deadbyte-mcp 0.15.24 → 0.15.26

package/src/desktop-mcp-tools-r40.mjs

@@ -33,6 +33,19 @@ const explicitTargetFields={
   confidence:z.number().min(0).max(1),semantic_label_sha256:hex64.nullable().default(null)
 };
 const uiaTargetFields={frame_id:hex64,uia_query:uiaQuery};
+const waitFields={
+  baseline_frame_id:hex64,
+  until:z.enum(['frame_changed','topology_changed','foreground_changed','uia_present','uia_absent']),
+  uia_query:uiaQuery.nullable().default(null),timeout_ms:z.number().int().min(100).max(30000).default(5000),
+  poll_ms:z.number().int().min(50).max(1000).default(100),preview:z.boolean().default(false)
+};
+function validateWait(value,ctx){
+  const needsQuery=value.until==='uia_present'||value.until==='uia_absent';
+  if(needsQuery&&value.uia_query===null)ctx.addIssue({code:'custom',path:['uia_query'],message:'UIA wait requires uia_query'});
+  if(!needsQuery&&value.uia_query!==null)ctx.addIssue({code:'custom',path:['uia_query'],message:'non-UIA wait cannot carry uia_query'});
+  if(value.poll_ms>value.timeout_ms)ctx.addIssue({code:'custom',path:['poll_ms'],message:'poll_ms cannot exceed timeout_ms'});
+}
+export const desktopWaitInputSchema=z.strictObject(waitFields).superRefine(validateWait);
 export const desktopTargetInputSchema=z.union([
   z.strictObject(explicitTargetFields),z.strictObject(uiaTargetFields)
 ]);
@@ -61,12 +74,13 @@ export const desktopActionInputSchema=z.strictObject(actionFields).superRefine(v
 
 const statusOp=z.strictObject({op:z.literal('status')});
 const observeOp=z.strictObject({op:z.literal('observe'),preview:z.boolean().default(false)});
+const waitOp=z.strictObject({op:z.literal('wait'),...waitFields}).superRefine(validateWait);
 const targetOp=z.union([
   z.strictObject({op:z.literal('target'),...explicitTargetFields}),
   z.strictObject({op:z.literal('target'),...uiaTargetFields})
 ]);
 const actionOp=z.strictObject({op:z.literal('action'),...actionFields}).superRefine(validateAction);
-export const desktopControlInputSchema=z.union([statusOp,observeOp,targetOp,actionOp]);
+export const desktopControlInputSchema=z.union([statusOp,observeOp,waitOp,targetOp,actionOp]);
 
 const sha256=value=>createHash('sha256').update(value).digest('hex');
 function publicResult(value){
@@ -89,6 +103,10 @@ export async function invokeDesktopOperation(args,runtime){
     let value;
     if(op==='status') value=await runtime.status();
     else if(op==='observe') value=await runtime.observe({preview:args.preview??false});
+    else if(op==='wait') value=await runtime.wait({
+      baselineFrameId:args.baseline_frame_id,until:args.until,query:args.uia_query,
+      timeoutMs:args.timeout_ms,pollMs:args.poll_ms,preview:args.preview
+    });
     else if(op==='target'&&args.uia_query) value=await runtime.ground({frameId:args.frame_id,query:args.uia_query});
     else if(op==='target') value=await runtime.target({
       frameId:args.frame_id,rect:args.rect,source:args.source,confidence:args.confidence,
@@ -115,6 +133,10 @@ export function registerDesktopTools(server,{runtime}={}){
     description:'Capture one bounded Windows desktop frame and signed observation evidence. Observation does not require Desktop mutation authority.',
     inputSchema:desktopObserveInputSchema,outputSchema:compactGatewayOutputSchema
   },args=>invokeDesktopOperation({op:'observe',...args},runtime));
+  server.registerTool('desktop_wait',{
+    description:'Wait for one bounded desktop or local UIA condition using fresh observations. This is read-only, returns signed final evidence, and never dispatches or retries an action.',
+    inputSchema:desktopWaitInputSchema,outputSchema:compactGatewayOutputSchema
+  },args=>invokeDesktopOperation({op:'wait',...args},runtime));
   server.registerTool('desktop_target',{
     description:'Bind one explicit rectangle or one local Windows UIA query to fresh desktop evidence. UIA query text is matched locally and is not returned.',
     inputSchema:desktopTargetInputSchema,outputSchema:compactGatewayOutputSchema

package/src/desktop-runtime-r40.mjs

@@ -71,13 +71,14 @@ export function verifyDesktopReceiptObject(receipt,{policySha256,publicKey,keyId
 
