@skylandnpm/octopus-proxy 0.1.50 → 0.1.52

package/dist/{chunk-6NV726RL.js → chunk-3KIA6HF6.js}

@@ -12,7 +12,7 @@ import {
   probeRemote,
   remoteSessionBudget,
   z
-} from "./chunk-PPH4OB7Y.js";
+} from "./chunk-XIJKEY4L.js";
 
 // ../../node_modules/.pnpm/ajv@8.17.1/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -3321,8 +3321,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -4011,8 +4011,8 @@ var require_fast_uri = __commonJS({
       const host = matches[4];
       return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
-    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+    function canonicalizeHost(parsed, options, schemeHandler, isIP2) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -4039,7 +4039,7 @@ var require_fast_uri = __commonJS({
       let malformedHost = false;
       let malformedIPLiteral = false;
       let malformedScheme = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -4102,15 +4102,15 @@ var require_fast_uri = __commonJS({
             const bracketedIPLiteral = isIPLiteral(parsed.host);
             const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
-            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            isIP2 = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
-            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            parsed.host = isIP2 ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
               malformedAuthorityOrPort = true;
             }
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -4127,14 +4127,14 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!malformedIPLiteral) {
-          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP2);
         }
         if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
-          let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-          if (!isIP) {
+          let host = isIP2 ? parsed.host : normalizePercentEncoding(parsed.host, true);
+          if (!isIP2) {
             host = normalizePercentEncoding(host.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = reescapeHostDelimiters(host, isIP2);
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -13335,6 +13335,71 @@ var PlatformDesktopSession = class {
 import { fork } from "node:child_process";
 import { randomBytes as randomBytes2, randomUUID as randomUUID16 } from "node:crypto";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
+
+// src/remote-stun.ts
+import { Resolver } from "node:dns/promises";
+import { isIP } from "node:net";
+var publicStunHost = "stun.cloudflare.com";
+var dnsJsonEndpoints = ["https://dns.alidns.com/resolve", "https://cloudflare-dns.com/dns-query"];
+var STUN_DNS_TIMEOUT = 1500;
+function defaultRemoteStunUrls(hubUrl) {
+  return [.../* @__PURE__ */ new Set([`stun:${new URL(hubUrl).hostname}:3478`, `stun:${publicStunHost}:3478`])];
+}
+function publicAddress(address, family) {
+  if (isIP(address) !== family) return false;
+  if (family === 6) return /^[23][\da-f]{0,3}:/i.test(address);
+  const [a, b] = address.split(".").map(Number);
+  return a !== 0 && a !== 10 && a !== 127 && a < 224 && !(a === 100 && b >= 64 && b <= 127) && !(a === 169 && b === 254) && !(a === 172 && b >= 16 && b <= 31) && !(a === 192 && b === 168) && !(a === 198 && (b === 18 || b === 19));
+}
+async function systemLookup(family) {
+  const resolver = new Resolver({ timeout: 500, tries: 1 });
+  try {
+    return await (family === 6 ? resolver.resolve6(publicStunHost) : resolver.resolve4(publicStunHost));
+  } finally {
+    resolver.cancel();
+  }
+}
+async function queryDnsJson(endpoint, family, signal) {
+  const type = family === 6 ? 28 : 1;
+  const url = new URL(endpoint);
+  url.searchParams.set("name", publicStunHost);
+  url.searchParams.set("type", String(type));
+  const response = await fetch(url, { headers: { accept: "application/dns-json" }, signal, redirect: "error" });
+  if (!response.ok) throw new Error("STUN DNS request failed");
+  const text = await response.text();
+  if (text.length > 16384) throw new Error("STUN DNS response too large");
+  const body = JSON.parse(text);
+  if (body.Status !== 0 || !Array.isArray(body.Answer)) throw new Error("STUN DNS answer unavailable");
+  return body.Answer.filter((record2) => record2.type === type && typeof record2.data === "string").map((record2) => record2.data);
+}
+async function resolvePublicStunAddresses(lookup = systemLookup, query = queryDnsJson) {
+  const families = await Promise.all([6, 4].map(async (family) => {
+    const valid = (addresses) => addresses.filter((address) => publicAddress(address, family)).slice(0, 1);
+    const native = valid(await lookup(family).catch(() => []));
+    if (native.length) return native;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), STUN_DNS_TIMEOUT);
+    try {
+      return await Promise.any(dnsJsonEndpoints.map(async (endpoint) => {
+        const addresses = valid(await query(endpoint, family, controller.signal));
+        if (!addresses.length) throw new Error("No public STUN address");
