Repository navigation
TEST 135
Create two same-shaped native Windows trial VMs with distinct grants and dynamic loopback RDP ports. Open the VS Code-integrated panel for one selected run and authenticate the guest interactively. In SETUP, exercise bounded keyboard/mouse input, establish the intended desktop baseline, and show the sealed synthetic taskId. Hold an input event in flight, request the LOCKING transition, and race a second event against it. Start Capture Desktop only after the server acknowledges that the queue is drained and the state is READ_ONLY. During capture and on-demand Ollama review, attempt stale, replayed, cross-run, malformed, oversized, and post-lock input; inject lock timeout/controller loss, expired grants, swapped UUID/port, duplicate or malformed RDP rules, non-loopback binding, clipboard/file-transfer routes, host-global shortcuts, panel disconnect, VM teardown, and model/action failures. Complete the authorized run with its one model-selected synthetic UI choice.
The panel connects only to the exact VM UUID and grant-bound loopback RDP port; panel metadata and guest taskId match. SETUP -> LOCKING -> READ_ONLY -> CAPTURING -> REVIEWING -> ACTION -> CLOSED is monotonic: in-flight input drains before capture; racing/post-lock input, lock timeout, controller loss, or missing acknowledgement prevents capture and never reopens setup. The private setup-baseline.json contains only run ID, VM UUID, grant digest, hashed panel-session ID, taskId, phase timestamps, and setup keyboard/mouse counts; it contains no key values, coordinates, text, screenshots, or frames. Setup intentionally establishes the capture baseline. The view shows no host content; only setup viewport keyboard/mouse works, with no clipboard, file transfer, host shortcuts, or generic actions. Credentials and input payloads are absent from application logs/receipts/artifacts, and the pinned RDP component/version and logging settings are recorded. Exactly one model-selected approve/hold is dispatched through MCP; its run-bound receipt identifies grant digest, run, VM, server/tool, candidate, event ID, and outcome, and panel input cannot create or repeat it. The application persists no raw frames/input payloads; its memory buffer and private per-run scratch are cleared on close/expiry/teardown, with run-bound orphan cleanup. OS swap/crash dumps are outside the app guarantee. Any identity, lock, privacy, or cleanup failure refuses/stops the run. Live acceptance remains planned pending independently reviewed authorized evidence.