replicas-computer 0.3.26 → 0.3.28

package/README.md

@@ -15,7 +15,7 @@ The versioned computer-use runtime for Replicas workspace images.
 - `src/viewer.ts` owns the optional noVNC fallback.
 - `assets/desktop/start-services.sh` owns the X11 and stream process lifecycle.
 - `xsettingsd` broadcasts theme changes to running GTK apps and Chrome. Chrome follows the dashboard theme without reopening tabs; launch it without a `GTK_THEME` override.
-- `assets/desktop/` owns the desktop theme: `wallpapers/` (a light and dark JPEG per scene; each new desktop picks a different scene), `tint2rc` dock, `openbox-theme/`, `gtk-settings.ini`, the `replicas-terminal` wrapper, `themes/` palettes that `start-services.sh` renders into those templates (`--theme light|dark` switches a running desktop), and the bundled fonts (static TTF instances of General Sans and Geist Mono; variable and WOFF2 builds render with wrong metrics in Pango and VTE).
+- `assets/desktop/` owns the desktop theme: `wallpapers/` (a light and dark JPEG per scene; each new desktop picks a different scene), `tint2rc` dock, `topbar-tint2rc` top bar (the `replicas-symbol.svg` logo and the clock), `openbox-theme/`, `gtk-settings.ini`, the `replicas-terminal` wrapper, `themes/` palettes that `start-services.sh` renders into those templates (`--theme light|dark` switches a running desktop), and the bundled fonts (static TTF instances of General Sans and Geist Mono; variable and WOFF2 builds render with wrong metrics in Pango and VTE).
 
 The viewer and agent command paths are independent. `start-services.sh` runs Xvfb, the compositor, PulseAudio and the stream server (and so the encoders it spawns) at nice −10 when `sudo` is available, so CPU load from the apps on the desktop slows those apps instead of stalling the picture of them. One on-demand encoder pair is shared by all viewers, stops when the last viewer disconnects, and restarts without reloading the page. A viewer out of sight (the dashboard keeps one connected while the Desktop tab is hidden) reports `standby`, detected with an `IntersectionObserver` because a hidden iframe keeps its last layout size; while every viewer is in standby the encoder runs at 5 fps on the 1.5 Mbps rung, and the first viewer to become visible returns it to full rate in place.
 

package/assets/desktop/replicas-symbol.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="@BRAND@" shape-rendering="crispEdges">
+  <path d="M3 0h12v6H3zm12 6h6v6h-6zM3 12h12v6H3zm0 6h6v6H3zm12 0h6v6h-6z"/>
+</svg>

package/assets/desktop/start-services.sh

@@ -336,6 +336,8 @@ mkdir -p \
   "$HOME/.icons/default"
 
 [ -f "$REPLICAS_DESKTOP_TEMPLATES/tint2rc" ] && render_template "$REPLICAS_DESKTOP_TEMPLATES/tint2rc" "$HOME/.config/tint2/tint2rc"
+[ -f "$REPLICAS_DESKTOP_TEMPLATES/topbar-tint2rc" ] && render_template "$REPLICAS_DESKTOP_TEMPLATES/topbar-tint2rc" "$HOME/.config/tint2/topbar-tint2rc"
+[ -f "$REPLICAS_DESKTOP_TEMPLATES/replicas-symbol.svg" ] && render_template "$REPLICAS_DESKTOP_TEMPLATES/replicas-symbol.svg" "$HOME/.config/tint2/replicas-symbol.svg"
 [ -f "$REPLICAS_DESKTOP_TEMPLATES/openbox-rc.xml" ] && cp "$REPLICAS_DESKTOP_TEMPLATES/openbox-rc.xml" "$HOME/.config/openbox/rc.xml"
 [ -f "$REPLICAS_DESKTOP_TEMPLATES/picom.conf" ] && cp "$REPLICAS_DESKTOP_TEMPLATES/picom.conf" "$HOME/.config/picom/picom.conf"
 [ -f "$REPLICAS_DESKTOP_TEMPLATES/gtk-settings.ini" ] && render_template "$REPLICAS_DESKTOP_TEMPLATES/gtk-settings.ini" "$HOME/.config/gtk-3.0/settings.ini"
@@ -395,14 +397,17 @@ paint_wallpaper
 
 if [ -n "$REQUESTED_THEME" ] && [ "$THEME" != "$PREVIOUS_THEME" ]; then
   DISPLAY=":$DISPLAY_NUM" openbox --reconfigure >/dev/null 2>&1 || true
-  kill_pids "$(cat "$STATE_DIR/tint2.pid" 2>/dev/null)"
-  rm -f "$STATE_DIR/tint2.pid"
+  kill_pids "$(cat "$STATE_DIR/tint2.pid" "$STATE_DIR/topbar.pid" 2>/dev/null)"
+  rm -f "$STATE_DIR/tint2.pid" "$STATE_DIR/topbar.pid"
 fi
 
