Merge branch 'ui-3-home' into ui-4-store

From the review: opening the toast popover with .show already set skipped the
fade-in; it now opens hidden and then shows. And the superseded-test test now
joins its threads in finally, so a failure can't leave them running into
cleanup.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -14,40 +14,7 @@ permissions:
   contents: write
 
 jobs:
-  # One job makes the draft, before the builds: three matrix jobs each running
-  # "view || create" could race and make duplicate drafts. The draft is tied to
-  # the pushed tag (the tag must already exist on GitHub, then tag_name is set
-  # explicitly), so scripts/publish-release.sh and `gh release upload` find it
-  # by tag. It is created with the REST API so the id comes straight back: the
-  # release list can lag a fresh draft (v0.4.2's first run found nothing and
-  # PATCHed releases/ with an empty id). tests/test_release_workflow.py runs
-  # this step against tests/fakegh.
-  draft:
-    if: startsWith(github.ref, 'refs/tags/')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create the draft release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          tag="${GITHUB_REF_NAME}"
-          # A rerun finds the draft an earlier attempt made.
-          id=$(gh api --paginate "repos/$GH_REPO/releases?per_page=100" --jq ".[] | select(.tag_name == \"$tag\") | .id" | head -n 1)
-          if [ -z "$id" ]; then
-            # Given a missing tag, GitHub would create it on the default branch.
-            gh api "repos/$GH_REPO/git/ref/tags/$tag" >/dev/null \
-              || { echo "tag $tag isn't on GitHub" >&2; exit 1; }
-            id=$(gh api -X POST "repos/$GH_REPO/releases" -f tag_name="$tag" -f name="Frame Control ${tag#v}" \
-              -F draft=true -f body="" --jq .id)
-          fi
-          [ -n "$id" ] || { echo "no release id for $tag; not PATCHing releases/" >&2; exit 1; }
-          gh api -X PATCH "repos/$GH_REPO/releases/$id" -f tag_name="$tag" --jq '"release " + (.id|tostring) + " tag_name " + .tag_name'
-
   build:
-    needs: draft
-    # Still runs for pull requests and manual runs, where the draft job is skipped.
-    if: ${{ !failure() && !cancelled() }}
     strategy:
       fail-fast: false
       matrix:
@@ -73,27 +40,15 @@ jobs:
         run: npm ci && npm run ${{ matrix.script }}
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
-      # The installer, not just the unpacked build: its 7-Zip payload once dropped
-      # the OpenXR layer's arm64 library without any error. Install it silently
-      # and compare every installed file with the unpacked build.
-      - name: Check the Windows installer installs every file
-        if: matrix.os == 'windows-latest'
-        shell: pwsh
-        run: |
-          $setup = Get-ChildItem app/dist/Frame-Control-Setup-*.exe | Select-Object -First 1
-          $p = Start-Process -FilePath $setup.FullName -ArgumentList '/S' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "installer exited $($p.ExitCode)" }
-          $installed = Join-Path $env:LOCALAPPDATA 'Programs\Frame Control'
-          for ($i = 0; $i -lt 60 -and -not (Test-Path (Join-Path $installed 'Uninstall Frame Control.exe')); $i++) { Start-Sleep 2 }
-          node app/build/check-resources.js (Join-Path $installed 'resources') app/dist/win-unpacked/resources
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - name: Upload to the release
         if: startsWith(github.ref, 'refs/tags/')
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "${GITHUB_REF_NAME}" ${{ matrix.files }} --clobber
+          tag="${GITHUB_REF_NAME}"
+          gh release view "$tag" >/dev/null 2>&1 || gh release create "$tag" --draft --title "Frame Control ${tag#v}" --notes ""
+          gh release upload "$tag" ${{ matrix.files }} --clobber
       - uses: actions/upload-artifact@v4
         with:
           name: frame-control-${{ matrix.os }}

README.md

@@ -189,7 +189,7 @@ entry to `~/.ssh/config` and keys at `~/.ssh/id_ed25519_frame` and
 
 This is a first public test, so reports are really useful, especially from
 Windows and Linux. The quickest way is **Report a problem** in the app (the
-warning-sign button at the top, or **Help → Report a Problem…**). It adds
+speech-bubble button at the top, or **Help → Report a Problem…**). It adds
 diagnostics with personal details removed, shows you exactly what's included,
 and sends it privately to the maintainer; nothing is published. Without the app,
 use the [feedback form](https://frame-control.pages.dev/feedback/). Please include:
@@ -213,8 +213,6 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
 | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
 | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
-| [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not |
-| [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token |
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |

apk-catalog/reports.py

@@ -6,25 +6,11 @@ A report: package, version, result (runs | crashes | install_failed |
 instance_failed, from an automated test), rating (works | issues | broken, from
 a person), notes, via (harness | probe | user), date, steamos, lepton, runtime.
 Newest wins, and a person's rating beats an automated result.
-
-An install_failed report saying the file had no arm64-v8a build (or needed a
-newer Android) is about that one APK file, often the wrong per-ABI download of
-an app that has an arm64 build, so it says nothing about the app and is left out.
 """
-import re
-
-FILE_FAULT = re.compile(r'no arm64-v8a build|needs Android API')
-
-
-def about_app(r):
-    """False for reports about one wrong APK file rather than the app itself."""
-    return not (r.get('result') == 'install_failed' and not r.get('rating')
-                and FILE_FAULT.search(r.get('notes') or ''))
 
 
 def verdict(reports):
     """(verdict, summary lines) for one package's reports, or None."""
-    reports = [r for r in reports or () if about_app(r)]
     if not reports:
         return None
     rs = sorted(reports, key=lambda r: r.get('date') or '')

app/build/check-resources.js

@@ -1,79 +0,0 @@
-// Checks that the app's resources hold what Frame Control can't work without.
-// The OpenXR compatibility layer is why this exists: VR APK installs need its
-// arm64-v8a library (ui/frame_android.py XR_COMPAT_FILES).
-//
-// As electron-builder's afterPack hook it checks the unpacked app. From the
-// command line it checks an installed copy, which is what caught the Windows
-// installer silently dropping the library (see .github/workflows/release.yml):
-//   node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES]
-// With a reference (the unpacked build's resources), every file in it must also
-// be in the installed copy, at the same size.
-const fs = require("fs");
-const path = require("path");
-
-const REQUIRED = [
-  "ui/server.py",
-  "ui/frame_android.py",
-  "frame/android/lepton-app.sh",
-  "frame/openxr-compat/XrApiLayer_FRAME_compat.json",
-  "frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz",
-];
-
-function resourcesDir(context) {
-  if (context.electronPlatformName === "darwin" || context.electronPlatformName === "mas") {
-    const app = `${context.packager.appInfo.productFilename}.app`;
-    return path.join(context.appOutDir, app, "Contents", "Resources");
-  }
-  return path.join(context.appOutDir, "resources");
-}
-
-function size(file) {
-  try {
-    return fs.statSync(file).size;
-  } catch {
-    return -1;
-  }
-}
-
-// Required files that are missing or empty.
-function missing(dir) {
-  return REQUIRED.filter((rel) => size(path.join(dir, rel)) <= 0);
-}
-
-// Files under reference that aren't in dir at the same size.
-function differences(dir, reference) {
-  const out = [];
-  (function walk(rel) {
-    for (const e of fs.readdirSync(path.join(reference, rel), { withFileTypes: true })) {
-      const r = path.join(rel, e.name);
-      if (e.isDirectory()) walk(r);
-      else if (e.isFile() && size(path.join(dir, r)) !== size(path.join(reference, r))) out.push(r.split(path.sep).join("/"));
-    }
-  })("");
-  return out;
-}
-
-exports.default = async function afterPack(context) {
-  const dir = resourcesDir(context);
-  const gone = missing(dir);
-  if (gone.length) {
-    throw new Error(`packaged app is missing required resources in ${dir}: ${gone.join(", ")}`);
-  }
-};
-exports.missing = missing;
-exports.differences = differences;
-exports.REQUIRED = REQUIRED;
-
-if (require.main === module) {
-  const [dir, reference] = process.argv.slice(2);
-  if (!dir) {
-    console.error("usage: node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES]");
-    process.exit(2);
-  }
-  const problems = [...missing(dir), ...(reference ? differences(dir, reference) : [])];
-  if (problems.length) {
-    console.error(`${dir} is missing or has the wrong size for:\n  ${[...new Set(problems)].join("\n  ")}`);
-    process.exit(1);
-  }
-  console.log(`${dir}: all required resources present${reference ? ", and every file of " + reference : ""}`);
-}

app/main.js

@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron");
+const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -11,7 +11,6 @@ const os = require("os");
 const path = require("path");
 const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 const updater = require("./updater");
-const { createMetaSignIn } = require("./meta-signin");
 
 const run = promisify(execFile);
 
@@ -150,7 +149,7 @@ async function startServer() {
   const target = `http://127.0.0.1:${port}/`;
   for (let i = 0; i < 100; i++) {
     if (exited !== null) throw new Error(`The server exited (${exited}). See ${LOG}.`);
-    if (await ping(target)) { url = target; serverStarted = Date.now(); return; }
+    if (await ping(target)) { url = target; return; }
     await new Promise((r) => setTimeout(r, 100));
   }
   if (server === child) server = null;
@@ -176,27 +175,18 @@ function stopServer() {
   if (server) endServer(server);
 }
 
-function errorPage(message, title = "Frame Control couldn't start") {
+function errorPage(message) {
   const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
   const html = `<!doctype html><meta charset="utf-8"><body style="margin:0;height:100vh;display:grid;
     place-items:center;background:${BG};color:#e6edf3;font:14px -apple-system,sans-serif">
-    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>${esc(title)}</h2>
-    <p>${esc(message)}</p>
-    <p><button onclick="this.disabled = true; frameApp.restartServer()" style="font:inherit;padding:6px 16px;
-      border-radius:6px;border:1px solid #30363d;background:#21262d;color:inherit;cursor:pointer">Try Again</button></p>
-    <p style="color:#8b98a8">Frame → Restart Server does the same.</p></div>`;
+    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>Frame Control couldn't start</h2>
+    <p>${esc(message)}</p><p style="color:#8b98a8">Fix it, then choose Frame → Restart Server.</p></div>`;
   return "data:text/html;charset=utf-8," + encodeURIComponent(html);
 }
 
-// A server that had been running starts again by itself (something stopped it: a
-// signal, a crash). One that stops again within a minute shows the error instead,
-// so a server that can't stay up doesn't restart forever.
-let serverStarted = 0;
 function serverDied(why) {
   url = null;
-  if (!win) return;
-  if (Date.now() - serverStarted > 60000) restartServer();
-  else win.loadURL(errorPage(`Its server stopped unexpectedly (${why}). See ${LOG}.`, "Frame Control stopped"));
+  if (win) win.loadURL(errorPage(`The server stopped unexpectedly (${why}). See ${LOG}.`));
 }
 
 // Restarts that overlap share one: two could each start a server, and the one
@@ -273,20 +263,7 @@ function fromUi(e) {
   } catch { return false; }
 }
 
-// The error page's Try Again button. The error page is the only data: page the window
-// shows (`url` can still be set then: the server answered but the page failed to load).
-ipcMain.handle("server:restart", (e) => {
-  if (win && e.sender === win.webContents && e.senderFrame && e.senderFrame.url.startsWith("data:")) restartServer();
-});
 ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : "");
-// A PNG or JPEG (a screenshot) onto the clipboard as an image.
-ipcMain.handle("clipboard:writeImage", (e, bytes) => {
-  if (!fromUi(e) || !(bytes instanceof Uint8Array)) return false;
-  const img = nativeImage.createFromBuffer(Buffer.from(bytes));
-  if (img.isEmpty()) throw new Error("not an image");
-  clipboard.writeImage(img);
-  return true;
-});
 ipcMain.handle("connection:setup", (e) => { if (fromUi(e)) setUpConnection(); });
 ipcMain.on("keys:capture", (e, on) => { if (fromUi(e)) win.webContents.setIgnoreMenuShortcuts(on === true); });
 ipcMain.handle("update:get", (e) => fromUi(e) ? publicUpdate() : null);
@@ -348,47 +325,6 @@ ipcMain.handle("comfort:notify", (e, message) => {
   });
 });
 
-// ---- Sign in with Meta (app/meta-signin.js, docs/meta-library.md) ----
-// The token goes from the sign-in window's own session straight to the server's
-// connect path; the page asks for it and only hears the server's answer.
-function postApi(apiPath, body) {
-  return new Promise((resolve, reject) => {
-    if (!url) return reject(new Error("Frame Control's server isn't running."));
-    const data = JSON.stringify(body);
-    const req = http.request(new URL(apiPath, url), {
-      method: "POST", timeout: 60000,
-      headers: { "Content-Type": "application/json", "X-Frame-UI": process.env.FRAME_UI_KEY || "1",
-                 "Content-Length": Buffer.byteLength(data) },
-    }, (res) => {
-      let text = "";
-      res.setEncoding("utf8");
-      res.on("data", (c) => { text += c; });
-      res.on("end", () => {
-        let parsed = {};
-        try { parsed = JSON.parse(text); } catch {}
-        resolve({ status: res.statusCode, data: parsed });
-      });
-    });
-    req.on("error", reject);
-    req.on("timeout", () => req.destroy(new Error("the server didn't answer")));
-    req.end(data);
-  });
-}
-
-let metaSignIn = null;
-const meta = () => (metaSignIn ||= createMetaSignIn({
-  BrowserWindow, session, shell, parent: () => win,
-  // The page only offers sign-in after its "I understand" box is ticked (checked again below).
-  connect: (token, attempt) => postApi("/api/meta", { action: "connect", token, acknowledged: true, attempt }),
-  cancel: (attempt) => postApi("/api/meta", { action: "cancel-signin", attempt }),
-}));
-ipcMain.handle("meta:signin", (e, acknowledged) => {
-  if (!fromUi(e)) return null;
-  if (acknowledged !== true) return { ok: false, error: "My Meta library is experimental: tick that you understand the warning first." };
-  return meta().signIn();
-});
-ipcMain.handle("meta:signout", (e) => fromUi(e) ? meta().signOut() : false);
-
 // frame-control://install links from websites (docs/web-install.md). They can
 // arrive before the window or server exists (macOS open-url on a cold launch),
 // so they wait here until the page asks for them. The page checks the link with

app/meta-signin.js

@@ -1,240 +0,0 @@
-// "Sign in with Meta" for My Meta library (docs/meta-library.md), the way BSManager's
-// "Log in with Meta" works: Meta's own login page in a Frame Control window, then the
-// access token cookie (oc_ac_at) that page sets is handed to the local server's
-// existing connect path (format check, "who am I" with Meta, 0600 file).
-//
-// The window has its own persistent session (PARTITION), so the cookie is read only
-// from there: never from Frame Control's main window, never from any browser. It has
-// no preload and no Node, and it only navigates within Meta's login sites; anything
-// else opens in the system browser. Nothing here logs the token, and the page only
-// ever gets back the server's answer (connected, display name), never the token.
-// Electron is passed in, so app/test/meta-signin.test.js can run it with fakes.
-const crypto = require("crypto");
-
-const PARTITION = "persist:meta-signin";
-// BSManager's loginUrl (src/main/services/bs-version-download/bs-oculus-downloader.service.ts).
-const LOGIN_URL = "https://secure.oculus.com";
-const COOKIE = "oc_ac_at";
-// Sites the login can go through: the Oculus store web, Meta accounts, Facebook login.
-const ALLOWED = ["oculus.com", "meta.com", "facebook.com"];
-const TIMEOUT = 10 * 60 * 1000;  // as BSManager
-
-const underDomain = (host, domains) => {
-  host = String(host || "").replace(/^\./, "").toLowerCase();
-  return domains.some((d) => host === d || host.endsWith("." + d));
-};
-
-// Plain HTTPS on the default port, to one of the login sites.
-function allowedUrl(raw) {
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  if (u.protocol !== "https:" || u.username || u.password || (u.port && u.port !== "443")) return false;
-  return underDomain(u.hostname, ALLOWED);
-}
-
-// Frames inside the page: any HTTPS address (Meta's login can embed captcha and CDN
-// frames from other sites), or an empty frame; never data:, blob:, javascript:, http:,
-// file: or any other scheme. Frames can't reach the cookie read or IPC (main process only).
-function allowedSubframeUrl(raw) {
-  if (/^about:(?:blank|srcdoc)$/.test(String(raw))) return true;
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  return u.protocol === "https:" && !u.username && !u.password;
-}
-
-const onOculus = (raw) => { try { return underDomain(new URL(raw).hostname, ["oculus.com"]); } catch { return false; } };
-
-// A cheap first look, so a signed-out or app value is never sent anywhere; the server's
-// check_token (ui/frame_meta.py) has the final word.
-function looksLikeUserToken(v) {
-  return typeof v === "string" && /^(?:OC|FRL)[A-Za-z0-9+/=_-]{18,4093}$/.test(v)
-    && !/^OC\d{15}$/.test(v) && /[a-z]/.test(v);
-}
-
-const fingerprint = (v) => crypto.createHash("sha256").update(v).digest("hex");
-
-// Anything token-shaped out of a message, in case a server error ever carried one.
-function scrub(text, token) {
-  let s = String(text == null ? "" : text);
-  if (token) s = s.split(token).join("<redacted>");
-  return s.replace(/(?:OC|FRL)[A-Za-z0-9+/=_%|:-]{8,}/g, "<redacted>").slice(0, 600);
-}
-
-// deps: { BrowserWindow, session, shell, parent() -> BrowserWindow|null, timeout,
-//         connect(token, attempt) -> Promise<{status, data}>  (the server's connect action),
-//         cancel(attempt) -> Promise  (the server's cancel-signin: never save that attempt) }
-function createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent = () => null, timeout = TIMEOUT }) {
-  let active = null;  // { win, promise, finish }
-  const pending = new Set();  // cancels still to reach the server, from flows already finished
-  let signingOut = null;      // the sign-out under way; no sign-in starts while it runs
-  const SIGNING_OUT = "Frame Control is signing out of Meta; try again in a moment.";
-
-  const openOutside = (target) => {
-    if (/^https?:\/\//i.test(String(target))) shell.openExternal(String(target));
-  };
-
-  function signIn() {
-    if (signingOut) return Promise.resolve({ ok: false, error: SIGNING_OUT });
-    if (active) { active.win.focus(); return active.promise; }
-    const ses = session.fromPartition(PARTITION);
-    ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false));
-    ses.setPermissionCheckHandler(() => false);
-    // Electron adds its own name and the app's to the user agent; send a plain Chrome one.
-    if (ses.getUserAgent && ses.setUserAgent) {
-      ses.setUserAgent(ses.getUserAgent().replace(/\s(?:Electron|frame-control|Frame Control)\/\S+/g, ""));
-    }
-    const p = parent();
-    const win = new BrowserWindow({
-      width: 520, height: 760, title: "Sign in with Meta – Frame Control", autoHideMenuBar: true,
-      ...(p ? { parent: p } : {}),
-      webPreferences: { partition: PARTITION, contextIsolation: true, nodeIntegration: false, sandbox: true,
-                        nodeIntegrationInSubFrames: false, webviewTag: false, safeDialogs: true, devTools: false },
-    });
-    const wc = win.webContents;
-
-    let resolve;
-    const promise = new Promise((r) => { resolve = r; });
-    let done = false, busy = false, again = false, lastError = null;
-    const tried = new Set();  // fingerprints of values already sent, so each goes once
-    // The server refuses to save a connect from an attempt this window gave up on.
-    const attemptId = crypto.randomUUID();
-
-    const onCookie = (_e, cookie, _cause, removed) => {
-      if (!removed && cookie && cookie.name === COOKIE && underDomain(cookie.domain, ["oculus.com"])) attempt();
-    };
-    const timer = setTimeout(() => finish({ ok: false, error: "Sign-in timed out after 10 minutes. Try again." }), timeout);
-    if (timer.unref) timer.unref();
-
-    // Stops cookie intake first, then the window (destroy: a page's beforeunload can't
-    // keep it open), and answers the page. Unless it connected, and if it sent a token, it
-    // then has the server drop this attempt: only once the connect under way has settled,
-    // so the server always sees the cancel after the connect (and deletes the token if
-    // that connect saved it). The returned promise settles when that is done.
-    let finished = null;
-    let inflight = null;  // the last connect sent
-    function finish(result) {
-      if (done) return finished || Promise.resolve();  // destroy() below re-enters through "closed"
-      done = true;
-      ses.cookies.removeListener("changed", onCookie);
-      clearTimeout(timer);
-      if (active && active.win === win) active = null;
-      if (!win.isDestroyed()) win.destroy();
-      resolve(result);
-      if (result.ok || !inflight) return (finished = Promise.resolve());  // nothing sent: nothing to cancel
-      finished = Promise.resolve(inflight).catch(() => {}).then(() => cancel(attemptId)).catch(() => {});
-      pending.add(finished);
-      finished.then(() => pending.delete(finished));
-      return finished;
-    }
-
-    async function attempt() {
-      if (done) return;
-      if (busy) { again = true; return; }
-      busy = true;
-      try {
-        do {
-          again = false;
-          // Only this window's own session, and only Meta's Oculus cookie.
-          const cookies = await ses.cookies.get({ name: COOKIE });
-          const c = cookies.find((k) => underDomain(k.domain, ["oculus.com"]) && looksLikeUserToken(k.value));
-          if (!c || done) continue;
-          const key = fingerprint(c.value);
-          if (tried.has(key)) continue;
-          tried.add(key);
-          let r;
-          try {
-            inflight = connect(c.value, attemptId);
-            r = await inflight;
-          } catch {
-            lastError = "Frame Control's local server didn't answer.";
-            continue;
-          }
-          if (done) return;
-          const d = (r && r.data) || {};
-          if (r && r.status === 200 && d.connected) {
-            finish({ ok: true, connected: true, user: d.user && d.user.name ? { name: scrub(d.user.name, c.value).slice(0, 80) } : null,
-                     message: scrub(d.message || "Connected your Meta account (Experimental)", c.value) });
-            return;
-          }
-          lastError = scrub(d.error || `HTTP ${r && r.status}`, c.value);
-        } while (again && !done);
-      } catch {
-        // The session went away (the window closed); nothing to do.
-      } finally {
-        busy = false;
-      }
-    }
-
-    // Navigation stays on Meta's login sites. A link elsewhere opens in the system
-    // browser; a redirect elsewhere is just stopped (it may carry sign-in data).
-    // Every frame: the window itself stays on the list; frames inside it may load any
-    // HTTPS page (captchas), and one going anywhere else is just stopped.
-    wc.on("will-navigate", (e, target) => { if (!allowedUrl(target)) { e.preventDefault(); openOutside(target); } });
-    wc.on("will-frame-navigate", (e) => {
-      if (e.isMainFrame ? allowedUrl(e.url) : allowedSubframeUrl(e.url)) return;
-      e.preventDefault();
-    });
-    // Redirects fire for frames too: the same rule per frame (details on the event in
-    // current Electron, positional arguments in older ones; unknown counts as the window).
-    wc.on("will-redirect", (e, target, _inPlace, isMainFrame) => {
-      const to = e && e.url !== undefined ? e.url : target;
-      const main = e && e.isMainFrame !== undefined ? e.isMainFrame : isMainFrame !== false;
-      if (!(main ? allowedUrl(to) : allowedSubframeUrl(to))) e.preventDefault();
-    });
-    // A page's beforeunload never keeps the window open.
-    wc.on("will-prevent-unload", (e) => e.preventDefault());
-    wc.setWindowOpenHandler(({ url: target }) => {
-      if (allowedUrl(target)) wc.loadURL(target).catch(() => {});
-      else openOutside(target);
-      return { action: "deny" };
-    });
-    // Signed in: the cookie changes, or the window lands back on Meta's store site.
-    ses.cookies.on("changed", onCookie);
-    wc.on("did-navigate", (_e, target) => { if (onOculus(target)) attempt(); });
-    wc.on("did-navigate-in-page", (_e, target) => { if (onOculus(target)) attempt(); });
-    win.on("closed", () => finish({ ok: false, cancelled: true,
-      error: lastError ? `The sign-in window closed before Frame Control could connect. ${lastError}`
-                       : "The sign-in window was closed before you signed in." }));
-
-    active = { win, promise, finish };
-    wc.loadURL(LOGIN_URL).catch(() => {});
-    return promise;
-  }
-
-  // Signs out of Meta in Frame Control: stops any sign-in under way (and has the server
-// refuse to save it), destroys the window, then clears everything
-  // the sign-in session stored (cookies, storage, cache), so the next sign-in starts fresh.
-  // One at a time (a second call joins the first), and no sign-in can start meanwhile.
-  // It goes round until no window is open and no connect or cancel is left, so nothing
-  // started before it can set a token after it (or after the Disconnect that follows).
-  function signOut() {
-    if (!signingOut) {
-      signingOut = (async () => {
-        for (;;) {
-          if (active) {
-            const { win, finish } = active;
-            await finish({ ok: false, cancelled: true, error: "Signed out of Meta in Frame Control." });
-            // Clear only once nothing can write to the session again.
-            if (!win.isDestroyed()) throw new Error("The Sign in with Meta window didn't close; try again.");
-          } else if (pending.size) {
-            // A connect under way settles and is cancelled before the caller (Disconnect)
-            // deletes the account, so it can't be saved afterwards.
-            await Promise.all([...pending]);
-          } else {
-            break;
-          }
-        }
-        const ses = session.fromPartition(PARTITION);
-        await ses.clearStorageData();
-        await ses.clearCache();
-        if (ses.clearAuthCache) await ses.clearAuthCache();
-        return true;
-      })().finally(() => { signingOut = null; });
-    }
-    return signingOut;
-  }
-
-  return { signIn, signOut, isOpen: () => !!active, isSigningOut: () => !!signingOut };
-}
-
-module.exports = { createMetaSignIn, allowedUrl, allowedSubframeUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE, ALLOWED };

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.5",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.5",
+      "version": "0.4.0",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.5",
+  "version": "0.4.0",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
@@ -29,7 +29,6 @@
         ]
       }
     ],
-    "afterPack": "build/check-resources.js",
     "directories": {
       "output": "dist",
       "buildResources": "build"
@@ -39,7 +38,6 @@
       "preload.js",
       "install-link.js",
       "updater.js",
-      "meta-signin.js",
       "package.json",
       "build/icon.png"
     ],
@@ -83,7 +81,7 @@
         "to": "frame/openxr-compat",
         "filter": [
           "XrApiLayer_FRAME_compat.json",
-          "prebuilt/**/*.so.gz"
+          "prebuilt/**/*.so"
         ]
       },
       {

app/preload.js

@@ -2,20 +2,17 @@
 // to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
 // the page where a dropped file or folder lives, so a folder can be sideloaded
 // as a title without zipping it (the local server reads it from there).
-// It can put a screenshot on the clipboard as an image, open Set Up Connection when
-// the headset can't be reached, and keeps the Frame menu's list of headsets up to date.
+// It can open Set Up Connection when the headset can't be reached, and keeps the
+// Frame menu's list of headsets up to date.
 // It also receives frame-control://install links (docs/web-install.md): only
 // what the link asked for, never an install; the page asks the user first.
-// And it passes update state both ways: see app/updater.js. It opens the Sign in
-// with Meta window and signs out of it (app/meta-signin.js).
+// And it passes update state both ways: see app/updater.js.
 const { contextBridge, ipcRenderer, webUtils } = require("electron");
 
 contextBridge.exposeInMainWorld("frameApp", {
   notify: (message, request) => ipcRenderer.invoke("comfort:notify", message, request),
   readClipboard: () => ipcRenderer.invoke("clipboard:read"),
-  writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes),
   setUpConnection: () => ipcRenderer.invoke("connection:setup"),
-  restartServer: () => ipcRenderer.invoke("server:restart"),  // the "couldn't start" page's Try Again
   // The Frame menu's headset switcher: the page tells it the headsets, and hears picks.
   devicesChanged: (list) => ipcRenderer.send("devices:changed", list),
   onUseDevice: (cb) => {
@@ -40,12 +37,6 @@ contextBridge.exposeInMainWorld("frameApp", {
     ipcRenderer.removeAllListeners("report:open");
     ipcRenderer.on("report:open", () => cb());
   },
-  // Sign in with Meta (app/meta-signin.js): Meta's login page in its own window. The
-  // answer is the server's (connected, display name), never the token.
-  meta: {
-    signIn: (acknowledged) => ipcRenderer.invoke("meta:signin", acknowledged === true),
-    signOut: () => ipcRenderer.invoke("meta:signout"),
-  },
   onInstallLink: (cb) => {
     ipcRenderer.removeAllListeners("install-link");
     ipcRenderer.on("install-link", (_e, req) => cb({ kind: req.kind, target: req.target }));

app/test/meta-signin.test.js

@@ -1,554 +0,0 @@
-// Run: node --test app/test/
-// "Sign in with Meta" (app/meta-signin.js) with fake Electron windows, sessions and cookies.
-const nodeTest = require("node:test");
-// A broken flow can leave a sign-in waiting forever; fail it instead of hanging.
-const test = (name, fn) => nodeTest(name, { timeout: 5000 }, fn);
-const assert = require("node:assert");
-const { EventEmitter } = require("node:events");
-const { createMetaSignIn, allowedUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE } = require("../meta-signin");
-
-const TOKEN = "OCAbcdefghijklmnopQRSTUVwxyz0123456789abcdEFGH";
-const OTHER = "OCzyxwvutsrqponmlkJIHGFEDcba9876543210zyxwVUTS";
-
-class FakeCookies extends EventEmitter {
-  constructor() { super(); this.store = []; this.reads = 0; }
-  async get(filter) {
-    this.reads++;
-    return this.store.filter((c) => !filter.name || c.name === filter.name);
-  }
-  set(cookie) {  // as the page would: store it, then tell listeners
-    this.store = this.store.filter((c) => !(c.name === cookie.name && c.domain === cookie.domain)).concat(cookie);
-    this.emit("changed", {}, cookie, "explicit", false);
-  }
-}
-
-class FakeSession {
-  constructor(name, log) { this.name = name; this.log = log; this.cookies = new FakeCookies(); this.cleared = []; this.permission = null; }
-  setPermissionRequestHandler(fn) { this.permission = fn; }
-  setPermissionCheckHandler(fn) { this.permissionCheck = fn; }
-  getUserAgent() { return "Mozilla/5.0 Chrome/140.0 frame-control/0.4.4 Electron/44.4.5 Safari/537.36"; }
-  setUserAgent(ua) { this.ua = ua; }
-  async clearStorageData(opts) { this.log.push("clear"); this.cleared.push(["storage", opts]); }
-  async clearCache() { this.cleared.push(["cache"]); }
-  async clearAuthCache() { this.cleared.push(["auth"]); }
-}
-
-function fakes({ timeout } = {}) {
-  const log = [];  // the order things happened in
-  const sessions = new Map();
-  const defaultSession = new FakeSession("default", log);
-  const session = {
-    defaultSession,
-    fromPartition(name) {
-      if (!sessions.has(name)) sessions.set(name, new FakeSession(name, log));
-      return sessions.get(name);
-    },
-  };
-  const windows = [];
-  class BrowserWindow extends EventEmitter {
-    constructor(opts) {
-      super();
-      this.opts = opts;
-      this.destroyed = false;
-      this.veto = false;  // a page whose beforeunload keeps the window open on close()
-      this.focused = 0;
-      const wc = new EventEmitter();
-      wc.loaded = [];
-      wc.loadURL = async (u) => { wc.loaded.push(u); };
-      wc.setWindowOpenHandler = (fn) => { wc.openHandler = fn; };
-      // Deliberately a different session: the code must read the partition's, not guess.
-      wc.session = defaultSession;
-      this.webContents = wc;
-      windows.push(this);
-    }
-    isDestroyed() { return this.destroyed; }
-    focus() { this.focused++; }
-    close() { if (this.destroyed || this.veto) return; this.destroy(); }
-    destroy() { if (this.destroyed) return; this.destroyed = true; log.push("destroyed"); this.emit("closed"); }
-  }
-  const opened = [];
-  const shell = { openExternal: (u) => { opened.push(u); } };
-  const calls = [], attempts = [], cancels = [];
-  let answer = () => ({ status: 200, data: { connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" } });
-  const connect = async (token, attempt) => { calls.push(token); attempts.push(attempt); log.push("connect"); return answer(token); };
-  const cancel = async (attempt) => {
-    cancels.push(attempt);
-    log.push(`cancel (cookie listeners: ${session.fromPartition(PARTITION).cookies.listenerCount("changed")})`);
-  };
-  const flow = createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent: () => null, ...(timeout ? { timeout } : {}) });
-  return { flow, session, sessions, windows, opened, calls, attempts, cancels, log, setAnswer: (fn) => { answer = fn; },
-           meta: () => session.fromPartition(PARTITION) };
-}
-
-const tick = () => new Promise((r) => setImmediate(r));
-async function settle() { for (let i = 0; i < 10; i++) await tick(); }
-
-function navigate(wc, event, target) {
-  let prevented = false;
-  wc.emit(event, { preventDefault: () => { prevented = true; } }, target);
-  return prevented;
-}
-
-test("only plain HTTPS addresses on Meta's login sites are allowed", () => {
-  for (const ok of ["https://secure.oculus.com", "https://secure.oculus.com/my/profile", "https://auth.meta.com/login/",
-                    "https://www.meta.com/", "https://www.facebook.com/login.php", "https://oculus.com:443/"]) {
-    assert.ok(allowedUrl(ok), ok);
-  }
-  for (const bad of ["http://secure.oculus.com/", "https://oculus.com.evil.example/", "https://evil-oculus.com/",
-                     "https://notmeta.com/", "https://example.com/", "javascript:alert(1)", "file:///etc/passwd",
-                     "https://secure.oculus.com:8443/", "https://user:pw@secure.oculus.com/", "https://evil.example/?u=https://www.meta.com",
-                     "data:text/html,hi", "not a url"]) {
-    assert.ok(!allowedUrl(bad), bad);
-  }
-});
-
-test("the window is isolated: its own partition, no preload, no Node, sandboxed, on Meta's login page", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const [w] = f.windows;
-  const wp = w.opts.webPreferences;
-  assert.strictEqual(wp.partition, PARTITION);
-  assert.strictEqual(PARTITION, "persist:meta-signin");
-  assert.strictEqual(wp.contextIsolation, true);
-  assert.strictEqual(wp.nodeIntegration, false);
-  assert.strictEqual(wp.sandbox, true);
-  assert.strictEqual(wp.preload, undefined);
-  assert.strictEqual(wp.devTools, false);
-  assert.deepStrictEqual(w.webContents.loaded, [LOGIN_URL]);
-  assert.strictEqual(LOGIN_URL, "https://secure.oculus.com");
-  // Permission prompts (camera, notifications...) are refused.
-  let granted = null;
-  f.meta().permission(null, "media", (v) => { granted = v; });
-  assert.strictEqual(granted, false);
-  assert.strictEqual(f.meta().permissionCheck(null, "notifications", "https://secure.oculus.com"), false);
-  assert.ok(!/Electron|frame-control/.test(f.meta().ua));
-  w.close();
-});
-
-test("navigation stays on Meta's sites; other links open in the system browser", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(navigate(wc, "will-navigate", "https://auth.meta.com/login/"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://www.facebook.com/login.php"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://example.com/help"), true);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // A redirect elsewhere is stopped and not opened anywhere (it may carry sign-in data).
-  assert.strictEqual(navigate(wc, "will-redirect", "https://evil.example/cb?x=1"), true);
-  assert.strictEqual(navigate(wc, "will-redirect", "https://auth.meta.com/next"), false);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // New windows: never created. Meta's own load in this window; others go outside; non-web schemes nowhere.
-  assert.deepStrictEqual(wc.openHandler({ url: "https://www.meta.com/legal/terms/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "https://example.org/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "file:///etc/passwd" }), { action: "deny" });
-  await settle();
-  assert.deepStrictEqual(wc.loaded, [LOGIN_URL, "https://www.meta.com/legal/terms/"]);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help", "https://example.org/"]);
-  f.windows[0].close();
-});
-
-test("the cookie is read only from the sign-in partition, only for Meta's Oculus domain", async () => {
-  const f = fakes();
-  // The same cookie elsewhere: the default session and another partition. Never read.
-  f.session.defaultSession.cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  f.session.fromPartition("persist:other").cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  // A cookie with the right name on another site, and a signed-out value: ignored.
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: OTHER });
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: "OC123456789012345" });
-  w.webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(f.session.defaultSession.cookies.reads, 0);
-  assert.strictEqual(f.session.fromPartition("persist:other").cookies.reads, 0);
-  assert.ok(f.sessions.get(PARTITION).cookies.reads > 0);
-});
-
-test("landing on the logged-in page picks up a cookie set earlier", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.store.push({ name: COOKIE, domain: "secure.oculus.com", value: TOKEN });  // no change event
-  f.windows[0].webContents.emit("did-navigate", {}, "https://auth.meta.com/login/");  // not Meta's store site yet
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  assert.strictEqual((await done).ok, true);
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("after a connect the window closes, and the page gets the answer, never the token", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.ok(f.windows[0].isDestroyed());
-  assert.ok(!f.flow.isOpen());
-  assert.deepStrictEqual(r, { ok: true, connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" });
-  assert.ok(!JSON.stringify(r).includes(TOKEN));
-  // The cookie listener is gone: a later change sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("a token the server refuses keeps the window open, is sent once, and the next one connects", async () => {
-  const f = fakes();
-  f.setAnswer((t) => t === TOKEN ? { status: 400, data: { error: "Meta didn't accept this token." } }
-                                 : { status: 200, data: { connected: true, user: null } });
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");  // same value again
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.ok(!f.windows[0].isDestroyed());
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN, OTHER]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.user, null);
-});
-
-test("the token is never logged, and an error that echoed it is scrubbed", async () => {
-  const seen = [];
-  const names = ["log", "info", "warn", "error", "debug", "trace"];
-  const saved = Object.fromEntries(names.map((n) => [n, console[n]]));
-  const writes = [process.stdout.write, process.stderr.write];
-  for (const n of names) console[n] = (...a) => { seen.push(a.map(String).join(" ")); };
-  process.stdout.write = (c, ...rest) => { seen.push(String(c)); return writes[0].call(process.stdout, c, ...rest); };
-  process.stderr.write = (c, ...rest) => { seen.push(String(c)); return writes[1].call(process.stderr, c, ...rest); };
-  let r;
-  try {
-    const f = fakes();
-    f.setAnswer((t) => ({ status: 500, data: { error: `RuntimeError: bad ${t} and ${t.slice(0, 12)}` } }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    f.windows[0].close();  // the user gives up
-    r = await done;
-  } finally {
-    for (const n of names) console[n] = saved[n];
-    [process.stdout.write, process.stderr.write] = writes;
-  }
-  assert.strictEqual(r.ok, false);
-  assert.strictEqual(r.cancelled, true);
-  assert.ok(!r.error.includes(TOKEN) && !r.error.includes(TOKEN.slice(0, 12)), r.error);
-  assert.match(r.error, /<redacted>/);
-  assert.ok(!seen.some((s) => s.includes(TOKEN.slice(0, 12))), "token in output");
-  assert.strictEqual(scrub(`x FRL${"a".repeat(30)} y`), "x <redacted> y");
-});
-
-test("closing the window before signing in reports it, and a second click reuses the open window", async () => {
-  const f = fakes();
-  const a = f.flow.signIn();
-  const b = f.flow.signIn();
-  assert.strictEqual(a, b);
-  assert.strictEqual(f.windows.length, 1);
-  assert.strictEqual(f.windows[0].focused, 1);
-  f.windows[0].close();
-  const r = await a;
-  assert.deepStrictEqual(r, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." });
-  assert.deepStrictEqual(f.calls, []);
-});
-
-test("disconnect's sign-out closes the window and clears only the sign-in partition", async () => {
-  const f = fakes();
-  f.session.fromPartition("persist:other");
-  const pending = f.flow.signIn();
-  await f.flow.signOut();
-  const r = await pending;
-  assert.strictEqual(r.ok, false);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.meta().cleared, [["storage", undefined], ["cache"], ["auth"]]);
-  assert.deepStrictEqual(f.session.defaultSession.cleared, []);
-  assert.deepStrictEqual(f.session.fromPartition("persist:other").cleared, []);
-  // The next sign-in starts with a new window.
-  f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.windows[1].close();
-});
-
-test("the first look at a cookie value matches the server's token rules", () => {
-  assert.ok(looksLikeUserToken(TOKEN));
-  assert.ok(looksLikeUserToken("FRL" + "aB3".repeat(10)));
-  for (const bad of [undefined, "", "OC123456789012345", "OC|123|abc", "OCabc%2Fdef" + "x".repeat(20), "OCshort",
-                     "XY" + "a".repeat(30), "OC" + "A".repeat(30)]) {
-    assert.ok(!looksLikeUserToken(bad), String(bad));
-  }
-});
-
-function frameNav(wc, url, isMainFrame) {
-  let prevented = false;
-  wc.emit("will-frame-navigate", { url, isMainFrame, preventDefault: () => { prevented = true; } });
-  return prevented;
-}
-
-test("the window stays on Meta's sites; frames inside it may load any HTTPS page, nothing else", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  // Frames: captcha and CDN frames from other sites load; other schemes are stopped.
-  for (const ok of ["https://client-api.arkoselabs.com/fc/gc/", "https://newassets.hcaptcha.com/captcha/v1/x",
-                    "https://www.google.com/recaptcha/api2/anchor", "https://static.xx.fbcdn.net/x",
-                    "https://www.facebook.com/plugin", "about:blank", "about:srcdoc"]) {
-    assert.strictEqual(frameNav(wc, ok, false), false, ok);
-  }
-  for (const bad of ["http://www.facebook.com/plugin", "data:text/html,<script>x</script>", "blob:https://evil.example/1",
-                     "javascript:alert(1)", "file:///etc/passwd", "ftp://example.com/", "https://u:p@evil.example/",
-                     "chrome://settings", "not a url"]) {
-    assert.strictEqual(frameNav(wc, bad, false), true, bad);
-  }
-  // The window itself: Meta's sites only.
-  assert.strictEqual(frameNav(wc, "about:blank", true), true);
-  assert.strictEqual(frameNav(wc, "https://evil.example/", true), true);
-  assert.strictEqual(frameNav(wc, "https://client-api.arkoselabs.com/", true), true);
-  assert.strictEqual(frameNav(wc, "https://auth.meta.com/login/", true), false);
-  assert.deepStrictEqual(f.opened, []);  // stopped, never opened outside
-  f.windows[0].destroy();
-});
-
-function redirect(wc, url, isMainFrame, style) {
-  let prevented = false;
-  const e = { preventDefault: () => { prevented = true; } };
-  if (style === "details") wc.emit("will-redirect", Object.assign(e, { url, isMainFrame }));
-  else wc.emit("will-redirect", e, url, false, isMainFrame);
-  return prevented;
-}
-
-test("redirects follow the same rule per frame", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  for (const style of ["details", "positional"]) {
-    // A captcha frame redirected within HTTPS loads; a frame redirected to data: or http: doesn't.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", false, style), false, style);
-    assert.strictEqual(redirect(wc, "https://newassets.hcaptcha.com/x", false, style), false, style);
-    assert.strictEqual(redirect(wc, "data:text/html,<b>x</b>", false, style), true, style);
-    assert.strictEqual(redirect(wc, "http://www.facebook.com/x", false, style), true, style);
-    assert.strictEqual(redirect(wc, "javascript:alert(1)", false, style), true, style);
-    // The window: Meta's sites only.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", true, style), true, style);
-    assert.strictEqual(redirect(wc, "https://auth.meta.com/next", true, style), false, style);
-  }
-  // Without frame information it is treated as the window.
-  assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/", undefined, "positional"), true);
-  assert.deepStrictEqual(f.opened, []);
-  f.windows[0].destroy();
-});
-
-test("a page's beforeunload can't keep the window open", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  let prevented = false;
-  w.webContents.emit("will-prevent-unload", { preventDefault: () => { prevented = true; } });
-  assert.ok(prevented);
-  // Even if close() would be vetoed, finishing destroys the window.
-  w.veto = true;
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  assert.strictEqual((await done).ok, true);
-  assert.ok(w.isDestroyed());
-});
-
-test("closing during a connect: the cancel goes to the server only after that connect settles", async () => {
-  for (const outcome of ["saved", "refused", "failed"]) {
-    const f = fakes();
-    let release, fail;
-    f.setAnswer(() => new Promise((r, j) => { release = r; fail = j; }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-    f.windows[0].close();  // the user gives up while the server and Meta are answering
-    const r = await done;  // the page hears at once
-    assert.strictEqual(r.ok, false);
-    await settle();
-    assert.deepStrictEqual(f.cancels, [], outcome);  // not before the connect has settled
-    if (outcome === "saved") release({ status: 200, data: { connected: true } });
-    else if (outcome === "refused") release({ status: 400, data: { error: "no" } });
-    else fail(new Error("socket hang up"));
-    await settle();
-    // The same attempt id the connect carried, after it settled and after cookie intake stopped.
-    assert.deepStrictEqual(f.cancels, [f.attempts[0]], outcome);
-    assert.match(f.cancels[0], /^[A-Za-z0-9-]{8,64}$/);
-    assert.deepStrictEqual(f.log, ["connect", "destroyed", "cancel (cookie listeners: 0)"], outcome);
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-  }
-});
-
-test("closing before any connect needs no cancel", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: TOKEN });  // nothing usable
-  await settle();
-  f.windows[0].close();
-  assert.strictEqual((await done).ok, false);
-  await f.flow.signOut();
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  assert.deepStrictEqual(f.cancels, []);
-});
-
-test("a timeout during a connect cancels after it settles", async () => {
-  const f = fakes({ timeout: 50 });
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));  // Meta is slow
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.match(r.error, /timed out/);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("disconnect during a connect waits for it, cancels it, then clears, before the page deletes the account", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.log.length = 0;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });  // the page's Disconnect, step one
-  assert.strictEqual((await done).ok, false);
-  await settle();
-  assert.strictEqual(signedOut, false);  // still waiting for the connect
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 200, data: { connected: true } });  // it saved, just now
-  await out;
-  // Only now would the page post its disconnect: the cancel (which deletes what that
-  // connect saved) has reached the server, and the session is cleared.
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("a later disconnect still waits for a closed window's connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await done;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });
-  await settle();
-  assert.strictEqual(signedOut, false);
-  release({ status: 400, data: { error: "no" } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("nothing sent means nothing to cancel; sign-out destroys the window, cancels, then clears", async () => {
-  const f = fakes();
-  // Nothing sent: closing cancels nothing.
-  const a = f.flow.signIn();
-  f.windows[0].close();
-  await a;
-  assert.deepStrictEqual(f.cancels, []);
-  // Something sent, then signed out: the attempt is cancelled before the session is cleared.
-  f.setAnswer(() => ({ status: 400, data: { error: "Meta didn't accept this token." } }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[1].veto = true;  // and its page tries to stay open
-  f.log.length = 0;
-  await f.flow.signOut();
-  assert.strictEqual((await b).ok, false);
-  assert.ok(f.windows[1].isDestroyed());
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  // After sign-out a new cookie in the partition sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("each sign-in has its own attempt id", async () => {
-  const f = fakes();
-  f.setAnswer(() => ({ status: 400, data: { error: "no" } }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await a;
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  f.windows[1].close();
-  await b;
-  await settle();
-  assert.strictEqual(f.attempts.length, 2);
-  assert.notStrictEqual(f.attempts[0], f.attempts[1]);
-  assert.deepStrictEqual(f.cancels, f.attempts);
-});
-
-test("no sign-in can start while a sign-out waits on an earlier connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const first = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  const out = f.flow.signOut();  // Disconnect pressed while that connect is under way
-  assert.strictEqual((await first).ok, false);
-  assert.ok(f.flow.isSigningOut());
-  // The page answered, so the user tries again at once: refused, no window, nothing sent.
-  const second = await f.flow.signIn();
-  assert.deepStrictEqual(second, { ok: false, error: "Frame Control is signing out of Meta; try again in a moment." });
-  assert.strictEqual(f.windows.length, 1);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  // A second sign-out joins the first.
-  assert.strictEqual(f.flow.signOut(), out);
-  release({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  assert.strictEqual(f.meta().cleared.filter(([k]) => k === "storage").length, 1);
-  assert.ok(!f.flow.isSigningOut());
-  // Once it is done, signing in works again.
-  f.setAnswer(() => ({ status: 200, data: { connected: true } }));
-  const third = f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  assert.strictEqual((await third).ok, true);
-});
-
-test("sign-out goes round until no window and no connect or cancel is left", async () => {
-  const f = fakes();
-  let releaseA;
-  f.setAnswer(() => new Promise((r) => { releaseA = r; }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();  // window A closed; its cancel waits on its connect
-  await a;
-  // Window B is open, with its own connect under way, when sign-out starts.
-  let releaseB;
-  f.setAnswer(() => new Promise((r) => { releaseB = r; }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  let finished = false;
-  const out = f.flow.signOut().then(() => { finished = true; });
-  await b;
-  releaseB({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.strictEqual(finished, false);  // A's connect is still under way
-  releaseA({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual([...f.cancels].sort(), [...f.attempts].sort());
-  assert.strictEqual(f.attempts.length, 2);
-  assert.strictEqual(f.log[f.log.length - 1], "clear");
-});

app/test/updater.test.js

@@ -51,27 +51,6 @@ test("update.json assets always download from this repository's release", () =>
   assert.throws(() => require("../updater").fromManifest({ version: "nope", assets: [] }));
 });
 
-test("the release page is this repository's tag page, never a draft's untagged-... link", () => {
-  const { fromManifest, fromApi } = require("../updater");
-  const tagPage = "https://github.com/saphid/frame-control/releases/tag/v0.4.0";
-  const page = (p) => fromManifest({ version: "0.4.0", assets: [], page: p }).page;
-  assert.strictEqual(page(tagPage), tagPage);
-  // 0.4.0's real update.json: the draft's address, a 404 once published.
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/untagged-c6ddfed7f75d67db2e99"), tagPage);
-  assert.strictEqual(page(undefined), tagPage);
-  assert.strictEqual(page("https://evil.example/releases/tag/v0.4.0"), tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.4.0?x=1"), tagPage);
-  // Paths that normalize to another repository.
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/..\\..\\..\\..\\other-owner\\other-repo"),
-                     tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/%2e%2e/%2e%2e/%2e%2e/%2e%2e/other-owner/other-repo"),
-                     tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.3.9"), tagPage);  // only its own tag
-  assert.strictEqual(fromApi({ tag_name: "../../x", assets: [] }).page, "https://github.com/saphid/frame-control/releases");
-  assert.strictEqual(fromApi({ tag_name: "v0.4.0", assets: [],
-                               html_url: "https://github.com/saphid/frame-control/releases/tag/untagged-x" }).page, tagPage);
-});
-
 test("prepare refuses a release that isn't newer (no downgrades)", async () => {
   const { prepare } = require("../updater");
   const release = { version: "0.3.1", assets: [] };

app/updater.js

@@ -106,24 +106,12 @@ async function getJson(url, headers) {
   return JSON.parse(body);
 }
 
-// The release page the banner links to. update.json for 0.4.0 carried the draft's
-// address (releases/tag/untagged-...), which is dead once the release is published,
-// and a page from the manifest could also be steered elsewhere (e.g. tag/..\..\other/repo
-// normalizes to another repository) before shell.openExternal. So the given page is
-// ignored: the link is always this repository's tag page, built from a valid version.
-function releasePage(version) {
-  const v = parseVersion(version);
-  if (!v) return RELEASES;
-  return `${RELEASES}/tag/v${v.nums.join(".")}${v.pre ? "-" + v.pre : ""}`;
-}
-
 // update.json and the API's release both become { version, notes, page, assets }.
 function fromManifest(m) {
   if (!parseVersion(m.version) || !Array.isArray(m.assets)) throw new Error("update.json is malformed");
-  const version = String(m.version).replace(/^v/i, "");
-  const base = `https://github.com/${REPO}/releases/download/v${version}/`;
-  return { version, notes: String(m.notes || "").slice(0, 4000),
-           page: releasePage(version),
+  const base = `https://github.com/${REPO}/releases/download/v${String(m.version).replace(/^v/i, "")}/`;
+  return { version: String(m.version).replace(/^v/i, ""), notes: String(m.notes || "").slice(0, 4000),
+           page: m.page || RELEASES,
            // Assets always come from this repository's release, whatever the manifest says.
            assets: m.assets.map((a) => ({ name: String(a.name), url: base + encodeURIComponent(String(a.name)),
                                           size: a.size, digest: a.digest || null })) };
@@ -131,9 +119,8 @@ function fromManifest(m) {
 
 function fromApi(r) {
   if (r.draft || r.prerelease) throw new Error("GitHub returned an unpublished release");
-  const version = String(r.tag_name || "").replace(/^v/i, "");
-  return { version, notes: String(r.body || "").slice(0, 4000),
-           page: releasePage(version),
+  return { version: String(r.tag_name || "").replace(/^v/i, ""), notes: String(r.body || "").slice(0, 4000),
+           page: r.html_url || RELEASES,
            assets: (r.assets || []).map((a) => ({ name: a.name, url: a.browser_download_url, size: a.size,
                                                  digest: a.digest || null })) };
 }

docs/agents.md

@@ -97,7 +97,7 @@ replies, screenshots and approval payloads are not sent to analytics.
 
 ## Assistant panel
 
-Open **Tools → Open assistant**, or `http://127.0.0.1:47810/assistant`.
+Open **Settings** (the gear in the header) **→ Open assistant settings**, or `http://127.0.0.1:47810/assistant`.
 To put the same page in the headset, with the HTTP server still running:
 
 ```sh

docs/apks.md

@@ -39,12 +39,6 @@ section below), instead of going into Lepton Development:
    run at once alongside Lepton Development, each in its own container
    (`lepton-steamlaunch-<id>`, ADB on 5556, 5557, …).
 
-Split APKs (a base plus `split_*.apk` files) install as one app:
-`python3 ui/frame_android.py install base.apk split1.apk …`. Lepton runs one
-APK, so splits that add native libraries or assets are merged into the base
-and re-signed; density and language splits are refused. See
-[quest-import.md](quest-import.md#split-apks). Not yet tried on a real Frame.
-
 Verified with AntennaPod and Tabletop Tools: installed in about 7 s, launched
 from the shortcut, stopped, and relaunched with their data intact. ADB and
 Lepton Development aren't involved.

docs/devices.md

@@ -3,8 +3,9 @@
 Frame Control can manage more than one Steam Frame, and each headset can be
 reached at more than one address: a LAN IP at home, another at the office, its
 mDNS name (`frame.local`), its Tailscale IP or MagicDNS name. The **Devices**
-tab (key 5) lists them, and the connection pill in the header shows what the
-app is doing to reach the one in use, step by step, as it happens.
+tab (key 5) lists them. The connection pill in the header says whether the one in
+use is connected and how (Tailscale, or the network's name); click it to add,
+edit or reorder that headset's addresses, or to see each step of connecting.
 
 The code is in three modules, all stdlib-only Python on your computer:
 
@@ -57,7 +58,7 @@ and ranks them:
 5. addresses that only ever worked on other networks;
 6. Tailscale addresses while Tailscale is off.
 
-Your order on the Devices tab breaks ties. The best-ranked address that answers
+Your order (on the Devices tab, or in the pill's dialog) breaks ties. The best-ranked address that answers
 wins; one that answers first waits up to 0.35 s for a better-ranked one that is
 still trying. If SSH to the winner fails in a way another address could fix
 (a different device answered there, or the link dropped), the next one that
@@ -72,6 +73,16 @@ status --json`, including the Mac app's own CLI) with buttons to add their
 MagicDNS name or IP. **Find on this network** asks mDNS for SteamOS devkit
 services and checks `ALIAS.local` and `frame.local`.
 
+**The pill's dialog** lists the same addresses, with what each one answered, and
+can add, edit, reorder and remove them without leaving the page you're on. When
+the headset reports a LAN IP on the same network as this computer and that IP
+isn't saved, it offers to add it. The offer puts the address first in the list,
+so on that network it wins over the Tailscale name; away from home the Tailscale
+name still leads. A new or edited address is tested straight away. While
+connected, **Reconnect** applies your changes now rather than at the next
+connection: it tries the addresses again, ranked as above, and the best-ranked
+one that answers promptly wins. It doesn't pick a particular address.
+
 ## Networks
 
 A network is told apart by its default gateway: the router's IP address plus its
@@ -104,9 +115,7 @@ connection is an SSH ControlMaster that every command shares; when it dies (the
 headset slept or left the network) the connector notices and starts again. On
 Windows, where OpenSSH can't share a connection, the same handshake runs once
 and each command then connects on its own; a command that can't reach the
-headset makes the connector start again. There ssh's stderr goes to a file that
-the connector reads as it grows, not a pipe: Windows' OpenSSH can block writing
-to a redirected pipe.
+headset makes the connector start again.
 
 Once connected, every `ssh`, `scp` and `rsync` the app runs gets
 `-o HostName=<address> -o HostKeyAlias=frame-control-<id>
@@ -123,57 +132,10 @@ lease that moved) would look like a new host there. The app keeps one known_host
 file per headset instead, so saving or forgetting one headset's key never touches
 another's: a different device answering at one of its
 addresses is refused, and the pill says so. A headset's first connection trusts
-the key it shows, as Set Up Connection does: while a headset has never had an
-identity here, every ssh command gets `StrictHostKeyChecking=accept-new` (the
-first contact saves it, whichever command makes it), and from then on
-`StrictHostKeyChecking=yes`. `accept-new` never replaces a saved key, so it
-can't hide a change. The saved key's fingerprint is also recorded in
-`devices.json` (`identity`), along with a flag that never clears
-(`identity_established`), as soon as ssh saves the key: even if the login is then
-refused. A headset counts as having had an identity if the flag is set, a
-fingerprint is recorded, its pin file exists at all, or a connection to it ever
-worked (older files get the flag from that when loaded, so editing or removing
-the address that worked doesn't undo it); then
-a pin file that's deleted, empty, unreadable or not parseable **fails closed**
-(*Checking the headset's identity* fails, "missing or can't be read") rather than
-trusting whatever answers, and only **Check its key…** saves a key again. It
-says when the key it reads matches the recorded fingerprint.
-
-**When the key changes** (SteamOS reinstalled or reset, a new headset at the
-same address, or a different device answering there), nothing is accepted by
-itself. The connection fails at *Checking the headset's identity*; the banner
-and the headset on the Devices tab say so, with **Check the new key…** (also
-**Check its key…** on the Devices tab at any time). That reads the key the
-headset shows now, and nothing more: ssh writes it to a throwaway known_hosts
-file during the key exchange, before any login, and is stopped as soon as it
-has. Every other kind of contact is ruled out on the command line, ahead of
-anything `~/.ssh/config` says: no authentication of any kind, no agent
-(`IdentityAgent=none`, `ForwardAgent=no`), no X11 or port forwarding, no local
-or remote command (`-N`), no terminal, and `-F none`. Through a ProxyJump host
-it builds that hop itself, as a ProxyCommand whose ssh forwards nothing and runs
-no local command (ProxyJump's own ssh would take `ForwardAgent` and
-`LocalCommand` from `~/.ssh/config`); it still logs in to the jump host as
-configured. Every word of that ProxyCommand is quoted for the shell that runs it
-(and `%` doubled for ssh's own tokens), the forward is `[%h]:%p` so an IPv6
-headset works, and an IPv6 jump host is passed bare with its port. Through a ProxyCommand from `~/.ssh/config`, or several jump hosts,
-it refuses, since those can't be made safe from here: add an address it can
-reach directly, or compare the key by hand. It shows the key's SHA256 fingerprint next to
-the saved one, with the command that prints it on the headset
-(`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`, in Konsole on its desktop).
-**This is my headset: trust its new key** then saves exactly that key, replacing
-the old one, and reconnects. The server keeps the key it showed for 10 minutes
-and saves it only if the page sends back the same fingerprint, and only while
-the headset's port, user and that address are unchanged; it never saves whatever
-answers next. The API's old `forget-identity`, which deleted the pin so that the
-next contact saved any key unseen, is refused. Set Up Connection can't fix a changed key: it checks your
-own `known_hosts`, not the headset's file.
-
-**When the headset refuses this computer's key** (`Permission denied
-(publickey,…)`), the connection stops at *Logging in*, and the banner and the
-Devices tab offer **Set Up Connection…**, which pairs this computer again.
-
-Neither is reported as a fault: the diagnostics report each kind at most once
-a session ([privacy.md](privacy.md)).
+the key it shows, as Set Up Connection does. After reinstalling SteamOS the
+headset has a new key; **Forget identity** (Devices tab → **Advanced**, with the
+SSH alias, user and port) lets the next
+connection save the new one.
 
 ## One server at a time
 
@@ -194,7 +156,7 @@ All under the usual `/api/` guards (loopback `Host`, `X-Frame-UI` header).
 | `GET /api/devices` | Headsets, the current network, known networks, the next free alias |
 | `GET /api/devices/tailscale?id=` | Tailscale peers, likely headsets first |
 | `GET /api/devices/mdns?id=` | Headsets found on this network |
-| `POST /api/devices` | `{"action": ...}`: `use`, `update` (name, user, port), `remove`, `address-add`, `address-update`, `address-remove`, `address-move`, `test`, `identity-scan` (read the key the headset shows: `scan` with `type`, `fingerprint`, `host`, `saved`, `recorded`, `matches`, `recorded_match`), `identity-trust` (`fingerprint`: save the key `identity-scan` showed), `forget-identity` (refused: use the two before), `name-network`, `setup` (alias, optional host), `retry` |
+| `POST /api/devices` | `{"action": ...}`: `use`, `update` (name, user, port), `remove`, `address-add`, `address-update`, `address-remove`, `address-move`, `test`, `forget-identity`, `name-network`, `setup` (alias, optional host), `retry` |
 
 Every host, alias and user is checked against strict patterns before it's
 stored, because they end up in ssh arguments and `~/.ssh/config`; nothing goes
@@ -211,7 +173,7 @@ share the format later (it still connects to one host; see
 ```json
 {"version": 1, "active": "f67f8b7e",
  "devices": [{"id": "f67f8b7e", "name": "Steam Frame", "alias": "frame", "user": "steamos", "port": 22,
-              "identity_files": ["~/.ssh/id_ed25519_frame"], "identity": ["SHA256:…"], "identity_established": true,
+              "identity_files": ["~/.ssh/id_ed25519_frame"],
               "addresses": [{"host": "frame.local", "kind": "mdns", "label": "",
                              "networks": ["n-e0998baa61"], "last_ok": 1790593550.4, "last_rtt_ms": 0.9}]}],
  "networks": {"n-e0998baa61": {"name": "Home Wi-Fi", "ssid": null, "gateway": "192.168.1.1",

docs/family-comfort.md

@@ -58,7 +58,7 @@ not been verified and is not guaranteed.
 
 ## Casting
 
-**Cast headset view** starts the existing headset Live view and requests full
+**Cast to this screen** (Home → **Right now**) starts the existing headset Live view and requests full
 screen where supported. Show that screen to people in the room, or use the
 computer/phone's own screen mirroring. It creates no new stream transport,
 public URL or LAN server. iPhone uses the inline viewer if full screen is not

docs/frame-control.md

@@ -17,14 +17,19 @@ python3 ui/server.py         # anywhere: then open http://127.0.0.1:47810
 
 ## Features
 
-The window has five tabs: **Home** (headset view, status, screenshots),
-**Games** (installed games, sideloaded titles, getting games), **Android** (apps,
-the catalogue, display settings, reports), **Tools** (sending files and text,
-Flatpaks, remote and power) and **Devices** (your headsets and their addresses).
-Keys 1–5 switch between them. Files can be dropped anywhere in the window. A
-connection pill in the header always shows which headset, which network this
-computer is on, the address in use or being tried, and each step of connecting
-as it happens; click it for the whole timeline. When the Frame can't be
+The window has five tabs: **Home** (what the headset's doing and what you'd do
+next, the headset view, screenshots, family and comfort, the keyboard and
+trackpad, and VR performance, folded away), **Games** (installed games,
+sideloaded titles, getting games), **Android** (apps, the catalogue, display
+settings, reports), **Tools** (in the headset: your computer's windows, the media
+player and the panel switcher; then sending files and text, Flatpaks, remote and
+power) and **Devices** (your headsets and their addresses). Keys 1–5 switch
+between them. The gear in the header (key 6) opens **Settings**: privacy and
+updates, library artwork and the assistant. The battery chip opens the headset's
+details: storage, memory, temperature, Wi-Fi, uptime and SteamOS build. Files can be dropped anywhere in the window. A
+connection pill in the header always shows which headset and whether it's
+connected, and how (Tailscale, or the network's name). Click it to add, edit or
+reorder the headset's addresses, or to see each step of connecting. When the Frame can't be
 reached, a banner says why in plain words, what was tried, and counts down to
 the next try, filling everything in once it answers. Flatpak and Android installs run in the background; the bottom bar
 counts them while they run.
@@ -88,13 +93,8 @@ counts them while they run.
   name your networks, and switch headsets. See [devices.md](devices.md).
 - **One-click tools**: SSH or SFTP in a terminal window, Steam Link, and remote
   desktop (Windows App on macOS, Remote Desktop on Windows, Remmina or FreeRDP on
-  Linux). Remote desktop first checks that the Frame's xrdp answers on port
-  3389 (Developer Mode turns it on). On Windows it opens a connection file for
-  user `steamos`, because `mstsc /v:` alone offers your Windows account, which
-  xrdp turns away. Accept the warning about the Frame's own certificate, then
-  sign in with the Developer Mode password. Sleep, restart and
-  shut down open a terminal window because SteamOS asks for the sudo password
-  over SSH.
+  Linux). Sleep, restart and shut down open a terminal window because SteamOS
+  asks for the sudo password over SSH.
 
 ## How it works
 
@@ -183,5 +183,5 @@ Control implementations. MCP wraps this HTTP API without API keys. Changes
 require a separate user approval; power also retains its password prompt. The
 assistant uses a user-chosen endpoint and sends nothing until the user opts in
 for a message. Screenshot context is separately opt-in. Model replies cannot
-operate the headset. Tools → Open assistant opens the page; the linked guide
+operate the headset. Settings → Open assistant settings opens the page; the linked guide
 covers putting it in a Chromium panel on the Frame.

docs/iphone.md

@@ -114,8 +114,8 @@ don't.
 