+        return addresses;
+      })).catch(() => []);
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+    }
+  }));
+  return families.flat();
+}
+async function discoverRemoteStunUrls(hubUrl, configured, resolve5 = resolvePublicStunAddresses) {
+  if (configured) return [...configured];
+  const addresses = await resolve5().catch(() => []);
+  const numeric = addresses.map((address) => `stun:${isIP(address) === 6 ? `[${address}]` : address}:3478`);
+  return [.../* @__PURE__ */ new Set([...numeric, ...defaultRemoteStunUrls(hubUrl)])].slice(0, 4);
+}
+
+// src/remote-manager.ts
 function spawnWorker(message) {
   const worker = fileURLToPath4(new URL(import.meta.url.endsWith(".ts") ? "./remote-worker.ts" : "./remote-worker.js", import.meta.url));
   const child = fork(worker, [], { stdio: ["ignore", "ignore", "ignore", "ipc"], execArgv: import.meta.url.endsWith(".ts") ? ["--import", "tsx"] : [] });
@@ -13342,7 +13407,7 @@ function spawnWorker(message) {
   return child;
 }
 var RemoteManager = class {
-  constructor(host, desktop, desktopSession, send, touch, workerFactory = spawnWorker, probe = probeRemote) {
+  constructor(host, desktop, desktopSession, send, touch, workerFactory = spawnWorker, probe = probeRemote, discoverStun = discoverRemoteStunUrls) {
     this.host = host;
     this.desktop = desktop;
     this.desktopSession = desktopSession;
@@ -13350,13 +13415,14 @@ var RemoteManager = class {
     this.touch = touch;
     this.workerFactory = workerFactory;
     this.probe = probe;
+    this.discoverStun = discoverStun;
     this.config = RemoteConfigSchema.parse(host.desktopRemote ?? {});
   }
   current;
   stopping = false;
   config;
   stunUrls() {
-    return this.config.stunUrls ?? [`stun:${new URL(this.host.hubUrl).hostname}:3478`];
+    return this.config.stunUrls ?? defaultRemoteStunUrls(this.host.hubUrl);
   }
   async status() {
     const base = { qualityModes: RemoteQualitySchema.options, platform: process.platform, passwordInput: process.platform === "darwin", enabled: this.config.enabled, busy: !!this.current, stunUrls: this.stunUrls(), budget: { ...REMOTE_DEFAULTS, totalBitrate: this.config.totalBitrate, videoMaxBitrate: this.config.videoMaxBitrate } };
@@ -13404,7 +13470,10 @@ var RemoteManager = class {
     const session = { remoteId: randomUUID16(), owner, closed: false, signaling: Promise.resolve(), signals: 0, signalWindow: Date.now(), candidates: 0 };
     this.current = session;
     try {
-      const permissions = await this.probe(this.host.stateDirectory, this.config);
+      const [permissions, stunUrls] = await Promise.all([
+        this.probe(this.host.stateDirectory, this.config),
+        this.discoverStun(this.host.hubUrl, this.config.stunUrls)
+      ]);
       if (!permissions.session || !permissions.capture || !permissions.input) throw new Error("\u8FDC\u63A7\u9700\u8981\u4E3B\u673A\u56FE\u5F62\u4F1A\u8BDD\u3001\u5C4F\u5E55\u5F55\u5236\u53CA\u8F85\u52A9\u529F\u80FD\u6743\u9650");
       if (permissions.locked === true && permissions.lockCapture === false) throw new Error("\u9501\u5C4F\u8FDC\u63A7\u9700\u8981 macOS 14 \u53CA\u4EE5\u4E0A\u53CA\u65B0\u7248 Xcode Command Line Tools\uFF1B\u5F53\u524D\u4E3B\u673A\u8BF7\u5148\u672C\u5730\u89E3\u9501");
       const identity = await this.desktopSession.sessionIdentity();
@@ -13413,7 +13482,7 @@ var RemoteManager = class {
       const layout = await this.desktop.layoutIdentity?.(display.id);
       if (session.closed || this.current !== session) throw new Error("\u5DE5\u4F5C\u533A\u8FDE\u63A5\u5DF2\u5173\u95ED\uFF0C\u8FDC\u63A7\u5DF2\u53D6\u6D88");
       const bindToken = randomBytes2(32).toString("base64url"), expiresAt = Date.now() + 2e4;
-      const child = this.workerFactory({ remoteId: session.remoteId, bindToken, expiresAt, display, helper: permissions.helper, quality, legacy: payload.quality === void 0, config: this.config, stunUrls: this.stunUrls() });
+      const child = this.workerFactory({ remoteId: session.remoteId, bindToken, expiresAt, display, helper: permissions.helper, quality, legacy: payload.quality === void 0, config: this.config, stunUrls });
       session.child = child;
       child.on("message", (message) => {
         if (this.current !== session || session.closed || !message || typeof message !== "object") return;
@@ -13447,7 +13516,7 @@ var RemoteManager = class {
         }
       }, 1e3);
       session.monitor.unref();
-      return { remoteId: session.remoteId, bindToken, expiresAt: new Date(expiresAt).toISOString(), display, revision: 1, stunUrls: this.stunUrls(), budget, quality, qualityModes: RemoteQualitySchema.options, protocolVersion: 1, heartbeatAck: true };
+      return { remoteId: session.remoteId, bindToken, expiresAt: new Date(expiresAt).toISOString(), display, revision: 1, stunUrls, budget, quality, qualityModes: RemoteQualitySchema.options, protocolVersion: 1, heartbeatAck: true };
     } catch (error) {
       this.finish(session);
       throw error;

