Desktop driver: bounded agent operations, protected service, and MCP adapter

.changeset/agent-operations-act.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `act` agent operation. It clicks with a physical pointer, performs the default accessibility action, types, or clears one element, which must be named by a reference that a `find` proved unique and by that find's sample id. Before dispatching, it rereads the element inside the target's input turn and refuses one whose role, name, or automation id changed, or that is disabled, hidden, or covered. The result reports the mechanism used. A mutating request with a caller-chosen `requestId` is recorded, so repeating it returns the first outcome instead of acting again, and reusing the id for a different request fails with `request-id-reused`. While the target is quarantined, `act` is refused in fixed words and reads continue. The typed client gains `act()`.

.changeset/agent-operations-capture.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `capture` and `artifact` agent operations: window and element PNGs kept as bounded session artifacts with provenance and a SHA-256, returned inline only on request and readable in pages.

.changeset/agent-operations-check.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `check` agent operation. It compares a referenced element's states, name, value, or text with what is expected, or counts the elements a selector matches (`none`, `unique`, or `some`), and reports each expectation's status with the actual value when it failed. With `waitMs`, up to 30 seconds, it re-evaluates on the provider's change events and a bounded poll until the expectation holds, and otherwise reports `timed-out` with the last status. An incomplete search is `inconclusive`, never an absence, and expected values and text are refused when the operator denies content. `act` also accepts a selector in `find`, which a search inside the request must prove unique, and returns the proven `ref` and `sample`. The typed client gains `check()`.

.changeset/agent-operations-client-signal.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Let typed-client operation calls take an `AbortSignal`, which the service treats as the caller leaving, and export `maxRequestIdLength` from `/operations`.

.changeset/agent-operations-observe-find.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add versioned agent operations to the driver service. `GET /session/{id}/furn/ops` lists a catalog of operations with JSON Schemas, and `POST /session/{id}/furn/ops/{name}` runs `observe`, `find`, or `journal` on the session's command queue. `observe` returns a bounded outline or node list of a window or element subtree under explicit budgets and names why it stopped. `find` reports whether a match is unique, none, multiple, or inconclusive and never proves uniqueness or absence from an incomplete search. Both issue session-scoped element references and release the provider records they do not return. Each session keeps a bounded journal that never holds typed text or displayed content, and operators can deny reading displayed content with `createDesktopDriverServer({ operations: { content: 'deny' } })`. The typed client gains `operations()`, `operation()`, `observe()`, `find()`, and `journal()`, and `./operations` exports the catalog and executor. Operations need a helper that negotiates `boundedObservation`, which today is the macOS helper and the fake host.

.changeset/agent-operations-sequence.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `sequence` agent operation. It runs up to eight `act` and `check` steps in order in one call, stopping at the first act that fails or check that does not pass, and optionally closes with a bounded observation. Each step reports its own result or a sanitized error with the act's mutation report; steps that ran stay done. The request is refused before the first step when it could not run as a whole: a quarantined target, an unsupported action, or content the operator denies. The checks share one 30-second wait ceiling. The catalog names embedded step schemas by operation instead of repeating them. The typed client gains `sequence()`.

.changeset/bounded-observation-contract.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the bounded observation contract to the native protocol: `observe` reads one budgeted, breadth-first sample of a window's accessibility tree and `releaseElements` drops the records Node created for agents, both negotiated as the additive `boundedObservation` helper feature. The native host validates every request and response against the contract, and the fake host is the reference provider. Helpers that do not negotiate the feature behave as before.

.changeset/desktop-driver-accessibility-perform.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `perform` action to `act`, which runs an accessibility action an element publishes by name. The macOS helper binds each listed action to an opaque per-process key so the action performed is exactly the one listed.

.changeset/desktop-driver-idle-expiry.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': minor
+---
+
+Close a protected service's idle grant sessions after `idleSessionTimeoutMs` (ten minutes by default) through the same path as `DELETE`.

.changeset/desktop-driver-mcp-story-tool.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver-mcp': patch
+---
+
+Add the `desktop_story` tool, which lists Storybook stories and renders one through the driver's story operations.

