instar 1.3.1597 → 1.3.1598

package/dashboard/desktop.css

@@ -41,3 +41,11 @@ body.desktop-live #localCursor{display:block}
 .setup-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 8px; }
 .setup-note:empty { display: none; }
 .setup-quiet { background: none; border: none; color: inherit; opacity: 0.7; text-decoration: underline; }
+
+#lockedPassword{position:absolute;z-index:8;left:max(.5rem,env(safe-area-inset-left));right:max(.5rem,env(safe-area-inset-right));top:max(.5rem,env(safe-area-inset-top));display:grid;gap:.4rem;padding:.6rem;background:#111827f2;border:1px solid #64748b;border-radius:10px;color:#f1f5f9}
+#lockedPassword[hidden],#leaveUnlockedButton[hidden]{display:none}
+#lockedPassword input{width:100%;font-size:16px;padding:.55rem}
+#lockedPassword p{margin:0;font-size:.8rem}
+#leaveUnlockedButton{position:absolute;z-index:8;right:max(.5rem,env(safe-area-inset-right));bottom:4rem;padding:.55rem .8rem}
+#lockedCard{margin-top:.8rem}
+#lockedCard[hidden]{display:none}

package/dashboard/desktop.html

@@ -19,6 +19,10 @@
     <label>Machine <select id="machine"></select></label>
     <button id="requestButton">Open selected machine</button>
     <ul id="machineNotes" class="machine-notes" aria-label="Machines that are not ready"></ul>
+    <div id="lockedCard" hidden>
+      <p id="lockedCardText"></p>
+      <button id="lockedToggle" type="button" hidden></button>
+    </div>
   </section>
   <section id="setup" hidden>
     <h2>Machines</h2>
@@ -86,6 +90,12 @@
       <button data-remote-key="F11" type="button">F11</button>
       <button data-remote-key="F12" type="button">F12</button>
     </div>
+    <form id="lockedPassword" hidden>
+      <label>Mac password <input id="lockedPasswordInput" type="password" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" maxlength="256"></label>
+      <button type="submit">Unlock</button>
+      <p>The machine serving this page and the tunnel provider can read what you type here. The Instar app is safer.</p>
+    </form>
+    <button id="leaveUnlockedButton" type="button" hidden>Leave unlocked</button>
     <div id="keyboardBar" hidden>
       <label class="type-label" for="typeText">Type on remote desktop</label>
       <input id="typeText" maxlength="64" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" enterkeyhint="done">

