deadbyte-mcp 0.11.3 → 0.13.0

package/docs/superpowers/specs/2026-09-20-r41-deterministic-memory-design.md

@@ -0,0 +1,132 @@
+# R41 DETERMINISTIC MEMORY ARCHITECTURE
+
+Status: approved implementation contract
+Date: 2026-09-20
+Predecessor: R40 PUBLIC FINAL / deadbyte-mcp 0.12.0
+Development root: `D:\Projects\deadbyte-mcp-r41-memory-dev`
+
+R40 release, source baseline, generation, npm artifact, and final evidence are immutable. R41 starts from parent manifest `70906ae0a7e4f0627efbb5087b40b85677c81ed6d64ed89c0ba2af846e390f39` recorded in `R41-PARENT.json`.
+
+## Execution contract
+
+- TASK_ID: `R41-MEMORY-ARCHITECTURE`
+- OBJECTIVE: production deterministic long-term memory derived from DEADBYTE's signed autonomous journals.
+- ACTIVE_SKILL: `implement-controlled-software-changes`.
+- LEAD_ROLE: systems implementation.
+- REVIEW_ROLE: independent machine verifier and adversarial tests; no human reviewer is available in this execution surface.
+- FIXED: journal authority, Ed25519 evidence, immutable releases, fail-closed mutation, Host never auto-arms, no blind replay.
+- TARGETS: deterministic snapshots, episodic/decision/incident memory, bounded working memory, rebuildable exact/FTS/symbol indexes, disabled semantic adapter.
+- BOUNDS: internal runtime and existing compact gateways only; no new public MCP tools; no neural authority; no new dependency.
+- CLASS_2_DISCRETION: bounded schemas, limits, file layout, and compaction thresholds that preserve the approved architecture.
+- CLASS_3_DISCRETION: helper structure, names, pure data structures, and test organization.
+- PROHIBITED: modifying R40 bytes/evidence, overwriting or republishing 0.12.0, embeddings as truth, memory-based authorization, silent decision overwrite, unverified provenance.
+- METHOD_LOCK: project lock; signed journal is canonical, memory is a deterministic projection, snapshot plus verified suffix must equal full replay, indexes are disposable.
+- ASSURANCE_MODE: security-critical deterministic state and release regression.
+- ACCEPTANCE_ORACLES: byte equality, content hashes, Ed25519 verification, full-replay equivalence, actual planner context, focused/adversarial tests, full Windows release gate.
+- STOP_CONDITION: source conflict, inability to verify canonical provenance, authority widening, or unknown side-effect state.
+- ROLLBACK: discard the separate R41 directory; R40 remains active and untouched.
+
+## Authority model
+
+```text
+signed goal + signed event journal
+            |
+            +--> verified full replay
+            +--> signed deterministic snapshot + verified suffix replay
+            +--> episodic projection
+            +--> decision projection
+            +--> incident projection
+            +--> disposable retrieval indexes
+            +--> bounded verified working set
+                              |
+                              v
+                           planner
+```
+
+Only the signed goal and journal events establish facts. Snapshots, memories, indexes, and planner working sets are derived state. They never arm authority, authorize an operation, or prove a side effect.
+
+## Journal identity
+
+R41 reuses the existing autonomous journal contract:
+
+- goal envelope: `deadbyte.autonomous-goal.v1`, Ed25519 domain-bound;
+- event envelope: `deadbyte.autonomous-event.v1`, contiguous per-goal sequence;
+- each event binds `goal_id`, `seq`, `prev_sha256`, payload, and `event_sha256`;
+- event files are immutable `000001.json`, `000002.json`, ...;
+- verification fails on a gap, substitution, signature failure, wrong goal, wrong predecessor hash, or schema drift.
+
+Canonical memory references use `{goal_id, seq, event_sha256}`. Artifacts and receipts are references by SHA-256, never copied as untraceable claims.