 # tint2 panel anchors window stacking on bare openbox.
 start_bg tint2 \
   "false" \
   "DISPLAY=:$DISPLAY_NUM exec tint2"
+start_bg topbar \
+  "false" \
+  "DISPLAY=:$DISPLAY_NUM exec tint2 -c $HOME/.config/tint2/topbar-tint2rc"
 
 if [ "$COMPOSITOR" = "1" ]; then
   start_bg picom \

package/assets/desktop/themes/dark.env

@@ -12,3 +12,4 @@ INK_DISABLED='#5c5c5c'
 LINE='#ffffff'
 ACCENT='#3cba85'
 ACCENT_INK='#3cba85'
+BRAND='#3eeba3'

package/assets/desktop/themes/light.env

@@ -12,3 +12,4 @@ INK_DISABLED='#b9c1b8'
 LINE='#162118'
 ACCENT='#2fc487'
 ACCENT_INK='#2f9d57'
+BRAND='#2f9d57'

package/assets/desktop/tint2rc

@@ -47,7 +47,7 @@ border_width = 1
 background_color = @SURFACE_ALT@ 96
 border_color = @LINE@ 16
 
-panel_items = LT:C
+panel_items = LT
 panel_size = 100% 72
 panel_margin = 0 12
 panel_padding = 10 7 6
@@ -103,22 +103,6 @@ task_active_icon_asb = 100 0 0
 task_iconified_icon_asb = 55 0 0
 urgent_nb_of_blink = 8
 
-separator = new
-separator_background_id = 0
-separator_color = @LINE@ 18
-separator_style = line
-separator_size = 1
-separator_padding = 6 14
-
-time1_format = %H:%M
-time2_format = %a %-d %b
-time1_font = General Sans Semibold 12
-time2_font = Geist Mono 8
-clock_font_color = @INK@ 100
-clock_padding = 12 0
-clock_background_id = 0
-clock_tooltip = %A, %B %-d
-
 tooltip_padding = 10 6
 tooltip_show_timeout = 0.4
 tooltip_hide_timeout = 0.1

package/assets/desktop/topbar-tint2rc

@@ -0,0 +1,33 @@
+rounded = 0
+border_width = 1
+border_sides = B
+background_color = @SURFACE@ 100
+border_color = @LINE@ 10
+
+panel_items = PFC
+panel_size = 100% 36
+panel_margin = 0 0
+panel_padding = 0 0 0
+panel_background_id = 1
+panel_position = top center horizontal
+panel_layer = top
+panel_monitor = all
+panel_window_name = tint2-topbar
+disable_transparency = 1
+strut_policy = follow_size
+wm_menu = 0
+font_shadow = 0
+mouse_effects = 0
+
+button = new
+button_icon = ~/.config/tint2/replicas-symbol.svg
+button_padding = 13 0 0
+button_background_id = 0
+button_centered = 0
+button_max_icon_size = 24
+
+time1_format = %a %-d %b   %H:%M
+time1_font = General Sans 11
+clock_font_color = @INK@ 100
+clock_padding = 16 0
+clock_background_id = 0

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/client.ts
-import { createConnection as createConnection2 } from "net";
+import { createConnection as createConnection3 } from "net";
 
 // src/daemon.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync5, rmSync as rmSync4 } from "fs";
-import { createConnection, createServer } from "net";
+import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync6, rmSync as rmSync5 } from "fs";
+import { createConnection as createConnection2, createServer as createServer2 } from "net";
 import { dirname as dirname5 } from "path";
 
 // src/commands/desktop.ts
@@ -14,8 +14,23 @@ import { spawnSync } from "child_process";
 import { existsSync, mkdirSync, readFileSync } from "fs";
 import { dirname, isAbsolute, resolve } from "path";
 
+// ../shared/src/type-guards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // ../shared/src/engine/environment.ts
 var DESKTOP_STREAM_PORT = 6080;
+var DEVICES_DIR = ".ssh/replicas-devices";
+var DEVICE_SCREEN_FILE_SUFFIX = ".screen.json";
+function parseDeviceScreenState(value) {
+  if (!isRecord(value)) return null;
+  if (value.state === "connected" && typeof value.width === "number" && typeof value.height === "number") {
+    return { state: "connected", width: value.width, height: value.height };
+  }
+  if (value.state === "failed" && typeof value.reason === "string") return { state: "failed", reason: value.reason };
+  return value.state === "connecting" ? { state: "connecting" } : null;
+}
 function getDesktopViewerUrl(publicUrl) {
   const url = new URL(`${publicUrl.replace(/\/$/, "")}/`);
   url.searchParams.set("v", "15");
@@ -31,6 +46,7 @@ var STREAM_PORT = process.env.REPLICAS_DESKTOP_STREAM_PORT ? parseInt(process.en
 var SERVICES_SCRIPT = process.env.REPLICAS_COMPUTER_SERVICES_SCRIPT || "/usr/local/bin/replicas-start-desktop-services";
 var INPUT_LOCK_FILE = process.env.REPLICAS_DESKTOP_INPUT_LOCK_FILE || `${STATE_DIR}/input.lock`;
 var CHROME_WRAPPER = "/usr/local/bin/replicas-chrome";
+var NOVNC_VIEWER_ROOT = "/usr/local/share/replicas/desktop/novnc";
 var TERMINAL_WRAPPER = "/usr/local/bin/replicas-terminal";
 var INFO_WAIT_TIMEOUT_MS = 1e4;
 var INFO_WAIT_INTERVAL_MS = 500;
@@ -58,7 +74,7 @@ function getDesktopBridgeStatus() {
 }
 function desktopStackHealthy() {
   const pids = {};
-  for (const name of ["openbox", "tint2", "stream"]) {
+  for (const name of ["openbox", "tint2", "topbar", "stream"]) {
     try {
       const pid = Number.parseInt(readFileSync(`${STATE_DIR}/${name}.pid`, "utf8").trim(), 10);
       if (!Number.isFinite(pid)) return false;
@@ -1111,11 +1127,6 @@ async function computerRecordStopCommand() {
   clearRecordingState();
 }
 