package/dist/{chunk-PPH4OB7Y.js → chunk-XIJKEY4L.js}

@@ -4187,7 +4187,7 @@ function assertLgplFFmpeg(output) {
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, mkdtemp, readFile, rename, rm, stat } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 var DESKTOP_IMAGE_LIMIT = 20 * 1024 * 1024;
@@ -4257,16 +4257,20 @@ var PlatformDesktop = class {
       await mkdir(this.stateDirectory, { recursive: true, mode: 448 });
       const target = join(this.stateDirectory, "octopus-desktop-capture");
       const source = fileURLToPath(new URL("../native/desktop-macos.m", import.meta.url));
-      const sourceInfo = await stat(source), existing = await stat(target).catch(() => null);
-      if (existing?.isFile() && existing.mtimeMs >= sourceInfo.mtimeMs && (existing.mode & 63) === 0) return target;
-      const temporary = `${target}.${randomUUID()}`;
+      const flags = ["-O2", "-fobjc-arc", "-mmacosx-version-min=12.3", "-framework", "Foundation", "-framework", "AppKit", "-framework", "ScreenCaptureKit", "-framework", "CoreMedia", "-framework", "CoreVideo", "-framework", "VideoToolbox", "-framework", "ImageIO"];
+      const fingerprint = createHash("sha256").update(await readFile(source)).update(JSON.stringify([process.arch, flags])).digest("hex");
+      const stamp = `${target}.sha256`, existing = await stat(target).catch(() => null);
+      if (existing?.isFile() && (existing.mode & 63) === 0 && await readFile(stamp, "utf8").catch(() => "") === fingerprint) return target;
+      const temporary = `${target}.${randomUUID()}`, temporaryStamp = `${temporary}.sha256`;
       try {
-        await this.execute("/usr/bin/clang", ["-O2", "-fobjc-arc", "-mmacosx-version-min=12.3", "-framework", "Foundation", "-framework", "AppKit", "-framework", "ScreenCaptureKit", "-framework", "CoreMedia", "-framework", "CoreVideo", "-framework", "VideoToolbox", "-framework", "ImageIO", source, "-o", temporary]);
+        await this.execute("/usr/bin/clang", [...flags, source, "-o", temporary]);
         await chmod(temporary, 448);
+        await writeFile(temporaryStamp, fingerprint, { mode: 384 });
         await rename(temporary, target);
+        await rename(temporaryStamp, stamp);
         return target;
       } finally {
-        await rm(temporary, { force: true });
+        await Promise.all([rm(temporary, { force: true }), rm(temporaryStamp, { force: true })]);
       }
     })();
     this.helper.catch(() => {
@@ -4447,7 +4451,7 @@ var DesktopManager = class {
 // src/remote-native.ts
 import { execFile as execFile2, spawn } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, stat as stat2, writeFile } from "node:fs/promises";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
@@ -4461,7 +4465,7 @@ async function ensureRemoteHelper(stateDirectory) {
   const source = fileURLToPath2(new URL(mac ? "../native/remote-macos.m" : "../native/remote-x11.c", import.meta.url));
   const target = join2(stateDirectory, "octopus-remote-desktop");
   const stamp = `${target}.sha256`;
-  const flags = mac ? ["-O2", "-fobjc-arc", "-mmacosx-version-min=12.3", "-framework", "Foundation", "-framework", "AppKit", "-framework", "ScreenCaptureKit", "-framework", "CoreMedia", "-framework", "CoreVideo", "-framework", "ApplicationServices", "-framework", "Carbon"] : ["-O2", "-lX11", "-lXtst"];
+  const flags = mac ? ["-O2", "-fobjc-arc", "-mmacosx-version-min=12.3", "-framework", "Foundation", "-framework", "AppKit", "-framework", "ScreenCaptureKit", "-framework", "CoreMedia", "-framework", "CoreVideo", "-framework", "ApplicationServices", "-framework", "Carbon", "-framework", "IOKit"] : ["-O2", "-lX11", "-lXtst"];
   const fingerprint = createHash2("sha256").update(await readFile2(source)).update(JSON.stringify([process.platform, process.arch, flags])).digest("hex");
   const existing = await stat2(target).catch(() => void 0);
   if (existing?.isFile() && (existing.mode & 63) === 0 && await readFile2(stamp, "utf8").catch(() => "") === fingerprint) return target;
@@ -4470,7 +4474,7 @@ async function ensureRemoteHelper(stateDirectory) {
   try {
     await exec(mac ? "/usr/bin/clang" : "cc", args, { timeout: 6e4, maxBuffer: 16384 });
     await chmod2(temporary, 448);
-    await writeFile(temporaryStamp, fingerprint, { mode: 384 });
+    await writeFile2(temporaryStamp, fingerprint, { mode: 384 });
     await rename2(temporary, target);
     await rename2(temporaryStamp, stamp);
     return target;

