feat(desktop,web,server,node): virtual displays, and the helper in both assistants

.changeset/attach-cursor-honest.md

@@ -0,0 +1,6 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+---
+
+A pane viewer could open already garbled, and stay garbled for its whole life: the replay's cursor read accepts a blank answer as row zero. tmux occasionally prints `":"` for a pane caught mid-redraw, and `Number("")` is 0, so that moment became a confident "the cursor is top-left", the replay ended sixteen-odd rows off the pane, and every later frame that repositions relative to it (a TUI repainting its pinned spinner block) landed on the transcript instead. The read now answers the pane's real position or nothing at all, and "nothing" takes the known degrade: a replay without the restore rather than a wrong one. The attach journal line gained the matching witness, `cursor=x,y|none`, so the next "fixed elements overlap the output" report reads the base off the log instead of guessing. Also: the hand-run attach probes were repaired (stale dist paths, and `test-setup.ts` no longer loads outside the runner, so they get their own preload) and `probe-join.ts` joins a pane the way production does, overlap and all.

.changeset/config.json

@@ -14,6 +14,7 @@
     "@internal/backend-errors",
     "@internal/brand",
     "@internal/e2e",
+    "@internal/helper-panel",
     "@internal/mcp-core",
     "@internal/mobile",
     "@internal/node-admin",

.changeset/copy-mode-toast-and-node-enabled.md

@@ -0,0 +1,8 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+---
+
+A pane's **Enable text copying** toggle now asks the preference what the device actually holds before deciding what the press did. The header menu and the touch bar share one per-device set, and each used to flip its own React copy of it, so a press that followed another window's change could "turn copying off" on a pane that was already off and say so out loud. In a private window, where the device stores nothing at all, the two surfaces disagreed the other way: the one you clicked remembered your click while the other re-read an empty store. Both now take the answer the preference module holds, which is also what a refused write leaves the page with.
+
+`get_node` also holds its answer about a display provider to the same rule the launch path applies, mirroring all four of the plane's gates: the node switch, the provider catalog, the owner's enabled list, and whether that provider runs on this node's operating system, with the protocol's own default rather than a provider name typed into the tool. The last one used to be inferred from `status`, which is the node's own report rather than the plane's verdict, so a node answering optimistically about a platform it cannot serve had the tool recommending a launch the server refuses. `enabled` is now the plane's answer and `status` stays the node's, and when the node cannot be asked the tool says so and promises nothing else. The other three were already enforced on the way in, so nothing a user could click read wrong before this; what changes is that a row arriving by some other route, or one a later release shrinks out of the catalog, can no longer be reported ready here and then refused by the launch it recommended.

.changeset/display-helper-copy.md

@@ -0,0 +1,6 @@
+---
+"@internal/desktop-client": patch
+"@internal/desktop-server": patch
+---
+
+Clarify virtual display setup and helper consent, permissions, sign-in, and quit messages. Keep shared-desktop warnings visible and explain when viewers disconnect while subshells keep running. Bump the bundled helper to 1.0.1 so its update is identified consistently across both desktop apps.

.changeset/frozen-tail-recovery.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+---
+
+A pane terminal could freeze while the pane itself kept running: when the node's byte stream to the browser died, every device watching that subshell kept seeing the same stale screen, typing echoed nothing, and the state lasted until the server restarted. The dashboard builds one output pump per subshell and hands it to every later viewer, and a pump that went silent (a refused tail start, a relay that stopped delivering) never said so. Now it does: the server logs the failure, drops that pane's viewers with the retry close, and the re-attach that follows builds a fresh pump at the current end of the log. A shared pump also gets a watchdog: if the pane's log grows while the stream has delivered nothing for 25 seconds, the pump is declared dead the same way, and a genuinely quiet pane is left alone because the verdict compares the log's size against what the pump actually delivered.
+
+The workspace header's actions menu now offers the **Diagnostics** toggle for the focused pane, the same per-device HUD the subshell page has had since Wave C. It floats over the dock terminal the header stands above and reports the socket state, reconnects, viewers, input echo timings, and when the last pane byte arrived, which is what you want on screen while a terminal is misbehaving.