-// ../shared/src/type-guards.ts
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 // src/lib/chrome-session.ts
 async function openChromeSession(webSocketDebuggerUrl) {
   const socket = new WebSocket(webSocketDebuggerUrl);
@@ -2996,11 +3007,193 @@ async function computerDragCommand(fx, fy, tx, ty) {
   console.log(`dragged (${fromX},${fromY}) -> (${toX},${toY})`);
 }
 
-// src/commands/system.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { readFileSync as readFileSync5 } from "fs";
+// src/commands/screen.ts
+import { spawn as spawn3 } from "child_process";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync5, openSync, readdirSync as readdirSync2, readFileSync as readFileSync5, rmSync as rmSync4, symlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { createConnection, createServer } from "net";
 import { homedir } from "os";
 import { join } from "path";
+import { setTimeout as sleep2 } from "timers/promises";
+var SCREEN_PORT = 5900;
+var CONNECT_TIMEOUT_MS = 3e4;
+var devicesDir = join(homedir(), DEVICES_DIR);
+function ownsProcess(session, pid) {
+  try {
+    return readFileSync5(`/proc/${pid}/cmdline`, "utf8").split("\0").some((arg) => arg.includes(`127.0.0.1:${session.tunnelPort}`));
+  } catch {
+    return false;
+  }
+}
+function isListening(port2) {
+  return new Promise((resolve5) => {
+    const socket = createConnection({ host: "127.0.0.1", port: port2 });
+    const done = (listening) => {
+      socket.destroy();
+      resolve5(listening);
+    };
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+    socket.setTimeout(1e3, () => done(false));
+  });
+}
+async function freePorts(count) {
+  const servers = await Promise.all(Array.from({ length: count }, () => new Promise((resolve5, reject) => {
+    const server = createServer().once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve5(server));
+  })));
+  const ports = servers.map((server) => {
+    const address = server.address();
+    return typeof address === "object" && address ? address.port : fail("Could not reserve a local port");
+  });
+  await Promise.all(servers.map((server) => new Promise((resolve5) => server.close(resolve5))));
+  return ports;
+}
+function spawnLogged(bin, args, log) {
+  const fd = openSync(log, "a");
+  const child = spawn3(bin, args, { detached: true, stdio: ["ignore", fd, fd] });
+  closeSync(fd);
+  child.unref();
+  let exited = false;
+  child.once("exit", () => {
+    exited = true;
+  });
+  return { pid: child.pid ?? fail(`Could not start ${bin}`), exited: () => exited };
+}
+async function waitForPort(port2, child) {
+  const deadline = Date.now() + CONNECT_TIMEOUT_MS;
+  while (Date.now() < deadline && !child.exited()) {
+    if (await isListening(port2)) return true;
+    await sleep2(200);
+  }
+  return false;
+}
+function readBanner(port2) {
+  return new Promise((resolve5) => {
+    const socket = createConnection({ host: "127.0.0.1", port: port2 });
+    let banner = "";
+    const done = () => {
+      socket.destroy();
+      resolve5(banner);
+    };
+    socket.setTimeout(1e4, done);
+    socket.on("data", (chunk) => {
+      banner += chunk.toString("latin1");
+      if (banner.length >= 12) done();
+    });
+    socket.once("error", done);
+    socket.once("close", done);
+  });
+}
+function readSession(file) {
+  try {
+    const value = JSON.parse(readFileSync5(file, "utf8"));
+    return isRecord(value) && typeof value.webPort === "number" && typeof value.tunnelPort === "number" && Array.isArray(value.pids) && value.pids.every((pid) => typeof pid === "number") ? { webPort: value.webPort, tunnelPort: value.tunnelPort, pids: value.pids } : null;
+  } catch {
+    return null;
+  }
+}
+async function closeScreen(dir, session) {
+  if (session) {
+    const pages = await getChromePages().catch(() => []);
+    for (const page of pages) {
+      if (page.webSocketDebuggerUrl && page.url?.startsWith(`http://127.0.0.1:${session.webPort}/`)) {
+        await sendChromeCommand(page.webSocketDebuggerUrl, "Page.close", {}).catch(() => void 0);
+      }
+    }
+    for (const pid of session.pids.filter((candidate) => ownsProcess(session, candidate))) {
+      try {
+        process.kill(pid);
+      } catch {
+      }
+    }
+  }
+  rmSync4(dir, { recursive: true, force: true });
+}
+async function openSession(device, dir, previous) {
+  await closeScreen(dir, previous);
+  const web = join(dir, "web");
+  mkdirSync5(web, { recursive: true, mode: 448 });
+  for (const entry of readdirSync2(NOVNC_VIEWER_ROOT)) symlinkSync(join(NOVNC_VIEWER_ROOT, entry), join(web, entry));
+  const credentials = join(devicesDir, `${device}${DEVICE_SCREEN_FILE_SUFFIX}`);
+  if (existsSync5(credentials)) symlinkSync(credentials, join(web, "credentials.json"));
+  const [tunnelPort, webPort] = await freePorts(2);
+  const tunnelLog = join(dir, "tunnel.log");
+  const tunnel = spawnLogged("ssh", ["-N", "-o", "BatchMode=yes", "-o", "ExitOnForwardFailure=yes", "-L", `127.0.0.1:${tunnelPort}:localhost:${SCREEN_PORT}`, device], tunnelLog);