package/dist/cli.js

@@ -31,13 +31,13 @@ import {
   supportedPlatform,
   systemdUnitPath,
   toolSearchDirs
-} from "./chunk-6NV726RL.js";
+} from "./chunk-3KIA6HF6.js";
 import {
   DESKTOP_PERMISSION_GUIDANCE,
   PlatformDesktop,
   checkDesktop,
   requestDesktopPermission
-} from "./chunk-PPH4OB7Y.js";
+} from "./chunk-XIJKEY4L.js";
 
 // src/cli.ts
 import { spawn as spawn2 } from "node:child_process";

package/dist/main.js

@@ -2,8 +2,8 @@
 import {
   ConfigError,
   runDaemon
-} from "./chunk-6NV726RL.js";
-import "./chunk-PPH4OB7Y.js";
+} from "./chunk-3KIA6HF6.js";
+import "./chunk-XIJKEY4L.js";
 
 // src/main.ts
 runDaemon(process.env.OCTOPUS_PROXY_CONFIG ?? "proxy.json").catch((error) => {

package/dist/remote-worker.js

@@ -14,7 +14,7 @@ import {
   remoteResolutionTiers,
   remoteSessionBudget,
   terminateNative
-} from "./chunk-PPH4OB7Y.js";
+} from "./chunk-XIJKEY4L.js";
 
 // src/remote-worker.ts
 import rtc from "@roamhq/wrtc";

package/native/desktop-macos.m

@@ -106,7 +106,9 @@ int main(int argc, const char *argv[]) {
       if (argc == 2 && strcmp(argv[1], "list") == 0) {
         CGDirectDisplayID ids[64];
         uint32_t count = 0;
-        if (CGGetActiveDisplayList(64, ids, &count) != kCGErrorSuccess) {
+        // Sleeping displays are still connected and must remain selectable so
+        // an authenticated remote connection can wake them with user input.
+        if (CGGetOnlineDisplayList(64, ids, &count) != kCGErrorSuccess) {
           fail(@"无法读取活动显示器，请检查 Proxy 是否运行在已登录的图形桌面会话中。" );
           return 1;
         }

