ysk-server-core 1.0.0

package/dist/hosting/vnc/novnc.js

@@ -0,0 +1,232 @@
+/**
+ * noVNC / websockify helpers — bind localhost RFB to a local HTTP port.
+ */
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { shellQuote } from '../project-user-run.js';
+import { tl } from 'ysk-server-shared';
+import { novncPortForDisplay, rfbPortForDisplay } from './ports.js';
+function runtimePath(dataDir) {
+    return join(dataDir, 'vnc', 'novnc-runtime.json');
+}
+function ticketsPath(dataDir) {
+    return join(dataDir, 'vnc', 'view-tickets.json');
+}
+export function loadNovncRuntimes(dataDir) {
+    const p = runtimePath(dataDir);
+    if (!existsSync(p))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(p, 'utf8'));
+        return Array.isArray(raw.items) ? raw.items : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveNovncRuntimes(dataDir, items) {
+    mkdirSync(join(dataDir, 'vnc'), { recursive: true });
+    writeFileSync(runtimePath(dataDir), JSON.stringify({ items, updatedAt: new Date().toISOString() }, null, 2) + '\n', 'utf8');
+}
+function loadTickets(dataDir) {
+    const p = ticketsPath(dataDir);
+    if (!existsSync(p))
+        return [];
+    try {
+        const raw = JSON.parse(readFileSync(p, 'utf8'));
+        const now = Date.now();
+        return (Array.isArray(raw.items) ? raw.items : []).filter((t) => t.expiresAt > now);
+    }
+    catch {
+        return [];
+    }
+}
+function saveTickets(dataDir, items) {
+    mkdirSync(join(dataDir, 'vnc'), { recursive: true });
+    writeFileSync(ticketsPath(dataDir), JSON.stringify({ items, updatedAt: new Date().toISOString() }, null, 2) + '\n', 'utf8');
+}
+export function isNovncRunning(dataDir, accountId) {
+    return loadNovncRuntimes(dataDir).some((r) => r.accountId === accountId);
+}
+export async function startNovnc(input) {
+    const notes = [];
+    const { host, dataDir, accountId, display } = input;
+    if (!host.executeEnabled() || !host.isRoot()) {
+        notes.push(tl('notes.vnc.novncStartBlocked'));
+        return {
+            ok: false,
+            notes,
+            blocked: true,
+            requiresExecute: !host.executeEnabled(),
+        };
+    }
+    const existing = loadNovncRuntimes(dataDir).find((r) => r.accountId === accountId);
+    if (existing) {
+        notes.push(tl('notes.vnc.novncAlreadyRunning', { port: String(existing.httpPort) }));
+        return { ok: true, notes, runtime: existing };
+    }
+    const rfbPort = rfbPortForDisplay(display);
+    const httpPort = novncPortForDisplay(display);
+    const web = existsSync('/usr/share/novnc')
+        ? '/usr/share/novnc'
+        : existsSync('/usr/share/novnc/vnc.html')
+            ? '/usr/share/novnc'
+            : '';
+    // websockify [options] [source_addr:]source_port target_addr:target_port
+    // Prefer: websockify --web /usr/share/novnc 127.0.0.1:httpPort 127.0.0.1:rfbPort
+    const webArg = web ? `--web ${shellQuote(web)}` : '';
+    const script = [
+        `command -v websockify >/dev/null 2>&1 || { echo 'websockify missing'; exit 127; }`,
+        `nohup websockify ${webArg} 127.0.0.1:${httpPort} 127.0.0.1:${rfbPort} >/tmp/ysk-novnc-${display}.log 2>&1 & echo $!`,
+    ].join(' && ');
+    const r = await host.runCommand(['bash', '-c', script], { timeoutMs: 15_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.vnc.novncStartFailed', {
+            detail: (r.stderr || r.stdout || '').slice(0, 200),
+        }));
+        return { ok: false, notes };
+    }
+    const pid = Number(r.stdout.trim().split('\n').pop()) || undefined;
+    const runtime = {
+        accountId,
+        display,
+        rfbPort,
+        httpPort,
+        pid,
+        startedAt: new Date().toISOString(),
+    };
+    const items = loadNovncRuntimes(dataDir).filter((x) => x.accountId !== accountId);
+    items.push(runtime);
+    saveNovncRuntimes(dataDir, items);
+    notes.push(tl('notes.vnc.novncStarted', {
+        httpPort: String(httpPort),
+        rfbPort: String(rfbPort),
+    }));
+    return { ok: true, notes, runtime };
+}
+export async function stopNovnc(input) {
+    const notes = [];
+    const { host, dataDir, accountId } = input;
+    const items = loadNovncRuntimes(dataDir);
+    const rt = items.find((r) => r.accountId === accountId);
+    if (!rt) {