 ## Family and comfort
 
-The shared Home card sets session limits, breaks and check-ins, and offers
-**Cast headset view**. **Enable / test notifications** requests iOS notification
+The shared Home card sets session limits, breaks and check-ins; **Cast to this
+screen** is in Home's **Right now** card. **Enable / test notifications** requests iOS notification
 permission and sends a local test. These are local notifications, not APNs push;
 iOS background suspension can interrupt phone alerts. The headset timer still
 runs. See [the behavior and verification limits](family-comfort.md).

docs/meta-library.md

@@ -1,366 +0,0 @@
-# My Meta library (Experimental)
-
-Install Quest games your Meta account owns straight from Meta, test whether
-they run on the Steam Frame, and add the result to the shared compatibility
-reports. It is off until you connect, and it lives in **Android → My Meta
-library**.
-
-**Read this first.** My Meta library uses Meta's undocumented internal API
-with your own Meta access token, as the open-source tools QAVS, DownQuest and
-BSManager do. It may stop working whenever Meta changes things, and using it
-may be against Meta's terms. Your account is your responsibility. Frame
-Control is unofficial and not made or endorsed by Meta or Valve.
-
-What it will and won't do:
-
-- It lists and downloads only games your account owns (its active
-  entitlements). It never downloads anything else.
-- It installs games as Meta ships them. There is **no licence-check bypass**:
-  no patching, no stub libraries, no OVRPort or FramePort. A game that
-  enforces Meta's licence check may quit or hang on the Frame, because that
-  check needs Meta's services, which the Frame doesn't have.
-- Game files go only to a cache folder on your computer and then to your
-  Frame. They are deleted from the cache after each install, and never
-  uploaded or shared. Reports carry results only (below), never files or your
-  token.
-
-## Your token
-
-Frame Control never reads your browser's cookies. There are two ways to give
-it your token.
-
-**Sign in with Meta** (desktop app only; a plain browser doesn't show it).
-Tick **I understand…**, then choose **Sign in with Meta…**. Meta's own login
-page (`https://secure.oculus.com`, the address BSManager's "Log in with Meta"
-opens) appears in a Frame Control window. Sign in there as usual. When Meta's
-site sets its access token cookie (`oc_ac_at`), Frame Control takes it from
-that window, connects with it exactly as if you had pasted it (below), and
-closes the window. The window:
-
-- has its own storage (the Electron session `persist:meta-signin`), separate
-  from Frame Control's main window and from every browser on your computer;
-  the cookie is read only from there, and only for `oculus.com`;
-- runs Meta's page sandboxed, with no access to Frame Control (no preload, no
-  Node, context isolation on, no developer tools) and every permission request
-  or check (camera, notifications…) refused;
-- only goes to `https://` pages on `oculus.com`, `meta.com` and `facebook.com`
-  (and their subdomains). A link anywhere else opens in your system browser; a
-  redirect anywhere else is stopped. Pop-ups on those sites open in the same
-  window. Frames inside the page may load any `https://` page (Meta's login
-  can embed captcha and CDN frames from other sites, such as Arkose Labs,
-  hCaptcha, reCAPTCHA or fbcdn) or an empty frame (`about:blank`,
-  `about:srcdoc`); a frame going to any other scheme (`http:`, `data:`,
-  `blob:`, `javascript:`, `file:`…) is just stopped. Redirects follow the same
-  rule for the frame they happen in. Frames can't reach the
-  token: the cookie is read by Frame Control's main process, and the window
-  has no IPC;
-- sends a cookie value on only if it looks like a user token (`OC` or `FRL`,
-  mixed case, no `%`, `|` or `:`), and each value once. If the server refuses
-  it, the window stays open; close it to see why;
-- gives up after 10 minutes, as BSManager does;
-- when it is closed, times out or is signed out of, stops reading cookies
-  first, then is destroyed (a page's "leave this page?" can't keep it open),
-  and, if it had sent a token, tells the server to drop that sign-in: each
-  sign-in has a random attempt id. The cancel is sent only once the connect
-  under way has finished (saved, refused or failed), so the server always
-  gets it after the connect; with nothing sent, there is nothing to cancel.
-  The server lists an attempt only while its
-  connect is being checked: cancelled then, it isn't saved; cancelled just
-  after its token was saved (even before the connect has finished tidying
-  up), that token is deleted (as a disconnect). A cancel
-  never removes an account a later sign-in or a pasted token saved, and one
-  for an unknown attempt changes nothing.
-
-The page never sees the token: the desktop app hands it straight to the local
-server's connect path and tells the page only the answer (connected, and your
-Meta display name). It isn't logged anywhere.
-
-The window keeps you signed in to Meta (in `persist:meta-signin` only) until
-you **Disconnect**, which also signs out of Meta in Frame Control: it clears
-that window's cookies, storage and cache, so the next sign-in starts fresh.
-**Sign out of Meta in Frame Control** next to the sign-in button does just
-that part, for a sign-in that didn't connect.
-
-**Paste a token.** You copy your own token and paste it in. The two ways
-BSManager's guide describes
-([How to obtain your Oculus Token](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token)):
-
-1. **From the Meta website.** Sign in at `https://secure.oculus.com`. Open the
-   browser's developer tools, then **Application** (Chrome, Edge) or
-   **Storage** (Firefox) → **Cookies** → `https://secure.oculus.com`. Copy the
-   value of `oc_ac_at`. It starts with `OC`.
-2. **From the Meta Quest PC app** (Windows). Press **Ctrl+Shift+I**, open
-   **Network**, press **Ctrl+R**, type `graph` in the filter, open the first
-   request, and copy the access token from its **Payload**. It starts with
-   `FRL`.
-
-Treat it like a password: anyone with it can act as your Meta account. Signing
-out of the Meta website or app usually ends it; then connect again with a new
-one.
-
-Frame Control refuses values that can't be a user token before sending them
-anywhere: anything not starting with `OC` or `FRL`, URL-encoded copies (with
-`%`), app tokens (with `|` or `:`), cut-off values (under 20 characters), and
-anything with characters other than letters, digits and `+ / = - _` (the
-base64 and URL-safe base64 sets), or with no lower-case letter (real tokens are
-mixed case). The public tools only describe tokens made
-of letters and digits; if a real token needs another character, it has to be
-added in one place (`TOKEN_CHARS` in `ui/frame_meta.py`), which also makes
-the redaction look for it.
-
-## Using it
-
-1. Tick **I understand…**, then either choose **Sign in with Meta…** (desktop
-   app) or paste your token and choose **Connect**. Frame Control asks Meta
-   "who am I" with it (a read-only query); only a token Meta accepts is kept.
-2. Your Quest games are listed with their version, size, game data, and the
-   community verdict from the compatibility database when there is one.
-3. **Install** downloads the game and installs it on the Frame, as [Import
-   from my Quest](quest-import.md) does. A game with OBB game data then needs
-   a second **Install** while you have it open on the Frame: Frame Control
-   downloads the data, copies it in and closes the game.
-4. **Install and test** does the same, then starts the game itself (twice if
-   it has game data to add: once to add it, once for the test), watches it for
-   about 30 seconds, and records what happened. **Test again** repeats only
-   the test.
-5. **Disconnect** deletes the token from your computer and, in the desktop
-   app, signs out of Meta in Frame Control (clears the sign-in window's
-   storage). Games already on the Frame stay.
-
-From a terminal (the token is read from standard input, never an argument):
-
-```sh
-python3 ui/frame_meta.py connect --token-stdin      # paste the token, press Enter
-python3 ui/frame_meta.py status
-python3 ui/frame_meta.py list [--refresh]           # owned Quest games, with community verdicts
-python3 ui/frame_meta.py download APP_ID            # into the local install cache (a later download clears it after 6 hours)
-python3 ui/frame_meta.py install APP_ID [--test] [--allow-downgrade]
-python3 ui/frame_meta.py test com.example.game [--wait 30] [--no-report]
-python3 ui/frame_meta.py disconnect
-```
-
-The local API: `GET /api/meta` (connected or not, never the token),
-`GET /api/meta?library=1[&refresh=1]` (the games), and `POST /api/meta` with
-`{"action": "connect", "token": "...", "acknowledged": true}`,
-`{"action": "disconnect"}`, `{"action": "cancel-signin", "attempt": "..."}`, `{"action": "install", "app": "APP_ID", "test": false,
-"allowDowngrade": false}` or `{"action": "test", "package": "..."}`. Install and
-test return a background job (`/api/job`). Sign in with Meta uses the same
-`connect` action: the desktop app's main process (`app/meta-signin.js`) posts
-it with the cookie's value and an `"attempt"` id (8 to 64 letters, digits or
-`-`) once the page's acknowledgement box is ticked. A connect whose attempt
-was cancelled while it was checked answers 409 and saves nothing;
-`cancel-signin` for an attempt whose token is the saved account deletes it.
-
-## What an install does
-
-1. Checks the game is in your library (by its Meta app id), and that there's
-   room on this computer for the APK, a patched copy of it and the game data.
-2. Downloads the APK from Meta's download server, within the size Meta
-   declared (and at most 2 GB), checking its SHA-256 if Meta gives one, and
-   that it is an APK of the package and version Meta said.
-3. Runs Import from my Quest's checks. Refused: 32-bit-only builds (no
-   `arm64-v8a`), and apps that need an Android newer than Lepton's (API 30).
-   Installed with a warning: games that use Meta's licence check
-   (`libovrplatformloader.so`), and VrApi-only games ("may not run").
-4. Installs it with `frame_android.install` (VR detection, the launcher fix,
-   the OpenXR compatibility layer, artwork, a Steam library entry). An older
-   copy never silently replaces a newer one on the Frame unless you tick
-   **Allow replacing a newer version**.
-5. Game data: the app's OBB (saved as Meta names it when that is a standard
-   `main|patch.<version>.<package>.obb` name, otherwise as
-   `main.<version code>.<package>.obb`) and any *required* asset files with
-   standard OBB names, at most 8 GB each. One install downloads at most 16 GB
-   in all, APK included, counted as the bytes arrive (so files whose size Meta
-   doesn't give count too); a file that goes past it is stopped and removed.
-   The data is copied into the
-   running game by the same two-step helper Import from my Quest uses. Other
-   asset files (DLC packs, `.pak` files a game fetches through Meta's
-   Platform SDK) aren't downloaded; the result lists them.
-6. Deletes everything it downloaded, whether the install worked or not.
-   Downloads left by a crash are removed after six hours.
-
-## The test, and the report
-
-The test starts the game, waits for its Lepton instance, then looks every 10
-seconds for 30 seconds: is the game's process alive, and what does its Android
-log (main, system and crash buffers) say. It recognises:
-
-| In the log | Cause given |
-|---|---|
-| "entitlement check failed", "not entitled", `ovr_Entitlement…` or `IsUserEntitledToApplication` reporting a failure (a call that passes doesn't count) | Meta's licence check failed |
-| Platform SDK initialisation errors | Meta's Platform SDK couldn't start |
-| `Failed to launch SystemActivities`, "device not supported" | The game checks it is on a Meta Quest |
-| `vrapi_… was called before…`, VrApi load errors | Legacy VrApi |
-| `XR_ERROR_EXTENSION_NOT_PRESENT` (with the extension's name) | An OpenXR feature the Frame lacks |
-| `XR_ERROR_API_VERSION_UNSUPPORTED`, runtime/initialisation failures | OpenXR version or session problems |
-| `VK_ERROR_DEVICE_LOST`, `zink`, `libgallium_dri.so`, `GL_INVALID_…`, shader failures | Graphics driver errors |
-| `ClipboardManager` | Lepton's missing clipboard service |
-| `NoSuchMethodError`, `UnsatisfiedLinkError`, `dlopen failed` | Android or library features Lepton lacks |
-| `FATAL EXCEPTION`, `Fatal signal`, `SIGSEGV` | A crash |
-| `ANR in …`, "Input dispatching timed out" | Not responding |
-| `XR_SESSION_STATE_SYNCHRONIZED/VISIBLE/FOCUSED`, `xrEndFrame` | The VR scene started |
-
-The outcome is one of **runs** or **runs with issues** (its VR scene
-started), **quits** (closed by itself), **crashes**, **hangs** (Android
-reported it not responding; Frame Control then closes it, and says so if it
-couldn't), **didn't start** (its instance never came up), or **no clear
-result**: it stayed open but its log never showed its VR scene starting. That
-can be a game still loading, or one stuck after a failed check; Frame Control
-can't tell, so it doesn't record it. A game already open is closed first, so
-the test starts clean; if it can't be closed, nothing is tested. If the Frame
-fails while the test reads the game or its log, the test says only that it
-couldn't read the log: a failed command's output can be the game's log, so it
-is never shown. Signatures look at the first 4 KB of each log line and are
-bounded, so a huge or hostile log can't make the test slow. They
-are written for Frame Control from the research in [vr-apks.md](vr-apks.md);
-they are not copied from other tools.
-
-The result goes through the same path as **Test** and **Report**
-(`frame_catalog.add_report`): `via` probe, source `meta-store`, the result
-(`runs`, `crashes` or `instance_failed`, the values the database accepts), and
-notes with the outcome, the cause, the names of the matched signals and the
-version code, all fixed texts. Nothing else: no token, account name, file or
-log text. The page may show a short name from the log next to the cause (an
-OpenXR extension, a library, an exception class or a signal), taken from the
-log line after the token is removed from it, and left out unless it looks like
-a real name (64 characters at most, no long mixed letter-and-digit runs);
-reports never carry it. It is always kept on this
-computer; it reaches the shared database only if **Share compatibility
-results** is on in Privacy settings, as for every report. The panel offers to
-turn that on.
-
-## Your token and privacy
-
-- Kept in `meta-account.json` in Frame Control's per-user data folder
-  (`~/Library/Application Support/Frame Control` on macOS,
-  `%APPDATA%\Frame Control` on Windows, `~/.local/share/frame-control` on
-  Linux), written owner-only (0600) through a temporary file. Never on the
-  Frame.
-- Sent only to `graph.oculus.com` (in the POST body) and
-  `securecdn.oculus.com` (in the download address, which is how that server
-  takes it), over HTTPS. A download that redirects elsewhere (Meta's CDN) is
-  followed only to a plain HTTPS address on port 443 that doesn't carry the
-  token in any form, anywhere (host, path, query or fragment; literal,
-  recased, percent-encoded, or 8+ characters of it), nor an `access_token`
-  parameter. That is checked before any lookup or connection, and a redirect
-  that fails it is refused. API answers that redirect are refused.
-- Every connection goes to an address checked to be public (an allow-list:
-  no private, local, shared, reserved, multicast, NAT64, 6to4 or Teredo
-  addresses), and to exactly that address, with TLS checked for the host
-  name, so a second DNS answer can't swap in another. System proxy settings
-  aren't used. This is the same design as the itch.io purchases branch.
-- Never in logs, error messages, API answers, the page or reports: every
-  message is cleaned first, matching the token (or any start of it of 8+
-  characters) in any letter case, with each character written literally or
-  percent-encoded once or twice (%XX, %25XX) in either case, and any other
-  token-shaped value, before it is shortened.
-- Disconnect deletes the file and the library Frame Control holds in memory,
-  and stops a download under way. A connect still being checked when you
-  disconnect is not saved. In the desktop app, before the token is deleted, it
-  also stops any sign-in under way, destroys the sign-in window, waits for a
-  connect still under way to finish and cancels its attempt (deleting its
-  token if it was just saved), and only then clears the `persist:meta-signin` session
-  (cookies, storage, cache); no other session is touched. Sign in with Meta
-  stays off from the moment you press Disconnect until the token is deleted,
-  and the app refuses a sign-in while it is signing out.
-- With Sign in with Meta, a second copy of your Meta sign-in lives in that
-  session's storage, in Electron's per-user data folder (`Partitions/meta-signin`),
-  until you disconnect or sign out of Meta in Frame Control.
-
-## Where the protocol comes from
-
-Frame Control's code is its own (MIT). These public sources describe the
-protocol; Frame Control takes only facts from them (addresses, query ids,
-field names), not code. QAVS and BSManager are GPL-3.0; OculusGraphQLApiLib,
-DownQuest and Oculus-downgrader state no licence.
-
-| Fact | Source |
-|---|---|
-| GraphQL at `https://graph.oculus.com/graphql`, POST, form fields `access_token`, `doc_id`, `variables`; `OAuthException` / code 190 for a bad token | [OculusGraphQLApiLib `GraphQLClient.cs`](https://github.com/ComputerElite/OculusGraphQLApiLib/blob/866081e2/OculusGraphQLApiLib/GraphQL/GraphQLClient.cs), [DownQuest `DownQuest.js`](https://github.com/ptrpaws/DownQuest/blob/50f5d558/DownQuest.js) |
-| "Who am I": `doc_id` 4149322231793299, `data.viewer.user {id, alias}` | OculusGraphQLApiLib `GraphQLClient.cs` and `Results/User.cs` |
-| Owned apps: `doc_id` 4850747515044496, `data.viewer.user.active_entitlements.nodes[].item` | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/Entitlement.cs`, `Results/Application.cs`; used by [QAVS `GameDownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/GameDownloadManager.cs) |
-| One binary: `doc_id` 4734929166632773 with `binaryID`; fields `package_name`, `version`, `version_code`, `size`, `obb_binary`, `asset_files` (`file_name`, `size`, `is_required`) | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/OculusBinary.cs`, `Results/AssetFile.cs` |
-| Downloads: `https://securecdn.oculus.com/binaries/download/?id=<id>&access_token=<token>`, the same for the APK, `obb_binary` and asset files; QAVS takes the OBB and required asset files | OculusGraphQLApiLib `Game/GameDownloader.cs`, [QAVS `DownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/DownloadManager.cs), DownQuest `DownQuest.js` |
-| Token checks (`OC`/`FRL`, no `%`, `|`, `:`, not `OC` + 15 digits) | OculusGraphQLApiLib `GraphQL/TokenTools.cs`, [BSManager `oculus.helpers.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/shared/helpers/oculus.helpers.ts) |
-| How users get a token (`oc_ac_at` cookie, or the PC app's `FRL` token) | [BSManager wiki](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token) |
-| Sign in with Meta: open `https://secure.oculus.com` in an app window, and once it reaches `https://secure.oculus.com/my/profile` read the `oc_ac_at` cookie from that window's session (checked on `did-navigate`, `did-navigate-in-page`, `did-stop-loading`); 10-minute timeout | [BSManager `bs-oculus-downloader.service.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/main/services/bs-version-download/bs-oculus-downloader.service.ts) (`getUserTokenFromMetaAuth`) |
-
-**Assumed, not seen in those sources:** that the entitlement and binary
-answers carry the fields above in the shapes the libraries' models describe
-(the stored queries are opaque); that the list isn't paginated (none of the
-tools page it); that `ANDROID_6DOF` marks Quest apps; where downloads redirect
-to (the tools let their HTTP client follow redirects; Frame Control follows
-up to five, to any public HTTPS host, and refuses one carrying the token); and
-a `sha256`
-field (none was seen, so in practice only sizes are checked). The log
-signatures for the test are inferred from the compatibility research, not
-from a real Frame.
-
-## Evidence and limits
-
-**Verified locally** with a fake Meta and a fake Frame (`tests/test_meta.py`):
-token checks; storage owner-only through a temporary file; redaction (the
-stored token recased and percent-encoded in either case, starts of it, other
-token-shaped values, and redaction before cutting); HTTPS-only URLs; the
-public-address allow-list, resolving once and connecting only to a checked
-address within one deadline; redirects off Meta's hosts refused when they
-carry the token anywhere, before any lookup; the token never sent to the
-CDN; GraphQL redirects refused; disconnect beating a connect in flight and
-stopping a download; library parsing (Quest apps only, nothing expired or
-inactive, details from the binary query); downloads with an OBB; size, length
-and checksum limits and the whole-install budget with nothing left behind;
-refusing apps not in the
-library; the handoff to Import from my Quest's checks, install and data step;
-the licence-check warning instead of a refusal; test outcomes from log
-fixtures (a passing licence check isn't a failure; no VR scene is no clear
-result, not recorded); closing before a test and saying when a close failed;
-reports carrying only fixed texts, no token, log text or file names. The
-real TLS connection code is the same as the itch.io branch's and is exercised
-here only with a fake connection.
-
-**Sign in with Meta, verified locally** with fake Electron windows, sessions
-and cookies (`app/test/meta-signin.test.js`): the window's options (its own
-partition, sandbox, context isolation, no Node, no preload) and Meta's login
-address, no developer tools; permission requests and checks refused; the
-navigation allow-list (links elsewhere open in the system browser, redirects
-elsewhere are stopped, pop-ups never become windows); frames allowed any
-HTTPS page but no other scheme, the window itself only Meta's sites; a
-page's beforeunload not keeping the window open; the cookie read only from
-`persist:meta-signin` and only for `oculus.com`, even when the default
-session and another partition hold one; signed-out values ignored; a value
-sent once, a refused one keeping the window open; the window closing after a
-connect, with the page getting the answer and never the token; nothing
-logged, and a server error that echoed the token scrubbed; closing the window
-or signing out ending the wait; closing, timing out or signing out during a
-connect cancelling that attempt (with its own id) after cookie intake stops
-and only after that connect settles (saved, refused or failed), and no cancel
-when nothing was sent; sign-out (Disconnect's first step) waiting for a
-connect under way, even from a window closed earlier, before it finishes;
-sign-out destroying the window before clearing only that partition; no
-sign-in starting while a sign-out runs (it is refused: "try again in a
-moment"), a second sign-out joining the first, and a sign-out waiting for
-every window and connect started before it. The
-frame redirects held to the frame rule, the window's to Meta's sites. The
-server side (`tests/test_meta.py`): an attempt cancelled while Meta is
-answering not saved, even after 300 other cancels; a cancel just after the
-save deleting that token; a cancel never removing a later sign-in's or a
-pasted token's account; unknown attempts changing nothing; no attempt left
-listed after a connect, refused or not; attempt ids checked.
-
-**Differences from BSManager:** BSManager uses its app's default session (and
-clears only `.oculus.com` cookies afterwards); Frame Control uses a session of
-its own and clears all of it on disconnect. BSManager waits for
-`/my/profile`; Frame Control also reacts to the cookie changing, and to any
-`oculus.com` page, and lets the server decide whether the value is a
-working token.
-
-**Not verified:** Sign in with Meta against Meta's real login page (no real
-Meta account was used, and nothing was sent to Meta): whether Meta's login
-still goes only through `oculus.com`, `meta.com` and `facebook.com`, whether
-it uses pop-ups (they open in the same window here, which would break a
-pop-up that reports back to its opener), whether `oc_ac_at` is still set on
-`oculus.com` after login, and whether Meta accepts the window (Frame Control
-removes Electron's name from the user agent as a precaution). A real Meta token and Meta's real answers (none was
-available; nothing was sent to Meta), real downloads and their redirects,
-real Quest games installed or tested on a real Frame, and whether the log
-signatures match what real games print in Lepton.

docs/panels.md

@@ -125,7 +125,7 @@ a limit on the number of floating panels.
   separate from Frame Control. Public reports describe some Proton support;
   Windows-only does not by itself prove a Frame app cannot run. Local status
   and sources are in [VR utilities](vr-utilities.md).
-- **Our performance HUD:** Home → VR comfort and performance → Open HUD in
+- **Our performance HUD:** Home → VR performance (unfold it) → Open HUD in
   headset creates its own gamescope panel using built-in tools. It needs no
   third-party overlay app. [Metrics and verification](vr-utilities.md).
 

docs/privacy.md

@@ -33,12 +33,6 @@ computer, exactly as they were sent.
   yours.
 - Every event includes the app version, OS name (macOS, Windows or Linux),
   CPU architecture and Python version.
-- `frame_connected` carries `headset_id`: the first 16 hex digits of a
-  SHA-256 hash of the headset's `/etc/machine-id`, worked out on the headset,
-  so the machine-id itself never leaves it. It is the same for one headset on
-  every computer, which lets us count headsets rather than installs; it can't
-  be turned back into the machine-id or a serial number. `headsets_saved` is how
-  many headsets this copy of Frame Control has set up.
 
 ## Usage events
 
@@ -47,25 +41,15 @@ computer, exactly as they were sent.
 | `app_installed` | First run | |
 | `app_updated` | First run of a new version | `from_version` |
 | `app_opened` | At most once a day | |
-| `frame_connected` | The first time a SteamOS build is seen on each headset | `steamos_build`, `steamos_version`, `headset_id`, `headsets_saved` |
+| `frame_connected` | The first time a SteamOS build is seen | `steamos_build`, `steamos_version` |
 | `tab_viewed` | The first click on each tab in a session | `tab` |
-| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category` (only when `ok` is false), `installer_code`, `xr_layer_missing`, and see below |
+| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category`, `installer_code`, and see below |
 | `update_offered`, `update_started`, `update_failed` | The update banner | `to_version`, `error_category` |
 
 `install_finished` never includes a file name, path or error message. An
-error becomes one category from this fixed list, plus Android's own
-`INSTALL_FAILED_…` code (`installer_code`) when there is one:
-`android_installer`, `apk_needs_newer_android`, `apk_wrong_abi`,
-`layer_missing`, `apk_repack_failed`, `tool_missing`, `apk_unreadable`,
-`cant_run_on_frame`, `steam_shortcut`, `steam_not_running`,
-`steam_not_responding`, `steam_js_error`, `artwork_failed`, `copy_timeout`,
-`frame_not_set_up`, `frame_auth`, `frame_unreachable`, `frame_disk_full`,
-`copy_failed`, `download_failed`, `flatpak`, `cancelled`, `lepton`,
-`internal_error` (a mistake in Frame Control's own code) or `other`. A VR
-APK that installed without Frame Control's OpenXR compatibility layer,
-because this copy of the app is missing it, carries `xr_layer_missing: true`;
-otherwise that field is left out. It names what was installed only when
-that's already public:
+error becomes one category from a fixed list (for example `apk_wrong_abi` or
+`frame_unreachable`), plus Android's own `INSTALL_FAILED_…` code when there
+is one. It names what was installed only when that's already public:
 
 - F-Droid catalogue apps: `package`. Never the version, since a local build can reuse a
   catalogue app's package name
@@ -83,21 +67,13 @@ SteamOS and Lepton builds. Before sending:
 
 - the notes, app name and version are scrubbed like error messages (see
   below)
-- the APK's source is kept only if it's `F-Droid`, `meta-store` (a test
-  from [My Meta library](meta-library.md)) or the public host name of a
-  download link (`https://example.com/…`). File names, user names,
+- the APK's source is kept only if it's `F-Droid` or the public host name of
+  a download link (`https://example.com/…`). File names, user names,
   passwords, ports, paths, IP addresses and local host names are dropped
 
 When you turn this on, reports you made earlier on this computer are shared
 too.
 
-My Meta library (Experimental) keeps your Meta access token in
-`meta-account.json` in this data folder, owner-only, and sends it only to
-Meta's API and download hosts. It is never in analytics, reports, error
-details or logs; its test reports carry the package, version, version code,
-title, result and the reason, nothing from your account. See
-[meta-library.md](meta-library.md#your-token-and-privacy).
-
 The maintainer's `python3 ui/frame_compat_db.py sync` copies these events
 into the compatibility database, marked `via=community…`. It takes at most
 30 per reporter per day.
@@ -117,32 +93,19 @@ scrubbed:
   names, passwords, ports, paths and queries are dropped
 - `token=`, `key=`, `password=` and similar values are replaced
 
-The same error is sent at most once every 10 minutes. When ssh reports that
-it couldn't reach the Frame (asleep, away, or not set up yet), or that ssh and
-the Frame refused each other's keys (a changed host key, or this computer's
-key not accepted), that is sent at most once per kind each time Frame Control
-runs.
+The same error is sent at most once every 10 minutes.
 
 ## Report a problem
 
-**Report a problem** is the warning-sign button in the header, also in the
-Privacy panel and under **Help → Report a Problem…**. It sends the report
+**Report a problem** is the speech-bubble button in the header, also in the
+Settings page (**Privacy & updates**) and under **Help → Report a Problem…**. It sends the report
 privately to Frame Control's PostHog project as a `problem_report` event, the
 same way as the analytics above, so only the maintainer can read it and
 nothing is published. It works whatever the analytics settings are, because
 the person sends it deliberately. The report has the kind, title and text you
-wrote, a short reference shown after sending, and the diagnostics below. Your
-email address goes with it only if you tick **The maintainer may contact me
-with follow-up questions** (the report then carries `contact_followup: true`);
-it's filled in from **Contact email** below when you've agreed there. It has its own random id, so it isn't linked to
-your analytics events. With that box ticked, the address also becomes your
-**Contact email** below with follow-up questions ticked, so you remove it there
-like any other. If it's a different address from the one saved there, it
-replaces it, and update notices stop until you turn them on again (they were
-agreed for the old address); the form says so before you send. The report then also
-carries this copy's contact id and change number (`contact_id`, `contact_rev`,
-see below), so removing or changing the address later takes back the
-follow-up permission given with the report too.
+wrote, how to reach you if you gave it, a short reference shown after sending,
+and the diagnostics below. It has its own random id, so it isn't linked to
+your analytics events.
 
 With **Include diagnostics** ticked (the default), the report adds:
 
@@ -150,56 +113,10 @@ With **Include diagnostics** ticked (the default), the report adds:
 - the OS, its release and CPU, and the Python version
 - the Frame's SteamOS build, if it has connected since the app started
 - which analytics levels are on
-- a short connection summary, so "the app can't find the headset" can be
-  diagnosed. It is made of fixed words and counts only; no text from an
-  error message or from ssh, and no name you chose, goes in it:
-  - the connector's state (idle, connecting, connected or failed), the stage
-    it failed at (network, find, ssh, identity or login), the attempt number
-    and why it started (such as "Starting up" or "Trying again")
-  - how many headsets are saved; whether the active one's ssh alias is the
-    default `frame` or a custom one (a custom alias itself is never named);
-    whether it's saved or a bare ssh alias; and its number of addresses
-  - for the current error and the last failure: the stage and an error
-    category (the same fixed names as error details, such as
-    `frame_unreachable`, `frame_not_set_up`, `frame_auth` or `other`), and
-    how long ago the last failure was. The category is decided when the
-    failure happens
-  - for each address tried, only its kind (`.local`, `ipv4`, `ipv6`,
-    `ipv6 link-local`, `tailscale`, `hostname`, `alias` for one read from
-    `~/.ssh/config`, and what a name resolved to, such as
-    `.local->ipv6 link-local`) and how the try went (answered, unresolved,
-    timeout, refused, unreachable, sshfailed). Never the address itself
-  - when connected, the kind of address used and its round trip in ms
-  - whether this computer has a network gateway, and whether Tailscale is on,
-    off or not installed
-  - which kind of `ssh` the app runs (Windows OpenSSH in System32, OpenSSH in
-    Program Files, Git for Windows, MSYS2/Cygwin, Homebrew or /usr/local,
-    Nix, the system one, or "other"), never its path; its version, rebuilt
-    from the numbers in the banner `ssh -V` prints (such as
-    `OpenSSH for Windows 9.5p1, LibreSSL 3.8.2`; anything that isn't a
-    plain OpenSSH banner is reported as `unknown`); and the kinds of any
-    other `ssh` on the PATH.
-    This is looked up once in the background after the app starts, so a
-    report sent straight away may say "still being checked"
-  - whether `~/.ssh/config` exists, whether it has Set Up Connection's
-    managed block for the active alias, how many managed blocks it has, and
-    whether a hand-written `Host` line also names the alias (yes or no; the
-    alias isn't named)
 
 **Also include recent activity and the server log** is off by default,
 because those lines can name files and apps. When ticked, it adds the newest
-Activity lines and server log lines, without the request lines. The server
-log has a line for each failed connection attempt: its stage, the message
-shown on the connection pill, ssh's last line about it, and the address kinds
-above. That free text is scrubbed when the line is written: the addresses, ssh alias
-and display name of the headset being tried (whole, whatever their case), and
-then any name ssh gives after "hostname", "host" or "to", become `<host>`; a Windows home folder's
-whole name (spaces and apostrophes included) becomes `<user>`, and ssh's
-whole `user@host:` field (spaces, `DOMAIN\user` and full domain names
-included) becomes `<user>@<host>:`; then the scrubbing below. A host name ssh mentions
-in some other wording can still get through, so check the log lines in **Show
-exactly what's included** before sending. A failure that repeats on every
-retry is written at most once every 5 minutes.
+Activity lines and server log lines, without the request lines.
 
 Everything is scrubbed like error details and limited to what fits in the
 report. Environment details are kept first, then the newest lines. **Show
@@ -211,67 +128,11 @@ The maintainer reads reports on the Frame Control dashboard in PostHog, or
 with `python3 ui/frame_report.py inbox [days]`, which uses the same personal
 API key as `frame_compat_db.py sync`.
 
-## Contact email (optional)
-
-Frame Control never needs an email address. If you'd like to leave one, there
-are two separate choices, both off until you tick them:
-
-| Choice | What it's for |
-|---|---|
-| **Email me about Frame Control updates** | Occasional notices about new releases and updates |
-| **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
-
-You're asked once, in a bar at the top of the page, after the Frame has
-connected for the first time, and never in the same visit as the first-run
-privacy notice. **No thanks** hides it for good, and it isn't
-shown again even if you ignore it. **Contact email** in **Privacy & updates**
-is where you add, change or remove the address and either choice at any time.
-
-**What's sent, and where.** The address and the two choices go privately to
-Frame Control's PostHog project, the same place as problem reports, as a
-`contact_consent` event with `email`, `updates`, `followup`, `action` (`set`
-or `withdraw`) and the common properties above. Only the maintainer can read
-that project, and nothing in it is published or shared. It's sent only when
-you save, or when you send a problem report with follow-up questions ticked,
-whatever the analytics settings are, because you chose to. With a report, the
-address and choices are saved before the report is sent and stay saved if it
-fails; like any change, they're sent as soon as PostHog can be reached. It
-carries its own random contact id, not the analytics id, so it isn't linked
-to your usage events, and a `rev` number that goes up with each change, so
-the newest choice always wins. Like everything else sent, it's listed under
-**Show what's been sent**. On this computer the address and choices are kept in
-`contact/contact.json` in Frame Control's data folder. An address is only
-kept with at least one choice ticked.
-
-**Removing it.** **Remove my email** (or clearing the address and saving)
-deletes it from this computer, including from the **Show what's been sent**
-log (in earlier contact events and problem reports), and sends a `withdraw`
-event with no address in it. The maintainer's list only uses the newest event from each copy, so from
-then on the address isn't listed for either choice. Unticking one choice
-works the same way for that choice. This also covers problem reports you sent
-from this copy with follow-up questions ticked: if your newest choice since the
-report (by change number, not the clock) no longer agrees to follow-up
-questions at that address, the maintainer's inbox shows the permission as
-withdrawn and leaves the address out. If you're offline, the change waits on
-this computer and is sent when PostHog can be reached. The earlier event
-stays in PostHog until its data retention removes it; to have it deleted
-sooner, ask the maintainer (for example in a problem report).
-
-Nothing sends email yet: this only records who agreed to what. The
-maintainer lists the addresses with
-`python3 ui/frame_report.py contacts [updates|followup]`, which uses the same
-personal API key as `inbox`.
-
 ## Turning it all off
 
 Untick the boxes, or set `DO_NOT_TRACK=1` or `FRAME_CONTROL_TELEMETRY=0` in
 the environment that starts Frame Control. A copy run from a source checkout
-never sends analytics unless `FRAME_CONTROL_TELEMETRY=1` is set.
-
-These switches cover the analytics above. A problem report or a contact email
-is sent only because you pressed its Send or Save button, so those still go
-when you choose to send them (a contact change saved while offline is sent
-by itself once PostHog can be reached); if you don't, nothing is sent.
+never sends anything unless `FRAME_CONTROL_TELEMETRY=1` is set.
 
 ## Update checks
 

docs/quest-import.md

@@ -1,208 +0,0 @@
-# Import from my Quest
-
-Move games you own from your own Meta Quest onto the Steam Frame. Plug the
-Quest into your computer by USB; Frame Control copies the game off it with
-adb, checks it can run in Lepton, and installs it on the Frame like any other
-APK, with its own Lepton instance and Steam library entry
-([apks.md](apks.md), [vr-apks.md](vr-apks.md)).
-
-There is no licence-check bypass, and there won't be. A game that uses Meta's
-licence check installs with a warning: on the Frame that check can't reach
-Meta, so the game may quit, hang, or run without online features. See
-[What won't run](#what-wont-run-and-why) below. To install games you own
-straight from Meta instead, without a Quest, see [My Meta library
-(Experimental)](meta-library.md).
-
-## Before you start: developer mode on the Quest
-
-adb only reaches a Quest with developer mode on:
-
-1. Make a free Meta developer organisation at
-   [developers.meta.com](https://developers.meta.com/horizon/) on a **verified**
-   Meta account (Meta asks for a phone number or payment card to verify).
-2. In the Meta Horizon phone app, open the headset's settings and switch
-   **Developer Mode** on. Restart the Quest.
-3. Plug the Quest into the computer that runs Frame Control with a USB cable
-   that carries data (some charging cables don't).
-4. Put the headset on. Accept **Allow USB debugging**, and tick **Always allow
-   from this computer**.
-
-Frame Control uses the adb it already uses for the Frame (an adb you
-installed, else the one it bundles). On Linux, adb also needs permission to
-open the Quest: add a udev rule for Meta's USB vendor id `2833`, for example
-`SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0660", GROUP="plugdev"`, and
-be in that group. Then unplug and replug.
-
-The Frame's own adb connections (Frame Control's SSH tunnels to Lepton,
-`127.0.0.1:<port>`) are never touched. Only a device that reports itself as
-Oculus or Meta, or a Quest model, counts as a Quest.
-
-## Using it
-
-In the app: **Android → On your Frame → Import from my Quest**. Choose **Look
-for my Quest**, then **Import** next to a game. Tick **Also copy each game's
-files in Android/data** to bring the game's external files too (some games
-keep saves there). Progress shows in the panel; the result and any reason it
-stopped appear in the message log.
-
-A game with game data (an OBB folder, or Android/data when ticked) takes two
-imports, because Android can only take that data while the game's Lepton
-instance is running, and there is no way to start the instance without the
-game. Frame Control never starts the game itself:
-
-1. **Import** installs the game and says it has data to add.
-2. Start the game from the Steam library and leave it on its first screen.
-3. **Import** again. Frame Control sees the game open with the same version,
-   copies the data in, and closes the game. Start it again to play.
-
-A game that quits straight away without its data can't take it this way.
-
-From a terminal:
-
-```sh
-python3 ui/frame_quest.py devices                      # what adb sees, and which is the Quest
-python3 ui/frame_quest.py list                         # apps on the Quest: split or not, OBB and data sizes
-python3 ui/frame_quest.py import com.example.game      # copy one to the Frame
-python3 ui/frame_quest.py import com.example.game --data --serial 1WMHH000XXXXXX
-```
-
-The API is `GET /api/quest` (the Quest, or guidance when there isn't one, and
-its apps) and `POST /api/quest` with
-`{"action": "import", "package": "...", "serial": "...", "data": false}`,
-which returns a background job (`/api/job`) with a stage and percentage.
-
-## What an import does
-
-1. Finds the Quest (`adb devices -l`, then `ro.product.manufacturer` and
-   `ro.product.model`). If none is ready it says why: nothing connected, not
-   authorised yet (the **Allow USB debugging** prompt), no USB permission
-   (Linux), offline, another Android device, or several Quests.
-2. Lists third-party apps (`pm list packages -3`), each with `pm path` (one
-   line is a single APK, several a split APK) and the size of
-   `/sdcard/Android/obb/<package>` and `/sdcard/Android/data/<package>`.
-   Labels aren't shown before import: reading them means copying the APK.
-3. Checks there is room on the computer (the APKs, a merged and a patched copy
-   of them counted uncompressed, the OBB folder and the Android/data folder
-   once, since that is streamed to the Frame), then copies the APK and its splits
-   into a per-user cache folder (`Frame Control/quest-import` under the
-   system's cache folder).
-4. **Checks the APK before anything else is copied**, refusing:
-   - 32-bit-only builds (native code but no `arm64-v8a`);
-   - apps that need an Android newer than Lepton's (API 30);
-   - split APKs Frame Control can't merge (below).
-   Installed with a warning:
-   - games that use Meta's licence check (Meta's Platform SDK,
-     `libovrplatformloader.so`, in the base or any split): "uses Meta's
-     licence check; it may quit, hang, or run without online features on the
-     Frame. Frame Control won't remove the check." Linking the SDK doesn't
-     mean a game enforces the check: Meta's store requirement for it
-     (VRC.Quest.Security.1) has only been *Recommended* since 2021, and what
-     a game does when the check fails is up to the game;
-   - VrApi-only builds (`libvrapi.so`, no OpenXR loader), flagged as for any
-     APK: the Frame has no VrApi, so they may not run.
-5. If the game isn't open on the Frame: installs it through the normal APK
-   install (`frame_android.install`: VR detection, the launcher fix, the
-   OpenXR compatibility layer, artwork), and says whether it has game data
-   to add. An older Quest copy never replaces a newer version on the Frame
-   (compared by version code, which installs now record; for installs made
-   before that, it is read from the installed APK on the Frame) unless you
-   tick **Allow replacing a newer version** (`--allow-downgrade`,
-   `"allowDowngrade": true`). If the installed version can't be read at all,
-   that permission is needed too.
-6. If the game is open on the Frame (the second import): refuses unless
-   Frame Control's install record is for this package, in this package's own
-   instance, at the Quest's exact version code (an open game is never
-   replaced), otherwise copies the OBB folder (and `Android/data` if ticked)
-   from the Quest, waits for Android to have finished booting, copies standard
-   `main|patch.<version>.<package>.obb` files with the existing OBB helper
-   (checked by SHA-256 inside Android, [sidequest.md](sidequest.md#obb-files))
-   once Android's own `dumpsys package` in that instance shows the same
-   package at the same version code,
-   streams the `Android/data` files in as a tar written straight into the SSH
-   transfer, then closes the game so its next start reads them, and checks
-   its instance has stopped; if it hasn't, or the check itself fails (a
-   failed `podman ps` never reads as "stopped"), the result says so. The game
-   is closed whatever happens during the copy, including a local read error
-   or Ctrl-C, and a failed close is reported without hiding the original
-   error. Everything
-   from the second check of the install record (after the pulls, which can
-   be long) to closing the game holds the same lock as installs and removals.
-   Other files in the OBB folder are listed as not copied.
-7. Deletes the cache folder, whether the import worked or not. A folder left
-   by a crash is removed by a later import after six hours.
-
-Only one import runs at a time. If copying game data fails, the game is
-closed and the message says so; start it and import again.
-
-### Split APKs
-
-Lepton runs one APK per instance, so the shared install path now merges a
-split APK into one (`frame_android.install(base, splits=[...])`, or
-`python3 ui/frame_android.py install base.apk split1.apk ...`). Merging copies
-each split's native libraries and assets into the base, drops the base
-manifest's `isSplitRequired` flag, and re-signs with Frame Control's key, as
-the launcher fix already does. Only splits that hold nothing but
-`lib/<abi>/*.so`, `assets/` and their own signature, manifest and an empty
-resource table are merged. Refused, with the reason, before anything reaches
-the Frame: splits with resources (screen density or language), code
-(`classes*.dex`), any other file, a manifest that declares components or
-libraries (`<service>`, `<uses-library>`...), feature splits, and splits of
-another package. The merged files are held in memory while the APK is
-repacked and signed (as for every patched APK), so a merge adds at most
-512 MB per file and 1 GB in all. Each file is read from its raw bytes and
-checked against both of its ZIP headers: the local header must name the same
-file with the same method, sizes and checksum as the central directory (or a
-data descriptor must carry them; ZIP64 sizes are understood), the data must
-end before the next entry, a stored file must be exactly its declared size, a
-compressed one must end exactly at the end of its data with nothing after it,
-and its checksum must match. So a forged header can't truncate a file or fill
-memory. A resource table counts as empty only
-if it defines nothing at all (styles and other complex entries included). A merged, re-signed APK can't update a
-copy signed by the publisher.
-
-## What won't run, and why
-
-- **Games that enforce their Meta store licence.** Many store games link
-  Meta's Platform SDK (`libovrplatformloader.so`), for the licence check and
-  for user ids, achievements, multiplayer, cloud saves or DLC. On the Frame the
-  SDK can't reach Meta's services, which only exist on Meta headsets. A game
-  that enforces the check then quits or hangs; one that doesn't may run
-  without its online features. Frame Control can't tell which from the APK, so
-  it installs these with a warning and **won't remove or work around the
-  check**, and doesn't bundle, call or link to any tool that does. If yours
-  quits, ask the developer for a build without the check, or get the game from
-  Steam or itch.io. Most SideQuest, itch.io and open-source games don't link
-  the SDK.
-- **32-bit games** (Quest 1 era): the Frame runs 64-bit ARM only. Refused.
-- **VrApi-only games**: the Frame has OpenXR, not Meta's older VrApi. They
-  install with a warning, but may not run.
-- **Anything else that needs Meta**: avatars, Quest-only device checks,
-  passthrough and other `XR_FB_*` features SteamVR lacks
-  ([vr-apks.md](vr-apks.md#what-steamvrs-android-runtime-supports-verified)).
-- **Private app data** (`/data/data/<package>`) can't be read over adb without
-  root, so only saves in `Android/data` come across.
-
-What usually works: OpenXR games without Meta's licence check, for example
-open-source and itch.io builds you sideloaded onto the Quest.
-
-Only import games you own, for your own use.
-
-## Evidence and limits
-
-**Verified locally** with a fake adb (`tests/fakeadb.py`, `tests/test_quest.py`):
-device detection (Quest, the Frame's tunnel, the Frame over USB, other
-Android devices, unauthorised, no permissions, offline, none, several),
-package listing and split detection, the refusals and the licence-check warning, the order of copies
-(APK checked before the OBB is copied), the two-step install then data copy
-(the game is never started by Frame Control, never replaced while open, and
-closed after its data is copied), split merging and signing, the split
-refusals and size limits (including a forged zip bomb), the space estimate,
-and cache clean-up after success and failure.
-
-**Not verified:** a real Quest (none was available), Quest system apps in
-`pm list packages -3`, real split APKs from the Meta Store, OBB and
-`Android/data` writes into a running Lepton instance on a real Frame
-(the OBB helper itself is also unverified there), whether games stay open
-without their OBB long enough for the second import, and the Linux udev rule.
-Large games are copied into memory while being merged or patched, as every
-patched APK already is.

docs/releasing.md

@@ -24,20 +24,13 @@ count. So a build reaches people only when you publish it, after testing it.
 4. Publish:
 
    ```sh
-   scripts/publish-release.sh --dry-run v0.4.0   # checks and shows update.json, changes nothing
    scripts/publish-release.sh v0.4.0
    ```
 
-   The script checks that the tag is on GitHub and that all eight installers
-   are attached, each with the SHA-256 digest GitHub records. It attaches
-   `update.json` (the version, the notes, the release page and each
-   installer's digest), then publishes the release and marks it latest. It
-   uses only the REST API: `gh release view` can't find a draft whose
-   `tag_name` still reads `untagged-…`, and GraphQL is often rate-limited.
-   Such a draft is found by its exact title (`Frame Control 0.4.0`, or that
-   followed by `: subtitle`) and tied to the tag when it's published. The release page in `update.json` is always
-   `releases/tag/<tag>`, because a draft's own address (`releases/tag/untagged-…`)
-   stops working once it's published. From then on, running copies see the update. They check about 8
+   The script checks that all eight installers are attached, each with the
+   SHA-256 digest GitHub records. It attaches `update.json` (the version, the
+   notes and each installer's digest), then publishes the release and marks it
+   latest. From then on, running copies see the update. They check about 8
    seconds after starting, then every 6 hours, and anyone can use **Check for
    Updates…** (the app menu on macOS, the Help menu elsewhere).
 

docs/sidequest.md

@@ -65,6 +65,8 @@ flow, not evidence of an anonymous download API. It is not implemented here.
 - `search()` raises a user-readable `SourceError` with the browse URL (zero
   limit returns no rows). It does not invent app results or report a false
   “no matching games”. The aggregate search UI should surface this source error.
+  In the app, Discover doesn't link to it; the **Sources** dialog lists SideQuest
+  with a link to its website instead of an on/off switch.
 - `details()` accepts a numeric listing id and returns its canonical page link,
   `downloadable: False`, empty versions/tags/headsets and the `images` shape
   `{icon: None, banner: None, screenshots: []}`. Name is explicitly a listing id;

docs/streaming.md

@@ -25,20 +25,6 @@ The confidence labels are the same as in [ssh.md](ssh.md).
 documents it. Use Windows App (RDP) when you want a proper Linux desktop on the
 Mac with keyboard, mouse, and clipboard.
 
-**Verified 2026-09-30** (Frame BUILD_ID 20260925.6191901, Windows 11 25H2,
-Remote Desktop Connection): signing in to xrdp as `steamos` with the Developer
-Mode password opens a Plasma (X11) desktop within about 6 seconds.
-
-- xrdp has no NLA, so the client shows a certificate warning (xrdp's own
-  `www.xrdp.org` certificate) and then xrdp's own login box. Frame Control
-  fills in `steamos` there on Windows, Remmina and FreeRDP.
-- The desktop is a separate login session (Xorg on display `:10`), not the
-  headset's view. It uses about 1.3 GB of the Frame's memory.
-- Closing the client leaves the session running, and the next login
-  reconnects to it. To end it over SSH, find it with `loginctl list-sessions`
-  and run `loginctl terminate-session <id>`. That doesn't touch the headset's
-  gamescope or SteamVR session.
-
 ## B. Show the Mac's desktop inside the Frame
 
 The Frame's VR streaming uses **SteamVR** on the host. Linux hosts had
@@ -261,16 +247,6 @@ How (**verified 2026-09-29**, SteamOS 0.4.1, build 20260925.6191901):
   -window_id <window> -i :<display>` works on gamescope's redirected windows,
   while grabbing the root gives black. It streams as H.264 like the headset view
   (about 30 fps at 720p).
-- **When no panel is found**, `frame_touch.py panels` says why (`"why"`), and the
-  Desktop view shows that instead of a bare "no app panel": X tools missing,
-  gamescope listing windows that aren't X11 windows on any display, the desktop
-  running but not listed, or nothing open. It reads gamescope's properties from
-  `:0` first (one `xprop` call) and probes the other displays, 2 s each, only if `:0`
-  has none. A whole run stops after 12 s, inside the server's 20 s, and says the headset
-  was too slow. Added for
-  [#73](https://github.com/saphid/frame-control/issues/73) (SteamOS 0.4.5, desktop
-  open but not found). The likely cause there was the page itself: a second
-  `loadPanels` (the panel switcher's) replaced the Desktop view's, fixed in #84.
 - Tested from the iPhone app (Simulator): a tap on the Desktop view focused a
   text box in the panel and the text field typed into it; a trackpad move went
   exactly (+40, +25).

docs/vr-apks.md

@@ -94,7 +94,7 @@ A new shortcut is rolled back if artwork fails; failure is never reported as
 an installed app with a blank tile.
 
 Artwork preference is **SteamGridDB → source images → generated fallback**.
-Set the optional free key in Frame Control's **Library artwork settings**, or
+Set the optional free key in Frame Control's **Settings → Library artwork**, or
 `STEAMGRIDDB_API_KEY` (`FRAME_STEAMGRIDDB_API_KEY` also works). Environment
 settings override the saved key. Without a key there are no provider calls or
 warnings. Saved keys stay in host app data, mode 0600 on POSIX, and are never
@@ -214,16 +214,9 @@ source-search endpoint remain unverified (the public install seam is tested).
 
 - **Meta entitlement.** Apps that call the Oculus Platform SDK
   (`libovrplatformloader.so`) to check the Quest store licence need Meta's
-  services. Frame Control won't work around that: no patching, no stub
-  libraries, no OVRPort or FramePort. Linking the SDK doesn't mean an app
-  enforces the check (Meta's VRC.Quest.Security.1 has only been
-  *Recommended* since 2021, and a failed check does nothing by itself; the app
-  decides), so [Import from my Quest](quest-import.md) and [My Meta
-  library](meta-library.md) install these with a warning: they may quit,
-  hang, or run without online features.
+  services. Frame Control won't work around that.
 - **VrApi-era apps** (`libvrapi.so`, before OpenXR) need an API translator,
-  not a patch. They install with a warning that they may not run: some
-  OpenXR games ship `libvrapi.so` without depending on it.
+  not a patch.
 
 ## Frame Control does this for you
 
@@ -256,10 +249,6 @@ the app wants 1.1 and enables the extensions that became 1.1 core; maps
 and keeps the current refresh rate when SteamVR refuses a requested one.
 `meta.json` records `"patched": ["openxr-compat"]`. Skip it with
 `install … --no-xr-compat`. Its decisions go to logcat under `FrameXrCompat`.
-If this copy of Frame Control is missing the layer's library (an incomplete
-install, or a file removed after installing), VR apps install without it and
-the install message says so; OpenXR 1.0 apps still run. Release builds fail
-to package without it (`app/build/check-resources.js`).
 
 Verified on the headset (2026-09-28):
 

docs/vr-utilities.md

@@ -11,7 +11,7 @@ checks below. The PR stays draft.
 
 ## Our performance HUD
 
-On **Home → VR comfort and performance**, the app shows a timestamped sample
+On **Home → VR performance** (folded until you open it), the app shows a timestamped sample
 with each status refresh (30 seconds, or Refresh). **Open HUD in headset**
 starts our text HUD as a gamescope panel, refreshed every two seconds. In the
 SteamVR dashboard, select **Frame Control HUD**, then Float in World or dock
@@ -26,7 +26,7 @@ it twice reuses the existing process.
 | Compositor CPU | OpenVR compositor render CPU milliseconds, not game CPU time. |
 | System CPU | `/proc/stat` busy-time delta across the sample, with guest time counted once and iowait treated as idle. |
 | GPU clock | `3d00000.gpu/cur_freq`, converted from Hz to MHz; frequency is not load. |
-| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. |
+| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. In the headset HUD only: the app shows them once, in the battery menu at the top. |
 
 OpenVR uses background application mode, which does not start SteamVR or keep
 it running. This mode also returned live timing in a read-only device probe.

docs/vr-video.md

@@ -6,7 +6,7 @@ is required.** Chromium and immersive WebXR are not in this playback path.
 
 ## Use it
 
-In **Tools → Media in the headset**, send a file, choose its layout and press
+In **Tools → Media player** (or **Play a video or photo** on Home), send a file, choose its layout and press
 **Play**. **Theatre** gives it a larger screen and an 85% black surround.
 **Stop** removes both. Refresh reads the library and the player's state.
 The screen follows your head; it isn't a saved world-space panel.

frame/openxr-compat/README.md

@@ -190,11 +190,8 @@ ctest --test-dir frame/openxr-compat/build-host --output-on-failure
 
 The script produces arm64-v8a / android-24, C++17, `-O2`, static libc++, hidden
 internal symbols, stripped output, and `-Wl,-z,max-page-size=16384`.
-The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz`,
-gzipped (`gzip -9 -n`) so the Windows installer carries it intact: electron-builder's
-7-Zip compresses a bare arm64 ELF with its ARM64 filter, which the installer's
-extractor skips. Frame Control decompresses it when injecting the layer. The
-SHA-256 of the uncompressed library is recorded below with the APK checks.
+The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so`.
+Its SHA-256 is recorded below with the APK checks.
 
 [Host test output](evidence/ctest.txt): two tests passed, covering pure logic
 and the actual layer with a fake next layer and host-only log/JNI shims.

frame/openxr-compat/build.sh

@@ -8,8 +8,5 @@ cmake -S "$here" -B "$here/build-android" -G Ninja \
   -DANDROID_STL=c++_static -DCMAKE_BUILD_TYPE=Release
 cmake --build "$here/build-android"
 mkdir -p "$here/prebuilt/arm64-v8a"
-# Committed and shipped gzipped: electron-builder's 7-Zip applies its ARM64
-# branch filter to a bare arm64 ELF, which the Windows installer's extractor
-# can't decode, so the installed app silently lacked the library.
-shasum -a 256 "$here/build-android/libXrApiLayer_FRAME_compat.so"
-gzip -9 -n -c "$here/build-android/libXrApiLayer_FRAME_compat.so" > "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz"
+cp "$here/build-android/libXrApiLayer_FRAME_compat.so" "$here/prebuilt/arm64-v8a/"
+shasum -a 256 "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so"

scripts/publish-release.sh

@@ -3,65 +3,23 @@
 # (docs/releasing.md). Checks every installer is attached with a SHA-256
 # digest first, since the app's updater refuses assets without one, then
 # attaches update.json, the manifest the updater reads.
-# Usage: scripts/publish-release.sh [--dry-run] v0.4.0
-#
-# Everything goes through the REST API (gh api), not `gh release view/edit`:
-# those look a draft up by its tag, and a draft can show tag_name
-# "untagged-..." until it's published, so they report "release not found"
-# (and GraphQL is often rate-limited). A draft's html_url is an untagged-...
-# link that dies on publishing, so update.json's page is built from the tag.
+# Usage: scripts/publish-release.sh v0.4.0
 set -eu
-dry=""
-[ "${1:-}" = "--dry-run" ] && { dry=1; shift; }
-tag="${1:?usage: $0 [--dry-run] vX.Y.Z}"
+tag="${1:?usage: $0 vX.Y.Z}"
 repo=saphid/frame-control
 expected="Frame-Control-mac-arm64.dmg Frame-Control-mac-arm64.zip Frame-Control-Setup-x64.exe
 Frame-Control-win-x64.zip Frame-Control-linux-x86_64.AppImage Frame-Control-linux-arm64.AppImage
 Frame-Control-linux-amd64.deb Frame-Control-linux-arm64.deb"
-page="https://github.com/$repo/releases/tag/$tag"
 
+info=$(gh release view "$tag" -R "$repo" --json isDraft,isPrerelease,assets)
 version=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' "$(dirname "$0")/../app/package.json")
 [ "v$version" = "$tag" ] || echo "note: app/package.json here says $version (the release was built from the tag)"
 
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' EXIT
-
-# Publishing sets tag_name; if the tag didn't exist GitHub would create it on
-# the default branch, which isn't what was built and tested.
-gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1 \
-  || { echo "tag $tag isn't on GitHub; push it first (git push origin $tag)" >&2; exit 1; }
-
-# Every release, drafts included, one JSON object per line.
-gh api --paginate "repos/$repo/releases?per_page=100" --jq '.[]' > "$tmp/releases"
-# The release whose tag_name is the tag; failing that, the one untagged-... draft
-# titled "Frame Control X.Y.Z" (release.yml's title), optionally ": subtitle".
-python3 - "$tag" "$tmp/releases" > "$tmp/release.json" <<'EOF'
-import json, re, sys
-tag, path = sys.argv[1], sys.argv[2]
-rels = [json.loads(line) for line in open(path) if line.strip()]
-hits = [r for r in rels if r.get("tag_name") == tag]
-if not hits:
-    # Exactly this version: "Frame Control 0.4.0", or that followed by ": <subtitle>".
-    # Never "Frame Control 0.4.0-rc.1" or "0.4.00", and only drafts with no real tag.
-    title = re.compile(r"Frame Control " + re.escape(tag.lstrip("v")) + r"(: .*)?", re.S)
-    hits = [r for r in rels if r.get("draft") and str(r.get("tag_name") or "").startswith("untagged-")
-            and title.fullmatch(r.get("name") or "")]
-if len(hits) != 1:
-    why = "no release" if not hits else "%d releases (ids %s)" % (len(hits), ", ".join(str(r["id"]) for r in hits))
-    sys.exit("found %s for %s; expected one draft" % (why, tag))
-r = hits[0]
-if not r.get("draft"):
-    print("note: %s is already published; refreshing update.json and marking it latest" % tag, file=sys.stderr)
-json.dump(r, sys.stdout)
-EOF
-id=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$tmp/release.json")
-echo "release  $id ($(python3 -c 'import json,sys; r=json.load(open(sys.argv[1])); print(("draft" if r["draft"] else "published") + ", tag_name " + str(r["tag_name"]))' "$tmp/release.json"))"
-
 missing=""
 for name in $expected; do
-  digest=$(python3 -c 'import json,sys
-d=json.load(open(sys.argv[1])); n=sys.argv[2]
-print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent"))' "$tmp/release.json" "$name")
+  digest=$(printf '%s' "$info" | python3 -c 'import json,sys
+d=json.load(sys.stdin); n=sys.argv[1]
+print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent"))' "$name")
   case "$digest" in
     sha256:*) echo "ok       $name" ;;
     absent) echo "MISSING  $name"; missing=1 ;;
@@ -72,32 +30,16 @@ done
 
 # update.json: what running copies read (app/updater.js), from github.com's
 # latest/download link rather than the rate-limited REST API.
-python3 - "$tmp/release.json" "$tag" "$page" "$expected" > "$tmp/update.json" <<'EOF'
-import json, sys
-d = json.load(open(sys.argv[1]))
-tag, page, names = sys.argv[2], sys.argv[3], set(sys.argv[4].split())
-print(json.dumps({"version": tag.lstrip("v"), "page": page, "notes": (d.get("body") or "")[:4000],
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+gh release view "$tag" -R "$repo" --json tagName,url,body,assets | python3 -c 'import json,sys
+d=json.load(sys.stdin)
+names=set(sys.argv[1].split())
+print(json.dumps({"version": d["tagName"].lstrip("v"), "page": d["url"], "notes": d["body"][:4000],
                   "assets": [{"name": a["name"], "size": a["size"], "digest": a["digest"]}
-                             for a in d["assets"] if a["name"] in names]}, indent=1))
-EOF
-old=$(python3 -c 'import json,sys
-d=json.load(open(sys.argv[1]))
-print(" ".join(str(a["id"]) for a in d["assets"] if a["name"]=="update.json"))' "$tmp/release.json")
-
-if [ -n "$dry" ]; then
-  echo "dry run: would replace update.json (old asset ids: ${old:-none}) with:"
-  cat "$tmp/update.json"
-  echo "dry run: would PATCH release $id: tag_name=$tag draft=false prerelease=false make_latest=true"
-  exit 0
-fi
-
-for asset in $old; do
-  gh api -X DELETE "repos/$repo/releases/assets/$asset" >/dev/null
-done
-gh api -X POST "https://uploads.github.com/repos/$repo/releases/$id/assets?name=update.json" \
-  -H "Content-Type: application/json" --input "$tmp/update.json" >/dev/null
+                             for a in d["assets"] if a["name"] in names]}, indent=1))' "$expected" > "$tmp/update.json"
+gh release upload "$tag" -R "$repo" "$tmp/update.json" --clobber
 echo "ok       update.json"
 
-gh api -X PATCH "repos/$repo/releases/$id" -f tag_name="$tag" -F draft=false -F prerelease=false \
-  -f make_latest=true --jq '"published " + .tag_name + " at " + .html_url'
-echo "running copies will offer $tag at their next check"
+gh release edit "$tag" -R "$repo" --draft=false --prerelease=false --latest
+echo "published $tag; running copies will offer it at their next check"

tests/apk_fixtures.py

@@ -1,87 +0,0 @@
-"""Small APKs built in memory (binary manifest plus resource table), for test_frame_apk
-and the end-to-end tests. Deliberately doesn't import sandbox: tests/e2e runs in a
-throwaway container and keeps its real home, which sandbox would move."""
-import io
-import os
-import struct
-import sys
-import zipfile
-
-sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'ui'))
-import frame_apk  # noqa: E402
-
-
-def pool(strings, utf8=False):
-    """A ResStringPool chunk."""
-    data, offsets = b'', []
-    for s in strings:
-        offsets.append(len(data))
-        if utf8:
-            b = s.encode()
-            data += bytes([len(s), len(b)]) + b + b'\0'
-        else:
-            data += struct.pack('<H', len(s)) + s.encode('utf-16-le') + b'\0\0'
-    data += b'\0' * (-len(data) % 4)
-    start = 28 + 4 * len(strings)
-    body = struct.pack(f'<{len(strings)}I', *offsets) + data
-    return struct.pack('<HHIIIIII', 1, 28, 28 + len(body), len(strings), 0, 0x100 if utf8 else 0, start, 0) + body
-
-
-def manifest(package, label_ref, version_ref, min_sdk, package_raw=True, foreign_label=False):
-    """<manifest package versionName><uses-sdk minSdkVersion/><application label icon/></manifest>.
-
-    package_raw=False drops the package's raw string (as some repackers do);
-    foreign_label adds a non-android `label` attribute after android:label.
-    """
-    strings = ['label', 'icon', 'versionName', 'minSdkVersion', 'package', 'manifest', 'uses-sdk',
-               'application', package, 'junk', 'label', 'versionCode']  # the second 'label' has no android id
-    resmap = struct.pack('<4I', 0x01010001, 0x01010002, 0x0101021c, 0x0101020c)
-    resmap = struct.pack('<HHI', 0x0180, 8, 8 + len(resmap)) + resmap
-
-    def element(name, attrs):
-        body = struct.pack('<IIHHHHHH', 0xffffffff, name, 20, 20, len(attrs), 0, 0, 0)
-        for aname, raw, dtype, value in attrs:
-            body += struct.pack('<IIIHBBI', 0xffffffff, aname, raw, 8, 0, dtype, value)
-        return struct.pack('<HHIII', 0x0102, 16, 16 + len(body), 1, 0xffffffff) + body
-
-    none = 0xffffffff
-    chunks = (pool(strings) + resmap
-              + element(5, [(4, 8 if package_raw else none, frame_apk.T_STRING, 8),
-                            (2, none, frame_apk.T_REF, version_ref),
-                            (11, none, frame_apk.T_INT_DEC, 210)])
-              + element(6, [(3, none, frame_apk.T_INT_DEC, min_sdk)])
-              + element(7, [(0, none, frame_apk.T_REF, label_ref), (1, none, frame_apk.T_REF, 0x7f020000)]
-                        + ([(10, 9, frame_apk.T_STRING, 9)] if foreign_label else [])))
-    return struct.pack('<HHI', 3, 8, 8 + len(chunks)) + chunks
-
-
-def resources(values):
-    """resources.arsc with package 0x7f; values: {(type id, entry, language, density): global string index}."""
-    strings = ['French label', 'App label', '2.1', 'res/icon_lo.png', 'res/icon_hi.png', 'res/icon.xml']
-    pkg_body = b''
-    for (tid, lang, density), entries in values.items():
-        cfg = struct.pack('<I4x2s4xH', 64, lang.encode().ljust(2, b'\0'), density).ljust(64, b'\0')
-        count = max(entries) + 1
-        offsets, data = [], b''
-        for i in range(count):
-            if i in entries:
-                offsets.append(len(data))
-                data += struct.pack('<HHI', 8, 0, 0) + struct.pack('<HBBI', 8, 0, frame_apk.T_STRING, entries[i])
-            else:
-                offsets.append(0xffffffff)
-        header = 20 + 64
-        estart = header + 4 * count
-        body = struct.pack(f'<{count}I', *offsets) + data
-        pkg_body += struct.pack('<HHIBBHII', 0x0201, header, header + len(body), tid, 0, 0, count, estart) + cfg + body
-    pkg_header = struct.pack('<HHII', 0x0200, 288, 288 + len(pkg_body), 0x7f).ljust(288, b'\0')
-    pkg = pkg_header + pkg_body
-    table = pool(strings, utf8=True) + pkg
-    return struct.pack('<HHII', 2, 12, 12 + len(table), 1) + table
-
-
-def apk(files):
-    buf = io.BytesIO()
-    with zipfile.ZipFile(buf, 'w') as z:
-        for name, data in files.items():
-            z.writestr(name, data)
-    return buf.getvalue()

tests/e2e/harness.py

@@ -10,7 +10,6 @@ import atexit
 import http.client
 import json
 import os
-import shutil
 import socket
 import subprocess
 import sys
@@ -23,22 +22,7 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[2]
 sys.path[:0] = [str(ROOT / 'ui'), str(ROOT / 'tests'), str(ROOT / 'tests' / 'smoke')]
 
-# Only inside the compose `host` container (FRAME_E2E_CONTAINER from compose.yaml, plus
-# the container runtime's marker file): these tests drive ui/server.py with the real
-# home, ~/.ssh and cache, which is only safe in a throwaway container.
-REQUESTED = os.environ.get('FRAME_E2E') == '1'
-IN_CONTAINER = os.environ.get('FRAME_E2E_CONTAINER') == '1' and (
-    os.path.exists('/.dockerenv') or os.path.exists('/run/.containerenv'))
-ENABLED = REQUESTED and IN_CONTAINER
-if ENABLED:
-    # What tests/sandbox.py does, minus moving HOME: the container's real ~/.ssh is what
-    # points `ssh frame` at the fake Frame, and OpenSSH reads ~/.ssh from the password
-    # database, not $HOME. (These tests used to get this through test_frame_apk.)
-    _data = tempfile.mkdtemp(prefix='frame-control-e2e-')
-    atexit.register(shutil.rmtree, _data, ignore_errors=True)
-    os.environ['FRAME_CONTROL_DATA_DIR'] = _data
-    os.environ['FRAME_CONTROL_TELEMETRY'] = '0'
-    os.environ['FRAME_COMPAT_DB_URL'] = 'http://127.0.0.1:9'
+ENABLED = os.environ.get('FRAME_E2E') == '1'
 CTL = os.environ.get('FAKEFRAME_CTL', 'http://fakeframe:9999').rstrip('/')
 FAKE_HOST = os.environ.get('FAKEFRAME_HOST', 'fakeframe')
 HOME = '/home/steamos'
@@ -46,14 +30,9 @@ SERVER_LOG = os.path.join(tempfile.gettempdir(), 'fakeframe-e2e-server.log')
 
 
 def require():
-    """Skips (the module, at module level; the class, in setUpClass) unless this is
-    scripts/e2e.sh's container with the fake Frame up."""
-    if ENABLED:
-        return
-    if REQUESTED:
-        raise unittest.SkipTest('FRAME_E2E=1 outside the e2e container: these tests use the real home, ~/.ssh '
-                                'and app cache, so they only run in scripts/e2e.sh\'s throwaway container')
-    raise unittest.SkipTest('needs the fake Frame: run scripts/e2e.sh (sets FRAME_E2E=1)')
+    """Call at module level: skips the module unless the fake Frame is up."""
+    if not ENABLED:
+        raise unittest.SkipTest('needs the fake Frame: run scripts/e2e.sh (sets FRAME_E2E=1)')
 
 
 # ---- the fake Frame's control port --------------------------------------------
@@ -118,7 +97,6 @@ class Server:
 
     @classmethod
     def start(cls):
-        require()  # never a server on this computer's real data
         if cls.proc and cls.proc.poll() is None:
             return
         with socket.socket() as s:
@@ -215,7 +193,6 @@ class FrameTestCase(unittest.TestCase):
 
     @classmethod
     def setUpClass(cls):
-        require()
         Server.start()
 
     def setUp(self):

tests/e2e/test_agents.py

@@ -6,8 +6,6 @@ import sys
 import harness
 from harness import api, ok, finished, ssh
 