+  const pids = [tunnel.pid];
+  const abort = (message) => {
+    for (const pid of pids) {
+      try {
+        process.kill(pid);
+      } catch {
+      }
+    }
+    return fail(message);
+  };
+  if (!await waitForPort(tunnelPort, tunnel)) abort(`Could not connect to ${device} over SSH: ${readFileSync5(tunnelLog, "utf8").trim() || "timed out"}`);
+  if (!(await readBanner(tunnelPort)).startsWith("RFB ")) {
+    abort(`${device} isn't sharing its screen: nothing answered on port ${SCREEN_PORT}. On a Mac, turn on Screen Sharing in System Settings \u2192 General \u2192 Sharing.`);
+  }
+  const bridgeLog = join(dir, "bridge.log");
+  const bridge = spawnLogged("websockify", ["--web", web, `127.0.0.1:${webPort}`, `127.0.0.1:${tunnelPort}`], bridgeLog);
+  pids.push(bridge.pid);
+  if (!await waitForPort(webPort, bridge)) abort(`Could not start the screen viewer: ${readFileSync5(bridgeLog, "utf8").trim() || "timed out"}`);
+  const session = { webPort, tunnelPort, pids };
+  writeFileSync5(join(dir, "session.json"), JSON.stringify(session));
+  return session;
+}
+async function computerScreenCommand(device, options) {
+  if (!/^[a-z0-9-]+$/.test(device)) fail(`Invalid device name: ${device}`);
+  const dir = join(STATE_DIR, "screens", device);
+  const previous = readSession(join(dir, "session.json"));
+  if (options.close) {
+    await closeScreen(dir, previous);
+    console.log(`Closed ${device}'s screen`);
+    return;
+  }
+  if (!existsSync5(join(devicesDir, device))) {
+    const names = existsSync5(devicesDir) ? readdirSync2(devicesDir).filter((name) => name !== "devices.conf" && !name.endsWith(DEVICE_SCREEN_FILE_SUFFIX)) : [];
+    fail(names.length > 0 ? `No device named ${device}. Devices: ${names.join(", ")}.` : "This workspace has no devices. Add them in the environment's Devices settings.");
+  }
+  ensureServicesRunning();
+  const session = previous && previous.pids.every((pid) => ownsProcess(previous, pid)) && await isListening(previous.webPort) ? previous : await openSession(device, dir, previous);
+  try {
+    await showScreen(device, session);
+  } catch (error) {
+    await closeScreen(dir, session);
+    throw error;
+  }
+}
+async function showScreen(device, session) {
+  const origin = `http://127.0.0.1:${session.webPort}/`;
+  const findPage = async () => (await getChromePages().catch(() => [])).find((page2) => page2.webSocketDebuggerUrl && page2.url?.startsWith(origin));
+  let page = await findPage();
+  if (!page) {
+    spawn3(CHROME_WRAPPER, ["--new-window", `--app=${origin}?device=${device}&requestFps=0`], { env: withDisplay(), detached: true, stdio: "ignore" }).unref();
+    const deadline2 = Date.now() + CONNECT_TIMEOUT_MS;
+    while (!page && Date.now() < deadline2) {
+      await sleep2(250);
+      page = await findPage();
+    }
+  }
+  const target = page?.webSocketDebuggerUrl ?? fail("Chrome did not open the screen viewer");
+  let state = { state: "connecting" };
+  const deadline = Date.now() + CONNECT_TIMEOUT_MS;
+  while (state.state === "connecting" && Date.now() < deadline) {
+    state = parseDeviceScreenState(await evaluateChromeTarget(target, "globalThis.__replicasScreen ?? null").catch(() => null)) ?? state;
+    if (state.state === "connecting") await sleep2(250);
+  }
+  if (state.state !== "connected") {
+    fail(state.state === "failed" ? state.reason : `${device}'s screen didn't connect within ${CONNECT_TIMEOUT_MS / 1e3} seconds.`);
+  }
+  await sendChromeCommand(target, "Page.bringToFront", {});
+  console.log(`Showing ${device}'s screen (${state.width}\xD7${state.height}) in a window on this desktop. Drive it with \`replicas computer observe\`, \`click\`, \`type\` and \`key\`; \`replicas computer screen ${device} --close\` closes it.`);
+}
+
+// src/commands/system.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 import chalk from "chalk";
 function bridgeStatus(details, includeBacklog = false, rootsOnly = false) {
   const pids = rootsOnly ? details.rootPids ?? [] : details.listenerPids ?? [];
@@ -3014,7 +3207,7 @@ function bridgeStatus(details, includeBacklog = false, rootsOnly = false) {
 }
 async function lookupDesktopViewerUrl() {
   try {
-    const value = JSON.parse(readFileSync5(join(homedir(), ".replicas", "preview-ports.json"), "utf8"));
+    const value = JSON.parse(readFileSync6(join2(homedir2(), ".replicas", "preview-ports.json"), "utf8"));
     if (!isRecord(value) || !Array.isArray(value.previews)) return null;
     const preview = value.previews.find(
       (item) => isRecord(item) && item.port === STREAM_PORT && typeof item.publicUrl === "string"
@@ -3050,7 +3243,8 @@ async function computerStatusCommand() {
     ["Xvfb", "Xvfb"],
     ["openbox", "openbox"],
     ["XSETTINGS", "xsettingsd"],
-    ["tint2", "tint2"],
+    ["dock", "^tint2$"],
+    ["top bar", "tint2 -c .*topbar"],
     ["PulseAudio", "pulseaudio"],
     ["desktop stream", "replicas-computer.*stream"]
   ];
@@ -3069,7 +3263,7 @@ async function computerStatusCommand() {
 }
 