+        notes.push(tl('notes.vnc.novncNotRunning'));
+        return { ok: true, notes };
+    }
+    if (!host.executeEnabled() || !host.isRoot()) {
+        notes.push(tl('notes.vnc.novncStopBlocked'));
+        return {
+            ok: false,
+            notes,
+            blocked: true,
+            requiresExecute: !host.executeEnabled(),
+        };
+    }
+    if (rt.pid) {
+        await host.runCommand(['bash', '-c', `kill ${rt.pid} 2>/dev/null || true`], {
+            timeoutMs: 5_000,
+        });
+    }
+    await host.runCommand([
+        'bash',
+        '-c',
+        `pkill -f 'websockify.*${rt.httpPort}' 2>/dev/null || true`,
+    ], { timeoutMs: 5_000 });
+    saveNovncRuntimes(dataDir, items.filter((r) => r.accountId !== accountId));
+    notes.push(tl('notes.vnc.novncStopped', { httpPort: String(rt.httpPort) }));
+    return { ok: true, notes };
+}
+export function createViewTicket(input) {
+    const token = randomBytes(24).toString('hex');
+    const ticket = {
+        token,
+        accountId: input.accountId,
+        httpPort: input.httpPort,
+        expiresAt: Date.now() + (input.ttlMs ?? 10 * 60_000),
+    };
+    const items = loadTickets(input.dataDir).filter((t) => t.accountId !== input.accountId);
+    items.push(ticket);
+    saveTickets(input.dataDir, items);
+    return ticket;
+}
+export function consumeViewTicket(dataDir, token) {
+    const items = loadTickets(dataDir);
+    const t = items.find((x) => x.token === token);
+    if (!t || t.expiresAt <= Date.now())
+        return null;
+    return t;
+}
+export function buildConnectionPayload(input) {
+    const host = input.endpointHint || '127.0.0.1';
+    const directNotes = [];
+    if (input.rfbBind === 'localhost') {
+        directNotes.push(tl('notes.vnc.directNeedsAllBind'));
+    }
+    else {
+        // Host firewall is auto-synced on start (ysk-svc:vnc:…); UI shows access strip
+        directNotes.push(tl('notes.vnc.directOpenFirewall', { port: String(input.rfbPort) }));
+    }
+    const httpPort = input.novncHttpPort ?? null;
+    const viaAvailable = httpPort != null;
+    const localUrl = viaAvailable
+        ? `http://127.0.0.1:${httpPort}/vnc.html?host=127.0.0.1&port=${httpPort}`
+        : null;
+    const ticketPath = input.viewTicketToken
+        ? `/api/v1/vnc/view/${input.viewTicketToken}`
+        : null;
+    return {
+        direct: {
+            host,
+            port: input.rfbPort,
+            display: input.display,
+            address: `${host}:${input.rfbPort}`,
+            bind: input.rfbBind,
+            recommended: false,
+            notes: directNotes,
+        },
+        viaServer: {
+            available: viaAvailable,
+            httpPort,
+            localUrl,
+            ticketPath,
+            recommended: true,
+            notes: viaAvailable
+                ? [tl('notes.vnc.viaServerReady')]
+                : [tl('notes.vnc.viaServerStartFirst')],
+        },
+    };
+}
+export async function openUfwTcpPort(input) {
+    const notes = [];
+    const port = input.port;
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        notes.push(tl('notes.vnc.invalidPort'));
+        return { ok: false, notes };
+    }
+    if (!input.host.executeEnabled()) {
+        notes.push(tl('notes.vnc.firewallNeedExecute'));
+        return { ok: false, notes, blocked: true, requiresExecute: true };
+    }
+    if (!input.host.isRoot()) {
+        notes.push(tl('notes.vnc.firewallNeedRoot'));
+        return { ok: false, notes, blocked: true };
+    }
+    const comment = input.comment ?? 'ysk-svc:vnc:listen';
+    // Prefer shared UFW helper (comment-tagged, honest blocked)
+    const { firewallAllowPort } = await import('../firewall-ops.js');
+    const r = await firewallAllowPort(input.host, port, 'tcp', undefined, comment);
+    if (!r.ok) {
+        notes.push(...(r.notes?.length
+            ? r.notes
+            : [
+                tl('notes.vnc.firewallFailed', {
+                    detail: 'ufw allow failed',
+                }),
+            ]));
+        return { ok: false, notes, blocked: r.blocked, requiresExecute: r.blocked };
+    }
+    notes.push(...(r.notes ?? []), tl('notes.vnc.firewallOpened', { port: String(port) }));
+    return { ok: true, notes, blocked: r.blocked };
+}
+//# sourceMappingURL=novnc.js.map