+
+## Deterministic snapshots
+
+Schema `deadbyte.memory-snapshot.v1` contains:
+
+- `schema_version` and snapshot schema;
+- `snapshot_sequence`;
+- `goal_id`;
+- `last_event_seq`;
+- `journal_prefix_hash` (the exact event head at `last_event_seq`);
+- `state` and `state_hash` over canonical JSON;
+- `created_at_utc` as metadata excluded from derived-state identity;
+- `source_release_manifest`;
+- `writer_version`;
+- Ed25519 attestation and a snapshot self-hash.
+
+Load verifies the signature, schema, state hash, source release binding, exact journal prefix, and sequence bounds. A corrupt/deleted snapshot is never trusted; the provider explicitly falls back to full verified replay and may replace the projection atomically. Snapshot plus suffix replay must be byte-equal to full replay.
+
+## Episodic memory
+
+Each goal is one episode. The projection records goal, observations, decisions, actions, results, verifications, outcome, event range, artifact/receipt references, and timestamps. Every item retains canonical event references. Open episodes remain open; only terminal journal evidence closes them.
+
+## Decision memory
+
+Planner decisions and explicit decision/supersession events project to stable decision records. Supersession is an edge, not an overwrite. Missing targets and cycles fail closed. Before any planner mutation, the bounded working set contains relevant active decisions and their source event references.
+
+## Failure and incident memory
+
+Failures project into deterministic fingerprints from safe structured fields: tool/operation, platform/architecture, exit/signal/timeout, diagnostic codes, output hashes, bounded stack frames, runtime/profile/symbol identity, artifacts, and environment fingerprint. Raw secrets and unbounded output are forbidden. Incidents link symptoms, attempts, root cause/fix evidence when present, status, and source event range.
+
+## Bounded working memory
+
+The working set contains the current goal/plan/files/symbols, recent events, open failures, active constraints, relevant decisions/incidents, current authority observation, and active episode. It is deterministically ranked and compacted to a byte budget. Each retained fact carries canonical event or artifact provenance. Deleting it loses no truth.
+
+## Retrieval indexes
+
+Indexes are canonical JSON projections rebuilt from verified memory:
+
+- exact canonical ID;
+- goal event range;
+- exact normalized token and bounded full-text token;
+- structured fields;
+- symbol;
+- artifact/content SHA-256;
+- decision scope/status;
+- incident fingerprint.
+
+The index binds the source memory hash. Poisoned or stale bindings fail closed. Deleting and rebuilding an index must produce byte-identical content.
+
+## Optional semantic adapter
+
+`memory.semantic.enabled` defaults to `false`. The adapter may return candidate canonical IDs only. Every candidate is resolved from the verified exact index and re-read from canonical memory before planner use. It cannot authorize, mutate, establish truth, or replace receipts.
+
+## Production integration
+
+R41 adds an internal memory provider to the autonomous runtime. `plannerView` receives only its bounded verified projection. Authority checks remain in the existing execution path immediately before effects. No public MCP tool is added. Local inspection and verification use CLI/internal APIs and signed evidence.
+
+## Acceptance
+
+Focused and adversarial tests must prove:
+
+1. full replay equals snapshot plus suffix replay;
+2. schema/sequence/prefix/state/signature tampering fails closed;
+3. deleted/corrupt snapshots explicitly fall back to full verified replay;
+4. nonexistent episode references and decision cycles fail;
+5. incident spoofing and index poisoning fail;
+6. stale/cross-release working memory is rejected;
+7. semantic candidates require valid canonical provenance;
+8. indexes rebuild byte-identically after deletion;
+9. retrieved memory cannot arm or authorize any execution;
+10. planner mutation sees verified decision memory;
+11. R40 manifest, release tree, and final evidence hashes remain unchanged.
+
+R41 release identity is a new version/manifest and cannot reuse or overwrite 0.12.0. Publication remains forbidden until focused tests, full regression, Windows gate, local/public parity, rollback/restore, final closure, independent verification, and final all-DISARMED authority pass.