package/dashboard/desktop.js

@@ -251,7 +251,7 @@ const base64ToBytes = text => Uint8Array.from(atob(text), character => character
 function recordIv(direction, sequence) {
   const iv = new Uint8Array(12);
   const view = new DataView(iv.buffer);
-  view.setUint32(0, direction === 'frame' ? 1 : 2);
+  view.setUint32(0, { frame: 1, input: 2, control: 3 }[direction]);
   view.setBigUint64(4, sequence);
   return iv;
 }
@@ -410,11 +410,65 @@ function receiveH264(bytes, epoch) {
     timestamp, data }));
   needsVideoKeyframe = false;
 }
+const CONTROL_MARKER = 0xc7;
+let controlSequence = 0n;
+let lockedSealKey = '';
+let lockedScreenState = '';
+let lockedBoxAllowed = false;
+let secretSequence = 0;
+function syncLockedPassword() {
+  const show = lockedBoxAllowed && lockedScreenState === 'locked-in-session' && !!lockedSealKey;
+  $('lockedPassword').hidden = !show;
+  if (!show) $('lockedPasswordInput').value = '';
+}
+function lockedMessage(reason) {
+  return { 'relock-pending': 'This Mac is finishing a relock. Try again in a couple of minutes.',
+    'attempts-per-request': 'Too many tries in this session.', 'attempts-per-day': 'Too many tries today.',
+    'seal-stale': 'The connection changed. Type your password again.',
+    aborted: 'Stopped before the password finished. Type it again.',
+    'field-dirty': 'Clearing the password field. Try again in a moment.',
+    'browser-box-off': 'Password entry from a browser is off for this Mac.',
+    'tunnel-not-first-tier': 'Password entry is off while the backup connection is in use.' }[reason]
+    ?? 'This Mac did not accept that. Try again.';
+}
+async function receiveControl(record) {
+  const view = new DataView(record.buffer, record.byteOffset, record.byteLength);
+  const sequence = view.getBigUint64(0) & 0x00ff_ffff_ffff_ffffn;
+  if (sequence <= controlSequence) throw new Error('Remote control record invalid.');
+  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: recordIv('control', sequence),
+    additionalData: recordAad('control') }, aesKey, record.subarray(8));
+  controlSequence = sequence;
+  const value = JSON.parse(new TextDecoder().decode(plain));
+  if (value.type === 'seal') lockedSealKey = value.key;
+  if (value.type === 'state') { lockedScreenState = value.state; lockedBoxAllowed = value.box === true; }
+  if (value.type === 'secret-result' && value.refused) status(lockedMessage(value.refused));
+  if (value.type === 'secret-result' && value.sent) { $('leaveUnlockedButton').hidden = false; }
+  if (value.type === 'relock') status(value.phase === 'left-unlocked' ? 'This Mac will stay unlocked.' : 'Relocking has begun.');
+  syncLockedPassword();
+}
+/** Sealed for the helper alone: Node and the front carry bytes they cannot read. */
+async function sendLockedPassword(text) {
+  const helperKey = lockedSealKey;
+  const pair = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
+  const helper = await crypto.subtle.importKey('raw', base64ToBytes(helperKey), { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const bits = await crypto.subtle.deriveBits({ name: 'ECDH', public: helper }, pair.privateKey, 256);
+  const hkdf = await crypto.subtle.importKey('raw', bits, 'HKDF', false, ['deriveKey']);
+  const key = await crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0),
+    info: encoder.encode(`instar-desktop-secret-v1:${requestId}:${helperKey}`) }, hkdf,
+  { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
+  const seq = ++secretSequence;
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv,
+    additionalData: encoder.encode(JSON.stringify(['instar-desktop-secret-v1', requestId, seq])) }, key, encoder.encode(text));
+  const ephemeral = await crypto.subtle.exportKey('raw', pair.publicKey);
+  return sendCommand({ type: 'secret', secret: { ephemeral: bytesToBase64(ephemeral), iv: bytesToBase64(iv), ct: bytesToBase64(ct), seq } });
+}
 async function receiveFrame(recordBuffer, epoch) {
   if (!inputEnabled || epoch !== streamEpoch) return;
   if (!aesKey || !(recordBuffer instanceof ArrayBuffer) || recordBuffer.byteLength < 28
     || recordBuffer.byteLength > 1_600_000) throw new Error('Encrypted frame invalid.');
   const record = new Uint8Array(recordBuffer);
+  if (record[0] === CONTROL_MARKER) { await receiveControl(record); return; }
   const sequence = new DataView(recordBuffer).getBigUint64(0);
   // The target may drop an already-encrypted frame under backpressure. A
   // strictly increasing nonce still rejects replay/reordering without treating
@@ -699,6 +753,7 @@ async function loadTargetsAndMaybeOpen({ open = true } = {}) {
     const trustedKey = typeof target.targetSigningPublicKey === 'string'
       ? target.targetSigningPublicKey : '';
     option.disabled = !target.ready || !trustedKey;
+    setTimeout(() => { void refreshLockedCard(); }, 0);
     option.textContent = option.disabled
       ? `${target.label} — ${target.unavailableReason || 'Unavailable right now'}`
       : target.label;
@@ -817,6 +872,8 @@ async function requestDesktop() {
       browserEcdhPublicKey: bytesToBase64(ecdhPublicKey),
       browserNonce: crypto.randomUUID().replaceAll('-', ''),
       videoCodec,
+      client: 'browser',
+      controlRecords: true,
     });
     requestId = result.requestId;
     const approved = await api(`/desktop/requests/${encodeURIComponent(requestId)}`);
@@ -875,6 +932,10 @@ async function openStream(result, resume = null) {
   sendChain = Promise.resolve();
   receiveChain = Promise.resolve();
   socket.binaryType = 'arraybuffer';
+  controlSequence = 0n;
+  lockedSealKey = '';
+  secretSequence = 0;
+  syncLockedPassword();
   return new Promise((resolve, reject) => {
   let opened = false;
   let settled = false;
@@ -930,8 +991,17 @@ async function openStream(result, resume = null) {
   });
 }
 