package/dist/hosting/vnc/novnc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"novnc.js","sourceRoot":"","sources":["../../../src/hosting/vnc/novnc.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkBpE,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA+B,CAAC;QAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAqB;IAC/D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CACX,WAAW,CAAC,OAAO,CAAC,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC9E,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAA6B,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,KAAmB;IACvD,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CACX,WAAW,CAAC,OAAO,CAAC,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC9E,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAiB;IAC/D,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAKhC;IAOC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACnF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,GAAG,GACP,UAAU,CAAC,kBAAkB,CAAC;QAC5B,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,UAAU,CAAC,2BAA2B,CAAC;YACvC,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE,CAAC;IAEX,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG;QACb,mFAAmF;QACnF,oBAAoB,MAAM,cAAc,QAAQ,cAAc,OAAO,oBAAoB,OAAO,qBAAqB;KACtH,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,4BAA4B,EAAE;YAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,SAAS,CAAC;IACnE,MAAM,OAAO,GAAiB;QAC5B,SAAS;QACT,OAAO;QACP,OAAO;QACP,QAAQ;QACR,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,wBAAwB,EAAE;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;KACzB,CAAC,CACH,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAI/B;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE;YAC1E,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,CAAC,UAAU,CACnB;QACE,MAAM;QACN,IAAI;QACJ,yBAAyB,EAAE,CAAC,QAAQ,uBAAuB;KAC5D,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;IACF,iBAAiB,CACf,OAAO,EACP,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAC/C,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAe;QACzB,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC;KACrD,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,KAAa;IAEb,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAUtC;IAmBC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;IAC/C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QAClC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,+EAA+E;QAC/E,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,oBAAoB,QAAQ,iCAAiC,QAAQ,EAAE;QACzE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe;QACtC,CAAC,CAAC,oBAAoB,KAAK,CAAC,eAAe,EAAE;QAC7C,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,MAAM,EAAE;YACN,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;YACnC,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,WAAW;SACnB;QACD,SAAS,EAAE;YACT,SAAS,EAAE,YAAY;YACvB,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,YAAY;gBACjB,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAIpC;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACtD,4DAA4D;IAC5D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM;YACjB,CAAC,CAAC,CAAC,CAAC,KAAK;YACT,CAAC,CAAC;gBACE,EAAE,CAAC,0BAA0B,EAAE;oBAC7B,MAAM,EAAE,kBAAkB;iBAC3B,CAAC;aACH,CAAC,CACP,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AACjD,CAAC"}

package/dist/hosting/vnc/passwd.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Write TigerVNC ~/.vnc/passwd via vncpasswd -f when available.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+export declare function writeVncPassword(input: {
+    host: HostExecutor;
+    linuxUser: string;
+    home: string;
+    password: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}>;
+//# sourceMappingURL=passwd.d.ts.map

package/dist/hosting/vnc/passwd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwd.d.ts","sourceRoot":"","sources":["../../../src/hosting/vnc/passwd.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAI3D,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC,CAsCD"}