.changeset/desktop-driver-mcp.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver-mcp': patch
+---
+
+Add the Desktop Driver MCP adapter: five tools (`desktop_session`, `desktop_observe`, `desktop_act`, `desktop_check`, `desktop_capture`) over the driver's agent operations, connected through a verified private descriptor, with session-scoped capture resources, progress, and cancellation.

.changeset/desktop-driver-story-operations.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add the `stories` and `story` agent operations, which list a Storybook target's story catalog and render a story with marker verification, preview-region expiry, and settled failure reports. Uncertain changes quarantine the target.

.changeset/desktop-driver-windows-tree-limit.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Report `tree-too-large` from the Windows helper's `tree` and `find` when an oversized tree outlasts the whole-subtree UI Automation transaction, by counting the subtree one child at a time up to the node limit instead of failing with `automation-failed`.

.changeset/desktop-layering-foundation.md

@@ -0,0 +1,8 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+'@fluentui-react-native/desktop-driver-mcp': patch
+'@fluentui-react-native/desktop-test': patch
+'@fluentui-react-native/storybook-desktop': patch
+---
+
+Serialize MCP connection and session lifetimes, reverify authority after transport failures, and fence ambiguous acquisitions. Discover target launch modes, quarantine uncertain story changes, refuse ungoverned args updates on protected services, and retain workload claims after uncertain cleanup. Document the work-in-progress layering and package-owned capability, qualification, and measurement status.

.changeset/desktop-readiness-failure-summary.md

@@ -0,0 +1,7 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+'@fluentui-react-native/desktop-test': patch
+'@fluentui-react-native/storybook-desktop': patch
+---
+
+Long-lived `serve`, `driver`, and `server` commands now write their bounded summary when they fail before readiness, instead of exiting with empty structured output. Integrations receive an `onReady` callback for `serve`. Storybook CLI tests no longer overwrite a live app's generated driver state. Records the live macOS paging and delta qualification.

.changeset/desktop-test-integration-agent.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-test': patch
+---
+
+Let an imported integration serve `serve --agent` by declaring `supportsAgent`; `run` receives the agent descriptor options and, for `serve`, the output format for its readiness document. `startNativeDesktopService` accepts `agent` options to protect the driver and publish its agent connection.

.changeset/desktop-test-serve-agent.md

@@ -0,0 +1,6 @@
+---
+'@fluentui-react-native/desktop-test': patch
+'@fluentui-react-native/desktop-driver-mcp': patch
+---
+
+Add `desktop-test serve --agent`, which protects the served target with a grant authority and publishes the private connection descriptor the Desktop Driver MCP adapter reads.

.changeset/macos-activation-swiftui.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Fix window activation on macOS for SwiftUI applications, such as Calculator on macOS 27, whose windows refuse `AXRaise` with `attributeUnsupported`. Activation now records that refusal and lets its frontmost and main-window checks decide, so physical clicks and typing no longer fail before they start.

.changeset/macos-bounded-observation.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Implement bounded observation in the macOS helper. `observe` samples a window's accessibility tree breadth first with one multi-attribute read per element under visited, depth, string, byte, and deadline budgets, and `releaseElements` drops element records. Element ids are shared with `tree`, `find`, and `snapshot`. The `actions` fact and `accessibilityActions` now return an empty list for an element whose action query reports a general failure, as AppKit split dividers do, instead of failing the command.

.changeset/macos-close-window-event.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Stop the macOS helper from publishing a `window-closed` event for a window that `closeWindow` closed. The native protocol reserves the event for windows the platform destroys, but the observer thread published it whenever the destroyed notification arrived before the command forgot the window, which happened on every close of a Calculator window. The helper now marks the window before it presses the close button, still records the destruction in the window event log, and removes the mark if the press fails. The fake host no longer publishes the event for `closeWindow` either.

.changeset/macos-helper-memory-growth.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Stop the macOS helper from growing its memory with every request. Its stdin reader and worker threads run no run loop, so nothing drained their autorelease pools, and a long session added about 25 KB per command plus 80 KB per `tree` and 250 KB per full `observe` for good. Each frame and each request now runs in its own autorelease pool, and the helper holds steady across thousands of requests.