package/native/remote-macos.m

@@ -3,6 +3,7 @@
 #import <ApplicationServices/ApplicationServices.h>
 #import <ScreenCaptureKit/ScreenCaptureKit.h>
 #import <Carbon/Carbon.h>
+#import <IOKit/pwr_mgt/IOPMLib.h>
 #include <arpa/inet.h>
 #include <fcntl.h>
 #include <signal.h>
@@ -17,6 +18,8 @@ static NSMutableSet<NSNumber *> *heldKeys;
 static BOOL heldButtons[3];
 static double lastPing;
 static pid_t parentPID;
+static IOPMAssertionID activityAssertion = kIOPMNullAssertionID;
+static double lastActivity;
 static void signalStop(int signal) { stopping = 1; }
 static BOOL sessionPresent(void) {
   NSDictionary *s = CFBridgingRelease(CGSessionCopyCurrentDictionary());
@@ -29,6 +32,19 @@ static BOOL screenLocked(void) {
   return [s[@"CGSSessionScreenIsLocked"] boolValue];
 }
 static BOOL inputOK(void) { return AXIsProcessTrusted() && CGPreflightPostEventAccess() && sessionPresent(); }
+// Quartz events can fill the password field without marking the console user
+// active. loginwindow then times out its activity check and reports a bad
+// password. Declare activity on connection and real console input, never on
+// capture/pings. This also wakes a sleeping connected display.
+static void userActivity(void) {
+  double now=NSProcessInfo.processInfo.systemUptime;
+  if(activityAssertion!=kIOPMNullAssertionID && now-lastActivity<1) return;
+  if(IOPMAssertionDeclareUserActivity(CFSTR("Octopus remote console input"),kIOPMUserActiveLocal,&activityAssertion)==kIOReturnSuccess) lastActivity=now;
+}
+static void releaseActivity(void) {
+  if(activityAssertion!=kIOPMNullAssertionID) IOPMAssertionRelease(activityAssertion);
+  activityAssertion=kIOPMNullAssertionID; lastActivity=0;
+}
 static void emit(NSDictionary *value) {
   NSData *data = [NSJSONSerialization dataWithJSONObject:value options:0 error:NULL];
   if (!data) return;
@@ -205,15 +221,18 @@ static void command(NSString *line,RemoteStream *capture) {
   }
   if (([op isEqual:@"pointer"] && parts.count==3) || ([op isEqual:@"button"] && parts.count==5) || ([op isEqual:@"wheel"] && parts.count==5)) {
     position(parts[1].doubleValue,parts[2].doubleValue);
-    if ([op isEqual:@"button"]) { int button=parts[3].intValue; if(button<0 || button>2) { stopping=1; return; } heldButtons[button]=parts[4].boolValue; mouseEvent(mouseType(button,heldButtons[button]),mouseButton(button)); }
+    if ([op isEqual:@"button"] && (parts[3].intValue<0 || parts[3].intValue>2)) { stopping=1; return; }
+    userActivity();
+    if ([op isEqual:@"button"]) { int button=parts[3].intValue; heldButtons[button]=parts[4].boolValue; mouseEvent(mouseType(button,heldButtons[button]),mouseButton(button)); }
     else if ([op isEqual:@"wheel"]) { mouseEvent(kCGEventMouseMoved,kCGMouseButtonLeft); CGEventRef e=CGEventCreateScrollWheelEvent(NULL,kCGScrollEventUnitPixel,2,-parts[4].intValue,-parts[3].intValue); if(e) { CGEventSetFlags(e,flags()); CGEventPost(kCGHIDEventTap,e); CFRelease(e); } }
     else { CGEventType type=heldButtons[0]?kCGEventLeftMouseDragged:heldButtons[2]?kCGEventRightMouseDragged:heldButtons[1]?kCGEventOtherMouseDragged:kCGEventMouseMoved; mouseEvent(type,heldButtons[2]?kCGMouseButtonRight:heldButtons[1]?kCGMouseButtonCenter:kCGMouseButtonLeft); }
-  } else if ([op isEqual:@"key"] && parts.count==3) { NSNumber *key=keyCodes()[parts[1]]; if(key) keyEvent(key.unsignedShortValue,parts[2].boolValue); }
+  } else if ([op isEqual:@"key"] && parts.count==3) { NSNumber *key=keyCodes()[parts[1]]; if(key) { userActivity(); keyEvent(key.unsignedShortValue,parts[2].boolValue); } }
   else if (([op isEqual:@"text"] && parts.count==3) || ([op isEqual:@"password"] && parts.count==2)) {
     BOOL password=[op isEqual:@"password"];
     NSData *data=[[NSData alloc] initWithBase64EncodedString:parts[password ? 1 : 2] options:0]; NSString *text=[[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