-harness.require()
-
 sys.path.insert(0, str(harness.ROOT / 'ui'))
 import frame_mcp
 

tests/e2e/test_android.py

@@ -5,7 +5,7 @@ import unittest
 
 import harness
 from harness import HOME, exists, ok, state, upload, wait_for
-from apk_fixtures import apk, manifest, resources
+from test_frame_apk import apk, manifest, resources
 
 harness.require()
 

tests/fakeadb.py

@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-"""A stand-in for Android's adb, for tests/test_quest.py: just enough of `devices -l`,
-`shell`, and `pull` for frame_quest.py, run as a real subprocess.
-
-$FAKEADB_STATE is a JSON file:
-  devices   [{"serial", "state", "extra" (the rest of the `devices -l` line), "props" {getprop name: value}}]
-  root      a folder standing in for each device's file system (remote /x/y is root/x/y)
-  packages  {package: [APK paths, as `pm path` prints them]}
-  fail_pull a remote path whose pull fails
-Every call is appended to $FAKEADB_LOG as a JSON line. Shell commands are the simple
-`; `-separated ones frame_quest sends, each answered here: no real shell runs.
-"""
-import json
-import os
-import shutil
-import sys
-
-args = sys.argv[1:]
-with open(os.environ['FAKEADB_LOG'], 'a') as f:
-    f.write(json.dumps(args) + '\n')
-with open(os.environ['FAKEADB_STATE']) as f:
-    state = json.load(f)
-root = state.get('root', '')
-serial = None
-if args[:1] == ['-s']:
-    serial, args = args[1], args[2:]
-
-
-def fail(message, code=1):
-    sys.stderr.write(message + '\n')
-    sys.exit(code)
-
-
-def local(remote):
-    return os.path.join(root, remote.lstrip('/'))
-
-
-def size_kb(path):
-    total = 0
-    for dirpath, _, files in os.walk(path):
-        total += sum(os.path.getsize(os.path.join(dirpath, n)) for n in files)
-    return max(4, total // 1024)
-
-
-if args == ['devices', '-l']:
-    print('List of devices attached')
-    for d in state.get('devices', []):
-        print(f"{d['serial']:<22} {d['state']} {d.get('extra', '')}".rstrip())
-    sys.exit(0)
-
-device = next((d for d in state.get('devices', []) if d['serial'] == serial), None)
-if serial is None or device is None:
-    fail(f"adb: device '{serial}' not found")
-if device['state'] == 'unauthorized':
-    fail('adb: device unauthorized.\nThis adb server\'s $ADB_VENDOR_KEYS is not set')
-if device['state'] != 'device':
-    fail(f"adb: device {device['state']}")
-
-if args[:1] == ['shell']:
-    out = []
-    for command in ' '.join(args[1:]).split('; '):
-        command = command.replace(' 2>/dev/null', '').strip()
-        words = command.split()
-        if not words or command == 'true':
-            continue
-        if words[0] == 'getprop':
-            out.append(device.get('props', {}).get(words[1], ''))
-        elif words[0] == 'echo':
-            out.append(' '.join(words[1:]))
-        elif command == 'pm list packages -3':
-            out += ['package:' + p for p in state.get('packages', {})]
-        elif words[:2] == ['pm', 'path']:
-            out += ['package:' + p for p in state.get('packages', {}).get(words[2], [])]
-        elif words[:2] == ['du', '-sk']:
-            if os.path.isdir(local(words[2])):
-                out.append(f'{size_kb(local(words[2]))}\t{words[2]}')
-        elif words[:3] == ['stat', '-c', '%s']:
-            out += [str(os.path.getsize(local(p.strip("'")))) for p in words[3:]]
-        else:
-            fail(f'/system/bin/sh: {words[0]}: inaccessible or not found', 127)
-    print('\n'.join(out))
-    sys.exit(0)
-
-if args[:1] == ['pull'] and len(args) == 3:
-    remote, dest = args[1], args[2]
-    if remote == state.get('fail_pull'):
-        fail(f"adb: error: failed to copy '{remote}' to '{dest}': remote Connection reset")
-    src = local(remote)
-    if not os.path.exists(src):
-        fail(f"adb: error: failed to stat remote object '{remote}': No such file or directory")
-    if os.path.isdir(dest):
-        dest = os.path.join(dest, os.path.basename(remote.rstrip('/')))
-    if os.path.isdir(src):
-        shutil.copytree(src, dest)
-    else:
-        shutil.copyfile(src, dest)
-    print(f'{remote}: 1 file pulled.')
-    sys.exit(0)
-
-fail('adb: unknown command ' + ' '.join(args))

tests/fakeframe/compose.yaml

@@ -43,7 +43,6 @@ services:
       FAKEFRAME_CTL: http://fakeframe:9999
       FAKEFRAME_HOST: fakeframe
       FRAME_E2E: "1"
-      FRAME_E2E_CONTAINER: "1"  # tests/e2e/harness.py refuses to run anywhere else
     healthcheck:
       test: ["CMD", "test", "-f", "/home/tester/.ready"]
       interval: 1s

tests/fakegh/gh

@@ -1,87 +0,0 @@
-#!/usr/bin/env python3
-"""A stand-in for the GitHub CLI's `gh api`, for tests/test_publish_release.py and
-tests/test_release_workflow.py. Serves the releases in $FAKEGH_RELEASES (a JSON list,
-drafts included) and the tags in $FAKEGH_TAGS (space-separated); an upload's body is
-written to $FAKEGH_UPLOAD. Every call is appended to $FAKEGH_LOG as a JSON line.
-Anything else fails, so the script under test can't fall back to `gh release ...`
-(GraphQL) unnoticed. POST .../releases (release.yml's draft step) answers as release
-$FAKEGH_NEW_ID (default 9001) without adding it to the listing, like GitHub's list
-lagging a fresh draft. With jq installed, --jq filters a response the way gh does
-(raw strings, compact JSON)."""
-import json
-import os
-import shutil
-import subprocess
-import sys
-
-args = sys.argv[1:]
-with open(os.environ["FAKEGH_LOG"], "a") as f:
-    f.write(json.dumps(args) + "\n")
-if not args or args[0] != "api":
-    sys.exit("fakegh: only `gh api` is supported: %r" % args)
-
-method, endpoint, fields, inp, jq, i = "GET", None, {}, None, None, 1
-while i < len(args):
-    a = args[i]
-    if a == "-X":
-        method = args[i + 1]; i += 2
-    elif a in ("-f", "-F"):
-        k, _, v = args[i + 1].partition("="); fields[k] = v; i += 2
-    elif a == "--input":
-        inp = args[i + 1]; i += 2
-    elif a == "--jq":
-        jq = args[i + 1]; i += 2
-    elif a == "-H":
-        i += 2
-    elif a.startswith("-"):
-        i += 1
-    elif endpoint is None:
-        endpoint = a; i += 1
-    else:
-        sys.exit("fakegh: unexpected argument %r" % a)
-
-releases = json.load(open(os.environ["FAKEGH_RELEASES"]))
-repo = "repos/saphid/frame-control/"
-
-
-def answer(response, fallback):
-    """Print response through --jq when jq is here, else the fixed fallback text."""
-    if jq and shutil.which("jq"):
-        out = subprocess.run(["jq", "-r", "-c", jq], input=json.dumps(response),
-                             stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)
-        sys.stdout.write(out.stdout)
-        if out.returncode:
-            sys.exit("fakegh: jq failed: " + out.stderr)
-    else:
-        print(fallback)
-
-
-if method == "GET" and endpoint.startswith(repo + "git/ref/tags/"):
-    tag = endpoint.rsplit("/", 1)[1]
-    if tag not in os.environ.get("FAKEGH_TAGS", "").split():
-        sys.exit("gh: Not Found (HTTP 404)")
-    print(json.dumps({"ref": "refs/tags/" + tag}))
-elif method == "GET" and endpoint.startswith(repo + "releases?"):
-    # The fallback is what --jq '.[]' prints.
-    answer(releases, "\n".join(json.dumps(r) for r in releases))
-elif method == "POST" and endpoint == repo + "releases":
-    new = {"id": int(os.environ.get("FAKEGH_NEW_ID", "9001")), "tag_name": fields.get("tag_name"),
-           "name": fields.get("name"), "draft": fields.get("draft") == "true",
-           "body": fields.get("body"), "assets": [],
-           "html_url": "https://github.com/saphid/frame-control/releases/tag/untagged-be29e900f7855d794136"}
-    answer(new, json.dumps(new))
-elif method == "DELETE" and endpoint.startswith(repo + "releases/assets/"):
-    pass
-elif method == "POST" and endpoint.startswith("https://uploads.github.com/" + repo + "releases/"):
-    with open(inp) as src, open(os.environ["FAKEGH_UPLOAD"], "w") as dst:
-        dst.write(src.read())
-    print("{}")
-elif method == "PATCH" and endpoint.startswith(repo + "releases/"):
-    rid = endpoint[len(repo + "releases/"):]
-    if not rid.isdigit():  # what GitHub said to v0.4.2's PATCH of releases/ (an empty id)
-        sys.exit("gh: Not Found (HTTP 404)")
-    page = "https://github.com/saphid/frame-control/releases/tag/%s" % fields.get("tag_name")
-    answer({"id": int(rid), "tag_name": fields.get("tag_name"), "html_url": page},
-           "published %s at %s" % (fields.get("tag_name"), page))
-else:
-    sys.exit("fakegh: unhandled %s %s" % (method, endpoint))

tests/fakessh/ssh

@@ -3,20 +3,10 @@
 each step of a connection, and plays a ControlMaster. What each HostName does comes
 from $FAKESSH_HOSTS (JSON: host -> "ok", "wrong" (a different host key), "denied" or
 "slow" (hangs after connecting);
-every call is appended to $FAKESSH_LOG as a JSON line. POSIX only.
-
-With $FAKESSH_PINS set, host keys are checked as OpenSSH does against UserKnownHostsFile under
-HostKeyAlias: "wrong" is then just a different key from the others' (a reinstalled headset),
-StrictHostKeyChecking=yes refuses a key not saved, accept-new saves a first one, and a saved key
-that differs is refused. "evil" is a device with its own key that lets anyone in without
-authentication ("none") and asks for the agent: it records in $FAKESSH_DIR what it got
-(agent-forwarded, command-ran). Like ssh, the first value of an option counts."""
-import base64
-import hashlib
+every call is appended to $FAKESSH_LOG as a JSON line. POSIX only."""
 import json
 import os
 import signal
-import subprocess
 import sys
 import time
 
@@ -27,12 +17,12 @@ hosts = json.loads(os.environ.get("FAKESSH_HOSTS", "{}"))
 opts = {}
 i = 0
 while i < len(args) and args[i].startswith("-"):
-    if args[i] in ("-o", "-O", "-p", "-l", "-F", "-W"):
+    if args[i] in ("-o", "-O", "-p", "-l"):
         key = args[i]
         val = args[i + 1]
         if key == "-o":
             k, _, v = val.partition("=")
-            opts.setdefault(k.lower(), v)
+            opts[k.lower()] = v
         else:
             opts[key] = val
         i += 2
@@ -40,12 +30,6 @@ while i < len(args) and args[i].startswith("-"):
         opts[args[i]] = True
         i += 1
 alias = args[i] if i < len(args) else ""
-command = args[i + 1:]
-if opts.get("-F") != "none":
-    # $FAKESSH_CONFIG: what ~/.ssh/config says (JSON, lower-case option -> value), below the
-    # command line's options, as ssh has it; `-F none` reads no config.
-    for k, v in json.loads(os.environ.get("FAKESSH_CONFIG", "{}")).items():
-        opts.setdefault(k, v)
 host = opts.get("hostname", alias).replace("%%", "%")
 marker = os.path.join(os.environ["FAKESSH_DIR"], "master-" + host.replace("/", "_"))
 say = lambda s: (sys.stderr.write(s + "\n"), sys.stderr.flush())
@@ -60,23 +44,6 @@ if opts.get("-O") == "exit":
         os.unlink(marker)
     sys.exit(0)
 
-if "-W" in opts:  # a jump host's ssh, forwarding to the headset: the call is logged, that's all
-    sys.exit(0)
-if opts.get("proxycommand", "none") != "none":
-    # As OpenSSH: expand %-tokens, then `$SHELL -c "exec <line>"` (here /bin/sh).
-    line, out, n = opts["proxycommand"], "", 0
-    while n < len(line):
-        if line[n] == "%" and n + 1 < len(line):
-            out += {"%": "%", "h": host, "p": opts.get("port", "22"), "r": opts.get("user", "")}.get(
-                line[n + 1], line[n:n + 2])
-            n += 2
-        else:
-            out += line[n]
-            n += 1
-    if subprocess.run(["/bin/sh", "-c", "exec " + out], stdin=subprocess.DEVNULL,
-                      stdout=subprocess.DEVNULL).returncode:
-        say("kex_exchange_identification: Connection closed by remote host")
-        sys.exit(255)
 what = hosts.get(host)
 if what is None:
     say(f"ssh: Could not resolve hostname {host}: nodename nor servname provided, or not known")
@@ -86,66 +53,6 @@ say("debug1: Connection established.")
 if what == "slow":
     time.sleep(30)
 say(f"debug1: Authenticating to {host}:22 as '{opts.get('user', 'tester')}'")
-if os.environ.get("FAKESSH_PINS") and "hostkeyalias" in opts and "userknownhostsfile" in opts:
-    name, path = opts["hostkeyalias"], os.path.expanduser(opts["userknownhostsfile"])
-    blob = base64.b64encode(b"fake-" + {"wrong": b"other", "evil": b"evil"}.get(what, b"headset") + b"-key").decode()
-    fp = base64.b64encode(hashlib.sha256(base64.b64decode(blob)).digest()).decode().rstrip("=")
-    say(f"debug1: Server host key: ssh-ed25519 SHA256:{fp}")
-    try:
-        saved = [ln.split() for ln in open(path, errors="replace").read().splitlines() if ln.strip()]
-    except OSError:
-        saved = []
-    saved = [f[2] for f in saved if len(f) >= 3 and name in f[0].split(",")]
-    strict = opts.get("stricthostkeychecking", "ask")
-    if saved and blob not in saved:
-        say("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@")
-        say("@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @")
-        say("Host key verification failed.")
-        sys.exit(255)
-    if not saved and strict != "accept-new":
-        say(f"No ED25519 host key is known for {name} and you have requested strict checking.")
-        say("Host key verification failed.")
-        sys.exit(255)
-    if not saved:
-        try:
-            with open(path, "a") as f:
-                f.write(f"{name} ssh-ed25519 {blob}\n")
-            say(f"Warning: Permanently added '{name}' (ED25519) to the list of known hosts.")
-        except OSError:  # ssh doesn't create the folder: it goes on, saving nothing
-            say(f"Failed to add the host to the list of known hosts ({path}).")
-    else:
-        say(f"debug1: Host '{name}' is known and matches the ED25519 host key.")
-    say("debug1: Next authentication method: publickey")
-    if what == "evil":
-        say(f'Authenticated to {host} ([127.0.0.1]:22) using "none".')
-        got = os.path.join(os.environ["FAKESSH_DIR"], "evil-")
-        if opts.get("forwardagent", "no") != "no" and opts.get("identityagent", "") != "none":
-            open(got + "agent-forwarded", "w").close()
-        if "-N" not in opts and (command or opts.get("remotecommand", "none") != "none"):
-            open(got + "command-ran", "w").close()
-            sys.exit(0)
-        time.sleep(30)  # -N: holds the session open
-        sys.exit(0)
-    if opts.get("preferredauthentications") == "none":
-        say(f"tester@{host}: Permission denied (publickey,password).")
-        sys.exit(255)
-    if what == "denied":
-        say(f"tester@{host}: Permission denied (publickey).")
-        sys.exit(255)
-    what = "ok"
-    say(f'Authenticated to {host} ([127.0.0.1]:22) using "publickey".')
-    if opts.get("controlmaster") != "yes":
-        sys.exit(0)
-    open(marker, "w").close()
-    def bye(*_):
-        if os.path.exists(marker):
-            os.unlink(marker)
-        sys.exit(0)
-    signal.signal(signal.SIGTERM, bye)
-    while True:
-        time.sleep(0.2)
-        if not os.path.exists(marker):
-            sys.exit(0)
 say("debug1: Server host key: ssh-ed25519 SHA256:fakefakefakefakefakefakefakefakefakefakefak")
 if what == "wrong":
     say("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@")

tests/page/desk_panels.mjs

@@ -1,82 +0,0 @@
-// The live view's Desktop panel list (#73), run in node against the real functions from
-// ui/index.html with a fake server: the headset's reason when it lists no panels, a failed
-// listing shown (first time too) rather than "Finding…", and recovery after it.
-import { readFileSync } from "fs";
-const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8");
-const grab = name => {
-  const m = src.match(new RegExp(`(?:\\nconst ${name} = [^\\n]*\\n)|((?:async )?function ${name}\\([\\s\\S]*?\\n}\\n)`));
-  if (!m) throw new Error("not found: " + name);
-  return m[0];
-};
-// The page's scripts share one global scope, so a second loadPanels would silently replace
-// the Desktop view's (what broke #73 until #84): the one grabbed here must be the only one.
-for (const name of ["loadPanels", "noPanelWhy", "deskPanel", "ctrlTarget"]) {
-  const count = (src.match(new RegExp(`\\n(?:async )?function ${name}\\(`, "g")) || []).length;
-  if (count !== 1) { console.log(`FAIL ${name} is defined ${count} times`); process.exit(1); }
-}
-const code = ["desk", "panelKey", "noPanelWhy", "deskPanel", "loadPanels", "ctrlTarget"].map(grab).join("");
-const fail = msg => { console.log("FAIL " + msg); process.exit(1); };
-
-function page(answer) {
-  const calls = [], logged = [];
-  const env = {
-    view: "flat", live: false, ctrlMode: () => "abs", renderPanelPick: () => {}, toggleLive: () => {}, ctrlShow: () => {},
-    log: (m) => logged.push(m),
-    api: async (path, body) => { calls.push([path, body]); return answer(); },
-  };
-  const fns = new Function(...Object.keys(env), `${code}
-    return { desk, noPanelWhy, loadPanels, ctrlTarget };`)(...Object.values(env));
-  return { ...fns, calls, logged };
-}
-
-// The Desktop view asks for the headset's panels with a plain GET (no switcher action).
-{
-  const p = page(() => ({ panels: [], focus: null, why: "The headset's desktop is running, but SteamOS isn't listing it as a panel." }));
-  if (p.ctrlTarget().why !== "Finding the headset's panels…") fail("before loading: " + p.ctrlTarget().why);
-  await p.loadPanels();
-  if (!(p.calls.length === 1 && p.calls[0][0] === "/api/panels" && p.calls[0][1] === undefined))
-    fail("request " + JSON.stringify(p.calls));
-  if (!p.desk.loaded) fail("not marked loaded");
-  if (!p.noPanelWhy().startsWith("The headset's desktop is running")) fail("why for capture: " + p.noPanelWhy());
-  if (!p.ctrlTarget().why.startsWith("The headset's desktop is running")) fail("why for control: " + p.ctrlTarget().why);
-}
-// An older headset script without "why": the generic advice.
-{
-  const p = page(() => ({ panels: [], focus: null }));
-  await p.loadPanels();
-  if (!p.noPanelWhy().startsWith("No app panel is open in the headset. Open the desktop")) fail("generic: " + p.noPanelWhy());
-}
-// The first listing fails: Control and Capture say so (logged once), then recover.
-{
-  let broken = true;
-  const p = page(() => {
-    if (broken) throw new Error("Timed out talking to frame");
-    return { panels: [{ window: 7, display: ":0", name: "Desktop" }], focus: 7, focus_display: ":0" };
-  });
-  await p.loadPanels(); await p.loadPanels();
-  const why = p.ctrlTarget().why;
-  if (why !== "Couldn't list the headset's panels: Timed out talking to frame") fail("initial failure in Control: " + why);
-  if (p.noPanelWhy() !== why) fail("initial failure in Capture: " + p.noPanelWhy());
-  if (p.logged.length !== 1) fail("logged " + p.logged.length + " times");
-  broken = false;
-  await p.loadPanels();
-  if (p.desk.error) fail("error kept after recovery");
-  const t = p.ctrlTarget();
-  if (!t.why || t.why.includes("Couldn't list")) fail("after recovery: " + JSON.stringify(t));
-  if (p.desk.panels.length !== 1) fail("panels after recovery");
-}
-// Waiting for the Frame: shown in Control, not logged every poll. An answer about the
-// previous headset (stale) is ignored.
-{
-  let err;
-  const p = page(() => { throw err; });
-  err = Object.assign(new Error("Can't reach the Frame"), { offline: true });
-  await p.loadPanels(); await p.loadPanels();
-  if (p.logged.length) fail("offline logged: " + p.logged);
-  if (p.ctrlTarget().why !== "Couldn't list the headset's panels: Can't reach the Frame") fail("offline: " + p.ctrlTarget().why);
-  const q = page(() => { throw Object.assign(new Error("old headset"), { offline: true, stale: true }); });
-  await q.loadPanels();
-  if (q.logged.length || q.desk.error) fail("stale answer used: " + q.desk.error);
-  if (q.ctrlTarget().why !== "Finding the headset's panels…") fail("stale: " + q.ctrlTarget().why);
-}
-console.log("ok");

tests/page/store_detail.mjs

@@ -1,93 +0,0 @@
-// The Android store's app page, run in node against the real functions from ui/index.html.
-// Issue #68: clicking an app opened an empty dialog (a bare horizontal line), because the
-// Devices page's renderDetail replaced the store's. The store's is renderAppDetail now.
-// (tests/test_server.py PageScripts checks no top-level name is declared twice.)
-import { readFileSync } from "fs";
-const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8");
-const lines = src.split("\n");
-const fail = msg => { console.log("FAIL " + msg); process.exit(1); };
-
-// A top-level declaration, from its first line to where its braces balance.
-function grab(name) {
-  const start = lines.findIndex(l => new RegExp(`^(?:(?:async )?function ${name}\\(|const ${name} = )`).test(l));
-  if (start < 0) fail(`no top-level ${name} in index.html`);
-  let depth = 0;
-  for (let i = start; i < lines.length; i++) {
-    for (const c of lines[i]) depth += c === "{" ? 1 : c === "}" ? -1 : 0;
-    if (depth <= 0) return lines.slice(start, i + 1).join("\n") + "\n";
-  }
-  fail(`unbalanced ${name}`);
-}
-const names = ["esc", "storeName", "storeHue", "storeInitial", "storeText", "storeOpenSource", "sourcePage", "storeImage",
-               "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody",
-               "updateInstall", "openStoreApp", "loadOfferDetails"];
-const code = names.map(grab).join("");
-
-// A fake page: elements by id. The install panel's elements exist only while
-// #detailBody holds the real app page, as in the browser.
-function page(api = async () => ({})) {
-  const els = { appDetail: { open: false, scrollTop: 0, showModal() { this.open = true; } } };
-  const inPage = id => ["detailInstall", "detailInstallNote", "detailProgress", "detailOffers"].includes(id);
-  const $ = id => inPage(id) && !(els.detailBody?.innerHTML || "").includes(`id="${id}"`) ? null
-    : (els[id] ||= { innerHTML: "", textContent: "", hidden: false, value: 0, removeAttribute() {}, querySelectorAll: () => [] });
-  const sourceState = { apps: [], detail: null, detailRequest: 0, jobs: new Map() };
-  const document = { activeElement: null, querySelector: () => null };
-  const console = { error() {} };
-  const calls = [];
-  const fns = new Function("$", "sourceState", "document", "console", "api", code + "; return { renderAppDetail, openStoreApp };")(
-    $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); });
-  return { els, sourceState, calls, ...fns };
-}
-
-const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid", name: "Open Brush", summary: "Paint in VR",
-                description: "Paint in 3D.", version: "2.1", version_code: 21, package: "org.example.brush",
-                artwork: { icon: "/source-image/abc", screenshots: [] }, downloadable: true, verdict: { tone: "works", label: "Works" } };
-
-// An app from the catalogue: its page renders, with its name, install and sources.
-{
-  const p = page();
-  p.sourceState.detail = { app: { name: "Open Brush", offers: [{ ...offer }] }, choice: 0 };
-  if (p.renderAppDetail() !== true) fail("a good listing reported a render failure");
-  const html = p.els.detailBody.innerHTML;
-  if (!html.includes('id="detailTitle">Open Brush<')) fail("app page has no title: " + html.slice(0, 200));
-  if (!html.includes('id="detailInstall"') || !html.includes("Get it from")) fail("app page has no install panel");
-  if (html.includes('role="alert"')) fail("a good listing showed the error state");
-}
-
-// A listing that can't render (no offer to show) gets a clear message, not an empty dialog.
-{
-  const p = page();
-  p.sourceState.detail = { app: { name: "Broken <App>", offers: [] }, choice: 0 };
-  if (p.renderAppDetail() !== false) fail("a broken listing reported success");
-  const html = p.els.detailBody.innerHTML;
-  if (!html.includes('role="alert"') || !html.includes("We couldn't show Broken &lt;App&gt;")) fail("no error state: " + html);
-  if (!html.includes('data-close="appDetail"')) fail("error state has no way to close");
-}
-
-// Opening a listing that can't render: the error stays up, no details request, nothing thrown.
-{
-  const p = page(async () => { throw new Error("offline"); });
-  p.sourceState.apps = [{ name: "Broken", offers: [] }];
-  await p.openStoreApp(0);
-  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('role="alert"')) fail("broken listing didn't open with the error");
-  if (p.calls.length) fail("asked for details of a listing that couldn't render");
-}
-
-// Opening a good listing: the dialog opens with its page, and fresher details fill it in.
-{
-  const p = page(async () => ({ description: "Fresh description." }));
-  p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }];
-  await p.openStoreApp(0);
-  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes("Fresh description.")) fail("details didn't fill in the page");
-  if (!String(p.calls[0]?.[0]).startsWith("/api/sources/details?")) fail("no details request: " + JSON.stringify(p.calls));
-}
-
-// A good listing whose details request fails keeps its page, with a note.
-{
-  const p = page(async () => { throw new Error("offline"); });
-  p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }];
-  await p.openStoreApp(0);
-  if (!p.els.detailBody.innerHTML.includes('id="detailTitle">Open Brush<')) fail("page lost after a failed details request");
-  if (!p.els.detailInstallNote.textContent.includes("couldn't be refreshed")) fail("no note after a failed details request");
-}
-console.log("ok");

tests/sandbox.py

@@ -1,20 +1,12 @@
 """Imported first by every test module: nothing a test does reaches this person's
-app data, their ~/.ssh, their telemetry, or the shared compatibility database.
+app data, their telemetry, or the shared compatibility database.
 
 Must run before any ui module is imported, since those read these at import time.
-The variables are set in os.environ, so servers and scripts the tests start
-inherit them too (they pass {**os.environ, ...}).
 """
 import atexit
 import os
 import shutil
 import tempfile
-from pathlib import Path
-
-# The environment and real ~/.ssh from before the changes below: test_sandbox
-# reruns tests from that environment and checks ~/.ssh is left alone.
-ORIGINAL_ENV = dict(os.environ)
-REAL_SSH_DIR = Path.home() / ".ssh"
 
 _dir = tempfile.mkdtemp(prefix="frame-control-tests-")
 atexit.register(shutil.rmtree, _dir, ignore_errors=True)
@@ -22,25 +14,3 @@ os.environ["FRAME_CONTROL_DATA_DIR"] = _dir
 os.environ["FRAME_CONTROL_TELEMETRY"] = "0"
 # A maintainer's machine holds the database key; send anything that slips through nowhere.
 os.environ["FRAME_COMPAT_DB_URL"] = "http://127.0.0.1:9"
-
-# A throwaway home, so Path.home() / "~" land here: ~/.ssh (config, host-key pins,
-# its lock file) and the other per-user folders some modules use. A server started
-# without FRAME_CONTROL_SSH_DIR used to import the real ~/.ssh/config and seed a pin
-# into the real ~/.ssh/frame-control-hosts on every run.
-#
-# tests/e2e must not import this (directly or through a test_* module): they run in
-# a throwaway container whose real ~/.ssh points `ssh frame` at the fake Frame, and
-# OpenSSH finds ~/.ssh from the password database, not $HOME. Shared helpers they
-# need live in sandbox-free modules such as apk_fixtures.py.
-HOME = os.path.join(_dir, "home")
-SSH_DIR = os.path.join(HOME, ".ssh")
-os.makedirs(SSH_DIR, mode=0o700)
-os.environ["HOME"] = HOME
-os.environ["USERPROFILE"] = HOME  # Path.home() on Windows
-os.environ["FRAME_CONTROL_SSH_DIR"] = SSH_DIR  # frame_devices.ssh_dir(), frame_connect.SSH_DIR
-# The per-user folders that don't follow HOME when these are set: frame_host.cache_dir()
-# (servers warm indexes there and sweep its staging folders) and data_dir()'s fallbacks.
-for _name, _sub in (("LOCALAPPDATA", "AppData/Local"), ("APPDATA", "AppData/Roaming"),
-                    ("XDG_CACHE_HOME", ".cache"), ("XDG_DATA_HOME", ".local/share"),
-                    ("XDG_STATE_HOME", ".local/state"), ("XDG_CONFIG_HOME", ".config")):
-    os.environ[_name] = os.path.join(HOME, *_sub.split("/"))

tests/test_agent.py

@@ -1,5 +1,4 @@
 """MCP protocol, exact-action approvals and explicit assistant data sharing."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import json
 import os

tests/test_apk_artwork.py

@@ -1,4 +1,3 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import http.client
 import json
 from pathlib import Path

tests/test_apk_more_sources.py

@@ -1,4 +1,3 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import hashlib, io, json, os, sys, tempfile, time, unittest, urllib.error, urllib.request, zipfile
 from pathlib import Path
 from unittest.mock import patch

tests/test_apk_search.py

@@ -1,4 +1,3 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import http.client
 import json
 from pathlib import Path

tests/test_comfort.py

@@ -1,5 +1,4 @@
 """Fake-Frame session clock/actions plus real helper serialization and sensor probes."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import os
 import shutil
 import json
@@ -256,47 +255,3 @@ class SensorTests(unittest.TestCase):
                 self.assertIsNone(status.activity_level())
         with patch.object(status, 'run', return_value='[{"operation":"status","activity_level":3}]'):
             self.assertEqual(status.activity_level(), 3)
-
-
-class DesktopBundleTests(unittest.TestCase):
-    """server.comfort runs the copy cached on the headset; the sources go only when it's missing."""
-
-    @unittest.skipUnless(os.name == "posix", "checks POSIX permissions")
-    def test_sources_are_sent_once_per_version(self):
-        import server
-        with tempfile.TemporaryDirectory() as tmp:
-            here, home = Path(tmp) / 'ui', Path(tmp) / 'frame'
-            here.mkdir()
-            home.mkdir()
-            for name in server.COMFORT_FILES:
-                (here / name).write_text('# ' + name + '\n')
-            (here / 'frame_comfort.py').write_text('import json, sys\nprint(json.dumps({"active": False, "got": sys.argv[1]}))\n')
-            sent = []
-
-            def ssh(remote, *, stdin, timeout):  # the headset: the script run under its own home
-                sent.append(stdin)
-                return subprocess.run([sys.executable, '-'], input=stdin, capture_output=True, text=True, check=True,
-                                      env={**os.environ, 'HOME': str(home)}).stdout
-
-            with patch.object(server, 'HERE', here), patch.object(server, 'ssh', side_effect=ssh):
-                first = server.comfort({'action': 'status'})
-                self.assertEqual(json.loads(first['got']), {'action': 'status'})
-                self.assertEqual(len(sent), 2)  # the check, then the sources
-                self.assertNotIn('# frame_steam.py', sent[0])
-                self.assertIn('# frame_steam.py', sent[1])
-                self.assertEqual(server.comfort({'action': 'status'}), first)
-                self.assertEqual(len(sent), 3)
-                self.assertNotIn('# frame_steam.py', sent[2])
-                cached, = (home / '.cache/frame-control/comfort').iterdir()
-                self.assertEqual(sorted(p.name for p in cached.iterdir()), sorted(server.COMFORT_FILES))
-                self.assertEqual(cached.stat().st_mode & 0o777, 0o700)
-                self.assertTrue(all(p.stat().st_mode & 0o777 == 0o600 for p in cached.iterdir()))
-                # A copy cut short is completed; a changed helper is a new version.
-                (cached / 'frame_status.py').unlink()
-                server.comfort({'action': 'status'})
-                self.assertEqual(len(sent), 5)
-                self.assertTrue((cached / 'frame_status.py').exists())
-                (here / 'frame_steam.py').write_text('# frame_steam.py, changed\n')
-                server.comfort({'action': 'status'})
-                self.assertEqual(len(sent), 7)
-                self.assertEqual(len(list((home / '.cache/frame-control/comfort').iterdir())), 2)

tests/test_comfort_ui.py

@@ -1,5 +1,4 @@
 """Run the actual shared page's comfort renderer against a minimal DOM/bridge."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import pathlib
 import shutil
 import subprocess
@@ -60,31 +59,44 @@ const log = ()=>{}, toast = ()=>{};
         result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
         self.assertEqual(result.returncode, 0, result.stderr)
 
-    def test_poll_waits_while_the_frame_is_unreachable(self):
+    def test_a_finished_session_leaves_the_defaults(self):
+        """A one-minute test session that has ended mustn't fill the form with 1 / 0 / 0."""
         page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
-        start = page.index('async function pollComfort()')
-        code = page[start:page.index('$("comfortForm").onsubmit', start)]
-        js = r'''
+        code = page[page.index('let comfortBusy ='):page.index('async function pollComfort()')]
+        setup = r'''
 const assert = require('node:assert/strict');
-const el = {textContent: 'Checking session…'};
-const $ = () => el;
-let online = false, comfortBusy = false, calls = 0, timers = 0;
-const api = async () => { calls++; return {}; };
-const renderComfort = () => {};
-const setTimeout = () => { timers++; };
-''' + code + r'''
-(async () => {
-  await pollComfort();
-  assert.equal(calls, 0);  // no ssh attempt while the status check can't reach the Frame
-  assert.match(el.textContent, /when the Frame is connected/);
-  assert.equal(timers, 1);  // still scheduled, to resume when it's back
-  online = true;
-  await pollComfort();
-  assert.equal(calls, 1);
-  online = null;  // a status check that failed for another reason: keep polling
-  await pollComfort();
-  assert.equal(calls, 2);
-})().catch(e => { console.error(e); process.exitCode = 1; });
+const elements = new Map();
+const $ = id => {
+  // The form's own defaults, as in the page's HTML.
+  const value = {sessionMinutes:'30', breakMinutes:'20', stillMinutes:'30'}[id] || '';
+  if (!elements.has(id)) elements.set(id, {textContent:'', hidden:true, disabled:false, value, defaultValue:value,
+    checked:true, defaultChecked:true, type: /Alert$/.test(id) ? 'checkbox' : 'number'});
+  return elements.get(id);
+};
+const window = {frameApp:{notify:async()=>{}}};
+const log = ()=>{}, toast = ()=>{};
 '''
-        result = subprocess.run(['node', '-e', js], capture_output=True, text=True)
+        checks = r'''
+renderComfort({id:'old', active:false, time:100, options:{minutes:1,breakMinutes:0,stillMinutes:0,batteryAlert:false,heatAlert:false},
+  events:[{id:'old:1',kind:'finished',time:90,message:'Session ended'}]});
+assert.equal($('sessionMinutes').value, '30');
+assert.equal($('breakMinutes').value, '20');
+assert.equal($('batteryAlert').checked, true);
+assert.match($('comfortEvents').textContent, /Session ended/);
+assert.notEqual($('comfortEvents').textContent, 'Session ended');  // it carries a time
+renderComfort({id:'new', active:true, time:200, remaining:600, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false}, events:[]});
+assert.equal($('sessionMinutes').value, 45);  // a running session shows its own settings
+assert.equal($('heatAlert').checked, false);
+// The page stays open while that session ends: the next one starts from the defaults again.
+renderComfort({id:'new', active:false, time:900, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false},
+  events:[{id:'new:1',kind:'finished',time:899,message:'Session ended'}]});
+assert.equal($('sessionMinutes').value, '30');
+assert.equal($('breakMinutes').value, '20');
+assert.equal($('heatAlert').checked, true);
+renderComfort({id:'new', active:false, time:905, options:{minutes:45}, events:[]});
+$('sessionMinutes').value = '50';  // what's typed for the next session
+renderComfort({id:'new', active:false, time:910, options:{minutes:45}, events:[]});
+assert.equal($('sessionMinutes').value, '50');  // later polls leave it alone
+'''
+        result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
         self.assertEqual(result.returncode, 0, result.stderr)

tests/test_contact.py

@@ -1,412 +0,0 @@
-"""A contact email (ui/frame_contact.py): kept only with a matching choice, sent privately,
-withdrawn when removed, never lost offline, and the one-time prompt stays dismissed.
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import sys
-import threading
-import time
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-
-import frame_compat_db as db  # noqa: E402
-import frame_contact as fc  # noqa: E402
-import frame_report as fr  # noqa: E402
-import frame_telemetry as tm  # noqa: E402
-from test_telemetry import Base, ReportProblem  # noqa: E402
-
-REPORT = {"title": "RDP not working", "message": "It never connects on Windows."}
-
-
-class Contact(Base):
-    """Base's temp telemetry state, ReportProblem's PostHog stand-in, and a temp contact file."""
-    serve = ReportProblem.serve
-
-    def setUp(self):
-        super().setUp()
-        self.addCleanup(fc._removed.clear)
-        for name, value in (("STATE", tm.STATE / "contact"), ("FILE", tm.STATE / "contact" / "contact.json")):
-            p = mock.patch.object(fc, name, value)
-            p.start()
-            self.addCleanup(p.stop)
-        self.got = self.serve()
-
-    def events(self):
-        return [body["batch"][0] for _, body in self.got]
-
-    def offline(self):
-        return mock.patch.object(tm, "post", side_effect=tm.SendError("couldn't reach PostHog"))
-
-    # ---- storage and consent flags
-
-    def test_nothing_is_kept_or_sent_until_chosen(self):
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"], s["waiting"]), ("", False, False, False))
-        self.assertFalse(fc.FILE.exists())
-        self.assertEqual(self.got, [])
-
-    def test_an_address_needs_a_choice_and_a_real_address(self):
-        with self.assertRaisesRegex(ValueError, "tick"):
-            fc.save({"email": "me@example.com"})
-        with self.assertRaisesRegex(ValueError, "email address"):
-            fc.save({"email": "not an address", "updates": True})
-        self.assertEqual(fc.load()["email"], "")
-        self.assertEqual(self.got, [])
-
-    def test_only_a_real_true_counts_as_consent(self):
-        for wrong in ("false", "true", 1, 0, [], {}):
-            with self.assertRaisesRegex(ValueError, "true or false"):
-                fc.save({"email": "me@example.com", "updates": wrong, "followup": True})
-            with self.assertRaisesRegex(ValueError, "true or false"):
-                fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": wrong})
-        self.assertEqual((fc.load()["email"], self.got), ("", []))
-        fc.save({"email": "me@example.com", "updates": True})  # left out is no
-        self.assertEqual((fc.load()["updates"], fc.load()["followup"]), (True, False))
-
-    def test_each_choice_is_sent_privately_on_its_own(self):
-        fc.save({"email": " me@example.com ", "updates": True})
-        fc.save({"email": "me@example.com", "updates": False, "followup": True})
-        first, second = self.events()
-        self.assertEqual(first["event"], "contact_consent")
-        self.assertEqual({k: first["properties"][k] for k in ("email", "updates", "followup", "action")},
-                         {"email": "me@example.com", "updates": True, "followup": False, "action": "set"})
-        self.assertEqual((second["properties"]["updates"], second["properties"]["followup"]), (False, True))
-        self.assertEqual(first["distinct_id"], second["distinct_id"])  # one contact id, newest wins
-        self.assertNotEqual(first["distinct_id"], tm.settings()["id"])  # not the analytics id
-        self.assertEqual((first["properties"]["$process_person_profile"], first["properties"]["$geoip_disable"]),
-                         (False, True))
-        self.assertEqual([e["event"] for e in tm._read_lines(tm.SENT)], ["contact_consent"] * 2)
-
-    def test_sent_whatever_the_analytics_settings(self):
-        tm.update_settings({"usage": False})
-        fc.save({"email": "me@example.com", "followup": True})
-        self.assertEqual(len(self.got), 1)
-
-    def test_saving_the_same_choice_again_sends_nothing(self):
-        fc.save({"email": "me@example.com", "updates": True})
-        fc.save({"email": "me@example.com", "updates": True})
-        self.assertEqual(len(self.got), 1)
-
-    # ---- withdrawal
-
-    def test_removing_the_address_sends_a_withdrawal_without_it(self):
-        fc.save({"email": "me@example.com", "updates": True, "followup": True})
-        s = fc.save({"email": "", "updates": True, "followup": True})
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("", False, False))
-        withdrawal = self.events()[-1]["properties"]
-        self.assertEqual((withdrawal["action"], withdrawal["email"], withdrawal["updates"], withdrawal["followup"]),
-                         ("withdraw", "", False, False))
-        self.assertNotIn("me@example.com", fc.FILE.read_text())
-
-    def test_an_address_still_waiting_is_withdrawn_too(self):
-        with self.offline():
-            fc.save({"email": "me@example.com", "updates": True})  # may already be on its way
-        with mock.patch.object(tm, "post") as post:
-            fc.save({"email": ""})
-        self.assertEqual([c.args[0][0]["properties"]["action"] for c in post.call_args_list], ["withdraw"])
-        self.assertFalse(fc.state()["waiting"])
-
-    def test_offline_the_newest_choice_waits_and_a_withdrawal_is_never_lost(self):
-        fc.save({"email": "me@example.com", "updates": True})
-        with self.offline():
-            s = fc.save({"email": ""})
-            self.assertTrue(s["waiting"])
-            self.assertFalse(fc._send_pending())
-        self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw")
-        self.assertTrue(fc._send_pending())
-        self.assertFalse(fc.state()["waiting"])
-        self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"])
-
-    def test_removing_the_address_wipes_it_from_the_sent_log_too(self):
-        fc.save({"email": "me@example.com", "followup": True})
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        self.assertIn("me@example.com", tm.SENT.read_text())
-        fc.save({"email": ""})
-        self.assertNotIn("me@example.com", tm.SENT.read_text())
-        self.assertEqual([e["properties"].get("action") for e in tm._read_lines(tm.SENT)
-                          if e["event"] == "contact_consent"], ["set", "withdraw"])
-
-    def test_each_change_has_a_higher_rev_so_the_newest_wins_whatever_the_clock(self):
-        fc.save({"email": "me@example.com", "updates": True})
-        fc.save({"email": "new@example.com", "updates": True})
-        fc.save({"email": ""})
-        self.assertEqual([e["properties"]["rev"] for e in self.events()], [1, 2, 3])
-
-    def test_a_withdrawal_during_a_send_goes_after_it(self):
-        started, release, order = threading.Event(), threading.Event(), []
-        real = tm.post
-
-        def slow(batch, timeout=20):
-            order.append(batch[0]["properties"]["action"])
-            if len(order) == 1:
-                started.set()
-                release.wait(5)
-            real(batch, timeout)
-
-        with mock.patch.object(tm, "post", side_effect=slow):
-            t = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},))
-            t.start()
-            self.assertTrue(started.wait(5))
-            w = threading.Thread(target=fc.save, args=({"email": ""},))
-            w.start()
-            for _ in range(500):  # the withdrawal is saved while the first send is still out
-                if fc.load()["rev"] == 2:
-                    break
-                time.sleep(0.01)
-            self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw")
-            release.set()
-            t.join(5)
-            w.join(5)
-        self.assertEqual(order, ["set", "withdraw"])
-        self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"])
-        self.assertFalse(fc.state()["waiting"])
-        self.assertNotIn("me@example.com", tm.SENT.read_text())
-
-    def test_a_report_still_sending_when_its_address_is_removed_is_logged_without_it(self):
-        fc.save({"email": "me@example.com", "followup": True})
-        real = tm.post
-
-        def remove_meanwhile(batch, timeout=20):
-            real(batch, timeout)
-            fc.save({"email": ""})  # removed while the report is on its way, before it's logged
-
-        with mock.patch.object(tm, "post", side_effect=remove_meanwhile):
-            fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        self.assertNotIn("me@example.com", tm.SENT.read_text())
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        self.assertIn("me@example.com", tm.SENT.read_text())  # sent again after removal: logged as sent
-
-    def test_only_reports_started_before_the_removal_are_redacted_even_within_a_second(self):
-        fc._removed["me@example.com"] = 1790000000.3
-        event = lambda: {"timestamp": "2026-09-21T12:53:20Z", "properties": {"contact": "me@example.com"}}
-        before, after = event(), event()  # the same whole second as the removal
-        fc.redact_removed(before, 1790000000.1)
-        fc.redact_removed(after, 1790000000.6)
-        self.assertEqual((before["properties"]["contact"], after["properties"]["contact"]),
-                         ("<removed>", "me@example.com"))
-
-    def test_saving_during_a_slow_send_returns_at_once(self):
-        busy = fc._send_lock
-        busy.acquire()
-        try:
-            s = fc.save({"email": "me@example.com", "updates": True})
-        finally:
-            busy.release()
-        self.assertTrue(s["waiting"])  # left for the send under way (or the retry) to take
-        self.assertEqual(self.got, [])
-        self.assertTrue(fc._send_pending())
-        self.assertEqual(len(self.got), 1)
-
-    def test_a_change_saved_as_a_send_finishes_is_not_left_behind(self):
-        real = fc._send_lock
-
-        class Lock:  # a Save lands after the sender found nothing waiting, before it lets go
-            saved = False
-
-            def acquire(self, blocking=True):
-                return real.acquire(blocking)
-
-            def release(self):
-                if not Lock.saved:
-                    Lock.saved = True
-                    s = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},))
-                    s.start()
-                    s.join(5)
-                    assert not s.is_alive()  # the change is saved while the sender still holds the lock
-                real.release()
-
-        with mock.patch.object(fc, "_send_lock", Lock()):
-            self.assertTrue(fc._send_pending())
-        self.assertEqual([e["properties"]["email"] for e in self.events()], ["me@example.com"])
-        self.assertFalse(fc.state()["waiting"])
-
-    # ---- the one-time prompt
-
-    def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self):
-        self.assertFalse(fc.state()["showPrompt"])  # a new install: the Frame hasn't connected yet
-        tm.frame_seen("20260901.1", "3.8")
-        self.assertTrue(fc.state()["showPrompt"])
-        fc.prompt({"prompt": "dismissed"})
-        fc.prompt({"prompt": "shown"})  # a later session can't bring it back
-        self.assertEqual(fc.load()["prompt"], "dismissed")
-        self.assertFalse(fc.state()["showPrompt"])
-        self.assertEqual(self.got, [])  # No thanks sends nothing
-        with self.assertRaises(ValueError):
-            fc.prompt({"prompt": "reset"})
-
-    def test_the_prompt_is_shown_once_and_saving_answers_it(self):
-        tm.frame_seen("20260901.1", "3.8")
-        fc.prompt({"prompt": "shown"})
-        self.assertFalse(fc.state()["showPrompt"])
-        fc.save({"email": "me@example.com", "followup": True, "fromPrompt": True})
-        self.assertEqual(fc.load()["prompt"], "answered")
-
-    # ---- reports and the maintainer's list
-
-    def reports(self):
-        return [e["properties"] for e in self.events() if e["event"] == "problem_report"]
-
-    def test_a_report_carries_the_address_only_with_follow_up_consent(self):
-        fr.send({**REPORT, "contact": "me@example.com"})
-        self.assertFalse(fc.FILE.exists())  # no follow-up: nothing kept, nothing linked
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        without, with_ = self.reports()
-        self.assertEqual((without["contact"], without["contact_followup"], without["contact_id"]), ("", False, ""))
-        self.assertEqual((with_["contact"], with_["contact_followup"]), ("me@example.com", True))
-        self.assertEqual((with_["contact_id"], with_["contact_rev"]), (fc.load()["id"], fc.load()["rev"]))
-        self.assertNotEqual(with_["contact_id"], tm.settings()["id"])  # not the analytics id
-        with self.assertRaisesRegex(ValueError, "email address"):
-            fr.send({**REPORT, "contact": "discord:me", "contactFollowup": True})
-
-    def test_follow_up_given_with_a_report_is_kept_and_removed_in_settings(self):
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("me@example.com", False, True))
-        consent = [e for e in self.events() if e["event"] == "contact_consent"]
-        self.assertEqual([(e["properties"]["action"], e["properties"]["rev"]) for e in consent], [("set", 1)])
-        self.assertEqual(consent[0]["distinct_id"], self.reports()[0]["contact_id"])
-        fr.send({**REPORT, "contact": "ME@example.com", "contactFollowup": True})  # already agreed
-        self.assertEqual(len([e for e in self.events() if e["event"] == "contact_consent"]), 1)
-        self.assertEqual(self.reports()[1]["contact_rev"], 1)
-        fc.save({"email": ""})  # Remove my email
-        last = self.events()[-1]
-        self.assertEqual((last["properties"]["action"], last["properties"]["email"], last["properties"]["rev"]),
-                         ("withdraw", "", 2))
-        logged = [e["properties"].get("contact") for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"]
-        self.assertEqual(logged, ["<removed>", "<removed>"])
-
-    def test_a_report_to_another_address_replaces_it_with_follow_up_only(self):
-        """Update notices were agreed for the old address, not the new one (the form says so)."""
-        fc.save({"email": "old@example.com", "updates": True})
-        fr.send({**REPORT, "contact": "new@example.com", "contactFollowup": True})
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", False, True))
-        self.assertEqual(self.reports()[0]["contact_rev"], 2)
-        fc.save({"email": "new@example.com", "updates": True, "followup": False})
-        fr.send({**REPORT, "contact": "NEW@example.com", "contactFollowup": True})  # same address: kept
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", True, True))
-
-    def test_a_removal_while_the_report_saves_its_address_still_counts(self):
-        """Removed while the report's own consent is on its way: the report keeps that consent's
-        rev (so the removal is newer) and is logged without the address."""
-        post, removed = tm.post, []
-
-        def slow_post(events, **kw):
-            post(events, **kw)
-            if not removed and events[0]["event"] == "contact_consent":
-                removed.append(fc.save({"email": ""}))  # Remove my email, mid-send
-        with mock.patch.object(tm, "post", side_effect=slow_post):
-            fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        report = self.reports()[0]
-        self.assertEqual((report["contact_rev"], fc.load()["rev"], fc.state()["email"]), (1, 2, ""))
-        consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]]
-                    for e in self.events() if e["event"] == "contact_consent"]
-        row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"])
-        fr.mark_withdrawn([row], consents)
-        self.assertEqual(row[10], "withdrawn")
-        logged = [e["properties"]["contact"] for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"]
-        self.assertEqual(logged, ["<removed>"])
-
-    def report_row(self, contact="me@example.com", followup=True, cid="copy", rev=1):
-        return ["2026-09-10T10:00:00Z", "AB12CD34", "bug", "RDP", "It never connects.", contact,
-                "0.4.0", "Windows", "", "", followup, cid, rev]
-
-    def test_a_later_change_takes_back_a_reports_follow_up_permission(self):
-        reports = [self.report_row(),                                   # removed later
-                   self.report_row(cid="other"),                        # another copy, still agrees
-                   self.report_row(rev=3),                              # sent after the removal
-                   self.report_row(cid="moved"),                        # address changed later
-                   self.report_row(cid="news-only"),                    # follow-up unticked later
-                   self.report_row(contact="Me@Example.com", cid="case"),  # same address, any case
-                   self.report_row(cid="", followup=True),              # no contact id: left alone
-                   self.report_row(cid="bad", rev="x")]                 # malformed rev: treated as 0
-        consents = [["copy", "me@example.com", True, 1], ["copy", "", False, 2],
-                    ["other", "me@example.com", True, 1], ["other", "me@example.com", True, 2],
-                    ["moved", "new@example.com", True, 2], ["news-only", "me@example.com", False, 2],
-                    ["case", "me@example.com", True, 2], ["bad", "", False, 1], ["short"], ["x", "", False, "?"]]
-        fr.mark_withdrawn(reports, consents)
-        self.assertEqual([r[10] for r in reports],
-                         ["withdrawn", True, True, "withdrawn", "withdrawn", True, True, "withdrawn"])
-
-    def test_the_change_number_decides_not_the_clock(self):
-        """The clock went back between the report and the removal: the removal still counts."""
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        with mock.patch.object(fc.time, "gmtime", return_value=time.gmtime(0)):
-            fc.save({"email": ""})
-        report = self.reports()[0]
-        row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"])
-        consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]]
-                    for e in self.events() if e["event"] == "contact_consent"]
-        self.assertEqual(self.events()[-1]["timestamp"], "1970-01-01T00:00:00Z")
-        fr.mark_withdrawn([row], consents)
-        self.assertEqual(row[10], "withdrawn")
-
-    def test_the_inbox_shows_withdrawn_follow_up_without_the_address(self):
-        reports = [self.report_row(), ["short"]]
-        consents = [["copy", "", False, 2]]
-        with mock.patch.object(db, "_posthog_query", side_effect=[{"results": reports}, {"results": consents}]) as q, \
-             mock.patch.object(sys, "argv", ["frame_report.py", "inbox", "30"]), \
-             mock.patch("builtins.print") as out:
-            fr.main()
-        self.assertIn("properties.contact_rev", q.call_args_list[0].args[0])
-        self.assertIn("event = 'contact_consent'", q.call_args_list[1].args[0])
-        printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args)
-        self.assertIn("follow-up permission since withdrawn", printed)
-        self.assertNotIn("me@example.com", printed)
-        with mock.patch.object(db, "_posthog_query", return_value={"results": [self.report_row(followup=False)]}) as q:
-            fr.inbox()
-        self.assertEqual(q.call_count, 1)  # nothing to reconcile, no second query
-
-    def test_contacts_lists_the_newest_choice_per_copy_by_consent(self):
-        rows = [["a", "both@example.com", True, "true", "2026-09-01T10:00:00Z"],
-                ["b", "news@example.com", "true", False, "2026-09-02T10:00:00Z"],
-                ["c", "", False, False, "2026-09-03T10:00:00Z"],  # withdrawn
-                ["d", "not-an-address", True, True, "2026-09-03T10:00:00Z"], ["short"]]
-        with mock.patch.object(db, "_posthog_query", return_value={"results": rows}) as q:
-            found = fr.contacts()
-        self.assertIn("argMax(properties.email, tuple(ifNull(toInt(properties.rev), 0), timestamp))",
-                      q.call_args.args[0])
-        self.assertEqual(found, {"updates": [("both@example.com", "2026-09-01"), ("news@example.com", "2026-09-02")],
-                                 "followup": [("both@example.com", "2026-09-01")]})
-        with mock.patch.object(fr, "contacts", return_value=found), \
-             mock.patch.object(sys, "argv", ["frame_report.py", "contacts", "followup"]), \
-             mock.patch("builtins.print") as out:
-            fr.main()
-        printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args)
-        self.assertIn("both@example.com", printed)
-        self.assertNotIn("news@example.com", printed)
-
-    def test_the_page_can_reach_it(self):
-        import server
-        self.assertIs(server.POST["/api/contact"], fc.save)
-        self.assertIs(server.POST["/api/contact/prompt"], fc.prompt)
-
-    def test_saving_is_not_headset_work(self):
-        """A slow send mustn't hold up switching headsets, nor be refused after a switch."""
-        import io
-        import server
-        seen = []
-        for path in ("/api/contact", "/api/contact/prompt"):
-            h = server.Handler.__new__(server.Handler)
-            body = b'{"prompt": "shown"}' if path.endswith("prompt") else b'{"email": "me@example.com", "updates": true}'
-            h.path, h.rfile = path, io.BytesIO(body)
-            h.headers = {"Content-Length": str(len(body)), "X-Frame-Device": "a-headset-switched-away-from"}
-            h.local_request = lambda: True
-            h.send_json = lambda obj, status=200: seen.append((status, server._work[0]))
-            with mock.patch.object(fc, "_send_pending", side_effect=lambda block=True: seen.append(("send", server._work[0]))):
-                h.do_POST()
-        self.assertEqual(seen, [("send", 0), (200, 0), (200, 0)])
-
-
-# Run these once, in test_telemetry, not again through the import above.
-del Base, ReportProblem
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_devices.py

@@ -17,7 +17,6 @@ ROOT = Path(__file__).resolve().parent.parent
 sys.path.insert(0, str(ROOT / "ui"))
 
 import frame_devices as fd  # noqa: E402
-import frame_host  # noqa: E402
 
 CONFIG = """Host lxso1
   HostName 192.168.1.109
@@ -264,30 +263,6 @@ class Pins(Base):
         self.assertFalse(fd.pinned("d1"))
         self.assertFalse(fd.forget_pin("d1"))
 
-    def test_a_trusted_key_replaces_the_saved_one_and_fingerprints_match_ssh_keygen(self):
-        key = self.dir / "hostkey"
-        frame_host.run_ssh(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)], capture_output=True,
-                           stdin=subprocess.DEVNULL, check=True, timeout=20)
-        kind, blob = key.with_suffix(".pub").read_text().split()[:2]
-        want = frame_host.run_ssh(["ssh-keygen", "-l", "-E", "sha256", "-f", str(key.with_suffix(".pub"))],
-                                  capture_output=True, text=True, stdin=subprocess.DEVNULL, timeout=10).stdout.split()[1]
-        self.assertEqual(fd.fingerprint(blob), want)
-        self.assertIsNone(fd.fingerprint("not base64!"))
-        (self.ssh / "known_hosts").write_text(f"frame.local {KEY}\n")
-        fd.seed_pin("d1", ["frame.local"])
-        old = fd.pinned_keys("d1")
-        fd.pin_key("d1", kind, blob)
-        self.assertEqual(fd.known_hosts("d1").read_text(), f"frame-control-d1 {kind} {blob}\n")  # old key gone
-        self.assertEqual(fd.pinned_keys("d1"), [(kind, want)])
-        self.assertNotEqual(old, fd.pinned_keys("d1"))
-        self.assertTrue(fd.pinned("d1"))
-        for bad in (("ssh-ed25519\nHost *", blob), ("ssh-ed25519", "AAAA AAAA"), ("evil", blob)):
-            with self.assertRaises(fd.DeviceError):
-                fd.pin_key("d1", *bad)
-        # Only plain entries for this headset's alias count.
-        self.assertIsNone(fd.key_entry(f"frame-control-d2 {kind} {blob}", "frame-control-d1"))
-        self.assertIsNone(fd.key_entry(f"# frame-control-d1 {kind} {blob}", "frame-control-d1"))
-
     def test_each_headset_has_its_own_file(self):
         (self.ssh / "known_hosts").write_text(f"a.local {KEY}\nb.local {KEY}\n")
         fd.seed_pin("da", ["a.local"])
@@ -299,8 +274,7 @@ class Pins(Base):
     def test_hashed_and_non_default_port_entries(self):
         kh = self.ssh / "known_hosts"
         kh.write_text(f"[frame.local]:2222 {KEY}\n")
-        frame_host.run_ssh(["ssh-keygen", "-H", "-f", str(kh)], capture_output=True,
-                           stdin=subprocess.DEVNULL, check=True, timeout=10)
+        subprocess.run(["ssh-keygen", "-H", "-f", str(kh)], capture_output=True, check=True)
         self.assertFalse(fd.seed_pin("d3", ["frame.local"]))  # port 22: not that entry
         self.assertTrue(fd.seed_pin("d3", ["frame.local"], port=2222))
         self.assertIn(f"frame-control-d3 {KEY}", fd.known_hosts("d3").read_text())
@@ -309,8 +283,7 @@ class Pins(Base):
         target = fd.known_hosts("d4")
         target.parent.mkdir(parents=True, exist_ok=True)
         target.write_text(f"frame-control-d4 {KEY}\n")
-        frame_host.run_ssh(["ssh-keygen", "-H", "-f", str(target)], capture_output=True,
-                           stdin=subprocess.DEVNULL, check=True, timeout=10)
+        subprocess.run(["ssh-keygen", "-H", "-f", str(target)], capture_output=True, check=True)
         self.assertNotIn("frame-control-d4", target.read_text())
         self.assertTrue(fd.pinned("d4"))
         self.assertTrue(fd.forget_pin("d4"))
@@ -323,6 +296,20 @@ class Pins(Base):
 
 
 class Registry(Base):
+    def test_an_address_added_first_wins_on_its_own_network(self):
+        # The page's "Add 192.168.x.x" offer: the headset is reached over Tailscale, which has
+        # worked here before. The LAN address has to go ahead of it to be used at home.
+        d = self.reg.add_device("frame-4", hosts=["frame.tail1234.ts.net"])
+        self.reg.record_success(d["id"], "frame.tail1234.ts.net", "n-home", 6.0)
+        self.reg.add_address(d["id"], "192.168.1.40", kind="lan", first=True)
+        self.reg.record_success(d["id"], "192.168.1.40", "n-home", 1.0)  # Test now found it
+        addrs = self.reg.get(d["id"])["addresses"]
+        self.assertEqual([a["host"] for a in addrs], ["192.168.1.40", "frame.tail1234.ts.net"])
+        at_home = [a["host"] for a, _ in fd.order_addresses(addrs, "n-home", True)]
+        self.assertEqual(at_home[0], "192.168.1.40")
+        away = [a["host"] for a, _ in fd.order_addresses(addrs, "n-cafe", True)]
+        self.assertEqual(away[0], "frame.tail1234.ts.net")  # elsewhere Tailscale still leads
+
     def test_address_editing(self):
         d = self.reg.add_device("frame-3", hosts=["192.168.1.40"])
         a = self.reg.add_address(d["id"], "frame-3.local", label="mDNS")

tests/test_fdroid_sources.py

@@ -1,5 +1,4 @@
 """Offline authenticated repository fixtures; no tests contact a server."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import json
 import os
@@ -257,36 +256,6 @@ class Repositories(unittest.TestCase):
         self.assertEqual(result['icon'], URL + 'icons/legacy.1.png')
         self.assertEqual(result['images']['screenshots'], [URL + 'org.example.app/fr/sevenInchScreenshots/tablet.png'])
 
-    def test_per_abi_builds_offer_and_download_the_arm64_one(self):
-        import hashlib
-
-        def build(code, name, abis):
-            self.files[name] = name.encode()
-            return {'manifest': {'versionName': '391', 'versionCode': code, 'usesSdk': {'minSdkVersion': 28},
-                                 'nativecode': abis},
-                    'file': {'name': '/' + name, 'sha256': hashlib.sha256(name.encode()).hexdigest(), 'size': code},
-                    'added': 0}
-        # One APK per ABI under different codes (the x86_64 one highest, as F-Droid often does),
-        # plus a universal and an arm64-only build sharing a code.
-        builds = [build(3911, 'app-armeabi-v7a.apk', ['armeabi-v7a']), build(3914, 'app-x86_64.apk', ['x86_64']),
-                  build(3913, 'app-x86.apk', ['x86']),
-                  build(3912, 'app-universal.apk', ['arm64-v8a', 'armeabi-v7a', 'x86_64']),
-                  build(3912, 'app-arm64-v8a.apk', ['arm64-v8a'])]
-        raw = self.root / 'splits.json'
-        raw.write_text(json.dumps({'packages': {'com.futo.platformplayer': {
-            'metadata': {'name': {'en-US': 'Grayjay'}},
-            'versions': {str(i): b for i, b in enumerate(builds)}}}}))
-        source = {'id': 'test', 'url': URL}
-        app = fdroid._reduce(raw, source)['com.futo.platformplayer']
-        self.assertEqual([v['name'] for v in app['versions']], ['/app-arm64-v8a.apk', '/app-universal.apk'])
-        self.assertEqual((app['version_code'], app['abis']), (3912, ['arm64-v8a']))
-        with patch.object(fdroid, 'details', return_value=app):
-            for code in (None, 3912):
-                fdroid.download(source, 'com.futo.platformplayer', version_code=code)
-                self.assertTrue(self.fetch_mock.call_args[0][0].endswith('/app-arm64-v8a.apk'))
-            with self.assertRaises(SourceError):  # the x86_64 build is never offered
-                fdroid.download(source, 'com.futo.platformplayer', version_code=3914)
-
     def test_v2_legacy_screenshot_keys_and_limit(self):
         meta = {'phoneScreenshots': {'fr': [{'name': '/phone/' + str(i) + '.png'} for i in range(8)]},
                 'sevenInchScreenshots': {'en-US': [{'name': '/tablet.png'}]}}

tests/test_frame_android_data.py

@@ -1,4 +1,3 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import json
 import os
@@ -64,7 +63,7 @@ class ObbTests(unittest.TestCase):
                 with self.assertRaisesRegex(android.FrameError, 'start this app'):
                     data.install_obb(PKG, [path])
                 stream.assert_not_called()
-            with patch.object(data.frame_host, 'run_ssh', return_value=subprocess.CompletedProcess([], 1, b'', b'bad hash')):
+            with patch.object(subprocess, 'run', return_value=subprocess.CompletedProcess([], 1, b'', b'bad hash')):
                 with self.assertRaisesRegex(android.FrameError, 'bad hash'):
                     data._stream('command')
 

tests/test_frame_android_library.py

@@ -1,5 +1,4 @@
 """Offline artwork, Steam API and launcher supervision regressions."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import importlib.util
 import json
 import os
@@ -264,14 +263,11 @@ class ArtworkTests(unittest.TestCase):
     def test_steamgriddb_uses_the_bounded_fetch_without_redirects(self):
         import frame_steamgriddb as sgdb
         from apk_sources import _images
-        deadline = time.monotonic() + 5
         with patch.object(_images, 'get', return_value=b'{"success": true, "data": [1]}') as get:
-            self.assertEqual(sgdb._get('/search/x', 'secret', deadline), [1])
+            self.assertEqual(sgdb._get('/search/x', 'secret', time.monotonic() + 5), [1])
         self.assertEqual(get.call_args.kwargs['redirects'], 0)
         self.assertEqual(get.call_args.args[1]['Authorization'], 'Bearer secret')
-        # The caller's deadline is passed on, never extended. (Comparing against a fresh
-        # time.monotonic() flaked on Windows, whose clock ticks coarsely.)
-        self.assertLessEqual(get.call_args.kwargs['deadline'], deadline)
+        self.assertLessEqual(get.call_args.kwargs['deadline'] - time.monotonic(), 5)
 
     def test_supplied_jpeg(self):
         data = (FIXTURES / 'icon.jpg').read_bytes()
@@ -423,19 +419,6 @@ class InstallTests(unittest.TestCase):
         self.assertIn(('remove', '3346865537'), [c.args for c in api.call_args_list])
         self.assertTrue(any(c.args[0] == 'rm -rf Applications/Android/org.test.vr' for c in ssh.call_args_list))
 
-    def test_failed_update_removes_partial_apk_and_keeps_the_app(self):
-        with patch.object(android.frame_artwork, 'prepare', return_value=(self.images, [])), \
-                patch.object(android, 'read_meta', return_value=dict(self.existing)), \
-                patch.object(android, '_copy', side_effect=android.FrameError('copying x.apk to the Frame timed out')), \
-                patch.object(android, 'ssh', return_value='') as ssh, \
-                patch.object(android, 'shortcut_tool') as api:
-            with self.assertRaisesRegex(android.FrameError, 'timed out'):
-                android._install('x.apk', self.info, 'org.test.vr', False, None, None)
-        commands = [c.args[0] for c in ssh.call_args_list]
-        self.assertIn('rm -f Applications/Android/org.test.vr/app.apk.part', commands)
-        self.assertFalse(any(c.startswith('rm -rf') for c in commands))
-        api.assert_not_called()
-
     def test_remove_keeps_data_when_requested_and_survives_steam_failure(self):
         with patch.object(android, '_meta_or_fail', side_effect=lambda pkg: dict(self.existing)), \
                 patch.object(android, 'stop'), \
@@ -499,49 +482,6 @@ class InstallTests(unittest.TestCase):
         self.assertIn('podman stop -t 5 lepton-steamlaunch-2800000001', ssh.call_args.args[0])
 
 
-class CopyAndSshTests(unittest.TestCase):
-    """The commands behind an install fail as FrameErrors with readable words, and a large APK
-    gets the time it needs."""
-
-    def fake(self, stderr, code=1, stdout=b''):
-        """frame_host.run_ssh running a stand-in that writes these bytes, with the caller's options."""
-        script = (f'import sys; sys.stdout.buffer.write({stdout!r}); sys.stderr.buffer.write({stderr!r}); '
-                  f'sys.exit({code})')
-        return lambda argv, **kwargs: subprocess.run([sys.executable, '-c', script], **kwargs)
-
-    def test_large_apk_copy_timeout_grows_with_its_size(self):
-        seen = {}
-        with tempfile.NamedTemporaryFile(suffix='.apk') as f, \
-                patch.object(android.frame_host, 'run_ssh', side_effect=lambda argv, **kw: seen.update(kw)), \
-                patch.object(android.os.path, 'getsize', return_value=2 * 1024 ** 3):
-            android._copy(f.name, 'Applications/Android/x/app.apk.part')
-        # 2 GB at the slowest rate allowed: 4096 s, not the old fixed 600 (300 MB at 4 Mbit/s).
-        self.assertGreaterEqual(seen['timeout'], 2 * 1024 ** 3 / (512 * 1024))
-        with tempfile.NamedTemporaryFile(suffix='.apk') as f, \
-                patch.object(android.frame_host, 'run_ssh', side_effect=lambda argv, **kw: seen.update(kw)):
-            android._copy(f.name, 'x/launch.sh', timeout=120)
-        self.assertEqual(seen['timeout'], 120)  # a small file keeps the least time given
-
-    def test_copy_failure_in_another_encoding_is_a_frame_error(self):
-        # A message from a Windows code page, or a file name, isn't UTF-8.
-        with tempfile.NamedTemporaryFile(suffix='.apk') as f, \
-                patch.object(android.shutil, 'which', return_value=None), \
-                patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'scp: Verbindung \x81ber\xff\n')):
-            with self.assertRaisesRegex(android.FrameError, r'\Acopying .* to the Frame failed: scp: Verbindung'):
-                android._copy(f.name, 'x/app.apk.part')
-
-    def test_ssh_failure_messages_are_text(self):
-        with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'mv: \xff cannot move\n')):
-            with self.assertRaisesRegex(android.FrameError, r'\Amv: .* cannot move\Z'):
-                android.ssh('mv a b')
-        with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'cat: write error: No space left on device\n')):
-            with self.assertRaises(android.FrameError) as caught:
-                android.ssh('cat > x', input=b'\x89PNG')  # bytes in, bytes out
-        self.assertEqual(str(caught.exception), 'cat: write error: No space left on device')
-        with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'', code=0, stdout=b'ok \xff\n')):
-            self.assertEqual(android.ssh('echo ok').strip(), 'ok �')
-
-
 class SteamAPITests(unittest.TestCase):
     def test_artwork_api_enums_and_safe_serialization(self):
         with patch.object(shortcuts, 'evaluate', return_value={'warnings': []}) as evaluate:

tests/test_frame_apk.py

@@ -11,7 +11,82 @@ import zipfile
 
 sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'ui'))
 import frame_apk  # noqa: E402
-from apk_fixtures import apk, manifest, pool, resources  # noqa: E402,F401
+
+
+def pool(strings, utf8=False):
+    """A ResStringPool chunk."""
+    data, offsets = b'', []
+    for s in strings:
+        offsets.append(len(data))
+        if utf8:
+            b = s.encode()
+            data += bytes([len(s), len(b)]) + b + b'\0'
+        else:
+            data += struct.pack('<H', len(s)) + s.encode('utf-16-le') + b'\0\0'
+    data += b'\0' * (-len(data) % 4)
+    start = 28 + 4 * len(strings)
+    body = struct.pack(f'<{len(strings)}I', *offsets) + data
+    return struct.pack('<HHIIIIII', 1, 28, 28 + len(body), len(strings), 0, 0x100 if utf8 else 0, start, 0) + body
+
+
+def manifest(package, label_ref, version_ref, min_sdk, package_raw=True, foreign_label=False):
+    """<manifest package versionName><uses-sdk minSdkVersion/><application label icon/></manifest>.
+
+    package_raw=False drops the package's raw string (as some repackers do);
+    foreign_label adds a non-android `label` attribute after android:label.
+    """
+    strings = ['label', 'icon', 'versionName', 'minSdkVersion', 'package', 'manifest', 'uses-sdk',
+               'application', package, 'junk', 'label', 'versionCode']  # the second 'label' has no android id
+    resmap = struct.pack('<4I', 0x01010001, 0x01010002, 0x0101021c, 0x0101020c)
+    resmap = struct.pack('<HHI', 0x0180, 8, 8 + len(resmap)) + resmap
+
+    def element(name, attrs):
+        body = struct.pack('<IIHHHHHH', 0xffffffff, name, 20, 20, len(attrs), 0, 0, 0)
+        for aname, raw, dtype, value in attrs:
+            body += struct.pack('<IIIHBBI', 0xffffffff, aname, raw, 8, 0, dtype, value)
+        return struct.pack('<HHIII', 0x0102, 16, 16 + len(body), 1, 0xffffffff) + body
+
+    none = 0xffffffff
+    chunks = (pool(strings) + resmap
+              + element(5, [(4, 8 if package_raw else none, frame_apk.T_STRING, 8),
+                            (2, none, frame_apk.T_REF, version_ref),
+                            (11, none, frame_apk.T_INT_DEC, 210)])
+              + element(6, [(3, none, frame_apk.T_INT_DEC, min_sdk)])
+              + element(7, [(0, none, frame_apk.T_REF, label_ref), (1, none, frame_apk.T_REF, 0x7f020000)]
+                        + ([(10, 9, frame_apk.T_STRING, 9)] if foreign_label else [])))
+    return struct.pack('<HHI', 3, 8, 8 + len(chunks)) + chunks
+
+
+def resources(values):
+    """resources.arsc with package 0x7f; values: {(type id, entry, language, density): global string index}."""
+    strings = ['French label', 'App label', '2.1', 'res/icon_lo.png', 'res/icon_hi.png', 'res/icon.xml']
+    pkg_body = b''
+    for (tid, lang, density), entries in values.items():
+        cfg = struct.pack('<I4x2s4xH', 64, lang.encode().ljust(2, b'\0'), density).ljust(64, b'\0')
+        count = max(entries) + 1
+        offsets, data = [], b''
+        for i in range(count):
+            if i in entries:
+                offsets.append(len(data))
+                data += struct.pack('<HHI', 8, 0, 0) + struct.pack('<HBBI', 8, 0, frame_apk.T_STRING, entries[i])
+            else:
+                offsets.append(0xffffffff)
+        header = 20 + 64
+        estart = header + 4 * count
+        body = struct.pack(f'<{count}I', *offsets) + data
+        pkg_body += struct.pack('<HHIBBHII', 0x0201, header, header + len(body), tid, 0, 0, count, estart) + cfg + body
+    pkg_header = struct.pack('<HHII', 0x0200, 288, 288 + len(pkg_body), 0x7f).ljust(288, b'\0')
+    pkg = pkg_header + pkg_body
+    table = pool(strings, utf8=True) + pkg
+    return struct.pack('<HHII', 2, 12, 12 + len(table), 1) + table
+
+
+def apk(files):
+    buf = io.BytesIO()
+    with zipfile.ZipFile(buf, 'w') as z:
+        for name, data in files.items():
+            z.writestr(name, data)
+    return buf.getvalue()
 
 
 class ApkInfo(unittest.TestCase):
@@ -93,20 +168,6 @@ class ApkInfo(unittest.TestCase):
             frame_apk.MAX_MANIFEST = limit
         self.assertLess(peak, 8 * 1024**2)
 
