plugins/minesweeper
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

a fixed stage for the game, and close the VNC port nobody meant to open

Browse Source 
── the stage ──

The framebuffer is now the picture. 800x600 whatever the difficulty, the game
centred in it by the sidecar, and the panel draws it entire — scaled to fit,
centred by its flex parent, never cropped. Changing difficulty moves the board
instead of resizing the panel.

What this replaces parked the window at the origin and had the client crop to
the window's size, polled every four seconds. Two things wrong with it. The
panel resized under the player mid-game; and wine puts the window at 3,29
rather than 0,0, so cropping from the origin showed a black strip on top and
cut a row of cells off the bottom — the "expert gets cut off" report.

Centring runs on a one-second timer because nothing announces a resize: not
RFB, which keeps the framebuffer, and not X without a window manager to listen
through. One chained `xdotool search … getwindowgeometry` per tick, one
process, and a `windowmove` only when the numbers actually changed.

The client loses the geometry poll, the offscreen canvas and the crop with it.

── the port ──

x11vnc was listening on 0.0.0.0:5900 and [::]:5900 with -nopw. Every account
on this machine, every device on the tailnet and everything on the LAN could
open it and take the display — which is precisely the hole the 5907 version
was replaced to close, reopened wider and documented as impossible.

`-unixsock` ADDS a unix socket. It does not remove the TCP one. Three flags do:
-rfbport 0 for IPv4, -rfbportv6 0 for IPv6, -noipv6 for outgoing. `-rfbport 0`
alone leaves [::]:5900 up, which is how this nearly shipped half-fixed.

Found with `ss -lntp` on the running process, and that is the only check that
was right about it at any point. Running the same argv by hand showed no IPv6
listener — most likely because the PM2 session still held [::]:5900 and the
hand-run copy failed to bind it silently. Comments in session.ts and index.ts
that asserted there was no port are corrected rather than deleted.