package/native/deadbyte-desktop-input.cpp

@@ -0,0 +1,455 @@
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <io.h>
+#include <fcntl.h>
+#include <cstdio>
+#include <cstdint>
+#include <cstdlib>
+#include <string>
+#include <vector>
+#include <sstream>
+#include <iomanip>
+#include <algorithm>
+
+static constexpr size_t kMaxRequestBytes = 128u * 1024u;
+static constexpr size_t kMaxTextBytes = 64u * 1024u;
+static constexpr size_t kMaxKeys = 5u;
+
+struct Request {
+    std::string actionSha256;
+    std::string kind;
+    std::string expectedDesktop;
+    uintptr_t expectedHwnd = 0;
+    DWORD expectedPid = 0;
+    LONG left = 0;
+    LONG top = 0;
+    LONG width = 0;
+    LONG height = 0;
+    LONG x = 0;
+    LONG y = 0;
+    LONG scrollDelta = 0;
+    std::vector<std::string> keys;
+    std::string textUtf8;
+};
+
+static std::string Utf8(const wchar_t* value) {
+    if (!value) return {};
+    const int needed = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, value, -1, nullptr, 0, nullptr, nullptr);
+    if (needed <= 0) return {};
+    std::string out(static_cast<size_t>(needed), '\0');
+    if (WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, value, -1, out.data(), needed, nullptr, nullptr) <= 0) return {};
+    if (!out.empty() && out.back() == '\0') out.pop_back();
+    return out;
+}
+
+static std::string JsonEscape(const std::string& input) {
+    std::ostringstream out;
+    for (unsigned char ch : input) {
+        switch (ch) {
+            case '"': out << "\\\""; break;
+            case '\\': out << "\\\\"; break;
+            case '\b': out << "\\b"; break;
+            case '\f': out << "\\f"; break;
+            case '\n': out << "\\n"; break;
+            case '\r': out << "\\r"; break;
+            case '\t': out << "\\t"; break;
+            default:
+                if (ch < 0x20) out << "\\u" << std::hex << std::setw(4) << std::setfill('0') << static_cast<unsigned int>(ch) << std::dec;
+                else out << static_cast<char>(ch);
+        }
+    }
+    return out.str();
+}
+
+static std::string HwndHex(HWND hwnd) {
+    std::ostringstream out;
+    out << "0x" << std::hex << std::nouppercase << reinterpret_cast<uintptr_t>(hwnd);
+    return out.str();
+}
+
+static bool InputDesktopName(std::string& name) {
+    HDESK desktop = OpenInputDesktop(0, FALSE, DESKTOP_READOBJECTS);
+    if (!desktop) return false;
+    wchar_t buffer[512]{};
+    DWORD needed = 0;
+    const BOOL ok = GetUserObjectInformationW(desktop, UOI_NAME, buffer, sizeof(buffer), &needed);
+    CloseDesktop(desktop);
+    if (!ok) return false;
+    name = Utf8(buffer);
+    return !name.empty();
+}
+
+static bool Hex64(const std::string& value) {
+    if (value.size() != 64u) return false;
+    return std::all_of(value.begin(), value.end(), [](char c) {
+        return (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f');
+    });
+}
+
+static bool ParseLong(const std::string& value, LONG& out) {
+    if (value.empty()) return false;
+    char* end = nullptr;
+    errno = 0;
+    const long parsed = std::strtol(value.c_str(), &end, 10);
+    if (errno != 0 || end == value.c_str() || *end != '\0') return false;
+    out = static_cast<LONG>(parsed);
+    return true;
+}
+
+static bool ParseDword(const std::string& value, DWORD& out) {
+    if (value.empty()) return false;
+    char* end = nullptr;
+    errno = 0;
+    const unsigned long parsed = std::strtoul(value.c_str(), &end, 10);