-    def test_damaged_download_is_an_apk_error(self):
-        # Corrupt deflate data used to escape as zlib.error, which the upload path didn't catch
-        # (a 500, and no install report) and frame_android.install reported as 'other'.
-        buf = io.BytesIO()
-        with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as z:
-            z.writestr('AndroidManifest.xml', manifest('com.example.bad', 0x7f010000, 0x7f010001, 21) * 20)
-        data = bytearray(buf.getvalue())
-        at = data.index(b'PK\x03\x04')
-        start = at + 30 + sum(struct.unpack_from('<HH', data, at + 26))  # past the name and extra field
-        for i in range(start, start + 40):
-            data[i] ^= 0x5a
-        with self.assertRaisesRegex(frame_apk.ApkError, 'could not read the APK manifest'):
-            self.read(bytes(data))
-
     def test_refuses_compression_android_cant_read(self):
         for method in (zipfile.ZIP_BZIP2, zipfile.ZIP_LZMA):
             buf = io.BytesIO()

tests/test_frame_apk_versions.py

@@ -184,35 +184,6 @@ class VersionsTest(unittest.TestCase):
         info['abis'] = ['armeabi-v7a']
         self.assertIn('no arm64-v8a build', versions.describe(info))
 
-    def test_wrong_abi_error_says_which_file_to_get(self):
-        import frame_telemetry
-        for abis in (['armeabi-v7a'], ['x86_64']):  # the two per-ABI Grayjay files users tried
-            info = {'label': 'Grayjay', 'min_sdk': 28, 'abis': abis}
-            with self.assertRaises(frame_android.FrameError) as error:
-                frame_android.check_installable(info)
-            message = str(error.exception)
-            self.assertIn('no arm64-v8a build (%s)' % abis[0], message)
-            self.assertIn('download the APK marked arm64-v8a', message)
-            self.assertEqual(frame_telemetry.categorize(message)[0], 'apk_wrong_abi')
-        frame_android.check_installable({'label': 'Universal', 'min_sdk': 28,
-                                         'abis': ['arm64-v8a', 'armeabi-v7a', 'x86', 'x86_64']})
-
-    def test_wrong_file_reports_do_not_rate_the_app(self):
-        reports = frame_catalog.reports
-        wrong_file = {'package': 'org.example.app', 'version': '391', 'result': 'install_failed',
-                      'notes': 'Example has no arm64-v8a build (x86_64); Lepton is 64-bit ARM only',
-                      'date': '2026-10-01T10:00:00'}
-        self.assertIsNone(reports.verdict([wrong_file]))
-        app = frame_catalog.catalog_build.finalize({'pr': 'likely', 'pw': ['No known blockers']}, [wrong_file])
-        self.assertEqual((app['r'], app['t']), ('likely', False))  # the prediction stands
-        # A real installer failure, a crash or a person's rating still counts.
-        installer = dict(wrong_file, notes='INSTALL_FAILED_INVALID_APK')
-        self.assertEqual(reports.verdict([installer])[0], 'no')
-        crash = dict(wrong_file, result='crashes', notes=None, date='2026-10-02')
-        self.assertEqual(reports.verdict([wrong_file, crash])[0], 'no')
-        rated = dict(wrong_file, rating='works', date='2026-10-03')
-        self.assertEqual(reports.verdict([wrong_file, rated])[0], 'works')
-
     def test_install_resolves_index_hash(self):
         versions.alternatives('org.example.app')
         with patch.object(versions, 'alternatives', side_effect=AssertionError('recomputed')), \

tests/test_frame_apk_vr.py

@@ -1,5 +1,4 @@
 """Local-only VR manifest, raw ZIP and independent signature checks."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import io
 import os
 from pathlib import Path
@@ -16,7 +15,7 @@ import frame_apk
 import frame_apk_vr as vr
 import frame_apk_sign as signing
 import frame_android
-from apk_fixtures import pool
+from test_frame_apk import pool
 
 
 DEFAULT = 'android.intent.category.DEFAULT'
@@ -256,10 +255,6 @@ class VRTests(unittest.TestCase):
             self.assertEqual(set(add), set(frame_android.XR_COMPAT_FILES))
             self.assertIn(b'XR_APILAYER_FRAME_compat', add['assets/openxr/1/api_layers/implicit.d/XrApiLayer_FRAME_compat.json'])
             self.assertTrue(add['lib/arm64-v8a/libXrApiLayer_FRAME_compat.so'].startswith(b'\x7fELF'))
-            # The library verified on the headset (its SHA-256 is in the layer's README).
-            import hashlib
-            digest = hashlib.sha256(add['lib/arm64-v8a/libXrApiLayer_FRAME_compat.so']).hexdigest()
-            self.assertIn(digest, (Path(frame_android.XR_COMPAT) / 'README.md').read_text())
             with zipfile.ZipFile(apk, 'a') as z:  # already injected: nothing more to add
                 z.writestr('lib/arm64-v8a/libXrApiLayer_FRAME_compat.so', b'')
             self.assertEqual(frame_android.xr_compat_files(str(apk)), {})
@@ -274,82 +269,8 @@ class VRTests(unittest.TestCase):
             with zipfile.ZipFile(apk, 'w') as z:
                 z.writestr('lib/arm64-v8a/libopenxr_loader.so', b'')
             with patch.object(frame_android, 'XR_COMPAT', d):
-                with self.assertRaisesRegex(frame_android.LayerMissing, 'build.sh'):
+                with self.assertRaisesRegex(frame_android.FrameError, 'build.sh'):
                     frame_android.xr_compat_files(str(apk))
-            # Present but corrupt, or empty, counts as missing too.
-            for rel in frame_android.XR_COMPAT_FILES.values():
-                os.makedirs(os.path.dirname(os.path.join(d, rel)) or d, exist_ok=True)
-                with open(os.path.join(d, rel), 'wb') as f:
-                    f.write(b'\x1f\x8b not really gzip')
-            with patch.object(frame_android, 'XR_COMPAT', d):
-                with self.assertRaises(frame_android.LayerMissing):
-                    frame_android.xr_compat_files(str(apk))
-            for rel in frame_android.XR_COMPAT_FILES.values():
-                os.makedirs(os.path.dirname(os.path.join(d, rel)) or d, exist_ok=True)
-                open(os.path.join(d, rel), 'wb').close()
-            with patch.object(frame_android, 'XR_COMPAT', d):
-                with self.assertRaises(frame_android.LayerMissing):
-                    frame_android.xr_compat_files(str(apk))
-
-    def test_layer_ships_in_packaged_builds(self):
-        """The arm64 library is in the repo, copied by electron-builder, and checked after packing."""
-        import fnmatch, json
-        root = Path(__file__).resolve().parents[1]
-        for rel in frame_android.XR_COMPAT_FILES.values():
-            self.assertGreater((root / 'frame/openxr-compat' / rel).stat().st_size, 0, rel)
-        # No bare arm64 ELF ships: electron-builder's 7-Zip gives those an ARM64 filter the
-        # Windows installer can't extract, so the installed app silently lacked the library.
-        for f in (root / 'frame/openxr-compat/prebuilt').rglob('*'):
-            if f.is_file():
-                self.assertNotEqual(f.read_bytes()[:4], b'\x7fELF', f)
-        build = json.loads((root / 'app/package.json').read_text())['build']
-        self.assertEqual(build.get('afterPack'), 'build/check-resources.js')
-        entry = next(e for e in build['extraResources'] if e['from'] == '../frame/openxr-compat')
-        self.assertEqual(entry['to'], 'frame/openxr-compat')
-        check = (root / 'app/build/check-resources.js').read_text()
-        for rel in frame_android.XR_COMPAT_FILES.values():
-            self.assertTrue(any(fnmatch.fnmatch(rel, f.replace('**/', '*/')) for f in entry['filter']), rel)
-            self.assertFalse(any(f.endswith('.so') for f in entry['filter']))
-            self.assertIn('frame/openxr-compat/' + rel, check)
-
-    def test_install_goes_ahead_without_a_missing_layer(self):
-        """A copy of Frame Control without the layer installs VR apps anyway and says so."""
-        base = {'package': 'org.test.vr', 'label': 'VR', 'abis': [], 'min_sdk': None, 'vr_issues': [],
-                'vr': True, 'vr_activity': True, 'launchable': True, 'repairable': False}
-        seen = []
-        missing = frame_android.LayerMissing(frame_android.LAYER_MISSING)
-        with patch.object(frame_android, 'apk_info', side_effect=lambda p: dict(base)), \
-                patch.object(frame_android, 'xr_compat_files', side_effect=missing), \
-                patch.object(frame_android, 'patch') as repair, \
-                patch.object(frame_android, '_install', return_value={'package': 'org.test.vr'}) as install, \
-                patch.object(frame_android, 'install_hooks', [lambda *a: seen.append(a)]):
-            frame_android.install('game.apk')
-            repair.assert_not_called()  # nothing to add and nothing to repair: the APK goes as is
-            info = install.call_args.args[1]
-            self.assertTrue(info['xr_layer_missing'])
-            self.assertEqual(info['vr_issues'], [frame_android.LAYER_MISSING_NOTE])
-            self.assertIsNone(seen[-1][2])  # reported as a working install
-            # Asked for explicitly, a missing layer is still an error.
-            with self.assertRaises(frame_android.LayerMissing):
-                frame_android.install('game.apk', xr_compat=True)
-            self.assertIsInstance(seen[-1][2], frame_android.LayerMissing)
-
-    def test_patch_failures_are_named_and_every_failure_is_reported(self):
-        base = {'package': 'org.test.vr', 'label': 'VR', 'abis': [], 'min_sdk': None,
-                'vr': True, 'vr_activity': True, 'launchable': True, 'repairable': False}
-        seen = []
-        with patch.object(frame_android, 'apk_info', side_effect=lambda p: dict(base)), \
-                patch.object(frame_android, 'xr_compat_files', return_value={'x': b'1'}), \
-                patch.object(frame_android, 'patch', side_effect=frame_android.FrameError('ZIP64 APKs are unsupported')), \
-                patch.object(frame_android, 'install_hooks', [lambda *a: seen.append(a)]):
-            with self.assertRaisesRegex(frame_android.FrameError, 'could not prepare the APK for the Frame: ZIP64'):
-                frame_android.install('game.apk')
-        with patch.object(frame_android, 'apk_info', side_effect=lambda p: dict(base, vr=False)), \
-                patch.object(frame_android, '_install', side_effect=FileNotFoundError(2, 'No such file or directory', 'ssh')), \
-                patch.object(frame_android, 'install_hooks', [lambda *a: seen.append(a)]):
-            with self.assertRaises(FileNotFoundError):
-                frame_android.install('game.apk')
-        self.assertIsInstance(seen[-1][2], FileNotFoundError)  # not only FrameErrors reach telemetry
 
     def test_patch_rejects_corrupt_manifest_cleanly(self):
         with patch.object(frame_android, 'apk_info', side_effect=struct.error('bad')):

tests/test_frame_host.py

@@ -1,87 +0,0 @@
-"""Captured OpenSSH output keeps working on Windows and POSIX hosts."""
-import sandbox  # noqa: F401
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "ui"))
-import frame_host
-
-
-class CapturedSSH(unittest.TestCase):
-    def run_command(self, source, **kwargs):
-        with mock.patch.object(frame_host, "WINDOWS", True):
-            return frame_host.run_ssh([sys.executable, "-c", source], timeout=5, **kwargs)
-
-    def test_binary_output_and_input(self):
-        result = self.run_command("import sys; sys.stdout.buffer.write(sys.stdin.buffer.read()); "
-                                  "sys.stderr.buffer.write(b'error\\r\\n')",
-                                  capture_output=True, input=b"data\x00\xff")
-        self.assertEqual(result.stdout, b"data\x00\xff")
-        self.assertEqual(result.stderr, b"error\r\n")
-
-    def test_text_output_normalizes_newlines(self):
-        result = self.run_command("import sys; sys.stdout.write(sys.stdin.read()); "
-                                  "sys.stderr.buffer.write(b'first\\r\\nsecond\\rthird\\n')",
-                                  capture_output=True, input="hello\n", text=True)
-        self.assertEqual(result.stdout, "hello\n")
-        self.assertEqual(result.stderr, "first\nsecond\nthird\n")
-
-    def test_explicit_encoding_and_errors(self):
-        result = self.run_command("import sys; sys.stderr.buffer.write(b'\\xe9\\xff')",
-                                  capture_output=True, encoding="ascii", errors="replace")
-        self.assertEqual(result.stderr, "\ufffd\ufffd")
-
-    def test_check_preserves_error_output(self):
-        with self.assertRaises(subprocess.CalledProcessError) as caught:
-            self.run_command("import sys; print('out'); print('err', file=sys.stderr); sys.exit(7)",
-                             capture_output=True, text=True, check=True)
-        self.assertEqual(caught.exception.returncode, 7)
-        self.assertEqual(caught.exception.stdout, "out\n")
-        self.assertEqual(caught.exception.stderr, "err\n")
-
-    def test_timeout_preserves_partial_stderr(self):
-        with self.assertRaises(subprocess.TimeoutExpired) as caught:
-            with mock.patch.object(frame_host, "WINDOWS", True):
-                frame_host.run_ssh([sys.executable, "-c", "import sys, time; "
-                                    "sys.stderr.write('waiting'); sys.stderr.flush(); time.sleep(10)"],
-                                   capture_output=True, text=True, timeout=1)
-        self.assertEqual(caught.exception.stderr, b"waiting")
-
-    def test_streamed_stdout_is_kept_separate(self):
-        with tempfile.TemporaryFile() as output:
-            result = self.run_command("import sys; sys.stdout.buffer.write(b'file'); "
-                                      "sys.stderr.buffer.write(b'error')",
-                                      stdout=output, stderr=subprocess.PIPE)
-            output.seek(0)
-            self.assertEqual(output.read(), b"file")
-        self.assertIsNone(result.stdout)
-        self.assertEqual(result.stderr, b"error")
-
-    def test_uncaptured_windows_call_is_unchanged(self):
-        with mock.patch.object(frame_host, "WINDOWS", True), mock.patch.object(subprocess, "run") as run:
-            frame_host.run_ssh(["ssh", "-V"], stderr=subprocess.DEVNULL, timeout=5)
-        run.assert_called_once_with(["ssh", "-V"], stderr=subprocess.DEVNULL, timeout=5)
-
-    def test_posix_call_is_unchanged(self):
-        with mock.patch.object(frame_host, "WINDOWS", False), mock.patch.object(subprocess, "run") as run:
-            frame_host.run_ssh(["ssh", "-V"], capture_output=True, check=True, timeout=5)
-        run.assert_called_once_with(["ssh", "-V"], capture_output=True, check=True, timeout=5)
-
-    def test_capture_rejects_explicit_streams(self):
-        for stream in ("stdout", "stderr"):
-            with self.subTest(stream=stream), self.assertRaises(ValueError):
-                self.run_command("", capture_output=True, **{stream: subprocess.DEVNULL})
-
-    @unittest.skipUnless(shutil.which("ssh"), "needs OpenSSH")
-    def test_real_ssh_failure_returns_stderr_without_hanging(self):
-        result = frame_host.run_ssh(["ssh", "-F", os.devnull, "-o", "BatchMode=yes",
-                                    "-o", "ConnectTimeout=2", "frame-control-test.invalid", "true"],
-                                   capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=5)
-        self.assertEqual(result.returncode, 255)
-        self.assertIn("Could not resolve hostname", result.stderr)

tests/test_input.py

@@ -6,7 +6,6 @@ identity line, then starts TLS as the *client*.
 
 Run: python3 -m unittest discover -s tests
 """
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import os
 import shutil

tests/test_library_entrypoints.py

@@ -1,5 +1,4 @@
 """Every public sideload entry point reaches the mandatory five-slot writer."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import contextlib
 import io
 import json

tests/test_link.py

@@ -6,10 +6,8 @@ Run: python3 -m unittest discover -s tests
 """
 import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import http.client
-import io
 import json
 import os
-import shlex
 import shutil
 import socket
 import subprocess
@@ -46,17 +44,6 @@ def explain(msg):
     return None
 
 
-class FailureDetail(unittest.TestCase):
-    def test_an_address_that_failed_says_why_in_a_few_words(self):
-        # #87: the banner put each address's detail after the headline, and with the whole
-        # message as the detail it said everything twice ("...may be answering here..").
-        self.assertEqual(fl.failure_detail({"message": "A long sentence.", "short": "SSH identity changed"}),
-                         "SSH identity changed")
-        self.assertEqual(fl.failure_detail({"message": "The connection to the Frame dropped. Try again."}),
-                         "The connection to the Frame dropped. Try again.")
-        self.assertEqual(fl.failure_detail(None), "SSH failed")
-
-
 class Probe(unittest.TestCase):
     def test_answers_refusals_and_unknown_names(self):
         with socket.socket() as srv:
@@ -211,8 +198,7 @@ class Connecting(unittest.TestCase):
         rows = {p["host"]: p for p in s["probes"]}
         self.assertEqual(rows["nothing.invalid"]["state"], "unresolved")
         self.assertEqual(rows["::1"]["state"], "sshfailed")
-        # Its row says why in a few words: the banner's headline already has the whole sentence (#87).
-        self.assertEqual(rows["::1"]["detail"], "SSH identity changed")
+        self.assertIn("different headset", rows["::1"]["detail"])
         # Every ssh command was pointed at the winner, with the host key pinned per device.
         alias, opts = self.routes[-1]
         self.assertEqual(alias, "frame-t")
@@ -221,10 +207,9 @@ class Connecting(unittest.TestCase):
         self.assertIn(f"Port={self.port}", opts)
         master = [c for c in self.calls() if "ControlMaster=yes" in c][-1]
         self.assertIn("StrictHostKeyChecking=accept-new", master)  # first connection: nothing pinned yet
-        self.assertNotIn("StrictHostKeyChecking=yes", master)
-        # This stand-in ssh saved no key, so commands may still save the first one (accept-new);
-        # test_a_first_connection_pins_and_then_checks_strictly has real pins.
-        self.assertIn("StrictHostKeyChecking=accept-new", opts)
+        # ssh takes an option's first value: accept-new must come before the commands' own "yes".
+        self.assertLess(master.index("StrictHostKeyChecking=accept-new"), master.index("StrictHostKeyChecking=yes"))
+        self.assertIn("StrictHostKeyChecking=yes", opts)  # every other command checks the pinned key
         self.assertTrue(fd.known_hosts(d["id"]).parent.is_dir())  # where ssh saves the key it accepts
         # It learned: 127.0.0.1 works on this network.
         learned = {a["host"]: a for a in self.reg.get(d["id"])["addresses"]}
@@ -271,9 +256,6 @@ class Connecting(unittest.TestCase):
         s = self.link.snapshot()
         self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "login"))
         self.assertIn("SSH key", s["error"]["message"])
-        self.assertEqual(s["error"]["auth"], "denied")  # the page offers Set Up Connection
-        self.assertEqual(s["error"]["short"], "This computer's key refused")  # the header pill's words (#87)
-        self.assertEqual(s["probes"][0]["detail"], "This computer's key refused")
 
     def test_pinned_identity_is_checked_strictly(self):
         d = self.device("localhost")
@@ -283,428 +265,6 @@ class Connecting(unittest.TestCase):
         master = [c for c in self.calls() if "ControlMaster=yes" in c][-1]
         self.assertIn("StrictHostKeyChecking=yes", master)
 
-    def pins(self):
-        """The stand-in ssh checks host keys as OpenSSH does (tests/fakessh/ssh)."""
-        p = mock.patch.dict(os.environ, {"FAKESSH_PINS": "1"})
-        p.start()
-        self.addCleanup(p.stop)
-
-    def command(self, device, host="127.0.0.1"):
-        """One ssh command as the server runs it, with the route the connector applied."""
-        return subprocess.run(["ssh", *self.link.host_opts(device, host), device["alias"], "true"],
-                              capture_output=True, text=True, timeout=20)
-
-    def test_a_first_connection_pins_and_then_checks_strictly(self):
-        # 0.4.2 on Windows: "No ED25519 host key is known for frame-control-<id> and you have
-        # requested strict checking." Every command said "yes" before anything was saved, so one
-        # that ran before the connector's handshake saved the key (or without it) failed.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        r = self.command(d)
-        self.assertEqual(r.returncode, 0, r.stderr)  # the first contact saves the key...
-        self.assertIn("Permanently added", r.stderr)
-        self.assertTrue(fd.pinned(d["id"]))
-        self.assertIn("StrictHostKeyChecking=yes", self.link.host_opts(d, "127.0.0.1"))  # ...then it's checked
-        self.assertEqual(self.reg.get(d["id"])["identity"], [k[1] for k in fd.pinned_keys(d["id"])])  # and recorded
-        # The connector's first handshake, for another new headset.
-        self.reg.remove_device(d["id"])
-        d = self.device("localhost")
-        self.link.connect(["start"])
-        s = self.link.snapshot()
-        self.assertEqual(s["phase"], "connected", s["error"])
-        self.assertTrue(fd.pinned(d["id"]))
-        self.assertTrue(self.reg.get(d["id"])["identity"])
-        alias, opts = self.routes[-1]
-        self.assertIn("StrictHostKeyChecking=yes", opts)  # every command after it checks strictly
-        self.assertNotIn("StrictHostKeyChecking=accept-new", opts)
-
-    def lose_pin(self, device_id, how):
-        f = fd.known_hosts(device_id)
-        if how == "deleted":
-            f.unlink()
-        elif how == "empty":
-            f.write_text("")
-        elif how == "unreadable":
-            f.chmod(0)
-            self.addCleanup(lambda: f.exists() and f.chmod(0o600))
-        elif how == "another alias":
-            f.write_text(f.read_text().replace(f"frame-control-{device_id}", "frame-control-someone-else"))
-        elif how == "not utf-8":
-            f.write_bytes(b"\xff\xfe" + f.read_bytes())
-
-    def test_a_lost_or_unusable_pin_fails_closed(self):
-        # Review pr85-review-r1: accept-new can't tell a new headset from one whose saved key
-        # went missing; real OpenSSH then trusted a replacement key. Once a headset had an
-        # identity, nothing is trusted again until the person checks it.
-        self.pins()
-        cases = ["deleted", "empty", "another alias", "not utf-8"]
-        if os.name == "posix" and os.geteuid() != 0:
-            cases.append("unreadable")  # root reads anything
-        for n, how in enumerate(cases):
-            with self.subTest(how=how):
-                self.hosts({"localhost": "ok"})
-                d = self.reg.add_device(f"frame-l{n}", port=self.port, hosts=[])
-                self.reg.add_address(d["id"], "localhost", kind="lan")
-                self.link.override = None
-                self.reg.set_active(d["id"])
-                self.link.connect(["switch"])
-                self.assertEqual(self.link.snapshot()["phase"], "connected")
-                self.link.close_master()
-                d = self.reg.get(d["id"])
-                self.lose_pin(d["id"], how)
-                self.hosts({"localhost": "wrong"})  # another device, or a reinstalled headset
-                r = self.command(d)
-                self.assertEqual(r.returncode, 255, r.stderr)
-                self.assertIn("Host key verification failed", r.stderr)
-                self.assertNotIn("Permanently added", r.stderr)
-                self.link.connect(["dropped"])
-                s = self.link.snapshot()
-                self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "identity"))
-                self.assertEqual(s["error"]["hostkey"]["state"], "missing")
-                self.assertIn("missing or can't be read", s["error"]["message"])
-                self.assertEqual(s["error"]["short"], "Saved SSH identity missing")
-                view = next(x for x in fl.devices_view(self.link)["devices"] if x["id"] == d["id"])
-                self.assertTrue(view["identity_lost"])
-                scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"]
-                self.assertFalse(scan["matches"] or scan["recorded_match"])  # not the key it had
-                self.hosts({"localhost": "ok"})
-                scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"]
-                self.assertTrue(scan["recorded_match"])  # its own key, as recorded
-                self.assertFalse(scan["matches"])  # but not usable from the file: trusting restores it
-                fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"],
-                                              "fingerprint": scan["fingerprint"]}, None)
-                self.link.connect(["switch"])
-                self.assertEqual(self.link.snapshot()["phase"], "connected", self.link.snapshot()["error"])
-                self.link.close_master()
-
-    def test_a_key_check_only_reads_the_key(self):
-        # Review pr85-review-r1: with ForwardAgent yes in ~/.ssh/config, a device that accepts
-        # "none" got the agent and ran a command before anyone trusted it.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "evil"})
-        os.environ["FAKESSH_CONFIG"] = json.dumps({"forwardagent": "yes", "remotecommand": "touch /tmp/x",
-                                                   "permitlocalcommand": "yes", "requesttty": "force"})
-        self.addCleanup(os.environ.pop, "FAKESSH_CONFIG", None)
-        for proxied in (False, True):
-            route = ("jump", "me@jumpy:2222") if proxied else (None, None)
-            with self.subTest(proxied=proxied), mock.patch.object(fl, "proxy_route", return_value=route):
-                t0 = time.monotonic()
-                scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"]
-                self.assertLess(time.monotonic() - t0, 10)  # stopped once it had the key, not left open
-                self.assertTrue(scan["fingerprint"].startswith("SHA256:"))
-                self.assertEqual([p.name for p in self.dir.iterdir() if p.name.startswith("evil-")], [])
-                call = [c for c in self.calls() if "PreferredAuthentications=none" in c][-1]
-                self.assertEqual(call[call.index("-F") + 1], "none")  # never ~/.ssh/config for the device
-                self.assertIn("-N", call)
-                hop = [c for c in call if c.startswith("ProxyCommand=")]
-                if proxied:
-                    # Review pr85-review-r2: ProxyJump's own ssh inherits the config (ForwardAgent,
-                    # LocalCommand); the scan builds the jump host's ssh itself, hardened.
-                    self.assertEqual(len(hop), 1)
-                    words = shlex.split(hop[0][len("ProxyCommand="):])
-                    self.assertEqual(words[-7:], ["-l", "me", "-p", "2222", "-W", "[%h]:%p", "jumpy"])
-                    for o in fl.Link.HOP_OPTS:
-                        self.assertIn(o, words)
-                    self.assertLess(call.index(hop[0]), call.index("HostKeyAlias=frame-control-" + d["id"]))
-                else:
-                    self.assertEqual(hop, [])
-                for o in ("ForwardAgent=no", "IdentityAgent=none", "ClearAllForwardings=yes", "RemoteCommand=none",
-                          "PermitLocalCommand=no", "RequestTTY=no", "PubkeyAuthentication=no"):
-                    self.assertIn(o, call)
-                self.assertLess(call.index("StrictHostKeyChecking=accept-new"), call.index("HostKeyAlias=frame-control-"
-                                                                                          + d["id"]))
-        self.assertFalse(fd.pinned(d["id"]))
-        self.assertEqual(sorted(p.name for p in fd.known_hosts(d["id"]).parent.iterdir()), [])  # no scan files
-
-    @unittest.skipIf(os.name != "posix", "the stand-in ssh runs ProxyCommand with /bin/sh")
-    def test_the_jump_hosts_command_line_is_quoted_whatever_the_names(self):
-        # Review pr85-review-r3: the hop's words went into the ProxyCommand line unquoted, so an
-        # ssh at /tmp/x/bin$(:>INJECTED)/ssh ran shell code; and an IPv6 jump host broke.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        for n, name in enumerate(["with space", "bin$(touch INJECTED-0)", "back`touch INJECTED-1`tick",
-                                  "quote'it\"s", "per%cent %h %%", "semi;touch INJECTED-2"]):
-            with self.subTest(name=name):
-                bindir = self.dir / f"b{n}" / name
-                bindir.mkdir(parents=True)
-                (bindir / "ssh").symlink_to(FAKESSH / "ssh")
-                for spec, at in (("me@jumpy:2222", "jumpy"), ("[::1]:2200", "::1")):
-                    before = len(self.calls())
-                    with mock.patch.dict(os.environ, {"PATH": f"{bindir}{os.pathsep}{os.environ['PATH']}"}), \
-                            mock.patch.object(fl, "proxy_route", return_value=("jump", spec)):
-                        scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"]
-                    self.assertTrue(scan["fingerprint"].startswith("SHA256:"))
-                    hops = [c for c in self.calls()[before:] if "-W" in c]
-                    self.assertEqual(len(hops), 1, self.calls()[before:])
-                    self.assertEqual(hops[0][-1], at)  # the jump host, bare
-                    self.assertEqual(hops[0][hops[0].index("-W") + 1], "[localhost]:%d" % self.port)
-                    outer = [c for c in self.calls()[before:] if "PreferredAuthentications=none" in c][-1]
-                    line = next(c for c in outer if c.startswith("ProxyCommand="))
-                    self.assertTrue(line[len("ProxyCommand="):].startswith(shlex.quote(str(bindir / "ssh")
-                                                                                       .replace("%", "%%"))))
-                self.assertEqual([p.name for p in self.dir.rglob("INJECTED*")], [])
-                self.assertFalse(list(Path.cwd().glob("INJECTED*")))
-
-    def test_a_key_check_refuses_routes_it_cant_harden(self):
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        before = len(self.calls())
-        for route in (("command", "nc %h %p"), ("jump", "a,b"), ("jump", "-oProxyCommand=x"), ("jump", "ssh://a"),
-                      ("jump", "a b"), ("jump", "a%h"), ("jump", "jumpy:99999")):
-            with self.subTest(route=route), mock.patch.object(fl, "proxy_route", return_value=route):
-                with self.assertRaises(fd.DeviceError) as caught:
-                    fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)
-                self.assertIn("can't make safe", str(caught.exception))
-        self.assertFalse(any("PreferredAuthentications=none" in c for c in self.calls()[before:]))
-
-    def test_a_key_read_before_the_address_or_port_changed_isnt_trusted(self):
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        for change in ({"action": "update", "id": d["id"], "port": self.port + 1},
-                       {"action": "address-remove", "id": d["id"], "host": "localhost"}):
-            with self.subTest(change=change["action"]):
-                scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"]
-                fl.devices_action(self.link, change, None)
-                with self.assertRaises(fd.DeviceError):
-                    fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"],
-                                                  "fingerprint": scan["fingerprint"]}, None)
-                self.assertFalse(fd.pinned(d["id"]))
-                self.reg.update_device(d["id"], port=self.port)
-                if not self.reg.get(d["id"])["addresses"]:
-                    self.reg.add_address(d["id"], "localhost", kind="lan")
-
-    def test_terminals_judge_identity_by_the_registry_not_a_frozen_route(self):
-        # Review pr85-review-r2: named_route used the device as routed (before its first key was
-        # recorded), so a Terminal window fell back to accept-new once the pin was deleted.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        self.link.connect(["start"])
-        self.assertEqual(self.link.snapshot()["phase"], "connected")
-        self.assertFalse(self.link.routed_device.get("identity"))  # the frozen copy knows nothing of it
-        fd.known_hosts(d["id"]).unlink()
-        alias, opts = self.link.named_route()
-        self.assertIn("StrictHostKeyChecking=yes", opts)
-        self.assertNotIn("StrictHostKeyChecking=accept-new", opts)
-        self.hosts({"localhost": "wrong"})
-        r = subprocess.run(["ssh", *opts, alias, "true"], capture_output=True, text=True, timeout=20)
-        self.assertEqual(r.returncode, 255, r.stderr)
-        self.assertFalse(fd.pinned(d["id"]))
-
-    def test_a_key_saved_before_a_refused_login_is_kept_and_checked(self):
-        # Review pr85-review-r2: ssh saves the key during the key exchange; if the login is then
-        # refused, it was neither recorded nor protected, and the route stayed accept-new.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "denied"})
-        self.link.connect(["start"])
-        s = self.link.snapshot()
-        self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "login"))
-        got = self.reg.get(d["id"])
-        self.assertEqual(got["identity"], [f for _, f in fd.pinned_keys(d["id"])])
-        self.assertTrue(got["identity_established"])
-        if os.name == "posix":
-            self.assertEqual(fd.known_hosts(d["id"]).stat().st_mode & 0o777, 0o600)
-        self.assertIn("StrictHostKeyChecking=yes", self.routes[-1][1])
-        fd.known_hosts(d["id"]).unlink()
-        self.hosts({"localhost": "wrong"})
-        r = self.command(self.reg.get(d["id"]))
-        self.assertEqual(r.returncode, 255)
-        self.assertNotIn("Permanently added", r.stderr)
-
-    def test_a_key_a_command_saved_tightens_the_route(self):
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "denied"})
-        with self.link.route_lock:
-            self.link.routed_device = d
-            self.link.apply(d["alias"], self.link.host_opts(d, "127.0.0.1"))
-        opts = self.routes[-1][1]
-        self.assertIn("StrictHostKeyChecking=accept-new", opts)
-        r = subprocess.run(["ssh", *opts, d["alias"], "true"], capture_output=True, text=True, timeout=20)
-        self.assertIn("Permanently added", r.stderr)
-        self.assertEqual(r.returncode, 255)  # saved the key, then refused the login
-        self.link.settle_pin()  # what the connector's loop does every tick while accept-new is applied
-        self.assertIn("StrictHostKeyChecking=yes", self.routes[-1][1])
-        self.assertNotIn("StrictHostKeyChecking=accept-new", self.routes[-1][1])
-        self.assertTrue(self.reg.get(d["id"])["identity"])
-
-    def test_editing_the_address_that_worked_keeps_the_identity_history(self):
-        # Review pr85-review-r2: last_ok lives on the address, so editing or removing it made a
-        # headset whose pin was gone (and had no fingerprint recorded) new again.
-        path = self.dir / "legacy.json"
-        path.write_text(json.dumps({"version": 1, "active": "abcd1234", "networks": {}, "devices": [
-            {"id": "abcd1234", "name": "Old", "alias": "frame-old", "user": "steamos", "port": 22,
-             "identity_files": [], "addresses": [{"host": "10.0.0.5", "kind": "lan", "label": "",
-                                                  "networks": [], "last_ok": 1790000000.0, "last_rtt_ms": 3}]}]}))
-        reg = fd.Registry(path)
-        self.assertTrue(reg.get("abcd1234")["identity_established"])  # migrated from last_ok
-        reg.update_address("abcd1234", "10.0.0.5", new_host="10.0.0.6")
-        reg.remove_address("abcd1234", "10.0.0.6")
-        reg.add_address("abcd1234", "10.0.0.7")
-        d = fd.Registry(path).get("abcd1234")  # saved, too
-        self.assertFalse(any(a.get("last_ok") for a in d["addresses"]))
-        self.assertTrue(fd.identity_established(d))
-        self.assertEqual(self.link.strictness(d), "yes")
-        # A connection that works sets it as well, for a headset added since.
-        n = self.reg.add_device("frame-new", hosts=["10.0.0.8"])
-        self.reg.record_success(n["id"], "10.0.0.8", None, 1)
-        self.reg.remove_address(n["id"], "10.0.0.8")
-        self.assertTrue(self.reg.get(n["id"])["identity_established"])
-
-    def test_ssh_last_words_arrive_even_when_the_reader_lags(self):
-        # Review pr85-review-r2: ssh's exit with nothing queued yet was taken as the end, and a
-        # late reader lost "Permission denied" ("ssh stopped").
-        self.pins()
-        link = fl.Link(self.reg, env_alias=None, mux_base=["ssh", "-o", "BatchMode=yes"], control=None,
-                       apply=lambda *a: None, explain=explain)
-        self.addCleanup(link.stop)
-        real = threading.Thread
-
-        class Late(real):
-            def __init__(self, *a, target=None, **kw):
-                if target is not None and getattr(target, "__name__", "") == "tail":
-                    inner = target
-
-                    def target():
-                        time.sleep(1)
-                        inner()
-                super().__init__(*a, target=target, **kw)
-        self.device("localhost")
-        self.hosts({"localhost": "denied"})
-        with mock.patch.object(fl.threading, "Thread", Late):
-            link.connect(["start"])
-        s = link.snapshot()
-        self.assertEqual((s["error"]["stage"], s["error"].get("auth")), ("login", "denied"), s["error"])
-        self.assertIn("SSH key", s["error"]["message"])
-
-    def test_forgetting_an_identity_is_refused(self):
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        self.link.connect(["start"])
-        saved = fd.known_hosts(d["id"]).read_text()
-        with self.assertRaises(fd.DeviceError) as caught:
-            fl.devices_action(self.link, {"action": "forget-identity", "id": d["id"]}, None)
-        self.assertIn("identity-scan", str(caught.exception))
-        self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved)
-
-    def test_without_a_shared_connection_ssh_writes_to_a_file_not_a_pipe(self):
-        # Windows: no ControlMaster, and its OpenSSH can block writing to a stderr pipe.
-        self.pins()
-        tmp = self.dir / "tmp"
-        tmp.mkdir()
-        link = fl.Link(self.reg, env_alias=None, mux_base=["ssh", "-o", "BatchMode=yes"], control=None,
-                       apply=lambda *a: None, explain=explain)
-        self.addCleanup(link.stop)
-        real = subprocess.Popen
-        seen = []
-
-        def popen(argv, **kw):
-            if "-v" in argv:  # the handshake (run_ssh calls go through Popen too)
-                seen.append(kw.get("stderr"))
-            return real(argv, **kw)
-        with mock.patch.object(tempfile, "tempdir", str(tmp)), mock.patch.object(fl.subprocess, "Popen", popen):
-            d = self.device("localhost")
-            self.hosts({"localhost": "ok"})
-            link.connect(["start"])
-            s = link.snapshot()
-            self.assertEqual(s["phase"], "connected", s["error"])
-            self.assertEqual([st["state"] for st in s["stages"]], ["done"] * 5)
-            self.assertIn("saved this headset's identity", next(st for st in s["stages"] if st["id"] == "identity")["detail"])
-            self.reg.update_device(d["id"], user="nobody")
-            self.hosts({"localhost": "denied"})
-            link.connect(["switch"])
-            s = link.snapshot()
-            self.assertEqual((s["phase"], s["error"]["stage"], s["error"].get("auth")), ("failed", "login", "denied"))
-        self.assertTrue(seen and all(isinstance(x, int) for x in seen))  # a file descriptor, never PIPE
-        self.assertNotIn(subprocess.PIPE, seen)
-        for _ in range(50):  # the reader removes its file once ssh has exited
-            if not list(tmp.iterdir()):
-                break
-            time.sleep(0.05)
-        self.assertEqual(list(tmp.iterdir()), [])
-
-    def test_a_changed_key_is_shown_never_accepted_and_trusted_on_request(self):
-        # 0.4.2 on Linux and Windows: "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!", with
-        # "Run Set Up Connection again" as the advice, which can't replace the saved key.
-        self.pins()
-        d = self.device("localhost")
-        self.hosts({"localhost": "ok"})
-        self.link.connect(["start"])
-        self.assertEqual(self.link.snapshot()["phase"], "connected")
-        saved = fd.known_hosts(d["id"]).read_text()
-        old = fd.pinned_keys(d["id"])
-        self.link.close_master()
-        self.hosts({"localhost": "wrong"})  # SteamOS reinstalled: a new host key
-        self.link.connect(["dropped"])
-        s = self.link.snapshot()
-        self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "identity"))
-        shown = s["error"]["hostkey"]
-        self.assertEqual((shown["state"], shown["type"], shown["host"]), ("changed", "ssh-ed25519", "localhost"))
-        self.assertTrue(shown["fingerprint"].startswith("SHA256:"))
-        self.assertIn("Devices tab", s["error"]["message"])
-        self.assertEqual(s["error"]["short"], "SSH identity changed")
-        self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved)  # never accepted on its own
-        r = self.command(d)
-        self.assertEqual(r.returncode, 255)
-        self.assertIn("REMOTE HOST IDENTIFICATION HAS CHANGED", r.stderr)  # nor by any command
-        # Trusting needs the key read first, and exactly the fingerprint shown.
-        with self.assertRaises(fd.DeviceError):
-            fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"],
-                                          "fingerprint": shown["fingerprint"]}, None)
-        out = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)
-        scan = out["scan"]
-        self.assertEqual(scan["fingerprint"], shown["fingerprint"])
-        self.assertFalse(scan["matches"])
-        self.assertEqual(scan["saved"], [{"type": t, "fingerprint": f} for t, f in old])
-        self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved)  # reading it saves nothing
-        self.assertEqual(sorted(p.name for p in fd.known_hosts(d["id"]).parent.iterdir()), [d["id"]])  # no scan files
-        call = [c for c in self.calls() if "PreferredAuthentications=none" in c][-1]  # no login offered
-        self.assertLess(call.index("StrictHostKeyChecking=accept-new"), call.index("StrictHostKeyChecking=yes"))
-        self.assertNotIn(f"UserKnownHostsFile={fd.known_hosts_opt(d['id'])}",
-                         call[:call.index("StrictHostKeyChecking=yes")])  # a throwaway file, first
-        with self.assertRaises(fd.DeviceError):
-            fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], "fingerprint": "SHA256:other"}, None)
-        self.link.scans[d["id"]]["at"] -= fl.SCAN_TTL + 1
-        with self.assertRaises(fd.DeviceError):  # shown too long ago
-            fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"],
-                                          "fingerprint": shown["fingerprint"]}, None)
-        fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)
-        with mock.patch.object(self.link, "kick") as kick:
-            out = fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"],
-                                                "fingerprint": shown["fingerprint"]}, None)
-        kick.assert_called_with("switch")
-        self.assertEqual(fd.pinned_keys(d["id"]), [("ssh-ed25519", shown["fingerprint"])])  # the old key is gone
-        self.assertEqual(next(x for x in out["devices"] if x["id"] == d["id"])["keys"],
-                         [{"type": "ssh-ed25519", "fingerprint": shown["fingerprint"]}])
-        self.link.connect(["switch"])
-        self.assertEqual(self.link.snapshot()["phase"], "connected", self.link.snapshot()["error"])
-        out = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)
-        self.assertTrue(out["scan"]["matches"])
-
-    def test_test_now_never_saves_a_key(self):
-        self.pins()
-        d = self.device("127.0.0.1")
-        self.hosts({"127.0.0.1": "ok"})
-        self.link.test(d["id"])
-        rows = self.link.snapshot()["tests"][d["id"]]["rows"]
-        self.assertEqual(rows[0]["ssh"], "unpinned")
-        self.assertFalse(fd.pinned(d["id"]))
-
-    def test_reading_a_key_from_a_headset_that_doesnt_answer_says_why(self):
-        self.pins()
-        d = self.device("nothing.invalid")
-        with self.assertRaises(fd.DeviceError) as caught:
-            fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)
-        self.assertIn("Can't find the Frame", str(caught.exception))
-        self.assertEqual([p.name for p in fd.known_hosts(d["id"]).parent.iterdir()], [])
-
     def test_ssh_goes_to_the_ipv4_address_that_answered(self):
         self.device("localhost")
         self.hosts({"localhost": "ok"})
@@ -897,6 +457,47 @@ class Connecting(unittest.TestCase):
         self.assertEqual(self.routes, [])
         self.assertTrue(all("ControlPath=none" in c for c in self.calls() if "-G" not in c))
 
+    def test_a_test_started_earlier_cant_overwrite_a_newer_one(self):
+        d = self.device("nothing.invalid")
+        entered = {1: threading.Event(), 2: threading.Event()}
+        release = {1: threading.Event(), 2: threading.Event()}
+        calls = []
+
+        def probe(host, port, update=None):
+            calls.append(host)
+            n = len(calls)
+            entered[n].set()
+            release[n].wait(10)
+            return {"state": "refused", "detail": f"test {n}", "ip": None, "rtt_ms": None}
+
+        tests = [threading.Thread(target=self.link.test, args=(d["id"],), daemon=True) for _ in range(2)]
+        with mock.patch.object(fl, "probe", probe):
+            try:
+                tests[0].start()
+                self.assertTrue(entered[1].wait(5), "the first test never probed")
+                tests[1].start()
+                self.assertTrue(entered[2].wait(5), "the second test never probed")
+                # The first finishes while the second is still probing: it mustn't show its
+                # rows or mark the second done.
+                release[1].set()
+                tests[0].join(10)
+                self.assertFalse(tests[0].is_alive())
+                running = self.link.snapshot()["tests"][d["id"]]
+                self.assertFalse(running["done"])
+                self.assertEqual(running["rows"][0]["detail"], "Waiting")
+                release[2].set()
+                tests[1].join(10)
+                self.assertFalse(tests[1].is_alive())
+            finally:
+                for e in release.values():
+                    e.set()
+                for t in tests:
+                    if t.ident:  # started
+                        t.join(10)
+        result = self.link.snapshot()["tests"][d["id"]]
+        self.assertTrue(result["done"])
+        self.assertEqual(result["rows"][0]["detail"], "test 2")
+
     def test_switching_to_a_headset_that_never_answers_stops_using_the_last_one(self):
         self.device("localhost")
         self.hosts({"localhost": "ok"})
@@ -940,7 +541,7 @@ class Connecting(unittest.TestCase):
                      {"action": "update", "id": d["id"], "port": 2222},
                      {"action": "address-remove", "id": d["id"], "host": "localhost"},
                      {"action": "address-update", "id": d["id"], "host": "localhost", "newHost": "127.0.0.1"},
-                     {"action": "identity-trust", "id": d["id"], "fingerprint": "SHA256:x"}):
+                     {"action": "forget-identity", "id": d["id"]}):
             with self.assertRaises(fd.DeviceError, msg=body):
                 fl.devices_action(self.link, body, open_setup=None, busy=lambda: 1)
         # Renaming, or changing another headset, is fine.
@@ -1039,260 +640,6 @@ class Connecting(unittest.TestCase):
         (self.dir / "ssh" / "config").write_text("Host frame lab-*\n  HostName 10.0.0.7\n")  # someone's own `frame`
         self.assertEqual(fl.next_alias(self.link), "frame-2")
 
-    # ---- what a failure leaves for a problem report ----
-    def stderr(self):
-        return quiet_log(self)
-
-    def report(self):
-        import frame_report as fr
-        done = threading.Thread(target=lambda: None)
-        done.start()
-        done.join()
-        with mock.patch.object(fr, "link", self.link), \
-                mock.patch.dict(fr._ssh, {"thread": done, "line": "SSH: system OpenSSH, OpenSSH 9.9p1, LibreSSL 3.3.6"}):
-            return fr.diagnostics()
-
-    def test_each_failure_goes_to_the_server_log_scrubbed(self):
-        err = self.stderr()
-        self.device("steamdeck-jane.invalid", "localhost")
-        self.hosts({"localhost": "denied"})
-        self.link.connect(["start"])
-        line = err.getvalue()
-        self.assertIn("frame_link: login failed: The Frame didn't accept this computer's SSH key.", line)
-        self.assertIn("addresses: hostname unresolved; hostname->ipv4", line)
-        for leaked in ("steamdeck-jane", "127.0.0.1", "localhost"):
-            self.assertNotIn(leaked, line)
-        self.assertEqual(self.link.last_failure["stage"], "login")
-
-    def test_reports_carry_a_connection_summary_in_fixed_words(self):
-        self.stderr()
-        self.device("steamdeck-jane.invalid", "frame-t.invalid")
-        (self.dir / "ssh" / "config").write_text(
-            f"{fd.begin_mark('frame-t')}\nHost frame-t\n  HostName 192.168.1.50\n  User steamos\n{fd.end_mark('frame-t')}\n"
-            "Host frame-t\n  HostName 10.0.0.7\n")
-        self.link.connect(["start"])
-        text = self.report()
-        self.assertIn("Connection: failed at find, attempt 1 (Starting up)", text)
-        self.assertIn("Headsets: 1 saved; active alias custom (saved, 2 address(es))", text)
-        self.assertIn("Error: find, frame_not_set_up", text)
-        self.assertRegex(text, r"Last failure: find, frame_not_set_up, 0 min \d+ s ago")
-        self.assertIn("Addresses tried: hostname unresolved; hostname unresolved", text)
-        self.assertIn("Network: gateway yes, Tailscale not installed", text)
-        self.assertIn("SSH: system OpenSSH, OpenSSH 9.9p1", text)
-        self.assertIn("~/.ssh/config: managed block for the active alias yes (1 managed in all); "
-                      "hand-written Host for it yes", text)
-        # No free text from the error or ssh at all, and not the custom alias.
-        for leaked in ("steamdeck-jane", "Could not resolve", "Can't find", "192.168", "10.0.0.7", "steamos",
-                       "frame-t", str(self.dir)):
-            self.assertNotIn(leaked, text)
-
-    def test_a_failure_on_the_last_headset_leaves_nothing_of_it_after_switching(self):
-        self.stderr()
-        a = self.device("steamdeck-jane.invalid")
-        self.link.connect(["start"])
-        b = self.reg.add_device("frame-2", port=self.port, hosts=[])
-        self.reg.add_address(b["id"], "localhost", kind="lan")
-        self.hosts({"localhost": "ok"})
-        self.reg.set_active(b["id"])
-        self.link.connect(["switch"])
-        self.assertEqual(self.link.snapshot()["phase"], "connected")
-        text = self.report()
-        self.assertIn("Connection: connected via hostname->ipv4", text)
-        self.assertRegex(text, r"Last failure: find, frame_not_set_up, ")
-        self.assertNotIn("steamdeck-jane", text)
-        self.assertNotEqual(a["id"], b["id"])
-
-    def test_the_headsets_alias_and_name_stay_out_of_the_log(self):
-        import frame_report as fr
-        err = self.stderr()
-        d = self.reg.add_device("jane-office.example.com", name="Jane Doe's work headset", hosts=[])
-        self.reg.set_active(d["id"])
-        self.link.connect(["start"])
-        self.assertIn("find failed: The active headset has no addresses.", err.getvalue())
-        # A message that names it anyway (any case) goes too, in the log and so in a report's log.
-        self.link.note_failure("ssh", "JANE-OFFICE.EXAMPLE.COM: jane doe's work headset stopped answering")
-        log = self.dir / "server.log"
-        log.write_text(err.getvalue())
-        with mock.patch.dict(os.environ, {"FRAME_CONTROL_LOG": str(log)}):
-            with mock.patch.object(fr, "link", self.link), mock.patch.dict(fr._ssh, {"thread": None, "line": "SSH: x"}):
-                text = fr.diagnostics(include_logs=True)
-        self.assertIn("frame_link: ssh failed", text)
-        for leaked in ("jane", "Jane", "JANE"):
-            self.assertNotIn(leaked, err.getvalue())
-            self.assertNotIn(leaked, text)
-
-
-def quiet_log(test):
-    """Catch frame_link's log lines, starting with nothing remembered."""
-    fl._logged.clear()
-    err = io.StringIO()
-    p = mock.patch.object(sys, "stderr", err)
-    p.start()
-    test.addCleanup(p.stop)
-    return err
-
-
-class FailureLog(unittest.TestCase):
-    def test_the_same_failure_isnt_logged_every_retry(self):
-        err = quiet_log(self)
-        for _ in range(3):
-            fl.log_failure("find", "The Frame isn't answering.", "", [{"host": "frame.local", "state": "timeout"}])
-        self.assertEqual(err.getvalue().count("frame_link:"), 1)
-        for v in fl._logged.values():
-            v["at"] -= fl.LOG_REPEAT_EVERY + 1
-        fl.log_failure("find", "The Frame isn't answering.", "", [{"host": "frame.local", "state": "timeout"}])
-        self.assertIn("(and 2 more times)", err.getvalue())
-        self.assertNotIn("frame.local", err.getvalue())
-
-    def test_interleaved_failures_are_throttled_too(self):
-        err = quiet_log(self)
-        for _ in range(4):
-            fl.log_failure("find", "The Frame isn't answering.")
-            fl.log_failure("login", "The Frame didn't accept this computer's SSH key.")
-        self.assertEqual(err.getvalue().count("frame_link:"), 2)
-        for i in range(fl.LOG_REMEMBER + 10):  # many different failures: memory stays bounded
-            fl.log_failure("ssh", f"failure number {i}")
-        self.assertLessEqual(len(fl._logged), fl.LOG_REMEMBER)
-
-    def test_hosts_ssh_names_go_known_or_not_and_whatever_the_case(self):
-        err = quiet_log(self)
-        fl.log_failure("ssh", "ssh stopped", "ssh: Could not resolve hostname bastion-jane: Name or service not known")
-        fl.log_failure("ssh", "ssh stopped", "channel 0: open failed: connect to host jane-office.example.com port 22")
-        fl.log_failure("ssh", "ssh stopped", "kex_exchange_identification: Connection reset by steamdeck-jane",
-                       hosts=["STEAMDECK-JANE"])
-        fl.log_failure("ssh", "Timed out talking to frame-jane", "")
-        out = err.getvalue()
-        self.assertIn("hostname <host>", out)
-        self.assertIn("connect to host <host> port 22", out)
-        for leaked in ("bastion-jane", "jane-office", "steamdeck-jane", "frame-jane"):
-            self.assertNotIn(leaked, out)
-
-    def test_headsets_named_like_sshs_words_dont_shield_the_real_host(self):
-        err = quiet_log(self)
-        for saved in ("host", "hostname", "to"):
-            fl.log_failure("ssh", "ssh stopped", "ssh: connect to host bastion-jane port 22: Connection refused",
-                           hosts=[saved])
-            fl.log_failure("ssh", "ssh stopped", "ssh: Could not resolve hostname jane-office.example.com: not known",
-                           hosts=[saved])
-        out = err.getvalue()
-        self.assertIn("connect to host <host> port 22", out)
-        self.assertIn("hostname <host>", out)
-        for leaked in ("bastion-jane", "jane-office"):
-            self.assertNotIn(leaked, out)
-        self.assertEqual(fl.hide_hosts("<host> and frame", ["host", "frame"]), "<host> and <host>")
-
-    def test_whole_names_go_before_sshs_words_and_only_real_tokens_are_spared(self):
-        for name, said in (("Jane Doe's work headset", "Timed out talking to Jane Doe's work headset"),
-                           ("Jane to Doe headset", "Jane to Doe headset stopped answering"),
-                           ("<Jane Doe>", "<Jane Doe> stopped answering")):
-            out = fl.scrub_failure(said, [name])
-            self.assertTrue(out.startswith("<host>") or out == "Timed out talking to <host>", out)
-            for leaked in ("Jane", "Doe"):
-                self.assertNotIn(leaked, out)
-        self.assertEqual(fl.scrub_failure("Timed out talking to Jane Doe's work headset", ["Jane Doe's work headset"]),
-                         "Timed out talking to <host>")
-        self.assertEqual(fl.hide_hosts("<user>@<host>: <ip>", ["user", "host", "ip"]), "<user>@<host>: <ip>")
-
-    def test_windows_user_names_with_spaces_go_whole(self):
-        err = quiet_log(self)
-        with mock.patch.object(fl.frame_telemetry, "_user_names", return_value=set()):
-            fl.log_failure("ssh", r"Bad owner or permissions on C:\Users\Jane Doe/.ssh/config", "")
-            fl.log_failure("login", "The Frame didn't accept this computer's SSH key.",
-                           "Jane Doe@frame: Permission denied (publickey).")
-            fl.log_failure("login", "refused", r"debug | ssh said: CORP\jane@frame's password: denied")
-        out = err.getvalue()
-        self.assertIn(r"C:\Users\<user>/.ssh/config", out)
-        self.assertIn("<user>@<host>: Permission denied", out)
-        for leaked in ("Jane", "Doe", "jane", "CORP"):
-            self.assertNotIn(leaked, out)
-
-    def test_whole_ssh_user_at_host_fields_and_home_folders_go(self):
-        import frame_telemetry as tm
-        with mock.patch.object(tm, "_user_names", return_value=set()):
-            self.assertEqual(tm.scrub(r"CORP\Jane Doe@jane-office.example.com: Permission denied (publickey)."),
-                             "<user>@<host>: Permission denied (publickey).")
-            self.assertEqual(tm.scrub("jane@jane-office.example.com's password: "), "<user>@<host>'s password: ")
-            self.assertEqual(tm.scrub(r"Bad owner on C:\Users\O'Brien/.ssh/config"), r"Bad owner on C:\Users\<user>/.ssh/config")
-            self.assertEqual(tm.scrub(r"c:\users\Zoë Smith.Jr\.ssh\config"), r"c:\users\<user>\.ssh\config")
-            self.assertEqual(tm.scrub("/users/O'Brien/x and /HOME/jane doe/y"), "/users/<user>/x and /HOME/<user>/y")
-            self.assertEqual(tm.scrub("write to me@example.com today"), "write to <email> today")
-
-
-class ConnectionDiagnostics(unittest.TestCase):
-    def test_address_kinds_never_the_address(self):
-        self.assertEqual(fl.address_kind("frame.local", "fe80::1%eth0"), ".local->ipv6 link-local")
-        self.assertEqual(fl.address_kind("frame.local", "192.168.1.5"), ".local->ipv4")
-        self.assertEqual(fl.address_kind("frame.local"), ".local")
-        self.assertEqual(fl.address_kind("fe80::1%5"), "ipv6 link-local")
-        self.assertEqual(fl.address_kind("2001:db8::1"), "ipv6")
-        self.assertEqual(fl.address_kind("192.168.1.5", "192.168.1.5"), "ipv4")
-        self.assertEqual(fl.address_kind("100.101.102.103"), "tailscale")
-        self.assertEqual(fl.address_kind("frame.tail1234.ts.net", "100.101.102.103"), "tailscale")
-        self.assertEqual(fl.address_kind("steamdeck"), "hostname")
-        self.assertEqual(fl.probes_summary([{"host": "frame", "label": "from ~/.ssh/config", "state": "timeout"}]),
-                         "alias hostname timeout")
-
-    def test_hidden_hosts_leave_the_rest(self):
-        self.assertEqual(fl.hide_hosts("frame_link: Could not resolve hostname frame", ["frame"]),
-                         "frame_link: Could not resolve hostname <host>")
-        self.assertEqual(fl.hide_hosts("ssh frame to frame.local", ["frame.local", "frame"], keep=("frame",)),
-                         "ssh frame to <host>")
-        self.assertEqual(fl.hide_hosts("reset by SteamDeck", ["steamdeck"]), "reset by <host>")
-        self.assertEqual(fl.hide_operands("The headset took too long to answer."), "The headset took too long to answer.")
-
-    def test_ssh_version_is_rebuilt_from_its_numbers(self):
-        import frame_report as fr
-        for said, want in (("OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2\n", "OpenSSH for Windows 9.5p1, LibreSSL 3.8.2"),
-                           ("OpenSSH_9.9p1, LibreSSL 3.3.6\n", "OpenSSH 9.9p1, LibreSSL 3.3.6"),
-                           ("OpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022\n", "OpenSSH 8.9p1"),
-                           ("OpenSSH_9.6p1, OpenSSL 3.0.13 30 Jan 2024\n", "OpenSSH 9.6p1, OpenSSL 3.0.13"),
-                           ("OpenSSH_9.9p1-Jane-Doe-Laptop, LibreSSL 3.3.6\n", "unknown"),
-                           ("OpenSSH_9.9p1, OpenSSL jane-laptop\n", "OpenSSH 9.9p1"),
-                           (r"C:\Users\Jane\OpenSSH-portable\ssh.exe: not found", "unknown"),
-                           ("", "unknown")):
-            with mock.patch.object(fr.frame_host, "run_ssh", return_value=subprocess.CompletedProcess([], 0, "", said)):
-                self.assertEqual(fr.ssh_version("ssh"), want, said)
-
-    def test_only_the_default_alias_is_named(self):
-        import frame_report as fr
-        self.assertEqual(fr.alias_kind("frame"), 'default ("frame")')
-        self.assertEqual(fr.alias_kind("jane-office.example.com"), "custom")
-
-    def test_a_slow_path_never_holds_up_a_report(self):
-        import frame_report as fr
-        release = threading.Event()
-
-        def slow():
-            release.wait(5)
-            return []
-        with mock.patch.dict(fr._ssh, {"thread": None, "line": None}), mock.patch.object(fr, "_ssh_on_path", slow), \
-                mock.patch.object(fr, "link", None), mock.patch.object(fr.shutil, "which", return_value="/usr/bin/ssh"), \
-                mock.patch.object(fr.frame_host, "run_ssh",
-                                  return_value=subprocess.CompletedProcess([], 0, "", "OpenSSH_9.9p1, LibreSSL 3.3.6\n")):
-            t0 = time.monotonic()
-            self.assertIn("Connection: no connector", fr.diagnostics())
-            self.assertIn("SSH: still being checked", fr.ssh_line())
-            self.assertLess(time.monotonic() - t0, 2)
-            thread = fr._ssh["thread"]
-            release.set()
-            thread.join(5)
-            self.assertTrue(fr._ssh["line"].startswith("SSH: "))
-            self.assertNotEqual(fr.ssh_line(), "SSH: still being checked")
-
-    def test_ssh_kinds(self):
-        import frame_report as fr
-        for path, kind in ((r"C:\WINDOWS\System32\OpenSSH\ssh.exe", "Windows OpenSSH (System32)"),
-                           (r"C:\Program Files\OpenSSH\ssh.exe", "OpenSSH in Program Files"),
-                           (r"C:\Program Files\Git\usr\bin\ssh.exe", "Git for Windows"),
-                           ("/usr/bin/ssh", "system OpenSSH"), ("/opt/homebrew/bin/ssh", "Homebrew or /usr/local"),
-                           ("/home/jane/bin/ssh", "other"), (None, "not found")):
-            self.assertEqual(fr.ssh_path_kind(path), kind)
-
-    def test_no_connector_says_so(self):
-        import frame_report as fr
-        with mock.patch.object(fr, "link", None):
-            self.assertIn("Connection: no connector", fr.diagnostics())
-
 
 @unittest.skipIf(os.name == "nt", "the stand-in ssh is a POSIX script")
 class ServerConnection(unittest.TestCase):

tests/test_link_ui.py

@@ -1,136 +0,0 @@
-"""The connection pill, the offline banner and the Devices tab's selection: the page's own
-functions from ui/index.html, run in Node against a minimal DOM (#87)."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import pathlib
-import re
-import shutil
-import subprocess
-import unittest
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-PAGE = (ROOT / "ui/index.html").read_text(encoding="utf-8")
-
-
-def between(start, end):
-    return PAGE[PAGE.index(start):PAGE.index(end)]
-
-
-SETUP = r'''
-const assert = require('node:assert/strict');
-const elements = new Map();
-const $ = id => {
-  if (!elements.has(id)) elements.set(id, {id, textContent: '', innerHTML: '', title: '', hidden: true, value: ''});
-  return elements.get(id);
-};
-const esc = s => String(s).replace(/[&<>"']/g, c => ({'&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;'}[c]));
-const serverNow = () => 1000;
-const activeStage = s => (s.stages || []).find(x => x.state === 'active');
-const ago = () => 'a minute ago';
-const openTrust = () => {};
-const window = {};
-let online = false;
-const link = {live: true, s: null};
-const dv = {list: [], sel: null, data: null, found: 'x', editing: 'y'};
-let rendered = 0;
-const renderDevices = () => { rendered++; };
-let refuse = false;
-const act = async (label, fn) => refuse ? undefined : fn();
-const api = async () => ({ok: true});
-const STAGES = [{id: 'find', label: 'Finding the headset', state: 'done'},
-                {id: 'identity', label: "Checking the headset's identity", state: 'failed'}];
-const changed = {phase: 'failed', retry_at: 1012, device: {id: 'd1', name: 'Office Frame'}, network: {name: 'Home'},
-  stages: STAGES, probes: [{host: 'frame.local', detail: 'SSH identity changed'}],
-  error: {stage: 'identity', short: 'SSH identity changed', hostkey: {state: 'changed'},
-          message: 'This address answered with a different SSH identity from the one saved for Office Frame. '
-                 + 'If not, a different device may be answering here.'}};
-'''
-
-
-@unittest.skipUnless(shutil.which("node"), "Node runs the page's own functions")
-class LinkUI(unittest.TestCase):
-    def run_page(self, checks):
-        code = (between("function netLabel(s) {", "function renderConnDlg() {")
-                + between("async function useDevice(id) {", "async function devAction(")
-                + between("function deviceStatus(d) {", "function renderDevices() {"))
-        script = SETUP + code + "\n(async () => {\n" + checks + "\n})().catch(e => { console.error(e); process.exitCode = 1; });"
-        r = subprocess.run(["node", "-e", script], capture_output=True, text=True)
-        self.assertEqual(r.returncode, 0, r.stderr)
-
-    def test_the_pill_leads_with_the_reason(self):
-        # The header pill cut off "Offline: checking the headset's identity failed · retry in…":
-        # the reason comes first, in a few words, and only the countdown gets cut.
-        self.run_page(r'''
-  link.s = changed;
-  renderPill();
-  assert.match($('conn').innerHTML, /<b>Office Frame<\/b><span>SSH identity changed · retry in 12 s<\/span>/);
-  assert.equal($('conn').title, 'Office Frame is offline: SSH identity changed · retry in 12 s. Click for details.');
-  // Without a short reason: the stage that failed.
-  link.s = {...changed, retry_at: null, error: {stage: 'identity', message: 'Something.'}};
-  renderPill();
-  assert.match($('conn').innerHTML, /<span>Checking the headset&#39;s identity failed<\/span>/);
-''')
-
-    def test_the_banner_never_doubles_a_full_stop(self):
-        # "…may be answering here.." and "…(Developer Mode must be on).." (#87).
-        self.run_page(r'''
-  link.s = changed;
-  renderBanner();
-  assert.equal($('offDetail').textContent, 'Office Frame on Home. Tried frame.local: SSH identity changed. Trying again in 12 s.');
-  link.s = {...changed, probes: [
-    {host: 'frame.local', detail: "The Frame didn't accept this computer's SSH key. Set Up Connection pairs this computer with it again (Developer Mode must be on)."},
-    {host: '100.64.0.2', detail: 'No answer'}]};
-  renderBanner();
-  const text = $('offDetail').textContent;
-  assert.ok(!/\.\./.test(text), text);
-  assert.ok(text.includes("frame.local: the Frame didn't accept"), text);
-  assert.ok(text.includes('must be on); 100.64.0.2: no answer. Trying'), text);
-  assert.equal(asClause('SSH identity changed.'), 'SSH identity changed');  // abbreviations keep their case
-  assert.equal(asClause('Answered in 3 ms'), 'answered in 3 ms');
-''')
-
-    def test_the_devices_list_keeps_the_whole_message_within_reach(self):
-        self.run_page(r'''
-  link.s = changed;
-  const [dot, text, full] = deviceStatus({active: true, addresses: []});
-  assert.equal(dot, 'off');
-  assert.equal(text, 'SSH identity changed');
-  assert.equal(full, changed.error.message);  // the row's tooltip
-''')
-
-    def test_using_a_headset_selects_it(self):
-        # After "Use this headset" on Office Frame, the last headset's details stayed on show.
-        self.run_page(r'''
-  dv.list = [{id: 'd0', name: 'Living Room Frame', active: true}, {id: 'd1', name: 'Office Frame', active: false}];
-  dv.sel = 'd0';
-  await useDevice('d1');
-  assert.equal(dv.sel, 'd1');
-  assert.equal(dv.found, null);
-  assert.equal(dv.editing, null);
-  assert.equal(rendered, 1);
-  // Refused (an install is running): the selection stays, and the header shows the one in use.
-  dv.list = [{id: 'd0', name: 'Living Room Frame', active: true}, {id: 'd2', name: 'Spare', active: false}];
-  dv.sel = 'd0'; refuse = true;
-  await useDevice('d2');
-  assert.equal(dv.sel, 'd0');
-  assert.equal($('devSel').value, 'd0');
-''')
-
-
-class HeaderLayout(unittest.TestCase):
-    def test_the_devices_tab_explanation_wraps(self):
-        # It was cut to one line with no way to read the rest.
-        self.assertIn(".dev-problem .s { white-space: normal; }", PAGE)
-        self.assertEqual(len(re.findall(r'<div class="item dev-problem" role="alert">', PAGE)), 2)
-
-    def test_the_header_buttons_dont_give_way(self):
-        # Refresh overhung the right edge at 1280 px: the pill (and the headset picker) shrink, not the buttons.
-        header = between("<header>", "</header>")
-        end = header[header.index('<div class="hdr-end">'):]
-        for el in ('id="conn"', 'id="devSel"', 'id="battChip"', 'id="reportBtn"', 'id="refreshAll"'):
-            self.assertIn(el, end)
-        self.assertIn(".hdr-end > :not(.pill, .devsel) { flex: none; }", PAGE)
-        self.assertRegex(PAGE, r"\.hdr-end \{[^}]*min-width: 0;[^}]*margin-left: auto;")
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_macview.py

@@ -7,7 +7,6 @@ input reaching the source, and closing.
 