.changeset/grid-resync-on-settle.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+A terminal no longer stays garbled after the pane it watches resizes. The reported shape: a TUI with a block that repaints constantly (a spinner, a pinned status line) would start drawing that block over the transcript, "where new output is mixed in", and keep doing it until the tab was closed. The window is the resize itself: bytes the pane emitted while changing its grid addressed a size the viewer never rendered, and every later frame the app positions relative to them lands a constant offset off. Only the attach can lay down a true base (absolute capture, cursor restore, confirmed geometry), so when a viewer adopts a grid other than the one its replay was painted into, and pane bytes arrived in between, it now silently re-attaches and heals. Once per observed change, debounced so a window drag settles before the replay, and gapped so a bouncing grid cannot turn the self-heal into a reconnect storm. The client never asks the server for a size, only for fresh truth.

.changeset/helper-review-hardening.md

@@ -0,0 +1,9 @@
+---
+"@internal/desktop-client": patch
+"@internal/desktop-server": patch
+"@internal/server": patch
+---
+
+Verify the installed display helper before opening it even when an update is blocked by another running helper. Preserve executable permissions when staging the helper, harden its bundled page's HTML escaping and native message boundary, and keep its state and menu updates consistent.
+
+Recover terminal grid changes that happen during the reconnect cooldown. Let native text selection reach the terminal rows in copy mode, and prevent input focus from clearing a new selection.

.changeset/pipe-writer-rearm.md

@@ -0,0 +1,5 @@
+---
+"@internal/node": patch
+---
+
+A node re-arms its own pane recorder now. Each pane's bytes reach the dashboard through a small writer process tmux pipes the pane into; if something kills just that writer (an OOM pass is the usual culprit) while the pane itself keeps running, the log stops growing, and every viewer sees a frozen terminal with a live pane behind it. tmux's own pipe flag cannot arbitrate (it has measured both on and off for a dead writer), so the exit watcher, which already touches every supervised pane, asks the honest question on that same beat: if the pane's screen moved and its log did not, repeatedly, for a little over a minute, the writer is dead, and the watcher re-arms the pipe on the same log file the long way: the form that cannot be talked out of it by tmux believing the pipe is already on. A quiet pane and a healthy writer both cost nothing beyond a periodic look, and the re-arm waits out three strikes so no single race spends one.

.changeset/pr465-review-docs.md

@@ -0,0 +1,7 @@
+---
+"@internal/docs": patch
+---
+
+Explain display-helper updates and signature failures, touch-device text copying, and terminal display recovery after resizing. Add screenshots of the copy controls and selected text, and show where to open helper settings.
+
+Explain private setup-key delivery, the CLI capability check, coordinated server and node upgrades, and the remaining shell-history and local-account trust limits.

.changeset/pr465-review-hardening.md

@@ -0,0 +1,11 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/desktop-server": patch
+"@internal/desktop-client": patch
+"@internal/docs": patch
+---
+
+Keep preview redirects inside their proxy, preserve malformed app scripts for browser diagnostics, and bound concurrent rewriting by decoded bytes. Fix preview preferences on display-only nodes, reconnect grid tracking, launch-dialog cleanup, and node-settings links. Recover stalled capture writers between output bursts and rescue the Mac pointer after capture loss. Keep helper confirmations stable across state updates and clear them when settings reopen. Verify shared palette imports and refresh the preview documentation screenshots.
+
+Reserve terminal input capacity per node so an offline machine cannot consume the fleet's budget, give a keystroke on a live pane the capacity a stuck retry was holding before disconnecting anyone, and drop held input immediately during forced viewer recovery. Prune obsolete helper staging copies after a successful install while preserving recovery data on failure. Dismiss the helper's quit confirmation when Confirm is pressed, even where the native bridge is absent.

.changeset/preview-compatibility-docs.md

@@ -0,0 +1,5 @@
+---
+"@internal/docs": patch
+---
+
+Document personal preview settings, common URL rewriting, and browser compatibility limits. Explain live sharing revocation, terminal input bounds, private installer credentials, and Display Helper verification. Give Web previews & screens its own sidebar section with shared prerequisites and dedicated app, browser, Linux, macOS, and agent guides. Consolidate platform setup and preserve existing links. Start the overview with a loaded website preview and consolidate repeated prerequisites, access rules, and provider lifecycle explanations.