+    if (errno != 0 || end == value.c_str() || *end != '\0') return false;
+    out = static_cast<DWORD>(parsed);
+    return true;
+}
+
+static bool ParseUintptrHex(const std::string& value, uintptr_t& out) {
+    if (value.size() < 3u || value[0] != '0' || value[1] != 'x') return false;
+    char* end = nullptr;
+    errno = 0;
+    const unsigned long long parsed = std::strtoull(value.c_str() + 2, &end, 16);
+    if (errno != 0 || end == value.c_str() + 2 || *end != '\0') return false;
+    out = static_cast<uintptr_t>(parsed);
+    return static_cast<unsigned long long>(out) == parsed;
+}
+
+static bool ReadAllStdin(std::string& bytes) {
+    if (_setmode(_fileno(stdin), _O_BINARY) == -1) return false;
+    std::vector<char> buffer(4096u);
+    for (;;) {
+        const size_t got = std::fread(buffer.data(), 1, buffer.size(), stdin);
+        if (got > 0u) {
+            if (bytes.size() + got > kMaxRequestBytes) return false;
+            bytes.append(buffer.data(), got);
+        }
+        if (got < buffer.size()) {
+            if (std::ferror(stdin)) return false;
+            break;
+        }
+    }
+    return !bytes.empty();
+}
+
+static bool NextLine(const std::string& bytes, size_t& offset, std::string& line) {
+    if (offset >= bytes.size()) return false;
+    const size_t end = bytes.find('\n', offset);
+    if (end == std::string::npos) return false;
+    line.assign(bytes, offset, end - offset);
+    if (!line.empty() && line.back() == '\r') line.pop_back();
+    offset = end + 1u;
+    return true;
+}
+
+static bool SplitField(const std::string& line, std::string& key, std::string& value) {
+    const size_t eq = line.find('=');
+    if (eq == std::string::npos || eq == 0u) return false;
+    key = line.substr(0u, eq);
+    value = line.substr(eq + 1u);
+    return true;
+}
+
+static bool SupportedKind(const std::string& kind) {
+    static const char* const kinds[] = {
+        "pointer_move","click_primary","click_secondary","double_click_primary",
+        "scroll","key_chord","text_input"
+    };
+    for (const char* value : kinds) if (kind == value) return true;
+    return false;
+}
+
+static WORD VirtualKey(const std::string& key) {
+    if (key.size() == 1u && key[0] >= 'A' && key[0] <= 'Z') return static_cast<WORD>(key[0]);
+    if (key.size() == 1u && key[0] >= '0' && key[0] <= '9') return static_cast<WORD>(key[0]);
+    if (key.size() >= 2u && key[0] == 'F') {
+        const int n = std::atoi(key.c_str() + 1);
+        if (n >= 1 && n <= 12) return static_cast<WORD>(VK_F1 + n - 1);
+    }
+    if (key == "ENTER") return VK_RETURN;
+    if (key == "ESC") return VK_ESCAPE;
+    if (key == "TAB") return VK_TAB;
+    if (key == "SPACE") return VK_SPACE;
+    if (key == "BACKSPACE") return VK_BACK;
+    if (key == "DELETE") return VK_DELETE;
+    if (key == "INSERT") return VK_INSERT;
+    if (key == "HOME") return VK_HOME;
+    if (key == "END") return VK_END;
+    if (key == "PAGEUP") return VK_PRIOR;
+    if (key == "PAGEDOWN") return VK_NEXT;
+    if (key == "LEFT") return VK_LEFT;
+    if (key == "RIGHT") return VK_RIGHT;
+    if (key == "UP") return VK_UP;
+    if (key == "DOWN") return VK_DOWN;
+    if (key == "CTRL") return VK_CONTROL;
+    if (key == "ALT") return VK_MENU;
+    if (key == "SHIFT") return VK_SHIFT;
+    if (key == "WIN") return VK_LWIN;
+    return 0;
+}
+
+static bool ParseRequest(const std::string& bytes, Request& request, std::string& reason) {