.changeset/macos-queued-cancel-effect.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+The macOS helper no longer attaches an `effect` when a queued read or lifecycle command is cancelled before it starts, matching the native protocol and the Windows helper. A queued mutation and an unknown id still report `none`. A new self-test drives the stdio host over in-process pipes and checks that cancelled queued requests never run.

.changeset/macos-service-verifier.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': minor
+---
+
+Add the macOS service verifier: `describeMacOSService` and `createMacOSServiceVerifier` on the `/authority` entry, backed by a new one-shot `--service-identity` mode in the macOS helper that checks the process identity, audit session, and exclusive loopback listener before a credential is sent.

.changeset/macos-window-event-tail.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Report macOS window-event history truncation after the bounded event ring evicts older notifications, matching the Windows provider.

.changeset/persistent-quarantine-recovery.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': minor
+---
+
+Persist target quarantines across service restarts with an optional settlement journal, add operator `recoverTarget`, and add the macOS `--application-incarnation` helper mode with `createMacOSApplicationProbe`.

.changeset/private-driver-discovery.md

@@ -0,0 +1,13 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add versioned private connection descriptors, a macOS owner-validated storage
+adapter, and grant support for connected, attached, and WDIO-managed clients.
+Descriptors require a trusted live service identity verifier before sending a
+credential, then verify the authenticated service incarnation. Storage rejects
+unsafe permissions, ACLs, links, oversized records, and replacement of existing
+records; the macOS adapter explicitly rejects unsupported platforms, including
+Windows, which has its own adapter. Protected client transports
+reject redirects and keep grants out of serialized WDIO options. Extend the
+gated native-helper contract to exercise the protected service boundary.

.changeset/protected-service-grants.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Let the driver service authenticate callers and keep their sessions apart. Pass a `DesktopAuthority` (new `./authority` export) to `createDesktopDriverServer`, issue each caller a grant with `authority.issue({ label, targets })`, and give the typed client its token with `createDesktopDriverClient({ grant })`. A protected service answers every route, including ordinary WebDriver routes, unknown routes, and `/status`, with HTTP 401 `unauthorized` unless the request carries a valid grant, and it decides that before reading the request body. A session belongs to the grant that created it and is invisible to every other grant, a grant opens only the targets it names, and a target that is busy or quarantined reports `data.reason` `target-busy` or `target-quarantined` with the holder's label but no grant, secret, or session identifier. Revoking a grant closes its sessions. A service started without an authority behaves as before.

.changeset/quiet-m3-evidence.md

@@ -0,0 +1,6 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+'@fluentui-react-native/desktop-driver-mcp': patch
+---
+
+Add bounded observation paging and deltas; extend the prior macOS M3 evidence record.

.changeset/quiet-runners-report.md

@@ -0,0 +1,7 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+'@fluentui-react-native/desktop-test': patch
+'@fluentui-react-native/storybook-desktop': patch
+---
+
+Add shared CLI reporter modes with bounded JSON summaries and NDJSON progress, propagate reporter settings to delegated commands, and emit Storybook readiness records only after service checks pass.

.changeset/safe-sessions-drain.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Drain grant-owned sessions on revocation, cancelling in-flight work and rejecting queued commands before teardown.

.changeset/settled-mutations-quarantine.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Settle failed and cancelled mutations before reusing a target. Native helpers report an additive `effect` (`none`, `partial`, or `unknown`) on a failed or cancelled mutating command, the macOS helper tracks it with an effect ledger, and the service quarantines a target whose mutation may have reached the application, refusing later mutations with `target-quarantined` instead of replaying them. A failed mutation reports its `data.mutation` disposition (`applied`, `indeterminate`, or `rejected`), `/status` lists active quarantines, and a late success after a Node timeout is reported as applied.

.changeset/steady-helpers-settle.md

@@ -0,0 +1,7 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+'@fluentui-react-native/desktop-test': patch
+'@fluentui-react-native/storybook-desktop': patch
+---
+
+Treat empty reporter environment variables as unset and stop CLIs crashing when stdout closes, and make the Windows helper fail closed when a UI Automation mutation does not settle by reporting `mutation-indeterminate` and refusing later mutations with `target-quarantined`.