.changeset/preview-proxy-compatibility.md

@@ -0,0 +1,8 @@
+---
+"@internal/server": patch
+"@internal/desktop-server": patch
+---
+
+Fix web preview asset paths and common development-server requests, including Next.js and Vite hot reload. Add personal proxy settings remembered for each app on a node, with controls for URL rewriting, the Host header, and redirects.
+
+Show the setup guide when either web previews or virtual displays is disabled, including when no views are discovered.

.changeset/setup-command-credentials.md

@@ -0,0 +1,5 @@
+---
+"@internal/server": patch
+---
+
+Keep setup keys out of process arguments in dashboard-generated install and setup commands. Explain the current CLI requirement and the remaining shell-history and local-account trust limits.

.changeset/ssh-bulletin-hardening.md

@@ -0,0 +1,8 @@
+---
+"@internal/server": patch
+"@internal/node": patch
+"@internal/desktop-server": patch
+"@internal/desktop-client": patch
+---
+
+Keep SSH setup keys out of subprocess arguments, require stdin-capable connecting nodes, and refuse older downloaded node binaries before passing credentials. Bound retained terminal resize work during sustained updates and document the SSH security bulletin review.

.changeset/terminal-input-budgets.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/desktop-server": patch
+"@internal/docs": patch
+---
+
+Bound terminal WebSocket input by frame count and UTF-8 payload bytes per connection and across the server, including dispatched writes and retries. Close connections that exceed the limits and prevent late failures from recreating retry queues after disconnect. Document the limits and recovery behavior.

.changeset/terminal-share-revocation.md

@@ -0,0 +1,7 @@
+---
+"@internal/server": patch
+"@internal/desktop-server": patch
+"@internal/docs": patch
+---
+
+Revoke cached terminal access when subshell shares change, including connections still attaching and queued input retries. Recipients reconnect through the current access checks; the owner's terminal stays connected. Document the cutoff and the limits for commands already dispatched.

