Support automatic Wayland resize handoff with verified remote client retirement

[vincentkoc]

Summary

Automatic Wayland resize-ownership handoff remains deferred pending exact remote client identity and lifecycle acknowledgement.

A fault-injected split-transport spike disproved local EOF plus successor reconnect as proof that WayVNC released its previous layout owner. This tracks the missing prerequisite, not a proposed transport-only workaround.

Related base change: #2075

Current Behavior

Crabbox input control and WayVNC layout ownership are distinct. The base PR requests resizing only for the confirmed controller, but a previous viewer can retain WayVNC layout ownership until its remote client is destroyed. The base PR's UI therefore tells users to close the previous sizing viewer, then reconnect the new controller.

Bounded Experiment

The independently reviewed spike used actual WayVNC 0.9.1 with independent SSH forwards and a fault-injected split TCP proxy. The proxy deliberately retained the old remote connection while allowing the old local transport to report EOF and the successor to complete a fresh RFB handshake.

The previous WayVNC client remained present, and the successor's resize returned status 1. Backend process identities and an unrelated observer were unchanged.

This is a counterexample to the proposed retirement proof. It is not a reproduction of an unmodified SSH failure or Crabbox's healthy/default shared-tunnel path. It does not establish that the default path has this failure.

Required Invariant

Bind the exact departing bridge generation to a WayVNC client ID scoped to the specific server process lifetime. Before allowing a successor to claim automatic layout ownership, obtain a trusted client-disconnected event or synchronous targeted-disconnect acknowledgement for that exact client.

Local EOF, completion of a fresh RFB handshake, an IP address, a client count, or differences between client lists are not sufficient identity or retirement evidence.

Acceptance Criteria

• Establish an authenticated, exact binding between the bridge generation, remote WayVNC client, and server process identity.
• Confirm that client's remote retirement before claiming automatic resize handoff succeeded.
• Fence stale acknowledgements, reconnects, and server-process replacement.
• Preserve unrelated observers and backend desktop processes; no broad disconnect or desktop restart as a handoff shortcut.
• Prove healthy handoff through the actual default shared-transport path.
• Keep a distinct fault-injected split-transport test that retains the old remote owner and demonstrates that no false handoff success is reported.
• Retain visible close-and-reconnect guidance until the remote identity/lifecycle contract is implemented and verified.

No implementation PR or protocol change is proposed here until that prerequisite has a defensible design and executable proof.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed September 10, 2026, 4:22 AM ET / 08:22 UTC.

Summary
Automatic Wayland resize handoff remains unimplemented and is explicitly deferred by the related open PR. This member-authored issue identifies a concrete prerequisite worth retaining; the injected experiment does not establish a default-path regression.

Reproducibility: not applicable. as an existing-behavior bug: this requests deferred automation. The reported fault injection challenges a proposed retirement check and explicitly does not reproduce a failure in the default shared transport.

Root-cause cluster
Relationship: canonical
Canonical: #2076
Summary: This issue owns the explicitly deferred automatic handoff contract; the related PR covers viewer sizing and manual guidance.

Members:

• adjacent_distinct: feat: match Linux WebVNC desktops to the viewer window #2075 - The open sizing PR expressly excludes automatic retirement-based handoff and links here for that prerequisite.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Ways to help us reproduce this

• Add a screenshot or short recording showing the behavior.
• Add expected vs actual behavior.

Maintainer decision needed

Question	Recommendation
What authenticated bridge-to-WayVNC client binding and retirement acknowledgement contract should authorize automatic resize handoff?	Design the identity contract first: Keep automatic handoff deferred while defining exact client/server lifetime binding and acceptance proof for healthy and injected-failure paths.

Why: The issue deliberately leaves this protocol undecided, and transport closure alone cannot establish the exact remote lifecycle fact required for implementation.

Next step
The authenticated lifecycle boundary needs maintainer design before implementation; this security-sensitive feature is not a safe automatic fix candidate.

Security
Needs attention: The proposed remote retirement capability needs an authenticated identity contract; no current exploitable defect is established.

Review details

Best possible solution:

Preserve visible manual handoff guidance until a provider-neutral bridge contract verifies exact remote retirement, rejects stale acknowledgements, and preserves observers and desktop processes.

Do we have a high-confidence way to reproduce the issue?

Not applicable as an existing-behavior bug: this requests deferred automation. The reported fault injection challenges a proposed retirement check and explicitly does not reproduce a failure in the default shared transport.

Is this the best way to solve the issue?

Yes, deferring automation until exact remote retirement can be authenticated is the sound direction; the concrete protocol still needs design and boundary proof.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The authenticated mapping from bridge generation to WayVNC client and server lifetime is not designed; stale or ambiguous acknowledgements could target an unrelated observer or falsely declare handoff complete.
• The supplied experiment establishes a counterexample under injected split transport, but does not establish healthy handoff behavior through the default shared transport.

Codex review notes: model internal, reasoning medium; reviewed against fd2039ff398a.

Label changes

Label changes:

• add P2: This is a bounded desktop capability with a concrete design prerequisite, without evidence of a default-path outage.
• add impact:security: The requested contract authenticates which remote client may be retired and fences stale authority before affecting other viewers.
• add issue-rating: 🌊 off-meta tidepool: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:needs-product-decision: Current issue advisory state selects this label.
• add clawsweeper:needs-security-review: Current issue advisory state selects this label.

Label justifications:

• P2: This is a bounded desktop capability with a concrete design prerequisite, without evidence of a default-path outage.
• impact:security: The requested contract authenticates which remote client may be retired and fences stale authority before affecting other viewers.

Evidence reviewed

Security concerns:

• [medium] Define exact authority for remote client retirement
  Before adding targeted disconnects, bind the bridge generation to the exact WayVNC client and server lifetime, and reject stale or reassigned bindings before any remote side effect.
  Confidence: 0.95

What I checked:

• Current main does not enable portal remote resizing: The inspected checkout matches fetched main. New portal RFB connections enable local scaling and explicitly disable remote resizing. (worker/src/portal.ts:1569, fd2039ff398a)
• Controller promotion is separate from remote retirement: Viewer removal promotes another open viewer in coordinator memory; disconnect cleanup closes the associated bridge socket without obtaining a WayVNC client retirement acknowledgement. (worker/src/fleet.ts:12371, fd2039ff398a)
• CLI cleanup observes local transport: Bridge Close closes its WebSocket and TCP connection. Its control messages currently handle desktop themes, with no remote client identity or retirement acknowledgement contract. (internal/cli/webvnc.go:4289, fd2039ff398a)
• Actual desktop dependency boundary: The managed Wayland bootstrap executes WayVNC as a guest service, establishing that any future remote retirement contract must work with that server’s actual lifecycle. (worker/src/bootstrap.ts:568, fd2039ff398a)
• Related PR explicitly excludes automatic handoff: The supplied body of feat: match Linux WebVNC desktops to the viewer window #2075 retains close-and-reconnect guidance and delegates automatic handoff to this issue. A REST read confirms that the same-author PR remains open, draft, and unmerged at the supplied head. (749eb4d69016)
• Experiment has an explicit scope limit: The captured issue body reports WayVNC 0.9.1 retaining the previous client under an injected split transport while successor resizing returned status 1. It expressly excludes an unmodified SSH failure or a reproduction of the healthy shared-tunnel path; no experiment was executed during this review.

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.