v1.3 — Sandboxed iteration, screen capture, and input injection

Fourth release. The headline is input.* — keyboard and mouse
injection on the target — plus the sandbox.* namespace, on-Amiga
screen capture, and the kernel debug ring as a first-class primitive.

121 → 137 tools, 12 → 14 namespaces. Wire protocol stays at 1.0:
every addition is additive and proto.capabilities derives its method
list dynamically, so an older host talks to a 1.3 daemon fine and an
older daemon simply reports no input capability.

input.* — and it is off by default

input.state, type, key, mouse_move, click, drag, scroll,
driving input.device IND_WRITEEVENT from MCPd, so it works on real
PowerPC hardware as well as QEMU — not just QMP-driven guests.

This is the only surface in the project that writes to a machine's
UI: it types and clicks as the logged-in user, into whatever window has
focus. So it is disabled at the daemon and returns -32003 until an
operator either starts MCPd with --enable-input or creates
SYS:System/MCPd/ENABLE-INPUT on the target and restarts.

• The gate is read once at startup into a read-only static, so no
  RPC method can switch it on — enabling needs filesystem access to the
  machine itself.
• The sentinel file is the primary mechanism because MCPd-Watchdog
  relaunches MCPd with no arguments; a CLI-flag-only gate would be
  silently dropped on the first restart, which is the worst failure mode
  for a security control.
• proto.capabilities reports input.enabled, and the methods stay
  advertised when the gate is shut, so a client can tell "switched off"
  from "old daemon".
• The host-side [targets.<name>.input] enabled flag is a wrong-target
  guard, not access control — anything that can reach TCP 4322
  bypasses the host.

Typing is layout-correct: characters map through the target's own
keymap.library MapANSI, dead-key sequences included, with a built-in
US table as fallback. confirm: true is required on the operations that
commit an action, and ctrl+lamiga+ramiga additionally needs
confirm_reset: true because it reboots the machine. Every handler
releases held modifiers and mouse buttons before returning, including on
the abort path, so a truncated drag cannot leave a stuck button.

Read SECURITY.md before enabling it on anything.

Also new

• sandbox.* — driver and program iteration on top of
  SandboxVM, so a guest segfault
  no longer costs a power cycle.
• wb.screenshot — captures an AmigaOS screen to PNG on the target
  and brings it back; works on real X5000 / A1222, unlike the QMP-only
  qemu.screenshot.
• sys.debug_ring — reads the kernel debug ring via
  c:DumpDebugBuffer.
• installer.* no longer needs a host-side diskimage-bootstrap/
  directory, and bundles AmiDock prefs.

Verified

QEMU pegasos2 (sm501 RTG) 27/27 and a real AmigaOne X5000 23/27
via the new scripts/validate_input.py, which drives the whole gate
cycle: shut by default → sentinel → restart → open → inject → sentinel
removed → restart → shut.

Echo café >… typed into a Shell produced exactly b'caf\xe9' on both
machines — four bytes, correct ISO-8859-1. The X5000's four non-passes
are debug-ring assertions that machine cannot satisfy: the AmigaOS
kernel debug buffer does not wrap, and a verbose graphics driver fills
all 80 KB of it during boot, before MCPd starts. proto.capabilities is
the authoritative gate reading; see the note in COMMANDS.md.

Assets

MCPd-1.3.lha — start here. The daemon plus all five install
scripts and a README, packaged on AmigaOS so every file already
carries the right protection bits. AmigaOS protection bits are part of
the file rather than the byte stream, so a raw ELF copied onto an Amiga
over SMB, a USB stick, or a browser download arrives with the
executable bit protected and simply refuses to run. Unpack this and
everything is runnable as-is:

LhA x MCPd-1.3.lha
Execute MCPd/MCPd-Install

sha256 415df28ffc48205d8875aeed7311452106c53308063771949f58d1398e16dfa7

MCPd-1.3 — the bare PowerPC ELF, 304,708 bytes,
$VER: MCPd 1.3 (10.09.2026), built with AmigaOS 4.1 FE SDK 54.16 +
GCC 11.5 (walkero/amigagccondocker:os4-gcc11, the same image CI
uses). This is the binary validated on the X5000 above. Use it if you
are deploying from the host with
scripts/install_mcpd_autostart.py <ip>:4322, which sets the
protection bits itself.

sha256 7a6f44b9edf4c9ab47c927d8baef73cb97565fefa1a84a2b1e61de1543977081

Input injection stays off until you run MCPd-Enable-Input yourself.

Thanks

input.* was contributed by @cpm1 in #2.