+const LOCK_SCREEN_KEYS = new Set(['Enter', 'Tab', 'Escape', 'ArrowLeft', 'ArrowRight', 'ArrowUp', 'ArrowDown']);
+/** A password typed at the shield must never leave as plain input. The helper
+ * also refuses it, but only this stops it reaching the server at all. */
+function refusedAtLock(action) {
+  if (!['locked-in-session', 'locked-by-policy', 'screensaver-or-sleep', 'unknown'].includes(lockedScreenState)) return false;
+  if (action.kind === 'type') return true;
+  return action.kind === 'keyDown' && !LOCK_SCREEN_KEYS.has(action.key);
+}
 function send(action) {
   if (!inputEnabled) return Promise.resolve(false);
+  if (refusedAtLock(action)) return Promise.resolve(true);
   if (screenSwitch && Date.now() - screenSwitch.at >= SCREEN_SWITCH_LIMIT_MS) screenSwitch = null;
   if (screenSwitch && ['click', 'buttonDown', 'move'].includes(action.kind)) return Promise.resolve(false);
   return sendCommand({ type: 'input', action });
@@ -1559,6 +1629,33 @@ $('stopButton').addEventListener('click', async () => {
   catch { message = 'The viewer closed, but the target has not confirmed revocation. Access expires automatically.'; }
   leave(message);
 });
+$('lockedPassword')?.addEventListener('submit', event => {
+  event.preventDefault();
+  const input = $('lockedPasswordInput');
+  const text = input.value;
+  input.value = '';
+  if (text) void sendLockedPassword(text);
+});
+const LOCKED_REASONS = { 'unsupported-macos': 'Not available yet: this Mac\u2019s macOS has not passed the crash and Stop tests.' };
+async function refreshLockedCard() {
+  let rows;
+  try { rows = (await api('/desktop/locked/status?scope=pool')).machines; }
+  catch { $('lockedCard').hidden = true; return; }
+  const row = rows?.find(item => item.machineId === $('machine').value);
+  if (!row) { $('lockedCard').hidden = true; return; }
+  $('lockedCard').hidden = !row.enabled && !!row.refusal;
+  $('lockedCardText').textContent = row.refusal ? LOCKED_REASONS[row.refusal] ?? 'Opening this Mac at its lock screen is unavailable.'
+    : row.enabled ? 'You can open this Mac at its lock screen. It relocks when you finish.' : 'Opening this Mac at its lock screen is off.';
+  $('lockedToggle').hidden = !!row.refusal;
+  $('lockedToggle').textContent = row.enabled ? 'Turn off' : 'Turn on';
+  $('lockedToggle').onclick = async () => {
+    try { await api('/desktop/locked/settings', 'POST', { machineId: row.machineId, enabled: !row.enabled }); }
+    catch (error) { status(error.message); }
+    void refreshLockedCard();
+  };
+}
+$('machine')?.addEventListener('change', () => { void refreshLockedCard(); });
+$('leaveUnlockedButton')?.addEventListener('click', () => { void sendCommand({ type: 'leave-unlocked' }); });
 window.addEventListener('beforeunload', () => {
   stopping = true;
   sendCommand({ type: 'stop' });

package/dist/core/DesktopAccessAudit.d.ts

@@ -1,10 +1,12 @@
 export interface DesktopAuditEvent {
-    kind: 'start' | 'stop';
+    kind: 'start' | 'stop' | 'leave-unlocked';
     grantId: string;
     machineId: string;
     operatorUid: string;
     authMethod?: 'pin' | 'telegram';
     inputBucket?: 'none' | '1-9' | '10-99' | '100+';
+    /** leave-unlocked only: true when the tap beat the relock guard. */
+    acknowledged?: boolean;
 }
 export declare class DesktopAccessAudit {
     private readonly dir;