package/dist/hosting/vnc/passwd.js

@@ -0,0 +1,41 @@
+/**
+ * Write TigerVNC ~/.vnc/passwd via vncpasswd -f when available.
+ */
+import { shellQuote } from '../project-user-run.js';
+import { tl } from 'ysk-server-shared';
+export async function writeVncPassword(input) {
+    const notes = [];
+    const { host, linuxUser, home, password } = input;
+    if (!password || password.length < 6) {
+        notes.push(tl('notes.vnc.passwordTooShort'));
+        return { ok: false, notes };
+    }
+    if (!host.executeEnabled() || !host.isRoot()) {
+        notes.push(tl('notes.vnc.passwordWrittenOnly'));
+        return {
+            ok: true,
+            notes,
+            blocked: true,
+            requiresExecute: !host.executeEnabled(),
+        };
+    }
+    const vncDir = `${home.replace(/\/$/, '')}/.vnc`;
+    const script = [
+        `mkdir -p ${shellQuote(vncDir)}`,
+        `chown ${shellQuote(linuxUser)}:${shellQuote(linuxUser)} ${shellQuote(vncDir)}`,
+        // vncpasswd -f reads password from stdin (first line); some builds need twice
+        `printf '%s\\n' ${shellQuote(password)} | vncpasswd -f > ${shellQuote(vncDir + '/passwd')} 2>/dev/null || printf '%s\\n%s\\n' ${shellQuote(password)} ${shellQuote(password)} | vncpasswd -f > ${shellQuote(vncDir + '/passwd')}`,
+        `chmod 600 ${shellQuote(vncDir + '/passwd')}`,
+        `chown ${shellQuote(linuxUser)}:${shellQuote(linuxUser)} ${shellQuote(vncDir + '/passwd')}`,
+    ].join(' && ');
+    const r = await host.runCommand(['bash', '-c', script], { timeoutMs: 15_000 });
+    if (r.exitCode !== 0) {
+        notes.push(tl('notes.vnc.passwordFailed', {
+            detail: (r.stderr || r.stdout || '').slice(0, 200),
+        }));
+        return { ok: false, notes };
+    }
+    notes.push(tl('notes.vnc.passwordSet', { user: linuxUser }));
+    return { ok: true, notes };
+}
+//# sourceMappingURL=passwd.js.map

package/dist/hosting/vnc/passwd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwd.js","sourceRoot":"","sources":["../../../src/hosting/vnc/passwd.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IAMC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC;IACjD,MAAM,MAAM,GAAG;QACb,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE;QAChC,SAAS,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;QAC/E,8EAA8E;QAC9E,kBAAkB,UAAU,CAAC,QAAQ,CAAC,qBAAqB,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,uCAAuC,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,qBAAqB,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;QACjO,aAAa,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;QAC7C,SAAS,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE;KAC5F,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,0BAA0B,EAAE;YAC7B,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CACH,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/hosting/vnc/ports.d.ts

@@ -0,0 +1,12 @@
+/**
+ * VNC display / RFB / noVNC port helpers.
+ */
+export declare function rfbPortForDisplay(display: number): number;
+export declare function novncPortForDisplay(display: number): number;
+export declare function sanitizeVncSlug(raw: string): string;
+export declare function linuxUserForSlug(slug: string): string;
+export declare function parseGeometry(raw: string): {
+    w: number;
+    h: number;
+} | null;
+//# sourceMappingURL=ports.d.ts.map

package/dist/hosting/vnc/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../../src/hosting/vnc/ports.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS1E"}

package/dist/hosting/vnc/ports.js

@@ -0,0 +1,36 @@
+/**
+ * VNC display / RFB / noVNC port helpers.
+ */
+export function rfbPortForDisplay(display) {
+    return 5900 + display;
+}
+export function novncPortForDisplay(display) {
+    return 6080 + display;
+}
+export function sanitizeVncSlug(raw) {
+    const s = raw
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, '_')
+        .replace(/_+/g, '_')
+        .replace(/^_|_$/g, '')
+        .slice(0, 24);
+    return s || 'user';
+}
+export function linuxUserForSlug(slug) {
+    const base = sanitizeVncSlug(slug).replace(/-/g, '_').slice(0, 18);
+    return `yskvnc_${base}`.slice(0, 32);
+}
+export function parseGeometry(raw) {
+    const m = String(raw ?? '')
+        .trim()
+        .match(/^(\d{3,5})x(\d{3,5})$/i);
+    if (!m)
+        return null;
+    const w = Number(m[1]);
+    const h = Number(m[2]);
+    if (w < 640 || h < 480 || w > 7680 || h > 4320)
+        return null;
+    return { w, h };
+}
+//# sourceMappingURL=ports.js.map

