[httpsphl]

D6 of Desktop Use (spec 24.2, 24.4, 24.6, 24.10, 24.12): the daemon and the app's button.

What changes

• desktop.grantWhole {botId, level, acceptedRisks} gives the whole desktop (scope: desktop).

  • Refused without the accepted risks.
  • The owner sets the level, and can lower it.
  • The grant keeps its options and saves accepted_risks_at.
  • It is never asked for in the chat.

• With it, desktop_windows shows every title, and any window is read or pictured without asking. Acting needs the level to be "see and use"; with "see" only, using an app is still asked app by app in the chat.

• desktop_screenshot without window takes the whole screen. This needs the whole desktop grant, and "while you are away" when the owner is away; the return notice then says "Desktop".

  • Platform: every_shown() lists every shown top-level window, including tool and untitled windows, but not the daemon's own.
  • Every window of a process that is never granted gets its DWM frame painted black. This happens even when another window covers it, so black may be left over but never missing.
  • The capture is a BitBlt of the virtual screen (all monitors, SRCCOPY | CAPTUREBLT). It is shrunk by the system scale to at most 1600 × 1200, and a locked screen is refused.
  • The outline, the bot cursor and the notice windows are excluded from capture (WDA_EXCLUDEFROMCAPTURE).

• tools/desktop.rs stays under 300 lines: the whole-screen tool is in desktop_screen.rs, and used moved to desktop_grant.rs.

• App:

  • "Dar o desktop inteiro" in the bot's "Seu desktop" section opens the risks screen with the level (Ver, or Ver e usar). Confirm lights only with "Entendi os riscos" checked.
  • The grant then shows as "O desktop inteiro" with its switches, and the button goes away.
  • Texts are in all three languages, and the fake daemon answers desktop.grantWhole. The first CI run failed without that handler.

Tests

• App: the dialog's gating, the level, the listed grant, pt-BR words.
• Store: one whole-desktop grant whose level the owner sets; it keeps its options.
• Unit test: covering black only inside the picture.
• tests/desktop_whole.rs (CI only). The owner is using the PC, so no window tests ran locally. It checks:
  • without the grant: no whole screen and no titles;
  • refused without accepted risks;
  • with the grant: titles show, a window is read without asking, and the whole screen comes back as an image.

Manual

• With a password manager or a terminal open, give a bot the whole desktop and ask for a screenshot of the whole screen. Those windows should be black, and the outline and bot cursor should not appear in the picture.