the platform stops knowing what VNC is

Desktop is a plugin as of today, and this is the half that leaves. sidecar/vnc/, api/desktop/ and
apps/Desktop/ are gone from src/, along with the vocabulary that was the real problem.

sidecar/protocol.ts had a VNC section: vnc:start, vnc:ensure-password, vnc:stop, four reply variants
and two types. sidecar-registry.ts had startVnc, ensureVncPassword, stopVnc, isVncConnected. Four
functions and a dozen message types in the platform, describing a feature that is not the platform's —
the rule CLAUDE.md states most plainly, and its clearest breach.

What replaced them is generic. sendSidecarCommand(kind, cmd) and isSidecarConnected(kind) know that a
command has a type and an id and that a reply carries the same id. A plugin's sidecar speaks whatever
it likes through them and nothing here has to be edited when it adds a message.

The desktop PERMISSION leaves too, and that is the interesting part: it was kind: 'execution', a kind
a plugin permission cannot have and never will, because a permission nobody can delegate is a
contradiction. The plugin expresses the same refusal as ownerOnly: ['/'] — every path under it denied
to anyone but the owner. Verified: /api/desktop, /api/desktop/vnc-password and a path that does not
exist all resolve owner-only. registry.test.ts records the round trip rather than just dropping the
key from its list.

Also gone: the app store's `vnc` entry, which would have offered an older second way to install the
same thing against a process PM2 no longer has, and four commented-out mounts left from 2026-08-13.

The disconnect-scope test used startVnc as its stand-in for "another sidecar's long-running request".
It now uses the generic door, which is the better instrument — that file is about the blast radius of
a disconnect and never had anything to do with VNC.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/protocol.ts

@@ -118,12 +118,7 @@ export type SidecarCommand =
   // Which OpenCode turns are running right now. The counterpart of `claude:list`, and thinner for a
   // reason: OpenCode has no warm session between turns, so there is nothing to report but the running
   // ones — see `listRunningServeTurns`.
-  | { type: 'opencode:list'; id: string }
-  // VNC
-  | { type: 'vnc:start'; id: string; params: VncStartParams }
-  // Provision the VNC password without starting a server — the UI needs it before it can connect
-  | { type: 'vnc:ensure-password'; id: string; email: string }
-  | { type: 'vnc:stop'; id: string; email: string };
+  | { type: 'opencode:list'; id: string };
 
 // ── Responses/Events (sidecar → API server) ──
 
@@ -158,11 +153,7 @@ export type SidecarEvent =
   | { type: 'claude:session-key'; id: string; sessionKey: string | null }
   | { type: 'claude:sessions'; id: string; sessions: LiveClaudeSession[] }
   | { type: 'opencode:sessions'; id: string; sessions: LiveOpenCodeSession[] }
-  // VNC
-  | { type: 'vnc:started'; id: string; port: number; display: number }
-  | { type: 'vnc:password'; id: string; password: string }
-  | { type: 'vnc:stopped'; id: string }
-  | { type: 'vnc:error'; id: string; error: string }
+
   // OpenCode — the sidecar reports where its `opencode serve` is listening (random port) on connect
   | { type: 'opencode:server'; port: number }
   // OpenCode turn streaming (analog of claude:*): spawned ack, per-message stream, session id report
@@ -290,21 +281,9 @@ export type OpenCodeRunParams = {
   durable?: boolean; // commit turn output to chat_session_events (default true) — see ClaudeSpawnStreamingParams
 };
 
-// ── VNC types ──
-
-export type VncStartParams = {
-  email: string;
-  username: string;
-  resolution?: string;
-};
-
-export type VncSessionInfo = {
-  email: string;
-  display: number;
-  port: number;
-  pid: number;
-  alive: boolean;
-};
+// The VNC command variants and their types left with the desktop plugin on 2026-08-21. A plugin's
+// sidecar speaks its own vocabulary through `sendSidecarCommand`, which knows only that a command has a
+// type and an id — see the note above it in sidecar-registry.ts.
 
 // ── PTY ──
 //