package/dist/hosting/vnc/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/hosting/vnc/ports.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,GAAG,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,IAAI,GAAG,OAAO,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG;SACV,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,MAAM,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB,IAAI,EAAE;SACN,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC"}

package/dist/hosting/vnc/rfb-probe.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Preflight TCP reachability for RFB targets (before minting a browser session ticket).
+ */
+export type RfbProbeResult = {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    detail: string;
+    noteKey: string;
+    noteParams: Record<string, string>;
+};
+export declare function classifyRfbProbeError(e: unknown, host: string, port: number): {
+    code: string;
+    noteKey: string;
+    noteParams: Record<string, string>;
+};
+/** TCP connect probe; does not speak RFB — only reachability. */
+export declare function probeRfbTcp(host: string, port: number, timeoutMs?: number): Promise<RfbProbeResult>;
+export declare function probeResultNote(r: Extract<RfbProbeResult, {
+    ok: false;
+}>): string;
+//# sourceMappingURL=rfb-probe.d.ts.map

package/dist/hosting/vnc/rfb-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfb-probe.d.ts","sourceRoot":"","sources":["../../../src/hosting/vnc/rfb-probe.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAIrG,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,OAAO,EACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAsCvE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,SAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,GAAG,MAAM,CAMjF"}

package/dist/hosting/vnc/rfb-probe.js

@@ -0,0 +1,95 @@
+/**
+ * Preflight TCP reachability for RFB targets (before minting a browser session ticket).
+ */
+import { connect as netConnect } from 'node:net';
+import { tl } from 'ysk-server-shared';
+const DEFAULT_TIMEOUT_MS = 5_000;
+export function classifyRfbProbeError(e, host, port) {
+    const err = e;
+    const c = String(err?.code || '');
+    const msg = String(err?.message || e || '');
+    const target = `${host}:${port}`;
+    if (c === 'ECONNREFUSED' || /refused/i.test(msg)) {
+        return {
+            code: 'rfb_refused',
+            noteKey: 'notes.vnc.probeRefused',
+            noteParams: { host, port: String(port), target },
+        };
+    }
+    if (c === 'ETIMEDOUT' || c === 'EHOSTUNREACH' || /timeout/i.test(msg)) {
+        return {
+            code: 'rfb_timeout',
+            noteKey: 'notes.vnc.probeTimeout',
+            noteParams: { host, port: String(port), target },
+        };
+    }
+    if (c === 'ENOTFOUND' || c === 'EAI_AGAIN' || /getaddrinfo|ENOTFOUND/i.test(msg)) {
+        return {
+            code: 'rfb_dns',
+            noteKey: 'notes.vnc.probeDns',
+            noteParams: { host },
+        };
+    }
+    if (c === 'ENETUNREACH') {
+        return {
+            code: 'rfb_net',
+            noteKey: 'notes.vnc.probeNet',
+            noteParams: { host, port: String(port), target },
+        };
+    }
+    return {
+        code: 'rfb_error',
+        noteKey: 'notes.vnc.probeFailed',
+        noteParams: { target, detail: msg.slice(0, 120) },
+    };
+}
+/** TCP connect probe; does not speak RFB — only reachability. */
+export function probeRfbTcp(host, port, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const h = String(host || '').trim();
+    const p = Number(port);
+    if (!h || !Number.isInteger(p) || p < 1 || p > 65535) {
+        return Promise.resolve({
+            ok: false,
+            code: 'rfb_invalid',
+            detail: 'invalid host/port',
+            noteKey: 'notes.vnc.probeInvalid',
+            noteParams: { host: h || '?', port: String(p || '?') },
+        });
+    }
+    return new Promise((resolve) => {
+        const sock = netConnect({ host: h, port: p }, () => {
+            sock.destroy();
+            resolve({ ok: true });
+        });
+        sock.setTimeout(timeoutMs, () => {
+            sock.destroy();
+            const c = classifyRfbProbeError(Object.assign(new Error(`timeout ${h}:${p}`), { code: 'ETIMEDOUT' }), h, p);
+            resolve({
+                ok: false,
+                code: c.code,
+                detail: `timeout ${h}:${p}`,
+                noteKey: c.noteKey,
+                noteParams: c.noteParams,
+            });
+        });
+        sock.on('error', (err) => {
+            const c = classifyRfbProbeError(err, h, p);
+            resolve({
+                ok: false,
+                code: c.code,
+                detail: err.message || c.code,
+                noteKey: c.noteKey,
+                noteParams: c.noteParams,
+            });
+        });
+    });
+}
+export function probeResultNote(r) {
+    try {
+        return tl(r.noteKey, r.noteParams);
+    }
+    catch {
+        return r.detail;
+    }
+}
+//# sourceMappingURL=rfb-probe.js.map