 export function createDesktopRuntime({
   policy,observerRuntime,inputProvider,grounderProvider=null,privateKey,publicKey=null,keyId,evidenceDir=policy?.evidence_dir,
-  now=()=>new Date().toISOString(),maxTargets=64
+  now=()=>new Date().toISOString(),clockMs=()=>Date.now(),sleeper=ms=>new Promise(resolve=>setTimeout(resolve,ms)),maxTargets=64
 }={}){
   insist(policy?.schema===DESKTOP_POLICY_SCHEMA,'desktop runtime policy invalid');
   insist(observerRuntime?.capture&&observerRuntime?.frameStatus,'desktop runtime observer invalid');
   insist(typeof inputProvider==='function','desktop runtime inputProvider required');
   insist(privateKey,'desktop runtime privateKey required');
   insist(typeof keyId==='string'&&keyId.length>=1,'desktop runtime keyId invalid');
+  insist(typeof clockMs==='function'&&typeof sleeper==='function','desktop wait clock invalid');
   insist(Number.isInteger(maxTargets)&&maxTargets>=1&&maxTargets<=1024,'maxTargets invalid');
   const receiptPublicKey=publicKey??createPublicKey(privateKey);
   const targets=new Map();
@@ -118,6 +119,49 @@ export function createDesktopRuntime({
     },observed.frame.observed_at_utc);
     return Object.freeze({...observed,...(previewValue?{preview:previewValue}:{}),receipt_id:evidence.receipt_id,receipt_sha256:evidence.receipt_sha256});
   }
+  async function wait({baselineFrameId,until,query=null,timeoutMs=5000,pollMs=100,preview=false}={}){
+    insist(HEX64.test(baselineFrameId??''),'desktop wait baseline frame invalid');
+    insist(['frame_changed','topology_changed','foreground_changed','uia_present','uia_absent'].includes(until),'desktop wait condition invalid');
+    insist(Number.isInteger(timeoutMs)&&timeoutMs>=100&&timeoutMs<=30000,'desktop wait timeout invalid');
+    insist(Number.isInteger(pollMs)&&pollMs>=50&&pollMs<=1000&&pollMs<=timeoutMs,'desktop wait poll invalid');
+    insist(typeof preview==='boolean','desktop wait preview invalid');
+    const needsQuery=until==='uia_present'||until==='uia_absent';
+    insist(needsQuery?query&&typeof grounderProvider==='function':query===null,'desktop wait query invalid');
+    const baseline=observerRuntime.frameStatus(baselineFrameId).frame;
+    const started=clockMs();
+    insist(Number.isFinite(started),'desktop wait clock result invalid');
+    let attempts=0,observed=null,match=null,satisfied=false;
+    while(true){
+      observed=await observerRuntime.capture();attempts++;
+      if(until==='frame_changed')satisfied=observed.frame.image_sha256!==baseline.image_sha256;
+      else if(until==='topology_changed')satisfied=observed.frame.topology_sha256!==baseline.topology_sha256;
+      else if(until==='foreground_changed')satisfied=!sameWindow(observed.frame.active_window,baseline.active_window);
+      else{
+        const grounded=await grounderProvider({frame:observed.frame,query});
+        insist(grounded&&grounded.status==='ok'&&HEX64.test(grounded.query_sha256??''),'desktop wait UIA result invalid');
+        const candidate=grounded.matches?.[grounded.ordinal??0]??null;
+        const actionable=Boolean(candidate?.enabled===true&&!candidate?.offscreen);
+        match=Object.freeze({query_sha256:grounded.query_sha256,query_kind:grounded.query_kind,
+          match_count:Array.isArray(grounded.matches)?grounded.matches.length:0,actionable,
+          visited:grounded.visited,truncated:grounded.truncated,provider_receipt_sha256:grounded.provider_receipt_sha256});
+        satisfied=until==='uia_present'?actionable:!actionable;
+      }
+      const elapsed=Math.max(0,clockMs()-started);
+      if(satisfied||elapsed>=timeoutMs)break;
+      await sleeper(Math.min(pollMs,timeoutMs-elapsed));
+    }
+    const elapsedMs=Math.max(0,clockMs()-started);
+    const previewValue=preview?observerRuntime.framePreview?.(observed.frame.frame_id,{maxBytes:policy.limits.max_preview_bytes}):null;
+    if(preview)insist(previewValue?.schema==='deadbyte.desktop-preview.v1','desktop preview unavailable');
+    const payload={condition:until,satisfied,attempts,elapsed_ms:elapsedMs,baseline_frame_id:baseline.frame_id,
+      frame_id:observed.frame.frame_id,desktop_epoch:observed.frame.desktop_epoch,topology_sha256:observed.frame.topology_sha256,
+      image_sha256:observed.frame.image_sha256,observed_at_utc:observed.frame.observed_at_utc,active_window:observed.frame.active_window,
+      match,preview:previewValue?{sha256:previewValue.sha256,byte_length:previewValue.byte_length,width:previewValue.width,height:previewValue.height,encoding:previewValue.encoding}:null};
+    const evidence=await receipt('desktop_wait_observation',payload,observed.frame.observed_at_utc);
+    return Object.freeze({status:'ok',condition:until,satisfied,timed_out:!satisfied,attempts,elapsed_ms:elapsedMs,
+      baseline_frame_id:baseline.frame_id,frame:observed.frame,match,...(previewValue?{preview:previewValue}:{}),
+      receipt_id:evidence.receipt_id,receipt_sha256:evidence.receipt_sha256});
+  }
   function targetFor(targetId){
     insist(HEX64.test(targetId??''),'targetId invalid');
     const found=targets.get(targetId);if(!found)throw new Error('desktop target expired or unknown');return found;
@@ -314,5 +358,5 @@ export function createDesktopRuntime({
       throw wrapped;
     }
   }
-  return Object.freeze({status,observe,target,ground,action,verifyReceipt});
+  return Object.freeze({status,observe,wait,target,ground,action,verifyReceipt});
 }