package/dist/core/DesktopAccessAudit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopAccessAudit.d.ts","sourceRoot":"","sources":["../../src/core/DesktopAccessAudit.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;CACjD;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,YAAY,QAAQ,EAAE,MAAM,EAI3B;IAED,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAWrC;IAED,OAAO,CAAC,KAAK;CASd"}
+{"version":3,"file":"DesktopAccessAudit.d.ts","sourceRoot":"","sources":["../../src/core/DesktopAccessAudit.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;IAChD,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,YAAY,QAAQ,EAAE,MAAM,EAI3B;IAED,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAYrC;IAED,OAAO,CAAC,KAAK;CASd"}

package/dist/core/DesktopAccessAudit.js

@@ -19,6 +19,7 @@ export class DesktopAccessAudit {
             operatorRef: crypto.createHash('sha256').update(event.operatorUid).digest('hex').slice(0, 16),
             ...(event.authMethod ? { authMethod: event.authMethod } : {}),
             ...(event.inputBucket ? { inputBucket: event.inputBucket } : {}),
+            ...(event.acknowledged !== undefined ? { acknowledged: event.acknowledged } : {}),
         };
         fs.appendFileSync(file, JSON.stringify(entry) + '\n', { mode: 0o600 });
     }

package/dist/core/DesktopAccessAudit.js.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopAccessAudit.js","sourceRoot":"","sources":["../../src/core/DesktopAccessAudit.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAS;IAC7B,YAAY,QAAgB;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAwB;QAC7B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAChD,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtF,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,MAAM,EAAE,CAAC;gBACrD,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"DesktopAccessAudit.js","sourceRoot":"","sources":["../../src/core/DesktopAccessAudit.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAarD,MAAM,OAAO,kBAAkB;IACZ,GAAG,CAAS;IAC7B,YAAY,QAAgB;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAwB;QAC7B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAChD,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACtF,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,MAAM,EAAE,CAAC;gBACrD,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/core/DesktopAead.d.ts

@@ -1,12 +1,19 @@
-export type DesktopDirection = 'frame' | 'input';
+export type DesktopDirection = 'frame' | 'input' | 'control';
+/** First byte of a control record. Frame sequences never reach it, and only a
+ * viewer that declared controlRecords is ever sent one. */
+export declare const DESKTOP_CONTROL_MARKER = 199;
 export declare const DESKTOP_MAX_PLAINTEXT_FRAME_BYTES: number;
 export declare class DesktopAead {
     private readonly key;
     private readonly requestId;
     private nextFrame;
     private nextInput;
+    private nextControl;
     constructor(key: Buffer, requestId: string);
     encryptFrame(frame: Buffer): Buffer;
+    /** Its own sequence and IV domain: a control record overtaking a frame in
+     * flight must never make that frame's sequence look stale to a viewer. */
+    encryptControl(value: unknown): Buffer;
     decryptInput(record: Buffer): unknown;
 }
 export declare function deriveDesktopKey(browserEcdhPublicKey: Buffer, requestId: string, machineId: string): {

package/dist/core/DesktopAead.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopAead.d.ts","sourceRoot":"","sources":["../../src/core/DesktopAead.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEjD,eAAO,MAAM,iCAAiC,QAA4B,CAAC;AAa3E,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAHpE,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,SAAS,CAAM;IAEvB,YAA6B,GAAG,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM,EAE3E;IAED,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlC;IAED,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUpC;CACF;AAED,wBAAgB,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACpG,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CACpD,CASA"}
+{"version":3,"file":"DesktopAead.d.ts","sourceRoot":"","sources":["../../src/core/DesktopAead.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;AAC7D;2DAC2D;AAC3D,eAAO,MAAM,sBAAsB,MAAO,CAAC;AAG3C,eAAO,MAAM,iCAAiC,QAA4B,CAAC;AAa3E,qBAAa,WAAW;IAKV,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJpE,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,WAAW,CAAM;IAEzB,YAA6B,GAAG,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM,EAE3E;IAED,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASlC;IAED;8EAC0E;IAC1E,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CASrC;IAED,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAUpC;CACF;AAED,wBAAgB,gBAAgB,CAAC,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IACpG,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CACpD,CASA"}

