pastilhasandClaude Opus 5
b91d4df21d
x11vnc against display :0 — the session the owner is actually logged into, not a second one Officer installs. sidecar/, api/, web/ and the host setup script, moved out of src/ whole. Dormant when it moved: the websocket was commented out in server.tsx and the router in hono.ts since 2026-08-13, and no officer-vnc process was running on any machine. Nothing regressed and nothing was restored — this took switched-off code out of the platform. The point of the move is what the platform stopped knowing. Its sidecar/protocol.ts carried a VNC section — vnc:start, vnc:ensure-password, vnc:stop, four reply variants, VncStartParams, VncSessionInfo — and sidecar-registry.ts carried startVnc, ensureVncPassword, stopVnc and isVncConnected. That is the platform speaking a plugin's vocabulary, which CLAUDE.md names as a rule and this was the clearest breach of. All of it is in sidecar/protocol.ts here now. The permission made a round trip worth recording. It was kind: 'execution' — "runs as the server owner and cannot be shared" — and a plugin permission has no kind, deliberately, because a permission nobody can delegate is a contradiction. So the property is expressed as ownerOnly: ['/'] instead: every path under this plugin refused to anyone but the owner. Same answer, reached from the paths rather than from a kind, and the first real use of a mechanism that landed the same day. The property is real — there is one physical screen and it is the owner's. Not finished, and BLOCKERS.md says so rather than the commit implying otherwise: the websocket is dormant because a plugin cannot claim a WebSocket provider, host setup needs a reboot and no manifest can express that, and there is no artwork. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
3.2 KiB
TypeScript
64 lines
3.2 KiB
TypeScript
import type { PluginManifest } from '@@/plugins/manifest';
|
||
|
||
// Desktop — this machine's physical screen, mirrored into the browser.
|
||
//
|
||
// Extracted from the platform on 2026-08-21, having been switched off since 2026-08-13: the websocket
|
||
// was commented out in server.tsx, the router in hono.ts, and no `officer-vnc` process was running on
|
||
// any machine. So this is dormant code moved out of the platform, not a working feature relocated.
|
||
//
|
||
// sidecar/ x11vnc against display :0, and the whole VNC contract
|
||
// api/ one route — the password the UI needs before it can open the socket
|
||
// web/ the noVNC panel, its header and the wrapper
|
||
// setup/ the host setup this cannot do for itself — see PLUGIN.md
|
||
//
|
||
// ── It mirrors ONE screen, and it is the owner's ──
|
||
//
|
||
// x11vnc attaches to the single physical display the owner is logged into. There is no per-user session
|
||
// here and there cannot be: two accounts granted this would see the SAME screen, which is the owner's,
|
||
// including whatever is open on it. That is why the permission below is owner-only at every path rather
|
||
// than merely grantable — the honest answer to "may a member have this" is no, and it is a property of
|
||
// what the plugin does rather than a policy anyone should be able to relax.
|
||
export const manifest: PluginManifest = {
|
||
publisher: 'officerdev',
|
||
version: '1.0.0',
|
||
platform: '>=1.0.0',
|
||
|
||
label: 'Desktop',
|
||
summary: 'Mirror this machine’s display in the browser — the real session, not a second one',
|
||
icon: 'MonitorSmartphone',
|
||
color: '#ec4899',
|
||
|
||
permissions: [
|
||
{
|
||
key: 'desktop',
|
||
label: 'Desktop',
|
||
description: "The server owner's physical screen, mirrored in the browser",
|
||
// The whole surface, because every path here reaches the owner's own screen. `/` matches everything
|
||
// under the plugin's prefix — see `isOwnerOnlyRoute`.
|
||
//
|
||
// This is what `kind: 'execution'` said while it was a core permission: "runs as the server owner
|
||
// and cannot be shared". A plugin permission has no `kind` and deliberately never will, so the
|
||
// property is expressed as paths instead. The registry entry it replaces is deleted, not both.
|
||
ownerOnly: ['/'],
|
||
},
|
||
],
|
||
|
||
// x11vnc is the mirror itself. Declared so a machine without it refuses the install rather than
|
||
// starting a sidecar that spawns a binary that is not there — and `dbus-x11` because the session it
|
||
// attaches to needs one.
|
||
//
|
||
// NOT declared here: ubuntu-desktop, gdm3, the Xorg switch and auto-login. Those are not a package
|
||
// check, they are a host reconfiguration that ends in a reboot, and `osDependencies` cannot express
|
||
// one. `setup/setup-desktop.sh` does it and the owner runs it by hand. See BLOCKERS.md.
|
||
//
|
||
// `scope` is deliberately absent, meaning owner: x11vnc is spawned by this plugin's own sidecar, which
|
||
// runs as the owner. No member ever invokes it, and there is nothing here a member could use.
|
||
osDependencies: [
|
||
{
|
||
binary: 'x11vnc',
|
||
reason: 'Mirrors the physical display. Without it the desktop cannot start at all.',
|
||
packages: { apt: 'x11vnc', dnf: 'x11vnc', pacman: 'x11vnc' },
|
||
},
|
||
],
|
||
};
|