desktop, extracted from the platform

x11vnc against display :0 — the session the owner is actually logged into, not a second one Officer
installs. sidecar/, api/, web/ and the host setup script, moved out of src/ whole.

Dormant when it moved: the websocket was commented out in server.tsx and the router in hono.ts since
2026-08-13, and no officer-vnc process was running on any machine. Nothing regressed and nothing was
restored — this took switched-off code out of the platform.

The point of the move is what the platform stopped knowing. Its sidecar/protocol.ts carried a VNC
section — vnc:start, vnc:ensure-password, vnc:stop, four reply variants, VncStartParams,
VncSessionInfo — and sidecar-registry.ts carried startVnc, ensureVncPassword, stopVnc and
isVncConnected. That is the platform speaking a plugin's vocabulary, which CLAUDE.md names as a rule
and this was the clearest breach of. All of it is in sidecar/protocol.ts here now.

The permission made a round trip worth recording. It was kind: 'execution' — "runs as the server owner
and cannot be shared" — and a plugin permission has no kind, deliberately, because a permission nobody
can delegate is a contradiction. So the property is expressed as ownerOnly: ['/'] instead: every path
under this plugin refused to anyone but the owner. Same answer, reached from the paths rather than
from a kind, and the first real use of a mechanism that landed the same day. The property is real —
there is one physical screen and it is the owner's.

Not finished, and BLOCKERS.md says so rather than the commit implying otherwise: the websocket is
dormant because a plugin cannot claim a WebSocket provider, host setup needs a reboot and no manifest
can express that, and there is no artwork.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

manifest.ts

@@ -0,0 +1,63 @@
+import type { PluginManifest } from '@@/plugins/manifest';
+
+// Desktop — this machine's physical screen, mirrored into the browser.
+//
+// Extracted from the platform on 2026-08-21, having been switched off since 2026-08-13: the websocket
+// was commented out in server.tsx, the router in hono.ts, and no `officer-vnc` process was running on
+// any machine. So this is dormant code moved out of the platform, not a working feature relocated.
+//
+//   sidecar/     x11vnc against display :0, and the whole VNC contract
+//   api/         one route — the password the UI needs before it can open the socket
+//   web/         the noVNC panel, its header and the wrapper
+//   setup/       the host setup this cannot do for itself — see PLUGIN.md
+//
+// ── It mirrors ONE screen, and it is the owner's ──
+//
+// x11vnc attaches to the single physical display the owner is logged into. There is no per-user session
+// here and there cannot be: two accounts granted this would see the SAME screen, which is the owner's,
+// including whatever is open on it. That is why the permission below is owner-only at every path rather
+// than merely grantable — the honest answer to "may a member have this" is no, and it is a property of
+// what the plugin does rather than a policy anyone should be able to relax.
+export const manifest: PluginManifest = {
+  publisher: 'officerdev',
+  version: '1.0.0',
+  platform: '>=1.0.0',
+
+  label: 'Desktop',
+  summary: 'Mirror this machine’s display in the browser — the real session, not a second one',
+  icon: 'MonitorSmartphone',
+  color: '#ec4899',
+
+  permissions: [
+    {
+      key: 'desktop',
+      label: 'Desktop',
+      description: "The server owner's physical screen, mirrored in the browser",
+      // The whole surface, because every path here reaches the owner's own screen. `/` matches everything
+      // under the plugin's prefix — see `isOwnerOnlyRoute`.
+      //
+      // This is what `kind: 'execution'` said while it was a core permission: "runs as the server owner
+      // and cannot be shared". A plugin permission has no `kind` and deliberately never will, so the
+      // property is expressed as paths instead. The registry entry it replaces is deleted, not both.
+      ownerOnly: ['/'],
+    },
+  ],
+
+  // x11vnc is the mirror itself. Declared so a machine without it refuses the install rather than
+  // starting a sidecar that spawns a binary that is not there — and `dbus-x11` because the session it
+  // attaches to needs one.
+  //
+  // NOT declared here: ubuntu-desktop, gdm3, the Xorg switch and auto-login. Those are not a package
+  // check, they are a host reconfiguration that ends in a reboot, and `osDependencies` cannot express
+  // one. `setup/setup-desktop.sh` does it and the owner runs it by hand. See BLOCKERS.md.
+  //
+  // `scope` is deliberately absent, meaning owner: x11vnc is spawned by this plugin's own sidecar, which
+  // runs as the owner. No member ever invokes it, and there is nothing here a member could use.
+  osDependencies: [
+    {
+      binary: 'x11vnc',
+      reason: 'Mirrors the physical display. Without it the desktop cannot start at all.',
+      packages: { apt: 'x11vnc', dnf: 'x11vnc', pacman: 'x11vnc' },
+    },
+  ],
+};