_primary','click_primary']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'actions-invalid');
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('nonce'),
+    action_kinds:['click_primary','power_off']
+  }));
+  assert.equal((await desktopSessionStatus(policy)).reason,'actions-invalid');
+});
+
+test('desktop policy rejects unsafe limits and malformed desktops',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-policy-bad-'));
+  const base={
+    schema:DESKTOP_POLICY_SCHEMA,enabled:true,
+    grant_file:path.join(root,'grant.json'),evidence_dir:path.join(root,'evidence'),
+    observer:{executable:path.join(root,'observer.exe'),sha256:H('observer')},
+    input:{executable:path.join(root,'input.exe'),sha256:H('input')},
+    grounder:{executable:path.join(root,'grounder.exe'),sha256:H('grounder')},
+    allowed_actions:['click_primary']
+  };
+  const p1=path.join(root,'bad-limit.json');
+  await writeFile(p1,JSON.stringify({...base,allowed_input_desktops:['Default'],limits:{max_frame_age_ms:999999}}));
+  await assert.rejects(loadDesktopPolicy(p1),/max_frame_age_ms/);
+  const p2=path.join(root,'bad-desktop.json');
+  await writeFile(p2,JSON.stringify({...base,allowed_input_desktops:['Default','Default']}));
+  await assert.rejects(loadDesktopPolicy(p2),/allowed_input_desktops invalid/);
+});

package/test/desktop-runtime-r40.test.mjs

@@ -0,0 +1,278 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash,generateKeyPairSync } from 'node:crypto';
+import { mkdtemp,readFile,writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createDesktopFrame } from '../src/desktop-contract.mjs';
+import { DESKTOP_POLICY_SCHEMA,DESKTOP_GRANT_SCHEMA } from '../src/desktop-policy-r40.mjs';
+import { createDesktopRuntime,verifyDesktopReceiptObject } from '../src/desktop-runtime-r40.mjs';
+
+const H=value=>createHash('sha256').update(String(value)).digest('hex');
+const EPOCH=H('epoch');
+const TOPO=H('topology');
+const WIN={hwnd:'0x1234',pid:55,process_image_sha256:H('app'),title_sha256:H('title')};
+
+function F(at,image=H('same'),window=WIN){
+  return createDesktopFrame({
+    desktopEpoch:EPOCH,topologySha256:TOPO,observedAtUtc:at,
+    bounds:{left:0,top:0,width:1000,height:800},activeWindow:window,imageSha256:image
+  });
+}
+async function fixture({grantActions=['click_primary','text_input'],captureFrames=null,times=null,inputProvider=null,grounderProvider=null}={}){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r40-desktop-runtime-'));
+  const grant=path.join(root,'grant.json'),evidence=path.join(root,'evidence');
+  const policy={
+    schema:DESKTOP_POLICY_SCHEMA,enabled:true,policy_path:path.join(root,'policy.json'),
+    policy_sha256:H('policy'),grant_file:grant,evidence_dir:evidence,
+    observer:{executable:path.join(root,'observer.exe'),sha256:H('observer'),backend:'fake'},
+    input:{executable:path.join(root,'input.exe'),sha256:H('input')},
+    allowed_input_desktops:['Default'],
+    allowed_actions:['pointer_move','click_primary','click_secondary','double_click_primary','scroll','key_chord','text_input'],
+    limits:{max_frame_age_ms:2000,max_frame_bytes:8*1024*1024,capture_timeout_ms:5000,input_timeout_ms:2000,post_observe_timeout_ms:5000,max_preview_bytes:512*1024,max_text_bytes:4096}
+  };
+  await writeFile(grant,JSON.stringify({
+    schema:DESKTOP_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:H('grant-nonce'),action_kinds:grantActions
+  }));
+  const expected=F('2026-09-19T02:00:00.000Z');
+  const frames=captureFrames??[
+    {frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4},
+    {frame:F('2026-09-19T02:00:01.000Z',H('after')),backend:'fake',byte_length:4}
+  ];
+  const records=new Map([[expected.frame_id,{frame:expected}]]);
+  let captureIndex=0;
+  const observerRuntime={
+    frameStatus(id){const r=records.get(id);if(!r)throw new Error('frame missing');return r;},
+    async capture(){
+      const item=frames[captureIndex++];
+      if(!item)throw new Error('capture exhausted');