 Run: python3 -m unittest discover -s tests
 """
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import base64
 import http.client
 import json

tests/test_media.py

@@ -1,5 +1,4 @@
 """Owned media planning, eye isolation, decoder choice and fake-Frame ownership."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import argparse
 import io
 import json

tests/test_page_scripts.py

@@ -0,0 +1,141 @@
+"""The page's inline scripts share one global scope, so a second top-level function or
+variable with a name already used replaces the first everywhere, silently."""
+import html.parser
+import json
+import pathlib
+import shutil
+import subprocess
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+
+# Compiles the scripts as one strict-mode block. There, functions are block scoped like let
+# and const, so V8 itself rejects a name declared twice in the shared scope (however it's
+# indented or declared: function, class, let, const, destructuring), while helpers with the
+# same name inside different functions stay legal. var is the exception (declaring one twice
+# is allowed), so the page doesn't use var at all: Node's own copy of the acorn parser finds
+# real var declarations, not the word in comments, strings or CSS var().
+DUPLICATES = r'''
+const vm = require('vm');
+const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+try { new vm.Script('"use strict"; {\n' + scripts.join('\n;\n') + '\n}'); console.log('ok'); }
+catch (e) { console.log(e.message); }
+'''
+VARS = r'''
+const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+let acorn, walk;
+try {
+  acorn = require('internal/deps/acorn/acorn/dist/acorn');
+  walk = require('internal/deps/acorn/acorn-walk/dist/walk');
+} catch { console.log('no parser'); process.exit(0); }
+for (const code of scripts) {
+  let found = null;
+  try {
+    walk.simple(acorn.parse(code, { ecmaVersion: 'latest' }), {
+      VariableDeclaration(n) { if (n.kind === 'var' && !found) found = code.slice(n.start, n.end).slice(0, 40); },
+    });
+  } catch (e) { console.log(e.message); process.exit(0); }
+  if (found) { console.log('declares with var: ' + found); process.exit(0); }
+}
+console.log('ok');
+'''
+
+
+def node(script, scripts, *flags):
+    r = subprocess.run(['node', *flags, '-e', script], input=json.dumps(scripts), capture_output=True, text=True)
+    return r.stdout.strip() or r.stderr.strip()
+
+
+def check(scripts):
+    """'ok', or V8's message for the first name declared twice."""
+    return node(DUPLICATES, scripts)
+
+
+def check_vars(scripts):
+    """'ok', or the first var declaration. Skips where Node doesn't include acorn."""
+    out = node(VARS, scripts, '--expose-internals')
+    if out == 'no parser':
+        raise unittest.SkipTest("this Node doesn't include acorn")
+    return out
+
+
+class ClassicScripts(html.parser.HTMLParser):
+    """The page's inline classic scripts: no src, and no type other than a JavaScript one (a
+    module has its own scope, and JSON data isn't code). The types a browser runs as script:
+    https://mimesniff.spec.whatwg.org/#javascript-mime-type"""
+    JS = {'', 'application/ecmascript', 'application/javascript', 'application/x-ecmascript',
+          'application/x-javascript', 'text/ecmascript', 'text/javascript', 'text/javascript1.0',
+          'text/javascript1.1', 'text/javascript1.2', 'text/javascript1.3', 'text/javascript1.4',
+          'text/javascript1.5', 'text/jscript', 'text/livescript', 'text/x-ecmascript', 'text/x-javascript'}
+
+    def __init__(self):
+        super().__init__()
+        self.scripts, self.current = [], None
+
+    def handle_starttag(self, tag, attrs):
+        if tag == 'script':
+            a = dict(attrs)
+            inline = 'src' not in a and (a.get('type') or '').strip().lower() in self.JS
+            self.current = [] if inline else None
+
+    def handle_data(self, data):
+        if self.current is not None:
+            self.current.append(data)
+
+    def handle_endtag(self, tag):
+        if tag == 'script' and self.current is not None:
+            self.scripts.append(''.join(self.current))
+        if tag == 'script':
+            self.current = None
+
+
+def classic_scripts(page):
+    p = ClassicScripts()
+    p.feed(page)
+    return p.scripts
+
+
+@unittest.skipUnless(shutil.which('node'), 'Node parses the page scripts')
+class PageScripts(unittest.TestCase):
+    def test_no_top_level_name_is_declared_twice(self):
+        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
+        self.assertGreaterEqual(len(scripts), 2)
+        self.assertEqual(check(scripts), 'ok')
+
+    def test_the_page_declares_nothing_with_var(self):
+        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
+        self.assertEqual(check_vars(scripts), 'ok')
+
+    def test_the_check_finds_what_it_should(self):
+        twice = {
+            'indented function': ['function loadPanels() {}', '  async function loadPanels() {}'],
+            'class': ['class Panel {}', 'class Panel {}'],
+            'destructured': ['const { a, b } = {};', 'let [b] = [];'],
+            'later declarator': ['let x = 1;', 'const y = 2, x = 3;'],
+            'function and const': ['function f() {}', 'const f = 1;'],
+        }
+        for what, scripts in twice.items():
+            with self.subTest(what):
+                self.assertIn('already been declared', check(scripts))
+        helpers = ['function a() { function help() {} }', 'function b() { const help = 1; }']
+        self.assertEqual(check(helpers), 'ok')
+
+    def test_the_var_check_finds_what_it_should(self):
+        # var: legal to declare twice, so not allowed at all; however it's written.
+        for code in ['var x = 1;', 'var/*c*/x = 1;', 'var {x} = {x: 1};', 'function f() { var y; }']:
+            with self.subTest(code):
+                self.assertIn('declares with var', check_vars([code]))
+        # The word var elsewhere is fine.
+        text = ['// var x\nconst a = "var y", b = `var ${a}`, c = "color: var(--blue)", d = {}.var;']
+        self.assertEqual(check_vars(text), 'ok')
+
+    def test_only_inline_classic_scripts_are_checked(self):
+        page = ('<script>let a;</script><script type="module">export const m = 1;</script>'
+                '<script type="application/json">{"b": 1}</script><script src = "x.js"></script>'
+                '<script data-src="y" type="text/javascript">let c;</script>'
+                '<script type="text/ecmascript">let d;</script><script type=" Application/X-JavaScript ">let e;</script>')
+        self.assertEqual(classic_scripts(page), ['let a;', 'let c;', 'let d;', 'let e;'])
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_page_startup.py

@@ -0,0 +1,55 @@
+"""The page calls showPage() while its first script is still running, before names declared
+later (in that script or the second one) exist. Touching one of them there throws, and the
+rest of the page's setup never runs: opening Frame Control at #games did exactly that."""
+import json
+import pathlib
+import re
+import shutil
+import subprocess
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+STUBS = ['$', 'toggleLive', 'scrollToY', 'loadMacView', 'loadPanels', 'loadPanelSwitcher', 'loadTitles']
+
+RUN = r'''
+const vm = require('vm');
+const {code, hashes} = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+const failures = [];
+for (const hash of hashes) {
+  const context = vm.createContext({
+    location: {hash}, document: {querySelectorAll: () => [], title: ''}, live: false,
+  });
+  try { vm.runInContext(code, context); }
+  catch (e) { failures.push(`${hash}: ${e.message}`); }
+}
+console.log(JSON.stringify(failures));
+'''
+
+
+@unittest.skipUnless(shutil.which('node'), 'Node runs the page code')
+class PageStartup(unittest.TestCase):
+    def test_opening_any_page_or_section_at_startup_runs(self):
+        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
+        first, second = re.findall(r'<script>(.*?)</script>', page, re.S)[:2]
+        tables = first[first.index('const PAGES ='):first.index('let page =')]
+        start = first.index('function showPage(')
+        show = first[start:first.index('\n}\n', start) + 3]
+        # Everything declared after the startup call is still uninitialised when it runs.
+        call = re.search(r'^showPage\(\);', first, re.M).end()
+        later = re.findall(r'^(?:const|let)\s+(\w+)', first[call:] + second, re.M)
+        later = [n for n in dict.fromkeys(later) if n not in STUBS and n not in ('PAGES', 'SECTION_PAGE', 'page')]
+        self.assertIn('link', later)  # the name that broke #games
+        stubs = ''.join(f'function {n}() {{ return {{ classList: {{ toggle() {{}} }}, scrollIntoView() {{}} }}; }}\n'
+                        for n in STUBS if n != '$')
+        code = ('const $ = id => id === "nowhere" ? null : { classList: { toggle() {} }, scrollIntoView() {} };\n' + stubs + tables + 'let page = "home";\n' + show +
+                'showPage();\n' + ''.join(f'let {n};\n' for n in later))
+        hashes = ['', '#home', '#games', '#android', '#tools', '#settings', '#devices', '#nowhere']
+        hashes += ['#' + k for k in re.findall(r'(\w+): "', tables)]
+        r = subprocess.run(['node', '-e', RUN], input=json.dumps({'code': code, 'hashes': hashes}),
+                           capture_output=True, text=True)
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertEqual(json.loads(r.stdout), [])
+
+
+if __name__ == '__main__':
+    unittest.main()

tests/test_panels.py

@@ -1,5 +1,4 @@
 """Fake-Frame panel responses and the headset page's real HTTP guards."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import http.client
 import json
 from pathlib import Path

tests/test_publish_release.py

@@ -1,110 +0,0 @@
-"""scripts/publish-release.sh against a stand-in gh (tests/fakegh/gh): finds the draft
-through the REST API even when its tag_name still says untagged-..., refuses
-missing installers or digests, writes update.json's page from the tag, and
-publishes with one PATCH. Nothing here talks to GitHub.
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import json
-import os
-import subprocess
-import tempfile
-import unittest
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parent.parent
-SCRIPT = ROOT / "scripts" / "publish-release.sh"
-FAKEGH = ROOT / "tests" / "fakegh"
-INSTALLERS = ["Frame-Control-mac-arm64.dmg", "Frame-Control-mac-arm64.zip", "Frame-Control-Setup-x64.exe",
-              "Frame-Control-win-x64.zip", "Frame-Control-linux-x86_64.AppImage",
-              "Frame-Control-linux-arm64.AppImage", "Frame-Control-linux-amd64.deb",
-              "Frame-Control-linux-arm64.deb"]
-
-
-def draft(tag_name="untagged-c6ddfed7f75d67db2e99", name="Frame Control 9.8.7", rid=42, assets=None):
-    if assets is None:
-        assets = [{"id": 100 + i, "name": n, "size": 1000 + i, "digest": "sha256:" + "%064x" % i}
-                  for i, n in enumerate(INSTALLERS)]
-    return {"id": rid, "tag_name": tag_name, "name": name, "draft": True, "prerelease": False,
-            "body": "notes", "html_url": "https://github.com/saphid/frame-control/releases/tag/" + tag_name,
-            "assets": assets}
-
-
-class PublishRelease(unittest.TestCase):
-    def run_script(self, releases, *args, tags="v9.8.7"):
-        d = Path(tempfile.mkdtemp())
-        (d / "releases.json").write_text(json.dumps(releases))
-        env = dict(os.environ, PATH="%s:%s" % (FAKEGH, os.environ["PATH"]),
-                   FAKEGH_RELEASES=str(d / "releases.json"), FAKEGH_TAGS=tags,
-                   FAKEGH_LOG=str(d / "log"), FAKEGH_UPLOAD=str(d / "upload.json"))
-        p = subprocess.run(["sh", str(SCRIPT), *args], env=env, capture_output=True, text=True, timeout=30)
-        log = [json.loads(line) for line in (d / "log").read_text().splitlines()] if (d / "log").exists() else []
-        upload = json.loads((d / "upload.json").read_text()) if (d / "upload.json").exists() else None
-        return p, log, upload
-
-    def test_publishes_an_untagged_draft_by_title_with_the_tag_page(self):
-        old = {"id": 7, "name": "update.json", "size": 1, "digest": None}
-        rel = draft(assets=draft()["assets"] + [old])
-        p, log, upload = self.run_script([rel], "v9.8.7")
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertEqual(upload["page"], "https://github.com/saphid/frame-control/releases/tag/v9.8.7")
-        self.assertEqual(upload["version"], "9.8.7")
-        self.assertEqual(sorted(a["name"] for a in upload["assets"]), sorted(INSTALLERS))
-        self.assertIn(["api", "-X", "DELETE", "repos/saphid/frame-control/releases/assets/7"], log)
-        patch = next(c for c in log if "PATCH" in c)
-        self.assertEqual(patch[3], "repos/saphid/frame-control/releases/42")
-        for f in ("tag_name=v9.8.7", "draft=false", "prerelease=false", "make_latest=true"):
-            self.assertIn(f, patch)
-        self.assertTrue(all(c[0] == "api" for c in log))  # never `gh release ...` (GraphQL)
-
-    def test_an_untagged_draft_may_carry_a_subtitle(self):
-        p, log, upload = self.run_script([draft(name="Frame Control 9.8.7: faster")], "v9.8.7")
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertEqual(upload["version"], "9.8.7")
-
-    def test_prefers_the_release_whose_tag_name_matches(self):
-        p, log, upload = self.run_script([draft(name="Frame Control 9.8.7 old", rid=1),
-                                          draft(tag_name="v9.8.7", name="Renamed", rid=2)], "v9.8.7")
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertEqual(next(c for c in log if "PATCH" in c)[3], "repos/saphid/frame-control/releases/2")
-
-    def test_refuses_missing_or_unhashed_installers(self):
-        assets = draft()["assets"][1:]
-        assets[0] = dict(assets[0], digest=None)
-        p, log, upload = self.run_script([draft(assets=assets)], "v9.8.7")
-        self.assertNotEqual(p.returncode, 0)
-        self.assertIn("MISSING  Frame-Control-mac-arm64.dmg", p.stdout)
-        self.assertIn("NO HASH  Frame-Control-mac-arm64.zip", p.stdout)
-        self.assertIsNone(upload)
-        self.assertFalse(any(c[1:3] == ["-X", "PATCH"] for c in log))
-
-    def test_refuses_ambiguous_or_absent_drafts_and_missing_tags(self):
-        p, _, _ = self.run_script([draft(rid=1), draft(rid=2)], "v9.8.7")
-        self.assertNotEqual(p.returncode, 0)
-        self.assertIn("2 releases", p.stderr)
-        p, _, _ = self.run_script([draft(name="Frame Control 9.8.70")], "v9.8.7")
-        self.assertNotEqual(p.returncode, 0)
-        self.assertIn("no release", p.stderr)
-        # A pre-release's draft, or one bound to an unrelated tag, is never taken for v9.8.7.
-        for rel in (draft(name="Frame Control 9.8.7-rc.1"), draft(name="Frame Control 9.8.7.1"),
-                    draft(tag_name="kdeconnect-frame-1"), draft(tag_name="")):
-            p, log, upload = self.run_script([rel], "v9.8.7")
-            self.assertNotEqual(p.returncode, 0, rel)
-            self.assertIn("no release", p.stderr)
-            self.assertIsNone(upload)
-            self.assertFalse(any("PATCH" in c for c in log))
-        p, log, _ = self.run_script([draft()], "v9.8.7", tags="")
-        self.assertNotEqual(p.returncode, 0)
-        self.assertIn("push it first", p.stderr)
-
-    def test_dry_run_changes_nothing(self):
-        p, log, upload = self.run_script([draft()], "--dry-run", "v9.8.7")
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertIn('"page": "https://github.com/saphid/frame-control/releases/tag/v9.8.7"', p.stdout)
-        self.assertIsNone(upload)
-        self.assertTrue(all("-X" not in c for c in log))
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_rdp.py

@@ -1,161 +0,0 @@
-"""Remote desktop to the Frame (frame_host.open_rdp) on each computer, with the client
-launch stubbed and a real socket standing in for the Frame's xrdp. Also the server
-staying quiet when the page goes away mid-reply, which on Windows is
-ConnectionAbortedError (WinError 10053).
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import email.message
-import io
-import socket
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-
-import frame_host  # noqa: E402
-import server  # noqa: E402
-
-
-def platform(name):
-    """Patches frame_host to behave as on `name` ("mac", "windows" or "linux")."""
-    return mock.patch.multiple(frame_host, MAC=name == "mac", WINDOWS=name == "windows",
-                               LINUX=name == "linux")
-
-
-class OpenRdp(unittest.TestCase):
-    def setUp(self):
-        self.xrdp = socket.socket()
-        self.xrdp.bind(("127.0.0.1", 0))
-        self.xrdp.listen(4)
-        self.addCleanup(self.xrdp.close)
-        port = mock.patch.object(frame_host, "RDP_PORT", self.xrdp.getsockname()[1])
-        port.start()
-        self.addCleanup(port.stop)
-        self.spawned = []
-        spawn = mock.patch.object(frame_host, "_spawn", self.spawned.append)
-        spawn.start()
-        self.addCleanup(spawn.stop)
-        cache = tempfile.TemporaryDirectory()
-        self.addCleanup(cache.cleanup)
-        self.cache = Path(cache.name)
-        where = mock.patch.object(frame_host, "cache_dir", lambda *p: self.cache.joinpath(*p))
-        where.start()
-        self.addCleanup(where.stop)
-
-    def test_windows_signs_in_as_steamos(self):
-        # The report: mstsc /v:HOST alone offers the Windows account, which xrdp rejects.
-        with platform("windows"):
-            message = frame_host.open_rdp("frame", "127.0.0.1")
-        self.assertEqual(len(self.spawned), 1)
-        argv = self.spawned[0]
-        self.assertEqual(argv[0], "mstsc.exe")
-        self.assertNotIn("/v:127.0.0.1", argv)
-        rdp = Path(argv[1])
-        self.assertEqual(rdp.suffix, ".rdp")
-        data = rdp.read_bytes()  # CRLF lines, as mstsc writes them, however this OS ends lines
-        self.assertNotIn(b"\r\r", data)
-        lines = data.decode("utf-8").split("\r\n")
-        self.assertIn("full address:s:127.0.0.1", lines)
-        self.assertIn("username:s:steamos", lines)
-        self.assertIn("steamos", message)
-        self.assertIn("Developer Mode password", message)
-        self.assertIn("certificate", message)
-        self.assertIn("Connect", message)
-
-    def test_nothing_listening_says_why_and_opens_nothing(self):
-        self.xrdp.close()
-        for name in ("windows", "mac", "linux"):
-            with self.subTest(name), platform(name), self.assertRaises(frame_host.Unreachable) as cm:
-                frame_host.open_rdp("frame", "127.0.0.1")
-            self.assertIn("Developer Mode", str(cm.exception))
-            self.assertIn(f"port {frame_host.RDP_PORT} refused", str(cm.exception))
-        self.assertEqual(self.spawned, [])
-
-    def test_says_which_way_it_failed(self):
-        # Only a refused port says xrdp is off; a wrong address or a silent network say so instead.
-        for error, says in ((socket.gaierror(8, "nodename nor servname provided"), "Devices tab"),
-                            (socket.timeout("timed out"), "didn't answer"),
-                            (OSError(65, "No route to host"), "didn't answer")):
-            with self.subTest(says), mock.patch.object(frame_host.socket, "create_connection", side_effect=error), \
-                    platform("windows"), self.assertRaises(frame_host.Unreachable) as cm:
-                frame_host.open_rdp("frame", "frame.local")
-            self.assertIn(says, str(cm.exception))
-            self.assertNotIn("refused", str(cm.exception))
-        self.assertEqual(self.spawned, [])
-
-    def test_server_says_it_as_the_persons_to_fix(self):
-        # A 400 with the message, not a 500 filed as an error diagnostic.
-        self.xrdp.close()
-        with mock.patch.multiple(server, LOCAL=False, LINK=None, HOST_OPTS=["-o", "HostName=127.0.0.1"]), \
-                self.assertRaises(server.Failure) as cm:
-            server.open_thing({"what": "rdp"})
-        self.assertEqual(cm.exception.status, 400)
-        self.assertIn("Developer Mode", str(cm.exception))
-
-    def test_one_file_per_address(self):
-        with platform("windows"):
-            a, b = frame_host.rdp_file("192.168.1.5"), frame_host.rdp_file("fe80::1%eth0")
-            c, d = frame_host.rdp_file("fe80::1%2"), frame_host.rdp_file("fe80::1:2")
-        self.assertEqual(len({a, b, c, d}), 4)
-        self.assertIn(b"full address:s:192.168.1.5\r\n", a.read_bytes())
-        self.assertIn(b"full address:s:fe80::1%eth0\r\n", b.read_bytes())
-
-    def test_address_cant_add_lines_to_the_file(self):
-        with platform("windows"), self.assertRaises(frame_host.HostError):
-            frame_host.rdp_file("frame\r\nusername:s:root")
-        self.assertEqual(list(self.cache.iterdir()), [])
-
-    def test_linux_clients_get_the_user(self):
-        with platform("linux"), mock.patch.object(frame_host, "which",
-                                                  lambda n, *e: "/usr/bin/xfreerdp" if n == "xfreerdp" else None):
-            message = frame_host.open_rdp("frame", "127.0.0.1")
-        self.assertEqual(self.spawned, [["xfreerdp", "/v:127.0.0.1", "/u:steamos", "/dynamic-resolution"]])
-        self.assertIn("steamos", message)
-
-
-class PageGoneAway(unittest.TestCase):
-    """The report's server log: the page closed while index.html was being sent, and the
-    server logged it as a 500, tried to answer anyway, and filed an error diagnostic."""
-
-    def handler(self, path="/"):
-        h = server.Handler.__new__(server.Handler)
-        h.command, h.path, h.request_version = "GET", path, "HTTP/1.1"
-        h.requestline, h.client_address = f"GET {path} HTTP/1.1", ("127.0.0.1", 1)
-        h.headers = email.message.Message()
-        h.headers["Host"] = "127.0.0.1:1"
-        h.wfile = mock.Mock(write=mock.Mock(side_effect=ConnectionAbortedError(10053, "aborted")))
-        h.close_connection = True
-        return h
-
-    def test_not_a_server_error(self):
-        h = self.handler()
-        with mock.patch.object(server.frame_telemetry, "diagnostic") as diagnostic, \
-                mock.patch.object(sys, "stderr", io.StringIO()), self.assertRaises(server.ClientGone):
-            h.do_GET()
-        diagnostic.assert_not_called()
-        self.assertEqual(h.wfile.write.call_count, 1)  # no second, 500 reply
-
-    def test_server_logs_nothing(self):
-        srv = server.LoopbackServer.__new__(server.LoopbackServer)
-        err = io.StringIO()
-        with mock.patch.object(sys, "stderr", err):
-            try:
-                raise server.ClientGone()
-            except server.ClientGone:
-                srv.handle_error(None, ("127.0.0.1", 1))
-            self.assertEqual(err.getvalue(), "")
-            try:
-                raise RuntimeError("real")
-            except RuntimeError:
-                srv.handle_error(None, ("127.0.0.1", 1))
-        self.assertIn("RuntimeError: real", err.getvalue())
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_release_workflow.py

@@ -1,106 +0,0 @@
-"""The "Create the draft release" step of .github/workflows/release.yml, taken out of
-the workflow and run with bash (as Actions runs it) against a stand-in gh
-(tests/fakegh/gh): a new draft's id comes straight from the POST even when the
-release list doesn't show it yet (v0.4.2's first run), a rerun reuses the draft
-found by tag_name, and a tag that isn't on GitHub stops it. Nothing here talks to
-GitHub.
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import json
-import os
-import shutil
-import subprocess
-import tempfile
-import textwrap
-import unittest
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parent.parent
-WORKFLOW = ROOT / ".github" / "workflows" / "release.yml"
-FAKEGH = ROOT / "tests" / "fakegh"
-STEP = "- name: Create the draft release"
-
-
-def step_script():
-    """The step's `run: |` block, dedented."""
-    lines = WORKFLOW.read_text().splitlines()
-    i = next(n for n, line in enumerate(lines) if line.strip() == STEP)
-    while lines[i].strip() != "run: |":
-        i += 1
-    indent = len(lines[i]) - len(lines[i].lstrip())
-    body = []
-    for line in lines[i + 1:]:
-        if line.strip() and len(line) - len(line.lstrip()) <= indent:
-            break
-        body.append(line)
-    return textwrap.dedent("\n".join(body)).strip() + "\n"
-
-
-def release(rid, tag_name, name="Frame Control 9.8.7", draft=True):
-    return {"id": rid, "tag_name": tag_name, "name": name, "draft": draft, "assets": []}
-
-
-# The step only runs on ubuntu-latest. On Windows `bash` is often the WSL launcher
-# (with no distribution on GitHub's runners), not a bash that can run tests/fakegh.
-@unittest.skipUnless(os.name != "nt" and shutil.which("bash") and shutil.which("jq"),
-                     "needs a POSIX bash and jq (for gh --jq); the step runs on ubuntu only")
-class DraftStep(unittest.TestCase):
-    def run_step(self, releases, tags="v9.8.7", tag="v9.8.7"):
-        d = Path(tempfile.mkdtemp())
-        (d / "step.sh").write_text(step_script())
-        (d / "releases.json").write_text(json.dumps(releases))
-        env = dict(os.environ, PATH="%s:%s" % (FAKEGH, os.environ["PATH"]),
-                   FAKEGH_RELEASES=str(d / "releases.json"), FAKEGH_TAGS=tags,
-                   FAKEGH_LOG=str(d / "log"), GITHUB_REF_NAME=tag, GH_REPO="saphid/frame-control")
-        p = subprocess.run(["bash", "--noprofile", "--norc", "-eo", "pipefail", str(d / "step.sh")],
-                           env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-                           universal_newlines=True, timeout=30)
-        log = [json.loads(line) for line in (d / "log").read_text().splitlines()] if (d / "log").exists() else []
-        return p, log
-
-    def posts(self, log):
-        return [c for c in log if c[1:4] == ["-X", "POST", "repos/saphid/frame-control/releases"]]
-
-    def patches(self, log):
-        return [c for c in log if c[1:3] == ["-X", "PATCH"]]
-
-    def test_new_draft_uses_the_id_the_post_returns(self):
-        # The list doesn't show the fresh draft (it never does in the fake): v0.4.2's case.
-        p, log = self.run_step([])
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        [post] = self.posts(log)
-        for f in ("tag_name=v9.8.7", "name=Frame Control 9.8.7", "draft=true"):
-            self.assertIn(f, post)
-        self.assertIn(["api", "repos/saphid/frame-control/git/ref/tags/v9.8.7"], log)
-        [patch] = self.patches(log)
-        self.assertEqual(patch[3], "repos/saphid/frame-control/releases/9001")
-        self.assertIn("tag_name=v9.8.7", patch)
-        self.assertIn("release 9001 tag_name v9.8.7", p.stdout)
-        self.assertTrue(all(c[0] == "api" for c in log))  # never `gh release ...`
-
-    def test_a_rerun_reuses_the_draft_with_the_tag(self):
-        p, log = self.run_step([release(7, "v9.8.6", "Frame Control 9.8.6"), release(42, "v9.8.7")])
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertEqual(self.posts(log), [])
-        [patch] = self.patches(log)
-        self.assertEqual(patch[3], "repos/saphid/frame-control/releases/42")
-
-    def test_other_releases_alone_mean_a_new_draft(self):
-        p, log = self.run_step([release(7, "v9.8.6", "Frame Control 9.8.6", draft=False),
-                                release(8, "v9.8.70", "Frame Control 9.8.70")])
-        self.assertEqual(p.returncode, 0, p.stderr + p.stdout)
-        self.assertEqual(len(self.posts(log)), 1)
-        self.assertEqual(self.patches(log)[0][3], "repos/saphid/frame-control/releases/9001")
-
-    def test_stops_when_the_tag_is_not_on_github(self):
-        p, log = self.run_step([], tags="")
-        self.assertNotEqual(p.returncode, 0)
-        self.assertIn("tag v9.8.7 isn't on GitHub", p.stderr)
-        self.assertEqual(self.posts(log), [])
-        self.assertEqual(self.patches(log), [])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_sandbox.py

@@ -1,122 +0,0 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import os
-import re
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-import frame_connect  # noqa: E402
-import frame_devices  # noqa: E402
-import frame_host  # noqa: E402
-
-
-def inside(path, folder):
-    path, folder = os.path.realpath(path), os.path.realpath(folder)
-    return path == folder or path.startswith(folder + os.sep)
-
-
-def snapshot(folder):
-    """{relative path: (size, mtime)} for everything under FOLDER."""
-    out = {}
-    for base, dirs, files in os.walk(folder):
-        for name in dirs + files:
-            p = os.path.join(base, name)
-            try:
-                st = os.lstat(p)
-            except OSError:
-                continue
-            out[os.path.relpath(p, folder)] = (st.st_size, st.st_mtime_ns)
-    return out
-
-
-class Sandbox(unittest.TestCase):
-    """Tests once wrote a host-key pin into the real ~/.ssh/frame-control-hosts on every
-    run (a server started without FRAME_CONTROL_SSH_DIR imported the real ~/.ssh/config)."""
-
-    def test_home_and_ssh_dir_are_throwaway(self):
-        tmp = tempfile.gettempdir()
-        self.assertTrue(inside(Path.home(), tmp), Path.home())
-        self.assertTrue(inside(os.path.expanduser("~"), tmp))
-        for d in (frame_devices.ssh_dir(), frame_devices.pin_dir(), frame_connect.SSH_DIR,
-                  os.environ["FRAME_CONTROL_SSH_DIR"], frame_host.cache_dir(), frame_host.data_dir()):
-            self.assertTrue(inside(d, tmp), d)
-            self.assertFalse(inside(d, sandbox.REAL_SSH_DIR), d)
-
-    def test_cache_folders_on_every_platform_are_throwaway(self):
-        """cache_dir() reads LOCALAPPDATA on Windows and XDG_CACHE_HOME on Linux, which a
-        moved HOME alone doesn't cover: servers sweep staging folders there."""
-        tmp = tempfile.gettempdir()
-        for platform in ("MAC", "WINDOWS", None):
-            with mock.patch.object(frame_host, "MAC", platform == "MAC"), \
-                    mock.patch.object(frame_host, "WINDOWS", platform == "WINDOWS"):
-                self.assertTrue(inside(frame_host.cache_dir("apk-sources"), tmp), platform)
-        for name in ("LOCALAPPDATA", "APPDATA", "XDG_CACHE_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME"):
-            self.assertTrue(inside(os.environ[name], tmp), name)
-
-    def test_end_to_end_tests_stay_out_of_it(self):
-        """tests/e2e keeps the container's real home (OpenSSH reads ~/.ssh from the password
-        database, not $HOME), so nothing there may import sandbox, even through a test_* module."""
-        here = Path(__file__).resolve().parent
-        pattern = re.compile(r"^\s*(import sandbox|from sandbox |import test_|from test_)", re.M)
-        for f in [*(here / "e2e").glob("*.py"), *(here / "smoke").glob("*.py"), here / "apk_fixtures.py"]:
-            self.assertIsNone(pattern.search(f.read_text(encoding="utf-8")), f)
-
-    def test_end_to_end_tests_start_no_server_outside_their_container(self):
-        """Plain discovery over tests/e2e, with or without FRAME_E2E=1, must skip everything
-        and never start ui/server.py: outside scripts/e2e.sh's container it would run on
-        this computer's real app data, ~/.ssh and cache."""
-        e2e = str(Path(__file__).resolve().parent / "e2e")
-        code = ("import io, sys, unittest; sys.path.insert(0, sys.argv[1]); import harness; calls = []\n"
-                "harness.Server.start = classmethod(lambda cls: calls.append(cls))\n"
-                "suite = unittest.defaultTestLoader.discover(sys.argv[1], top_level_dir=sys.argv[1])\n"
-                "r = unittest.TextTestRunner(stream=io.StringIO()).run(suite)\n"
-                "print(len(calls), r.testsRun, len(r.skipped), len(r.errors) + len(r.failures))")
-        for extra in ({}, {"FRAME_E2E": "1"}):
-            env = {k: v for k, v in os.environ.items() if not k.startswith("FRAME_E2E")}
-            env.update(extra, PYTHONDONTWRITEBYTECODE="1")
-            out = subprocess.run([sys.executable, "-c", code, e2e], env=env, capture_output=True, text=True,
-                                 timeout=120)
-            self.assertEqual(out.returncode, 0, out.stderr[-2000:])
-            started, ran, skipped, broken = map(int, out.stdout.split())
-            self.assertEqual((started, broken), (0, 0), (extra, out.stdout))
-            self.assertEqual(ran, skipped, (extra, out.stdout))
-            self.assertGreater(skipped, 0, extra)
-
-    def test_child_processes_inherit_it(self):
-        out = subprocess.run(
-            [sys.executable, "-c", "import sys; sys.path.insert(0, sys.argv[1]); import frame_devices, frame_connect;"
-             " from pathlib import Path; print(Path.home()); print(frame_devices.ssh_dir()); print(frame_connect.SSH_DIR)",
-             str(ROOT / "ui")], env={**os.environ, "PYTHONDONTWRITEBYTECODE": "1"},
-            capture_output=True, text=True, check=True).stdout.split("\n")
-        for d in filter(None, out):
-            self.assertFalse(inside(d, sandbox.REAL_SSH_DIR), d)
-            self.assertTrue(inside(d, tempfile.gettempdir()), d)
-
-    def test_real_ssh_folder_untouched_by_tests_that_start_servers(self):
-        """Reruns, from the environment the suite was started in, the tests that used to
-        leak (servers started without FRAME_CONTROL_SSH_DIR) plus the device and connect
-        tests, and checks nothing under the real ~/.ssh changed."""
-        real = sandbox.REAL_SSH_DIR
-        if inside(real, tempfile.gettempdir()):
-            self.skipTest("this run's HOME is already a temporary folder")
-        before = snapshot(real)
-        env = {k: v for k, v in sandbox.ORIGINAL_ENV.items() if k != "FRAME_CONTROL_SSH_DIR"}
-        env["PYTHONDONTWRITEBYTECODE"] = "1"
-        r = subprocess.run([sys.executable, "-m", "unittest", "-q", "test_server.OneServer", "test_server.LocalMode",
-                            "test_devices", "test_connect"],
-                           cwd=str(Path(__file__).resolve().parent), env=env, capture_output=True, text=True,
-                           timeout=300)
-        self.assertEqual(r.returncode, 0, r.stderr[-3000:])
-        after = snapshot(real)
-        changed = sorted(k for k in set(before) | set(after) if before.get(k) != after.get(k)
-                         and not k.startswith("agent"))  # ssh-agent sockets come and go on their own
-        self.assertEqual(changed, [], f"tests changed the real {real}")
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_server.py

@@ -10,7 +10,6 @@ import http.client
 import io
 import json
 import os
-import shutil
 import socket
 import struct
 import subprocess
@@ -112,8 +111,6 @@ class ServerGuards(unittest.TestCase):
             ("/api/volume", {"level": 1.5}),
             ("/api/clipboard", {"text": ""}),
             ("/api/open", {"what": "anything-else"}),
-            ("/api/open", {"what": "shot", "id": "1/250820/../../.ssh/id_ed25519"}),
-            ("/api/open", {"what": "shot"}),
             ("/api/shots/save", {"ids": []}),
             ("/api/shots/save", {"ids": "1/250820/20260925225208_1.jpg"}),
             ("/api/shots/save", {"ids": [1]}),
@@ -124,10 +121,6 @@ class ServerGuards(unittest.TestCase):
             status, payload = self.post(path, body)
             self.assertEqual(status, 400, f"{path} {body} -> {payload}")
 
-    def test_showing_a_shot_needs_it_saved_here(self):
-        status, payload = self.post("/api/open", {"what": "shot", "id": "1/250820/19990101000000_1.jpg"})
-        self.assertEqual(status, 404, payload)
-
     def test_screenshot_ids_checked_before_ssh(self):
         for shot in ("../../etc/passwd", "1/250820/x.jpg", "1/2/20260925225208_1.jpg;id", "1/250820/20260925225208_1.gif"):
             status, _, _ = self.request("GET", f"/api/shots/image?id={quote(shot)}", headers={"X-Frame-UI": "1"})
@@ -286,80 +279,6 @@ class OneServer(unittest.TestCase):
         r = conn.getresponse()
         self.assertEqual(r.status, 403, r.read())
 
-    @unittest.skipIf(os.name == "nt", "no SIGTERM on Windows")
-    def test_sigterm_while_the_app_holds_stdin_exits_cleanly(self):
-        """The app keeps stdin open; a stop signal used to abort Python (SIGABRT) at exit,
-        and later, now and then, crash it (SIGSEGV) while background threads were still
-        loading TLS certificates. Run a few times: that crash came about 1 run in 100."""
-        for attempt in range(5):
-            with self.subTest(attempt=attempt):
-                env = {**os.environ, "FRAME_CONTROL_DATA_DIR": tempfile.mkdtemp(prefix="frame-one-server-"),
-                       "FRAME_ALIAS": "frame-control-test.invalid", "PYTHONFAULTHANDLER": "1"}
-                proc = subprocess.Popen([sys.executable, str(ROOT / "ui" / "server.py"), "--port", "0", "--exit-on-eof"],
-                                        env=env, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-                                        stderr=subprocess.STDOUT, text=True)
-                try:
-                    self.assertIn("Frame Control on", proc.stdout.readline())
-                    proc.terminate()
-                    self.assertEqual(proc.wait(30), 0, proc.stdout.read())
-                finally:
-                    if proc.poll() is None:
-                        proc.kill()
-                        proc.wait()
-                    proc.stdin.close()
-                    proc.stdout.close()
-                    shutil.rmtree(env["FRAME_CONTROL_DATA_DIR"], ignore_errors=True)
-
-    def test_staging_folders_cleared_when_stopped_mid_transfer(self):
-        """The server leaves without interpreter teardown, so TemporaryDirectory cleanup
-        doesn't run for work still in progress: its own staging folders go on the way out,
-        and a dead server's at the next start."""
-        dead = subprocess.Popen([sys.executable, "-c", "pass"])
-        dead.wait()
-        home = tempfile.mkdtemp(prefix="frame-stop-home-")
-        self.addCleanup(shutil.rmtree, home, ignore_errors=True)
-        env = {**os.environ, "FRAME_CONTROL_DATA_DIR": os.path.join(home, "data"),
-               "FRAME_ALIAS": "frame-control-test.invalid", "HOME": home, "XDG_CACHE_HOME": os.path.join(home, ".cache"),
-               "LOCALAPPDATA": home, "APPDATA": home}
-        index_dir = Path(subprocess.run(
-            [sys.executable, "-c", "import sys; sys.path.insert(0, sys.argv[1]); import frame_host; "
-                                   "print(frame_host.cache_dir('apk-sources'))", str(ROOT / "ui")],
-            env=env, capture_output=True, text=True, check=True).stdout.strip())
-        index_dir.mkdir(parents=True)
-        tmp = Path(tempfile.gettempdir())
-
-        def staged(folder, prefix, pid):
-            d = Path(tempfile.mkdtemp(prefix=f"{prefix}{pid}-", dir=folder))
-            self.addCleanup(shutil.rmtree, d, ignore_errors=True)
-            (d / "app.apk").write_bytes(b"\0" * 4096)
-            return d
-
-        # Stopped as the app stops it: by closing stdin (the only way on Windows,
-        # where terminate() is a hard kill) and, elsewhere, by SIGTERM too.
-        for stop in ["stdin"] + (["sigterm"] if os.name != "nt" else []):
-            with self.subTest(stop=stop):
-                left_by_dead = [staged(tmp, "frame-vr-", dead.pid), staged(index_dir, ".download-", dead.pid)]
-                proc = subprocess.Popen([sys.executable, str(ROOT / "ui" / "server.py"), "--port", "0", "--exit-on-eof"],
-                                        env=env, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-                                        stderr=subprocess.STDOUT, text=True)
-                try:
-                    self.assertIn("Frame Control on", proc.stdout.readline())
-                    self.assertEqual([d for d in left_by_dead if d.exists()], [])
-                    in_flight = [staged(tmp, "frame-vr-", proc.pid), staged(tmp, "frame-agent-", proc.pid),
-                                 staged(index_dir, ".download-", proc.pid)]
-                    if stop == "stdin":
-                        proc.stdin.close()
-                    else:
-                        proc.terminate()
-                    self.assertEqual(proc.wait(30), 0, proc.stdout.read())
-                    self.assertEqual([d for d in in_flight if d.exists()], [])
-                finally:
-                    if proc.poll() is None:
-                        proc.kill()
-                        proc.wait()
-                    proc.stdin.close()
-                    proc.stdout.close()
-
 
 class ArtworkSettings(unittest.TestCase):
     """The settings panel's endpoints, with and without the page's X-Frame-UI key."""
@@ -411,59 +330,6 @@ class ArtworkSettings(unittest.TestCase):
         self.assertLess(page.index("async function api("), page.index('<script src="/artwork-settings.js">'))
 
 
-@unittest.skipUnless(shutil.which("node"), "needs node")
-class PageScripts(unittest.TestCase):
-    """A page's scripts share one global scope, where a later function declaration
-    silently replaces an earlier one of the same name. Issue #68: the Devices page's
-    renderDetail replaced the Android store's, so every app opened as an empty
-    dialog (a bare horizontal line). Compiled together as one module, any top-level
-    name declared twice is a SyntaxError; node's parser handles nested scopes,
-    comments and strings."""
-
-    PAGES = ("index.html", "assistant.html", "mac-view.html")
-
-    @staticmethod
-    def page_scripts(html):
-        """A page's inline scripts, then its /*.js scripts, in one source."""
-        import re
-        parts = re.findall(r"<script>([\s\S]*?)</script>", html)
-        parts += [(ROOT / "ui" / src).read_text(encoding="utf-8") for src in re.findall(r'<script src="/([\w.-]+\.js)">', html)]
-        return "\n;\n".join(parts)
-
-    @staticmethod
-    def module_check(source):
-        with tempfile.TemporaryDirectory() as tmp:
-            path = Path(tmp) / "page.mjs"
-            path.write_text(source, encoding="utf-8")
-            r = subprocess.run(["node", "--check", str(path)], capture_output=True, text=True)
-        return r.returncode, r.stderr
-
-    def test_the_check_catches_top_level_duplicates_only(self):
-        dup = "<script>function a() {}\nfunction a() {}</script>"
-        across = "<script>function a() {}</script><p>x</p><script>  async function a() {}</script>"
-        same_line = "<script>function a() {} function a() {}</script>"
-        const_and_function = "<script>const a = 1, b = 2;\nfunction b() {}</script>"
-        for html in (dup, across, same_line, const_and_function):
-            rc, err = self.module_check(self.page_scripts(html))
-            self.assertNotEqual(rc, 0, html)
-            self.assertIn("has already been declared", err, html)
-        nested = ("<script>function a() {}\nfunction f() { function a() {} if (1) { const a = 2; } }\n"
-                  "// function a() {}\nconst s = `function a() {}`;</script>")
-        self.assertEqual(self.module_check(self.page_scripts(nested)), (0, ""))
-
-    def test_no_top_level_name_is_declared_twice(self):
-        for name in self.PAGES:
-            source = self.page_scripts((ROOT / "ui" / name).read_text(encoding="utf-8"))
-            self.assertIn("function", source, name)
-            rc, err = self.module_check(source)
-            self.assertEqual(rc, 0, f"{name}: {err}")
-
-    def test_store_app_page_renders(self):
-        """tests/page/store_detail.mjs runs the real store functions from index.html."""
-        r = subprocess.run(["node", str(ROOT / "tests" / "page" / "store_detail.mjs")], capture_output=True, text=True)
-        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-
-
 @unittest.skipIf(os.name == "nt", "runs on the Frame (Linux); local-bin/ssh is a POSIX shell script")
 class LocalMode(unittest.TestCase):
     """FRAME_LOCAL=1, as the iPhone app starts the server on the Frame: its own key
@@ -535,11 +401,7 @@ class UnreachableMessages(unittest.TestCase):
             "ssh: connect to host 192.168.1.9 port 22: No route to host": "isn't answering",
             "ssh: connect to host 192.168.1.9 port 22: Connection refused": "refused",
             "steamos@192.168.1.9: Permission denied (publickey,password).": "SSH key",
-            "Host key verification failed.": "identity has changed",
-            "@@@@\n@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\nHost key verification failed.":
-                "Check the new key on the Devices tab",
-            "No ED25519 host key is known for frame-control-f7b4e9ac and you have requested strict checking.\n"
-            "Host key verification failed.": "isn't saved yet",
+            "Host key verification failed.": "identity changed",
             "kex_exchange_identification: read: Connection reset by peer": "dropped",
             "Timed out talking to frame": "too long",
         }
@@ -555,47 +417,6 @@ class UnreachableMessages(unittest.TestCase):
             self.assertEqual(self.server.error_body(raw), ({"error": raw}, None), raw)
 
 
-class ClipboardDesktopClosed(unittest.TestCase):
-    """The headset's desktop being closed is the person's to fix: a 409, not a 5xx fault for telemetry."""
-
-    @classmethod
-    def setUpClass(cls):
-        sys.path.insert(0, str(ROOT / "ui"))
-        import server
-        cls.server = server
-
-    def paste_failing_with(self, message):
-        s = self.server
-        saved = s.ssh
-
-        def fake_ssh(remote, **kw):
-            raise s.Failure(message)
-        s.ssh = fake_ssh
-        try:
-            s.clipboard({"text": "hello"})
-        finally:
-            s.ssh = saved
-
-    def test_desktop_closed_is_a_409(self):
-        with self.assertRaises(self.server.Failure) as cm:
-            self.paste_failing_with("The headset's desktop isn't open (plasmashell is not running). "
-                                    "Open the desktop in the headset, then try again.")
-        self.assertEqual(cm.exception.status, 409)
-        self.assertIn("Open the desktop", str(cm.exception))
-        # Older wording (scripts/paste-to-frame.sh) is recognised too.
-        with self.assertRaises(self.server.Failure) as cm:
-            self.paste_failing_with("plasmashell is not running: open the desktop in the headset first.")
-        self.assertEqual(cm.exception.status, 409)
-
-    def test_other_failures_stay_faults(self):
-        with self.assertRaises(self.server.Failure) as cm:
-            self.paste_failing_with("Klipper call failed (bus: none)")
-        self.assertEqual(cm.exception.status, 502)
-
-    def test_paste_script_says_it(self):
-        self.assertIn(self.server.DESKTOP_CLOSED, self.server.PASTE)
-
-
 class StatusProbe(unittest.TestCase):
     # frame_status.py only ever runs on the Frame (Linux); it needs os.statvfs.
     @unittest.skipIf(os.name == "nt", "Frame-side script; POSIX only")

tests/test_sidequest.py

@@ -1,4 +1,3 @@
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 from pathlib import Path
 import sys

tests/test_telemetry.py

@@ -6,7 +6,6 @@ Run: python3 -m unittest discover -s tests
 import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
 import os
-import subprocess
 import sys
 import tempfile
 import threading
@@ -21,15 +20,9 @@ sys.path.insert(0, str(ROOT / "ui"))
 
 import frame_compat_db as db  # noqa: E402
 import frame_report as fr  # noqa: E402
-import frame_host  # noqa: E402
 import frame_telemetry as tm  # noqa: E402
 
 
-def link_error(message, kind=RuntimeError):
-    """An error as an ssh helper raises it when ssh couldn't reach the headset."""
-    return frame_host.link_failure(kind(message))
-
-
 class Base(unittest.TestCase):
     """A packaged build with a key, its state in a temp folder."""
 
@@ -99,47 +92,6 @@ class Gates(Base):
             tm.diagnostic("POST /api/android install", RuntimeError("boom"))
         self.assertEqual(len(self.queued()), 1)
 
-    def test_connection_failures_are_sent_once_per_session(self):
-        # The status poll meets an asleep or absent headset every few seconds (638 timeouts from
-        # six people in two weeks): one event per kind per session, whatever the address or route,
-        # for errors marked where ssh ran as ssh failing to reach the headset.
-        tm.update_settings({"diagnostics": True})
-        with mock.patch.object(tm.time, "time", return_value=1000.0):
-            for ip in ("192.168.1.20", "192.168.1.21", "10.0.0.5"):
-                for where in ("POST /api/comfort status", "job steam"):
-                    tm.diagnostic(where, link_error(f"ssh: connect to host {ip} port 22: Connection timed out"))
-                    tm.diagnostic(where, link_error(f"ssh: connect to host {ip} port 22: Host is down"))
-                    tm.diagnostic(where, link_error("Timed out talking to frame"))
-            tm.diagnostic("POST /api/comfort status",
-                          link_error("ssh: Could not resolve hostname frame: No such host is known."))
-        with mock.patch.object(tm.time, "time", return_value=1000.0 + 10 * tm.REPEAT_WINDOW):
-            tm.diagnostic("POST /api/comfort status", link_error("client_loop: send disconnect: Connection reset"))
-            tm.diagnostic("POST /api/comfort status", link_error("ssh: Could not resolve hostname frame"))
-        sent = [e["properties"] for e in self.queued()]
-        self.assertEqual([p["error_category"] for p in sent], ["frame_unreachable", "frame_not_set_up"])
-        self.assertTrue(all(p["$exception_message"].startswith("ssh: ") for p in sent))
-
-    def test_only_marked_errors_are_held_for_the_session(self):
-        # The same words without the mark (from a download, a file name, anything not ssh) keep
-        # the usual 10-minute window.
-        tm.update_settings({"diagnostics": True})
-        tm.diagnostic("POST /api/comfort status", link_error("ssh: connect to host 10.0.0.5 port 22: Connection timed out"))
-        tm.diagnostic("job web", RuntimeError("ssh: connect to host 10.0.0.5 port 22: Connection timed out"))
-        tm.diagnostic("job web", RuntimeError("ssh: connect to host 10.0.0.5 port 22: Connection timed out"))
-        tm.diagnostic("job web", RuntimeError("download failed: [Errno 54] Connection reset by peer"))
-        tm.diagnostic("job web", RuntimeError("urlopen error [Errno 60] Operation timed out"))
-        self.assertEqual([e["properties"]["error_category"] for e in self.queued()],
-                         ["frame_unreachable", "frame_unreachable", "download_failed", "frame_unreachable"])
-
-    def test_real_errors_are_still_sent_beside_connection_failures(self):
-        tm.update_settings({"diagnostics": True})
-        tm.diagnostic("POST /api/comfort status", link_error("ssh: connect to host 10.0.0.5 port 22: Connection timed out"))
-        tm.diagnostic("POST /api/comfort status", KeyError("battery"))
-        tm.diagnostic("POST /api/android install", RuntimeError("boom"))
-        tm.diagnostic("POST /api/comfort status", RuntimeError("ssh exited 255"))  # the command's own exit code?
-        self.assertEqual([e["properties"]["error_category"] for e in self.queued()],
-                         ["frame_unreachable", "internal_error", "other", "other"])
-
     def test_page_events_are_checked(self):
         self.assertTrue(tm.page_event({"event": "tab_viewed", "properties": {"tab": "android", "extra": "x"}})["queued"])
         self.assertEqual(self.queued()[0]["properties"].get("extra"), None)
@@ -164,38 +116,6 @@ class Lifecycle(Base):
         tm.frame_seen("20260922.1", "3.8")
         self.assertEqual(len(self.queued()), 1)
 
-    def test_frame_once_per_headset_with_saved_count(self):
-        tm.frame_seen("20260922.1", "3.8", "0123456789abcdef", 2)
-        tm.frame_seen("20260922.1", "3.8", "0123456789abcdef", 2)
-        tm.frame_seen("20260922.1", "3.8", "fedcba9876543210", 2)
-        props = [e["properties"] for e in self.queued()]
-        self.assertEqual([(p["headset_id"], p["headsets_saved"]) for p in props],
-                         [("0123456789abcdef", 2), ("fedcba9876543210", 2)])
-
-    def test_frame_many_headsets_are_not_sent_twice(self):
-        ids = ["%016x" % n for n in range(25)]
-        for _ in range(2):
-            for h in ids:
-                tm.frame_seen("20260922.1", "3.8", h, 25)
-        self.assertEqual(len(self.queued()), 25)
-
-    def test_frame_headset_id_must_be_the_hash(self):
-        tm.frame_seen("20260922.1", "3.8", "/etc/machine-id contents", None)
-        p = self.queued()[0]["properties"]
-        self.assertNotIn("headset_id", p)
-        self.assertNotIn("headsets_saved", p)
-
-
-class HeadsetId(unittest.TestCase):
-    def test_hash_of_machine_id_and_none_without_one(self):
-        import hashlib
-        import frame_status
-        with mock.patch.object(frame_status, "read", return_value="abc123"):
-            self.assertEqual(frame_status.headset_id(),
-                             hashlib.sha256(b"frame-control-headset:abc123").hexdigest()[:16])
-        with mock.patch.object(frame_status, "read", return_value=None):
-            self.assertIsNone(frame_status.headset_id())
-
 
 class Sending(Base):
     def serve(self, status=200):
@@ -260,107 +180,6 @@ class Scrub(unittest.TestCase):
                          "frame_unreachable")
         self.assertEqual(tm.categorize("something new")[0], "other")
 
-    def test_connection_failures_seen_from_released_versions(self):
-        # Wording from 0.4.0's error reports (addresses replaced), on Windows, macOS and Linux.
-        unreachable = [
-            "ssh: connect to host 192.168.1.20 port 22: Connection timed out",
-            "ssh: connect to host 192.168.1.20 port 22: Operation timed out",
-            "ssh: connect to host 192.168.1.20 port 22: No route to host",
-            "ssh: connect to host 192.168.1.20 port 22: Host is down",
-            "ssh: connect to host 192.168.1.20 port 22: Unknown error",
-            "mux_client_request_session: read from master failed: Broken pipe\n"
-            "ssh: connect to host 192.168.1.20 port 22: Host is down",
-            "client_loop: send disconnect: Connection reset",
-            "banner exchange: Connection to UNKNOWN port -1: Connection refused",
-            "Timed out talking to frame",
-        ]
-        for message in unreachable:
-            self.assertEqual(tm.categorize(message)[0], "frame_unreachable", message)
-        for message in ("ssh: Could not resolve hostname frame: No such host is known.",
-                        "ssh: Could not resolve hostname fe80::1%wireless_32773: No such host is known."):
-            self.assertEqual(tm.categorize(message)[0], "frame_not_set_up", message)
-        self.assertEqual(tm.categorize("ssh exited 1")[0], "other")
-        self.assertEqual(tm.categorize("ssh exited 255")[0], "other")  # may be the command's own exit code
-        self.assertEqual(tm.categorize("download failed: [Errno 54] Connection reset by peer")[0], "download_failed")
-        self.assertEqual(tm.categorize("frame@10.0.0.2: Permission denied (publickey).")[0], "frame_auth")
-
-    def test_install_failure_categories(self):
-        import frame_android
-        self.assertEqual(tm.categorize(frame_android.LayerMissing(frame_android.LAYER_MISSING))[0], "layer_missing")
-        # The message 0.4.0 sent, so old and new builds land in the same bucket.
-        self.assertEqual(tm.categorize("the OpenXR compatibility layer isn't built; run "
-                                       "frame/openxr-compat/build.sh")[0], "layer_missing")
-        self.assertEqual(tm.categorize("could not prepare the APK for the Frame: ZIP64 APKs are unsupported")[0],
-                         "apk_repack_failed")
-        self.assertEqual(tm.categorize(FileNotFoundError(2, "No such file or directory", "ssh"))[0], "tool_missing")
-        self.assertEqual(tm.categorize("[WinError 2] The system cannot find the file specified")[0], "tool_missing")
-
-    def test_apk_install_failures_that_were_other(self):
-        """What frame_android.install can raise, worded as it is, that 0.4.x sent as 'other'
-        (or as frame_unreachable, when it was the Steam client or a slow copy)."""
-        tail = 'Traceback (most recent call last):\n  File "<stdin>", line 19, in target_ws\n'
-        cases = {
-            "steam_not_running": [
-                "SharedJSContext not found: is the Steam client running?",
-                tail + "urllib.error.URLError: <urlopen error [Errno 111] Connection refused>",
-                tail + "ConnectionRefusedError: [Errno 111] Connection refused",
-            ],
-            "steam_not_responding": [
-                "websocket handshake failed",
-                tail + "TimeoutError: timed out",
-                tail + "socket.timeout: timed out",
-                tail + '  File "<stdin>", line 45, in _read\nEOFError',
-            ],
-            "steam_js_error": ['JS error: {"exceptionId": 1, "text": "Uncaught", "exception": '
-                               '{"description": "Error: Steam artwork API unavailable; installation is incomplete"}}'],
-            "artwork_failed": [
-                "Steam artwork renderer did not produce every slot",
-                tail + "ValueError: incomplete artwork render",
-                tail + "ValueError: hero render is 0 bytes of png",
-                "could not prepare artwork: unknown artwork slot",
-                tail + "ValueError: all five Steam artwork slots are required",
-            ],
-            "copy_timeout": ["copying Big Game (timed out).apk to the Frame timed out",
-                             "copying launch.sh to the Frame timed out"],
-            "copy_failed": [
-                "copying game.apk to the Frame failed: rsync: connection unexpectedly closed (0 bytes received "
-                "so far) [sender]\nrsync error: error in rsync protocol data stream (code 12) at io.c(231)",
-                "copying game.apk to the Frame failed: ",
-            ],
-            "apk_unreadable": [
-                "x.apk: not a readable APK: [Errno 2] No such file or directory: 'x.apk'",
-                "x.apk: could not read the APK manifest: Error -3 while decompressing data: invalid block type",
-                "x.apk: the APK manifest has no package name",
-                "x.apk: lib/arm64-v8a/libx.so in the APK uses a compression Android does not",
-                "x.apk: AndroidManifest.xml in the APK is 40 MB, more than a real one (16 MB)",
-            ],
-        }
-        for category, messages in cases.items():
-            for message in messages:
-                self.assertEqual(tm.categorize(message)[0], category, message)
-        # Still where they were: ssh's own failures, and a full disk during a copy.
-        self.assertEqual(tm.categorize("timed out talking to frame")[0], "frame_unreachable")
-        self.assertEqual(tm.categorize("copying a.apk to the Frame failed: ssh: connect to host 10.0.0.2 "
-                                       "port 22: Connection refused")[0], "frame_unreachable")
-        self.assertEqual(tm.categorize("copying a.apk to the Frame failed: rsync: write failed on "
-                                       "\"app.apk.part\": No space left on device (28)")[0], "frame_disk_full")
-        self.assertEqual(tm.categorize("download failed: timed out")[0], "download_failed")
-
-    def test_python_errors_are_internal_whatever_they_say(self):
-        import json as _json
-        for error in (KeyError("paths"), TypeError("'NoneType' object is not subscriptable"),
-                      AttributeError("x"), _json.JSONDecodeError("Expecting value", "", 0),
-                      UnicodeDecodeError("utf-8", b"\xff", 0, 1, "invalid start byte"),
-                      KeyError("timed out")):
-            self.assertEqual(tm.categorize(error)[0], "internal_error", repr(error))
-        self.assertEqual(tm.categorize("KeyError: 'paths'")[0], "other")  # only the exception itself
-        self.assertEqual(tm.categorize(OSError(28, "No space left on device"))[0], "frame_disk_full")
-
-    def test_privacy_doc_lists_every_category(self):
-        doc = (ROOT / "docs" / "privacy.md").read_text()
-        for name in {n for n, _ in tm.CATEGORIES} | {"internal_error", "other"}:
-            self.assertIn(f"`{name}`", doc)
-
 
 class Compat(Base):
     def test_reports_are_shared_only_after_opting_in_without_file_names(self):
@@ -386,278 +205,6 @@ class Compat(Base):
         self.assertEqual([e["properties"]["id"] for e in self.queued() if e["event"] == "compat_report"], ["old1"])
 
 
-class LinkFailureProvenance(Base):
-    """Only ssh, where it runs, decides that it couldn't reach the headset; the error report
-    then holds that back for the session. Nothing in a message can claim it."""
-
-    def setUp(self):
-        super().setUp()
-        import frame_android
-        import frame_webinstall
-        import server
-        self.server, self.android, self.web = server, frame_android, frame_webinstall
-        for target, name, kw in ((server, "ensure_master", {}), (server, "LINK", {"new": None}),
-                                 (server, "repair_ssh_config", {"return_value": False})):
-            p = mock.patch.object(target, name, **kw)
-            p.start()
-            self.addCleanup(p.stop)
-        tm.update_settings({"diagnostics": True})
-
-    def ssh_fails(self, module, returncode, stderr, stdout=""):
-        """Run module.ssh with ssh exiting `returncode`; -> the exception, as the route handler gets it."""
-        done = subprocess.CompletedProcess(["ssh"], returncode, stdout, stderr)
-        with mock.patch.object(frame_host, "run_ssh", return_value=done):
-            try:
-                module.ssh("true")
-            except Exception as e:  # noqa: BLE001
-                return e
-        self.fail("ssh did not raise")
-
-    def poll_fails(self):
-        e = self.ssh_fails(self.server, 255, "ssh: connect to host 10.0.0.5 port 22: Connection timed out\r\n")
-        tm.diagnostic("POST /api/comfort status", e)
-
-    def test_a_status_poll_that_cannot_reach_the_frame_is_sent_once(self):
-        for _ in range(5):
-            self.poll_fails()
-        for stderr in ("Warning: Permanently added '10.0.0.5' (ED25519) to the list of known hosts.\r\n"
-                       "kex_exchange_identification: read: Connection reset by peer\r\n",
-                       "banner exchange: Connection to UNKNOWN port -1: Connection refused\r\n",
-                       "\x1b[0mssh: connect to host 10.0.0.5 port 22: Unknown error\n"):
-            tm.diagnostic("POST /api/comfort status", self.ssh_fails(self.server, 255, stderr))
-        with mock.patch.object(frame_host, "run_ssh", side_effect=subprocess.TimeoutExpired("ssh", 30)):
-            with self.assertRaises(self.server.Failure) as caught:
-                self.server.ssh("true")
-        tm.diagnostic("POST /api/comfort status", caught.exception)
-        e = self.ssh_fails(self.android, 255, "ssh: connect to host 10.0.0.5 port 22: Host is down\n")
-        tm.diagnostic("job steam", e)
-        self.assertEqual([p["properties"]["error_category"] for p in self.queued()], ["frame_unreachable"])
-
-    def test_host_key_and_login_refusals_are_sent_once(self):
-        # 0.4.2: each of these came in as a $exception from the status poll, again every 10 minutes.
-        for _ in range(3):
-            for stderr in ("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n"
-                           "@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\r\n"
-                           "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\r\nHost key verification failed.\r\n",
-                           "No ED25519 host key is known for frame-control-f7b4e9ac and you have requested strict "
-                           "checking.\r\nHost key verification failed.\r\n",
-                           "jane doe@frame-control-f7b4e9ac: Permission denied (publickey,password).\r\n",
-                           "steamos@192.168.1.9: Permission denied (publickey,password).\n"):
-                e = self.ssh_fails(self.server, 255, stderr)
-                self.assertTrue(getattr(e, "frame_link_failed", False), stderr)
-                tm.diagnostic("POST /api/comfort status", e)
-        self.assertEqual([p["properties"]["error_category"] for p in self.queued()], ["frame_auth"])
-        # A command on the Frame that was refused something isn't ssh refusing the headset.
-        for code, stderr in ((1, "steamos@frame: Permission denied (publickey).\n"),
-                             (255, "cat: /root/x: Permission denied\n"),
-                             (255, "scp: /home/steamos/x: Permission denied\n")):
-            self.assertFalse(getattr(self.ssh_fails(self.server, code, stderr), "frame_link_failed", False), stderr)
-
-    def test_a_command_that_fails_on_the_frame_is_not_marked(self):
-        self.poll_fails()
-        for module in (self.server, self.android):
-            for code, stderr in ((255, ""), (255, "x: ssh: connect to host frame port 22: Connection timed out\n"),
-                                 (1, "ssh: connect to host 10.0.0.5 port 22: Connection timed out\n")):
-                e = self.ssh_fails(module, code, stderr)
-                self.assertFalse(getattr(e, "frame_link_failed", False), (module.__name__, code, stderr))
-            # Review round 4: the command's own output (stdout) isn't ssh speaking.
-            e = self.ssh_fails(module, 255, "", stdout="ssh: connect to host frame port 22: Connection timed out\n")
-            self.assertFalse(getattr(e, "frame_link_failed", False), module.__name__)
-
-    def request(self, path, body):
-        """POST to the real server, as the page does."""
-        import http.client
-        c = http.client.HTTPConnection("127.0.0.1", self.httpd.server_port)
-        c.request("POST", path, json.dumps(body), {"X-Frame-UI": self.server.UI_KEY, "Content-Type": "application/json"})
-        r = c.getresponse()
-        result = r.status, json.loads(r.read())
-        c.close()
-        return result
-
-    def serve(self):
-        self.httpd = self.server.ThreadingHTTPServer(("127.0.0.1", 0), self.server.Handler)
-        threading.Thread(target=self.httpd.serve_forever, daemon=True).start()
-        self.addCleanup(self.httpd.server_close)
-        self.addCleanup(self.httpd.shutdown)
-
-    def test_routes_that_rewrap_a_link_failure_keep_its_mark(self):
-        # Review round 4: /api/android and /api/titles re-raise frame_android's FrameError as a
-        # Failure; after the first connection failure, theirs are held back too, also past the
-        # 10-minute window.
-        self.serve()
-        down = subprocess.CompletedProcess(["ssh"], 255, "", "ssh: connect to host 10.0.0.5 port 22: Connection timed out\r\n")
-        meta = {"label": "Test App", "game_id": 5, "shortcut": None}
-        with mock.patch.object(frame_host, "run_ssh", return_value=down), \
-                mock.patch.object(self.android, "_meta_or_fail", return_value=meta), \
-                mock.patch.object(self.server.frame_titles, "ensure_utils"):
-            self.assertEqual(self.request("/api/comfort", {"action": "status"})[0], 503)  # the page shows its offline message
-            for t in (1000.0, 1000.0 + 2 * tm.REPEAT_WINDOW):
-                with mock.patch.object(tm.time, "time", return_value=t):
-                    self.assertEqual(self.request("/api/android", {"action": "launch", "package": "org.test"})[0], 503)
-                    self.assertEqual(self.request("/api/titles", {"action": "launch", "id": "mygame"})[0], 503)
-            # Not a link failure: still reported, through the same re-wrap.
-            with mock.patch.object(self.android, "_meta_or_fail", side_effect=self.android.FrameError("boom")):
-                self.assertEqual(self.request("/api/android", {"action": "launch", "package": "org.test"})[0], 502)
-        sent = [(e["properties"]["where"], e["properties"]["error_category"]) for e in self.queued()
-                if e["event"] == "$exception"]
-        # The comfort poll's own failure isn't one (see the next test).
-        self.assertEqual(sent, [("POST /api/android launch", "frame_unreachable"), ("POST /api/android launch", "other")])
-
-    def test_the_comfort_poll_meeting_an_unreachable_frame_is_not_sent(self):
-        # 0.4.2: most reports were this poll (every 5 s) finding the headset asleep, away or
-        # refusing ssh. Like GET /api/status, it isn't reported; a session started or cancelled
-        # by hand still is, once, and a real failure of the poll is too.
-        self.serve()
-        for stderr in ("ssh: connect to host 10.0.0.5 port 22: Connection timed out\r\n",
-                       "banner exchange: Connection to UNKNOWN port -1: Connection refused\r\n",
-                       "ssh: Could not resolve hostname frame: nodename nor servname provided\r\n",
-                       "@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\r\nHost key verification failed.\r\n",
-                       "No ED25519 host key is known for frame-control-f7b4e9ac and you have requested strict "
-                       "checking.\r\nHost key verification failed.\r\n",
-                       "steamos@192.168.1.9: Permission denied (publickey,password).\r\n"):
-            down = subprocess.CompletedProcess(["ssh"], 255, "", stderr)
-            with mock.patch.object(frame_host, "run_ssh", return_value=down):
-                self.assertGreaterEqual(self.request("/api/comfort", {"action": "status"})[0], 500, stderr)
-        self.assertEqual(self.queued(), [])
-        down = subprocess.CompletedProcess(["ssh"], 255, "", "ssh: connect to host 10.0.0.5 port 22: Host is down\r\n")
-        with mock.patch.object(frame_host, "run_ssh", return_value=down):
-            self.request("/api/comfort", {"action": "cancel"})
-        broken = subprocess.CompletedProcess(["ssh"], 1, "", "Traceback (most recent call last):\nOSError: boom\n")
-        with mock.patch.object(frame_host, "run_ssh", return_value=broken):
-            self.assertEqual(self.request("/api/comfort", {"action": "status"})[0], 502)
-        sent = [(e["properties"]["where"], e["properties"]["error_category"]) for e in self.queued()
-                if e["event"] == "$exception"]
-        self.assertEqual(sent, [("POST /api/comfort cancel", "frame_unreachable"), ("POST /api/comfort status", "other")])
-
-    def test_download_failures_after_a_poll_failure_are_still_sent(self):
-        # Review round 3: these file names, in the real checksum message through the web-link worker,
-        # were held back with the poll's connection failures.
-        self.poll_fails()
-        names = ("Connection closed by frame port 22.zip", "Connection reset by frame port 22.apk",
-                 "kex_exchange_identification: read.zip", "banner exchange: payload.zip",
-                 "ssh: connect to host frame port 22: x.zip", "Timed out talking to frame")
-        for name in names:
-            job = {"phase": "download", "done": 0, "total": None, "detail": "", "message": None, "error": None,
-                   "cancel": False}
-            plan = {"name": None, "exe": None, "url": "https://example.com/x.zip", "kind": "zip"}
-            error = self.web.WebInstallError(f"{name} doesn't match the manifest's sha256; not installing it")
-            with mock.patch.object(self.web, "download", side_effect=error):
-                self.server._webinstall_run(plan, job)
-            self.assertEqual(job["phase"], "error")
-        exceptions = [e["properties"] for e in self.queued() if e["event"] == "$exception"]
-        self.assertEqual([p["error_category"] for p in exceptions], ["frame_unreachable"] + ["download_failed"] * len(names))
-        finished = [e["properties"] for e in self.queued() if e["event"] == "install_finished"]
-        self.assertEqual({p["error_category"] for p in finished}, {"download_failed"})
-
-
-class InstallFinished(unittest.TestCase):
-    def test_failure_category_only_no_text(self):
-        """install_finished carries a fixed category for a failure, never the message or a file name."""
-        import frame_android
-        with mock.patch.object(tm, "capture") as capture, mock.patch.object(tm, "diagnostic"):
-            tm.install_finished("apk", False, 0.0, frame_android.LayerMissing(
-                "C:\\Users\\Bob\\My Game.apk: " + frame_android.LAYER_MISSING), catalog=False)
-            props = capture.call_args[0][1]
-            self.assertEqual(props["error_category"], "layer_missing")
-            self.assertNotIn("Bob", repr(props))
-            self.assertEqual(set(props), {"kind", "ok", "seconds", "error_category", "catalog"})
-            tm.install_finished("apk", False)
-            self.assertEqual(capture.call_args[0][1]["error_category"], "other")
-
-
-class ApkInstallJobs(unittest.TestCase):
-    """The whole job path: what the page is told, and what telemetry sends, once."""
-
-    def setUp(self):
-        import frame_android
-        import frame_webinstall
-        import server
-        self.server, self.android, self.web = server, frame_android, frame_webinstall
-        for target, name, kw in ((server, "ensure_master", {}), (server.frame_catalog, "app", {}),
-                                 (server.frame_catalog, "add_report", {})):
-            p = mock.patch.object(target, name, **kw)
-            p.start()
-            self.addCleanup(p.stop)
-
-    def run_job(self, body):
-        job = self.server.android(body)["job"]
-        for _ in range(500):
-            with self.server._jobs_lock:
-                state = dict(self.server._jobs[job])
-            if state["done"]:
-                return state
-            time.sleep(0.01)
-        self.fail("job did not finish")
-
-    def test_missing_layer_warning_reaches_every_completion_message(self):
-        meta = {"label": "VR", "package": "org.test.vr", "vr_issues": [self.android.LAYER_MISSING_NOTE]}
-        with mock.patch.object(self.server.frame_catalog, "install", return_value=meta):
-            state = self.run_job({"action": "install", "package": "org.test.vr"})
-        self.assertIsNone(state["error"])
-        self.assertIn(self.android.LAYER_MISSING_NOTE, state["message"])
-        with mock.patch.object(self.server.frame_apk_versions, "install", return_value=meta):
-            state = self.run_job({"action": "install", "package": "org.test.vr", "url": "https://example.com/v.apk"})
-        self.assertIn(self.android.LAYER_MISSING_NOTE, state["message"])
-        with mock.patch.object(self.android, "install", return_value=meta):
-            self.assertIn(self.android.LAYER_MISSING_NOTE, self.web.dispatch("/tmp/v.apk")["message"])
-        # A normal install says nothing about the layer.
-        with mock.patch.object(self.server.frame_catalog, "install", return_value=dict(meta, vr_issues=[])):
-            state = self.run_job({"action": "install", "package": "org.test.vr"})
-        self.assertNotIn("OpenXR", state["message"])
-
-    def test_unexpected_failure_is_one_event_and_one_diagnostic(self):
-        info = {"package": "org.test.flat", "label": "Flat", "abis": [], "min_sdk": None, "vr": False,
-                "vr_activity": False, "launchable": True, "repairable": False}
-        sent = []
-        tm._seen_errors.clear()
-        with mock.patch.object(tm, "enabled", return_value=True), \
-                mock.patch.object(tm, "capture", side_effect=lambda e, p=None, level="usage": sent.append((e, p))), \
-                mock.patch.object(self.android, "apk_info", side_effect=lambda path: dict(info)), \
-                mock.patch.object(self.android, "_install",
-                                  side_effect=FileNotFoundError(2, "No such file or directory", "scp")), \
-                mock.patch.object(self.server.frame_catalog, "install",
-                                  side_effect=lambda pkg: self.android.install("/tmp/x.apk")):
-            state = self.run_job({"action": "install", "package": "org.test.flat"})
-        self.assertIn("FileNotFoundError", state["error"])
-        events = [e for e, _ in sent]
-        self.assertEqual(events.count("install_finished"), 1)
-        self.assertEqual(events.count("$exception"), 1, events)
-        finished = next(p for e, p in sent if e == "install_finished")
-        self.assertEqual((finished["ok"], finished["error_category"]), (False, "tool_missing"))
-        # The same failure through a web link: one event and one diagnostic there too.
-        sent.clear()
-        tm._seen_errors.clear()
-        job = {"phase": "download", "done": 0, "total": None, "detail": "", "message": None, "error": None,
-               "cancel": False}
-        plan = {"name": None, "exe": None, "url": "https://example.com/x.apk", "kind": "apk"}
-        with mock.patch.object(tm, "enabled", return_value=True), \
-                mock.patch.object(tm, "capture", side_effect=lambda e, p=None, level="usage": sent.append((e, p))), \
-                mock.patch.object(self.android, "apk_info", side_effect=lambda path: dict(info)), \
-                mock.patch.object(self.android, "_install",
-                                  side_effect=FileNotFoundError(2, "No such file or directory", "scp")), \
-                mock.patch.object(self.server.frame_webinstall, "download",
-                                  side_effect=lambda plan, tmp, **kw: os.path.join(tmp, "x.apk")):
-            self.server._webinstall_run(plan, job)
-        self.assertEqual(job["phase"], "error")
-        self.assertIn("FileNotFoundError", job["error"])
-        events = [e for e, _ in sent]
-        self.assertEqual(events.count("install_finished"), 1, events)
-        self.assertEqual(events.count("$exception"), 1, events)
-        finished = next(p for e, p in sent if e == "install_finished")
-        self.assertEqual((finished["kind"], finished["error_category"]), ("apk", "tool_missing"))
-        # A FrameError still gets its install diagnostic (the job reports it as well, as before).
-        sent.clear()
-        tm._seen_errors.clear()
-        with mock.patch.object(tm, "enabled", return_value=True), \
-                mock.patch.object(tm, "capture", side_effect=lambda e, p=None, level="usage": sent.append((e, p))), \
-                mock.patch.object(self.android, "apk_info", side_effect=lambda path: dict(info)), \
-                mock.patch.object(self.android, "_install", side_effect=self.android.FrameError("timed out talking to frame")), \
-                mock.patch.object(self.server.frame_catalog, "install",
-                                  side_effect=lambda pkg: self.android.install("/tmp/x.apk")):
-            self.run_job({"action": "install", "package": "org.test.flat"})
-        self.assertEqual([e for e, _ in sent].count("install_finished"), 1)
-
-
 class ApkInstallReports(unittest.TestCase):
     """server.apk_installed: an APK that won't install is reported; connection trouble isn't."""
 