+    size_t offset = 0u;
+    std::string line;
+    if (!NextLine(bytes, offset, line) || line != "DEADBYTE_DESKTOP_INPUT_V1") {
+        reason = "magic mismatch"; return false;
+    }
+
+    bool seenAction=false,seenKind=false,seenDesktop=false,seenHwnd=false,seenPid=false;
+    bool seenLeft=false,seenTop=false,seenWidth=false,seenHeight=false,seenX=false,seenY=false;
+    bool seenDelta=false,seenKeyCount=false,seenTextBytes=false;
+    size_t declaredKeyCount=0u, declaredTextBytes=0u;
+
+    while (NextLine(bytes, offset, line)) {
+        std::string key,value;
+        if (!SplitField(line,key,value)) { reason="field malformed"; return false; }
+        if (key=="action_sha256") {
+            if (seenAction || !Hex64(value)) { reason="action_sha256 invalid"; return false; }
+            seenAction=true; request.actionSha256=value;
+        } else if (key=="kind") {
+            if (seenKind || !SupportedKind(value)) { reason="kind invalid"; return false; }
+            seenKind=true; request.kind=value;
+        } else if (key=="expected_desktop") {
+            if (seenDesktop || value.empty() || value.size()>128u || value.find('\0')!=std::string::npos) { reason="expected_desktop invalid"; return false; }
+            seenDesktop=true; request.expectedDesktop=value;
+        } else if (key=="expected_hwnd") {
+            if (seenHwnd || !ParseUintptrHex(value,request.expectedHwnd)) { reason="expected_hwnd invalid"; return false; }
+            seenHwnd=true;
+        } else if (key=="expected_pid") {
+            if (seenPid || !ParseDword(value,request.expectedPid) || request.expectedPid>0x7fffffffu) { reason="expected_pid invalid"; return false; }
+            seenPid=true;
+        } else if (key=="left") {
+            if (seenLeft || !ParseLong(value,request.left)) { reason="left invalid"; return false; } seenLeft=true;
+        } else if (key=="top") {
+            if (seenTop || !ParseLong(value,request.top)) { reason="top invalid"; return false; } seenTop=true;
+        } else if (key=="width") {
+            if (seenWidth || !ParseLong(value,request.width)) { reason="width invalid"; return false; } seenWidth=true;
+        } else if (key=="height") {
+            if (seenHeight || !ParseLong(value,request.height)) { reason="height invalid"; return false; } seenHeight=true;
+        } else if (key=="x") {
+            if (seenX || !ParseLong(value,request.x)) { reason="x invalid"; return false; } seenX=true;
+        } else if (key=="y") {
+            if (seenY || !ParseLong(value,request.y)) { reason="y invalid"; return false; } seenY=true;
+        } else if (key=="scroll_delta") {
+            if (seenDelta || !ParseLong(value,request.scrollDelta)) { reason="scroll_delta invalid"; return false; } seenDelta=true;
+        } else if (key=="key_count") {
+            if (seenKeyCount) { reason="key_count duplicate"; return false; }
+            DWORD count=0; if (!ParseDword(value,count) || count>kMaxKeys) { reason="key_count invalid"; return false; }
+            seenKeyCount=true; declaredKeyCount=static_cast<size_t>(count);
+        } else if (key=="key") {
+            if (request.keys.size()>=kMaxKeys || VirtualKey(value)==0) { reason="key invalid"; return false; }
+            if (std::find(request.keys.begin(),request.keys.end(),value)!=request.keys.end()) { reason="key duplicate"; return false; }
+            request.keys.push_back(value);
+        } else if (key=="text_bytes") {