package/src/machine-fs-smoke-client.mjs

@@ -8,6 +8,7 @@ import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotoc
 import { CODING_GRANT_SCHEMA, loadCodingPolicy } from './coding-plane.mjs';
 import { verifyMachineFsReceiptFile } from './machine-fs.mjs';
 import { generateTrustKeypair } from './trust.mjs';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, '..');
@@ -51,24 +52,13 @@ const client = new Client({ name: 'deadbyte-machine-fs-smoke', version: '0.8.0'
 const transport = new StdioClientTransport({
   command: process.execPath, args: [serverPath], cwd: repoRoot,
   env: { ...getDefaultEnvironment(), DEADBYTE_CODING_RUNTIME: '1', DEADBYTE_MACHINE_FS_RUNTIME: '1',
+    DEADBYTE_PRIVILEGED_POLICY: '',
     DEADBYTE_CODING_POLICY: policyPath, DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
     DEADBYTE_VERIFY_KEY: keys.publicKeyPath }, stderr: 'pipe'
 });
 const stderrChunks = [];
 transport.stderr?.on('data', chunk => stderrChunks.push(Buffer.from(chunk)));
-const baseTools = ['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
-const codingTools = [
-  'coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read',
-  'coding_receipt_verify','coding_search','coding_session_status','coding_stat',
-  'coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',
-  'coding_task_approve','coding_task_cancel','coding_task_events','coding_task_run',
-  'coding_task_status','coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'
-];
-const machineFsTools = [
-  'machine_fs_delete','machine_fs_edit_exact','machine_fs_list','machine_fs_mkdir',
-  'machine_fs_move','machine_fs_read','machine_fs_stat','machine_fs_write'
-];
-const expectedCatalog = [...baseTools, ...codingTools, ...machineFsTools].sort();
+const expectedCatalog = await expectedFullCatalogForEnv({DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_MACHINE_FS_RUNTIME:'1'});
 const receipts = [];
 const remember = (operation, result) => {
   if (result.status !== 'committed' || !/^[0-9a-f]{24}$/.test(result.receipt_id ?? '')) throw new Error(`${operation} missing committed receipt`);
@@ -79,10 +69,9 @@ try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
-  if (JSON.stringify(names) !== JSON.stringify(expectedCatalog)) throw new Error(`machine fs smoke catalog mismatch: ${JSON.stringify(names)}`);
-  for (const tool of listed.tools) {
-    if (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false) throw new Error(`tool ${tool.name} missing strict output schema`);
-  }
+  assertExactCatalog(names,expectedCatalog,'machine fs smoke');
+  for (const tool of listed.tools) if (tool.outputSchema !== undefined &&
+      (tool.outputSchema?.type !== 'object' || tool.outputSchema?.additionalProperties !== false)) throw new Error(`tool ${tool.name} has non-strict output schema`);
   const rootStat = structured(await client.callTool({ name:'machine_fs_stat', arguments:{ root_id:'core', path:'.', hash:false } }), 'machine_fs_stat(root)');
   if (rootStat.status !== 'ok' || rootStat.kind !== 'directory') throw new Error('machine fs root stat malformed');
   const made = remember('machine_fs_mkdir', structured(await client.callTool({

package/src/mcp-host-smoke-client.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
 import { generateTrustKeypair } from './trust.mjs';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -84,8 +85,8 @@ function structured(result, label) {
 try {
   await client.connect(transport);
   const names = (await client.listTools()).tools.map(t => t.name).sort();
-  const expected = ['contained_transform', 'evidence_verify', 'file_read', 'host_exec', 'host_file_read', 'host_file_write', 'proof_execute', 'skill_catalog', 'workspace_open'];
-  if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`privileged catalog mismatch: ${JSON.stringify(names)}`);
+  const expected = await expectedFullCatalogForEnv({DEADBYTE_PRIVILEGED_POLICY:policyPath});
+  assertExactCatalog(names,expected,'privileged smoke');
 
   const writeText = structured(await client.callTool({
     name: 'host_file_write',