@@ -677,12 +224,6 @@ class ApkInstallReports(unittest.TestCase):
         self.assertEqual((args[0], args[1], kw["result"], kw["via"]), ("org.x", "2.0", "install_failed", "install"))
         self.assertIs(self.install_finished.call_args[0][1], False)
 
-    def test_install_without_layer_is_flagged(self):
-        self.server.apk_installed({"package": "com.private.vr", "xr_layer_missing": True}, {}, None, 4.0)
-        self.assertIs(self.install_finished.call_args[1]["xr_layer_missing"], True)
-        self.server.apk_installed({"package": "com.private.vr"}, {}, None, 4.0)
-        self.assertIsNone(self.install_finished.call_args[1]["xr_layer_missing"])
-
     def test_connection_trouble_is_not_reported(self):
         self.server.apk_installed({"package": "org.x", "version": "2.0"}, None,
                                   self.server.frame_android.FrameError("timed out talking to frame"), 3.0)
@@ -850,16 +391,14 @@ class ReportProblem(Base):
     def test_send_is_a_private_posthog_event_whatever_the_settings(self):
         got = self.serve()
         tm.update_settings({"usage": False})  # analytics off: a deliberate report still goes
-        with mock.patch.object(fr.frame_contact, "from_report", return_value=("contact-id", 1)):  # test_contact
-            res = fr.send({"kind": "idea", "title": "Live view stops", "message": "It stops after a minute.",
-                           "contact": "me@example.com", "contactFollowup": True})
+        res = fr.send({"kind": "idea", "title": "Live view stops", "message": "It stops after a minute.",
+                       "contact": "me@example.com"})
         path, body = got[0]
         event = body["batch"][0]
         self.assertEqual((path, body["api_key"], event["event"]), ("/batch/", "phc_test", "problem_report"))
         props = event["properties"]
         self.assertEqual((props["kind"], props["title"], props["message"], props["contact"], props["report_id"]),
                          ("idea", "Live view stops", "It stops after a minute.", "me@example.com", res["id"]))
-        self.assertEqual((props["contact_followup"], props["contact_id"], props["contact_rev"]), (True, "contact-id", 1))
         self.assertEqual((props["$process_person_profile"], props["$geoip_disable"]), (False, True))
         self.assertNotEqual(event["distinct_id"], tm.settings()["id"])  # not linked to the analytics
         self.assertIn(res["id"], res["message"])
@@ -882,9 +421,8 @@ class ReportProblem(Base):
 
     def test_the_inbox_skips_malformed_reports(self):
         good = ["2026-09-28T09:50:00Z", "AB12CD34", "bug", "Live view stops", "It stops.", None,
-                "0.4.0", "macOS", "", "", None, None, None]
-        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None, None, None, None],
-                ["short"], good]
+                "0.4.0", "macOS", "", ""]
+        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None], ["short"], good]
         with mock.patch.object(db, "_posthog_query", return_value={"results": rows}), \
              mock.patch.object(sys, "argv", ["frame_report.py", "inbox"]), \
              mock.patch("builtins.print") as out:

tests/test_touch.py

@@ -2,15 +2,9 @@
 
 Run: python3 -m unittest discover -s tests
 """
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import io
-import json
-import os
 import shutil
 import subprocess
 import sys
-import tempfile
-import time
 import unittest
 from pathlib import Path
 
@@ -57,9 +51,12 @@ class Mapping(unittest.TestCase):
         self.assertEqual(t.locate(5, None)["display"], ":0")
 
     def test_focus_display_is_decoded(self):
+        t = self.t
+        saved = t.xprop_root
+        self.addCleanup(lambda: setattr(t, "xprop_root", saved))
         for values, want in (([12602, 0, 58], ":1"), ([12346], ":0"), ([], None), ([0x41], None)):
-            self.assertEqual(self.t.focus_display({"GAMESCOPE_FOCUS_DISPLAY": values}), want)
-        self.assertIsNone(self.t.focus_display({}))
+            t.xprop_root = lambda d, n, v=values: v
+            self.assertEqual(t.focus_display(), want)
 
     def test_ascii_table_covers_printable_characters(self):
         for code in range(0x20, 0x7F):
@@ -262,236 +259,6 @@ class ServerChecks(unittest.TestCase):
             self.s.remote_touch({"events": [{"dx": 1}] * (self.s.INPUT_BATCH_LIMIT + 1)})
 
 
-class FindingPanels(unittest.TestCase):
-    """panels() with faked headset probes: where gamescope's properties are, and why nothing was found (#73)."""
-
-    @classmethod
-    def setUpClass(cls):
-        import frame_touch
-        cls.t = frame_touch
-
-    def setUp(self):
-        t = self.t
-        names = ("read_props", "window_info", "window_pid", "displays", "desktop_running")
-        saved = {n: getattr(t, n) for n in names}
-        saved_which = t.shutil.which
-        self.real_displays = saved["displays"]
-        self.real_read_props = saved["read_props"]
-
-        def restore():
-            for n, v in saved.items():
-                setattr(t, n, v)
-            t.shutil.which = saved_which
-            t._ROOT.clear()
-        self.addCleanup(restore)
-        t._ROOT.clear()
-        self.props = {}  # (display, property) -> values
-        self.windows = {}  # (display, window) -> info
-        self.reads = []  # displays whose gamescope properties were read
-        t.read_props = lambda d, limit=5.0: self.reads.append(d) or {n: list(v) for (dd, n), v in self.props.items() if dd == d}
-        t.window_info = lambda d, w: self.windows.get((d, w))
-        t.window_pid = lambda d, w: None
-        t.displays = lambda: [":0", ":1", ":2"]
-        t.desktop_running = lambda: False
-        t.shutil.which = lambda tool: "/usr/bin/" + tool
-
-    def plasma_on(self, display):
-        # SteamOS 0.4.1: the nested Plasma desktop (kwin_wayland, app id 0) is a window on :0.
-        self.props[(display, "GAMESCOPE_FOCUSABLE_WINDOWS")] = [4194307, 0, 2222]
-        self.props[(display, "GAMESCOPE_FOCUSED_WINDOW")] = [4194307]
-        self.props[(display, "GAMESCOPE_FOCUS_DISPLAY")] = [0x303A]  # ":0"
-        self.windows[(":0", 4194307)] = {"name": "KDE Wayland Compositor", "x": 0, "y": 0, "width": 1280, "height": 800}
-        self.windows[(":0", "root")] = {"width": 1280, "height": 720}
-
-    def test_desktop_panel_on_display_0(self):
-        self.plasma_on(":0")
-        out = self.t.panels()
-        self.assertEqual([(p["window"], p["display"], p["focused"]) for p in out["panels"]], [(4194307, ":0", True)])
-        self.assertNotIn("why", out)
-
-    def test_display_0_costs_one_read(self):
-        # The layout of every build seen so far: one read of :0's properties for the whole run.
-        self.plasma_on(":0")
-        self.t.panels()
-        self.assertEqual(self.reads, [":0"])
-
-    def test_gamescope_properties_on_another_display_are_found(self):
-        # A build that numbers its displays differently: :0 has no gamescope properties.
-        self.plasma_on(":1")
-        self.assertEqual(self.t.gamescope()[0], ":1")
-        self.reads.clear()
-        self.t._ROOT.clear()
-        self.assertEqual(len(self.t.panels()["panels"]), 1)
-        self.assertEqual(self.reads, [":0", ":1"])  # read once, then reused by focus() and focusable()
-
-    def test_other_displays_are_probed_briefly(self):
-        limits = []
-        self.t.read_props = lambda d, limit=5.0: limits.append((d, limit)) or {}
-        self.assertEqual(self.t.gamescope(), (":0", {}))
-        self.assertEqual(limits, [(":0", 5.0), (":1", self.t.ROOT_PROBE_TIMEOUT), (":2", self.t.ROOT_PROBE_TIMEOUT)])
-
-    def test_input_helper_remembers_the_display(self):
-        # The input helper lives for a session: a found display is kept, a failed search retried later.
-        t = self.t
-        self.plasma_on(":1")
-        t.gamescope(); t.gamescope()
-        self.assertEqual(self.reads, [":0", ":1", ":1"])
-        self.props.clear()
-        self.reads.clear()
-        t._ROOT.clear()
-        t.gamescope(); t.gamescope()
-        self.assertEqual(self.reads, [":0", ":1", ":2", ":0"])  # given up: :0 for ROOT_RETRY
-        t._ROOT[1] -= t.ROOT_RETRY
-        self.reads.clear()
-        t.gamescope()
-        self.assertEqual(self.reads, [":0", ":1", ":2"])
-
-    def test_read_props_parses_xprop(self):
-        t = self.t
-        saved = t.subprocess.run
-        self.addCleanup(setattr, t.subprocess, "run", saved)
-        out = ("GAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = 1, 0, 2, 3, 769, 4\n"
-               "GAMESCOPE_FOCUSED_WINDOW(CARDINAL) = 0\nGAMESCOPE_FOCUS_DISPLAY:  not found.\n")
-        t.subprocess.run = lambda *a, **k: subprocess.CompletedProcess(a, 0, out, "")
-        self.assertEqual(self.real_read_props(":0"), {"GAMESCOPE_FOCUSABLE_WINDOWS": [1, 0, 2, 3, 769, 4],
-                                                      "GAMESCOPE_FOCUSED_WINDOW": [0]})
-        t.subprocess.run = lambda *a, **k: subprocess.CompletedProcess(a, 0, "GAMESCOPE_FOCUSED_WINDOW:  not found.\n", "")
-        self.assertEqual(self.real_read_props(":0"), {})
-
-        def hang(*a, **k):
-            raise subprocess.TimeoutExpired(a[0], k.get("timeout"))
-        t.subprocess.run = hang
-        self.assertEqual(self.real_read_props(":0"), {})
-
-    def test_deadline_returns_what_was_found(self):
-        t, clock = self.t, [0.0]
-        self.plasma_on(":0")
-        self.props[(":0", "GAMESCOPE_FOCUSABLE_WINDOWS")] = [4194307, 0, 2222, 5, 0, 1, 6, 0, 1]
-        saved = t.time.monotonic
-        self.addCleanup(setattr, t.time, "monotonic", saved)
-        t.time.monotonic = lambda: clock[0]
-        info = self.windows.get
-
-        def slow(d, w):  # every xwininfo takes 1 s: the run is out of time after a few
-            t.budget()
-            clock[0] += 1
-            return info((d, w))
-        t.window_info = slow
-        out = t.panels(limit=7)  # focus: 2 reads; the first panel: 3 displays and its root
-        self.assertEqual([p["window"] for p in out["panels"]], [4194307])
-        self.assertIn("took too long", out["why"])
-        self.assertIn("Some may be missing", out["why"])
-        self.assertIsNone(t.DEADLINE[0])  # the next run (or the input helper) has no deadline left over
-
-    def test_listed_window_that_isnt_x11_explains_itself(self):
-        self.plasma_on(":0")
-        del self.windows[(":0", 4194307)]  # say, a desktop drawn as a Wayland window
-        out = self.t.panels()
-        self.assertEqual(out["panels"], [])
-        self.assertIn("can't find its window", out["why"])
-        self.assertIn("Headset view", out["why"])
-
-    def test_desktop_running_but_not_listed(self):
-        self.t.desktop_running = lambda: True
-        out = self.t.panels()
-        self.assertEqual(out["panels"], [])
-        self.assertIn("desktop is running", out["why"])
-
-    def test_nothing_open(self):
-        out = self.t.panels()
-        self.assertEqual(out, {"focus": None, "focus_display": None, "panels": [],
-                               "why": "No app panel is open in the headset. Open the desktop or an app in "
-                                      "the headset, then try again."})
-
-    def test_missing_x_tools_are_named(self):
-        self.plasma_on(":0")
-        self.t.shutil.which = lambda tool: None if tool == "xwininfo" else "/usr/bin/" + tool
-        self.windows.clear()  # xwininfo can't run, so nothing resolves
-        self.assertIn("no xwininfo", self.t.panels()["why"])
-
-    def test_displays_include_abstract_sockets(self):
-        # /tmp/.X11-unix not visible to the SSH session: the abstract sockets still name the displays.
-        import builtins
-        t = self.t
-        real_open, real_listdir = builtins.open, t.os.listdir
-
-        def fake_open(path, *a, **k):
-            if path == "/proc/net/unix":
-                return io.StringIO("0000: 00000002 0 ... @/tmp/.X11-unix/X1\n0000: ... @/tmp/.X11-unix/X0\n"
-                                   "0000: ... /run/user/1000/wayland-0\n")
-            return real_open(path, *a, **k)
-
-        def fake_listdir(path):
-            if path == "/tmp/.X11-unix":
-                raise FileNotFoundError(path)
-            return real_listdir(path)
-        builtins.open, t.os.listdir = fake_open, fake_listdir
-        try:
-            self.assertEqual(self.real_displays(), [":0", ":1"])
-        finally:
-            builtins.open, t.os.listdir = real_open, real_listdir
-
-
-FAKE_XPROP = """#!/bin/sh
-sleep "${FAKE_X_DELAY:-0}"
-if [ "$1" = "-root" ] && [ "$DISPLAY" = ":0" ]; then
-  echo "GAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = 11, 0, 101, 12, 769, 102"
-  echo "GAMESCOPE_FOCUSED_WINDOW(CARDINAL) = 11"
-  echo "GAMESCOPE_FOCUS_DISPLAY(CARDINAL) = 12346"
-fi
-"""
-FAKE_XWININFO = """#!/bin/sh
-sleep "${FAKE_X_DELAY:-0}"
-[ "$DISPLAY" = ":0" ] || exit 1
-echo 'xwininfo: Window id: 0xb "Desktop"'
-echo '  Absolute upper-left X:  0'
-echo '  Absolute upper-left Y:  0'
-echo '  Width: 1280'
-echo '  Height: 800'
-echo '  Map State: IsViewable'
-"""
-
-
-@unittest.skipIf(sys.platform == "win32", "fake X tools are shell scripts; frame_touch.py runs on the Frame")
-class PanelsAsAFreshProcess(unittest.TestCase):
-    """`frame_touch.py panels` the way the server runs it: a new process each request, with
-    fake xprop and xwininfo first on PATH (two displays, :0 and :1)."""
-
-    def run_panels(self, delay):
-        with tempfile.TemporaryDirectory() as bin_dir:
-            for name, body in (("xprop", FAKE_XPROP), ("xwininfo", FAKE_XWININFO)):
-                path = Path(bin_dir) / name
-                path.write_text(body)
-                path.chmod(0o755)
-            env = dict(os.environ, PATH=bin_dir + os.pathsep + os.environ.get("PATH", ""), FAKE_X_DELAY=str(delay),
-                       PYTHONDONTWRITEBYTECODE="1")
-            code = ("import sys; sys.path.insert(0, sys.argv[1]); import frame_touch as t; "
-                    "t.displays = lambda: [':0', ':1']; t.desktop_running = lambda: False; "
-                    "sys.argv = ['frame_touch.py', 'panels']; sys.exit(t.main())")
-            start = time.monotonic()
-            r = subprocess.run([sys.executable, "-c", code, str(ROOT / "ui")], env=env, capture_output=True,
-                               text=True, timeout=60)
-            took = time.monotonic() - start
-        self.assertEqual(r.returncode, 0, r.stderr)
-        return json.loads(r.stdout), took
-
-    def test_lists_panels(self):
-        out, _ = self.run_panels(0)
-        self.assertEqual(out["focus"], 11)
-        self.assertEqual(out["focus_display"], ":0")
-        self.assertEqual([(p["window"], p["display"], p["focused"]) for p in out["panels"]],
-                         [(11, ":0", True), (12, ":0", False)])
-        self.assertNotIn("why", out)
-
-    def test_slow_x_tools_stay_inside_the_servers_timeout(self):
-        # Review of #83: X tools answering in 4.6 s each would take well over the server's
-        # 20 s; one deadline for the run (PANELS_DEADLINE, 12 s) returns in time, saying why.
-        out, took = self.run_panels(4.6)
-        self.assertLess(took, 15, out)
-        self.assertEqual(out["panels"], [])
-        self.assertIn("took too long", out["why"])
-
-
 @unittest.skipUnless(shutil.which("node"), "needs node")
 class PageGestures(unittest.TestCase):
     """Control's gestures and queue (tests/page/ctrl_gestures.mjs runs the real functions from index.html)."""
@@ -501,12 +268,6 @@ class PageGestures(unittest.TestCase):
                            timeout=60)
         self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
 
-    def test_desktop_panel_list(self):
-        # #73: the headset's reason for no panels, and a failed listing, reach Capture and Control.
-        r = subprocess.run(["node", str(ROOT / "tests" / "page" / "desk_panels.mjs")], capture_output=True, text=True,
-                           timeout=60)
-        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-
 
 class Script(unittest.TestCase):
     def test_helper_compiles_on_the_frames_python(self):

tests/test_vr.py

@@ -1,5 +1,4 @@
 """Own VR telemetry, optional catalogue and entitlement guards; no headset needed."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import ctypes
 import json
 from pathlib import Path

tests/test_webinstall.py

@@ -386,28 +386,17 @@ class ServerJobs(unittest.TestCase):
     def test_dead_servers_leftovers_swept(self):
         dead = subprocess.Popen([sys.executable, "-c", "pass"])
         dead.wait()
-        s = self.server
-        with tempfile.TemporaryDirectory() as cache, \
-                mock.patch.object(s.frame_host, "cache_dir", lambda *parts: Path(cache).joinpath(*parts)):
-            # Downloads, title staging, patched VR APKs, files staged for the
-            # assistant, and app-index downloads (in the cache folder).
-            places = s._tmp_places()
-            self.assertEqual({p for _, p in places}, {s.WEB_TMP_PREFIX, s.frame_titles.TMP_PREFIX,
-                                                      s.frame_android.TMP_PREFIX, s.frame_agent.TMP_PREFIX,
-                                                      s.apk_fdroid.TMP_PREFIX})
-            for folder, prefix in places:
-                folder.mkdir(parents=True, exist_ok=True)
-                gone = tempfile.mkdtemp(prefix=f"{prefix}{dead.pid}-", dir=folder)
-                live = tempfile.mkdtemp(prefix=f"{prefix}{os.getpid()}-", dir=folder)
-                try:
-                    s.sweep_tmp()
-                    self.assertFalse(os.path.exists(gone), prefix)
-                    self.assertTrue(os.path.exists(live), prefix)
-                    s.sweep_tmp(own=True)  # on the way out: this server's own go too
-                    self.assertFalse(os.path.exists(live), prefix)
-                finally:
-                    shutil.rmtree(gone, ignore_errors=True)
-                    shutil.rmtree(live, ignore_errors=True)
+        # Downloads and title staging (unzipped titles) are both swept.
+        for prefix in (self.server.WEB_TMP_PREFIX, self.server.frame_titles.TMP_PREFIX):
+            gone = tempfile.mkdtemp(prefix=f"{prefix}{dead.pid}-")
+            live = tempfile.mkdtemp(prefix=f"{prefix}{os.getpid()}-")
+            try:
+                self.server.sweep_tmp()
+                self.assertFalse(os.path.exists(gone), prefix)
+                self.assertTrue(os.path.exists(live), prefix)
+            finally:
+                shutil.rmtree(gone, ignore_errors=True)
+                shutil.rmtree(live, ignore_errors=True)
 
     def test_temp_dir_failure_ends_the_job(self):
         job, dispatch = self.run_job(mkdtemp_error=OSError("disk full"))

tests/test_windows_fixes.py

@@ -1,162 +0,0 @@
-"""Windows-only paths, faked on any OS: ~/.ssh/config's ACL and link-local IPv6 zones.
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-
-import frame_host  # noqa: E402
-import frame_devices as fd  # noqa: E402
-
-REFUSED = ("Bad permissions. Try removing permissions for user: UNKNOWN\\UNKNOWN (S-1-5-21-1-2-3-1000) "
-           "on file C:/Users/bob/.ssh/config.\r\nBad owner or permissions on C:\\Users\\bob/.ssh/config\r\n")
-
-
-def ran(*results):
-    """subprocess.run stand-in answering whoami, then icacls."""
-    calls = []
-
-    def run(argv, **kw):
-        calls.append(argv)
-        return results[len(calls) - 1]
-    return run, calls
-
-
-class MakePrivate(unittest.TestCase):
-    def test_windows_sets_owner_only_acl_by_sid(self):
-        run, calls = ran(subprocess.CompletedProcess([], 0, '"desktop\\björn","S-1-5-21-9-8-7-1001"\r\n'.encode("cp850")),
-                         subprocess.CompletedProcess([], 0))
-        with mock.patch.object(frame_host, "WINDOWS", True), mock.patch.object(frame_host.subprocess, "run", run):
-            self.assertTrue(frame_host.make_private(Path("C:/x/config")))
-        self.assertEqual(calls[1][1:], [str(Path("C:/x/config")), "/inheritance:r", "/grant:r",
-                                        "*S-1-5-21-9-8-7-1001:F", "*S-1-5-18:F", "*S-1-5-32-544:F"])
-
-    def test_windows_falls_back_to_username_and_reports_failure(self):
-        run, calls = ran(subprocess.CompletedProcess([], 1, b""), subprocess.CompletedProcess([], 5))
-        with mock.patch.object(frame_host, "WINDOWS", True), mock.patch.object(frame_host.subprocess, "run", run), \
-                mock.patch.dict(os.environ, {"USERNAME": "bob"}):
-            self.assertFalse(frame_host.make_private(Path("config")))
-        self.assertIn("bob:F", calls[1])
-
-    @unittest.skipIf(os.name == "nt", "POSIX modes")
-    def test_posix_chmods_600(self):
-        with tempfile.NamedTemporaryFile() as f:
-            os.chmod(f.name, 0o644)
-            self.assertTrue(frame_host.make_private(f.name))
-            self.assertEqual(os.stat(f.name).st_mode & 0o777, 0o600)
-
-
-class ConfigWrites(unittest.TestCase):
-    def setUp(self):
-        self.ssh = Path(tempfile.mkdtemp(prefix="frame-acl-"))
-        self.addCleanup(shutil.rmtree, self.ssh, ignore_errors=True)
-        self.config = self.ssh / "config"
-
-    def test_devices_and_connect_writes_make_the_file_private(self):
-        import frame_connect as fc
-        self.config.write_text("Host other\n  User me\n", encoding="utf-8")
-        with mock.patch.object(frame_host, "make_private", return_value=True) as private, \
-                mock.patch.object(fc, "SSH_DIR", self.ssh), mock.patch.object(fc, "CONFIG", self.config):
-            fc.write_config("10.0.0.5")
-            self.assertTrue(fd.repair_permissions(self.config))
-            fd.rewrite_block("frame", path=self.config, user="deck")
-        self.assertEqual(private.call_count, 3)
-        self.assertIn("User deck", self.config.read_text(encoding="utf-8"))
-        self.assertTrue(all(Path(c.args[0]).parent == self.ssh for c in private.call_args_list))
-        self.assertIn("Host other", self.config.read_text(encoding="utf-8"))
-
-    def test_setup_runs_isolated_as_the_app_starts_it(self):
-        r = subprocess.run([sys.executable, "-I", "-B", str(ROOT / "ui" / "frame_connect.py"), "--help"],
-                           capture_output=True, text=True, stdin=subprocess.DEVNULL, timeout=30)
-        self.assertNotIn("ModuleNotFoundError", r.stderr)
-        self.assertIn("frame_connect.py", r.stdout + r.stderr)
-
-    def test_repair_keeps_the_bytes_and_skips_a_missing_file(self):
-        self.assertFalse(fd.repair_permissions(self.config))
-        data = "# caf\xe9 (ANSI, not UTF-8)\r\nHost a\r\n".encode("cp1252")
-        self.config.write_bytes(data)
-        with mock.patch.object(frame_host, "make_private", return_value=True):
-            self.assertTrue(fd.repair_permissions(self.config))
-        self.assertEqual(self.config.read_bytes(), data)
-
-    def test_repair_fails_without_the_acl_and_leaves_the_file(self):
-        self.config.write_bytes(b"Host a\n")
-        before = self.config.stat().st_ino
-        with mock.patch.object(frame_host, "make_private", return_value=False):
-            self.assertFalse(fd.repair_permissions(self.config))
-        self.assertEqual((self.config.read_bytes(), self.config.stat().st_ino), (b"Host a\n", before))
-        self.assertEqual(sorted(f.name for f in self.ssh.iterdir()), ["config", fd.LOCK_NAME])
-
-
-class ServerRepair(unittest.TestCase):
-    @classmethod
-    def setUpClass(cls):
-        import server
-        cls.server = server
-
-    def setUp(self):
-        self.ssh = Path(tempfile.mkdtemp(prefix="frame-acl-"))
-        self.addCleanup(shutil.rmtree, self.ssh, ignore_errors=True)
-        (self.ssh / "config").write_text("Host a\n", encoding="utf-8")
-        patches = [mock.patch.dict(os.environ, {"FRAME_CONTROL_SSH_DIR": str(self.ssh)}),
-                   mock.patch.object(frame_host, "WINDOWS", True),
-                   mock.patch.object(self.server, "_config_repaired", False)]
-        for p in patches:
-            p.start()
-            self.addCleanup(p.stop)
-
-    def test_repairs_the_refused_config_once(self):
-        with mock.patch.object(fd, "repair_permissions", return_value=True) as repair:
-            self.assertTrue(self.server.repair_ssh_config(REFUSED))
-            self.assertFalse(self.server.repair_ssh_config(REFUSED))
-        repair.assert_called_once()
-
-    def test_leaves_other_files_and_errors_alone(self):
-        key = REFUSED.replace(".ssh/config", ".ssh/id_ed25519_frame")
-        with mock.patch.object(fd, "repair_permissions") as repair:
-            self.assertFalse(self.server.repair_ssh_config(key))
-            self.assertFalse(self.server.repair_ssh_config("ssh: connect to host frame port 22: timed out"))
-            with mock.patch.object(frame_host, "WINDOWS", False):
-                self.assertFalse(self.server.repair_ssh_config(REFUSED))
-        repair.assert_not_called()
-
-    def test_ssh_retries_after_repairing(self):
-        results = iter([subprocess.CompletedProcess([], 255, "", REFUSED), subprocess.CompletedProcess([], 0, "ok", "")])
-        with mock.patch.object(frame_host, "run_ssh", lambda *a, **k: next(results)), \
-                mock.patch.object(fd, "repair_permissions", return_value=True), \
-                mock.patch.object(self.server, "LINK", None):
-            self.assertEqual(self.server.ssh("true"), "ok")
-
-
-class LinkLocalZone(unittest.TestCase):
-    """A .local name answering on fe80::: Windows' ssh needs fe80::1%12, not %wireless_32768."""
-
-    def probe(self, windows):
-        import frame_link as fl
-        info = [(fl.socket.AF_INET6, fl.socket.SOCK_STREAM, 6, "", ("fe80::1", 22, 0, 12))]
-        sock = mock.MagicMock()
-        with mock.patch.object(frame_host, "WINDOWS", windows), \
-                mock.patch.object(fl.socket, "getaddrinfo", return_value=info), \
-                mock.patch.object(fl.socket, "socket", return_value=sock), \
-                mock.patch.object(fl.socket, "if_indextoname", return_value="wireless_32768", create=True):
-            return fl.probe("frame.local", 22)["ip"]
-
-    def test_windows_uses_the_numeric_zone(self):
-        self.assertEqual(self.probe(True), "fe80::1%12")
-
-    def test_elsewhere_uses_the_interface_name(self):
-        self.assertEqual(self.probe(False), "fe80::1%wireless_32768")
-
-
-if __name__ == "__main__":
-    unittest.main()

ui/apk_sources/fdroid.py

@@ -27,7 +27,6 @@ from frame_catalog import _IndexReader, _reduce_index, _sha256
 
 KIND = 'fdroid'
 CACHE_VERSION = 2
-TMP_PREFIX = '.download-'  # in the cache folder, then the server's PID, so server.sweep_tmp can clear a stopped run's
 _LOCK = threading.RLock()  # settings only; never held while downloading
 _load_locks = {}
 _refreshing = {}  # source id -> background refresh thread
@@ -531,7 +530,7 @@ def _load(source, force=False):
             return found[:2]
         cache.parent.mkdir(parents=True, exist_ok=True)
         try:
-            with tempfile.TemporaryDirectory(prefix=f'{TMP_PREFIX}{os.getpid()}-', dir=str(cache.parent)) as tmp:
+            with tempfile.TemporaryDirectory(dir=str(cache.parent)) as tmp:
                 jar, raw = Path(tmp) / 'index.jar', Path(tmp) / 'index.json'
                 v2 = True
                 try:

ui/frame_agent.py

@@ -9,8 +9,6 @@ import subprocess
 import threading
 import time
 
-TMP_PREFIX = 'frame-agent-'  # then the server's PID, so server.sweep_tmp can clear a stopped run's
-
 
 class Approvals:
     def __init__(self):
@@ -111,7 +109,7 @@ def call(server, body):
     if name == 'send_file':
         # Stage the reviewed bytes before the existing transfer helper reads them.
         import tempfile
-        with tempfile.TemporaryDirectory(prefix=f'{TMP_PREFIX}{os.getpid()}-') as tmp:
+        with tempfile.TemporaryDirectory(prefix='frame-agent-') as tmp:
             source = Path(action['arguments']['path'])
             with source.open('rb') as stream:
                 data = stream.read(16 * 1024**2 + 1)

ui/frame_android.py

@@ -7,23 +7,22 @@ in the Steam library and gets its own SteamVR panel. Nothing goes through
 Lepton Development, which wipes its apps on exit. See docs/apks.md.
 
 Python stdlib only. CLI: python3 ui/frame_android.py
-  install APK [SPLIT.apk ...] [--vr|--flat] [--no-xr-compat] | info APK | versions APK-or-PKG
+  install APK [--vr|--flat] [--no-xr-compat] | info APK | versions APK-or-PKG
   install-obb PKG OBB [OBB ...] | backup-data PKG ARCHIVE | restore-data PKG ARCHIVE
   refresh-art PKG|--all | patch SRC DST [--add NAME=PATH ...] | list | launch PKG | stop PKG | remove PKG | probe PKG
 """
-import base64, gzip, json, os, re, shlex, shutil, struct, subprocess, sys, threading, time, zlib
+import base64, json, os, re, shlex, shutil, struct, subprocess, sys, threading, time, zlib
 
 import frame_apk
 import frame_artwork
 import frame_host
 import tempfile
 import zipfile
-from frame_apk_vr import add_launcher_category, drop_split_required
+from frame_apk_vr import add_launcher_category
 from frame_apk_sign import repack
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 FRAME = os.environ.get('FRAME_ALIAS', 'frame')
-TMP_PREFIX = 'frame-vr-'  # then the server's PID, so server.sweep_tmp can clear a stopped run's patched APK
 APPS_DIR = 'Applications/Android'          # relative to the Frame's $HOME
 COMPAT = '.local/share/Steam/steamapps/compatdata'
 SHADERS = '.local/share/Steam/steamapps/shadercache'
@@ -34,8 +33,7 @@ SHORTCUTS = os.path.join(ROOT, 'frame', 'android', 'steam_shortcuts.py')
 XR_COMPAT = os.path.join(ROOT, 'frame', 'openxr-compat')
 XR_COMPAT_FILES = {
     'assets/openxr/1/api_layers/implicit.d/XrApiLayer_FRAME_compat.json': 'XrApiLayer_FRAME_compat.json',
-    # Gzipped in the repo and the app; see frame/openxr-compat/build.sh for why.
-    'lib/arm64-v8a/libXrApiLayer_FRAME_compat.so': 'prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz',
+    'lib/arm64-v8a/libXrApiLayer_FRAME_compat.so': 'prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so',
 }
 PKG_RE = re.compile(r'^[A-Za-z][\w]*(\.[A-Za-z_][\w]*)+$')
 SSH_OPTS = ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8']
@@ -45,37 +43,16 @@ class FrameError(RuntimeError):
     pass
 
 
-class LayerMissing(FrameError):
-    """The OpenXR compatibility layer's files aren't in this copy of Frame Control."""
-
-
-LAYER_MISSING = ("Frame Control's OpenXR compatibility layer is missing from this copy "
-                 "(frame/openxr-compat/prebuilt); reinstall Frame Control, or in a source "
-                 "checkout run frame/openxr-compat/build.sh")
-LAYER_MISSING_NOTE = ("Installed without the OpenXR compatibility layer, which is missing from this "
-                      "copy of Frame Control; apps that need OpenXR 1.1 may not start. Reinstalling "
-                      "Frame Control restores it.")
-
-
 def ssh(cmd, input=None, timeout=120):
     try:
         # No inherited stdin (see server.ssh): Windows' ssh.exe would wait on it.
         feed = {'input': input} if input is not None else {'stdin': subprocess.DEVNULL}
-        # The Frame writes UTF-8, whatever this computer's code page (Windows would decode it as
-        # cp1252). errors='replace': stray bytes (a file name) mustn't turn a failed command, or
-        # one that worked, into a UnicodeDecodeError.
-        text = ({'text': True, 'encoding': 'utf-8', 'errors': 'replace'}
-                if isinstance(input, str) or input is None else {})
-        p = frame_host.run_ssh(['ssh', *SSH_OPTS, FRAME, cmd], capture_output=True, **feed,
-                               timeout=timeout, **text)
+        p = subprocess.run(['ssh', *SSH_OPTS, FRAME, cmd], capture_output=True, **feed,
+                           timeout=timeout, text=isinstance(input, str) or input is None)
     except subprocess.TimeoutExpired:
-        raise frame_host.link_failure(FrameError(f'timed out talking to {FRAME}'))
+        raise FrameError(f'timed out talking to {FRAME}')
     if p.returncode != 0:
-        # Bytes input gives bytes output: decode it, so the message isn't "b'...'".
-        stderr, stdout = (v if isinstance(v, str) else (v or b'').decode(errors='replace')
-                          for v in (p.stderr, p.stdout))
-        error = FrameError((stderr or stdout or f'ssh exited {p.returncode}').strip()[-600:])
-        raise frame_host.link_failure(error) if frame_host.ssh_link_failed(p.returncode, stderr) else error
+        raise FrameError((p.stderr or p.stdout or f'ssh exited {p.returncode}').strip()[-600:])
     return p.stdout
 
 
@@ -117,47 +94,25 @@ def xr_compat_files(apk_path):
     for entry, rel in XR_COMPAT_FILES.items():
         try:
             with open(os.path.join(XR_COMPAT, rel), 'rb') as f:
-                data = f.read()
-            add[entry] = gzip.decompress(data) if rel.endswith('.gz') else data
-        except (OSError, EOFError, zlib.error):  # gzip.BadGzipFile is an OSError
-            add[entry] = b''
-        if not add[entry]:  # missing, unreadable (antivirus, permissions) or truncated
-            raise LayerMissing(LAYER_MISSING)
+                add[entry] = f.read()
+        except OSError:
+            raise FrameError("the OpenXR compatibility layer isn't built; run frame/openxr-compat/build.sh")
     return add
 
 
-def layer_note(meta):
-    """The missing-layer warning for an install's completion message, or ''."""
-    return LAYER_MISSING_NOTE if LAYER_MISSING_NOTE in ((meta or {}).get('vr_issues') or []) else ''
-
-
 def check_installable(info):
     if info['min_sdk'] and info['min_sdk'] > 30:
         raise FrameError(f"{info['label']} needs Android API {info['min_sdk']}; Lepton is Android 11 (API 30)")
     if info['abis'] and 'arm64-v8a' not in info['abis']:
-        # Sites that offer one APK per ABI (Grayjay: arm64-v8a, armeabi-v7a, x86, x86_64,
-        # universal) leave the choice to the user; say which file to fetch instead.
-        raise FrameError(f"{info['label']} has no arm64-v8a build ({', '.join(info['abis'])}); Lepton is 64-bit ARM only. "
-                         "This file is for other devices: download the APK marked arm64-v8a "
-                         "(or arm64, or universal) and install that instead")
+        raise FrameError(f"{info['label']} has no arm64-v8a build ({', '.join(info['abis'])}); Lepton is 64-bit ARM only")
 
 
-# Installs are rare; one at a time avoids every race. Reentrant so a caller (a Quest import's
-# final checks and data copy) can hold it around install_obb and install, which take it too.
-_install_lock = threading.RLock()
-# The slowest transfer a copy is allowed before it times out, in bytes a second (about 4 Mbit/s,
-# a slow or busy Wi-Fi link). A fixed 10 minutes failed any APK over about 300 MB at that rate.
-COPY_MIN_RATE = 512 * 1024
+_install_lock = threading.Lock()  # installs are rare; one at a time avoids every race
 
 
 def _copy(src, dest, executable=False, timeout=600):
-    """Copy a local file to the Frame: rsync where installed (not on Windows), else scp.
-    timeout is the least time allowed; a large file gets longer (COPY_MIN_RATE)."""
+    """Copy a local file to the Frame: rsync where installed (not on Windows), else scp."""
     name = os.path.basename(src)
-    try:
-        timeout = max(timeout, os.path.getsize(src) / COPY_MIN_RATE)
-    except OSError:
-        pass  # rsync or scp says what's wrong with the file
     rsync = None if frame_host.WINDOWS else shutil.which('rsync')  # see server.push_file
     if rsync:
         cmd = ['rsync', '-a', *(['--chmod=u+x'] if executable else []),
@@ -165,8 +120,7 @@ def _copy(src, dest, executable=False, timeout=600):
     else:
         cmd = ['scp', *SSH_OPTS, src, f'{FRAME}:{dest}']
     try:
-        frame_host.run_ssh(cmd, check=True, capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                           errors='replace', timeout=timeout)
+        subprocess.run(cmd, check=True, capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=timeout)
     except subprocess.TimeoutExpired:
         raise FrameError(f'copying {name} to the Frame timed out')
     except subprocess.CalledProcessError as e:
@@ -192,303 +146,7 @@ def _write_meta(d, meta):
 install_hooks = []
 
 
-# Split APK members that belong to the split itself, not the app: never merged.
-SPLIT_OWN = re.compile(r'^(AndroidManifest\.xml|stamp-cert-sha256|META-INF/.*)$')
-# What a mergeable split may add: native libraries and assets, nothing else.
-SPLIT_ADDS = re.compile(r'^(lib/[^/]+/[^/]+\.so|assets/.*[^/])$')
-# Manifest elements a config or install-time asset split carries. Anything else (an
-# activity, service, uses-library...) belongs to a feature split, which needs its manifest.
-SPLIT_TAGS = {'manifest', 'application', 'uses-sdk', 'module', 'delivery', 'install-time', 'fusing'}
-# Every merged byte is held in memory while the APK is repacked and signed (as for every
-# patched APK), so splits are bounded by what's actually inflated, not only the headers.
-MAX_SPLIT_MEMBER = 512 * 1024**2
-MAX_SPLIT_TOTAL = 1024**3
-
-
-def _split_manifest(path, name):
-    """(package, split name) from a split APK's manifest, refusing splits that declare
-    anything the merged app would lose with that manifest."""
-    with zipfile.ZipFile(path) as z:
-        elements = frame_apk.manifest_elements(frame_apk._read(z, 'AndroidManifest.xml', frame_apk.MAX_MANIFEST))
-    attrs = next((a for tag, a in elements if tag == 'manifest'), {})
-    split = (attrs.get('split') or (None, None, None))[2]
-    feature = attrs.get('isFeatureSplit')
-    if feature and feature[1]:
-        raise FrameError(f'{name} ({split or "split"}) is a feature split with its own code and manifest; '
-                         'Frame Control can only merge splits that add native libraries or assets')
-    extra = sorted({tag for tag, _ in elements if tag not in SPLIT_TAGS})
-    if extra:
-        raise FrameError(f'{name} ({split or "split"}) declares <{">, <".join(extra)}> in its manifest; '
-                         'Frame Control can only merge splits that add native libraries or assets')
-    return (attrs.get('package') or (None, None, None))[2], split
-
-
-def split_entries(base, splits):
-    """What merging splits into base adds: {entry name: (split path, entry name, size)}.
-
-    Lepton runs one APK per instance, so a split app is merged into one APK. Only splits
-    that add native libraries (the arm64 ABI split) or install-time assets can be: a split
-    with code, components or resources (screen density, language) needs its own manifest
-    or resource table, which Frame Control doesn't merge, so those are refused."""
-    try:
-        with zipfile.ZipFile(base) as z:
-            taken = set(z.namelist())
-        package = apk_info(base)['package']
-        plan, total = {}, 0
-        for path in splits:
-            name = os.path.basename(path)
-            split_pkg, split_name = _split_manifest(path, name)
-            label = f'{name} ({split_name or "split"})'
-            if split_pkg != package:
-                raise FrameError(f'{name} is not part of {package} (it says {split_pkg or "nothing"})')
-            with zipfile.ZipFile(path) as z:
-                for member in z.infolist():
-                    entry = member.filename
-                    if entry.endswith('/') or SPLIT_OWN.match(entry):
-                        continue
-                    if entry == 'resources.arsc':
-                        # A config split for native code may carry an empty table; any resource needs merging.
-                        if not resources_empty(frame_apk._read(z, entry, frame_apk.MAX_ARSC)):
-                            raise FrameError(f'{label} holds screen-density or language resources; Frame Control '
-                                             'can only merge splits that add native libraries or assets')
-                        continue
-                    if entry.startswith('res/'):
-                        raise FrameError(f'{label} holds screen-density or language resources ({entry}); Frame '
-                                         'Control can only merge splits that add native libraries or assets')
-                    if re.match(r'^classes\d*\.dex$', entry):
-                        raise FrameError(f'{label} contains code ({entry}); Frame Control can only merge splits '
-                                         'that add native libraries or assets')
-                    if not SPLIT_ADDS.match(entry):
-                        raise FrameError(f'{label} contains {entry}; Frame Control can only merge splits that '
-                                         'add native libraries or assets')
-                    if entry in taken:
-                        raise FrameError(f'{name} and another part of the app both contain {entry}')
-                    if member.compress_type not in (zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED):
-                        raise FrameError(f'{entry} in {name} uses a compression Android does not')
-                    if member.file_size > MAX_SPLIT_MEMBER:
-                        raise FrameError(f'{entry} in {name} is {member.file_size / 1024**2:.0f} MB, more than '
-                                         f'Frame Control merges ({MAX_SPLIT_MEMBER // 1024**2} MB)')
-                    total += member.file_size
-                    if total > MAX_SPLIT_TOTAL:
-                        raise FrameError(f'the split APKs add more than {MAX_SPLIT_TOTAL // 1024**3} GB, more than '
-                                         'Frame Control merges')
-                    taken.add(entry)
-                    plan[entry] = (path, entry, member.file_size)
-        return plan
-    except (OSError, zipfile.BadZipFile, struct.error, IndexError, frame_apk.ApkError) as e:
-        raise FrameError(f'could not read the split APKs: {e}') from e
-
-
-def resources_empty(data):
-    """True only for a resource table that provably defines nothing: every type chunk's
-    entries absent. Bags (styles, plurals) count, and anything not understood counts too."""
-    def covered(start, end):
-        chunks, at = [], start
-        for chunk in frame_apk._chunks(data, start, end):
-            if chunk[2] != at:
-                return None
-            chunks.append(chunk)
-            at = chunk[2] + chunk[3]
-        return chunks if at == end else None
-
-    try:
-        if len(data) < 12 or struct.unpack_from('<H', data, 0)[0] != 0x0002:
-            return False
-        top = covered(struct.unpack_from('<H', data, 2)[0], len(data))
-        if top is None:
-            return False
-        for ctype, _, off, size in top:
-            if ctype == 0x0001:  # the global string pool
-                continue
-            if ctype != 0x0200:
-                return False
-            inner = covered(off + struct.unpack_from('<H', data, off + 2)[0], off + size)
-            if inner is None:
-                return False
-            for kind, hs, t, _ in inner:
-                if kind in (0x0001, 0x0202):  # type and key names, type specs
-                    continue
-                if kind != 0x0201:
-                    return False
-                flags, count = struct.unpack_from('<xBxxI', data, t + 8)
-                if flags & 0x01:  # sparse: only present entries are listed
-                    if count:
-                        return False
-                elif flags & 0x02:
-                    if any(o != 0xffff for o in struct.unpack_from(f'<{count}H', data, t + hs)):
-                        return False
-                elif any(o != 0xffffffff for o in struct.unpack_from(f'<{count}I', data, t + hs)):
-                    return False
-        return True
-    except (struct.error, IndexError):
-        return False
-
-
-def _zip64_sizes(extra, usize, csize):
-    """(uncompressed, compressed) with 0xffffffff fields taken from a ZIP64 extra field."""
-    at = 0
-    while at + 4 <= len(extra):
-        kind, length = struct.unpack_from('<HH', extra, at)
-        body = extra[at + 4:at + 4 + length]
-        if kind == 0x0001:
-            values, pos = [], 0
-            for field in (usize, csize):
-                if field == 0xffffffff:
-                    if pos + 8 > len(body):
-                        raise FrameError('truncated ZIP64 extra field')
-                    values.append(struct.unpack_from('<Q', body, pos)[0])
-                    pos += 8
-                else:
-                    values.append(field)
-            return tuple(values)
-        at += 4 + length
-    if 0xffffffff in (usize, csize):
-        raise FrameError('ZIP64 sizes without a ZIP64 extra field')
-    return usize, csize
-
-
-def _has_zip64_extra(extra):
-    at = 0
-    while at + 4 <= len(extra):
-        kind, length = struct.unpack_from('<HH', extra, at)
-        if kind == 0x0001:
-            return True
-        at += 4 + length
-    return False
-
-
-def read_member(path, member):
-    """A split member's bytes, read from its raw data and checked against both headers.
-
-    The local header must name the same file, with the same method and (unless a data
-    descriptor carries them, which is then checked) the same sizes and checksum as the
-    central directory; the data must end before the next member; a stored member must be
-    exactly its size and a deflated stream must end exactly at the end of its data, with
-    nothing after it. Output is bounded by the declared size: never trusts zipfile, which
-    stops early at a smaller declared size."""
-    with zipfile.ZipFile(path) as z:
-        info = z.getinfo(member)
-        starts = sorted({i.header_offset for i in z.infolist()} | {z.start_dir})
-    name, size = f'{member} in {os.path.basename(path)}', info.file_size
-    if info.flag_bits & 1 or info.compress_type not in (zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED):
-        raise FrameError(f'{name} is encrypted or uses a compression Android does not')
-    if size > MAX_SPLIT_MEMBER or info.compress_size > MAX_SPLIT_MEMBER:
-        raise FrameError(f'{name} is larger than Frame Control merges ({MAX_SPLIT_MEMBER // 1024**2} MB)')
-    following = next((o for o in starts if o > info.header_offset), None)
-    with open(path, 'rb') as raw:
-        raw.seek(info.header_offset)
-        header = raw.read(30)
-        if len(header) != 30 or header[:4] != b'PK\3\4':
-            raise FrameError(f'{name}: invalid local ZIP header')
-        flags, method, crc, csize, usize, nl, el = struct.unpack_from('<2xHH4xIIIHH', header, 4)
-        local_name, extra = raw.read(nl), raw.read(el)
-        if local_name != info.orig_filename.encode('utf-8' if flags & 0x800 else 'cp437', 'surrogateescape'):
-            raise FrameError(f'{name}: the local header names {local_name.decode("utf-8", "replace")!r}')
-        if method != info.compress_type or (flags & 0x08) != (info.flag_bits & 0x08):
-            raise FrameError(f'{name} does not match its header (local and central entries differ)')
-        start = info.header_offset + 30 + nl + el
-        compressed = raw.read(info.compress_size)
-        if len(compressed) != info.compress_size:
-            raise FrameError(f'{name} is truncated')
-        if flags & 0x08:
-            # Sizes and checksum follow the data: (signature,) crc, then sizes of 4 bytes each,
-            # or 8 for ZIP64. Streaming writers use the ZIP64 form even for small files when
-            # sizes weren't known up front, so the width isn't implied by the final sizes: take
-            # the layout that matches the central directory and fits before the next entry,
-            # preferring one that ends exactly there, then the width the local header implies.
-            zip64 = 0xffffffff in (csize, usize) or _has_zip64_extra(extra)
-            tail = raw.read(24)
-            if len(tail) < 12:
-                raise FrameError(f'{name}: truncated data descriptor')
-            end = start + info.compress_size
-            fits = []
-            for signed in (True, False):
-                if signed and tail[:4] != b'PK\7\x08':
-                    continue
-                for width in (20, 12):
-                    body = tail[4:4 + width] if signed else tail[:width]
-                    if len(body) < width:
-                        continue
-                    values = struct.unpack_from('<IQQ' if width == 20 else '<III', body)
-                    length = width + (4 if signed else 0)
-                    if values == (info.CRC, info.compress_size, size) and \
-                            (following is None or end + length <= following):
-                        exact = following is not None and end + length == following
-                        fits.append((not exact, (width == 20) != zip64, length))
-            if not fits:
-                raise FrameError(f'{name} does not match its header (local and central entries differ, '
-                                 'or its data descriptor is truncated)')
-            crc, csize, usize = info.CRC, info.compress_size, size
-            descriptor = min(fits)[2]
-        else:
-            usize, csize = _zip64_sizes(extra, usize, csize)
-            descriptor = 0
-    if (crc, csize, usize) != (info.CRC, info.compress_size, size):
-        raise FrameError(f'{name} does not match its header (local and central entries differ)')
-    if following is not None and start + info.compress_size + descriptor > following:
-        raise FrameError(f'{name} overlaps the next ZIP entry')
-    if info.compress_type == zipfile.ZIP_STORED:
-        if info.compress_size != size:
-            raise FrameError(f'{name} does not match its header (stored {info.compress_size} bytes, says {size})')
-        data = compressed
-    else:
-        inflate = zlib.decompressobj(-15)
-        try:
-            data = inflate.decompress(compressed, size + 1)
-        except zlib.error as e:
-            raise FrameError(f'{name} is corrupt: {e}') from e
-        if len(data) != size or not inflate.eof or inflate.unconsumed_tail or inflate.unused_data:
-            raise FrameError(f'{name} does not match its header (its compressed data is not exactly '
-                             f'{size} bytes with nothing after it)')
-    if zlib.crc32(data) != info.CRC:
-        raise FrameError(f'{name} does not match its checksum')
-    return data
-
-
-def merge_splits(base, splits, dst):
-    """One installable APK from a base APK and its splits (see split_entries), re-signed
-    with Frame Control's key, without the base's isSplitRequired flag."""
-    plan = split_entries(base, splits)
-    add, total = {}, 0
-    try:
-        for entry, (path, member, size) in plan.items():
-            data = read_member(path, member)
-            total += len(data)
-            if total > MAX_SPLIT_TOTAL:
-                raise FrameError(f'the split APKs add more than {MAX_SPLIT_TOTAL // 1024**3} GB')
-            add[entry] = data
-        with zipfile.ZipFile(base) as z:
-            original = frame_apk._read(z, 'AndroidManifest.xml', frame_apk.MAX_MANIFEST)
-        manifest = drop_split_required(original)
-        repack(base, dst, replace={'AndroidManifest.xml': manifest} if manifest != original else None, add=add)
-    except (OSError, ValueError, IndexError, struct.error, zipfile.BadZipFile, frame_apk.ApkError) as e:
-        raise FrameError(f'could not merge the split APKs: {e}') from e
-    return {'merged': sorted(os.path.basename(p) for p in splits), 'entries': len(plan)}
-
-
-def split_size(splits):
-    """Bytes a merge adds, from the split headers (merge_splits enforces the real sizes)."""
-    total = 0
-    for path in splits:
-        with zipfile.ZipFile(path) as z:
-            total += sum(m.file_size for m in z.infolist() if SPLIT_ADDS.match(m.filename))
-    return total
-
-
-def install(apk_path, flatscreen=None, name=None, source=None, icon_png=None, xr_compat=None, artwork=None,
-            splits=None):
-    """splits: the rest of a split APK (base first, as apk_path); merged into one APK first."""
-    if splits:
-        start = time.time()
-        with tempfile.TemporaryDirectory(prefix=f'{TMP_PREFIX}{os.getpid()}-') as tmp:
-            merged = os.path.join(tmp, 'merged.apk')
-            try:
-                merge_splits(apk_path, list(splits), merged)
-            except Exception as e:  # reported like any other failed install
-                _after_install(None, None, e, start)
-                raise
-            meta = install(merged, flatscreen, name, source or os.path.basename(apk_path), icon_png, xr_compat, artwork)
-            return meta
+def install(apk_path, flatscreen=None, name=None, source=None, icon_png=None, xr_compat=None, artwork=None):
     start, info = time.time(), None
     try:
         info = apk_info(apk_path)
@@ -501,31 +159,18 @@ def install(apk_path, flatscreen=None, name=None, source=None, icon_png=None, xr
         if flatscreen is None:
             flatscreen = not info['vr']
         # VR apps get the OpenXR compatibility layer unless told otherwise; it only
-        # changes calls SteamVR would otherwise reject. Without it OpenXR 1.0 apps
-        # still run, so a copy of Frame Control that lacks it installs anyway and
-        # says so, unless the layer was asked for explicitly.
-        add = {}
-        if info['vr'] if xr_compat is None else xr_compat:
-            try:
-                add = xr_compat_files(apk_path)
-            except LayerMissing:
-                if xr_compat:
-                    raise
-                info['vr_issues'] = list(info.get('vr_issues') or []) + [LAYER_MISSING_NOTE]
-                info['xr_layer_missing'] = True
+        # changes calls SteamVR would otherwise reject.
+        add = xr_compat_files(apk_path) if (info['vr'] if xr_compat is None else xr_compat) else {}
         with _install_lock:
             if add or info['repairable']:
-                with tempfile.TemporaryDirectory(prefix=f'{TMP_PREFIX}{os.getpid()}-') as tmp:
+                with tempfile.TemporaryDirectory(prefix='frame-vr-') as tmp:
                     patched = os.path.join(tmp, 'app.apk')
-                    try:
-                        info['patched'] = patch(apk_path, patched, add)['patched']
-                    except FrameError as e:
-                        raise FrameError(f'could not prepare the APK for the Frame: {e}') from e
+                    info['patched'] = patch(apk_path, patched, add)['patched']
                     info['launchable'] = True
                     meta = _install(patched, info, pkg, flatscreen, name, source or os.path.basename(apk_path), artwork)
             else:
                 meta = _install(apk_path, info, pkg, flatscreen, name, source, artwork)
-    except Exception as e:  # not only FrameError: every failed install is reported
+    except FrameError as e:
         _after_install(info, None, e, start)
         raise
     _after_install(info, meta, None, start)
@@ -571,7 +216,6 @@ def _install(apk_path, info, pkg, flatscreen, name, source, artwork=None):
                                               'source': source or os.path.basename(apk_path)})
         presentation['warnings'] = art_warnings + presentation.get('warnings', [])
         meta = {'package': pkg, 'label': name or info['label'], 'version': info['version'],
-                'version_code': info.get('version_code'),
                 'instance': iid, 'shortcut': shortcut, 'game_id': game_id(shortcut),
                 'vr': info.get('vr', False), 'vr_issues': info.get('vr_issues', []),
                 'launchable': info.get('launchable', False), 'patched': info.get('patched', []),
@@ -594,13 +238,6 @@ def _install(apk_path, info, pkg, flatscreen, name, source, artwork=None):
                 ssh(f'rm -rf {d}', timeout=30)
             except FrameError:
                 pass
-        elif not ok:
-            # An update that failed: the app still works, but a partial copy of the new APK
-            # (scp leaves one; it can be gigabytes) mustn't stay beside it.
-            try:
-                ssh(f'rm -f {d}/app.apk.part', timeout=30)
-            except FrameError:
-                pass
 
 
 
@@ -658,34 +295,6 @@ except (OSError, ValueError, TypeError, AttributeError):
 """
 
 
-def _apk_parser_script():
-    """Frame-side Python preamble that loads this copy's stdlib APK parser (frame_apk)."""
-    script = 'import sys, types, json, base64\n'
-    for module in ('frame_apk', 'frame_apk_vr'):
-        with open(os.path.join(ROOT, 'ui', module + '.py')) as f:
-            source = f.read()
-        script += f'm = types.ModuleType({module!r}); sys.modules[{module!r}] = m; exec({source!r}, m.__dict__)\n'
-    return script
-
-
-def installed_version_code(pkg):
-    """The version code of pkg's installed app.apk, read on the Frame (only its manifest
-    crosses the link), or None if there is no readable APK. Connection failures raise."""
-    if not PKG_RE.match(pkg or ''):
-        raise FrameError(f'bad package name {pkg!r}')
-    script = _apk_parser_script() + f"""try:
-    code = sys.modules['frame_apk'].apk_info({(APPS_DIR + '/' + pkg + '/app.apk')!r}).get('version_code')
-except Exception:
-    code = None
-print(json.dumps(code if isinstance(code, int) else None))
-"""
-    try:
-        code = json.loads(ssh('python3 -', input=script, timeout=120).strip().splitlines()[-1])
-    except (ValueError, IndexError):
-        return None
-    return code if isinstance(code, int) and not isinstance(code, bool) else None
-
-
 def art_missing(m):
     """True when a Frame Control install has no complete Steam artwork on record."""
     return set((m or {}).get('artwork') or {}) != set(frame_artwork.SLOTS)
@@ -707,7 +316,13 @@ def refresh_art(pkg=None, artwork=None, fill_only=False):
         m = _meta_or_fail(pkg)
         d = f'{APPS_DIR}/{pkg}'
         # Parse the APK on the Frame, transferring only its icon/label, not the APK.
-        script = _apk_parser_script()
+        modules = {}
+        for module in ('frame_apk', 'frame_apk_vr'):
+            with open(os.path.join(ROOT, 'ui', module + '.py')) as f:
+                modules[module] = f.read()
+        script = 'import sys, types, json, base64\n'
+        for module, source in modules.items():
+            script += f'm = types.ModuleType({module!r}); sys.modules[{module!r}] = m; exec({source!r}, m.__dict__)\n'
         script += f"info = sys.modules['frame_apk'].apk_info({(d + '/app.apk')!r})\n"
         script += "info['icon_png'] = base64.b64encode(info.get('icon_png') or b'').decode()\n"
         script += cached_art_script(d) + "info['artwork'] = cached\nprint(json.dumps(info))\n"
@@ -768,22 +383,10 @@ def _clean_meta(m):
     return m
 
 
-def running_instances(strict=False):
-    """Lepton container name -> adb port, for the instances that are running now.
-
-    strict: a failed `podman ps` raises FrameError instead of reading as "nothing running",
-    and containers without an adb port label count too (port None); for callers that must
-    not mistake an error for a stopped instance."""
-    if not strict:
-        out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}" 2>/dev/null || true')
-        return dict(line.split()[:2] for line in out.splitlines() if len(line.split()) >= 2)
-    out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}"')
-    found = {}
-    for line in out.splitlines():
-        cols = line.split()
-        if cols:
-            found[cols[0]] = cols[1] if len(cols) > 1 and cols[1] != '<no' else None
-    return found
+def running_instances():
+    """Lepton container name -> adb port, for the instances that are running now."""
+    out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}" 2>/dev/null || true')
+    return dict(line.split()[:2] for line in out.splitlines() if len(line.split()) >= 2)
 
 
 def list_apps():
@@ -932,11 +535,8 @@ def main():
             r = frame_apk_versions.alternatives(
                 info['package'] if info else args[0], info.get('version_code') if info else None)
         elif cmd == 'install':
-            files = [a for a in args if not a.startswith('--')]
-            if not files:
-                raise FrameError('install requires APK [SPLIT.apk ...]')
-            r = install(files[0], flatscreen=False if '--vr' in args else True if '--flat' in args else None,
-                        xr_compat=False if '--no-xr-compat' in args else None, splits=files[1:])
+            r = install(args[0], flatscreen=False if '--vr' in args else True if '--flat' in args else None,
+                        xr_compat=False if '--no-xr-compat' in args else None)
         elif cmd == 'refresh-art':
             if len(args) != 1:
                 raise FrameError('usage: refresh-art PACKAGE or refresh-art --all')

ui/frame_android_data.py

@@ -11,17 +11,16 @@ import tempfile
 import uuid
 
 import frame_android as android
-import frame_host
 
 REMOTE = Path(android.ROOT) / 'frame/android/app-data.py'
 
 
 def _stream(command, src=None, dst=None):
     try:
-        result = frame_host.run_ssh(['ssh', *android.SSH_OPTS, android.FRAME, command],
-                                    stdin=src if src else subprocess.DEVNULL,
-                                    stdout=dst if dst else subprocess.PIPE,
-                                    stderr=subprocess.PIPE, timeout=1800)
+        result = subprocess.run(['ssh', *android.SSH_OPTS, android.FRAME, command],
+                                stdin=src if src else subprocess.DEVNULL,
+                                stdout=dst if dst else subprocess.PIPE,
+                                stderr=subprocess.PIPE, timeout=1800)
     except subprocess.TimeoutExpired:
         raise android.FrameError('app-data transfer timed out')
     except OSError as error:

ui/frame_apk.py

@@ -7,7 +7,6 @@ the resource table in resources.arsc.
 """
 import struct
 import zipfile
-import zlib
 
 # android: attribute resource ids; names can be stripped by shrinkers, ids can't.
 ATTR = {0x01010001: 'label', 0x01010002: 'icon', 0x01010003: 'name',
@@ -222,9 +221,7 @@ def apk_info(path):
             res = Resources(_read(z, 'resources.arsc', MAX_ARSC) if 'resources.arsc' in names else b'')
             from frame_apk_vr import detection
             vr_info = detection(manifest_data, names)
-        # A damaged download: corrupt deflate data (zlib.error), a member cut short (EOFError),
-        # undecodable text (UnicodeDecodeError) or an encrypted entry (RuntimeError).
-        except (struct.error, IndexError, zipfile.BadZipFile, zlib.error, EOFError, ValueError, RuntimeError) as e:
+        except (struct.error, IndexError, zipfile.BadZipFile) as e:
             raise ApkError(f'could not read the APK manifest: {e}')
         tags = {}
         for tag, attrs in elements:

ui/frame_apk_vr.py

@@ -118,7 +118,7 @@ def detection(data, names):
     info, _ = inspect(data)
     issues = []
     if 'lib/arm64-v8a/libvrapi.so' in names:
-        issues.append("Uses Meta's legacy VrApi, which the Frame doesn't have; it may not run.")
+        issues.append("Uses Meta's legacy VrApi, which the Frame doesn't have; it won't run.")
     if any(n.endswith('/libovrplatformloader.so') for n in names):
         issues.append("Uses Meta's platform SDK; if it checks your Quest store licence it will quit.")
     if 'lib/arm64-v8a/libopenxr_loader.so' in names:
@@ -126,46 +126,3 @@ def detection(data, names):
         issues.append('Uses OpenXR (good).')
     info['vr_issues'] = issues
     return info
-
-
-IS_SPLIT_REQUIRED = 0x01010591  # android:isSplitRequired
-
-
-def drop_split_required(axml_bytes):
-    """The manifest without <application android:isSplitRequired>, for a base APK whose
-    splits were merged into it: Android refuses a lone base that still says it needs them."""
-    chunks = list(frame_apk._chunks(axml_bytes, 8, len(axml_bytes)))
-    pool = next((c for c in chunks if c[0] == 1), None)
-    if pool is None:
-        raise frame_apk.ApkError('AndroidManifest.xml has no string pool')
-    strings = frame_apk._string_pool(axml_bytes, pool[2])
-    resmap = ()
-    for kind, header_size, offset, chunk_size in chunks:
-        if kind == 0x180:
-            resmap = struct.unpack_from('<%dI' % ((chunk_size - header_size) // 4), axml_bytes, offset + header_size)
-    result, changed = bytearray(axml_bytes[:8]), False
-    for kind, hs, off, size in chunks:
-        chunk = bytearray(axml_bytes[off:off + size])
-        if kind == 0x0102 and not changed:
-            name, astart, asize, count = struct.unpack_from('<4xIHHH', chunk, hs)
-            if name < len(strings) and strings[name] == 'application':
-                for i in range(count):
-                    a = hs + astart + i * asize
-                    attr = struct.unpack_from('<I', chunk, a + 4)[0]
-                    known = resmap[attr] if attr < len(resmap) else None
-                    if known == IS_SPLIT_REQUIRED or (known is None and attr < len(strings)
-                                                      and strings[attr] == 'isSplitRequired'):
-                        del chunk[a:a + asize]
-                        struct.pack_into('<I', chunk, 4, len(chunk))
-                        struct.pack_into('<H', chunk, hs + 12, count - 1)
-                        # id/class/style attribute indexes are 1-based positions in the list.
-                        for at in (hs + 14, hs + 16, hs + 18):
-                            index = struct.unpack_from('<H', chunk, at)[0]
-                            struct.pack_into('<H', chunk, at, 0 if index == i + 1 else index - 1 if index > i + 1 else index)
-                        changed = True
-                        break
-        result += chunk
-    if not changed:
-        return axml_bytes
-    struct.pack_into('<I', result, 4, len(result))
-    return bytes(result)

ui/frame_connect.py

@@ -24,15 +24,10 @@ import urllib.error
 import urllib.request
 from pathlib import Path
 
