feat: add compositor capability

programs/include/Api/Syscall.hpp

@@ -285,7 +285,14 @@ namespace montauk::abi {
        whatever that image is granted at its next launch. Formatting a data
        volume must not carry that authority with it. */
     static constexpr uint64_t CAP_SYSTEM_IMAGE   = 1ULL << 12;
-    static constexpr uint64_t CAP_ALL            = (1ULL << 13) - 1;
+    /* Map other processes' windows and deliver input events to them
+       (SYS_WINMAP, SYS_WINSENDEVENT): the desktop compositor's authority.
+       Anything holding it can read every window's pixels and click on any
+       window, including a consent prompt it is itself waiting on, so it is
+       never part of a session mask, never part of "all", and never
+       delegated by the compositor to what it launches. */
+    static constexpr uint64_t CAP_COMPOSITOR     = 1ULL << 13;
+    static constexpr uint64_t CAP_ALL            = (1ULL << 14) - 1;
     static constexpr uint64_t CAP_STANDARD_SESSION = CAP_POWER_REQUEST | CAP_SUSPEND;
     static constexpr uint64_t CAP_ADMIN_SESSION =
         CAP_STANDARD_SESSION | CAP_PROCESS_ADMIN | CAP_STORAGE_ADMIN |
@@ -297,6 +304,9 @@ namespace montauk::abi {
     static_assert((CAP_ADMIN_SESSION & CAP_SYSTEM_IMAGE) == 0,
                   "an admin session must not imply authority to rewrite the "
                   "programs it launches; grant CAP_SYSTEM_IMAGE per binary");
+    static_assert((CAP_ADMIN_SESSION & CAP_COMPOSITOR) == 0,
+                  "a session must not delegate the compositor's authority; "
+                  "login grants it to the desktop directly");
     static constexpr int SYS_ERR_PERMISSION = -13;
 
     struct SpawnCapabilities {

programs/include/montauk/capabilities.h

@@ -37,13 +37,18 @@ namespace caps {
         {"device_admin",  montauk::abi::CAP_DEVICE_ADMIN},
         {"log_read",      montauk::abi::CAP_LOG_READ},
         {"system_image",  montauk::abi::CAP_SYSTEM_IMAGE},
+        {"compositor",    montauk::abi::CAP_COMPOSITOR},
     };
 
+    // Never implied by "all": each must be named explicitly in a grant.
+    inline constexpr uint64_t EXPLICIT_ONLY =
+        montauk::abi::CAP_SYSTEM_IMAGE | montauk::abi::CAP_COMPOSITOR;
+
     inline uint64_t bit_for_name(const char* name) {
         if (name == nullptr || name[0] == '\0') return 0;
         // "all" means "everything this launcher may pass on".
         if (montauk::streq(name, "all"))
-            return montauk::abi::CAP_ALL & ~montauk::abi::CAP_SYSTEM_IMAGE;
+            return montauk::abi::CAP_ALL & ~EXPLICIT_ONLY;
         for (const auto& entry : NAMES) {
             if (montauk::streq(entry.name, name)) return entry.bit;
         }