     if(!text || data.length>(password ? 1024 : 16384) || (password && (!data.length || [text rangeOfCharacterFromSet:NSCharacterSet.controlCharacterSet].location!=NSNotFound))) { stopping=1; return; }
     if(password && !screenLocked()) { emit(@{@"kind":@"input-error"}); return; }
+    if(text.length) userActivity();
     releaseAll();
     for(NSUInteger i=0;i<text.length;) {
       if(!inputOK()) { stopping=1; return; }
@@ -252,9 +271,15 @@ int main(int argc,const char *argv[]) {
         emit(@{@"capture":@(CGPreflightScreenCaptureAccess()),@"input":@((BOOL)(AXIsProcessTrusted() && CGPreflightPostEventAccess())),@"session":@(sessionPresent()),@"locked":@(screenLocked()),@"lockCapture":@(lockCapture)}); return 0;
       }
       if(argc!=6 || strcmp(argv[1],"serve")!=0 || !inputOK() || !CGPreflightScreenCaptureAccess()) return 1;
-      displayID=(CGDirectDisplayID)strtoul(argv[2],NULL,10); bounds=CGDisplayBounds(displayID);
+      displayID=(CGDirectDisplayID)strtoul(argv[2],NULL,10);
       int w=atoi(argv[3]),h=atoi(argv[4]),fps=atoi(argv[5]);
-      if(!CGDisplayIsActive(displayID) || w<2 || h<2 || w>3840 || h>2160 || w%2 || h%2 || fps<1 || fps>30) return 1;
+      if(!CGDisplayIsOnline(displayID) || w<2 || h<2 || w>3840 || h>2160 || w%2 || h%2 || fps<1 || fps>30) return 1;
+      userActivity();
+      NSDate *wakeDeadline=[NSDate dateWithTimeIntervalSinceNow:2];
+      while(!CGDisplayIsActive(displayID) && CGDisplayIsOnline(displayID) && inputOK() && wakeDeadline.timeIntervalSinceNow>0)
+        [NSRunLoop.currentRunLoop runUntilDate:[NSDate dateWithTimeIntervalSinceNow:.02]];
+      if(!CGDisplayIsActive(displayID) || !inputOK()) { releaseActivity(); return 1; }
+      bounds=CGDisplayBounds(displayID);
       heldKeys=[NSMutableSet set]; cursor=bounds.origin; parentPID=getppid(); lastPing=NSDate.date.timeIntervalSince1970;
       signal(SIGTERM,signalStop); signal(SIGINT,signalStop); signal(SIGPIPE,signalStop);
       fcntl(STDIN_FILENO,F_SETFL,O_NONBLOCK);
@@ -279,7 +304,7 @@ int main(int argc,const char *argv[]) {
       NSMutableData *incoming=[NSMutableData data];
       while(!stopping) {
         @autoreleasepool {
-          if(getppid()!=parentPID || NSDate.date.timeIntervalSince1970-lastPing>15 || !inputOK() || !CGPreflightScreenCaptureAccess() || !CGDisplayIsActive(displayID) || !CGRectEqualToRect(bounds,CGDisplayBounds(displayID))) break;
+          if(getppid()!=parentPID || NSDate.date.timeIntervalSince1970-lastPing>15 || !inputOK() || !CGPreflightScreenCaptureAccess() || !CGDisplayIsOnline(displayID) || !CGRectEqualToRect(bounds,CGDisplayBounds(displayID))) break;
           if(screenLocked()) [capture captureLockedFrame];
           else if(capture.streamStopped && capture.stream) {
             capture.streamStopped=NO;
@@ -297,7 +322,7 @@ int main(int argc,const char *argv[]) {
           [NSRunLoop.currentRunLoop runUntilDate:[NSDate dateWithTimeIntervalSinceNow:.005]];
         }
       }
-      stopping=1; releaseAll(); [capture.stream stopCaptureWithCompletionHandler:nil]; return 0;
+      stopping=1; releaseAll(); releaseActivity(); [capture.stream stopCaptureWithCompletionHandler:nil]; return 0;
     }
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skylandnpm/octopus-proxy",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "type": "module",
   "description": "Octopus host proxy: OpenCode, Codex, ZCode and Pi adapters with service installer CLI",
   "bin": {

package/proxy.example.json

@@ -7,7 +7,6 @@
   "tool": { "kind": "opencode", "command": "/Users/luhuili/.opencode/bin/opencode", "baseUrl": "http://127.0.0.1:4096", "mode": "external", "password": "replace-with-a-random-secret-at-least-20-characters" },
   "desktopRemote": {
     "enabled": true,
-    "stunUrls": ["stun:hub.example.com:3478"],
     "totalBitrate": 22000000,
     "videoMaxBitrate": 16000000
   }