package/src/mcp-smoke-client.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
 import { generateTrustKeypair } from './trust.mjs';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, '..');
@@ -39,6 +40,7 @@ const transport = new StdioClientTransport({
     DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
     DEADBYTE_SIGNING_KEY: keys.privateKeyPath,
     DEADBYTE_VERIFY_KEY: keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY: '',
     DEADBYTE_STDIO_CONSOLE_GUARD_PROBE: '1'
   },
   stderr: 'pipe'
@@ -67,15 +69,8 @@ try {
   const names = listed.tools.map(tool => tool.name).sort();
   const guardStderr = Buffer.concat(serverStderr).toString('utf8');
   if (!guardStderr.includes('DEADBYTE MCP LOG DEADBYTE_STDIO_CONSOLE_GUARD_PROBE')) throw new Error('stdio console guard probe did not reach stderr');
-  const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
-  const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
-  const allowedCatalogs = [
-    baseTools,
-    [...baseTools, ...privilegedTools]
-  ].map(items => [...items].sort());
-  if (!allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected))) {
-    throw new Error(`tool catalog mismatch: ${JSON.stringify(names)}`);
-  }
+  const expected=await expectedFullCatalogForEnv({});
+  assertExactCatalog(names,expected,'MCP smoke');
 
   const opened = structured(await client.callTool({
     name: 'workspace_open',

package/src/observation-smoke-client.mjs

@@ -8,6 +8,7 @@ import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotoc
 import { loadCodingPolicy } from './coding-plane.mjs';
 import { verifyObservationReceiptFile } from './observation-runtime.mjs';
 import { generateTrustKeypair } from './trust.mjs';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const here=path.dirname(fileURLToPath(import.meta.url));
 const repoRoot=path.resolve(here,'..');
@@ -49,21 +50,15 @@ const client=new Client({name:'deadbyte-observation-smoke',version:'0.8.0'},
   {versionNegotiation:{mode:{pin:'2026-07-28'}}});
 const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,
   env:{...getDefaultEnvironment(),DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1',
+    DEADBYTE_PRIVILEGED_POLICY:'',
     DEADBYTE_CODING_POLICY:policyPath,DEADBYTE_STATE_ROOT:state,DEADBYTE_SIGNING_KEY:keys.privateKeyPath,DEADBYTE_VERIFY_KEY:keys.publicKeyPath},stderr:'pipe'});
 const stderr=[]; transport.stderr?.on('data',chunk=>stderr.push(Buffer.from(chunk)));
-const base=['contained_transform','evidence_verify','file_read','host_exec','host_file_read','host_file_write','proof_execute','skill_catalog','workspace_open'];
-const machine=['machine_list','machine_ping','machine_revoke','machine_status'];
-const coding=['coding_benchmark_run','coding_command_run','coding_file_read','coding_file_write','coding_files_read','coding_receipt_verify','coding_search',
-  'coding_session_status','coding_stat','coding_symbol_definition','coding_symbol_diagnostics','coding_symbol_implementations','coding_symbol_outline','coding_symbol_references','coding_symbol_rename_preview','coding_symbol_replace',
-  'coding_task_approve','coding_task_cancel','coding_task_events','coding_task_run','coding_task_status',
-  'coding_task_submit','coding_task_verify','coding_text_replace','coding_tree'];
-const observation=['machine_hardware_query','machine_process_list','machine_search_cancel','machine_search_page','machine_search_start','machine_search_status','machine_system_status'];
-const expected=[...base,...machine,...coding,...observation].sort();
+const expected=await expectedFullCatalogForEnv({DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_CODING_RUNTIME:'1',DEADBYTE_OBSERVATION_RUNTIME:'1'});
 try{
   await client.connect(transport);
   const listed=await client.listTools(); const names=listed.tools.map(tool=>tool.name).sort();
-  if(JSON.stringify(names)!==JSON.stringify(expected)) throw new Error(`observation smoke catalog mismatch: ${JSON.stringify(names)}`);
-  for(const tool of listed.tools) if(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false) throw new Error(`tool ${tool.name} missing strict output schema`);
+  assertExactCatalog(names,expected,'observation smoke');
+  for(const tool of listed.tools) if(tool.outputSchema!==undefined&&(tool.outputSchema?.type!=='object'||tool.outputSchema?.additionalProperties!==false)) throw new Error(`tool ${tool.name} has non-strict output schema`);
   const codingStatus=structured(await client.callTool({name:'coding_session_status',arguments:{}}),'coding_session_status');
   if(codingStatus.status!=='ok'||codingStatus.armed!==false) throw new Error('observation smoke requires coding mutation authority disarmed');
   const system=structured(await client.callTool({name:'machine_system_status',arguments:{}}),'machine_system_status');

