/minesweeper — a wine session streamed to the browser over RFB

a websocket byte relay onto x11vnc's tcp socket, the same shape as the
terminal's relay onto the pty sidecar. this is the piece plugins/desktop
could not have: a plugin cannot claim a websocket provider.

the rfb client is ours rather than vendored novnc — raw and copyrect,
one pixel format we dictate so a rectangle memcpys into ImageData. we
control the server, so the other eight encodings are surface we would
carry and never run.

execution, so owner-only: wine runs as the owner, which makes the game's
menus file dialogs over the owner's home.

two bugs worth keeping. the token key is BEARER_TOKEN, not token, so the
upgrade 401'd before any rfb byte moved. and the /status health check
opened a tcp connection to prove liveness — libvncserver blocks its
accept loop peeking for a websocket handshake, so a polled health check
filled the backlog and locked out the real viewer. a liveness check must
not be indistinguishable from a client; it reads /proc/net/tcp now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/servers/permissions/registry.ts

@@ -328,6 +328,25 @@ const CORE_REGISTRY: Permission[] = [
     ws: ['task-runner', 'pipeline'],
     routes: ['/jobs'],
   },
+  // Minesweeper X, on a virtual display, streamed to the browser over RFB.
+  //
+  // `execution` rather than `app`, and the reason is not that a game is dangerous. The wine process runs
+  // as the SERVER OWNER on the owner's display — so its File and Extras menus are file dialogs with the
+  // owner's home behind them, and "granted Minesweeper" would quietly mean "granted a file picker as the
+  // owner". `plugins/desktop` reached the same conclusion from the same premise.
+  //
+  // There is a second reason to keep it here for now: one display and one game means two viewers share a
+  // board and fight over the mouse. Per-viewer sessions would be a display and a wine prefix each, which
+  // is cheap for this but is a design decision rather than an implementation detail.
+  {
+    key: 'minesweeper',
+    label: 'Minesweeper',
+    description: 'A Windows Minesweeper session on a virtual display, as the server owner',
+    kind: 'execution',
+    api: ['/minesweeper'],
+    ws: ['minesweeper'],
+    routes: ['/minesweeper'],
+  },
   {
     key: 'items',
     label: 'Permission authoring',