package/dist/core/DesktopAead.js

@@ -3,11 +3,15 @@
  * prevent reflection, reordering and replay. A new ECDH key is used per grant. */
 import crypto from 'node:crypto';
 import { H264_MAX_ACCESS_UNIT } from './DesktopVideo.js';
+/** First byte of a control record. Frame sequences never reach it, and only a
+ * viewer that declared controlRecords is ever sent one. */
+export const DESKTOP_CONTROL_MARKER = 0xc7;
+const IV_DOMAIN = { frame: 1, input: 2, control: 3 };
 // The native access unit may fill its cap; the authenticated H.264 wrapper adds 18 bytes.
 export const DESKTOP_MAX_PLAINTEXT_FRAME_BYTES = H264_MAX_ACCESS_UNIT + 18;
 function iv(direction, sequence) {
     const nonce = Buffer.alloc(12);
-    nonce.writeUInt32BE(direction === 'frame' ? 1 : 2, 0);
+    nonce.writeUInt32BE(IV_DOMAIN[direction], 0);
     nonce.writeBigUInt64BE(sequence, 4);
     return nonce;
 }
@@ -19,6 +23,7 @@ export class DesktopAead {
     requestId;
     nextFrame = 1n;
     nextInput = 1n;
+    nextControl = 1n;
     constructor(key, requestId) {
         this.key = key;
         this.requestId = requestId;
@@ -36,6 +41,18 @@ export class DesktopAead {
         header.writeBigUInt64BE(sequence);
         return Buffer.concat([header, encrypted, cipher.getAuthTag()]);
     }
+    /** Its own sequence and IV domain: a control record overtaking a frame in
+     * flight must never make that frame's sequence look stale to a viewer. */
+    encryptControl(value) {
+        const sequence = this.nextControl++;
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.key, iv('control', sequence));
+        cipher.setAAD(aad(this.requestId, 'control'));
+        const encrypted = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+        const header = Buffer.alloc(8);
+        header.writeBigUInt64BE(sequence);
+        header[0] = DESKTOP_CONTROL_MARKER;
+        return Buffer.concat([header, encrypted, cipher.getAuthTag()]);
+    }
     decryptInput(record) {
         if (record.length < 8 + 16 + 2 || record.length > 4_096)
             throw new Error('desktop input record size invalid');

package/dist/core/DesktopAead.js.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopAead.js","sourceRoot":"","sources":["../../src/core/DesktopAead.ts"],"names":[],"mappings":"AAAA;;kFAEkF;AAClF,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGzD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAAoB,GAAG,EAAE,CAAC;AAE3E,SAAS,EAAE,CAAC,SAA2B,EAAE,QAAgB;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,CAAC,aAAa,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,SAAiB,EAAE,SAA2B;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,OAAO,WAAW;IAIO,GAAG;IAA2B,SAAS;IAH5D,SAAS,GAAG,EAAE,CAAC;IACf,SAAS,GAAG,EAAE,CAAC;IAEvB,YAA6B,GAAW,EAAmB,SAAiB;mBAA/C,GAAG;yBAA2B,SAAS;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpH,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAiC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,MAAc;QACzB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,oBAA4B,EAAE,SAAiB,EAAE,SAAiB;IAGjG,IAAI,oBAAoB,CAAC,MAAM,KAAK,EAAE,IAAI,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"DesktopAead.js","sourceRoot":"","sources":["../../src/core/DesktopAead.ts"],"names":[],"mappings":"AAAA;;kFAEkF;AAClF,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGzD;2DAC2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,SAAS,GAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACvF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAAoB,GAAG,EAAE,CAAC;AAE3E,SAAS,EAAE,CAAC,SAA2B,EAAE,QAAgB;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,SAAiB,EAAE,SAA2B;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,wBAAwB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,OAAO,WAAW;IAKO,GAAG;IAA2B,SAAS;IAJ5D,SAAS,GAAG,EAAE,CAAC;IACf,SAAS,GAAG,EAAE,CAAC;IACf,WAAW,GAAG,EAAE,CAAC;IAEzB,YAA6B,GAAW,EAAmB,SAAiB;mBAA/C,GAAG;yBAA2B,SAAS;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpH,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,iCAAiC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;8EAC0E;IAC1E,cAAc,CAAC,KAAc;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,MAAc;QACzB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,oBAA4B,EAAE,SAAiB,EAAE,SAAiB;IAGjG,IAAI,oBAAoB,CAAC,MAAM,KAAK,EAAE,IAAI,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC"}