Verified on the live socket: the streamed framebuffer is 447k teal pixels
around a 152x214 window at 324,193 — dead centre — and window grey arrives as
c0 c0 c0, no TCP listener for the x11vnc pid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: de3ed4e6-f88a-429c-94e6-a760336ba83b
This commit is contained in:
pastilhas
2026-08-23 21:17:12 +00:00
co-authored by Claude Opus 5
parent 76b6a9c567
commit e6cec953e4
5 changed files with 226 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sidecar/index.ts
+7 -3
View File
@@ -29,9 +29,13 @@ import { isRunning, start, status, stop } from './session';
─────────────────────────────────────────────────────────────────────────────────────────────────
WHAT REACHES x11vnc
Nothing but this file. x11vnc binds a socket inside a mode-0700 directory and has no port at all, so the
kernel refuses every other account before any credential could be checked. That is why `-nopw` is right
rather than lazy — see the block comment in `session.ts` where it is spawned.
Nothing but this file. x11vnc binds a socket inside a mode-0700 directory, so the kernel refuses every
other account before any credential could be checked. That is why `-nopw` is right rather than lazy —
see the block comment in `session.ts` where it is spawned.
This paragraph used to end "and has no port at all", and that was false for as long as it existed:
`-unixsock` ADDS a unix socket, it does not remove the TCP listener, so x11vnc was on 0.0.0.0:5900 with
no password. `-rfbport 0` is what makes the sentence true, and it is in `session.ts` for that reason.
This listener is loopback and unauthenticated, exactly like every other sidecar in the fleet; the platform
is the authenticator and `X-Officer-User` is how a request proves it came through one.
sidecar/session.ts
+138 -21
View File
@@ -37,9 +37,35 @@ export type SessionStatus = {
error?: string;
};
/**
* The stage: a fixed framebuffer, with the game centred in it.
*
* The game window changes size with the difficulty — 152x214 on beginner, 504x342 on expert, larger
* again on a custom board — and the whole framebuffer is what gets streamed, so the panel sees one
* stable rectangle whatever is being played. The alternative, and what this replaced, was parking the
* window at the origin and having the client crop to its size: that made the panel resize under the
* player mid-game, and it was wrong by the 3x29 wine puts between the root origin and the window, which
* showed as a black strip on top and a row of cut-off cells at the bottom.
*
* 800x600 is generous on beginner and that is deliberate: it holds the largest board Minesweeper X can
* make (30x24 custom, 504x470) with room to spare, so no difficulty ever reaches an edge.
*/
const SCREEN_W = 800;
const SCREEN_H = 600;
/**
* How often to check whether the board changed size.
*
* Nothing announces a resize — not RFB, which keeps the framebuffer, and not X without a window manager
* to listen through. The game only resizes when somebody picks a difficulty, so this is idle almost
* always; one chained `xdotool` per second is the price of the re-centre feeling immediate when it is
* not.
*/
const CENTRE_INTERVAL_MS = 1_000;
/** The desktop behind the game. Windows 95's own, because that is what this is a picture of. */
const STAGE_COLOUR = '#008080';
let xvfb: Proc | null = null;
let game: Proc | null = null;
let vnc: Proc | null = null;
@@ -63,24 +89,95 @@ function pickDisplay(): string | null {
return null;
}
/** The game's window. wine also creates a 1x1 owner stub, so the larger of the two is the real one. */
export async function windowGeometry(): Promise<WindowGeometry | null> {
if (!display) return null;
const search = await run(['xdotool', 'search', '--name', 'Minesweeper X'], { DISPLAY: display }, 5_000);
if (!search.ok) return null;
type FoundWindow = WindowGeometry & { id: string };
let best: WindowGeometry | null = null;
for (const id of search.stdout.trim().split('\n').filter(Boolean)) {
const geom = await run(['xdotool', 'getwindowgeometry', '--shell', id], { DISPLAY: display }, 5_000);
if (!geom.ok) continue;
const read = (key: string) => Number(new RegExp(`^${key}=(\\d+)$`, 'm').exec(geom.stdout)?.[1] ?? NaN);
const candidate = { width: read('WIDTH'), height: read('HEIGHT'), x: read('X'), y: read('Y') };
if (Object.values(candidate).some(Number.isNaN)) continue;
if (!best || candidate.width * candidate.height > best.width * best.height) best = candidate;
/**
* The game's window, with the id needed to move it.
*
* wine creates several 1x1 owner stubs under the same name, so the largest candidate is the real one.
*
* One `xdotool` process, not one per candidate: `search … getwindowgeometry --shell %@` chains the two
* commands and prints a block per window. That matters because this now runs on a timer rather than once
* at startup, and the old shape spawned five processes a tick.
*/
async function findWindow(): Promise<FoundWindow | null> {
if (!display) return null;
const found = await run(
['xdotool', 'search', '--name', 'Minesweeper X', 'getwindowgeometry', '--shell', '%@'],
{ DISPLAY: display },
5_000,
);
if (!found.ok) return null;
// WINDOW= opens each block; the keys after it belong to that window until the next one.
const blocks: Record<string, string>[] = [];
for (const line of found.stdout.split('\n')) {
const match = /^(\w+)=(.+)$/.exec(line.trim());
if (!match) continue;
const [, key, value] = match;