package/src/process-smoke-client.mjs

@@ -8,6 +8,7 @@ import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotoc
 import { canonicalJson } from './canonical-json.mjs';
 import { loadProcessPolicy, PROCESS_GRANT_SCHEMA } from './process-policy.mjs';
 import { generateTrustKeypair, loadPublicVerifyKey } from './trust.mjs';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const EVENT_DOMAIN = Buffer.from('DEADBYTE-PROCESS-EVENT-V1\0', 'utf8');
 const ZERO_SHA256 = '0'.repeat(64);
@@ -58,9 +59,8 @@ try {
   await client.connect(transport);
   const listed = await client.listTools();
   const names = listed.tools.map(tool => tool.name).sort();
-  const expected = ['contained_transform','evidence_verify','file_read','proof_execute','skill_catalog','workspace_open',
-    'process_session_action','process_session_cancel','process_session_list','process_session_read','process_session_start','process_session_status','process_session_terminate','process_session_write'].sort();
-  if (JSON.stringify(names) !== JSON.stringify(expected)) throw new Error(`process smoke catalog mismatch: ${JSON.stringify(names)}`);
+  const expected = await expectedFullCatalogForEnv({DEADBYTE_PROCESS_RUNTIME:'1'});
+  assertExactCatalog(names,expected,'process smoke');
   const started = structured(await client.callTool({ name: 'process_session_start', arguments: {
     profile_id: 'ping_hold', root_id: 'core', cwd: '.', args: []
   } }), 'process_session_start');

package/src/remote-mcp-smoke-client.mjs

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';
+import { verifyMachinePingPublic } from './machine-identity.mjs';
 
 const endpointText = process.argv[2];
 const mode = process.argv[3] ?? 'smoke';
@@ -151,6 +152,11 @@ try {
         ping.release_id !== machine.release_id || ping.release_manifest_sha256 !== machine.release_manifest_sha256) {
       throw new Error('compact machine ping binding mismatch');
     }
+    const pingSignatureValid = await verifyMachinePingPublic({
+      ping,
+      publicKeySpkiBase64: machine.public_key_spki_base64
+    });
+    if (!pingSignatureValid) throw new Error('machine ping public Ed25519 verification failed');
     compact = {
       profile: 'compact',
       ledger_sha256: manifest.ledger_sha256,
@@ -160,7 +166,7 @@ try {
       machine_id: machine.machine_id,
       release_id: machine.release_id,
       release_manifest_sha256: machine.release_manifest_sha256,
-      ping_signature_valid: ping.signature_valid === true
+      ping_signature_valid: true
     };
   } else {
     const opened = structured(await client.callTool({ name: 'workspace_open', arguments: { workspace_id: 'demo' } }), 'workspace_open');

package/src/runtime-catalog-expectation.mjs

@@ -0,0 +1,45 @@
+import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { R36_CAPABILITY_LEDGER } from './capability-ledger.mjs';
+
+const packageRoot=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const catalogPath=path.join(packageRoot,'docs','R48-FULL-TOOL-CATALOG.json');
+const overlayPath=path.join(packageRoot,'docs','R49-FULL-TOOL-CATALOG.json');
+const AGENT_TOOLS=new Set(['agent_task_approve','agent_task_cancel','agent_task_events','agent_task_run','agent_task_status','agent_task_submit','agent_task_verify']);
+
+export async function expectedFullCatalogForEnv(env){
+  const canonical=JSON.parse(await readFile(catalogPath,'utf8'));
+  if(canonical.schema!=='deadbyte.r48-full-catalog.v1'||canonical.tool_count!==canonical.tools?.length) throw new Error('canonical R48 full catalog is invalid');
+  const overlay=JSON.parse(await readFile(overlayPath,'utf8'));
+  const baseSha=createHash('sha256').update(await readFile(catalogPath)).digest('hex');
+  if(overlay.schema!=='deadbyte.r49-full-catalog-overlay.v1'||overlay.base?.sha256!==baseSha||overlay.base?.tool_count!==canonical.tool_count||
+    overlay.tool_count!==canonical.tool_count+overlay.additions.length-overlay.removals.length) throw new Error('canonical R49 full catalog overlay is invalid');
+  const full=[...new Set([...canonical.tools.filter(name=>!overlay.removals.includes(name)),...overlay.additions])].sort((a,b)=>a.localeCompare(b,'en'));
+  if(full.length!==overlay.tool_count) throw new Error('canonical R49 full catalog count mismatch');
+  const disabled=new Set();
+  for(const capability of R36_CAPABILITY_LEDGER.entries){
+    const flag=capability.runtime_flag;
+    const enabled=flag===null||(flag==='DEADBYTE_PRIVILEGED_POLICY'?Boolean(env[flag]):env[flag]==='1');
+    if(!enabled) disabled.add(capability.full_tool);
+  }
+  // The rename preview tool is registered by the coding surface even when its
+  // optional Native Diff backend is absent; only the apply path needs Autonomous.
+  if(env.DEADBYTE_CODING_RUNTIME==='1') disabled.delete('coding_symbol_rename_preview');
+  if(env.DEADBYTE_AGENT_RUNTIME!=='1') for(const name of AGENT_TOOLS) disabled.add(name);
+  if(env.DEADBYTE_PROCESS_RUNTIME!=='1') disabled.add('process_session_cancel');
+  return full.filter(name=>!disabled.has(name));
+}
+
+export function assertExactCatalog(actual,expected,label='MCP'){
+  const names=[...actual].sort((a,b)=>a.localeCompare(b,'en'));
+  const wanted=[...expected].sort((a,b)=>a.localeCompare(b,'en'));
+  if(JSON.stringify(names)!==JSON.stringify(wanted)){
+    const actualSet=new Set(names); const expectedSet=new Set(wanted);
+    const missing=wanted.filter(name=>!actualSet.has(name));
+    const unexpected=names.filter(name=>!expectedSet.has(name));
+    throw new Error(`${label} catalog mismatch: missing=${JSON.stringify(missing)} unexpected=${JSON.stringify(unexpected)}`);
+  }
+  return names;
+}