+      records.set(item.frame.frame_id,item);return item;
+    }
+  };
+  const calls=[];
+  const provider=inputProvider??(async(action)=>{calls.push(action);return {injected:true,provider_receipt_sha256:H('provider')};});
+  const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+  const clock=[...(times??[
+    '2026-09-19T02:00:00.500Z',
+    '2026-09-19T02:00:00.800Z',
+    '2026-09-19T02:00:00.810Z',
+    '2026-09-19T02:00:01.000Z'
+  ])];
+  const now=()=>clock.length?clock.shift():'2026-09-19T02:00:01.000Z';
+  const runtime=createDesktopRuntime({policy,observerRuntime,inputProvider:provider,grounderProvider,privateKey,keyId:'test-key',evidenceDir:evidence,now});
+  return {root,grant,evidence,policy,expected,runtime,calls,publicKey};
+}
+
+test('desktop runtime performs observe-target-fresh-guard-effect-post chain',async()=>{
+  const fx=await fixture();
+  const target=await fx.runtime.target({
+    frameId:fx.expected.frame_id,rect:{left:100,top:100,width:200,height:100},source:'uia',confidence:0.99
+  });
+  const result=await fx.runtime.action({
+    intentId:H('intent'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,targetId:target.target.target_id
+  });
+  assert.equal(fx.calls.length,1);
+  assert.deepEqual(fx.calls[0].point,{x:200,y:150});
+  assert.equal(result.injected,true);
+  assert.equal(result.task_success,null);
+  assert.equal(result.post_observation.change_observed,true);
+  assert.equal(result.post_observation.success,null);
+  assert.equal(result.side_effect_state,'confirmed_injected');
+  assert.match(result.started_receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.match(result.post_receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.match(result.receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.match(result.action_chain.chain_sha256,/^[0-9a-f]{64}$/);
+  assert.match(result.effect_id,/^[0-9a-f]{64}$/);
+  assert.match(result.effect_fingerprint,/^[0-9a-f]{64}$/);
+  assert.equal(result.effect_completion.schema,'deadbyte.effect-completion.v1');
+
+  const postReceipt=JSON.parse(await readFile(path.join(fx.evidence,`${result.post_receipt_id}.json`),'utf8'));
+  assert.equal(postReceipt.kind,'desktop_post_observation');
+  assert.equal(postReceipt.payload.post_observation_sha256,result.post_observation.post_observation_sha256);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${result.receipt_id}.json`),'utf8'));
+  assert.deepEqual(verifyDesktopReceiptObject(receipt,{
+    policySha256:fx.policy.policy_sha256,publicKey:fx.publicKey,keyId:'test-key'
+  }),{ok:true,receipt_sha256:result.receipt_sha256,kind:'desktop_action_completed',receipt_id:result.receipt_id});
+});
+
+test('desktop runtime refuses effect when expected frame is stale',async()=>{
+  const fx=await fixture({times:['2026-09-19T02:00:03.500Z']});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('stale'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:10,y:10}
+  }),/expected frame is stale/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('desktop runtime re-observes and blocks pixels changed before effect',async()=>{
+  const changed={frame:F('2026-09-19T02:00:00.700Z',H('changed-before')),backend:'fake',byte_length:4};
+  const fx=await fixture({captureFrames:[changed]});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('changed'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:10,y:10}
+  }),/pixels changed before action/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('desktop runtime key_chord is window-scoped and tolerates unrelated pixel drift',async()=>{
+  const changedPre={frame:F('2026-09-19T02:00:00.700Z',H('dynamic-before')),backend:'fake',byte_length:4};
+  const changedPost={frame:F('2026-09-19T02:00:01.000Z',H('dynamic-after')),backend:'fake',byte_length:4};
+  const fx=await fixture({grantActions:['key_chord'],captureFrames:[changedPre,changedPost]});
+  const result=await fx.runtime.action({
+    intentId:H('window-key'),kind:'key_chord',expectedFrameId:fx.expected.frame_id,keyChord:['SHIFT']
+  });
+  assert.equal(fx.calls.length,1);