if (key === undefined || value === undefined) continue; // the regex guarantees both; the compiler does not
if (key === 'WINDOW') blocks.push({});
const block = blocks[blocks.length - 1];
if (block) block[key] = value;
}
let best: FoundWindow | null = null;
for (const block of blocks) {
const id = block.WINDOW;
const candidate = {
width: Number(block.WIDTH),
height: Number(block.HEIGHT),
x: Number(block.X),
y: Number(block.Y),
};
if (!id || Object.values(candidate).some(Number.isNaN)) continue;
if (!best || candidate.width * candidate.height > best.width * best.height) best = { id, ...candidate };
}
return best && best.width > 1 ? best : null;
}
/** The game's window geometry, for `/status`. Nothing in the panel needs it — it is a diagnostic. */
export async function windowGeometry(): Promise<WindowGeometry | null> {
const found = await findWindow();
return found ? { width: found.width, height: found.height, x: found.x, y: found.y } : null;
}
/**
* Put the game in the middle of the stage.
*
* Clamped at zero so a board wider or taller than the framebuffer loses its right and bottom edges
* rather than its menu bar — a negative origin would push the part you need to click off the top.
*/
async function centre(): Promise<void> {
const win = await findWindow();
if (!win || !display) return;
const x = Math.max(0, Math.round((SCREEN_W - win.width) / 2));
const y = Math.max(0, Math.round((SCREEN_H - win.height) / 2));
if (win.x === x && win.y === y) return;
await run(['xdotool', 'windowmove', win.id, String(x), String(y)], { DISPLAY: display }, 5_000);
}
let centring: ReturnType<typeof setTimeout> | null = null;
/**
* Re-centre whenever the board changes size, for as long as the session is up.
*
* Self-scheduling rather than `setInterval`: a tick spawns a process and awaits it, and an interval that
* fires faster than that completes would stack ticks on a slow machine.
*/
function watchForResize(): void {
if (centring) return;
const tick = async () => {
if (!isRunning()) {
centring = null;
return;
}
await centre().catch(() => undefined);
centring = setTimeout(tick, CENTRE_INTERVAL_MS);
};
centring = setTimeout(tick, CENTRE_INTERVAL_MS);
}
/**
* Whether the session is up, decided by the socket file plus a live x11vnc.
*
@@ -173,13 +270,7 @@ async function startInner(log: (line: string) => void): Promise<SessionStatus> {
return status();
}
// Park the window at the framebuffer origin. Everything downstream then crops by using a canvas
// smaller than the framebuffer, with no offset arithmetic and nothing to keep in sync when the board
// resizes with the difficulty.
const found = await run(['xdotool', 'search', '--name', 'Minesweeper X'], { DISPLAY: display! }, 5_000);
for (const id of found.stdout.trim().split('\n').filter(Boolean)) {
await run(['xdotool', 'windowmove', id, '0', '0'], { DISPLAY: display! }, 5_000);
}
await centre();
}
// Wine has now booted the prefix, and booting it is what can restore `Z:`. The confinement in
@@ -208,7 +299,26 @@ async function startInner(log: (line: string) => void): Promise<SessionStatus> {
vnc = spawn(
// -forever: survive a viewer disconnecting. -shared: more than one viewer. -noxdamage: the damage
// extension reports nothing useful on Xvfb and costs a poll that misses updates.
['x11vnc', '-display', display!, '-unixsock', VNC_SOCKET, '-forever', '-shared', '-nopw', '-noxdamage', '-wait', '5', '-defer', '5'],
//
// THE THREE PORT FLAGS ARE WHAT MAKE THE PARAGRAPH ABOVE TRUE, AND ALL THREE ARE LOAD-BEARING.
//
// `-unixsock` ADDS a unix socket; it does not remove the TCP one. So the first version of this
// listened on 0.0.0.0:5900 AND [::]:5900 with -nopw, while its own comment said there was no port
// to authenticate against — anything on the tailnet, anything on the LAN, and every other account
// on the machine could take the display. Found with `ss -lntp` on the running session. Reading the
// flags would never have shown it, because the flag that mattered was the one nobody had written.
//
// `-rfbport 0` alone leaves `[::]:5900` up; `-rfbportv6 0` is what closes it. Verified by `ss` on
// the real process both times, which is the only check that has been right about this so far —
// running the same argv by hand showed no IPv6 listener at all, almost certainly because the
// session under PM2 was still holding [::]:5900 and the hand-run copy silently failed to bind it.
//
// Do not drop one of these because a check looks clean. Check the RUNNING process.
//
// -solid: the stage is bigger than the game, so the surround is now something people look at. Teal
// rather than the root's black, which reads as a broken stream rather than a desktop. x11vnc sets it
// itself on a bare display, so this costs no new host binary.
['x11vnc', '-display', display!, '-unixsock', VNC_SOCKET, '-rfbport', '0', '-rfbportv6', '0', '-noipv6', '-solid', STAGE_COLOUR, '-forever', '-shared', '-nopw', '-noxdamage', '-wait', '5', '-defer', '5'],
{ DISPLAY: display! },
'x11vnc',
);
@@ -221,6 +331,8 @@ async function startInner(log: (line: string) => void): Promise<SessionStatus> {
}
}
watchForResize();
log('ready');
return status();
}
@@ -246,6 +358,11 @@ async function reap(proc: Proc | null, name: string): Promise<void> {
}
export async function stop(): Promise<SessionStatus> {
if (centring) {
clearTimeout(centring);
centring = null;
}
await reap(vnc, 'x11vnc');
vnc = null;
rmSync(VNC_SOCKET, { force: true });