package/src/tunnel-stdio-compat-smoke.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { Client } from '@modelcontextprotocol/client';
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { assertExactCatalog, expectedFullCatalogForEnv } from './runtime-catalog-expectation.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, '..');
@@ -11,6 +12,7 @@ const workspaceRoot = path.join(repoRoot, 'workspaces');
 const baseEnv = {
   ...process.env,
   DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+  DEADBYTE_PRIVILEGED_POLICY: '',
   DEADBYTE_TUNNEL_STDIO_PROBE_COMPAT: '1'
 };
 
@@ -100,6 +102,7 @@ async function modernPassThrough() {
     env: {
       ...getDefaultEnvironment(),
       DEADBYTE_WORKSPACE_ROOT: workspaceRoot,
+      DEADBYTE_PRIVILEGED_POLICY: '',
       DEADBYTE_TUNNEL_STDIO_PROBE_COMPAT: '1'
     },
     stderr: 'pipe'
@@ -112,15 +115,8 @@ async function modernPassThrough() {
     if (era !== 'modern') throw new Error(`expected modern era through compat prefilter, got ${String(era)}`);
     const listed = await client.listTools();
     const names = listed.tools.map(tool => tool.name).sort();
-    const baseTools = ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'skill_catalog', 'workspace_open'];
-    const privilegedTools = ['host_exec', 'host_file_read', 'host_file_write'];
-    const allowedCatalogs = [
-      baseTools,
-      [...baseTools, ...privilegedTools]
-    ].map(items => [...items].sort());
-    if (!allowedCatalogs.some(expected => JSON.stringify(names) === JSON.stringify(expected))) {
-      throw new Error(`modern catalog changed through compat prefilter: ${JSON.stringify(names)}`);
-    }
+    const expected=await expectedFullCatalogForEnv({});
+    assertExactCatalog(names,expected,'modern tunnel compatibility');
     return { protocol_revision: '2026-07-28', protocol_era: era, tools: names };
   } catch (error) {
     const stderr = Buffer.concat(serverStderr).toString('utf8').trim();

package/src/version.mjs

@@ -1,4 +1,4 @@
-export const DEADBYTE_VERSION = '0.15.24';
+export const DEADBYTE_VERSION = '0.15.26';
 export const MCP_PROTOCOL_VERSION = '2026-07-28';
 export const RECEIPT_SCHEMA_V1 = 'deadbyte.receipt.v1';
 export const RECEIPT_SCHEMA_V2 = 'deadbyte.receipt.v2';

package/test/autonomous-desktop-r40.test.mjs

@@ -11,7 +11,7 @@ const POLICY=H('desktop-policy');
 const WIN={hwnd:'0x1234',pid:77,process_image_sha256:H('desktop-app'),title_sha256:H('desktop-title')};
 
 function fakeDesktopRuntime({armed=false,unknown=false}={}){
-  const calls={status:0,observe:0,ground:0,action:0,verify:0};
+  const calls={status:0,observe:0,wait:0,ground:0,action:0,verify:0};
   const receipts=new Map();
   let seq=0;
   const issue=kind=>{
@@ -28,6 +28,9 @@ function fakeDesktopRuntime({armed=false,unknown=false}={}){
     async status(){calls.status++;return {status:'ok',configured:true,armed,reason:armed?'standing-grant':'disarmed',
       action_kinds:armed?['click_primary']:[],policy_sha256:POLICY,observer_backend:'fake'};},
     async observe(){calls.observe++;const r=issue('desktop_observation');return {status:'ok',frame:frame(FRAME),backend:'fake',byte_length:4,...r};},
+    async wait({baselineFrameId,until}){calls.wait++;assert.equal(baselineFrameId,FRAME);assert.equal(until,'frame_changed');
+      const r=issue('desktop_wait_observation');return {status:'ok',condition:until,satisfied:true,timed_out:false,attempts:2,elapsed_ms:100,
+        baseline_frame_id:FRAME,frame:frame(GROUNDED_FRAME),match:null,...r};},
     async ground({frameId,query}){calls.ground++;assert.equal(frameId,FRAME);assert.equal(query.kind,'root');
       const r=issue('desktop_grounding');return {status:'ok',frame:frame(GROUNDED_FRAME),
         target:{target_id:TARGET,frame_id:GROUNDED_FRAME,rect:{left:100,top:100,width:200,height:80},source:'uia'},
@@ -99,6 +102,29 @@ test('T7 read-only Desktop observe works while Desktop mutation authority is DIS
   }finally{await f.cleanup();}
 });
 
