Actor may ask Bot for a watch link to its own desk (contracts 0.268.0) (#480)

ddiff --git a/README.md b/README.md
iindex de7cf548..59944770 100644
---- a/README.md
++++ b/README.md
@@@ -820,7 +820,7 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
  MIT (`license` in [package.json](package.json)).
  
  <!-- versions:start -->
--- openvibe-contracts: v0.267.0
++- openvibe-contracts: v0.268.0
  - openvibe-sdk: v0.74.0
  - openvibe-shared: v4.73.0
  <!-- versions:end -->
ddiff --git a/STATUS.json b/STATUS.json
iindex 5ee985fe..e14d1987 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -6,7 +6,7 @@
    "runtime": "node 22, express, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
    "port": 4000,
    "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
--  "contracts": "openvibe-contracts v0.267.0",
++  "contracts": "openvibe-contracts v0.268.0",
    "sdk": "openvibe-sdk v0.74.0",
    "shared": "openvibe-shared v4.73.0",
    "capabilities": [
ddiff --git a/package-lock.json b/package-lock.json
iindex 2e835d0e..93873ef2 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -20,7 +20,7 @@
          "iovalkey": "^0.4.0",
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
--        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.267.0",
++        "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.268.0",
          "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.73.0",
          "pg": "^8.23.0",
@@@ -1595,9 +1595,9 @@
        }
      },
      "node_modules/openvibe-contracts": {
--      "version": "0.267.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.267.0",
--      "integrity": "sha512-AoyZQuBztDzlLLkvHE+iV3o7aj4jPPw/JrE5LvUZSkPg0W4DOfGZvJ7zR3RqbuiMtwAlxp/q4iLS7yggJFY13w==",
++      "version": "0.268.0",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.268.0",
++      "integrity": "sha512-M1StQXkgFX8Larqn+nTI9zed5Ezo1Fcv6cS/nfrISMVY9N7o5uftpqAj/mSUGQmsYFdoY+aHnXUJmSGzfRLYEw==",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex b2967d7a..48675b1f 100644
---- a/package.json
++++ b/package.json
@@@ -24,7 +24,7 @@
      "iovalkey": "^0.4.0",
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
--    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.267.0",
++    "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.268.0",
      "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.74.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.73.0",
      "pg": "^8.23.0",
ddiff --git a/server/identity/principals.js b/server/identity/principals.js
iindex dc824085..8277e5c1 100644
---- a/server/identity/principals.js
++++ b/server/identity/principals.js
@@@ -407,6 +407,10 @@ const DEFAULT_GRANTS = [
      // Bot, only as that machine's owner (X-OV-Subject) and only where the owner turned on "Let my agent use this
      // computer"; the level the owner set on the machine decides what may happen there.
      ['actor', 'bot.computer.control', 'openvibe.bot', []],
++    // Plan L55 C1b (contracts 0.268.0): a chat turn shows the desk the agent works on, live, and lets the person take it
++    // over. Actor asks Bot for a short-lived watch link to that desk (the private desk or its own desk-<name>, never the
++    // owner's screen), only for the person's own machine and only where they let their agent use it.
++    ['actor', 'bot.machine.watch_link', 'openvibe.bot', []],
      // Plan T17 (contracts 0.183.0): ask Actor from chat. Actor answers a person's "@actor …" in the room they asked in,
      // through Chat's service API (POST /internal/chat/messages), as "OpenVibe Actor".
      ['actor', 'chat.message.send', 'openvibe.chat', []],
ddiff --git a/test/actor-watch-link-grant.test.js b/test/actor-watch-link-grant.test.js
nnew file mode 100644
iindex 00000000..66cedf1c
---- /dev/null
++++ b/test/actor-watch-link-grant.test.js
@@@ -0,0 +1,15 @@
++'use strict';
++// Plan L55 C1b: Actor holds bot.machine.watch_link on openvibe.bot (a chat turn shows the agent's desk, live), a
++// capability the pinned contracts know, and nothing wider than it: the machines hub (bot.machine.manage) stays Network's.
++//   node test/actor-watch-link-grant.test.js
++const assert = require('assert');
++const { capabilities } = require('openvibe-contracts');
++const { DEFAULT_GRANTS } = require('../server/identity/principals');
++
++const has = (client, cap, aud) => DEFAULT_GRANTS.some((g) => g[0] === client && g[1] === cap && g[2] === aud);
++assert.ok(capabilities.get('bot.machine.watch_link'), 'the pinned openvibe-contracts knows the capability');
++assert.ok(has('actor', 'bot.machine.watch_link', 'openvibe.bot'), 'Actor may ask Bot for a watch link');
++assert.ok(has('actor', 'bot.computer.control', 'openvibe.bot'), 'beside the computer control it already had');
++assert.ok(!has('actor', 'bot.machine.manage', 'openvibe.bot'), 'the machines hub is not Actor\'s');
++assert.ok(!DEFAULT_GRANTS.some((g) => g[0] !== 'actor' && g[1] === 'bot.machine.watch_link'), 'no other client holds it');
++console.log('actor watch-link grant: all checks passed');