+            if (seenTextBytes) { reason="text_bytes duplicate"; return false; }
+            DWORD count=0; if (!ParseDword(value,count) || count>kMaxTextBytes) { reason="text_bytes invalid"; return false; }
+            seenTextBytes=true; declaredTextBytes=static_cast<size_t>(count);
+            if (bytes.size()-offset != declaredTextBytes) { reason="text payload length mismatch"; return false; }
+            request.textUtf8.assign(bytes.data()+offset,declaredTextBytes);
+            offset=bytes.size();
+            break;
+        } else {
+            reason="unknown field"; return false;
+        }
+    }
+
+    if (!(seenAction&&seenKind&&seenDesktop&&seenHwnd&&seenPid&&seenLeft&&seenTop&&seenWidth&&seenHeight&&seenX&&seenY&&seenDelta&&seenKeyCount&&seenTextBytes)) {
+        reason="required field missing"; return false;
+    }
+    if (request.keys.size()!=declaredKeyCount) { reason="key_count mismatch"; return false; }
+    if (request.width<=0 || request.height<=0 || request.width>131072 || request.height>131072) { reason="bounds invalid"; return false; }
+    if (request.left < -131072 || request.top < -131072 || request.left+request.width > 262144 || request.top+request.height > 262144) { reason="bounds extent invalid"; return false; }
+
+    const bool pointer = request.kind=="pointer_move" || request.kind=="click_primary" || request.kind=="click_secondary" ||
+        request.kind=="double_click_primary" || request.kind=="scroll";
+    if (pointer) {
+        if (request.x<request.left || request.y<request.top || request.x>=request.left+request.width || request.y>=request.top+request.height) {
+            reason="point outside expected desktop"; return false;
+        }
+    } else if (request.x!=0 || request.y!=0) { reason="non-pointer coordinate must be zero"; return false; }
+
+    if (request.kind=="scroll") {
+        if (request.scrollDelta==0 || request.scrollDelta < -12000 || request.scrollDelta > 12000) { reason="scroll delta invalid"; return false; }
+    } else if (request.scrollDelta!=0) { reason="non-scroll delta must be zero"; return false; }
+
+    if (request.kind=="key_chord") {
+        if (request.keys.empty()) { reason="key chord empty"; return false; }
+    } else if (!request.keys.empty()) { reason="keys supplied for non-key action"; return false; }
+
+    if (request.kind=="text_input") {
+        if (request.textUtf8.empty()) { reason="text input empty"; return false; }
+    } else if (!request.textUtf8.empty()) { reason="text supplied for non-text action"; return false; }
+
+    return true;
+}
+
+static bool ValidateEnvironment(const Request& request, std::string& currentDesktop, HWND& foreground, DWORD& foregroundPid, std::string& reason) {
+    if (!InputDesktopName(currentDesktop)) { reason="input desktop unavailable"; return false; }
+    if (currentDesktop != request.expectedDesktop) { reason="input desktop changed"; return false; }
+
+    const LONG left=GetSystemMetrics(SM_XVIRTUALSCREEN);
+    const LONG top=GetSystemMetrics(SM_YVIRTUALSCREEN);
+    const LONG width=GetSystemMetrics(SM_CXVIRTUALSCREEN);
+    const LONG height=GetSystemMetrics(SM_CYVIRTUALSCREEN);
+    if (left!=request.left || top!=request.top || width!=request.width || height!=request.height) {
+        reason="virtual desktop bounds changed"; return false;
+    }
+
+    foreground=GetForegroundWindow();
+    foregroundPid=0;
+    if (foreground) GetWindowThreadProcessId(foreground,&foregroundPid);