+test('successor autonomous Desktop wait replaces fixed sleep and verifies signed observation evidence',async()=>{
+  const d=fakeDesktopRuntime({armed:false});
+  const f=await createR34Fixture({desktopRuntime:d});
+  try{
+    const goal=await f.runtime.submit({submissionId:'desktop-bounded-wait',rootId:'project',title:'desktop wait',goal:'wait for visual change',acceptance:'signed bounded wait'});
+    let result=await f.runtime.run({goalId:goal.goal_id,maxCycles:2});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,plan(['observe','wait']));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{kind:'desktop_observe'}});
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,complete('observe','wait-observe-proof'));
+    result=await toAct(f,goal,result);
+    result=await sendPlannerDecision(f.runtime,goal.goal_id,result,{schema:'deadbyte.autonomous-decision.v2',kind:'act',action:{
+      kind:'desktop_wait',baseline_frame_id:FRAME,until:'frame_changed',uia_query:null,timeout_ms:1000,poll_ms:100
+    }});
+    assert.equal(result.loop.phase,'VERIFYING');
+    assert.equal(d.calls.wait,1);assert.equal(d.calls.action,0);assert.equal(d.calls.verify,2);
+    const journal=await f.runtime.events({goalId:goal.goal_id,fromSeq:1,limit:200});
+    const completed=journal.events.find(e=>e.type==='delegated_action_completed'&&e.payload?.operation?.kind==='desktop_wait');
+    assert.equal(completed.payload.capability_id,'desktop.wait');
+    assert.equal(completed.payload.evidence.receipts[0].kind,'desktop_wait_observation');
+  }finally{await f.cleanup();}
+});
+
 test('T7 Autonomous authority cannot substitute for missing Desktop mutation grant',async()=>{
   const d=fakeDesktopRuntime({armed:false});
   const f=await createR34Fixture({desktopRuntime:d});

package/test/coding-catalog-consistency.test.mjs

@@ -16,9 +16,17 @@ function extract(source){
   assert.ok(m,'coding catalog array missing');
   return [...m[1].matchAll(/'([^']+)'/g)].map(x=>x[1]).sort();
 }
-for(const rel of ['src/machine-fs-smoke-client.mjs','src/observation-smoke-client.mjs','src/remote-mcp-coding-smoke-client.mjs','src/remote-mcp-smoke-client.mjs']){
+for(const rel of ['src/remote-mcp-coding-smoke-client.mjs','src/remote-mcp-smoke-client.mjs']){
   test(`${rel} uses the exact R36 25-tool coding catalog`,async()=>{
     const source=await readFile(path.join(root,...rel.split('/')),'utf8');
     assert.deepEqual(extract(source),expected);
   });
 }
+for(const rel of ['src/machine-fs-smoke-client.mjs','src/observation-smoke-client.mjs']){
+  test(`${rel} derives its exact R48 catalog from the canonical runtime catalog`,async()=>{
+    const source=await readFile(path.join(root,...rel.split('/')),'utf8');
+    assert.match(source,/expectedFullCatalogForEnv/);
+    assert.match(source,/assertExactCatalog/);
+    assert.doesNotMatch(source,/const (?:codingTools|coding)\s*=\s*\[/);
+  });
+}

package/test/commander-real-parity-r47.test.mjs

@@ -73,13 +73,14 @@ test('real Commander-parity filesystem lifecycle is transactional and signed',as
 
 test('real Commander adapter preserves PowerShell command bytes through the bounded REPL', {skip:process.platform!=='win32'}, async()=>{
   const f=await processFixture();
+  let adapter=null,pid=null;
   try{
-    const adapter=createCommanderWireAdapter({processRuntime:f.runtime});
+    adapter=createCommanderWireAdapter({processRuntime:f.runtime});
     const command=`[Console]::OutputEncoding=[Text.UTF8Encoding]::new(); $x='a b'; "DB:$x"; 'pipe' | ForEach-Object { "P:$_" }; "U:สวัสดี"`;
     const started=await adapter.handlers.start_process({command,timeout_ms:10000});
-    const pid=started.structuredContent.pid;
+    pid=started.structuredContent.pid;
     let output='';
-    for(let i=0;i<50&&!output.includes('P:pipe');i++){
+    for(let i=0;i<50&&!(output.includes('DB:a b')&&output.includes('P:pipe')&&output.includes('U:สวัสดี'));i++){
       const page=await adapter.handlers.read_process_output({pid,offset:0,length:100,timeout_ms:100});
       output+=page.content[0].text;
     }
@@ -94,7 +95,10 @@ test('real Commander adapter preserves PowerShell command bytes through the boun
     assert.match(largeText,/END/);
     const ended=await adapter.handlers.force_terminate({pid});
     assert.equal(ended.structuredContent.termination.verified,true);
-  }finally{await rm(f.root,{recursive:true,force:true});}
+  }finally{
+    if(adapter&&pid!==null) await adapter.handlers.force_terminate({pid}).catch(()=>{});
+    await rm(f.root,{recursive:true,force:true});
+  }
 });
 