 // src/version.ts
-var COMPUTER_USE_VERSION = "0.3.26";
+var COMPUTER_USE_VERSION = "0.3.28";
 var COMPUTER_USE_PROTOCOL_VERSION = 1;
 
 // src/program.ts
@@ -3107,6 +3301,7 @@ function createProgram() {
   program.command("scroll <direction>").description("Scroll the desktop").option("--amount <n>", "Wheel ticks").option("--x <x>", "Pointer x").option("--y <y>", "Pointer y").action((direction, options) => computerScrollCommand(direction, options));
   program.command("drag <fromX> <fromY> <toX> <toY>").description("Drag between desktop coordinates").action((fromX, fromY, toX, toY) => computerDragCommand(fromX, fromY, toX, toY));
   program.command("launch <app> [args...]").description("Launch an application on the desktop").action((app, args) => computerLaunchCommand(app, args));
+  program.command("screen <device>", { hidden: true }).description("Show a device's screen in a window on this desktop, where the other commands drive it").option("--close", "Close the window and its connection").action((device, options) => computerScreenCommand(device, options));
   const record = program.command("record").description("Record the workspace display");
   record.command("start <path>").description("Start a recording").option("--fps <n>", "Frame rate. Default 60.").action((path, options) => computerRecordStartCommand(path, options));
   record.command("stop").description("Stop and finalize the active recording").action(() => computerRecordStopCommand());
@@ -3158,9 +3353,9 @@ function writeResult(socket, result) {
 `);
 }
 async function hasSocketListener() {
-  if (!existsSync5(COMPUTER_USE_SOCKET_PATH)) return false;
+  if (!existsSync6(COMPUTER_USE_SOCKET_PATH)) return false;
   return await new Promise((resolve5) => {
-    const socket = createConnection(COMPUTER_USE_SOCKET_PATH);
+    const socket = createConnection2(COMPUTER_USE_SOCKET_PATH);
     socket.setTimeout(500, () => socket.destroy());
     socket.once("connect", () => {
       socket.destroy();
@@ -3173,11 +3368,11 @@ async function hasSocketListener() {
 async function runComputerDaemon() {
   if (await hasSocketListener()) throw new Error(`Computer-use daemon is already listening on ${COMPUTER_USE_SOCKET_PATH}`);
   ensureServicesRunning();
-  mkdirSync5(dirname5(COMPUTER_USE_SOCKET_PATH), { recursive: true, mode: 448 });
-  rmSync4(COMPUTER_USE_SOCKET_PATH, { force: true });
+  mkdirSync6(dirname5(COMPUTER_USE_SOCKET_PATH), { recursive: true, mode: 448 });
+  rmSync5(COMPUTER_USE_SOCKET_PATH, { force: true });
   let queue = Promise.resolve();
   const clients = /* @__PURE__ */ new Set();
-  const server = createServer({ allowHalfOpen: true }, (socket) => {
+  const server = createServer2({ allowHalfOpen: true }, (socket) => {
     if (clients.size >= MAX_CLIENTS) {
       writeResult(socket, { exitCode: 75, stdout: "", stderr: "Computer-use daemon is busy; retry the request\n" });
       return;
@@ -3250,7 +3445,7 @@ async function runComputerDaemon() {
     process.once("SIGINT", close);
   });
   spawnSync5("bash", [SERVICES_SCRIPT, "--stop"], { stdio: "inherit" });
-  rmSync4(COMPUTER_USE_SOCKET_PATH, { force: true });
+  rmSync5(COMPUTER_USE_SOCKET_PATH, { force: true });
 }
 
 // src/client.ts
@@ -3259,7 +3454,7 @@ var ComputerDaemonUnavailableError = class extends Error {
 };
 function sendComputerRequest(argv) {
   return new Promise((resolve5, reject) => {
-    const socket = createConnection2(COMPUTER_USE_SOCKET_PATH);
+    const socket = createConnection3(COMPUTER_USE_SOCKET_PATH);
     let response = "";
     let settled = false;
     const finish = (error, result) => {
@@ -3310,17 +3505,17 @@ async function runComputerClient(argv) {
 }
 
 // src/media-server.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { createReadStream, existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { createServer as createServer2 } from "http";
+import { createReadStream, existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { createServer as createServer3 } from "http";
 import { availableParallelism as availableParallelism2, loadavg } from "os";
 import { dirname as dirname7, extname, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import WebSocket2, { WebSocketServer } from "ws";
 
 // src/encoder.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createSocket } from "dgram";
 import { createInterface } from "readline";
 