.changeset/virtual-display-rail-entry.md

@@ -0,0 +1,28 @@
+---
+"@internal/desktop-client": minor
+"@internal/desktop-server": minor
+"@internal/server": patch
+"@internal/node": patch
+"@internal/docs": patch
+---
+
+Add a **Virtual Displays** section to both desktop assistants' sidebar, shown only where a display helper exists, so the helper is reachable from the window a person is already looking at instead of only from the macOS menu bar. The screen carries the steps the menu item never showed (enable the helper, grant Screen Recording and Accessibility to Subshell Display Helper, and what to do when macOS asks for a restart) above one button that opens the helper's own settings panel and a link to the setup guide. Document the sidebar as the way in.
+
+In the web dashboard, a node that cannot serve previews now says so in gold when the reason is that both of its preview switches are off, which an owner can fix, with a link to the guide that says how; an offline or outdated node stays muted, because no setting fixes that. A launch form, a preset, and the provider list no longer offer a virtual display provider the selected machine's operating system cannot run, and once the server knows the machine's OS it refuses one before the subshell row, its token, or a launch command exists, so a Mac is not asked to start Xvfb. A machine whose OS has not answered is not refused on that basis. Both shapes of no-answer count (no value at all, and an agent on a platform it cannot classify reporting the protocol's own `unknown`), because neither is a verdict: the list keeps what it held and the saved choice stays. Filtering on a non-answer would empty the provider card of a node that enrolled and never reported, which is the owner's only way to enable anything there, and would hide what a preset is about to launch. It is not a promise that such a machine can run the provider: the node answers that itself and refuses Xvfb on any non-Linux platform with `preview-display-unsupported`, so the server's check is a fast no rather than the only no. A provider the node has not enabled now stays named in its picker instead of hiding behind a trigger reading "Node default", since the line beside that row tells you to choose another provider and a choice you cannot see is not one you can change.
+
+A launch refused over its virtual display now reports the problem beside the **Virtual display** checkbox it belongs to, not under Save as preset; switch the checkbox off and the line moves back to the form's own message, so the reason is never both invisible and orphaned. A refusal the server raises itself now carries the node's own word for the same failure, so it lands in the same place whoever noticed it. On the machine, the display allocation says which readiness gate stayed shut (the Xvfb socket, the VNC port, or the listener's owner), logs what Xvfb and x11vnc printed before cleaning up, and gives a cold box 10 seconds instead of 5.
+
+The preview icon in a pane's header now wears a count when the pane has things you could open but have not saved: discovered app ports with no Saved services row, plus the screen and the browser watch when the pane offers them. It is the picker's own data, so the number and the list cannot disagree, and "you could" is read as the reader's own access: someone holding view sees the port and screen rows but cannot act on them, each disabled control saying why, so their badge counts only the browser watch and never numbers a control that answers "needs edit access".
+
+The desktop apps' **Open Display Helper settings** control works: the helper's signature check handed `codesign` a bare requirement string, which it read as a file name, so the panel failed to open on every press. (The module is macOS-only, so no Linux lane even builds it, and the macOS lanes that do only fail at runtime on a machine with a real bundle: nothing in CI opens the helper's panel, so no lane ever pressed the path that checks a signature or reads a preference.) Pressing it then opened nothing either: the helper read its own preferences through a `UserDefaults` suite named after its bundle identifier, which Foundation refuses, so the process trapped before any window existed. Both are fixed, and a helper that cannot find its panel now says so instead of showing an empty window.
+
+The panel itself is now the same product as the rest of Subshell, built from the components a person already knows in the dashboard: a card plate with its border and radius, `Fact` rows (a strong muted label above a readable value) for the login item and the two macOS permissions, and a form-section heading with its trailing rule for each group. Gold marks what you can still fix and plain ink what is settled, red what macOS refused, a live line names how many people are watching this Mac's screens, help sits at the bottom left and the exits at the bottom right in one shape, and a disabled control's reason is drawn in gold rather than hidden where a person who cannot hover will never find it. It is a small local page bundled into the helper, so the design system's own checker guards it, and the palette it draws on moved to `packages/assistant/tokens.css`, which every CSS surface imports rather than copies: the dashboard, both assistants and the helper's panel now read one file, while the node's own dashboard and the mobile app still keep a hand-maintained copy of the same values. The menu bar's menu now says it belongs to the Subshell virtual display helper instead of leaving you to guess from an icon, its **Minimize helper** item follows whether the panel is actually on screen, and the consent item turns itself into **Enable helper** once you disable the helper, raising the panel so you can read what you agreed to. It used to offer only Disable, greyed out once consent was off, which left the settings window as the only way back to running.
+
+**Quit helper** asks first, from the panel and from the menu bar's menu alike, and the question answers the part the button never said: watching stops now, your consent and the macOS permissions stay, and the helper
+says what it will actually do next: it returns at sign-in only if you registered
+it there, and the panel's **Stop at sign-in** button, not disabling, is what
+takes it off that list. Quitting also stopped revoking your consent, which it had been doing silently along with unregistering the login item: an app's Close button destroying the very permission the panel exists to collect, so every reopen started from Disabled.
+
+Enabling the helper no longer adds it to macOS's sign-in list, and disabling no longer takes it off. **Start at sign-in** is its own row with its own button, and the row says which of the three states macOS actually reports, registered, waiting for your approval, or not registered at all. Reading the last two as "approved" is what let a turned-off sign-in start keep claiming it starts at sign-in. The panel re-reads the machine every five seconds while it is open, in every run-loop mode and with App Nap held off, so a switch you flip in System Settings changes what you see without reopening anything.
+
+Discarding the last virtual display on a Mac also hands the pointer back. A viewer driving that screen leaves the real cursor on a display that no longer exists, which looked like a vanished cursor to whoever was sitting at the machine. A virtual screen can outlive the helper, so the rescue runs on any helper start as well as on teardown: whoever opens the panel next finds their cursor back where they can see it.

.changeset/website-virtual-displays.md

@@ -0,0 +1,12 @@
+---
+"@internal/website": patch
+"@internal/docs": patch
+"@internal/server": patch
+"@internal/desktop-server": patch
+---
+
+Add a virtual-display section to the website with a screenshot and Linux and macOS setup links. Refresh the display screenshot in the guide, and show SSH owner-only restrictions in gold like other node settings.
+
+Refresh the website-preview recording with a neutral demo path.
+
+Keep the phone demo at the same size when switching to the wider website layout.