 test('real stale mutation is rejected before commit and leaves source intact',async()=>{

package/test/contained.test.mjs

@@ -456,13 +456,11 @@ test('receipt and verifier bind contained worker, launcher and independent trans
   assert.match(verifier, /contained transform semantic mismatch/);
 });
 
-test('MCP protocol smoke accepts only the base or base-plus-host catalog and excludes agent tools', async () => {
+test('MCP protocol smoke derives the exact full catalog and explicitly disables Host', async () => {
   const smoke = await readFile(fileURLToPath(new URL('../src/mcp-smoke-client.mjs', import.meta.url)), 'utf8');
-  for (const name of ['contained_transform', 'evidence_verify', 'file_read', 'proof_execute', 'workspace_open']) assert.match(smoke, new RegExp(name));
-  for (const name of ['host_exec', 'host_file_read', 'host_file_write']) assert.match(smoke, new RegExp(name));
-  assert.match(smoke, /allowedCatalogs/);
-  assert.match(smoke, /baseTools/);
-  assert.match(smoke, /privilegedTools/);
+  assert.match(smoke, /expectedFullCatalogForEnv/);
+  assert.match(smoke, /assertExactCatalog/);
+  assert.match(smoke, /DEADBYTE_PRIVILEGED_POLICY: ''/);
   assert.doesNotMatch(smoke, /agent_task_/);
 });
 

package/test/controller.test.mjs

@@ -83,7 +83,8 @@ test('controller keeps privileged policy optional and propagates it only to the
 test('Windows host policy bootstrap pins executables and creates only explicit local roots', async () => {
   const init = await readFile(fileURLToPath(new URL('../scripts/init-host-policy.ps1', import.meta.url)), 'utf8');
   assert.match(init, /deadbyte\.host-policy\.v2/);
-  assert.match(init, /Get-FileHash/);
+  assert.match(init, /System\.Security\.Cryptography\.SHA256/);
+  assert.match(init, /System\.IO\.File.*OpenRead/);
   assert.match(init, /powershell_script/);
   assert.match(init, /cmd_script/);
   assert.match(init, /node_script/);

package/test/desktop-mcp-tools-r40.test.mjs

@@ -1,7 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
-  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,registerDesktopTools
+  desktopActionInputSchema,desktopControlInputSchema,desktopTargetInputSchema,desktopWaitInputSchema,registerDesktopTools
 } from '../src/desktop-mcp-tools-r40.mjs';
 
 const H=c=>c.repeat(64);
@@ -30,11 +30,26 @@ test('R40 T5 target schema supports local UIA query without arbitrary dispatch',
   assert.equal(desktopControlInputSchema.safeParse({op:'target',frame_id:frame,uia_query:{kind:'control_type',value:'button',max_results:4,ordinal:0}}).success,true);
 });
 
-test('R40 full desktop surface registers four narrow typed tools',()=>{
+test('successor desktop wait schema is bounded, semantic, and rejects action-shaped fields',()=>{
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',uia_query:{kind:'name_exact',value:'Ready',max_results:8,ordinal:0},timeout_ms:5000,poll_ms:100,preview:false
+  }).success,true);
+  assert.equal(desktopWaitInputSchema.safeParse({
+    baseline_frame_id:frame,until:'uia_present',timeout_ms:5000,poll_ms:100,preview:false
+  }).success,false);
+  assert.equal(desktopControlInputSchema.safeParse({
+    op:'wait',baseline_frame_id:frame,until:'frame_changed',timeout_ms:5000,poll_ms:100,preview:false,point:{x:1,y:2}
+  }).success,false);
+});
+
+test('successor full desktop surface registers bounded semantic wait without mutation authority',()=>{
   const server=fakeServer();
-  const runtime={status(){},observe(){},target(){},action(){}};
+  const runtime={status(){},observe(){},wait(){},target(){},action(){}};
   registerDesktopTools(server,{runtime});
-  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target']);
+  assert.deepEqual([...server.tools.keys()].sort(),['desktop_action','desktop_observe','desktop_status','desktop_target','desktop_wait']);
 });
 
 test('R40 public desktop action output removes raw text while preserving content and action hashes',async()=>{