+  assert.equal(result.injected,true);
+  assert.deepEqual(fx.calls[0].key_chord,['SHIFT']);
+});
+
+test('desktop runtime text_input remains pixel-stable because keyboard focus is control-sensitive',async()=>{
+  const changed={frame:F('2026-09-19T02:00:00.700Z',H('changed-text')),backend:'fake',byte_length:4};
+  const fx=await fixture({grantActions:['text_input'],captureFrames:[changed]});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('changed-text'),kind:'text_input',expectedFrameId:fx.expected.frame_id,text:'x'
+  }),/pixels changed before action/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('desktop runtime re-observes and blocks foreground-window drift',async()=>{
+  const changed={frame:F('2026-09-19T02:00:00.700Z',H('same'),{...WIN,hwnd:'0x9999'}),backend:'fake',byte_length:4};
+  const fx=await fixture({captureFrames:[changed]});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('window'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:10,y:10}
+  }),/foreground window changed before action/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('T9 capture failure blocks input before any side effect dispatch',async()=>{
+  const fx=await fixture({captureFrames:[]});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('capture-fail'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+  }),/capture exhausted/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('T9 Desktop receipt substitution is detected by runtime verifier',async()=>{
+  const fx=await fixture();
+  const result=await fx.runtime.action({
+    intentId:H('receipt-substitution'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+  });
+  const clean=await fx.runtime.verifyReceipt({receiptId:result.receipt_id});
+  assert.equal(clean.ok,true);
+  assert.equal(clean.receipt_sha256,result.receipt_sha256);
+  const receiptPath=path.join(fx.evidence,result.receipt_id+'.json');
+  const tampered=JSON.parse(await readFile(receiptPath,'utf8'));
+  tampered.payload.action_sha256=H('forged-action');
+  await writeFile(receiptPath,JSON.stringify(tampered));
+  await assert.rejects(fx.runtime.verifyReceipt({receiptId:result.receipt_id}),/receipt verification failed/);
+});
+
+test('desktop runtime enforces standing-grant action scope',async()=>{
+  const fx=await fixture({grantActions:['click_primary']});
+  await assert.rejects(fx.runtime.action({
+    intentId:H('text'),kind:'text_input',expectedFrameId:fx.expected.frame_id,text:'hello'
+  }),/outside active grant/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('desktop runtime denies mutation when grant is revoked',async()=>{
+  const fx=await fixture();
+  await writeFile(fx.grant,'{}');
+  await assert.rejects(fx.runtime.action({
+    intentId:H('revoked'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+  }),/desktop plane is disarmed/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('provider failure after dispatch is signed OUTCOME_UNKNOWN and never blind-retried',async()=>{
+  let calls=0;
+  const fx=await fixture({inputProvider:async()=>{calls++;throw new Error('transport lost after dispatch');}});
+  let error;
+  try{
+    await fx.runtime.action({
+      intentId:H('fail-unknown'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+    });
+  }catch(e){error=e;}
+  assert.equal(calls,1);
+  assert.equal(error.side_effect_state,'unknown');
+  assert.match(error.message,/outcome unknown/);
+  assert.match(error.receipt_id,/^[0-9a-f]{24}$/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${error.receipt_id}.json`),'utf8'));
+  assert.equal(receipt.kind,'desktop_action_outcome_unknown');
+  assert.equal(receipt.payload.side_effect_state,'unknown');
+});
+
+test('definite pre-dispatch provider denial is signed as not_started',async()=>{
+  const provider=async()=>{const e=new Error('binary pin mismatch');e.side_effect_state='not_started';throw e;};
+  const fx=await fixture({inputProvider:provider});
+  let error;
+  try{
+    await fx.runtime.action({
+      intentId:H('fail-not-started'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+    });