package/dist/core/DesktopHost.d.ts

@@ -43,6 +43,13 @@ export declare function isDesktopKey(key: unknown): key is DesktopKey;
 export declare function isDesktopButton(button: unknown): button is DesktopButton;
 /** Shape check applied before any host sees an action. */
 export declare function validDesktopInput(action: DesktopInput): boolean;
+/** Sealed to the input-stream helper's key. Node carries bytes it cannot read. */
+export interface DesktopSealedSecret {
+    ephemeral: string;
+    iv: string;
+    ct: string;
+    seq: number;
+}
 export interface DesktopProbe {
     screenPermission: boolean;
     inputPermission: boolean;
@@ -53,6 +60,9 @@ export interface DesktopProbe {
     onConsole?: boolean;
     loginDone?: boolean;
     screenLocked?: boolean;
+    osMajor?: number;
+    /** The classified lock reading, when the locked-screen controller exists. */
+    lockState?: import('./DesktopLockState.js').DesktopLockState;
     /** macOS only: which identity holds the permission. `own` is the helper
      * itself; `inherited` depends on what started this server's process tree. */
     screenGrant?: 'own' | 'inherited' | 'none';
@@ -61,6 +71,8 @@ export interface DesktopProbe {
     helperSource?: 'retained' | 'packaged';
     helperFallback?: string;
     helperChange?: DesktopHelperPermissionChange;
+    /** macOS only, while the locked-screen feature is on. */
+    lockInputs?: import('./DesktopLockState.js').DesktopLockInputs;
 }
 export type DesktopPlatform = 'macos' | 'windows';
 export interface DesktopDisplay {
@@ -105,7 +117,20 @@ export interface DesktopHost {
         x: number;
         y: number;
     }>;
-    input(action: DesktopInput): Promise<void>;
+    /** A `refused` reply is not a failure: the helper did nothing and lives on. */
+    input(action: DesktopInput): Promise<void | {
+        refused: string;
+    }>;
+    secretType?(input: {
+        requestId: string;
+        key: string;
+        secret: DesktopSealedSecret;
+    }): Promise<void | {
+        refused: string;
+    }>;
+    abortInput?(): void;
+    ensureInputStream?(): void;
+    setSealKeyHandler?(handler: (key: string) => void): void;
     cancelInput(): void;
     setInputFailureHandler?(handler: () => void): void;
     startIndicator(onUnexpectedExit: () => void): Promise<void>;

package/dist/core/DesktopHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopHost.d.ts","sourceRoot":"","sources":["../../src/core/DesktopHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF;oFACoF;AACpF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE;AACxC,iEAAiE;GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAChF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AAChD,gFAAgF;GAC9E;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAMxD;sEACsE;AACtE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAIC,CAAC;AAG5C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,UAAU,CAE5D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,aAAa,CAExE;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAkB/D;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;iFAC6E;IAC7E,WAAW,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;IAC3C,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE9D;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,EAAE,CAgBnE;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,mEAAmE;IACnE,YAAY,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,iBAAiB,CAAC,IAAI,OAAO,CAAC;QAAE,gBAAgB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvF,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,yEAAyE;IACzE,aAAa,CAAC,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,WAAW,CAAC,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,mBAAmB,EAAE,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnG,MAAM,CAAC,IAAI,OAAO,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,IAAI,IAAI,CAAC;IACpB,sBAAsB,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACnD,cAAc,CAAC,gBAAgB,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,aAAa,IAAI,IAAI,CAAC;CACvB"}
+{"version":3,"file":"DesktopHost.d.ts","sourceRoot":"","sources":["../../src/core/DesktopHost.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AACjF;oFACoF;AACpF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAExD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE;AACxC,iEAAiE;GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAChF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AAChD,gFAAgF;GAC9E;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAMxD;sEACsE;AACtE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAIC,CAAC;AAG5C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,UAAU,CAE5D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,aAAa,CAExE;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAkB/D;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,uBAAuB,EAAE,gBAAgB,CAAC;IAC7D;iFAC6E;IAC7E,WAAW,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;IAC3C,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,YAAY,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,yDAAyD;IACzD,UAAU,CAAC,EAAE,OAAO,uBAAuB,EAAE,iBAAiB,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAKD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE9D;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,EAAE,CAgBnE;AAED,MAAM,WAAW,WAAW;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,mEAAmE;IACnE,YAAY,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,iBAAiB,CAAC,IAAI,OAAO,CAAC;QAAE,gBAAgB,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvF,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,yEAAyE;IACzE,aAAa,CAAC,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,WAAW,CAAC,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,mBAAmB,EAAE,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnG,MAAM,CAAC,IAAI,OAAO,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,+EAA+E;IAC/E,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,UAAU,CAAC,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzH,UAAU,CAAC,IAAI,IAAI,CAAC;IACpB,iBAAiB,CAAC,IAAI,IAAI,CAAC;IAC3B,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,WAAW,IAAI,IAAI,CAAC;IACpB,sBAAsB,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACnD,cAAc,CAAC,gBAAgB,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,aAAa,IAAI,IAAI,CAAC;CACvB"}