+    if (reinterpret_cast<uintptr_t>(foreground)!=request.expectedHwnd || foregroundPid!=request.expectedPid) {
+        reason="foreground window changed"; return false;
+    }
+    return true;
+}
+
+static LONG NormalizeAbsolute(LONG value,LONG origin,LONG extent) {
+    if (extent<=1) return 0;
+    const long long numerator=static_cast<long long>(value-origin)*65535ll;
+    return static_cast<LONG>(numerator/static_cast<long long>(extent-1));
+}
+
+static INPUT MouseInput(DWORD flags,LONG x,LONG y,DWORD data=0) {
+    INPUT input{};
+    input.type=INPUT_MOUSE;
+    input.mi.dx=x;
+    input.mi.dy=y;
+    input.mi.mouseData=data;
+    input.mi.dwFlags=flags;
+    return input;
+}
+
+static INPUT KeyInput(WORD vk,DWORD flags=0) {
+    INPUT input{};
+    input.type=INPUT_KEYBOARD;
+    input.ki.wVk=vk;
+    input.ki.dwFlags=flags;
+    return input;
+}
+
+static INPUT UnicodeInput(wchar_t ch,DWORD flags=0) {
+    INPUT input{};
+    input.type=INPUT_KEYBOARD;
+    input.ki.wScan=static_cast<WORD>(ch);
+    input.ki.dwFlags=KEYEVENTF_UNICODE|flags;
+    return input;
+}
+
+static bool SendExact(const std::vector<INPUT>& inputs,size_t& sent,std::string& reason) {
+    size_t offset=0u;
+    while (offset<inputs.size()) {
+        const size_t remaining=inputs.size()-offset;
+        const UINT batch=static_cast<UINT>(remaining>512u?512u:remaining);
+        const UINT result=SendInput(batch,const_cast<INPUT*>(inputs.data()+offset),sizeof(INPUT));
+        if (result!=batch) {
+            sent+=result;
+            std::ostringstream out; out<<"SendInput partial result "<<result<<"/"<<batch<<" error="<<GetLastError();
+            reason=out.str(); return false;
+        }
+        sent+=result; offset+=batch;
+    }
+    return true;
+}
+
+static bool BuildInputs(const Request& request,std::vector<INPUT>& inputs,std::string& reason) {
+    const bool pointer=request.kind=="pointer_move" || request.kind=="click_primary" || request.kind=="click_secondary" ||
+        request.kind=="double_click_primary" || request.kind=="scroll";
+    LONG nx=0,ny=0;
+    if (pointer) {
+        nx=NormalizeAbsolute(request.x,request.left,request.width);
+        ny=NormalizeAbsolute(request.y,request.top,request.height);
+        inputs.push_back(MouseInput(MOUSEEVENTF_MOVE|MOUSEEVENTF_ABSOLUTE|MOUSEEVENTF_VIRTUALDESK,nx,ny));
+    }
+    if (request.kind=="click_primary") {
+        inputs.push_back(MouseInput(MOUSEEVENTF_LEFTDOWN,0,0));
+        inputs.push_back(MouseInput(MOUSEEVENTF_LEFTUP,0,0));
+    } else if (request.kind=="click_secondary") {
+        inputs.push_back(MouseInput(MOUSEEVENTF_RIGHTDOWN,0,0));
+        inputs.push_back(MouseInput(MOUSEEVENTF_RIGHTUP,0,0));
+    } else if (request.kind=="double_click_primary") {
+        for (int i=0;i<2;i++) {
+            inputs.push_back(MouseInput(MOUSEEVENTF_LEFTDOWN,0,0));
+            inputs.push_back(MouseInput(MOUSEEVENTF_LEFTUP,0,0));
+        }
+    } else if (request.kind=="scroll") {
+        inputs.push_back(MouseInput(MOUSEEVENTF_WHEEL,0,0,static_cast<DWORD>(request.scrollDelta)));
+    } else if (request.kind=="key_chord") {
+        for (const auto& key:request.keys) inputs.push_back(KeyInput(VirtualKey(key)));
+        for (auto it=request.keys.rbegin();it!=request.keys.rend();++it) inputs.push_back(KeyInput(VirtualKey(*it),KEYEVENTF_KEYUP));
+    } else if (request.kind=="text_input") {