-# The app runs this with python -I, which leaves the script's folder off sys.path.
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-import frame_host  # noqa: E402
-
 FRAME_USER = os.environ.get("FRAME_USER", "steamos")
 USER_FROM_ENV = "FRAME_USER" in os.environ
 FRAME_ALIAS = os.environ.get("FRAME_ALIAS", "frame")
-# $FRAME_CONTROL_SSH_DIR in tests, as frame_devices.ssh_dir(), so they never touch the real one.
-SSH_DIR = Path(os.environ.get("FRAME_CONTROL_SSH_DIR") or Path.home() / ".ssh")
+SSH_DIR = Path.home() / ".ssh"
 KEY = SSH_DIR / "id_ed25519_frame"
 # The devkit service only accepts ssh-rsa keys (write_key in Valve's
 # steamos-devkit-service), so pairing uses a second key next to the ed25519 one.
@@ -335,9 +330,8 @@ def _write_config(host, port, user):
     block = config_block(host, port, user)
     tmp = CONFIG.with_name(f"config.frame-control.{os.getpid()}.tmp")
     tmp.write_text("\n".join(block + kept) + "\n", encoding="utf-8")
-    if not frame_host.make_private(tmp):
-        say("    couldn't make ~/.ssh/config private; if ssh says \"Bad owner or permissions\", "
-            "Frame Control repairs it when it next connects")
+    if os.name != "nt":
+        tmp.chmod(0o600)
     # On Windows a running ssh.exe (Frame Control's own, say) keeps the config open
     # and locked, so the swap can fail for a moment; keep trying for a while.
     for attempt in range(60):
@@ -355,9 +349,9 @@ def _write_config(host, port, user):
 
 def key_login_works():
     # accept-new: trust a first-seen host key (as the copy step does); a changed one still fails.
-    return frame_host.run_ssh(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
-                               "-o", "StrictHostKeyChecking=accept-new", FRAME_ALIAS, "true"],
-                              capture_output=True).returncode == 0
+    return subprocess.run(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
+                           "-o", "StrictHostKeyChecking=accept-new", FRAME_ALIAS, "true"],
+                          capture_output=True).returncode == 0
 
 
 def configured_user():

ui/frame_contact.py

@@ -1,252 +0,0 @@
-"""An email address the person chooses to leave, and what it may be used for. Python stdlib only.
-
-Two separate opt-in choices, both off until ticked:
-
-- updates: occasional notices about Frame Control releases and updates
-- followup: the maintainer may ask follow-up questions, mainly about problem reports
-
-The address and the choices are kept on this computer (frame_host.data_dir('contact')) and
-sent privately to Frame Control's PostHog project as a `contact_consent` event, the same way
-as problem reports (frame_report.py), so only the maintainer can read them. Every change
-sends a new event under this copy's own random contact id (not the analytics id), numbered
-by `rev`, and the highest rev for an id is the one that counts, whatever the clocks say:
-removing the address sends a withdrawal with no address in it, and wipes the address from
-the local log of what was sent. The maintainer lists who agreed to what with
-`python3 ui/frame_report.py contacts`. Nothing here sends email.
-
-A change that can't be sent (offline) waits in the state file and is retried in the
-background, so a withdrawal is never lost. The page's one-time prompt is remembered here
-too: once it has been shown or dismissed it never comes back.
-"""
-import json
-import os
-import re
-import threading
-import time
-import uuid
-
-import frame_host
-import frame_telemetry
-
-STATE = frame_host.data_dir('contact')
-FILE = STATE / 'contact.json'
-EMAIL_MAX = 254
-EMAIL_RE = re.compile(r'[^@\s]+@[^@\s]+\.[^@\s.]+')
-PROMPTS = ('new', 'shown', 'dismissed', 'answered')
-RETRY_EVERY = 600
-
-_lock = threading.RLock()
-_send_lock = threading.Lock()  # one send at a time, so events reach PostHog in rev order
-_removed = {}  # address (lower case) -> when it was removed, for reports still being sent then
-_wake = threading.Event()
-_retrier = None
-
-
-def _defaults():
-    return {'id': str(uuid.uuid4()), 'email': '', 'updates': False, 'followup': False,
-            'prompt': 'new', 'pending': None, 'rev': 0}
-
-
-def load():
-    with _lock:
-        s = _defaults()
-        try:
-            with open(FILE) as f:
-                saved = json.load(f)
-            if isinstance(saved, dict):
-                s.update({k: v for k, v in saved.items() if k in s})
-        except (OSError, ValueError):
-            pass
-        return s
-
-
-def _save(s):
-    STATE.mkdir(parents=True, exist_ok=True)
-    tmp = FILE.with_suffix('.tmp')
-    tmp.write_text(json.dumps(s, indent=1))
-    os.replace(tmp, FILE)
-
-
-def valid_email(email):
-    return len(email) <= EMAIL_MAX and bool(EMAIL_RE.fullmatch(email))
-
-
-def flag(body, key):
-    """A consent choice: true only when it really is true (not "false" or 1), left out is no."""
-    v = body.get(key)
-    if v is not None and not isinstance(v, bool):
-        raise ValueError(f'{key} must be true or false')
-    return v is True
-
-
-def from_report(email):
-    """Follow-up questions agreed to with a problem report: the address becomes the contact
-    email with that choice ticked, so it shows in Settings and is removed the same way. Update
-    notices stay on only for the same address: a different one replaces the old address with
-    follow-up questions only (the report form says so before sending). Returns (contact id,
-    rev) for the report to carry, read together with the change itself: a later change from
-    this copy has a higher rev, and the newest such change decides whether the report's
-    follow-up permission still stands, whatever the clocks say."""
-    with _lock:
-        s = load()
-        same = s['email'].lower() == email.lower()
-        changed, cid, rev = _apply({'email': s['email'] if same else email,
-                                    'updates': s['updates'] and same, 'followup': True})
-    _deliver(changed)
-    return cid, rev
-
-
-def state():
-    """What the page shows. showPrompt: the one-time prompt hasn't been shown or answered yet,
-    and the Frame has connected at least once (setup worked), so it never greets a new install."""
-    s = load()
-    set_up = bool(frame_telemetry.settings().get('frames_seen'))
-    return {'email': s['email'], 'updates': s['updates'], 'followup': s['followup'],
-            'waiting': s['pending'] is not None, 'showPrompt': s['prompt'] == 'new' and set_up}
-
-
-def _event(s):
-    email = s['email'] if s['updates'] or s['followup'] else ''
-    return {'event': 'contact_consent', 'distinct_id': s['id'], 'uuid': str(uuid.uuid4()),
-            'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
-            'properties': {**frame_telemetry.common(), 'email': email, 'updates': bool(email and s['updates']),
-                           'followup': bool(email and s['followup']),
-                           'action': 'set' if email else 'withdraw', 'rev': s['rev'], 'level': 'contact'}}
-
-
-def _send_pending(block=True):
-    """Send what's waiting, including changes made while sending. True if nothing is left
-    waiting. Without block, a send already under way is left to pick up the newest change."""
-    if not _send_lock.acquire(blocking=block):
-        return False
-    try:
-        while True:
-            with _lock:
-                event = load()['pending']
-            if event is None:
-                break
-            try:
-                frame_telemetry.post([event], timeout=30)
-            except frame_telemetry.SendError:
-                return False
-            _sent(event)
-    finally:
-        _send_lock.release()
-    # A change saved just as this finished found the lock still held and left it to us.
-    with _lock:
-        left = load()['pending'] is not None
-    return _send_pending(block=False) if left else True
-
-
-def _sent(event):
-    with _lock:
-        s = load()
-        if s['pending'] and s['pending'].get('uuid') == event['uuid']:  # not replaced meanwhile
-            s['pending'] = None
-            _save(s)
-        # A withdrawal, or the address still in use: not an old one removed while this was on its way.
-        if event['properties']['email'] in ('', s['email']):
-            try:
-                frame_telemetry.record_sent([event])
-            except OSError:
-                pass
-
-
-def _forget_locally(email):
-    """Take a removed address out of the log of what was sent (contact events and reports)."""
-    with frame_telemetry._lock:
-        _removed[email.lower()] = time.time()
-        rows = frame_telemetry._read_lines(frame_telemetry.SENT)
-        hit = False
-        for e in rows:
-            p = e.get('properties') or {}
-            for k in ('email', 'contact'):
-                if p.get(k) and str(p[k]).strip().lower() == email.lower():
-                    p[k], hit = '<removed>', True
-        if hit:
-            frame_telemetry._write_lines(frame_telemetry.SENT, rows)
-
-
-def redact_removed(event, started):
-    """Before logging a report (started at time.time() `started`) whose address was removed
-    while it was being sent: take the address out. Call with frame_telemetry._lock held, so a
-    removal can't slip between this and the log."""
-    p = event.get('properties') or {}
-    removed_at = _removed.get(str(p.get('contact') or '').strip().lower())
-    if removed_at is not None and started <= removed_at:
-        p['contact'] = '<removed>'
-
-
-def save(body):
-    """Set, change or remove the address and the two choices. An address needs at least one
-    choice ticked; an empty address (or neither ticked) removes it and withdraws both."""
-    _deliver(_apply(body)[0])
-    return state()
-
-
-def _apply(body):
-    """save()'s change, kept here and waiting to send. Returns (changed, contact id, rev)."""
-    email = str(body.get('email') or '').strip()
-    updates, followup = flag(body, 'updates'), flag(body, 'followup')
-    if email and not valid_email(email):
-        raise ValueError("that doesn't look like an email address")
-    if email and not (updates or followup):
-        raise ValueError('tick what the address may be used for, or remove it')
-    if not email:
-        updates = followup = False
-    with _lock:
-        s = load()
-        old = s['email']
-        changed = (email, updates, followup) != (s['email'], s['updates'], s['followup'])
-        s.update(email=email, updates=updates, followup=followup)
-        if body.get('fromPrompt') or email:
-            s['prompt'] = 'answered'
-        if changed:
-            # Only the newest choice matters, so it replaces anything still waiting. A withdrawal
-            # is sent even for an address still waiting here: its send may already be under way.
-            s['rev'] += 1
-            s['pending'] = _event(s)
-        _save(s)
-        if old and old.lower() != email.lower():
-            try:
-                _forget_locally(old)
-            except OSError:
-                pass
-        return changed, s['id'], s['rev']
-
-
-def _deliver(changed):
-    if changed and not _send_pending(block=False):
-        _wake.set()  # offline, or a send under way that will take this change with it
-
-
-def prompt(body):
-    """The one-time prompt was shown, or dismissed with No thanks. Either way it stays gone."""
-    action = body.get('prompt')
-    if action not in ('shown', 'dismissed'):
-        raise ValueError('unknown prompt action')
-    with _lock:
-        s = load()
-        if s['prompt'] in ('new', 'shown'):
-            s['prompt'] = action
-            _save(s)
-    return state()
-
-
-def start():
-    """Retry a change that couldn't be sent, from now on in the background."""
-    global _retrier
-    if _retrier:
-        return
-
-    def loop():
-        while True:
-            try:
-                _send_pending()
-            except Exception:
-                pass
-            _wake.wait(RETRY_EVERY)
-            _wake.clear()
-
-    _retrier = threading.Thread(target=loop, name='contact', daemon=True)
-    _retrier.start()

ui/frame_devices.py

@@ -28,10 +28,8 @@ remembered IP is caught.
 
 Python stdlib only.
 """
-import base64
 import contextlib
 import copy
-import hashlib
 import json
 import os
 import re
@@ -243,7 +241,8 @@ def _write_config(path, text, expected):
     try:
         with os.fdopen(fd_, "w", encoding="utf-8") as fh:
             fh.write(text)
-        frame_host.make_private(tmp)  # best effort: an edit still beats none (repair_permissions insists)
+        if not frame_host.WINDOWS:
+            tmp.chmod(0o600)
         for attempt in range(20):  # Windows: a running ssh.exe can hold the file for a moment
             if read_config(path) != expected:
                 return False
@@ -272,37 +271,6 @@ def _edit_config(path, change):
         raise OSError(f"{path} kept changing while Frame Control tried to update it")
 
 
-def repair_permissions(path=None):
-    """Give ~/.ssh/config make_private's ACL by swapping in a byte-for-byte copy: for a
-    file Windows' OpenSSH refuses ("Bad owner or permissions"). -> True only if the copy
-    got that ACL and replaced the file."""
-    path = Path(path or ssh_config())
-    with _config_lock, file_lock(path.with_name(LOCK_NAME)):
-        try:
-            data = path.read_bytes()
-        except OSError:
-            return False
-        fd_, tmp = tempfile.mkstemp(prefix="config.frame-control.", dir=str(path.parent))
-        tmp = Path(tmp)
-        try:
-            with os.fdopen(fd_, "wb") as fh:
-                fh.write(data)
-            if not frame_host.make_private(tmp):
-                return False
-            for attempt in range(20):  # a running ssh.exe can hold the file for a moment
-                if path.read_bytes() != data:
-                    return False
-                try:
-                    os.replace(tmp, path)
-                    return True
-                except PermissionError:
-                    time.sleep(0.25)
-            return False
-        finally:
-            if tmp.exists():
-                tmp.unlink()
-
-
 def rewrite_block(alias, path=None, hostname=None, user=None, port=None, expect=None):
     """Change HostName, User or Port inside ALIAS's managed block, leaving the rest of the
     file alone. -> True if the file changed. Does nothing if there's no such block, or
@@ -365,8 +333,8 @@ def remove_block(alias, path=None):
 def effective_port(alias, config):
     """The port ssh uses for ALIAS with this config file (`ssh -F FILE -G ALIAS`), else 22."""
     try:
-        out = frame_host.run_ssh(["ssh", "-F", str(config), "-G", alias], capture_output=True, text=True,
-                                 stdin=subprocess.DEVNULL, timeout=10).stdout
+        out = subprocess.run(["ssh", "-F", str(config), "-G", alias], capture_output=True, text=True,
+                             stdin=subprocess.DEVNULL, timeout=10).stdout
     except (OSError, subprocess.TimeoutExpired):
         return 22
     m = re.search(r"^port (\d+)$", out, re.M)
@@ -378,8 +346,8 @@ def effective_port(alias, config):
 
 def _keygen(*args):
     try:
-        return frame_host.run_ssh(["ssh-keygen", *args], capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                                  timeout=10)
+        return subprocess.run(["ssh-keygen", *args], capture_output=True, stdin=subprocess.DEVNULL, text=True,
+                              timeout=10)
     except (OSError, subprocess.TimeoutExpired):
         return None
 
@@ -420,100 +388,19 @@ def seed_pin(device_id, hosts, port=22, sources=None):
                 if len(f) >= 3 and not line.startswith("#") and not f[0].startswith("@"):
                     keys.append(f"{name} {f[1]} {f[2]}")
         if keys:
-            _write_pin(device_id, keys)
+            target = known_hosts(device_id)
+            target.parent.mkdir(**({} if frame_host.WINDOWS else {"mode": 0o700}), parents=True, exist_ok=True)
+            fd_, tmp = tempfile.mkstemp(prefix=".seed-", dir=str(target.parent))
+            with os.fdopen(fd_, "w", encoding="utf-8") as fh:
+                fh.write("\n".join(dict.fromkeys(keys)) + "\n")
+            os.replace(tmp, target)  # whole file at once: ssh never sees half of it
             return True
     return False
 
 
-def pin_dir():
-    """Where the per-headset files go, created private: ssh won't create it itself."""
-    d = ssh_dir() / PIN_DIR
-    d.mkdir(**({} if frame_host.WINDOWS else {"mode": 0o700}), parents=True, exist_ok=True)
-    return d
-
-
-def _write_pin(device_id, lines):
-    target = known_hosts(device_id)
-    fd_, tmp = tempfile.mkstemp(prefix=".seed-", dir=str(pin_dir()))
-    with os.fdopen(fd_, "w", encoding="utf-8") as fh:
-        fh.write("\n".join(dict.fromkeys(lines)) + "\n")
-    frame_host.make_private(tmp)  # Windows: this user only, not the folder's inherited ACL
-    os.replace(tmp, target)  # whole file at once: ssh never sees half of it
-
-
-# The host key types OpenSSH writes to known_hosts.
-KEY_TYPE_RE = re.compile(r"ssh-ed25519|ssh-rsa|ssh-dss|ecdsa-sha2-nistp(?:256|384|521)|"
-                         r"sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com")
-
-
-def fingerprint(blob):
-    """OpenSSH's SHA256 fingerprint of a base64 key blob (what `ssh-keygen -l` and ssh -v print),
-    or None if it isn't base64."""
-    try:
-        raw = base64.b64decode(blob, validate=True)
-    except (ValueError, TypeError):
-        return None
-    return "SHA256:" + base64.b64encode(hashlib.sha256(raw).digest()).decode().rstrip("=")
-
-
-def key_entry(line, name):
-    """(type, blob, fingerprint) from a known_hosts line for `name`, or None."""
-    f = (line or "").split()
-    if len(f) < 3 or line.startswith("#") or name not in f[0].split(",") or not KEY_TYPE_RE.fullmatch(f[1]):
-        return None
-    fp = fingerprint(f[2])
-    return (f[1], f[2], fp) if fp else None
-
-
-def pinned_keys(device_id):
-    """[(type, fingerprint)] of the keys saved for a headset (plain entries only)."""
-    try:
-        lines = known_hosts(device_id).read_text(encoding="utf-8").splitlines()
-    except (OSError, UnicodeDecodeError):
-        return []
-    name = host_key_alias(device_id)
-    return [(e[0], e[2]) for e in (key_entry(line, name) for line in lines) if e]
-
-
-def pin_key(device_id, key_type, blob):
-    """Save one key as the headset's whole identity, replacing whatever was saved: what the
-    person confirmed after seeing its fingerprint (see frame_link.Link.trust_identity)."""
-    if not KEY_TYPE_RE.fullmatch(key_type or "") or not fingerprint(blob):
-        raise DeviceError("That isn't an SSH host key")
-    _write_pin(device_id, [f"{host_key_alias(device_id)} {key_type} {blob}"])
-
-
-def scan_file(device_id):
-    """(path, how ssh is told) for a throwaway known_hosts file that a key check writes the
-    headset's key to, without touching the saved one. `~` as in known_hosts_opt."""
-    name = f".scan-{device_id}-{secrets.token_hex(4)}"
-    path = pin_dir() / name
-    path.touch(**({} if frame_host.WINDOWS else {"mode": 0o600}))
-    frame_host.make_private(path)
-    return path, (str(path) if os.environ.get("FRAME_CONTROL_SSH_DIR") else f"~/.ssh/{PIN_DIR}/{name}")
-
-
-def identity_established(device):
-    """Whether this headset ever had an SSH identity here: the device's own flag (set once it
-    had a key or a connection that worked, and never cleared, whatever happens to its
-    addresses), a fingerprint recorded in devices.json, a pin file at all (even empty,
-    unreadable or not parseable), or an address that worked. Then a missing or unusable pin
-    fails closed, needing Check its key; only a headset with none of these may save the
-    first key it meets (accept-new)."""
-    if device.get("identity_established") or device.get("identity"):
-        return True
-    try:
-        if os.path.lexists(known_hosts(device["id"])):
-            return True
-    except OSError:
-        return True
-    return any(a.get("last_ok") for a in device.get("addresses") or ())
-
-
 def forget_pin(device_id):
-    """Drop a headset's saved key (the headset was removed, or the API's forget-identity).
-    The next connection trusts whatever key the headset shows, as a first connection does;
-    the page's Trust a new key flow (frame_link) shows the key first instead."""
+    """Drop a headset's saved key, e.g. after SteamOS was reinstalled. The next connection
+    trusts whatever key the headset shows, as a first connection does."""
     try:
         known_hosts(device_id).unlink()
         return True
@@ -593,10 +480,6 @@ class Registry:
             for a in d["addresses"]:
                 a.setdefault("networks", [])
                 a.setdefault("label", "")
-            if d.get("identity") or any(a.get("last_ok") for a in d["addresses"]):
-                # Files from before the flag existed: it had an identity (or a connection that
-                # worked, which saved one). Kept from now on, whatever happens to its addresses.
-                d["identity_established"] = True
             return NAME_RE.fullmatch(d.get("id", "")) is not None
         except (KeyError, TypeError, DeviceError):
             return False
@@ -740,7 +623,9 @@ class Registry:
                 return a
         raise DeviceError(f"{host} isn't one of this headset's addresses")
 
-    def add_address(self, device_id, host, kind=None, label=""):
+    def add_address(self, device_id, host, kind=None, label="", first=False):
+        """Add an address at the end of the list, or at the front (first=True), where the
+        user's order makes it win over the others that work on the same network."""
         with self._changing():
             d = self._find(device_id)
             a = new_address(host, kind, label)
@@ -748,7 +633,7 @@ class Registry:
                 raise DeviceError(f"{a['host']} is already on the list")
             if len(d["addresses"]) >= 32:
                 raise DeviceError("That's enough addresses for one headset")
-            d["addresses"].append(a)
+            d["addresses"].insert(0 if first else len(d["addresses"]), a)
             self.save()
             return copy.deepcopy(a)
 
@@ -799,25 +684,8 @@ class Registry:
                 a["networks"] = (a["networks"] + [network_id])[-16:]
             a["last_ok"] = time.time()
             a["last_rtt_ms"] = rtt_ms
-            self._find(device_id)["identity_established"] = True  # survives editing the address away
             self.save()
 
-    def record_identity(self, device_id, fingerprints):
-        """Remember the fingerprints of the key saved for a headset, so that losing the pin
-        file later can't turn into trusting whatever answers (identity_established)."""
-        fingerprints = [f for f in fingerprints if isinstance(f, str) and f.startswith("SHA256:")][:8]
-        if not fingerprints:
-            return
-        with self._changing():
-            try:
-                d = self._find(device_id)
-            except DeviceError:
-                return
-            if d.get("identity") != fingerprints or not d.get("identity_established"):
-                d["identity"] = fingerprints
-                d["identity_established"] = True
-                self.save()
-
     def undismiss(self, alias):
         """Set Up Connection is about to run for this alias: import its block again."""
         with self._changing():
@@ -901,17 +769,15 @@ class Registry:
                         d["addresses"].append(dict(new_address(host), label="From Set Up Connection"))
                     d["config_host"] = host
                     changed = True
-                    if seed and host and seed_pin(d["id"], [host], b["port"]):
-                        d["identity"] = [f for _, f in pinned_keys(d["id"])][:8] or d.get("identity")
-                        d["identity_established"] = True
+                    if seed and host:
+                        seed_pin(d["id"], [host], b["port"])
                 elif host and host != d.get("config_host"):
                     # Set Up Connection ran again and found the headset somewhere new.
                     d["config_host"] = host
                     if not any(a["host"] == host for a in d["addresses"]):
                         d["addresses"].insert(0, dict(new_address(host), label="From Set Up Connection"))
-                    if seed and seed_pin(d["id"], [host], b["port"]) and not d.get("identity"):
-                        d["identity"] = [f for _, f in pinned_keys(d["id"])][:8] or None
-                        d["identity_established"] = True
+                    if seed:
+                        seed_pin(d["id"], [host], b["port"])
                     changed = True
                 if d.get("config_login") != [user, b["port"]]:
                     # Set Up Connection (or an edit) changed who to log in as, or the port.

ui/frame_host.py

@@ -5,17 +5,12 @@ Everything here runs on your computer, not the Frame. Python stdlib only.
 CLI (used by the Electron app, so terminal handling lives in one place):
   python3 ui/frame_host.py terminal -- CMD [ARG...]   # open CMD in a terminal window
 """
-import hashlib
-import io
 import os
-import re
 import shlex
 import shutil
-import socket
 import ssl
 import subprocess
 import sys
-import tempfile
 from pathlib import Path
 
 MAC = sys.platform == "darwin"
@@ -37,68 +32,6 @@ class HostError(RuntimeError):
     pass
 
 
-# The start of a line in which ssh itself says the link to the headset failed (not the command it ran).
-# That includes ssh refusing the headset's host key, and the headset refusing this computer's
-# key ("user@host: Permission denied (publickey,...)."): either way no command ran.
-SSH_LINK_FAILED = re.compile(r"^(?:ssh: connect to host |ssh: Could not resolve hostname |banner exchange: |"
-                             r"kex_exchange_identification: |mux_client_\w+: |client_loop: |"
-                             r"Connection (?:closed|reset) by \S+ port \d+|Connection timed out during banner exchange|"
-                             r"Host key verification failed\.|No \S+ host key is known for |"
-                             r"[^\n@:]{1,64}@\S+: Permission denied \()",  # a Windows user name may have spaces
-                             re.M)
-
-
-def ssh_link_failed(returncode, stderr):
-    """Whether an ssh run failed to reach the headset: ssh's own exit code (255) and its own words."""
-    return returncode == 255 and bool(SSH_LINK_FAILED.search(stderr or ""))
-
-
-def link_failure(error):
-    """Mark an exception as ssh failing to reach the headset, judged where ssh ran (so error
-    reports can tell it from a message that only looks like one: a file name, say)."""
-    error.frame_link_failed = True
-    return error
-
-
-class Unreachable(HostError):
-    """The Frame, or a service on it, didn't answer: the person's to sort out, not a fault here."""
-
-
-def run_ssh(argv, **kwargs):
-    """Run an OpenSSH tool without Windows' redirected-stderr pipe hang.
-
-    A real temporary file avoids OpenSSH's blocked asynchronous stderr writes,
-    while keeping subprocess.run's captured output, text, check and timeout API.
-    """
-    if not WINDOWS:
-        return subprocess.run(argv, **kwargs)
-    if kwargs.pop("capture_output", False):
-        if kwargs.get("stdout") is not None or kwargs.get("stderr") is not None:
-            raise ValueError("stdout and stderr arguments may not be used with capture_output")
-        kwargs.update(stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    if kwargs.get("stderr") != subprocess.PIPE:
-        return subprocess.run(argv, **kwargs)
-    check = kwargs.pop("check", False)
-    text = any(kwargs.get(key) for key in ("text", "universal_newlines", "encoding", "errors"))
-    with tempfile.TemporaryFile() as stderr:
-        kwargs["stderr"] = stderr
-        try:
-            result = subprocess.run(argv, **kwargs)
-        except subprocess.TimeoutExpired as error:
-            stderr.seek(0)
-            error.stderr = stderr.read()
-            raise
-        stderr.seek(0)
-        if text:
-            with io.TextIOWrapper(stderr, encoding=kwargs.get("encoding"), errors=kwargs.get("errors")) as reader:
-                result.stderr = reader.read()
-        else:
-            result.stderr = stderr.read()
-    if check:
-        result.check_returncode()
-    return result
-
-
 def data_dir(*parts):
     """Per-user app data: ~/Library/Application Support, %APPDATA% or $XDG_DATA_HOME
     (or $FRAME_CONTROL_DATA_DIR, which the tests point at a throwaway directory)."""
@@ -220,19 +153,6 @@ def open_path(path):
                      stderr=subprocess.DEVNULL, **DETACHED)
 
 
-def reveal_path(path):
-    """Show a file selected in its folder (Linux file managers vary, so there the folder opens)."""
-    path = Path(path)
-    if MAC:
-        cmd = ["open", "-R", str(path)]
-    elif WINDOWS:
-        cmd = f'explorer /select,"{path}"'  # as one string: Explorer wants the quotes after the comma
-    else:
-        return open_path(path.parent)
-    subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-                     stderr=subprocess.DEVNULL, **DETACHED)
-
-
 open_url = open_path  # the same openers hand URLs to the default browser
 
 
@@ -308,46 +228,10 @@ def clipboard_text():
     raise HostError("Can't read the clipboard")
 
 
-# What Windows' OpenSSH says when it refuses ~/.ssh/config (or a key) for its ACL.
-BAD_PERMISSIONS = "Bad owner or permissions on "
-
-
-def make_private(path):
-    """Leave only this user able to open PATH, as ssh insists for ~/.ssh/config.
-    Windows: an ACL of just this user, SYSTEM and Administrators, inherited nothing.
-    A file written into ~/.ssh otherwise takes the folder's ACL, and Windows' OpenSSH
-    refuses it if that grants anyone else, even an account deleted long ago
-    ("Bad owner or permissions"). Best effort: -> False if it couldn't."""
-    if not WINDOWS:
-        try:
-            os.chmod(path, 0o600)
-            return True
-        except OSError:
-            return False
-    me = os.environ.get("USERNAME", "")
-    try:  # "desktop\me","S-1-5-21-..."
-        # Bytes: the account name is in the console's code page, the SID is ASCII.
-        out = subprocess.run(["whoami", "/user", "/fo", "csv", "/nh"], capture_output=True,
-                             stdin=subprocess.DEVNULL, timeout=10).stdout
-        sid = out.decode("ascii", "replace").strip().rsplit(",", 1)[-1].strip('"')
-        if sid.startswith("S-1-"):
-            me = "*" + sid
-    except (OSError, subprocess.TimeoutExpired):
-        pass
-    if not me:
-        return False
-    try:
-        return subprocess.run(["icacls", str(path), "/inheritance:r", "/grant:r", f"{me}:F",
-                               "*S-1-5-18:F", "*S-1-5-32-544:F"], capture_output=True,
-                              stdin=subprocess.DEVNULL, timeout=10).returncode == 0
-    except (OSError, subprocess.TimeoutExpired):
-        return False
-
-
 def ssh_hostname(alias):
     """The real host name an ssh alias points at (`ssh -G`), for non-SSH clients like RDP."""
     try:
-        out = run_ssh(["ssh", "-G", alias], capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=10).stdout
+        out = subprocess.run(["ssh", "-G", alias], capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=10).stdout
     except (OSError, subprocess.TimeoutExpired):
         return alias
     for line in out.splitlines():
@@ -380,65 +264,24 @@ def open_steam_link():
     return "Steam Link isn't installed; opened its download page"
 
 
-RDP_PORT = 3389
-RDP_USER = "steamos"  # xrdp signs in with the Developer Mode password, not this computer's
-# xrdp's certificate is its own, so every client warns about it first.
-RDP_LOGIN = (f"accept the warning about the Frame's certificate, then sign in as {RDP_USER} "
-             "with your Developer Mode password")
-
-
-def check_rdp(host, timeout=3):
-    """Raise Unreachable, saying why, unless the Frame's RDP port takes a connection."""
-    try:
-        with socket.create_connection((host, RDP_PORT), timeout=timeout):
-            return
-    except ConnectionRefusedError:
-        raise Unreachable(f"The Frame at {host} is on but isn't accepting remote desktop (port {RDP_PORT} "
-                          "refused). Turn on Developer Mode in Steam Settings > System on the headset, "
-                          "then restart it and try again.") from None
-    except socket.gaierror:
-        raise Unreachable(f"Can't find {host} on the network for remote desktop. Check the headset's "
-                          "address on the Devices tab.") from None
-    except OSError as e:
-        raise Unreachable(f"The Frame didn't answer remote desktop at {host} ({e}). It may be asleep, "
-                          "switched off or on another network; if it's on, check Developer Mode is on "
-                          "in Steam Settings > System.") from None
-
-
-def rdp_file(host):
-    """A Remote Desktop connection file for the Frame. mstsc /v: alone offers this
-    computer's Windows account, which xrdp turns away; the file names steamos instead."""
-    if any(c in host for c in "\r\n"):
-        raise HostError("That headset address can't be used for remote desktop")
-    # One file per address, so two launches close together can't swap headsets.
-    path = cache_dir(f"frame-{hashlib.sha256(host.encode()).hexdigest()[:16]}.rdp")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with open(path, "w", encoding="utf-8", newline="\r\n") as f:  # Path.write_text(newline=) is 3.10+
-        f.write(f"full address:s:{host}\nusername:s:{RDP_USER}\n")
-    return path
-
-
 def open_rdp(alias, host=None):
     """Remote desktop to the Frame's xrdp (user steamos), at `host` or where the alias points."""
     host = host or ssh_hostname(alias)
-    # The client would open either way and then fail on its own, with nothing said here.
-    check_rdp(host)
     if MAC:
         if subprocess.run(["open", "-a", "Windows App"], capture_output=True).returncode == 0:
-            return f"Opened Windows App: connect to {host} and {RDP_LOGIN}"
+            return "Opened Windows App"
         open_url("https://apps.apple.com/app/windows-app/id1295203466")
         return "Windows App isn't installed; opened its App Store page"
     if WINDOWS:
-        _spawn(["mstsc.exe", str(rdp_file(host))])
-        # Windows asks about the unsigned connection file first.
-        return f"Opened Remote Desktop to {host}: choose Connect, {RDP_LOGIN}"
+        _spawn(["mstsc.exe", f"/v:{host}"])
+        return f"Opened Remote Desktop to {host}"
     if which("remmina"):
-        _spawn(["remmina", "-c", f"rdp://{RDP_USER}@{host}"])
-        return f"Opened Remmina to {host}: {RDP_LOGIN}"
+        _spawn(["remmina", "-c", f"rdp://steamos@{host}"])
+        return f"Opened Remmina to {host}"
     for name in ("xfreerdp3", "xfreerdp"):
         if which(name):
-            _spawn([name, f"/v:{host}", f"/u:{RDP_USER}", "/dynamic-resolution"])
-            return f"Opened FreeRDP to {host}: {RDP_LOGIN}"
+            _spawn([name, f"/v:{host}", "/u:steamos", "/dynamic-resolution"])
+            return f"Opened FreeRDP to {host}"
     raise HostError("No RDP client found: install Remmina or FreeRDP")
 
 

ui/frame_link.py

@@ -28,21 +28,16 @@ Python stdlib only. Runs on this computer, never on the Frame.
 import copy
 import hashlib
 import ipaddress
-import os
 import queue
 import re
-import shlex
 import socket
 import subprocess
-import sys
-import tempfile
 import threading
 import time
 
 import frame_devices
 import frame_host
 import frame_network
-import frame_telemetry
 
 PROBE_TIMEOUT = 4      # seconds for a TCP answer on port 22
 RESOLVE_GRACE = 6      # ...after however long the name lookup took, up to this much
@@ -53,7 +48,6 @@ NETWORK_EVERY = 5      # how often the network fingerprint is read
 TAILSCALE_EVERY = 30
 RETRY = (5, 10, 20, 30)  # seconds before automatic retries after a failure
 REQUEST_GAP = 5        # a request may start a new attempt this long after the last one
-SCAN_TTL = 600         # a key shown for "Trust a new key" may be trusted this long after it was read
 
 STAGES = [("network", "Checking this computer's network"), ("find", "Finding the headset"),
           ("ssh", "Opening SSH"), ("identity", "Checking the headset's identity"),
@@ -80,8 +74,8 @@ def ssh_g(alias):
     """(hostname, port, user, proxied) from `ssh -G ALIAS`, for a headset that's only an
     ssh alias. proxied: it goes through ProxyJump or ProxyCommand, so only ssh can reach it."""
     try:
-        out = frame_host.run_ssh(["ssh", "-G", alias], capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                                 timeout=10).stdout
+        out = subprocess.run(["ssh", "-G", alias], capture_output=True, stdin=subprocess.DEVNULL, text=True,
+                             timeout=10).stdout
     except (OSError, subprocess.TimeoutExpired):
         out = ""
     got = {}
@@ -94,32 +88,6 @@ def ssh_g(alias):
     return got.get("hostname") or alias, port, got.get("user"), proxied
 
 
-def proxy_route(alias):
-    """How ~/.ssh/config sends ALIAS: (None, None) directly, ("jump", spec) through
-    ProxyJump, or ("command", text) through a ProxyCommand."""
-    try:
-        out = frame_host.run_ssh(["ssh", "-G", alias], capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                                 timeout=10).stdout
-    except (OSError, subprocess.TimeoutExpired):
-        out = ""
-    got = {}
-    for line in out.splitlines():
-        k, _, v = line.partition(" ")
-        if k in ("proxyjump", "proxycommand") and k not in got:
-            got[k] = v.strip()
-    if got.get("proxyjump") not in (None, "", "none"):
-        return "jump", got["proxyjump"]
-    if got.get("proxycommand") not in (None, "", "none"):
-        return "command", got["proxycommand"]
-    return None, None
-
-
-# One jump host, as ProxyJump names it: [user@]host[:port], nothing that could start an
-# option, split a shell word or carry an ssh % token.
-JUMP_RE = re.compile(r"(?:([A-Za-z0-9][A-Za-z0-9._-]{0,63})@)?"
-                     r"(\[[0-9A-Fa-f:.]{2,45}\]|[A-Za-z0-9][A-Za-z0-9.-]{0,252})(?::(\d{1,5}))?")
-
-
 def probe(host, port, timeout=PROBE_TIMEOUT, update=None):
     """Try a TCP connection to host:port. -> {"state", "detail", "ip", "rtt_ms"}.
 
@@ -140,8 +108,7 @@ def probe(host, port, timeout=PROBE_TIMEOUT, update=None):
         ip = addr[0]
         if family == socket.AF_INET6 and len(addr) > 3 and addr[3] and "%" not in ip:
             try:  # a link-local IPv6 address only works with its interface
-                # Windows' ssh takes only the number: its names ("wireless_32768") don't resolve.
-                ip = f"{ip}%{addr[3] if frame_host.WINDOWS else socket.if_indextoname(addr[3])}"
+                ip = f"{ip}%{socket.if_indextoname(addr[3])}"
             except (OSError, AttributeError):
                 pass
         left = deadline - now()
@@ -168,122 +135,6 @@ def probe(host, port, timeout=PROBE_TIMEOUT, update=None):
     return last or {"state": "timeout", "detail": "No answer"}
 
 
-def _ip_kind(text):
-    """ipv4, ipv6, ipv6 link-local or tailscale for an IP address (zone allowed), else None."""
-    try:
-        ip = ipaddress.ip_address((text or "").strip("[]").split("%")[0])
-    except ValueError:
-        return None
-    if frame_network.is_tailscale(str(ip)):
-        return "tailscale"
-    return "ipv4" if ip.version == 4 else "ipv6 link-local" if ip.is_link_local else "ipv6"
-
-
-def address_kind(host, ip=None):
-    """What sort of address a probe row is, for diagnostics, never the address itself:
-    ".local", "ipv4", "ipv6", "ipv6 link-local", "tailscale" or "hostname", plus what a
-    name resolved to (".local->ipv6 link-local") when the probe got that far."""
-    h = (host or "").lower().rstrip(".")
-    kind = _ip_kind(h) or (".local" if h.endswith(".local") else
-                           "tailscale" if frame_network.is_tailscale(h) else "hostname")
-    got = _ip_kind(ip) if ip and not _ip_kind(h) else None
-    return f"{kind}->{got}" if got and got != kind else kind
-
-
-def probes_summary(probes):
-    """Each address tried, as its kind and how the probe went: "alias .local->ipv4 timeout"."""
-    out = []
-    for row in probes or ():
-        lead = "alias " if row.get("label") == "from ~/.ssh/config" else ""
-        out.append(f"{lead}{address_kind(row.get('host'), row.get('ip'))} {row.get('state') or '?'}")
-    return "; ".join(out)
-
-
-# Exactly the tokens the scrubbers write (here and frame_telemetry.scrub), nothing else in <...>.
-PLACEHOLDER = re.compile(r"(<(?:host|user|email|ip|mac|steamid|hex|token|ssh-key|pem|url|redacted)>)")
-
-
-def hide_hosts(text, hosts, keep=()):
-    """text with each of `hosts` (the headset's own addresses and names) replaced by <host>,
-    longest first and whatever the case, so a bare name like "steamdeck" that the scrubber
-    can't recognise goes too."""
-    keep = {k.lower() for k in keep if k} | KEYWORDS  # a headset called "host" mustn't eat ssh's wording
-    names = sorted({h for h in hosts if h and h.lower() not in keep}, key=len, reverse=True)
-    parts = PLACEHOLDER.split(text)  # never inside a scrubber's own <token> already there
-    for i in range(0, len(parts), 2):
-        for h in names:
-            parts[i] = re.sub(r"(?<![\w.:-])%s(?![\w-]|[:.%%]\w)" % re.escape(h), "<host>", parts[i], flags=re.I)
-    return "".join(parts)
-
-
-# ssh names the host it was going to after these words ("Could not resolve hostname X",
-# "connect to host X port 22", "Timed out talking to X"): whatever follows goes, known or not.
-OPERAND = re.compile(r"(?i)\b(hostname|host|to(?:\s+host)?)\s+(?!<)([^\s:,;'\"()|]+)")
-PLAIN_WORDS = {"answer", "the", "a", "an", "this", "it", "its", "be", "connect", "find", "work", "try"}
-KEYWORDS = {"host", "hostname", "to", "port"} | PLAIN_WORDS
-
-
-def hide_operands(text):
-    def one(m):
-        word = m.group(2).rstrip(".")
-        dots = m.group(2)[len(word):]
-        return m.group(0) if word.lower() in PLAIN_WORDS else f"{m.group(1)} <host>{dots}"
-    return OPERAND.sub(one, text)
-
-
-def scrub_failure(text, hosts=()):
-    """Free text about a failed attempt, for the log: the attempt's own names, whole and
-    longest first (case-insensitively, never ssh's own words), then anything ssh names as a
-    host, then the shared scrubber (addresses, paths, user names)."""
-    return frame_telemetry.scrub(hide_operands(hide_hosts(str(text or ""), hosts)), 600)
-
-
-def failure_detail(error):
-    """What an address that answered but failed SSH shows: the short reason when there is one
-    (the whole message is the banner's headline already), else the message."""
-    error = error or {}
-    return error.get("short") or error.get("message") or "SSH failed"
-
-
-def failure_category(message, raw=""):
-    """The telemetry error category (frame_unreachable, frame_auth, ...) for a failure: a fixed
-    word, never its text."""
-    return frame_telemetry.categorize(f"{message or ''}\n{raw or ''}")[0]
-
-
-_logged = {}            # failure line -> {"at": when last written, "repeats": since then}
-LOG_REPEAT_EVERY = 300  # the same failure, retried every 30 s, goes in the log at most this often
-LOG_REMEMBER = 32       # different failures remembered for that
-
-
-def log_failure(stage, message, raw="", probes=(), hosts=()):
-    """One failed connection attempt to stderr (the app's server.log), scrubbed when written,
-    with the hosts of that attempt (so a later switch of headset can't let them through)."""
-    hosts = list(hosts) + [r.get(k) for r in probes or () for k in ("host", "ip")]
-    bits = [f"frame_link: {stage} failed: {scrub_failure(message, hosts)}"]
-    last = [ln.strip() for ln in (raw or "").splitlines() if ln.strip()][-1:]
-    if last and last[0] != message:
-        bits.append(f"ssh said: {scrub_failure(last[0][:300], hosts)}")
-    tried = probes_summary(probes)
-    if tried:
-        bits.append(f"addresses: {tried}")
-    line = " | ".join(bits)[:900]
-    t = time.monotonic()
-    seen = _logged.get(line)
-    if seen and t - seen["at"] < LOG_REPEAT_EVERY:
-        seen["repeats"] += 1
-        return
-    more = f" (and {seen['repeats']} more times)" if seen and seen["repeats"] else ""
-    _logged.pop(line, None)
-    _logged[line] = {"at": t, "repeats": 0}
-    while len(_logged) > LOG_REMEMBER:
-        _logged.pop(next(iter(_logged)))  # the least recently written
-    try:
-        print(line + more, file=sys.stderr, flush=True)
-    except (OSError, ValueError, AttributeError):
-        pass  # no stderr (a closed pipe): the page still shows the failure
-
-
 def ssh_target(host, ip):
     """Where ssh should go for an address whose probe answered from `ip`: that IP, so ssh
     doesn't look the name up again and try an address that didn't answer."""
@@ -294,43 +145,6 @@ def ssh_target(host, ip):
         return host
 
 
-def _unlink(path):
-    try:
-        os.unlink(path)
-    except OSError:
-        pass
-
-
-def _scanned_key(path, name):
-    """The first whole, valid known_hosts line for `name` that a key check wrote, or None.
-    Only lines ssh has finished (ending in a newline): a half-written key mustn't count."""
-    try:
-        with open(path, encoding="utf-8") as fh:
-            text = fh.read()
-    except (OSError, UnicodeDecodeError):
-        return None
-    for line in text.splitlines(True):
-        if line.endswith("\n"):
-            entry = frame_devices.key_entry(line.strip(), name)
-            if entry:
-                return entry
-    return None
-
-
-def proxy_command(literal):
-    """A ProxyCommand that runs `literal` (argv, ending with the jump host) with `-W` to the
-    headset, each word exactly as given. ssh first expands its %-tokens in the line, so every
-    % of ours is doubled; then it hands the line to a shell (`$SHELL -c` on macOS and Linux)
-    or, on Windows, starts it as a command line, so every word is quoted for that: a path
-    with spaces, $(...), backticks or quotes stays one plain word. The forward is
-    [%h]:%p, so an IPv6 address (with a zone) reads as one host."""
-    words = [w.replace("%", "%%") for w in literal]
-    target = "[%h]:%p"
-    if frame_host.WINDOWS:
-        return subprocess.list2cmdline([*words[:-1], "-W", target, words[-1]])
-    return " ".join(shlex.quote(w) for w in [*words[:-1], "-W", target, words[-1]])
-
-
 def probe_raw(host, port, result):
     """ssh's own wording for a failed probe, so the server's UNREACHABLE table explains it."""
     return {"unresolved": f"ssh: Could not resolve hostname {host}: not found",
@@ -349,13 +163,13 @@ class Link:
         self.session_alias = env_alias  # ...and stays selectable after switching away
         self.mux_base = list(mux_base)  # ["ssh", "-o", "BatchMode=yes", ControlPath...]
         self.control = control          # ControlPath, or None where ssh can't share connections
-        self._apply = apply             # apply(alias, host_opts): point every ssh command at the headset
-        self.applied = (None, [])       # what it was last given
+        self.apply = apply              # apply(alias, host_opts): point every ssh command at the headset
         self.explain = explain          # ssh error text -> plain reason, or None
         self.cond = threading.Condition()
         self.version = 0
         self.stopped = False
         self.kicks = []                 # reasons someone asked for a (re)connect
+        self.test_gen = {}              # device id -> its newest test of the addresses (see test())
         self.busy = False               # the loop is handling kicks
         self.state = {"phase": "idle", "reason": None, "device": None, "network": None, "stages": [],
                       "probes": [], "via": None, "error": None, "retry_at": None, "attempt": 0,
@@ -374,9 +188,6 @@ class Link:
         self.route_lock = threading.Lock()
         self.routed = None              # the device id every ssh command points at
         self.routed_device = None
-        self.last_failure = None        # {"stage", "category", "at"}: for report diagnostics, no free text
-        self.attempt_device = None      # the headset the current attempt is for
-        self.scans = {}                 # device id -> the host key it showed for "Trust a new key"
 
     # ---- publishing ----
     def publish(self, **fields):
@@ -581,76 +392,13 @@ class Link:
             return [*mux, *(device.get("frozen") or [])]  # what ~/.ssh/config said when it was routed
         if not host:  # a headset with no addresses: reach nothing, not whatever ~/.ssh/config says
             return ["-o", "HostName=no-address.invalid"]
-        # Whatever ~/.ssh/config says for Host *, every command checks the headset's pinned key:
-        # StrictHostKeyChecking=yes. Only a headset that never had an identity here (just
-        # added, never connected) gets accept-new: the first contact saves its key, as Set Up
-        # Connection and the connector's first handshake do, rather than every command failing
-        # with "No host key is known" until the connector gets there. Once it had one, a pin
-        # file that's gone, empty or unreadable fails closed (identity_established): accept-new
-        # can't tell that from a new headset and would trust whatever answers.
-        strict = self.strictness(device)
-        if strict == "accept-new":
-            try:
-                frame_devices.pin_dir()  # ssh won't create the folder its known_hosts file goes in
-            except OSError:
-                pass  # ssh then says it couldn't save the key, and goes on
-        return [*mux, "-o", f"StrictHostKeyChecking={strict}", "-o", f"HostName={frame_devices.ssh_host(host)}",
+        # StrictHostKeyChecking=yes: whatever ~/.ssh/config says for Host *, every command
+        # checks the headset's pinned key (only the connector's first handshake may save one).
+        return [*mux, "-o", "StrictHostKeyChecking=yes", "-o", f"HostName={frame_devices.ssh_host(host)}",
                 "-o", f"HostKeyAlias={frame_devices.host_key_alias(device['id'])}",
                 "-o", f"UserKnownHostsFile={frame_devices.known_hosts_opt(device['id'])}", "-o", "HashKnownHosts=no",
                 "-o", f"User={device['user']}", "-o", f"Port={device['port']}"]
 
-    def apply(self, alias, opts):
-        self.applied = (alias, list(opts))
-        self._apply(alias, opts)
-
-    def strictness(self, device):
-        """yes, or accept-new for a headset that never had an identity. Judged on what the
-        registry says now, not only the copy handed in (a route frozen at connect, say, from
-        before its first key was recorded). A key saved since is recorded on the way."""
-        try:
-            current = self.reg.get(device["id"])
-        except frame_devices.DeviceError:
-            current = {}
-        if not (frame_devices.identity_established(device) or
-                (current and frame_devices.identity_established(current))):
-            return "accept-new"
-        self.settle_pin(dict(device, **current) if current else device, tighten=False)
-        return "yes"
-
-    def settle_pin(self, device=None, tighten=True):
-        """A key ssh saved on a first contact, whatever happened next (logged in or refused,
-        by the handshake or any command): record it, make the file private, and from then on
-        route every command strictly. Idempotent and cheap when there's nothing to do."""
-        device = device or self.routed_device
-        if not device or device.get("transient") or device.get("none") or not device.get("id"):
-            return
-        did = device["id"]
-        if frame_devices.pinned(did):
-            fps = [f for _, f in frame_devices.pinned_keys(did)]
-            if fps and (device.get("identity") != fps or not device.get("identity_established")):
-                try:
-                    current = self.reg.get(did)
-                except frame_devices.DeviceError:
-                    return
-                if current.get("identity") != fps or not current.get("identity_established"):
-                    frame_host.make_private(frame_devices.known_hosts(did))  # ssh wrote it
-                    self.reg.record_identity(did, fps)
-        if not tighten:
-            return
-        with self.route_lock:
-            alias, opts = self.applied
-            if alias == device.get("alias") and "StrictHostKeyChecking=accept-new" in opts and \
-                    frame_devices.identity_established(dict(device, **self._current(did))):
-                self.opts = [("StrictHostKeyChecking=yes" if o == "StrictHostKeyChecking=accept-new" else o)
-                             for o in opts]
-                self.apply(alias, self.opts)
-
-    def _current(self, device_id):
-        try:
-            return self.reg.get(device_id)
-        except frame_devices.DeviceError:
-            return {}
-
     def public_device(self, d):
         return {k: d.get(k) for k in ("id", "name", "alias", "user", "port", "transient")}
 
@@ -680,8 +428,6 @@ class Link:
                 if t - last_ts >= TAILSCALE_EVERY and self.state["network"] and not reasons:
                     last_ts = t
                     self.refresh_network()
-                if "StrictHostKeyChecking=accept-new" in self.applied[1]:
-                    self.settle_pin()  # a command's first contact may have saved the key
                 phase = self.state["phase"]
                 if phase == "connected" and not self.alive():
                     reasons.append("dropped")
@@ -690,9 +436,7 @@ class Link:
                 if reasons:
                     self.connect(reasons)
             except Exception as e:  # keep the loop alive whatever happens; say what went wrong
-                message = f"{type(e).__name__}: {e}"
-                self.note_failure("network", message, str(e))
-                self.publish(phase="failed", error={"stage": "network", "message": message,
+                self.publish(phase="failed", error={"stage": "network", "message": f"{type(e).__name__}: {e}",
                                                     "raw": str(e)}, retry_at=now() + RETRY[-1])
             finally:
                 with self.cond:
@@ -768,7 +512,6 @@ class Link:
             self.cond.notify_all()
         ok = False
         try:
-            self.attempt_device = device  # its names, for scrubbing this attempt's log lines
             ok = self.attempt(device)
         finally:
             self.finish(gen, ok, device)
@@ -797,7 +540,6 @@ class Link:
                                   now() + RETRY[min(self.fails, len(RETRY)) - 1])
                 if not self.state["error"]:
                     self.state["error"] = {"stage": "find", "message": "Couldn't connect", "raw": ""}
-                    self.note_failure("find", "Couldn't connect", "", self.state["probes"])
             self.version += 1
             self.cond.notify_all()
 
@@ -816,33 +558,17 @@ class Link:
             return "Starting up"
         return "Connecting"
 
-    def fail(self, sid, message, raw="", **more):
-        """A stage failed. `more`: what the page can offer to fix it (hostkey, auth), and `short`:
-        the reason in a few words, for the places a whole sentence doesn't fit (the header pill,
-        the address that failed)."""
+    def fail(self, sid, message, raw=""):
         self.stage(sid, "failed", message)
         with self.cond:
-            self.state["error"] = dict({"stage": sid, "message": message, "raw": raw}, **more)
-            probes = copy.deepcopy(self.state["probes"])
-        self.note_failure(sid, message, raw, probes)
-
-    def note_failure(self, stage, message, raw="", probes=()):
-        """Keep a failure for report diagnostics as fixed values only (its stage and error
-        category, decided now), and write it to the log scrubbed with this attempt's hosts."""
-        self.last_failure = {"stage": stage, "category": failure_category(message, raw), "at": now()}
-        hosts = []
-        for d in (self.attempt_device, self.routed_device):  # the headset tried, and where commands go
-            d = d or {}
-            hosts += [a.get("host") for a in d.get("addresses") or ()]
-            hosts += [d.get("frozen_host"), d.get("alias"), d.get("name")]
-        log_failure(stage, message, raw, probes, hosts)
+            self.state["error"] = {"stage": sid, "message": message, "raw": raw}
 
     def attempt(self, device):
         if device.get("none"):
             self.fail("find", "No headset is set up. Add one on the Devices tab.")
             return False
         if not device.get("transient") and not device["addresses"]:
-            self.fail("find", "The active headset has no addresses. Add one on the Devices tab.")
+            self.fail("find", f"{device['name']} has no addresses. Add one on the Devices tab.")
             return False
         # 1. this computer's network
         self.stage("network", "active")
@@ -905,7 +631,7 @@ class Link:
                         self.learn(device, a["host"], net, None)
                         return True
                     with self.cond:
-                        why_not = failure_detail(self.state["error"])
+                        why_not = (self.state["error"] or {}).get("message") or "SSH failed"
                     self.probe_update(i, state="sshfailed", detail=why_not)
                     if outcome != "next":
                         return False
@@ -955,7 +681,7 @@ class Link:
                 self.learn(device, a["host"], net, results[pick]["rtt_ms"])
                 return True
             with self.cond:
-                why_not = failure_detail(self.state["error"])
+                why_not = (self.state["error"] or {}).get("message") or "SSH failed"
             self.probe_update(pick, state="sshfailed", detail=why_not)
             if outcome != "next":
                 return False
@@ -1011,7 +737,6 @@ class Link:
         if device.get("transient"):
             return
         self.reg.record_success(device["id"], host, net.get("id"), rtt)
-        self.reg.record_identity(device["id"], [f for _, f in frame_devices.pinned_keys(device["id"])])
         # Set Up Connection may have changed the block while this attempt ran: take that
         # in (and reconnect) rather than writing this attempt's older settings over it.
         self.watch_config()
@@ -1041,8 +766,8 @@ class Link:
         if not self.control:
             return False
         try:
-            return frame_host.run_ssh([*self.mux_base, *opts, "-O", "check", alias or self.alias], capture_output=True,
-                                      stdin=subprocess.DEVNULL, timeout=5).returncode == 0
+            return subprocess.run([*self.mux_base, *opts, "-O", "check", alias or self.alias], capture_output=True,
+                                  stdin=subprocess.DEVNULL, timeout=5).returncode == 0
         except (OSError, subprocess.TimeoutExpired):
             return False
 
@@ -1053,8 +778,8 @@ class Link:
             pending.kill()
         if self.control and self.alias:
             try:
-                frame_host.run_ssh([*self.mux_base, *self.opts, "-O", "exit", self.alias], capture_output=True,
-                                   stdin=subprocess.DEVNULL, timeout=5)
+                subprocess.run([*self.mux_base, *self.opts, "-O", "exit", self.alias], capture_output=True,
+                               stdin=subprocess.DEVNULL, timeout=5)
             except (OSError, subprocess.TimeoutExpired):
                 pass
         if proc and proc.poll() is None:
@@ -1066,17 +791,7 @@ class Link:
 
     def handshake(self, device, a, found, user):
         """SSH to one address, following ssh -v through stages 3-5.
-        -> "ok", "next" (try another address) or "stop". A key ssh saved is recorded and
-        protected however it ends: a login refused after the key was saved, a timeout, a stop."""
-        try:
-            return self._handshake(device, a, found, user)
-        finally:
-            if not device.get("transient"):
-                with self.route_lock:
-                    current = self.attempt_gen == self.gen
-                self.settle_pin(device, tighten=current)
-
-    def _handshake(self, device, a, found, user):
+        -> "ok", "next" (try another address) or "stop"."""
         # The IP that answered (with a link-local IPv6 address's zone), so ssh doesn't
         # look the name up again and stall on an address that didn't answer.
         opts = self.host_opts(device, ssh_target(a["host"], found.get("ip")))
@@ -1094,9 +809,15 @@ class Link:
             return "ok"
         extra = []
         if not device.get("transient"):
-            # A headset's first connection trusts what it shows (as Set Up Connection does) and
-            # pins it; any later one checks the pin strictly (see host_opts).
-            extra = ["-o", f"StrictHostKeyChecking={self.strictness(device)}"]
+            if frame_devices.pinned(device["id"]):
+                extra = ["-o", "StrictHostKeyChecking=yes"]
+            else:
+                # First connection since this headset was added: trust what it shows
+                # (as Set Up Connection does), and pin it from now on. ssh won't create
+                # the folder its known_hosts file goes in.
+                extra = ["-o", "StrictHostKeyChecking=accept-new"]
+                pins = frame_devices.known_hosts(device["id"]).parent
+                pins.mkdir(**({} if frame_host.WINDOWS else {"mode": 0o700}), parents=True, exist_ok=True)
         if self.control:
             # No ConnectTimeout: with it, OpenSSH's master takes ~5s to open its socket.
             # `extra` first: ssh takes the first value of an option, and it may say accept-new.
@@ -1104,70 +825,27 @@ class Link:
                     "-o", "ServerAliveCountMax=2", "-N", alias]
         else:
             argv = [*self.mux_base, *extra, *opts, "-v", "-o", "ConnectTimeout=10", alias, "true"]
-        lines = queue.Queue()
-        collecting = [True]
-        reader_done = threading.Event()
-        errfile = None
         try:
-            if self.control:
-                proc = subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-                                        stderr=subprocess.PIPE, **frame_host.DETACHED)
-            else:
-                # No master (Windows): ssh runs `true` and exits. Its stderr goes to a file read
-                # as it grows, not a pipe: Windows' OpenSSH can block writing to a redirected
-                # pipe (see frame_host.run_ssh), and the handshake would never finish.
-                fd_, errfile = tempfile.mkstemp(prefix="frame-ssh-")
-                try:
-                    proc = subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-                                            stderr=fd_, **frame_host.DETACHED)
-                finally:
-                    os.close(fd_)
+            proc = subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                    stderr=subprocess.PIPE, **frame_host.DETACHED)
         except OSError as e:
-            if errfile:
-                _unlink(errfile)
             self.fail("ssh", f"Couldn't run ssh: {e}", str(e))
             return "stop"
         self.pending = proc  # so stop() can end it mid-handshake
+        lines = queue.Queue()
+        collecting = [True]
 
         def read():
             for raw in iter(proc.stderr.readline, b""):
                 if collecting[0]:
                     lines.put(raw.decode("utf-8", "replace").rstrip())
-            reader_done.set()
             lines.put(None)
             proc.stderr.close()
-
-        def tail():
-            buf = b""
-            try:
-                with open(errfile, "rb") as fh:
-                    while True:
-                        chunk = fh.read()
-                        if not chunk:
-                            if proc.poll() is None:
-                                time.sleep(0.05)
-                                continue
-                            chunk = fh.read()  # whatever it wrote just before exiting
-                            if not chunk:
-                                break
-                        buf += chunk
-                        *done, buf = buf.split(b"\n")
-                        for raw in done:
-                            lines.put(raw.decode("utf-8", "replace").rstrip())
-            except OSError:
-                pass
-            if buf:
-                lines.put(buf.decode("utf-8", "replace").rstrip())
-            reader_done.set()
-            lines.put(None)
-            _unlink(errfile)
-        threading.Thread(target=read if errfile is None else tail, daemon=True).start()
+        threading.Thread(target=read, daemon=True).start()
 
         step, said, authed = "ssh", [], False
         deadline = time.monotonic() + HANDSHAKE_TIMEOUT
         mismatch = False
-        shown = None  # (type, fingerprint) of the key the headset showed
-        exited = None  # when ssh was first seen to have exited
         while True:
             left = deadline - time.monotonic()
             if self.stopped:
@@ -1185,14 +863,7 @@ class Link:
                 if authed and self.control and self.check(opts, alias):
                     break
                 if proc.poll() is not None and lines.empty():
-                    # ssh exited: its last words (Permission denied…) may still be on their way.
-                    # The reader's end marker says when they're all in; a pipe that something
-                    # else holds open (a ProxyCommand's child) gets a short grace instead.
-                    exited = exited or time.monotonic()
-                    if reader_done.is_set() and lines.empty() or time.monotonic() - exited > 2:
-                        line = None
-                    else:
-                        continue
+                    line = None
                 else:
                     continue
             if line is None:  # ssh exited
@@ -1201,7 +872,7 @@ class Link:
                     break
                 if authed and self.control and self.check(opts, alias):
                     break
-                return self.failed(step, said, mismatch, alias, shown, a["host"], device)
+                return self.failed(step, said, mismatch, alias)
             if not line.startswith("debug"):
                 said.append(line)
             m = CONNECTING.search(line)
@@ -1214,15 +885,12 @@ class Link:
                 self.stage("identity", "active", "Waiting for the headset's host key")
             elif HOSTKEY.search(line):
                 m = HOSTKEY.search(line)
-                shown = (m.group(1), m.group(2))
                 self.stage("identity", "active", f"It shows {m.group(1)} key {m.group(2)[:20]}…")
             elif KNOWN.search(line):
                 self.stage("identity", "done", "Matches the identity saved for this headset")
                 step = "login"
                 self.stage("login", "active", f"Logging in as {user}")
             elif ADDED.search(line):
-                if not device.get("transient"):
-                    self.settle_pin(device, tighten=False)  # now, before the login can fail
                 self.stage("identity", "done", "First connection: saved this headset's identity")
                 step = "login"
                 self.stage("login", "active", f"Logging in as {user}")
@@ -1261,36 +929,18 @@ class Link:
         # OpenSSH lower-cases host names (FRAME.LOCAL logs as frame.local).
         return not m or m.group(1).lower() in (host.lower(), alias.lower()) or "Authentication succeeded" in line
 
-    def failed(self, step, said, mismatch, alias, shown=None, host=None, device=None):
+    def failed(self, step, said, mismatch, alias):
         text = "\n".join(said).strip()
         if mismatch:
-            # A key that differs from the saved one, or (strict, pinned) none of the saved key's
-            # type any more: either way not the identity saved. Never accepted here: the page
-            # shows the new key's fingerprint and the person decides (Trust a new key).
-            name = (device or {}).get("name") or alias
-            lost = bool(device) and not frame_devices.pinned(device["id"]) and \
-                frame_devices.identity_established(device)
-            if lost:
-                message = (f"The SSH identity saved for {name} is missing or can't be read, so Frame Control won't "
-                           "trust whatever answers. Check its key and trust it on the Devices tab.")
-            else:
-                message = (f"This address answered with a different SSH identity from the one saved for {name}. "
-                           "If SteamOS was reinstalled or reset, or this is a new headset, check its new key and trust "
-                           "it on the Devices tab. If not, a different device may be answering here.")
-            self.fail("identity", message, text,
-                      short="Saved SSH identity missing" if lost else "SSH identity changed",
-                      hostkey={"state": "missing" if lost else "changed", "type": shown[0] if shown else None,
-                               "fingerprint": shown[1] if shown else None, "host": host})
+            self.fail("identity", "This address answered as a different headset (its SSH identity doesn't match). "
+                      "If SteamOS was reinstalled, use Forget Identity on the Devices tab.", text)
             return "next"
         # A refused key is the same at every address: stop. (Judged by ssh's own words, not
         # the step: a jump host's progress lines look like the headset's.) A forward that
         # a jump host couldn't open is about this address only: try the next.
         forward = re.search(r"open failed|forwarding failed|Connection refused|Connection closed|timed out", text)
         if re.search(r"Permission denied", text) and not forward:
-            # Not something a retry fixes: the headset needs this computer's key (Set Up Connection).
-            self.fail("login", self.explain(text) or "The headset didn't accept this computer's key. Run Set Up "
-                      "Connection: it pairs this computer with the headset again.", text, auth="denied",
-                      short="This computer's key refused")
+            self.fail("login", self.explain(text) or "The headset didn't accept this computer's key.", text)
             return "stop"
         if step == "connected":
             self.fail("login", "Logged in, but the shared SSH connection didn't start.", text)
@@ -1306,9 +956,13 @@ class Link:
         started = now()
         rows = [{"host": a["host"], "kind": a["kind"], "state": "waiting", "detail": "Waiting", "ip": None,
                  "rtt_ms": None, "ssh": None} for a in device["addresses"]]
+        with self.cond:
+            gen = self.test_gen[device_id] = self.test_gen.get(device_id, 0) + 1
 
         def put(**fields):
             with self.cond:
+                if gen != self.test_gen[device_id]:
+                    return  # a newer test has started: its results are the ones to show
                 self.state["tests"][device_id] = dict({"started": started, "done": False, "rows": rows}, **fields)
                 self.version += 1
                 self.cond.notify_all()
@@ -1330,14 +984,12 @@ class Link:
             lead = f"Answered in {res['rtt_ms']:g} ms" if res.get("rtt_ms") is not None else "Through the jump host"
             rows[i]["ssh"] = "checking"
             put()
-            # "yes" before host_opts (ssh takes an option's first value): a test only looks, so
-            # it reports a key not saved yet rather than saving it as host_opts' accept-new would.
             argv = [*self.mux_base[:3], "-o", "ControlPath=none", "-o", "ConnectTimeout=8",
-                    "-o", "StrictHostKeyChecking=yes",
-                    *self.host_opts(device, ssh_target(a["host"], res.get("ip"))), device["alias"], "true"]
+                    *self.host_opts(device, ssh_target(a["host"], res.get("ip"))),
+                    "-o", "StrictHostKeyChecking=yes", device["alias"], "true"]
             try:
-                r = frame_host.run_ssh(argv, capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                                       errors="replace", timeout=20)
+                r = subprocess.run(argv, capture_output=True, stdin=subprocess.DEVNULL, text=True,
+                                   errors="replace", timeout=20)
                 err = r.stderr.strip()
                 if r.returncode == 0:
                     rows[i].update(ssh="ok", detail=f"{lead} · SSH works")
@@ -1362,156 +1014,6 @@ class Link:
         put(done=True, finished=now())
         self.devices_changed()
 