package/dist/core/DesktopHost.js.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopHost.js","sourceRoot":"","sources":["../../src/core/DesktopHost.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACvD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAExE;sEACsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO;IAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO;IACxD,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW;IACjD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ;IAC7C,GAAG,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AAItC,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;eACvD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;eACpD,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;eAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;WAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAyCD,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,IAAI,GAAI,GAAqC,EAAE,QAAQ,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;eAClG,KAAgB,GAAG,CAAC,IAAK,KAAgB,GAAG,MAAM;eAClD,MAAiB,GAAG,CAAC,IAAK,MAAiB,GAAG,MAAM,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ;YACpC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAe,EAAE,MAAM,EAAE,MAAgB,EAAE,IAAI,EAAE,CAAC;IAC/G,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"DesktopHost.js","sourceRoot":"","sources":["../../src/core/DesktopHost.ts"],"names":[],"mappings":"AAgBA,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACvD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAExE;sEACsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO;IAC7F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO;IACxD,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW;IACjD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ;IAC7C,GAAG,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AAItC,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;AACxE,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;eACvD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;eACpD,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;eAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;WAC3D,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAsDD,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,IAAI,GAAI,GAAqC,EAAE,QAAQ,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;eAClG,KAAgB,GAAG,CAAC,IAAK,KAAgB,GAAG,MAAM;eAClD,MAAiB,GAAG,CAAC,IAAK,MAAiB,GAAG,MAAM,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ;YACpC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAe,EAAE,MAAM,EAAE,MAAgB,EAAE,IAAI,EAAE,CAAC;IAC/G,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/DesktopLockState.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Reads whether a Mac is really locked. The flag is one input, never the
+ * answer: the session-only inputs name whose session is on the console and stay
+ * true at the shield, so only the flag and the shield window can tell locked
+ * from unlocked. Fixed predicates, no model; a real frame settles capture.
+ * Spec: docs/specs/desktop-locked-screen.md, "Lock reading".
+ */
+export type DesktopLockState = 'unlocked' | 'screensaver-or-sleep' | 'locked-in-session' | 'locked-by-policy' | 'login-window-switched' | 'other-user-on-console' | 'unknown';
+/** `pending` is a refresh after a state change. It falls on the locked side. */
+export type DesktopLockPolicy = 'off' | 'on' | 'delayed' | 'unreadable' | 'pending';
+export interface DesktopLockInputs {
+    shieldWindow: boolean;
+    secureInputOwner: 'loginwindow' | 'other' | 'none' | 'unreadable';
+    displayAsleep: boolean;
+    screensaver: boolean;
+    onlineDisplays: number;
+    thisUser: string;
+    consoleUser?: string;
+    osMajor: number;
+    sampledAtMs: number;
+    bootSession?: string;
+    loginSession?: string;
+}
+export declare const LOCK_SAMPLE_MAX_AGE_MS = 2000;
+export interface DesktopLockSample {
+    screenLocked?: boolean;
+    onConsole?: boolean;
+    loginDone?: boolean;
+    osMajor?: number;
+    lockInputs?: DesktopLockInputs;
+}
+/** `unknown` comes first: a stale, partial or self-contradicting sample never
+ * reaches the table. */
+export declare function classifyDesktopLock(sample: DesktopLockSample, policy: DesktopLockPolicy, nowMs: number): DesktopLockState;
+export declare function isLockedClass(state: DesktopLockState): boolean;
+/** Parses `sysadminctl -screenLock status`, which reports on stderr. */
+export declare function parseScreenLockPolicy(output: string): DesktopLockPolicy;
+//# sourceMappingURL=DesktopLockState.d.ts.map

