desktop is a plugin too

Its sidecar, officer-vnc, was already excluded from the light profile, so calling
it core was only the capability kind saying `execution` — which is about who may
reach it, not whether a light install runs it.

Unmounted the same way as the other twelve: `/desktop`, its capability's api and
ws claims, the `desktop` websocket handler and its upgrade route. Implementation
untouched.

Also reverts a mistake from the previous commit. I had commented entries out of
WSData's `provider` union and left `upgradeWs`'s parameter type listing them,
which would have been a type error the moment either was used — and one I cannot
see here, since node_modules is empty and tsgo does not run. Those unions describe
possible values rather than what is served, and neither is a registration. Only
registrations are commented now, which is what was asked for in the first place.

Totality simulated again: 33 live mounts, 5 websockets, zero problems.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/server.tsx

@@ -15,7 +15,7 @@ import { chatWebsocket } from './servers/api/chat/websocket';
 import { taskRunnerWebsocket } from './servers/api/tasks/task-executor';
 import { pipelineWebsocket } from './servers/api/tasks/pipeline-executor';
 import { cliampWebsocket, cliampAudioWebsocket } from './servers/api/cliamp/relay';
-import { desktopWebsocket } from './servers/api/desktop/websocket';
+// import { desktopWebsocket } from './servers/api/desktop/websocket';
 // import { vaultWebsocket, upgradeVaultWs } from './servers/api/vault/websocket';
 import officerWeb from './apps/officer-web/index.gen.html';
 // import { startBrowserRelay } from './servers/api/browser/relay';  // switched off — see below
@@ -41,10 +41,10 @@ type WSData = {
     | 'chat'
     | 'task-runner'
     | 'pipeline'
-    // | 'cliamp'
+    | 'cliamp'
-    // | 'cliamp-audio'
+    | 'cliamp-audio'
     | 'desktop'
-    // | 'vault'
+    | 'vault'
     | 'sidecar';
   sessionId?: string;
   cwd?: string;
@@ -137,7 +137,7 @@ const handlers: Record<string, any> = {
   pipeline: pipelineWebsocket,
   // cliamp: cliampWebsocket,
   // 'cliamp-audio': cliampAudioWebsocket,
-  desktop: desktopWebsocket,
+  // desktop: desktopWebsocket,
   // vault: vaultWebsocket,
   sidecar: sidecarWebsocket,
 };
@@ -295,7 +295,7 @@ const server = serve({
     '/api/chat/ws': (req, server) => upgradeWs(req, server, 'chat'),
     '/api/cliamp/ws': (req, server) => upgradeWs(req, server, 'cliamp'),
     '/api/cliamp/audio/ws': (req, server) => upgradeWs(req, server, 'cliamp-audio'),
-    '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
+    // '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
     // CalDAV/CardDAV. These live OUTSIDE /api because DAV clients are given a bare domain and probe
     // fixed, spec-defined paths — `/.well-known/caldav` unauthenticated, before they hold any
     // credential at all. They need naming explicitly here or the `/*` SPA fallback below swallows them

src/servers/capabilities/registry.ts

@@ -334,8 +334,9 @@ export const CAPABILITIES: Capability[] = [
     label: 'Desktop',
     description: "The server owner's physical screen",
     kind: 'execution',
-    api: ['/desktop'],
+    // api: ['/desktop'],  // plugin — switched off 2026-08-13
-    ws: ['desktop'],
+    // ws: ['desktop'],
+    api: [],
     routes: ['/desktop'],
   },
   // `/browser` — the Chrome-extension relay — is unmounted as of 2026-08-13 and dropped from this claim,

src/servers/hono.ts

@@ -52,7 +52,7 @@ import { queueRouter } from './api/queue/queue';
 // The browser relay is switched off — see server.tsx. Restoring this mount means restoring the
 // registry's claim on '/browser' in the same commit, or assertCapabilityTotality refuses to boot.
 // import { browserRouter } from './api/browser/router';
-import { desktopRouter } from './api/desktop/rest';
+// import { desktopRouter } from './api/desktop/rest';
 import { bugReportRouter } from './api/bug-report/bug-report';
 import { agentStatusRouter } from './api/agent-status/router';
 import { chatRouter } from './api/chat/chat';
@@ -227,7 +227,7 @@ const PROTECTED_MOUNTS: [prefix: string, router: ReturnType<typeof createRouter>
   ['/chat', chatRouter],
   ['/pipeline-jobs', pipelineJobsRouter],
   ['/jobs', pipelineJobsRouter], // unified jobs API (script + pipeline); /pipeline-jobs kept for the existing UI
-  ['/desktop', desktopRouter],
+  // ['/desktop', desktopRouter],  // plugin — switched off 2026-08-13
 ];
 
 for (const [prefix, router] of PROTECTED_MOUNTS) protectedRouter.route(prefix, router);