+  }catch(e){error=e;}
+  assert.equal(error.side_effect_state,'not_started');
+  assert.match(error.message,/did not start/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${error.receipt_id}.json`),'utf8'));
+  assert.equal(receipt.kind,'desktop_action_effect_failed');
+  assert.equal(receipt.payload.side_effect_state,'not_started');
+});
+
+test('post-observation failure after confirmed injection is OUTCOME_UNKNOWN',async()=>{
+  const preOnly={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const fx=await fixture({captureFrames:[preOnly]});
+  let error;
+  try{
+    await fx.runtime.action({
+      intentId:H('post-fail'),kind:'click_primary',expectedFrameId:fx.expected.frame_id,point:{x:20,y:20}
+    });
+  }catch(e){error=e;}
+  assert.equal(fx.calls.length,1);
+  assert.equal(error.side_effect_state,'unknown');
+  assert.match(error.message,/post-observation\/evidence incomplete/);
+  const receipt=JSON.parse(await readFile(path.join(fx.evidence,`${error.receipt_id}.json`),'utf8'));
+  assert.equal(receipt.kind,'desktop_action_outcome_unknown');
+  assert.equal(receipt.payload.injection_confirmed,true);
+});
+
+test('read-only observe works independently of desktop mutation grant',async()=>{
+  const fx=await fixture();
+  await writeFile(fx.grant,'{}');
+  const observed=await fx.runtime.observe();
+  assert.equal(observed.status,undefined);
+  assert.match(observed.frame.frame_id,/^[0-9a-f]{64}$/);
+  assert.match(observed.receipt_sha256,/^[0-9a-f]{64}$/);
+});
+
+
+test('desktop runtime enforces policy max_text_bytes before observation or input effect',async()=>{
+  const fx=await fixture({grantActions:['text_input']});
+  const multibyte='ก'.repeat(2000);
+  assert.ok(multibyte.length<=4096);
+  assert.ok(Buffer.byteLength(multibyte,'utf8')>fx.policy.limits.max_text_bytes);
+  await assert.rejects(fx.runtime.action({
+    intentId:H('oversize-text'),kind:'text_input',expectedFrameId:fx.expected.frame_id,text:multibyte
+  }),/exceeds policy byte limit/);
+  assert.equal(fx.calls.length,0);
+});
+
+test('T5 UIA grounding re-observes and binds candidate to fresh frame without mutation authority',async()=>{
+  const groundedFrame={frame:F('2026-09-19T02:00:00.700Z'),backend:'fake',byte_length:4};
+  const grounderProvider=async({frame,query})=>{
+    assert.equal(frame.frame_id,groundedFrame.frame.frame_id);
+    assert.equal(query.value,'Save');
+    return {
+      status:'ok',query_sha256:H('query-save'),query_kind:'name_exact',ordinal:0,visited:9,truncated:false,
+      matches:[{rect:{left:100,top:120,width:80,height:30},control_type:50000,enabled:true,offscreen:false}],
+      provider_receipt_sha256:H('uia-provider')
+    };
+  };
+  const fx=await fixture({captureFrames:[groundedFrame],grounderProvider});
+  await writeFile(fx.grant,'{}');
+  const result=await fx.runtime.ground({frameId:fx.expected.frame_id,query:{kind:'name_exact',value:'Save',max_results:8,ordinal:0}});
+  assert.equal(result.target.source,'uia');
+  assert.equal(result.target.frame_id,groundedFrame.frame.frame_id);
+  assert.deepEqual(result.target.rect,{left:100,top:120,width:80,height:30});
+  assert.equal(result.grounding.query_sha256,H('query-save'));
+  assert.match(result.grounding.receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.equal(JSON.stringify(result).includes('Save'),false);
+  assert.equal(fx.calls.length,0);
+});

package/test/desktop-uia-r40.test.mjs

@@ -0,0 +1,42 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { parseDesktopUiaResponse,serializeDesktopUiaRequest } from '../src/desktop-uia-r40.mjs';
+
+const H=v=>createHash('sha256').update(String(v)).digest('hex');
+const win={hwnd:'0x1234',pid:42};
+const bounds={left:-100,top:0,width:2020,height:1080};
+
+test('T5 UIA request is fixed bounded and keeps semantic query in stdin only',()=>{
+  const out=serializeDesktopUiaRequest({expectedWindow:win,query:{kind:'name_exact',value:'Save',max_results:4,ordinal:1}});
+  assert.ok(out.request.length<8192);