package/dist/core/DesktopLockState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DesktopLockState.d.ts","sourceRoot":"","sources":["../../src/core/DesktopLockState.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB,UAAU,GAAG,sBAAsB,GAAG,mBAAmB,GAAG,kBAAkB,GAC9E,uBAAuB,GAAG,uBAAuB,GAAG,SAAS,CAAC;AAElE,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,sBAAsB,OAAQ,CAAC;AAE5C,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC;AAED;wBACwB;AACxB,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAiBzH;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAKvE"}

package/dist/core/DesktopLockState.js

@@ -0,0 +1,43 @@
+export const LOCK_SAMPLE_MAX_AGE_MS = 2_000;
+/** `unknown` comes first: a stale, partial or self-contradicting sample never
+ * reaches the table. */
+export function classifyDesktopLock(sample, policy, nowMs) {
+    const inputs = sample.lockInputs;
+    const flag = sample.screenLocked;
+    if (!inputs || typeof flag !== 'boolean' || typeof sample.onConsole !== 'boolean'
+        || typeof sample.loginDone !== 'boolean' || !inputs.thisUser
+        || Math.abs(nowMs - inputs.sampledAtMs) > LOCK_SAMPLE_MAX_AGE_MS)
+        return 'unknown';
+    const console = inputs.consoleUser;
+    const quiet = inputs.screensaver || inputs.displayAsleep;
+    if (!flag && inputs.shieldWindow)
+        return 'unknown';
+    if (flag && !inputs.shieldWindow && !quiet)
+        return 'unknown';
+    if (console && console !== 'loginwindow' && console !== 'root' && console !== inputs.thisUser)
+        return 'other-user-on-console';
+    if (!console || console === 'loginwindow' || console === 'root' || !sample.onConsole)
+        return 'login-window-switched';
+    if (flag && inputs.shieldWindow)
+        return 'locked-in-session';
+    if (quiet && (flag || policy !== 'off'))
+        return 'locked-by-policy';
+    if (quiet)
+        return 'screensaver-or-sleep';
+    if (!flag && !inputs.shieldWindow)
+        return 'unlocked';
+    return 'unknown';
+}
+export function isLockedClass(state) {
+    return state === 'locked-in-session' || state === 'locked-by-policy' || state === 'unknown';
+}
+/** Parses `sysadminctl -screenLock status`, which reports on stderr. */
+export function parseScreenLockPolicy(output) {
+    if (/screenLock is off/i.test(output))
+        return 'off';
+    const delay = /screenLock delay is (-?\d+)/i.exec(output);
+    if (!delay)
+        return /immediate/i.test(output) ? 'on' : 'unreadable';
+    return Number(delay[1]) === 0 ? 'on' : 'delayed';
+}
+//# sourceMappingURL=DesktopLockState.js.map

package/dist/core/DesktopLockState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DesktopLockState.js","sourceRoot":"","sources":["../../src/core/DesktopLockState.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAU5C;wBACwB;AACxB,MAAM,UAAU,mBAAmB,CAAC,MAAyB,EAAE,MAAyB,EAAE,KAAa;IACrG,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS;WAC5E,OAAO,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ;WACzD,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC;IACzD,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,OAAO,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IAC9H,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,aAAa,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,uBAAuB,CAAC;IACrH,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,mBAAmB,CAAC;IAC5D,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACnE,IAAI,KAAK;QAAE,OAAO,sBAAsB,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,OAAO,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,KAAK,SAAS,CAAC;AAC9F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC"}