@@ -3555,7 +3750,7 @@ function superviseEncoder(options) {
     const warmupFrames = active ? options.warmupFrames ?? 0 : 0;
     const command = options.command?.() ?? "ffmpeg";
     const args = options.args(socket.address().port, warmupFrames);
-    const child = spawn3(command, args, { env: options.env, stdio: [options.controllable?.(command) ? "pipe" : "ignore", options.onOutput ? "pipe" : "ignore", "pipe"] });
+    const child = spawn4(command, args, { env: options.env, stdio: [options.controllable?.(command) ? "pipe" : "ignore", options.onOutput ? "pipe" : "ignore", "pipe"] });
     child.stdin?.on("error", () => {
     });
     child.stderr?.on("data", (chunk) => process.stderr.write(`[desktop-stream] ${chunk}`));
@@ -3657,7 +3852,7 @@ function superviseEncoder(options) {
 }
 
 // src/ice-servers.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // ../shared/src/desktop-stream.ts
 function isStreamIceServer(value) {
@@ -3802,7 +3997,7 @@ var refreshing;
 async function currentIceServers() {
   let env = process.env;
   try {
-    env = { ...env, ...parsePosixEnvFile(readFileSync6(runtimeEnvFile, "utf8")) };
+    env = { ...env, ...parsePosixEnvFile(readFileSync7(runtimeEnvFile, "utf8")) };
   } catch {
   }
   const monolithUrl = readReplicasRuntimeEnv((name) => env[name], REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl);
@@ -3856,7 +4051,7 @@ function toIceServers(spec = "stun:stun.l.google.com:19302", relayServers) {
 }
 
 // src/video-encoder.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { availableParallelism } from "os";
 import { dirname as dirname6, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
@@ -4305,7 +4500,7 @@ var captureBinary = resolve2(dirname6(fileURLToPath(import.meta.url)), "..", "di
 function superviseVideoEncoder(options) {
   const { display: display2, width: width2, height: height2, colorMode: colorMode2 } = options;
   const env = { ...process.env, DISPLAY: display2 };
-  let nativeCapture = process.env.REPLICAS_DESKTOP_STREAM_CAPTURE !== "ffmpeg" && existsSync6(captureBinary);
+  let nativeCapture = process.env.REPLICAS_DESKTOP_STREAM_CAPTURE !== "ffmpeg" && existsSync7(captureBinary);
   let captureMetrics;
   const encoder = superviseEncoder({
     label: "video",
@@ -4479,7 +4674,7 @@ function superviseVideoEncoder(options) {
 }
 
 // src/input-bridge.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 var scrollPixelsPerStep = 80;
 var namedKeys = {
   AltLeft: "Alt_L",
@@ -4660,7 +4855,7 @@ var InputBridge = class {
   }
   write(command) {
     if (!this.process || this.process.exitCode !== null || this.process.stdin.destroyed) {
-      const child = spawn4("xte", [], {
+      const child = spawn5("xte", [], {
         env: { ...process.env, DISPLAY: this.display },
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -4761,7 +4956,7 @@ function drainDesktopTheme() {
     if (applied) appliedTheme = theme;
     drainDesktopTheme();
   };
-  const child = spawn5("bash", [SERVICES_SCRIPT, "--theme", theme], { detached: true, stdio: "ignore" });
+  const child = spawn6("bash", [SERVICES_SCRIPT, "--theme", theme], { detached: true, stdio: "ignore" });
   child.unref();
   child.once("exit", (code) => finish(code === 0));
   child.once("error", () => finish(false));
@@ -4769,7 +4964,7 @@ function drainDesktopTheme() {
 function processCpuMs(pid) {
   if (!pid) return 0;
   try {
-    const stat = readFileSync7(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync8(`/proc/${pid}/stat`, "utf8");
     const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
     return (Number(fields[11]) + Number(fields[12])) * 10;
   } catch {
@@ -5497,7 +5692,7 @@ async function runMediaServer() {
     audioSampleRate: 48e3,
     audioChannels: 2
   };
-  const httpServer = createServer2((request, response) => {
+  const httpServer = createServer3((request, response) => {
     const url = new URL(request.url || "/", "http://localhost");
     if (url.pathname === "/health" || url.pathname === "/telemetry") {
       const all = [...viewers.values()];
@@ -5551,7 +5746,7 @@ async function runMediaServer() {
       return;
     }
     if (url.pathname === "/snapshot") {
-      const capture = spawn5("ffmpeg", [
+      const capture = spawn6("ffmpeg", [
         "-hide_banner",
         "-loglevel",
         "error",
@@ -5588,7 +5783,7 @@ async function runMediaServer() {
     }
     const requested = url.pathname === "/" ? "stream-index.html" : url.pathname.slice(1);
     const path = resolve3(webroot, requested);
-    if (!path.startsWith(resolve3(webroot) + "/") || !existsSync7(path) || !statSync2(path).isFile()) {
+    if (!path.startsWith(resolve3(webroot) + "/") || !existsSync8(path) || !statSync2(path).isFile()) {
       response.statusCode = 404;
       response.end("Not found");
       return;
@@ -5600,8 +5795,8 @@ async function runMediaServer() {
       if (webrtc) void currentIceServers();
       response.setHeader("cache-control", "no-store");
       const digest = createHash3("sha1");
-      for (const name of readdirSync2(webroot).filter((file) => /\.(js|css)$/.test(file)).sort()) digest.update(readFileSync7(resolve3(webroot, name)));
-      response.end(readFileSync7(path, "utf8").replaceAll("__VERSION__", `${COMPUTER_USE_VERSION}-${digest.digest("hex").slice(0, 8)}`));
+      for (const name of readdirSync3(webroot).filter((file) => /\.(js|css)$/.test(file)).sort()) digest.update(readFileSync8(resolve3(webroot, name)));
+      response.end(readFileSync8(path, "utf8").replaceAll("__VERSION__", `${COMPUTER_USE_VERSION}-${digest.digest("hex").slice(0, 8)}`));
       return;
     }
     response.setHeader("cache-control", "private, max-age=31536000, immutable");
@@ -5713,7 +5908,7 @@ async function runMediaServer() {
 