+        if (request.textUtf8.size()>static_cast<size_t>(INT_MAX)) { reason="text too large"; return false; }
+        const int needed=MultiByteToWideChar(CP_UTF8,MB_ERR_INVALID_CHARS,request.textUtf8.data(),static_cast<int>(request.textUtf8.size()),nullptr,0);
+        if (needed<=0) { reason="text UTF-8 invalid"; return false; }
+        std::wstring wide(static_cast<size_t>(needed),L'\0');
+        if (MultiByteToWideChar(CP_UTF8,MB_ERR_INVALID_CHARS,request.textUtf8.data(),static_cast<int>(request.textUtf8.size()),wide.data(),needed)!=needed) {
+            reason="text UTF-8 conversion failed"; return false;
+        }
+        if (std::find(wide.begin(),wide.end(),L'\0')!=wide.end()) { reason="text contains NUL"; return false; }
+        if (wide.size()>32768u) { reason="text UTF-16 event bound exceeded"; return false; }
+        inputs.reserve(wide.size()*2u);
+        for (wchar_t ch:wide) {
+            inputs.push_back(UnicodeInput(ch));
+            inputs.push_back(UnicodeInput(ch,KEYEVENTF_KEYUP));
+        }
+    }
+    if (inputs.empty() || inputs.size()>65536u) { reason="input event count invalid"; return false; }
+    return true;
+}
+
+static int SelfTest() {
+    if (VirtualKey("A")!='A' || VirtualKey("F12")!=VK_F12 || VirtualKey("CTRL")!=VK_CONTROL || VirtualKey("NOPE")!=0) return 31;
+    if (NormalizeAbsolute(-1920,-1920,3840)!=0) return 32;
+    if (NormalizeAbsolute(1919,-1920,3840)!=65535) return 33;
+    std::printf("{\"schema\":\"deadbyte.desktop-native-input-selftest.v1\",\"status\":\"passed\"}\n");
+    return 0;
+}
+
+int wmain(int argc,wchar_t** argv) {
+    SetProcessDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2);
+    if (argc==2 && std::wstring(argv[1])==L"--selftest") return SelfTest();
+    if (argc!=1) {
+        std::fprintf(stderr,"deadbyte-desktop-input: arguments are not accepted\n");
+        return 2;
+    }
+
+    std::string bytes;
+    if (!ReadAllStdin(bytes)) {
+        std::fprintf(stderr,"deadbyte-desktop-input: request read failed or exceeded bound\n");
+        return 10;
+    }
+    Request request;
+    std::string reason;
+    if (!ParseRequest(bytes,request,reason)) {
+        std::fprintf(stderr,"deadbyte-desktop-input: request rejected: %s\n",reason.c_str());
+        return 11;
+    }
+
+    std::string currentDesktop;
+    HWND foreground=nullptr;
+    DWORD foregroundPid=0;
+    if (!ValidateEnvironment(request,currentDesktop,foreground,foregroundPid,reason)) {
+        std::fprintf(stderr,"deadbyte-desktop-input: environment rejected: %s\n",reason.c_str());
+        return 12;
+    }
+
+    std::vector<INPUT> inputs;
+    if (!BuildInputs(request,inputs,reason)) {
+        std::fprintf(stderr,"deadbyte-desktop-input: input build rejected: %s\n",reason.c_str());
+        return 13;
+    }
+
+    size_t sent=0u;
+    if (!SendExact(inputs,sent,reason)) {
+        std::fprintf(stderr,"deadbyte-desktop-input: injection failed after %zu events: %s\n",sent,reason.c_str());
+        return 14;
+    }
+
+    std::printf("{\"schema\":\"deadbyte.desktop-native-input.v1\",\"injected\":true,\"backend\":\"win32-sendinput\","
+        "\"action_sha256\":\"%s\",\"kind\":\"%s\",\"event_count\":%zu,\"input_desktop\":\"%s\","
+        "\"foreground_hwnd\":\"%s\",\"foreground_pid\":%lu}\n",
+        request.actionSha256.c_str(),request.kind.c_str(),sent,JsonEscape(currentDesktop).c_str(),
+        HwndHex(foreground).c_str(),static_cast<unsigned long>(foregroundPid));
+    return 0;
+}