.changeset/storybook-desktop-agent-driver.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/storybook-desktop': patch
+---
+
+Add `driver --agent` (with `--descriptor` and `--root`), which protects the embedded Desktop Driver, publishes an agent connection for the Desktop Driver MCP adapter, disables the channel's unauthenticated MCP endpoint, and keeps the macOS application lease current. `desktop-test serve --agent` now works for Storybook targets and reports readiness in structured output modes.

.changeset/storybook-desktop-windows-agent.md

@@ -0,0 +1,6 @@
+---
+'@fluentui-react-native/storybook-desktop': patch
+'@fluentui-react-native/desktop-test': patch
+---
+
+Let `driver --agent` attach on Windows and Win32 without an application lease: the agent connection names the app's verified AUMID or REX executable, resolved through the new `resolveDesktopApplication(target, signal, { attach: true })` option, and the command fails before starting services when no identity can be verified. `driver` also serves Metro on a platform's declared fixed smoke Metro port, such as the RN Test App Windows Debug host's 8081, and fails clearly when that port is in use.

.changeset/target-non-response-reason.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Report a macOS application that stops answering with a reason. A read that failed because the target did not respond used to reach callers as a bare `unknown error`. The helper now marks it with `data.reason` `target-non-response`, and Node keeps that reason and `nativeCode` `automation-failed` on the error, in the operation response, and in the session journal, so an agent can wait and retry instead of treating the request as wrong.

.changeset/windows-application-probe.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Add `createWindowsApplicationProbe` to `./authority` and the Windows helper's `--application-incarnation` mode behind it, so a Windows service's `recovery.probeApplication` can lift a persisted quarantine once the recorded application process is proven to have exited. The helper answers `exited` only when the process id names no process, the process holding it has exited, or it names a process created more than one second later; a creation time within 10 ms is `running`, and access denied or anything else is `unknown`.

.changeset/windows-bounded-observation.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Implement bounded observation in the Windows helper. `observe` pages each family of UI Automation children with the cached tree walker, so the visited, depth, byte, and deadline budgets take effect between any two siblings, and a 10,000-item tree returns a partial sample instead of failing `tree-too-large`. Records that `observe` emits are pinned until `releaseElements` or their window ends, a full record table ends the sample with the `references` truncation instead of evicting them, and `releaseElements` drops only the named records. Password fields never report `value` or `text`. The helper negotiates `boundedObservation` in `hello` and `probe`, so agent operations now work on Windows.

.changeset/windows-helper-identity-events.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Harden the Windows helper: publish window lifecycle from WinEvent hooks, recheck input authority on every physical operation, never reuse element ids and bound retained elements with a fingerprint check before each action, treat a provider-reported UI Automation timeout on a mutation as indeterminate, refuse clicks that another application's window covers, and report provider failures with their named UI Automation results. Adds an opt-in plain Win32 fixture contract.

.changeset/windows-keyed-accessibility-actions.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Expose Windows UI Automation actions in bounded observation and support opaque keyed action execution with live pattern revalidation and mutation settlement.

.changeset/windows-lease-scoped-quarantine.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Scope the Windows helper's mutation quarantine to the application lease. Closing a launched application ends its quarantine once the helper has verified the process exited, as the service already does, so one unsettled call no longer refuses mutations for every later session until the helper restarts. An attached application keeps running and stays quarantined. Adds an opt-in `protectedService` native contract that serves the Win32 fixture through a grant-protected service with the real helper behind it.

.changeset/windows-mutation-effects.md

@@ -0,0 +1,5 @@
+---
+'@fluentui-react-native/desktop-driver': patch
+---
+
+Report the FDR1 mutation `effect` from the Windows helper on every failed or cancelled mutating command. An effect ledger counts each UI Automation pattern action and value write and every key, button, wheel, close, and window-placement change Windows accepts, so a rejection reports `none`, a command stopped after part of it landed reports `partial`, and a provider call that never settled or failed ambiguously reports `unknown`. A cancel for a queued mutation, or for an id the helper does not hold, reports `none`. The gated native test now checks effect reporting against the Windows helper as well as the macOS one.