+  assert.equal(out.query.kind,'name_exact');
+  assert.equal(out.query.ordinal,1);
+  assert.match(out.query.querySha256,/^[0-9a-f]{64}$/);
+  assert.equal(out.request.toString('utf8').endsWith('Save'),true);
+});
+
+test('T5 UIA response is foreground-bound and filters off-desktop rectangles',()=>{
+  const raw=Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-uia-ground.v1',foreground_hwnd:'0x1234',foreground_pid:42,
+    query_kind:'control_type',visited:12,truncated:false,matches:[
+      {left:10,top:20,width:100,height:30,control_type:50000,enabled:true,offscreen:false},
+      {left:5000,top:20,width:100,height:30,control_type:50000,enabled:true,offscreen:false}
+    ]
+  }));
+  const parsed=parseDesktopUiaResponse(raw,{expectedWindow:win,expectedBounds:bounds,query:{kind:'control_type',value:'button',max_results:8,ordinal:0}});
+  assert.equal(parsed.matches.length,1);
+  assert.deepEqual(parsed.matches[0].rect,{left:10,top:20,width:100,height:30});
+  assert.equal(parsed.matches[0].control_type,50000);
+  assert.match(parsed.provider_receipt_sha256,/^[0-9a-f]{64}$/);
+  assert.match(parsed.query_sha256,/^[0-9a-f]{64}$/);
+});
+
+test('T5 UIA response rejects foreground substitution and oversized query',()=>{
+  const raw=Buffer.from(JSON.stringify({
+    schema:'deadbyte.desktop-uia-ground.v1',foreground_hwnd:'0x9999',foreground_pid:42,
+    query_kind:'root',visited:1,truncated:false,matches:[]
+  }));
+  assert.throws(()=>parseDesktopUiaResponse(raw,{expectedWindow:win,expectedBounds:bounds,query:{kind:'root',value:'',max_results:1,ordinal:0}}),/hwnd mismatch/);
+  assert.throws(()=>serializeDesktopUiaRequest({expectedWindow:win,query:{kind:'name_exact',value:'x'.repeat(513)}}),/bytes invalid/);
+});

package/test/full-max-catalog-r40.test.mjs

@@ -0,0 +1,91 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R40 real max-runtime full stdio catalog is exactly 80 with four Desktop primitives while authority remains disarmed',async()=>{
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const nodeSha=sha(await readFile(process.execPath));
+  await mkdir(processState,{recursive:true});
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],
+      prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,
+      max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],
+      input_actions:{ping:'PING\r\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,
+      root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r40-full-catalog',version:'0.12.0'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),
+    DEADBYTE_CAPABILITY_PROFILE:'full',
+    DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),
+    DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,
+    DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,
+    DEADBYTE_MACHINE_RUNTIME:'1',
+    DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',
+    DEADBYTE_PROCESS_POLICY:processPolicyPath,
+    DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),
+    DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_DESKTOP_RUNTIME:'1',
+    DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',
+    DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    const {R40_EXPECTED_TOOLS}=await import('../src/remote-mcp-r40-parity-client.mjs');
+    assert.equal(names.length,80,'expected exact full R40 catalog 80, got '+names.length+': '+names.join(','));
+    assert.deepEqual(names,R40_EXPECTED_TOOLS);
+    for(const name of ['desktop_status','desktop_observe','desktop_target','desktop_action',
+      'host_file_read','host_file_write','host_exec']) assert.ok(names.includes(name),'missing '+name);
+    for(const tool of listed.tools) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
+    const catalog_sha256=sha(Buffer.from(JSON.stringify(names),'utf8'));
+    console.log(JSON.stringify({tool_count:names.length,catalog_sha256,desktop_tools:4,authority:'DISARMED'}));
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/helpers/autonomous-r34-fixture.mjs