 // src/setup.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { accessSync, chmodSync as chmodSync2, constants, cpSync, existsSync as existsSync8, mkdirSync as mkdirSync6, readdirSync as readdirSync3, writeFileSync as writeFileSync5 } from "fs";
+import { accessSync, chmodSync as chmodSync2, constants, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname8, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var dependencies = [
@@ -5814,7 +6009,7 @@ async function setupComputer(options = {}) {
   const noVncPackageRoot = dirname8(dirname8(fileURLToPath3(import.meta.resolve("@novnc/novnc"))));
   const noVncCore = resolve4(noVncPackageRoot, "core");
   const noVncVendor = resolve4(noVncPackageRoot, "vendor");
-  if (!existsSync8(noVncCore) || !existsSync8(noVncVendor)) {
+  if (!existsSync9(noVncCore) || !existsSync9(noVncVendor)) {
     missing.push("bundled noVNC client");
     console.error("\u2717 bundled noVNC client");
   } else {
@@ -5831,23 +6026,22 @@ async function setupComputer(options = {}) {
   if (process.getuid?.() !== 0) throw new Error("replicas-computer setup must run as root to install runtime files");
   const packageRoot2 = resolve4(dirname8(fileURLToPath3(import.meta.url)), "..");
   const assets = resolve4(packageRoot2, "assets", "desktop");
-  if (!existsSync8(assets)) throw new Error(`Computer-use assets are missing from ${assets}`);
-  mkdirSync6("/usr/local/share/replicas/desktop", { recursive: true });
+  if (!existsSync9(assets)) throw new Error(`Computer-use assets are missing from ${assets}`);
+  mkdirSync7("/usr/local/share/replicas/desktop", { recursive: true });
   cpSync(assets, "/usr/local/share/replicas/desktop", { recursive: true, force: true });
   const fontRoot = "/usr/local/share/fonts/replicas";
-  mkdirSync6(fontRoot, { recursive: true });
-  for (const file of readdirSync3(assets).filter((name) => name.endsWith(".ttf"))) cpSync(resolve4(assets, file), resolve4(fontRoot, file), { force: true });
+  mkdirSync7(fontRoot, { recursive: true });
+  for (const file of readdirSync4(assets).filter((name) => name.endsWith(".ttf"))) cpSync(resolve4(assets, file), resolve4(fontRoot, file), { force: true });
   spawnSync6("fc-cache", ["-f", fontRoot], { stdio: "ignore" });
-  const viewerRoot = "/usr/local/share/replicas/desktop/novnc";
-  mkdirSync6(viewerRoot, { recursive: true });
-  cpSync(noVncCore, resolve4(viewerRoot, "core"), { recursive: true, force: true });
-  cpSync(noVncVendor, resolve4(viewerRoot, "vendor"), { recursive: true, force: true });
+  mkdirSync7(NOVNC_VIEWER_ROOT, { recursive: true });
+  cpSync(noVncCore, resolve4(NOVNC_VIEWER_ROOT, "core"), { recursive: true, force: true });
+  cpSync(noVncVendor, resolve4(NOVNC_VIEWER_ROOT, "vendor"), { recursive: true, force: true });
   for (const file of ["novnc-index.html", "viewer.css", "viewer-theme.css", "viewer-theme.js", "viewer-icon.svg", "geist-mono-400.ttf", "geist-mono-700.ttf"]) {
-    cpSync(resolve4(assets, file), resolve4(viewerRoot, file === "novnc-index.html" ? "index.html" : file), { force: true });
+    cpSync(resolve4(assets, file), resolve4(NOVNC_VIEWER_ROOT, file === "novnc-index.html" ? "index.html" : file), { force: true });
   }
-  cpSync(resolve4(packageRoot2, "dist", "viewer.js"), resolve4(viewerRoot, "viewer.js"), { force: true });
+  cpSync(resolve4(packageRoot2, "dist", "viewer.js"), resolve4(NOVNC_VIEWER_ROOT, "viewer.js"), { force: true });
   const streamRoot = "/usr/local/share/replicas/desktop/stream";
-  mkdirSync6(streamRoot, { recursive: true });
+  mkdirSync7(streamRoot, { recursive: true });
   for (const file of ["stream-index.html", "stream-viewer.css", "viewer-theme.css", "viewer-theme.js", "viewer-icon.svg", "geist-mono-400.ttf", "geist-mono-700.ttf"]) {
     cpSync(resolve4(assets, file), resolve4(streamRoot, file), { force: true });
   }
@@ -5859,13 +6053,13 @@ async function setupComputer(options = {}) {
   chmodSync2("/usr/local/bin/replicas-start-desktop-services", 493);
   chmodSync2("/usr/local/bin/replicas-chrome", 493);
   chmodSync2("/usr/local/bin/replicas-terminal", 493);
-  writeFileSync5("/etc/systemd/system/replicas-computer.service", serviceUnit, { mode: 420 });
-  if (existsSync8("/run/systemd/system")) {
+  writeFileSync6("/etc/systemd/system/replicas-computer.service", serviceUnit, { mode: 420 });
+  if (existsSync9("/run/systemd/system")) {
     const reload = spawnSync6("systemctl", ["daemon-reload"], { stdio: "pipe" });
     if (reload.status !== 0) throw new Error(`Failed to reload systemd: ${reload.stderr?.toString().trim() || `exit ${reload.status}`}`);
   }
-  mkdirSync6("/usr/local/share/replicas-computer", { recursive: true });
-  writeFileSync5("/usr/local/share/replicas-computer/install.json", `${JSON.stringify({
+  mkdirSync7("/usr/local/share/replicas-computer", { recursive: true });
+  writeFileSync6("/usr/local/share/replicas-computer/install.json", `${JSON.stringify({
     version: COMPUTER_USE_VERSION,
     protocolVersion: COMPUTER_USE_PROTOCOL_VERSION,
     dependencies: found

