mirror of
https://github.com/stablyai/orca.git
synced 2026-11-15 18:37:24 +00:00
Neil
60377d3364
* feat(cloud): remote desktop single-use tickets, fit, clipboard and keyboard release - VM: Xvnc on a 0600 socket with no VNC auth plus an X cookie; orca-desktop-proxy (websockify subclass) admits one WebSocket per unused 60 s ticket from the same localhost origin, refuses rebinding Hosts, scrubs tickets from logs, serves the page with connect-src 'self'. - Worker: POST /desktop mints a fresh ticket per call (schemaVersion 2). - Desktop: no secret in the tab URL; main hands the page tickets on load and reconnect (backoff, floor, pause with Reconnect), only for the exact URL of a live forward it opened; keyboard stays in the desktop until Ctrl+Cmd / Ctrl+Alt; a paste key pushes this computer's clipboard; sandbox copies reach this computer after a copy gesture. - UI: keyboard hint, asleep/starting neutral tone and mapping, persistent error toasts, Beta badge. * fix(cloud): remote desktop review fixes - Security review: noVNC host/port/encrypt pinned to the page's origin, CSP connect-src 'self', exact-URL + live-forward trust, mint floor and per-minute cap, copy gate on copy gestures only, X display cookie. - Design review: archived is its own neutral state, starting covers waking, page messages say "Wake it in Orca", pause overlay is a status for calm states and focuses Reconnect, hint wraps and hides from assistive tech when faded. - FE review: paste follows the keyboard layout, AltGr never releases, page calls settle on navigation, state notices only on change, hint once per load/release, paste always pushes, no committed bytecode, session tests. * fix(cloud): remote desktop archived page message, hint layout, fixtures * fix(cloud): remote desktop copy gate counts double-clicks (pointer events have no click count) * chore(cloud): remote desktop lint (exhaustive pause reasons, no test casts or wall clock)