package/dist/hosting/vnc/rfb-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfb-probe.js","sourceRoot":"","sources":["../../../src/hosting/vnc/rfb-probe.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAMvC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,UAAU,qBAAqB,CACnC,CAAU,EACV,IAAY,EACZ,IAAY;IAEZ,MAAM,GAAG,GAAG,CAA0B,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE;SACjD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,cAAc,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE;SACjD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE;SACjD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uBAAuB;QAChC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAY,EACZ,SAAS,GAAG,kBAAkB;IAE9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,qBAAqB,CAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EACpE,CAAC,EACD,CAAC,CACF,CAAC;YACF,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE;gBAC3B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,qBAAqB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI;gBAC7B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAyC;IACvE,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,CAAC,CAAC,OAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/hosting/vnc/server-session.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Start / stop / probe TigerVNC sessions per Linux user + display.
+ */
+import type { HostExecutor } from '../../host/executor.js';
+import type { VncRfbBind } from './types.js';
+import type { VncDesktopProfile } from './types.js';
+/** Same bin names SoftwareVersionBar / catalog use for TigerVNC server. */
+export declare const VNCSERVER_BIN_CANDIDATES: readonly ["tigervncserver", "vncserver"];
+/** Absolute paths shipped by Ubuntu/Debian tigervnc-standalone-server. */
+export declare const VNCSERVER_ABSOLUTE_PATHS: readonly ["/usr/bin/tigervncserver", "/usr/bin/vncserver", "/usr/local/bin/tigervncserver", "/usr/local/bin/vncserver", "/bin/tigervncserver", "/bin/vncserver"];
+/**
+ * Resolve absolute path to TigerVNC *wrapper* (tigervncserver / vncserver).
+ * Prefer filesystem probes — do not depend on login-shell PATH.
+ */
+export declare function resolveVncserverBin(host: HostExecutor): Promise<string | null>;
+/** True if TigerVNC server stack is present (wrapper or X server binary). */
+export declare function isTigerVncInstalled(host: HostExecutor): Promise<{
+    installed: boolean;
+    serverBin: string | null;
+    found: string[];
+    packageInstalled: boolean;
+}>;
+export declare function writeXstartupFile(input: {
+    host: HostExecutor;
+    linuxUser: string;
+    home: string;
+    desktop: VncDesktopProfile;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    path?: string;
+}>;
+export declare function probeSessionRunning(host: HostExecutor, display: number): Promise<boolean>;
+/** Map raw vncserver stderr to a short operator-facing note (primary, no path dump). */
+export declare function classifyVncStartFailure(input: {
+    display: number;
+    port: number;
+    detail: string;
+}): string;
+export declare function startVncSession(input: {
+    host: HostExecutor;
+    linuxUser: string;
+    display: number;
+    geometry: string;
+    depth: number;
+    rfbBind: VncRfbBind;
+    /** Home directory (default /home/{linuxUser}) */
+    home?: string;
+    /** If control-plane says no password, fail early when file also missing */
+    requirePassword?: boolean;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+    requiresRoot?: boolean;
+    running?: boolean;
+}>;
+export declare function stopVncSession(input: {
+    host: HostExecutor;
+    linuxUser: string;
+    display: number;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    requiresExecute?: boolean;
+}>;
+//# sourceMappingURL=server-session.d.ts.map

package/dist/hosting/vnc/server-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-session.d.ts","sourceRoot":"","sources":["../../../src/hosting/vnc/server-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAI3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGpD,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,0CAG3B,CAAC;AAEX,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,kKAO3B,CAAC;AA2BX;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAED,6EAA6E;AAC7E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACrE,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC,CAkCD;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8B3D;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAelB;AAkBD,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CA4DT;AAyBD,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC,CAgJD;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC,CA+BD"}