package/dist/viewer.js

@@ -2,6 +2,11 @@
 import RFB from "./core/rfb.js";
 import { encodings } from "./core/encodings.js";
 
+// ../shared/src/type-guards.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/wheel.ts
 function wheelDeltaPixels(event, pageHeight) {
   const scale = event.deltaMode === WheelEvent.DOM_DELTA_LINE ? 32 : event.deltaMode === WheelEvent.DOM_DELTA_PAGE ? pageHeight : 1;
@@ -15,6 +20,17 @@ var statusText = document.querySelector("#status-text");
 var hint = document.querySelector("#hint");
 if (!screen || !status || !statusText || !hint) throw new Error("Desktop viewer markup is incomplete");
 var params = new URLSearchParams(location.search);
+var device = params.get("device");
+var credentials = device ? await fetch("./credentials.json").then((response) => response.ok ? response.json() : void 0, () => void 0) : void 0;
+var screenFailed = false;
+var reportScreen = (state) => {
+  screenFailed = state.state === "failed";
+  globalThis.__replicasScreen = state;
+};
+if (device) {
+  document.title = `${device} screen`;
+  reportScreen({ state: "connecting" });
+}
 var intParam = (name, fallback, min = 0, max = 9) => {
   const value = Number.parseInt(params.get(name) ?? "", 10);
   return Number.isInteger(value) && value >= min && value <= max ? value : fallback;
@@ -93,7 +109,7 @@ var configureEncodings = (rfb) => {
   };
 };
 var scheduleReconnect = (immediate = false) => {
-  if (reconnectTimer || document.visibilityState === "hidden" || !navigator.onLine) return;
+  if (screenFailed || reconnectTimer || document.visibilityState === "hidden" || !navigator.onLine) return;
   const delay = immediate ? 0 : Math.min(1e4, 250 * 2 ** Math.min(reconnectAttempt, 6)) * (0.8 + Math.random() * 0.4);
   reconnectAttempt += 1;
   showStatus(reconnectAttempt > 1 ? "reconnecting\u2026" : "connecting\u2026");
@@ -113,7 +129,7 @@ var connect = () => {
   showStatus(reconnectAttempt ? "reconnecting\u2026" : "connecting\u2026");
   let rfb;
   try {
-    rfb = new RFB(screen, wsUrl);
+    rfb = new RFB(screen, wsUrl, { credentials });
   } catch {
     scheduleReconnect();
     return;
@@ -132,6 +148,7 @@ var connect = () => {
     if (generation !== connectionGeneration) return;
     reconnectAttempt = 0;
     status.classList.remove("visible");
+    if (device) reportScreen({ state: "connected", width: rfb._fbWidth, height: rfb._fbHeight });
     applyModernCursor();
     startUpdatePump();
   });
@@ -139,14 +156,29 @@ var connect = () => {
     if (generation !== connectionGeneration) return;
     activeRfb = null;
     stopUpdatePump();
+    if (device && !screenFailed) reportScreen({ state: "connecting" });
     scheduleReconnect();
   });
-  rfb.addEventListener("securityfailure", () => {
+  rfb.addEventListener("securityfailure", (event) => {
     if (generation !== connectionGeneration) return;
     activeRfb = null;
     stopUpdatePump();
-    scheduleReconnect();
+    if (!device) {
+      scheduleReconnect();
+      return;
+    }
+    const reason = event instanceof CustomEvent && isRecord(event.detail) && typeof event.detail.reason === "string" ? event.detail.reason : void 0;
+    showStatus("the device rejected the screen password");
+    reportScreen({ state: "failed", reason: `${device} rejected the screen password${reason ? ` (${reason})` : ""}. Update it in the environment's Devices settings.` });
   });
+  if (device) {
+    rfb.addEventListener("credentialsrequired", () => {
+      if (generation !== connectionGeneration) return;
+      reportScreen({ state: "failed", reason: `${device} asks for a password. Add its screen password in the environment's Devices settings.` });
+      showStatus("the device asks for a screen password");
+      rfb.disconnect();
+    });
+  }
 };
 var shiftCanvasForWheel = (event) => {
   if (!optimisticScroll || event.ctrlKey || event.metaKey || Math.abs(event.deltaY) <= Math.abs(event.deltaX)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-computer",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Replicas workspace computer-use runtime",
   "type": "module",
   "main": "dist/index.js",