@@ -12,7 +12,7 @@ import { createAutonomousRuntime } from '../../src/autonomous-runtime.mjs';
 const sha = bytes => createHash('sha256').update(bytes).digest('hex');
 const nonce = () => randomBytes(32).toString('hex');
 
-export async function createR34Fixture({authority='armed',withFailingProfile=false,withStatefulProfile=false,codingRuntimeFactory=null,nativeDiffRuntimeFactory=null}={}) {
+export async function createR34Fixture({authority='armed',withFailingProfile=false,withStatefulProfile=false,codingRuntimeFactory=null,nativeDiffRuntimeFactory=null,desktopMemoryProvider=null,memoryProvider=null,desktopRuntime=null}={}) {
   const root = await mkdtemp(path.join(os.tmpdir(),'deadbyte-r34-e2e-'));
   const project = path.join(root,'project');
   const trust = path.join(root,'trust');
@@ -73,8 +73,8 @@ export async function createR34Fixture({authority='armed',withFailingProfile=fal
   const machineFsRuntime = createMachineFsRuntime({policy:codingPolicy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const baseNativeDiffRuntime = createNativeDiffRuntime({policy,codingRuntime,machineFsRuntime,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   const nativeDiffRuntime = nativeDiffRuntimeFactory ? nativeDiffRuntimeFactory(baseNativeDiffRuntime) : baseNativeDiffRuntime;
-  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
-    signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
+  const createRuntime = ({codingRuntimeOverride=codingRuntime,nativeDiffRuntimeOverride=nativeDiffRuntime,desktopMemoryProviderOverride=desktopMemoryProvider,memoryProviderOverride=memoryProvider,desktopRuntimeOverride=desktopRuntime}={}) => createAutonomousRuntime({policy,codingRuntime:codingRuntimeOverride,nativeDiffRuntime:nativeDiffRuntimeOverride,machineFsRuntime,
+    desktopRuntime:desktopRuntimeOverride,desktopMemoryProvider:desktopMemoryProviderOverride,memoryProvider:memoryProviderOverride,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath});
   return {
     root,project,target,keys,codingPolicy,policy,baseCodingRuntime,codingRuntime,machineFsRuntime,nativeDiffRuntime,createRuntime,runtime:createRuntime(),
     initial_sha256:sha(await readFile(target)),arm,disarm,

package/test/memory-autonomous-integration-r41.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+import { loadPrivateSigningKey,loadPublicVerifyKey } from '../src/trust.mjs';
+import { createR41MemoryProvider } from '../src/memory-r41.mjs';
+
+const sha=value=>createHash('sha256').update(String(value)).digest('hex');
+
+test('R41 planner request binds verified bounded memory before a mutating decision',async()=>{
+  const f=await createR34Fixture();
+  try{
+    const signing=await loadPrivateSigningKey(f.keys.privateKeyPath);
+    const verify=await loadPublicVerifyKey(f.keys.publicKeyPath);
+    const provider=createR41MemoryProvider({memoryRoot:path.join(f.root,'memory'),sourceReleaseManifest:sha('r41-release'),
+      writerVersion:'0.13.0',privateKey:signing.privateKey,publicKey:verify.publicKey,keyId:signing.keyId,byteBudget:65536});
+    const runtime=f.createRuntime({memoryProviderOverride:provider});
+    const goal=await runtime.submit({submissionId:'r41-memory-binding',rootId:'project',title:'repair',goal:'repair x.txt',acceptance:'x is y'});
+    const run=await runtime.run({goalId:goal.goal_id,maxCycles:1});
+    assert.equal(run.status,'input_required');
+    assert.match(run.planner_request.prompt,/"long_term_memory"/);
+    assert.match(run.planner_request.prompt,/"working_memory_sha256":"[0-9a-f]{64}"/);
+    const journal=await runtime.events({goalId:goal.goal_id,fromSeq:1,limit:100});
+    const requested=journal.events.find(event=>event.type==='planner_requested');
+    assert.match(requested.payload.working_memory_sha256,/^[0-9a-f]{64}$/);
+    assert.match(requested.payload.memory_snapshot_sha256,/^[0-9a-f]{64}$/);
+    assert.match(requested.payload.memory_index_sha256,/^[0-9a-f]{64}$/);
+    assert.equal(requested.payload.memory_source_release_manifest,sha('r41-release'));
+  }finally{await f.cleanup();}
+});