-    # ---- Trust a new key ----
-    # Every way a key check could do more than read the key: no login of any kind, no agent
-    # (nor forwarding it), no X11, port or tunnel forwarding, no local or remote command, no
-    # terminal, no shared connection, no learning keys. Given first, so ssh takes these over
-    # anything ~/.ssh/config (or host_opts) says. -N: no command, even if a device accepts "none".
-    SCAN_OPTS = ["BatchMode=yes", "ControlMaster=no", "ControlPath=none", "ConnectTimeout=8",
-                 "StrictHostKeyChecking=accept-new", "UpdateHostKeys=no", "HashKnownHosts=no",
-                 "PreferredAuthentications=none", "PubkeyAuthentication=no", "PasswordAuthentication=no",
-                 "KbdInteractiveAuthentication=no", "HostbasedAuthentication=no", "IdentityAgent=none",
-                 "ForwardAgent=no", "ForwardX11=no", "ForwardX11Trusted=no", "ClearAllForwardings=yes",
-                 "Tunnel=no", "PermitLocalCommand=no", "RemoteCommand=none", "RequestTTY=no"]
-    SCAN_TIMEOUT = 20
-
-    def scan_identity(self, device_id):
-        """Read the headset's host key without trusting it or logging in. ssh writes it to a
-        throwaway known_hosts file during the key exchange, before any authentication, and is
-        stopped as soon as it has (or when it gives up); SCAN_OPTS and -N rule out anything else.
-        `-F none` too, unless ~/.ssh/config sends the alias through a jump host (then it's
-        needed for that, and SCAN_OPTS still win). The address that showed the changed key goes
-        first, then the rest in order. -> {"type", "fingerprint", "host", "saved", "recorded",
-        "matches", "recorded_match"}; the key is kept (SCAN_TTL) for trust_identity, which pins
-        exactly it."""
-        device = self.reg.get(device_id)
-        if not device["addresses"]:
-            raise frame_devices.DeviceError("This headset has no addresses to ask")
-        hosts = [a["host"] for a in device["addresses"]]
-        with self.cond:
-            err = self.state.get("error") or {}
-            mine = (self.state.get("device") or {}).get("id") == device_id
-        first = (err.get("hostkey") or {}).get("host") if mine else None
-        if first in hosts:
-            hosts.remove(first)
-            hosts.insert(0, first)
-        route = self.scan_route(device)
-        reasons = []
-        for host in hosts:
-            key, err_text = self._scan_one(device, host, route)
-            if key:
-                saved = frame_devices.pinned_keys(device_id)
-                recorded = [f for f in device.get("identity") or [] if isinstance(f, str)]
-                scan = {"type": key[0], "blob": key[1], "fingerprint": key[2], "host": host,
-                        "port": device["port"], "user": device["user"], "at": now()}
-                with self.cond:
-                    self.scans[device_id] = scan
-                return {"type": key[0], "fingerprint": key[2], "host": host,
-                        "saved": [{"type": t, "fingerprint": f} for t, f in saved], "recorded": recorded,
-                        "matches": any(f == key[2] for _, f in saved), "recorded_match": key[2] in recorded}
-            text = err_text.strip()
-            reasons.append(f"{host}: " + (self.explain(text) or (text.splitlines() or ["no answer"])[-1]))
-        raise frame_devices.DeviceError("Couldn't read the headset's key. " + "; ".join(reasons))
-
-    # The jump host's own ssh (a ProxyCommand the scan builds itself): it may log in to the jump
-    # host as configured (keys, the agent), but it never forwards the agent, X11 or ports, runs
-    # no local or remote command, has no terminal, shares no connection and goes no further.
-    HOP_OPTS = ["BatchMode=yes", "ForwardAgent=no", "ForwardX11=no", "ForwardX11Trusted=no",
-                "ClearAllForwardings=yes", "Tunnel=no", "PermitLocalCommand=no", "RemoteCommand=none",
-                "RequestTTY=no", "ControlMaster=no", "ControlPath=none", "ProxyCommand=none", "ProxyJump=none"]
-
-    def scan_route(self, device):
-        """The options that take a key check to the headset: `-F none` and nothing else when
-        it's reached directly. Through a jump host (ProxyJump), `-F none` and a ProxyCommand
-        built here, whose ssh gets HOP_OPTS ahead of ~/.ssh/config: config options can't be
-        overridden for ProxyJump's own ssh, which inherits ForwardAgent, LocalCommand and the
-        rest. Through a ProxyCommand from ~/.ssh/config, or several jump hosts, it refuses:
-        those can't be made safe from here."""
-        kind, spec = proxy_route(device["alias"])
-        if kind is None:
-            return ["-F", "none"]
-        m = JUMP_RE.fullmatch(spec or "") if kind == "jump" else None
-        if not m or (m.group(3) and not 1 <= int(m.group(3)) <= 65535):
-            how = "a ProxyCommand" if kind == "command" else "this jump host setting"
-            raise frame_devices.DeviceError(
-                f"{device['name']} is reached through {how} in ~/.ssh/config, which Frame Control can't make safe "
-                "for talking to a device it doesn't trust yet, so it won't read the key that way. Add an address "
-                "it can reach directly (or through a single ProxyJump host) and check its key again; or compare "
-                "the key by hand (on the headset, in Konsole: ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub)")
-        user, host, port = m.groups()
-        # The ssh this server runs, by its full path: the shell that runs a ProxyCommand may set
-        # up another PATH.
-        ssh = frame_host.which(self.mux_base[0])
-        if not ssh:
-            raise frame_devices.DeviceError(f"Couldn't find {self.mux_base[0]} to reach the jump host with")
-        hop = [ssh, *(a for o in self.HOP_OPTS for a in ("-o", o)), *(["-l", user] if user else []),
-               *(["-p", port] if port else []), host.strip("[]")]  # ssh takes a bare IPv6 address here
-        return ["-F", "none", "-o", "ProxyCommand=" + proxy_command(hop)]
-
-    def _scan_one(self, device, host, route):
-        """-> ((type, blob, fingerprint) or None, what ssh said)."""
-        name = frame_devices.host_key_alias(device["id"])
-        path, opt = frame_devices.scan_file(device["id"])
-        opts = [a for o in [*self.SCAN_OPTS, f"UserKnownHostsFile={opt}"] for a in ("-o", o)]
-        argv = [self.mux_base[0], *route, *opts, *self.host_opts(device, host), "-N", device["alias"]]
-        fd_, errfile = tempfile.mkstemp(prefix="frame-scan-")  # a file, not a pipe (see frame_host.run_ssh)
-        key, proc = None, None
-        try:
-            try:
-                proc = subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=fd_,
-                                        **frame_host.DETACHED)
-            finally:
-                os.close(fd_)
-            deadline = time.monotonic() + self.SCAN_TIMEOUT
-            while key is None:
-                ended = proc.poll() is not None
-                key = _scanned_key(path, name)
-                if key or ended or self.stopped or time.monotonic() > deadline:
-                    break
-                time.sleep(0.05)
-        except OSError as e:
-            return None, str(e)
-        finally:
-            if proc and proc.poll() is None:
-                proc.kill()  # it has the key (or gave up): nothing more to do with that device
-            if proc:
-                try:
-                    proc.wait(5)
-                except subprocess.TimeoutExpired:
-                    pass
-            try:
-                with open(errfile, "rb") as fh:
-                    said = fh.read().decode("utf-8", "replace")
-            except OSError:
-                said = ""
-            _unlink(errfile)
-            _unlink(path)
-        if key is None and not said.strip() and proc and proc.returncode is not None and proc.returncode < 0:
-            said = f"Timed out talking to {device['alias']}"
-        return key, said
-
-    def trust_identity(self, device_id, fingerprint):
-        """Pin the key scan_identity read, and only if `fingerprint` is the one it showed (what
-        the person saw and confirmed), replacing whatever was saved; and only while the headset
-        is still reached as it was then (same port and user, the address still one of its own).
-        -> the scan."""
-        with self.cond:
-            scan = self.scans.get(device_id)
-            if not scan or now() - scan["at"] > SCAN_TTL:
-                self.scans.pop(device_id, None)
-                raise frame_devices.DeviceError("Check the headset's key again first: the one shown has expired")
-            if not isinstance(fingerprint, str) or fingerprint != scan["fingerprint"]:
-                raise frame_devices.DeviceError("That isn't the key the headset showed. Check its key again")
-            self.scans.pop(device_id)
-        d = self.reg.get(device_id)  # still a headset here
-        if (d["port"], d["user"]) != (scan["port"], scan["user"]) or \
-                scan["host"] not in [a["host"] for a in d["addresses"]]:
-            raise frame_devices.DeviceError("The headset's address, port or user changed since its key was read. "
-                                            "Check its key again")
-        frame_devices.pin_key(device_id, scan["type"], scan["blob"])
-        self.reg.record_identity(device_id, [scan["fingerprint"]])
-        return scan
-
 
 # ---- the page's API: /api/devices -------------------------------------------------
 
@@ -1530,9 +1032,6 @@ def devices_view(link):
         view = {k: v for k, v in d.items() if k not in ("config_host", "addresses")}
         view["active"] = d["id"] == active["id"]
         view["pinned"] = frame_devices.pinned(d["id"])
-        view["keys"] = [{"type": t, "fingerprint": f} for t, f in frame_devices.pinned_keys(d["id"])]
-        # It had an identity, but the saved key is gone or unusable: nothing is trusted until checked.
-        view["identity_lost"] = not view["pinned"] and frame_devices.identity_established(d)
         view["addresses"] = [dict(a, network_names=[names.get(n, "an unnamed network") for n in a["networks"]])
                              for a in d["addresses"]]
         devices.append(view)
@@ -1565,7 +1064,7 @@ def devices_action(link, body, open_setup, busy=lambda: 0):
     is_active = did == active["id"]
     moves = action == "use" or (action == "retry" and link.alive()) or (is_active and (
         # (a retry while connected would cut the install's connection)
-        action in ("remove", "address-remove", "identity-trust")
+        action in ("remove", "address-remove", "forget-identity")
         or (action == "update" and login_change(reg, did, body))
         or (action == "address-update" and body.get("newHost") not in (None, body.get("host")))))
     if moves and busy():
@@ -1617,7 +1116,8 @@ def devices_action(link, body, open_setup, busy=lambda: 0):
                 raise frame_devices.DeviceError(f"Removed, but couldn't edit ~/.ssh/config: {e}")
         msg = f"Removed {d['name']}" + (f" and its '{d['alias']}' entry in ~/.ssh/config" if removed else "")
     elif action == "address-add":
-        a = reg.add_address(did, body.get("host"), body.get("kind") or None, body.get("label") or "")
+        a = reg.add_address(did, body.get("host"), body.get("kind") or None, body.get("label") or "",
+                            first=body.get("first") is True)
         if is_active and link.state["phase"] == "failed":
             link.kick("retry")
         msg = f"Added {a['host']}"
@@ -1645,25 +1145,11 @@ def devices_action(link, body, open_setup, busy=lambda: 0):
         threading.Thread(target=link.test, args=(did,), daemon=True).start()
         msg = f"Testing {len(d['addresses'])} address{'es' * (len(d['addresses']) != 1)}"
     elif action == "forget-identity":
-        # Dropping the pin used to let the next contact save whatever key answered, unseen.
-        # A new key is now always shown first: identity-scan, then identity-trust.
-        reg.get(did)
-        raise frame_devices.DeviceError("Forgetting a headset's identity is no longer supported: use Check its key "
-                                        "on the Devices tab (identity-scan, then identity-trust), which shows the "
-                                        "new key before saving it")
-    elif action == "identity-scan":
         d = reg.get(did)
-        scan = link.scan_identity(did)
-        msg = (f"{d['name']} shows the key already saved for it" if scan["matches"]
-               else f"{d['name']} shows a {scan['type']} key, {scan['fingerprint']}")
-        link.devices_changed()
-        return dict(devices_view(link), message=msg, scan=scan)
-    elif action == "identity-trust":
-        d = reg.get(did)
-        link.trust_identity(did, body.get("fingerprint"))
+        frame_devices.forget_pin(did)
         if is_active:
-            link.kick("switch")  # reconnect with the key now saved
-        msg = f"Saved {d['name']}'s new SSH identity; reconnecting"
+            link.kick("switch")
+        msg = f"Forgot {d['name']}'s SSH identity; the next connection saves the one it shows"
     elif action == "name-network":
         reg.name_network(body.get("network"), body.get("name"))
         if link.state["network"]:

ui/frame_quest.py

@@ -1,644 +0,0 @@
-"""Import from my Quest: copy games you own off your own Meta Quest onto the Frame.
-
-The Quest is plugged into this computer by USB with developer mode on; its own
-adb copies the APK (and split APKs) into a per-user cache. The APK is checked
-before anything goes to the Frame, then installed through frame_android.install
-like any other APK. Game data (the OBB folder and, if asked, the external
-app-data folder) is copied by a second import while the person has the game
-open, since only a running Lepton instance can take it; Frame Control never
-starts the game itself. The cache is always removed. Games that link Meta's Platform SDK
-(libovrplatformloader.so) install with a warning: linking it doesn't mean the game
-enforces a licence check, but if it does the game may quit or hang on the Frame, and
-Frame Control does not remove the check or work around it. See docs/quest-import.md.
-
-Python stdlib only. CLI: python3 ui/frame_quest.py
-  devices | list [--serial SERIAL] | import PACKAGE [--serial SERIAL] [--data] [--allow-downgrade]
-"""
-import json
-import os
-from pathlib import Path
-import re
-import secrets
-import shlex
-import shutil
-import subprocess
-import sys
-import tarfile
-import threading
-import time
-import zipfile
-
-import frame_android as android
-import frame_host
-
-OBB = '/sdcard/Android/obb'
-DATA = '/sdcard/Android/data'
-OBB_NAME = r'(main|patch)\.[0-9]+\.{}\.obb'
-# Serials of adb connections that aren't a USB headset: Frame Control's own SSH tunnels
-# to the Frame's Lepton instances (127.0.0.1:<port>, server.AdbTunnel) and emulators.
-TUNNEL_RE = re.compile(r'^(127\.0\.0\.1|localhost|\[::1\]):\d+$')
-QUEST_MAKERS = {'oculus', 'meta'}
-META_APPS = ('com.oculus.', 'com.meta.', 'com.facebook.')
-CACHE_TTL = 6 * 3600  # an import left behind by a crash is swept after this
-ADB_TIMEOUT = 30
-PULL_TIMEOUT = 3 * 3600
-READY_TIMEOUT = 150
-BATCH = 15  # packages per adb shell command while listing
-
-# Linking the Platform SDK doesn't mean a game enforces the licence check (Meta's
-# VRC.Quest.Security.1 has only been Recommended since 2021), so it's a warning, not a refusal.
-ENTITLEMENT = ("Uses Meta's licence check (Platform SDK, libovrplatformloader.so); it may quit, hang, or run "
-               "without online features on the Frame. Frame Control won't remove the check.")
-VRAPI = ("Uses Meta's legacy VrApi and no OpenXR loader. The Frame doesn't have VrApi, so it may not run.")
-NO_DEVICE = ("No Quest found on this computer's USB. Connect the Quest with a cable that carries data, "
-             "put the headset on and allow USB debugging. Developer mode must be on first: it needs a Meta "
-             "developer organisation on a verified Meta account (developers.meta.com), then Developer Mode "
-             "switched on for the headset in the Meta Horizon phone app.")
-UNAUTHORISED = ("The Quest hasn't allowed this computer yet. Put the headset on and accept the \"Allow USB "
-                "debugging\" prompt (tick Always allow from this computer), then try again. No prompt? Unplug "
-                "and replug the cable, or switch developer mode off and on.")
-NO_PERMISSIONS = ("This computer sees the Quest but isn't allowed to open it over USB. On Linux, add a udev "
-                  "rule for Meta's USB vendor id 2833 (see docs/quest-import.md), then replug it.")
-OFFLINE = "adb reports the Quest offline. Unplug and replug the cable, or restart the headset."
-GONE = "The Quest was disconnected. Plug it back in, put it on, and try again."
-
-
-class QuestError(android.FrameError):
-    pass
-
-
-def _adb_cmd():
-    try:
-        return [frame_host.adb()]
-    except frame_host.HostError as e:
-        raise QuestError(str(e)) from e
-
-
-def _friendly(out):
-    low = out.lower()
-    if 'unauthorized' in low:
-        return UNAUTHORISED
-    if 'no permissions' in low or 'insufficient permissions' in low:
-        return NO_PERMISSIONS
-    if 'device offline' in low:
-        return OFFLINE
-    if 'no devices/emulators found' in low or re.search(r"device '[^']*' not found", low):
-        return GONE
-    return None
-
-
-def adb(*args, serial=None, timeout=ADB_TIMEOUT):
-    """Run this computer's adb (the one Frame Control already finds) and return stdout."""
-    cmd = _adb_cmd() + (['-s', serial] if serial else []) + list(args)
-    try:
-        r = subprocess.run(cmd, capture_output=True, stdin=subprocess.DEVNULL, text=True, errors='replace',
-                           timeout=timeout)
-    except subprocess.TimeoutExpired:
-        raise QuestError(f'adb {args[0]} took more than {timeout} s; check the Quest is still connected')
-    except OSError as e:
-        raise QuestError(f'could not run adb: {e}')
-    if r.returncode != 0:
-        out = (r.stderr or '').strip() or (r.stdout or '').strip()
-        raise QuestError(_friendly(out) or out[-600:] or f'adb exited {r.returncode}')
-    return r.stdout
-
-
-# ---- Finding the Quest ------------------------------------------------------
-
-def _parse_devices(out):
-    found = []
-    for line in out.splitlines():
-        line = line.strip()
-        if not line or line.startswith('List of devices') or line.startswith('*'):
-            continue
-        parts = line.split(None, 1)
-        serial, rest = parts[0], (parts[1] if len(parts) > 1 else '')
-        state = 'no permissions' if rest.startswith('no permissions') else (rest.split() or ['unknown'])[0]
-        fields = dict(t.split(':', 1) for t in rest.split() if re.match(r'^[a-z_]+:', t))
-        found.append({'serial': serial, 'state': state, 'usb': 'usb' in fields,
-                      'model': fields.get('model', '').replace('_', ' '), 'manufacturer': ''})
-    return found
-
-
-def devices():
-    """Every adb device on this computer, each with a kind: quest, frame, android (another
-    Android device), frame-tunnel (Frame Control's own SSH-tunnelled connection to a Lepton
-    instance, never touched here), emulator, or unknown (not authorised, offline...)."""
-    found = _parse_devices(adb('devices', '-l', timeout=15))
-    for d in found:
-        if TUNNEL_RE.match(d['serial']):
-            d['kind'] = 'frame-tunnel'
-        elif d['serial'].startswith('emulator-'):
-            d['kind'] = 'emulator'
-        elif d['state'] != 'device':
-            d['kind'] = 'unknown'
-        else:
-            try:
-                props = adb('shell', 'getprop ro.product.manufacturer; getprop ro.product.model',
-                            serial=d['serial'], timeout=15).splitlines() + ['', '']
-            except QuestError:
-                d['kind'] = 'unknown'
-                continue
-            d['manufacturer'], d['model'] = props[0].strip(), props[1].strip() or d['model']
-            maker = d['manufacturer'].lower()
-            d['kind'] = ('quest' if maker in QUEST_MAKERS or 'quest' in d['model'].lower()
-                         else 'frame' if maker == 'valve' else 'android')
-    return found
-
-
-def find_quest(serial=None):
-    """The one connected, authorised Quest, or a QuestError saying what to do."""
-    found = devices()
-    if serial:
-        d = next((d for d in found if d['serial'] == serial), None)
-        if not d:
-            raise QuestError(f'No adb device {serial} on this computer. ' + NO_DEVICE)
-        if d['kind'] == 'quest':
-            return d
-        state = {'unauthorized': UNAUTHORISED, 'no permissions': NO_PERMISSIONS, 'offline': OFFLINE}.get(d['state'])
-        what = ' '.join(x for x in (d['manufacturer'] or d['kind'], d['model']) if x)
-        raise QuestError(state or f"{serial} isn't a Meta Quest ({what}).")
-    quests = [d for d in found if d['kind'] == 'quest']
-    if len(quests) == 1:
-        return quests[0]
-    if quests:
-        raise QuestError('Several Quests are connected: ' + ', '.join(f"{d['model']} ({d['serial']})" for d in quests)
-                         + '. Choose one, or unplug the others.')
-    states = {d['state'] for d in found if d['kind'] == 'unknown'}
-    for state, message in (('unauthorized', UNAUTHORISED), ('no permissions', NO_PERMISSIONS), ('offline', OFFLINE)):
-        if state in states:
-            raise QuestError(message)
-    others = [d for d in found if d['kind'] in ('android', 'frame')]
-    if others:
-        raise QuestError(NO_DEVICE + ' (adb sees ' + ', '.join(
-            f"{d['manufacturer']} {d['model']}".strip() for d in others) + ", which isn't a Quest.)")
-    raise QuestError(NO_DEVICE)
-
-
-# ---- What's on it -------------------------------------------------------------
-
-def _package_script(packages):
-    parts = []
-    for p in packages:
-        parts += [f'echo @@{p}', f'pm path {p}', f'du -sk {OBB}/{p} 2>/dev/null', f'du -sk {DATA}/{p} 2>/dev/null']
-    return '; '.join(parts + ['true'])
-
-
-def _parse_packages(out, packages):
-    apps, current = {}, None
-    for line in out.splitlines():
-        line = line.strip()
-        if line.startswith('@@') and line[2:] in packages:
-            current = apps[line[2:]] = {'package': line[2:], 'apks': [], 'obb': None, 'data': None}
-        elif current is None or not line:
-            continue
-        elif line.startswith('package:'):
-            current['apks'].append(line[len('package:'):])
-        else:
-            size, _, where = line.partition('\t') if '\t' in line else line.partition(' ')
-            if size.isdigit():
-                key = 'obb' if where.strip().startswith(OBB + '/') else 'data' if where.strip().startswith(DATA + '/') else None
-                if key:
-                    current[key] = int(size) * 1024
-    result = []
-    for p in packages:
-        app = apps.get(p)
-        if not app or not app['apks']:
-            continue  # removed while listing
-        app['split'] = len(app['apks']) > 1
-        app['meta'] = p.startswith(META_APPS)
-        result.append(app)
-    return result
-
-
-def packages(serial):
-    """Third-party apps on the Quest: APK paths (several means a split APK), and the size
-    in bytes of the OBB and external data folders (None when there is none)."""
-    out = adb('shell', 'pm list packages -3', serial=serial)
-    names = sorted({l.split(':', 1)[1].strip() for l in out.splitlines() if l.startswith('package:')})
-    names = [n for n in names if android.PKG_RE.match(n)]
-    apps = []
-    for i in range(0, len(names), BATCH):
-        batch = names[i:i + BATCH]
-        apps += _parse_packages(adb('shell', _package_script(batch), serial=serial, timeout=120), batch)
-    return apps
-
-
-def package(serial, pkg):
-    apps = _parse_packages(adb('shell', _package_script([pkg]), serial=serial, timeout=60), [pkg])
-    if not apps:
-        raise QuestError(f"{pkg} isn't installed on the Quest")
-    return apps[0]
-
-
-def status(serial=None, with_apps=True):
-    """For the page: the Quest (or why there isn't one), what else adb sees, and its apps."""
-    try:
-        found = devices()
-    except QuestError as e:
-        return {'quest': None, 'devices': [], 'guidance': str(e), 'apps': []}
-    try:
-        quest = find_quest(serial)
-    except QuestError as e:
-        return {'quest': None, 'devices': found, 'guidance': str(e), 'apps': []}
-    return {'quest': quest, 'devices': found, 'guidance': None,
-            'apps': packages(quest['serial']) if with_apps else []}
-
-
-# ---- Checking what was copied ---------------------------------------------------
-
-def inspect(package_name, base, splits=()):
-    """Refuse what can't run on the Frame (32-bit only, Android newer than Lepton's, splits
-    that can't be merged), before anything is copied to it; warn about what may not run."""
-    names = set()
-    for path in [base, *splits]:
-        try:
-            with zipfile.ZipFile(path) as z:
-                names |= set(z.namelist())
-        except (zipfile.BadZipFile, OSError) as e:
-            raise QuestError(f'{os.path.basename(path)} copied from the Quest is not a readable APK: {e}')
-    info = android.apk_info(base)
-    label = info['label']
-    if info['package'] != package_name:
-        raise QuestError(f"The APK copied for {package_name} says it is {info['package']}; not importing it")
-    platform_sdk = any(n.rsplit('/', 1)[-1] == 'libovrplatformloader.so' for n in names)
-    abis = sorted({n.split('/')[1] for n in names if n.startswith('lib/') and n.count('/') >= 2})
-    if abis and 'arm64-v8a' not in abis:
-        raise QuestError(f"{label} is a 32-bit-only build ({', '.join(abis)}). The Frame runs 64-bit ARM "
-                         "(arm64-v8a) apps only; older Quest games are often 32-bit. Ask the developer "
-                         "whether a 64-bit build exists.")
-    android.check_installable(dict(info, abis=abis))  # Android version
-    if splits:
-        android.split_entries(base, splits)  # a split APK Frame Control can't merge fails now
-    warnings = [ENTITLEMENT] if platform_sdk else []
-    openxr = 'lib/arm64-v8a/libopenxr_loader.so' in names
-    if 'lib/arm64-v8a/libvrapi.so' in names and not openxr:
-        warnings.append(VRAPI)
-    return {'package': info['package'], 'label': label, 'version': info['version'],
-            'version_code': info.get('version_code'), 'abis': abis,
-            'vr': bool(info.get('vr') or openxr), 'platform_sdk': platform_sdk, 'warnings': warnings}
-
-
-# ---- Importing ------------------------------------------------------------------
-
-_import_lock = threading.Lock()
-_sleep = time.sleep
-
-
-def cache_root():
-    return Path(frame_host.cache_dir('quest-import'))
-
-
-def sweep_cache(now=None):
-    """Remove imports a crash left behind (older than CACHE_TTL)."""
-    root, now = cache_root(), now or time.time()
-    if root.is_dir():
-        for d in root.iterdir():
-            try:
-                if now - d.stat().st_mtime > CACHE_TTL:
-                    shutil.rmtree(d, ignore_errors=True)
-            except OSError:
-                pass
-
-
-def _safe(name):
-    return re.sub(r'[^A-Za-z0-9._-]', '_', name)[:120] or 'part.apk'
-
-
-def _remote_sizes(serial, paths):
-    out = adb('shell', 'stat -c %s ' + ' '.join(shlex.quote(p) for p in paths), serial=serial)
-    return sum(int(x) for x in out.split() if x.isdigit())
-
-
-def _pull(serial, remote, local):
-    adb('pull', remote, str(local), serial=serial, timeout=PULL_TIMEOUT)
-
-
-def _wait_ready(meta):
-    """Until the app's Lepton instance has finished booting Android."""
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    deadline = time.monotonic() + READY_TIMEOUT
-    while time.monotonic() < deadline:
-        out = android.ssh(f"podman exec {container} /system/bin/sh -c 'getprop sys.boot_completed' "
-                          "2>/dev/null || true", timeout=30)
-        if out.strip() == '1':
-            return
-        _sleep(3)
-    raise QuestError(f"{meta['label']} didn't start on the Frame within {READY_TIMEOUT // 60} minutes, so its "
-                     "game data couldn't be added. Check it opens from the Steam library, then import again.")
-
-
-def push_data(meta, folder):
-    """Stream a pulled /sdcard/Android/data/<package> folder into the running instance as a
-    tar, written straight into the SSH transfer: nothing is staged on this computer."""
-    import frame_android_data
-    pkg = meta['package']
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    script = f'set -eu; mkdir -p {DATA}/{pkg}; cd {DATA}/{pkg}; tar -x -o -f -'
-    read_end, write_end = os.pipe()
-    state = {'count': 0, 'error': None}
-
-    def write():
-        try:
-            with os.fdopen(write_end, 'wb') as out, \
-                    tarfile.open(fileobj=out, mode='w|', format=tarfile.GNU_FORMAT) as tar:
-                for path in sorted(Path(folder).rglob('*')):
-                    if path.is_symlink() or not (path.is_file() or path.is_dir()):
-                        continue  # regular files and folders only
-                    info = tar.gettarinfo(str(path), arcname=path.relative_to(folder).as_posix())
-                    info.uid = info.gid = 0
-                    info.uname = info.gname = ''
-                    if path.is_file():
-                        with path.open('rb') as f:
-                            tar.addfile(info, f)
-                        state['count'] += 1
-                    else:
-                        tar.addfile(info)
-        except (OSError, tarfile.TarError, ValueError) as e:  # ValueError: the reader closed first
-            state['error'] = e
-
-    writer = threading.Thread(target=write, daemon=True)
-    writer.start()
-    try:
-        with os.fdopen(read_end, 'rb') as src:
-            frame_android_data._stream(shlex.join(['podman', 'exec', '-i', container, '/system/bin/sh', '-c', script]),
-                                       src=src)
-    finally:
-        writer.join(60)
-    if state['error']:
-        raise QuestError(f'could not read the app files copied from the Quest: {state["error"]}')
-    return state['count']
-
-
-def space_needed(apk_bytes, merged_bytes, obb_bytes, data_bytes):
-    """Bytes an import needs free on this computer: the APKs as copied, a merged APK and the
-    install's patched copy of it (each up to merged_bytes), the OBB folder and the
-    Android/data folder (streamed to the Frame, never staged twice)."""
-    return apk_bytes + 2 * merged_bytes + obb_bytes + data_bytes
-
-
-def _check_space(work, need, pkg):
-    free = shutil.disk_usage(str(work)).free
-    if need > free:
-        raise QuestError(f'Importing {pkg} needs about {need / 1024**3:.1f} GB free on this computer '
-                         f'({free / 1024**3:.1f} GB available in {work.parent})')
-
-
-def import_game(package_name, serial=None, data=False, progress=None, allow_downgrade=False):
-    """Copy package_name from the Quest to the Frame. progress(stage, percent).
-
-    Frame Control never starts the game itself. Its game data (OBB, and Android/data if
-    asked) can only be written into a running Lepton instance, and there is no way to
-    boot one without its game, so that's a second import: the person starts the game,
-    imports again, and Frame Control copies the data in and closes the game.
-
-    allow_downgrade: replace a newer version on the Frame with the Quest's older one."""
-    if not android.PKG_RE.match(package_name or ''):
-        raise QuestError('invalid package name')
-    report = progress or (lambda stage, percent=None: None)
-    if not _import_lock.acquire(blocking=False):
-        raise QuestError('Another Quest import is running; wait for it to finish')
-    try:
-        report('Looking for your Quest', 1)
-        quest = find_quest(serial)
-        app = package(quest['serial'], package_name)
-        sweep_cache()
-        work = cache_root() / f'{package_name}-{secrets.token_hex(4)}'
-        work.mkdir(parents=True)
-        try:
-            return _import(quest['serial'], app, data, work, report, allow_downgrade)
-        finally:
-            shutil.rmtree(work, ignore_errors=True)
-    finally:
-        _import_lock.release()
-
-
-def _running(pkg):
-    # strict: a failed `podman ps` raises, never reads as "not running".
-    return f'lepton-steamlaunch-{android.instance_id(pkg)}' in android.running_instances(strict=True)
-
-
-def _installed_code(pkg, meta):
-    """The installed version code: from the install record, else (installs made before
-    records kept it) read from the installed app.apk on the Frame; None if unknown."""
-    code = (meta or {}).get('version_code')
-    if isinstance(code, int) and not isinstance(code, bool):
-        return code
-    return android.installed_version_code(pkg) if meta else None
-
-
-def _version(name, code):
-    return ' '.join(x for x in (f'version {name}' if name else '', f'code {code}' if code is not None else 'unknown code') if x)
-
-
-def _check_downgrade(existing, checked, allow):
-    """Refuse to replace a newer install on the Frame with the Quest's older copy."""
-    if not existing or allow:
-        return
-    have, new = _installed_code(existing['package'], existing), checked['version_code']
-    if have is None or new is None:
-        raise QuestError(f"Frame Control can't tell which version of {checked['label']} is on the Frame, so it "
-                         "won't replace it in case that one is newer. Allow replacing a newer version (or "
-                         "--allow-downgrade) to install your Quest's copy anyway.")
-    if int(new) < int(have):
-        raise QuestError(f"The Frame has a newer {checked['label']} ({_version(existing.get('version'), have)}) than "
-                         f"your Quest ({_version(checked['version'], new)}). Frame Control won't replace it with "
-                         "an older version unless you allow it (Allow replacing a newer version, or "
-                         "--allow-downgrade).")
-
-
-def _check_target(pkg, meta, checked):
-    """The install record of the game open on the Frame, if it is this package, in its own
-    instance, at the Quest's exact version code; else a QuestError."""
-    label = checked['label']
-    if (not meta or meta.get('package') != pkg or android._int(meta.get('instance')) != android.instance_id(pkg)):
-        raise QuestError(f"{label} is open on the Frame, but Frame Control has no matching install record for "
-                         'it. Close it, then import again to install it.')
-    have, new = _installed_code(pkg, meta), checked['version_code']
-    if have is None or new is None or int(have) != int(new):
-        raise QuestError(f"{label} is open on the Frame with a different version (Frame: "
-                         f"{_version(meta.get('version'), have)}; Quest: {_version(checked['version'], new)}). "
-                         "Close it, then import again to install the Quest's version.")
-    return meta
-
-
-def _check_android_package(meta, code):
-    """The package Android itself has installed in the instance is this one, at this version."""
-    pkg = meta['package']
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    out = android.ssh(f"podman exec {container} /system/bin/sh -c 'dumpsys package {pkg}' 2>/dev/null || true",
-                      timeout=60)
-    # Only this package's own block (dumpsys can list other packages too).
-    block = re.search(r'^\s*Package \[' + re.escape(pkg) + r'\] \(.*?(?=^\s*Package \[|\Z)', out, re.M | re.S)
-    found = re.search(r'\bversionCode=(\d+)', block.group(0)) if block else None
-    if not found:
-        raise QuestError(f'Android in {container} does not have {pkg} installed')
-    if int(found.group(1)) != int(code):
-        raise QuestError(f'Android in {container} has {pkg} version code {found.group(1)}, not the '
-                         f"Quest's {code}")
-
-
-def _close(pkg):
-    """Stop the game and confirm its instance is gone: (closed, why not)."""
-    try:
-        android.stop(pkg)
-        for _ in range(6):
-            if not _running(pkg):
-                return True, None
-            _sleep(2)
-        return False, 'it is still running'
-    except Exception as e:  # never replaces the error that led here; unconfirmed counts as not closed
-        return False, str(e) or type(e).__name__
-
-
-def _import(serial, app, data, work, report, allow_downgrade=False):
-    pkg = app['package']
-    obb_bytes = app['obb'] or 0
-    data_bytes = (app['data'] or 0) if data else 0
-    apk_bytes = _remote_sizes(serial, app['apks'])
-    _check_space(work, space_needed(apk_bytes, apk_bytes, obb_bytes, data_bytes), pkg)
-    # 1. The APK (and its splits), checked before anything else is copied.
-    local = []
-    for i, remote in enumerate(app['apks']):
-        report(f'Copying the app from your Quest ({i + 1} of {len(app["apks"])})', 5 + 20 * i // len(app['apks']))
-        name = 'base.apk' if os.path.basename(remote) == 'base.apk' else f'{i:02d}-{_safe(os.path.basename(remote))}'
-        _pull(serial, remote, work / name)
-        if not (work / name).is_file():
-            raise QuestError(f'adb did not copy {remote} from the Quest')
-        local.append(work / name)
-    base = next((p for p in local if p.name == 'base.apk'), local[0])
-    splits = [p for p in local if p != base]
-    report('Checking it can run on the Frame', 27)
-    checked = inspect(pkg, str(base), [str(p) for p in splits])
-    warnings = list(checked['warnings'])
-    label = checked['label']
-    # A merge stores what splits compressed: count it uncompressed, now the files are here.
-    merged = base.stat().st_size + android.split_size([str(p) for p in splits])
-    _check_space(work, space_needed(0, merged, obb_bytes, data_bytes), pkg)
-    wants_data = app['obb'] is not None or bool(data and app['data'] is not None)
-    if not _running(pkg):
-        # 2a. Install. The game is never started here: see import_game. Checked and installed
-        # under the shared install lock, so nothing installs or removes it in between.
-        report('Installing on the Frame', 60)
-        with android._install_lock:
-            if _running(pkg):
-                raise QuestError(f'{label} was started on the Frame during the import. Close it, then import again.')
-            _check_downgrade(android.read_meta(pkg), checked, allow_downgrade)
-            meta = android.install(str(base), splits=[str(p) for p in splits], source='Meta Quest (USB)')
-        report('Done', 100)
-        message = f"Imported {meta['label']} from your Quest. It's in the Steam library."
-        if wants_data:
-            what = ' and '.join(x for x in ('its OBB game data' if app['obb'] is not None else '',
-                                            'its Android/data files' if data and app['data'] is not None else '') if x)
-            message += (f" To add {what}, start {meta['label']} from the Steam library, leave it on its first "
-                        "screen, then import it again here: Frame Control copies the data in and closes the game.")
-        note = android.layer_note(meta)
-        return {'message': ' '.join([message, *warnings, *([note] if note else [])]), 'app': meta, 'obb': [],
-                'files': 0, 'warnings': warnings, 'split': bool(splits), 'needs_game_data': wants_data,
-                'closed': None}
-    # 2b. The game is open on the Frame: add its data to exactly this install, never replacing it.
-    _check_target(pkg, android.read_meta(pkg), checked)  # early, before copying the data off the Quest
-    if not wants_data:
-        raise QuestError(f"{label} is already installed and open on the Frame, and has no game data to add. "
-                         'Close it first to install it again.')
-    obb_files = []
-    if app['obb'] is not None:
-        report('Copying game data (OBB) from your Quest', 30)
-        (work / 'obb').mkdir()
-        _pull(serial, f'{OBB}/{pkg}', work / 'obb')
-        folder = work / 'obb' / pkg
-        files = sorted(p for p in folder.iterdir() if p.is_file()) if folder.is_dir() else []
-        obb_files = [p for p in files if re.fullmatch(OBB_NAME.format(re.escape(pkg)), p.name)]
-        skipped = [p.name for p in files if p not in obb_files]
-        if skipped:
-            warnings.append('Not copied, not standard OBB file names: ' + ', '.join(skipped))
-    data_folder = None
-    if data and app['data'] is not None:
-        report('Copying app files from your Quest', 50)
-        (work / 'data').mkdir()
-        _pull(serial, f'{DATA}/{pkg}', work / 'data')
-        data_folder = work / 'data' / pkg if (work / 'data' / pkg).is_dir() else None
-    result = add_game_data(pkg, checked, [str(p) for p in obb_files], data_folder, report, warnings)
-    result['split'] = bool(splits)
-    return result
-
-
-def add_game_data(pkg, checked, obb_files, data_folder, report, warnings=(), source='your Quest'):
-    """Copy game data into the game open on the Frame, then close it: the second step of a
-    two-step install (Import from my Quest, and My Meta library). checked is inspect()'s
-    result for the APK the data belongs to; obb_files are local OBB paths, data_folder a
-    local Android/data/<package> folder or None. Raises QuestError, after closing the game,
-    if anything fails."""
-    warnings = list(warnings)
-    label = checked['label']
-    copied_obb, copied_files, failure = [], 0, None
-    # Fetching the data can take a long time: check the target again, and hold the shared
-    # install lock (install, remove and install_obb take it too) until the game is closed.
-    with android._install_lock:
-        if not _running(pkg):
-            raise QuestError(f'{label} was closed on the Frame during the import. Start it, then import again.')
-        meta = _check_target(pkg, android.read_meta(pkg), checked)
-        closed, why = None, None
-        try:
-            report('Waiting for Android on the Frame', 70)
-            _wait_ready(meta)
-            _check_android_package(meta, checked['version_code'])
-            if obb_files:
-                report('Copying game data (OBB) to the Frame', 80)
-                copied_obb = android.install_obb(pkg, [str(p) for p in obb_files])['obb']
-            if data_folder:
-                report('Copying app files to the Frame', 92)
-                copied_files = push_data(meta, data_folder)
-        except Exception as e:  # any failure, local (OSError) or on the Frame, is reported below
-            failure = e
-        finally:
-            # Whatever happened, even Ctrl-C part-way through a write, the game is closed so it
-            # never runs on half-copied data. A failed close never hides the original error.
-            interrupted = sys.exc_info()[0] is not None
-            closed, why = _close(pkg)
-            if interrupted and not closed:
-                print(f"Frame Control couldn't close {meta['label']} on the Frame ({why}); close it from Steam "
-                      'before playing.', file=sys.stderr)
-    if failure:
-        message = f"Copying {meta['label']}'s game data failed: {failure}."
-        message += (' The game was closed; start it and import again to retry.' if closed else
-                    f" Frame Control also couldn't close the game ({why}): close it from Steam, then start it "
-                    'and import again.')
-        raise QuestError(message) from failure
-    report('Done', 100)
-    message = f"Added {meta['label']}'s game data from {source}"
-    message += ('; the game is closed, start it again from the Steam library.' if closed else
-                f", but Frame Control couldn't close the game ({why}). Close it from Steam before playing, so it "
-                'starts with the new data.')
-    if copied_obb:
-        message += f' Added {len(copied_obb)} OBB file{"s" if len(copied_obb) != 1 else ""}.'
-    if copied_files:
-        message += f' Copied {copied_files} app file{"s" if copied_files != 1 else ""}.'
-    return {'message': ' '.join([message, *warnings]), 'app': meta, 'obb': copied_obb, 'files': copied_files,
-            'warnings': warnings, 'split': False, 'needs_game_data': False, 'closed': closed}
-
-
-def main():
-    cmd, *args = sys.argv[1:] or ['help']
-    serial = args[args.index('--serial') + 1] if '--serial' in args and args.index('--serial') + 1 < len(args) else None
-    try:
-        if cmd == 'devices':
-            r = devices()
-        elif cmd == 'list':
-            r = packages(find_quest(serial)['serial'])
-        elif cmd == 'import':
-            names = [a for a in args if not a.startswith('--') and a != serial]
-            if len(names) != 1:
-                raise QuestError('usage: import PACKAGE [--serial SERIAL] [--data] [--allow-downgrade]')
-            r = import_game(names[0], serial, data='--data' in args, allow_downgrade='--allow-downgrade' in args,
-                            progress=lambda stage, percent=None: print(f'{percent:>3}% {stage}' if percent is not None
-                                                                       else stage, file=sys.stderr))
-        else:
-            sys.exit(__doc__)
-    except (android.FrameError, OSError) as e:
-        sys.exit(f'error: {e}')
-    print(json.dumps(r, indent=1))
-
-
-if __name__ == '__main__':
-    main()

ui/frame_report.py

@@ -6,25 +6,14 @@ project as a `problem_report` event: only the maintainer can read it, and
 nothing is published. It is sent whatever the analytics settings are, because
 the person sends it deliberately. Diagnostics are scrubbed first
 (frame_telemetry.scrub); the person's own words are sent as written.
-
-An email address goes with a report only when the person ticks "may contact me with
-follow-up questions" (contact_followup). Standing choices made in Settings are
-frame_contact.py's `contact_consent` events; `contacts` lists them.
 """
 import os
 import platform
-import re
-import shutil
-import subprocess
 import sys
-import threading
 import time
 import uuid
 
-import frame_contact
-import frame_devices
 import frame_host
-import frame_link
 import frame_telemetry
 
 KINDS = ('bug', 'idea', 'question', 'other')
@@ -34,7 +23,6 @@ LOG_LINES = 60
 ACTIVITY_LINES = 25
 
 frame = {}  # the Frame's last known SteamOS build, set by server.status()
-link = None  # the connector (frame_link.Link), set by server.main; None on the Frame itself
 
 
 def u16(s):
@@ -66,174 +54,9 @@ def _log_tail():
     return list(reversed(keep[-LOG_LINES:]))
 
 
-def ssh_path_kind(path):
-    """What sort of ssh a path is, never the path itself (it can hold a user name)."""
-    if not path:
-        return "not found"
-    p = str(path).replace("\\", "/").lower()
-    for marks, kind in ((("/system32/openssh/", "/sysnative/openssh/"), "Windows OpenSSH (System32)"),
-                        (("/program files/openssh",), "OpenSSH in Program Files"),
-                        (("/git/",), "Git for Windows"), (("msys", "cygwin"), "MSYS2/Cygwin"),
-                        (("/opt/homebrew/", "/usr/local/", "linuxbrew"), "Homebrew or /usr/local"),
-                        (("/nix/",), "Nix")):
-        if any(m in p for m in marks):
-            return kind
-    if p in ("/usr/bin/ssh", "/bin/ssh"):
-        return "system OpenSSH"
-    return "other"
-
-
-def _ssh_on_path():
-    """Every ssh on PATH, in the order they're found; the first is the one the app runs."""
-    names = ("ssh.exe", "ssh") if frame_host.WINDOWS else ("ssh",)
-    found, seen = [], set()
-    for d in os.get_exec_path():
-        for name in names:
-            cand = os.path.join(d, name)
-            key = os.path.normcase(os.path.abspath(cand))
-            if key not in seen and os.path.isfile(cand):
-                seen.add(key)
-                found.append(cand)
-                break
-    return found
-
-
-# Only a real banner at the very start ("OpenSSH_9.9p1, LibreSSL 3.3.6",
-# "OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2"): rebuilt from fixed names and its numbers.
-BANNER_RE = re.compile(r"OpenSSH_(for_Windows_)?(\d+)\.(\d+)(p\d+)?(?=[,\s]|$)")
-LIBRARY_RE = re.compile(r",?\s*(LibreSSL|OpenSSL) (\d+\.\d+\.\d+[a-z]?)(?=[,\s]|$)")
-
-
-def parse_ssh_version(said):
-    """"OpenSSH 9.9p1, LibreSSL 3.3.6"-style text from `ssh -V`'s output, or "unknown"."""
-    said = (said or "").lstrip()
-    m = BANNER_RE.match(said)
-    if not m:
-        return "unknown"
-    out = f"OpenSSH{' for Windows' if m.group(1) else ''} {m.group(2)}.{m.group(3)}{m.group(4) or ''}"
-    lib = LIBRARY_RE.match(said, m.end())
-    return out + (f", {lib.group(1)} {lib.group(2)}" if lib else "")
-
-
-def ssh_version(path):
-    """The version from `ssh -V` (it prints to stderr), nothing else it says."""
-    try:
-        r = frame_host.run_ssh([path, "-V"], capture_output=True, stdin=subprocess.DEVNULL, text=True,
-                               errors="replace", timeout=5)
-    except (OSError, subprocess.SubprocessError) as e:
-        return f"couldn't run it ({type(e).__name__})"
-    return parse_ssh_version(r.stderr or r.stdout)
-
-
-def _ssh_check():
-    path = shutil.which("ssh")
-    if not path:
-        return "SSH: no ssh on PATH"
-    others = [ssh_path_kind(p) for p in _ssh_on_path()
-              if os.path.normcase(os.path.abspath(p)) != os.path.normcase(os.path.abspath(path))]
-    others = [k for i, k in enumerate(others) if k not in others[:i]]
-    return f"SSH: {ssh_path_kind(path)}, {ssh_version(path)}" + (f"; also on PATH: {', '.join(others)}" if others else "")
-
-
-_ssh = {"thread": None, "line": None}
-_ssh_lock = threading.Lock()
-SSH_WAIT = 0.3  # how long a report preview waits for the ssh check (PATH can hold slow network drives)
-
-
-def start_ssh_check():
-    """Look for ssh once, in the background (server.main starts it), so a report never waits
-    on PATH folders on slow or mapped drives."""
-    def run():
-        try:
-            line = _ssh_check()
-        except Exception as e:  # a report must still go out
-            line = f"SSH: couldn't check ({type(e).__name__})"
-        _ssh["line"] = line
-    with _ssh_lock:
-        if _ssh["thread"] is None:
-            _ssh["thread"] = threading.Thread(target=run, name="report-ssh-check", daemon=True)
-            _ssh["thread"].start()
-        return _ssh["thread"]
-
-
-def ssh_line():
-    start_ssh_check().join(SSH_WAIT)
-    return _ssh["line"] or "SSH: still being checked"
-
-
-def config_line(alias):
-    """Whether ~/.ssh/config has the managed block for the alias, and a hand-written Host for it."""
-    try:
-        text = frame_devices.ssh_config().read_text(encoding="utf-8", errors="replace")
-    except FileNotFoundError:
-        return "~/.ssh/config: missing"
-    except OSError as e:
-        return f"~/.ssh/config: can't read it ({type(e).__name__})"
-    blocks = [b["alias"] for b in frame_devices.parse_blocks(text)]
-    outside, inside = [], None
-    for line in text.splitlines():
-        m = frame_devices.BLOCK_RE.fullmatch(line.strip())
-        if m:
-            inside = m.group(1)
-        elif inside and line.strip() == frame_devices.end_mark(inside):
-            inside = None
-        elif not inside:
-            outside.append(line)
-    own = any(alias in re.split(r"[\s=]+", ln.strip())[1:] for ln in outside
-              if re.match(r"(?i)\s*host[\s=]", ln))
-    return (f"~/.ssh/config: managed block for the active alias {'yes' if alias in blocks else 'no'} "
-            f"({len(blocks)} managed in all); hand-written Host for it {'yes' if own else 'no'}")
-
-
-def alias_kind(alias):
-    """`default ("frame")` or `custom`: a name someone chose can say who they are."""
-    return 'default ("frame")' if alias == "frame" else "custom"
-
-
-def connection_lines():
-    """A short summary of the connector in fixed words only: states, stages, error categories,
-    kinds of address, counts. No text from errors or ssh, no custom alias, never an address."""
-    if link is None:
-        return ["Connection: no connector (this server doesn't reach a headset over SSH)"]
-    snap = link.snapshot()
-    active = link.active_device()
-    alias = active.get("alias") or "?"
-    phase, err, via = snap.get("phase") or "idle", snap.get("error"), snap.get("via")
-    head = f"Connection: {phase}"
-    if phase == "connected" and via:
-        rtt = via.get("rtt_ms")
-        head += f" via {frame_link.address_kind(via.get('host'), via.get('ip'))}" + (f" ({rtt:g} ms)" if rtt is not None else "")
-    elif err:
-        head += f" at {err.get('stage')}"
-    head += f", attempt {snap.get('attempt') or 0}" + (f" ({snap['reason']})" if snap.get("reason") else "")
-    lines = [head]
-    kind = ("none set up" if active.get("none") else "a bare ssh alias" if active.get("transient")
-            else f"saved, {len(active.get('addresses') or [])} address(es)")
-    lines.append(f"Headsets: {len(link.reg.devices())} saved; active alias {alias_kind(alias)} ({kind})")
-    if err:
-        lines.append(f"Error: {err.get('stage')}, {frame_link.failure_category(err.get('message'), err.get('raw'))}")
-    last = link.last_failure
-    if last:
-        ago = max(0, int(frame_link.now() - last.get("at", 0)))
-        lines.append(f"Last failure: {last.get('stage')}, {last.get('category')}, {ago // 60} min {ago % 60} s ago")
-    lines.append(f"Addresses tried: {frame_link.probes_summary(snap.get('probes')) or 'none yet'}")
-    net = snap.get("network")
-    if net:
-        ts = net.get("tailscale") or {}
-        lines.append(f"Network: gateway {'yes' if net.get('gateway') else 'no'}, Tailscale "
-                     f"{'on' if ts.get('up') else 'off' if ts.get('installed') else 'not installed'}")
-    for part in (ssh_line, lambda: config_line(alias)):
-        try:
-            lines.append(part())
-        except Exception as e:  # a report must still go out
-            lines.append(f"({type(e).__name__} while checking SSH)")
-    return lines
-
-
 def diagnostics(activity=(), include_logs=False, limit=DIAG_MAX):
     """What a report includes, scrubbed and at most `limit` UTF-16 units. Always the versions
-    and builds, and a connection summary (connection_lines: kinds of address and states, never
-    the addresses, so "the app can't find the headset" can be told apart); recent activity and the server log only when asked for, since they can name
+    and builds; recent activity and the server log only when asked for, since they can name
     files. Sections are filled in order of use, newest lines first, so trimming drops the oldest."""
     t = frame_telemetry.state()
     levels = ', '.join(f"{name} {'on' if on else 'off'}" for name, on in
@@ -246,11 +69,7 @@ def diagnostics(activity=(), include_logs=False, limit=DIAG_MAX):
         f"Analytics: {levels}",
         f"Report time: {time.strftime('%Y-%m-%d %H:%M %Z')}",
     ]
-    try:
-        conn = connection_lines()
-    except Exception as e:  # never stop a report over its diagnostics
-        conn = [f"Connection: summary unavailable ({type(e).__name__})"]
-    out = frame_telemetry.scrub('\n'.join(env) + '\n\n' + '\n'.join(conn), limit=limit)
+    out = frame_telemetry.scrub('\n'.join(env), limit=limit)
     if not include_logs:
         return cut(out, limit)
     sections = [('Recent activity (newest first):', [str(a)[:300] for a in list(activity)[:ACTIVITY_LINES] if isinstance(a, str)]),
@@ -288,18 +107,9 @@ def send(body):
     """Send the report to PostHog. Returns {"id", "message"}; raises ReportError."""
     kind = body.get('kind') if body.get('kind') in KINDS else 'bug'
     title, text, diag = compose(body)
-    followup = frame_contact.flag(body, 'contactFollowup')
-    contact = str(body.get('contact') or '').strip() if followup else ''
-    if followup and not frame_contact.valid_email(contact):
-        raise ValueError('add your email address for follow-up questions, or untick that box')
-    started = time.time()  # a removal from now on (even while saving the address) is redacted from the log
-    # It becomes the contact email in Settings, where it's changed or removed like any other.
-    contact_id, contact_rev = frame_contact.from_report(contact) if followup else ('', 0)
     ref = uuid.uuid4().hex[:8].upper()
     props = {**frame_telemetry.common(), 'kind': kind, 'title': title, 'message': text,
-             'contact': contact, 'contact_followup': followup, 'diagnostics': diag,
-             # Only with an address: a later change from this copy (higher rev) can take it back.
-             'contact_id': contact_id, 'contact_rev': contact_rev,
+             'contact': str(body.get('contact') or '').strip()[:120], 'diagnostics': diag,
              'report_id': ref, 'steamos': str(frame.get('build') or '')[:120], 'level': 'report'}
     # Its own random id: a report can carry contact details, so it isn't linked to this copy's analytics.
     event = {'event': 'problem_report', 'distinct_id': str(uuid.uuid4()), 'uuid': str(uuid.uuid4()),
@@ -309,9 +119,7 @@ def send(body):
     except frame_telemetry.SendError as e:
         raise ReportError(str(e))
     try:
-        with frame_telemetry._lock:  # the lock a removal holds while wiping its address
-            frame_contact.redact_removed(event, started)
-            frame_telemetry.record_sent([event])
+        frame_telemetry.record_sent([event])
     except OSError:
         pass  # it was sent; failing to log it here mustn't make the person send it again
     return {'id': ref, 'message': f'Sent privately to the Frame Control developer (report {ref}).'}
@@ -323,109 +131,26 @@ class ReportError(RuntimeError):
 
 def inbox(days=30):
     """The maintainer's recent reports from PostHog, newest first (needs the personal API key
-    frame_compat_db.sync uses). Column 10 is whether the person may be asked follow-up
-    questions now: 'withdrawn' when a later choice from the same copy took it back."""
+    frame_compat_db.sync uses)."""
     import frame_compat_db
-    days = int(days)
     res = frame_compat_db._posthog_query(
         "SELECT timestamp, properties.report_id, properties.kind, properties.title, properties.message, "
-        "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics, "
-        "properties.contact_followup, properties.contact_id, properties.contact_rev "
-        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {days} DAY "
+        "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics "
+        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {int(days)} DAY "
         "ORDER BY timestamp DESC LIMIT 200")
-    rows = [r for r in res.get('results') or [] if isinstance(r, list) and len(r) == 13]
-    if any(r[11] and _yes(r[10]) for r in rows):
-        later = frame_compat_db._posthog_query(
-            "SELECT distinct_id, properties.email, properties.followup, ifNull(toInt(properties.rev), 0) "
-            "FROM events WHERE event = 'contact_consent' LIMIT 100000")
-        mark_withdrawn(rows, later.get('results') or [])
-    return rows
-
-
-def mark_withdrawn(reports, consents):
-    """Mark reports whose follow-up permission was taken back: the newest contact choice from
-    the same copy made after the report (a higher rev than it carries, not a later clock) no
-    longer agrees to follow-up questions at that address."""
-    newest = {}
-    for c in consents:
-        if not isinstance(c, list) or len(c) != 4:
-            continue
-        cid, email, followup, rev = c
-        try:
-            rev = int(rev or 0)
-        except (TypeError, ValueError):
-            continue
-        if rev > newest.get(str(cid), (-1,))[0]:
-            newest[str(cid)] = (rev, str(email or ''), followup)
-    for r in reports:
-        if not (r[11] and _yes(r[10])):
-            continue
-        try:
-            sent_at = int(r[12] or 0)
-        except (TypeError, ValueError):
-            sent_at = 0
-        rev, email, followup = newest.get(str(r[11]), (-1, '', None))
-        if rev > sent_at and not (_yes(followup) and email.strip().lower() == str(r[5] or '').strip().lower()):
-            r[10] = 'withdrawn'
-
-
-def _yes(v):
-    return v is True or str(v).lower() in ('true', '1')
-
-
-def contacts():
-    """{'updates': [(email, since)], 'followup': [...]}: the addresses whose newest
-    contact_consent event agrees to each, oldest first. A withdrawal, or a change to another
-    address, replaces what came before, so withdrawn addresses are never listed. "Newest" is
-    the highest rev from that copy (then time), so every field comes from the same event
-    whatever order they arrived in or what the clocks said."""
-    import frame_compat_db
-    newest = "tuple(ifNull(toInt(properties.rev), 0), timestamp)"
-    res = frame_compat_db._posthog_query(
-        f"SELECT distinct_id, argMax(properties.email, {newest}), argMax(properties.updates, {newest}), "
-        f"argMax(properties.followup, {newest}), argMax(timestamp, {newest}) FROM events "
-        "WHERE event = 'contact_consent' GROUP BY distinct_id ORDER BY max(timestamp) LIMIT 100000")
-    out = {'updates': [], 'followup': []}
-    for row in res.get('results') or []:
-        if not isinstance(row, list) or len(row) != 5:
-            continue
-        _, email, updates, followup, ts = row
-        email = str(email or '').strip()
-        if not frame_contact.valid_email(email):
-            continue
-        for kind, agreed in (('updates', updates), ('followup', followup)):
-            if _yes(agreed):
-                out[kind].append((email, str(ts or '')[:10]))
-    return out
-
-
-USAGE = 'usage: frame_report.py inbox [days] | contacts [updates|followup]'
+    return res.get('results') or []
 
 
 def main():
     cmd, *args = sys.argv[1:] or ['inbox']
-    if cmd == 'contacts':
-        kinds = args[:1] or ['updates', 'followup']
-        if not set(kinds) <= {'updates', 'followup'}:
-            sys.exit(USAGE)
-        found = contacts()
-        for kind in kinds:
-            print(f"== {'Release and update notices' if kind == 'updates' else 'Follow-up questions'}"
-                  f" ({len(found[kind])})")
-            for email, since in found[kind]:
-                print(f"   {email}  (since {since})")
-            print()
-        return
     if cmd != 'inbox':
-        sys.exit(USAGE)
+        sys.exit('usage: frame_report.py inbox [days]')
     for row in inbox(*(args[:1] or [30])):
-        ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row[:10])
-        # Reports from before contact_followup existed only carried an address given for a reply.
-        reply = contact and (row[10] is None or _yes(row[10]))
+        if not isinstance(row, list) or len(row) != 10:
+            continue
+        ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row)
         print(f"== {ts[:16].replace('T', ' ')}  {ref}  [{kind}] {title}")
-        print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}"
-              f"{', may follow up at ' + contact if reply else ''}"
-              f"{', follow-up permission since withdrawn' if row[10] == 'withdrawn' else ''}")
+        print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}{', reply to ' + contact if contact else ''}")
         print('   ' + text.replace('\n', '\n   '))
         if diag:
             print('   --- diagnostics\n   ' + diag.replace('\n', '\n   '))

ui/frame_status.py

@@ -6,7 +6,6 @@ error. Sensor paths verified on SteamOS 0.3.0; OpenVR timing on 0.4.1
 """
 import ctypes as C
 import glob
-import hashlib
 import math
 import json
 import os
@@ -122,16 +121,7 @@ def os_release():
         k, _, v = line.partition("=")
         out[k] = v.strip('"')
     return {"version": out.get("VERSION_ID"), "build": out.get("BUILD_ID"),
-            "variant": out.get("VARIANT_ID"), "headset": headset_id()}
-
-
-def headset_id():
-    """A one-way hash of the headset's /etc/machine-id: the same for this headset on every
-    computer, and the machine-id itself never leaves the headset. None without one."""
-    mid = read("/etc/machine-id")
-    if not mid:
-        return None
-    return hashlib.sha256(("frame-control-headset:" + mid).encode()).hexdigest()[:16]
+            "variant": out.get("VARIANT_ID")}
 
 
 def volume():

ui/frame_telemetry.py

@@ -50,18 +50,9 @@ SETTINGS = STATE / 'settings.json'
 OUTBOX = STATE / 'outbox.jsonl'
 SENT = STATE / 'sent.jsonl'
 SENT_KEEP = 200
-FRAMES_SEEN_KEEP = 100  # build/headset pairs already reported, enough for several headsets' updates
 OUTBOX_MAX = 2000  # events kept while offline; the oldest go first
 FLUSH_EVERY = 60
 REPEAT_WINDOW = 600  # the same diagnostic error is sent at most once in this many seconds
-# Not faults in Frame Control: the headset asleep, away or not set up yet, or ssh and the headset
-# not trusting each other (a host key that changed, a key not authorised): the page says what to do
-# about each (Devices tab, Set Up Connection). The status poll
-# meets these every few seconds, so each is sent at most once per session, whatever the wording,
-# but only for an error marked where ssh ran as ssh failing to reach the headset
-# (frame_host.link_failure). The message alone isn't evidence: a download's "Connection reset by
-# peer", or a file name with ssh's words in it, keeps the usual window.
-EXPECTED_CATEGORIES = ('frame_unreachable', 'frame_not_set_up', 'frame_auth')
 DEFAULT_HOST = 'https://us.i.posthog.com'
 
 LEVELS = ('usage', 'compat', 'diagnostics')
@@ -238,16 +229,9 @@ def scrub(text, limit=2000):
     home = str(Path.home())
     if len(home) > 3:
         t = t.replace(home, '~')
-    # A home folder's whole name ("C:\Users\Jane Doe", "/Users/O'Brien"), up to the next separator.
-    t = re.sub(r'''(?i)(/Users/|/home/|[A-Za-z]:[\\/]+Users[\\/]+)[^\\/\n"]+''', r'\1<user>', t)
-    # ssh's "user@host: ..." and "user@host's password:", the whole field: the user even with
-    # spaces or a DOMAIN\ prefix, the host even a full domain name. Before the email rule, which
-    # would otherwise take only the last word of the user.
-    t = re.sub(r'''(?m)(?:^|(?<=: )|(?<=\| ))[^@\n:|"<]{1,64}@[\w.\[\]%:<>-]+?(?=:(?:\s|$)|'s\s)''',
-               '<user>@<host>', t)
+    t = re.sub(r'(/Users/|/home/|[A-Za-z]:\\Users\\)[^/\\\s]+', r'\1<user>', t)
     for pattern, repl in SCRUBS:
         t = pattern.sub(repl, t)
-    t = re.sub(r'(?<![\w.+\\<-])[\w.+\\-]+@(?=[A-Za-z\[<])', '<user>@', t)  # any other word@host
     t = IPV6_RE.sub(_ipv6, t)
     for name in _user_names():
         t = re.sub(r'\b%s\b' % re.escape(name), '<user>', t)
@@ -256,47 +240,17 @@ def scrub(text, limit=2000):
 
 # From the most to the least specific; the first match wins.
 CATEGORIES = [
-    # A web-link download (frame_webinstall) that broke or didn't check out: not the headset,
-    # whatever the reason, and first so a file name in the message can't put it elsewhere.
-    ('download_failed', re.compile(r"\A(?:download failed: |download cut off at |downloaded \d+ bytes; |"
-                                   r"the server says \d+ bytes; )|doesn't match the manifest's sha256; "
-                                   r"not installing it\Z")),
     ('android_installer', re.compile(r'INSTALL_(?:FAILED|PARSE_FAILED)_[A-Z_]+')),
     ('apk_needs_newer_android', re.compile(r'needs Android API')),
     ('apk_wrong_abi', re.compile(r'no arm64-v8a build')),
-    ('layer_missing', re.compile(r'OpenXR compatibility layer')),
-    ('apk_repack_failed', re.compile(r'could not prepare the APK for the Frame')),
-    ('tool_missing', re.compile(r"\[WinError 2\]|No such file or directory: '(?:ssh|scp|rsync|adb)")),
-    ('apk_unreadable', re.compile(r'(?i)not a zip|bad apk|AndroidManifest|ApkError|unexpected package name|'
-                                  r'not a readable APK|not an APK|APK manifest|in the APK (?:uses a compression|is )')),
+    ('apk_unreadable', re.compile(r'(?i)not a zip|bad apk|AndroidManifest|ApkError|unexpected package name')),
     ('cant_run_on_frame', re.compile(r"can't run on the Frame")),
     ('steam_shortcut', re.compile(r'(?i)steam did not return a shortcut|shortcut list|no Steam shortcut')),
-    # The Frame-side scripts that talk to the Steam client's UI (frame/android/steam_shortcuts.py), which
-    # fail with their own words or a Python traceback, its last lines kept. Before frame_unreachable:
-    # "Connection refused" and "timed out" here are Steam's debug port on the Frame, not ssh.
-    ('steam_not_running', re.compile(r'SharedJSContext not found|'
-                                     r'URLError: <urlopen error \[Errno 111\] Connection refused>|'
-                                     r'ConnectionRefusedError: \[Errno 111\]')),
-    ('steam_not_responding', re.compile(r'websocket handshake failed|(?:socket\.timeout|TimeoutError): timed out|'
-                                        r'(?:\A|\n)EOFError\Z')),
-    ('steam_js_error', re.compile(r'JS error: ')),
-    ('artwork_failed', re.compile(r'incomplete artwork render|artwork renderer did not produce|'
-                                  r'render is \d+ bytes of|could not prepare artwork|all five Steam artwork slots')),
-    # Copying the APK (or its launcher) to the Frame: rsync or scp ran out of time.
-    ('copy_timeout', re.compile(r'to the Frame timed out\Z')),
     ('frame_not_set_up', re.compile(r'(?i)Could not resolve hostname|no "?frame"? (?:SSH )?alias')),
-    ('frame_auth', re.compile(r'(?i)Permission denied|Host key verification failed|'
-                              r'REMOTE HOST IDENTIFICATION HAS CHANGED|host key is known for')),
-    # Anything ssh says about its own connection: "ssh: connect to host … port 22: <reason>" (Windows
-    # says "Unknown error"), a dropped shared connection (mux_client_…, client_loop), and Windows'
-    # "banner exchange: Connection to UNKNOWN port -1" (its ssh can't name a peer whose connect
-    # failed late). Not a bare "ssh exited 255": a command on the Frame can exit 255 too.
+    ('frame_auth', re.compile(r'(?i)Permission denied|Host key verification failed')),
     ('frame_unreachable', re.compile(r'(?i)timed out|Connection (?:refused|reset|closed)|No route to host|'
-                                     r'Network is unreachable|Host is down|asleep|kex_exchange|banner exchange|'
-                                     r'ssh: connect to host |mux_client_|client_loop: ')),
+                                     r'Network is unreachable|Operation timed out|asleep|kex_exchange')),
     ('frame_disk_full', re.compile(r'(?i)No space left|disk full|ENOSPC')),
-    # rsync or scp failed for another reason ("connection unexpectedly closed", or no words at all).
-    ('copy_failed', re.compile(r'\Acopying .+ to the Frame failed: ')),
     ('download_failed', re.compile(r'(?i)HTTP (?:Error )?\d{3}|URLError|download|certificate verify failed')),
     ('flatpak', re.compile(r'(?i)flatpak|flathub')),
     ('cancelled', re.compile(r'(?i)cancel')),
@@ -304,16 +258,8 @@ CATEGORIES = [
 ]
 
 
-# Python's own errors for a mistake in Frame Control's code, whatever their message says.
-BUG_ERRORS = (KeyError, IndexError, TypeError, AttributeError, NameError, AssertionError,
-              ZeroDivisionError, RecursionError, UnicodeError, json.JSONDecodeError)
-
-
 def categorize(message):
-    """(category, detail): a fixed category name, plus an Android installer code when there is one.
-    message may be the exception itself: one of BUG_ERRORS is internal_error."""
-    if isinstance(message, BUG_ERRORS):
-        return 'internal_error', None
+    """(category, detail): a fixed category name, plus an Android installer code when there is one."""
     text = str(message or '')
     for name, pattern in CATEGORIES:
         m = pattern.search(text)
@@ -391,29 +337,20 @@ def app_started():
         _save(s)
 
 
-def frame_seen(build, version, headset=None, saved=None):
-    """The Frame's SteamOS build (public build numbers), once per build for each headset.
-    headset: the anonymous hash from frame_status.headset_id; saved: how many headsets
-    this copy of the app has set up."""
-    headset = headset if isinstance(headset, str) and re.fullmatch(r'[0-9a-f]{16}', headset) else None
-    key = f'{build}/{version}' + (f'/{headset}' if headset else '')
+def frame_seen(build, version):
+    """The Frame's SteamOS build, once per build (public build numbers)."""
+    key = f'{build}/{version}'
     with _lock:
         s = settings()
         if not build or key in s['frames_seen']:
             return
-        s['frames_seen'] = (s['frames_seen'] + [key])[-FRAMES_SEEN_KEEP:]
+        s['frames_seen'] = (s['frames_seen'] + [key])[-20:]
         _save(s)
-    p = {'steamos_build': str(build)[:40], 'steamos_version': str(version or '')[:40]}
-    if headset:
-        p['headset_id'] = headset
-    if isinstance(saved, int) and saved >= 0:
-        p['headsets_saved'] = saved
-    capture('frame_connected', p)
+    capture('frame_connected', {'steamos_build': str(build)[:40], 'steamos_version': str(version or '')[:40]})
 
 
-def install_finished(kind, ok, seconds=None, error=None, diagnose=True, **props):
-    """kind: apk, flatpak, steam, title or web. props must already be public (no file names).
-    diagnose=False when the error is reported as a diagnostic elsewhere."""
+def install_finished(kind, ok, seconds=None, error=None, **props):
+    """kind: apk, flatpak, steam, title or web. props must already be public (no file names)."""
     p = {'kind': kind, 'ok': bool(ok), **{k: v for k, v in props.items() if v is not None}}
     if seconds is not None:
         p['seconds'] = round(seconds, 1)
@@ -421,41 +358,21 @@ def install_finished(kind, ok, seconds=None, error=None, diagnose=True, **props)
         p['error_category'], code = categorize(error)
         if code:
             p['installer_code'] = code
-    elif not ok:
-        p['error_category'] = 'other'
     capture('install_finished', p)
-    if error is not None and not ok and diagnose:
+    if error is not None and not ok:
         diagnostic(f'{kind} install failed', error)
 
 
-def link_failed(error):
-    """Whether an ssh helper marked this error (frame_host.link_failure) as ssh failing to reach the
-    headset: the error itself, or one it was re-raised from (`raise Failure(...) from e`)."""
-    for _ in range(10):  # a cause chain is short; never loop on a cycle
-        if error is None:
-            return False
-        if getattr(error, 'frame_link_failed', False):
-            return True
-        error = getattr(error, '__cause__', None)
-    return False
-
-
 def diagnostic(where, error, tb=None):
     """An error for the opt-in diagnostics level: scrubbed text, and a traceback if there is one."""
     if not enabled('diagnostics'):
         return
     message = scrub(error)
-    category = categorize(error)[0]
+    fingerprint = f'{where}|{message[:120]}'
     now = time.time()
     with _lock:
-        if category in EXPECTED_CATEGORIES and link_failed(error):
-            fingerprint = f'expected|{category}'
-            if fingerprint in _seen_errors:
-                return
-        else:
-            fingerprint = f'{where}|{message[:120]}'
-            if now - _seen_errors.get(fingerprint, 0) < REPEAT_WINDOW:
-                return
+        if now - _seen_errors.get(fingerprint, 0) < REPEAT_WINDOW:
+            return
         _seen_errors[fingerprint] = now
     exc_type = type(error).__name__ if isinstance(error, BaseException) else 'Error'
     frames = []
@@ -468,7 +385,7 @@ def diagnostic(where, error, tb=None):
                                                 'mechanism': {'handled': True, 'type': 'generic'},
                                                 'stacktrace': {'type': 'raw', 'frames': frames[-30:]}}],
                            '$exception_type': exc_type, '$exception_message': message,
-                           'where': scrub(where, 200), 'error_category': category},
+                           'where': scrub(where, 200), 'error_category': categorize(error)[0]},
             level='diagnostics')
 
 
@@ -486,7 +403,7 @@ def compat_report(report):
         if k in p:
             p[k] = scrub(p[k], n)
     src = str(p.pop('source', '') or '')
-    if src in ('F-Droid', 'meta-store'):  # fixed source tags, never a person's file name
+    if src == 'F-Droid':
         p['source'] = src
     elif src.startswith(('http://', 'https://')) and _scrub_url(src) != '<url>':
         p['source'] = _scrub_url(src)

ui/frame_touch.py

@@ -25,9 +25,7 @@ Standard library only (ctypes for libei), like the rest of what runs on the Fram
 import ctypes
 import json
 import os
-import re
 import select
-import shutil
 import subprocess
 import sys
 import time
@@ -55,41 +53,14 @@ def say(state, **more):
 
 # ---- which panel has focus -----------------------------------------------------
 
-PROPS = ("GAMESCOPE_FOCUSABLE_WINDOWS", "GAMESCOPE_FOCUSED_WINDOW", "GAMESCOPE_FOCUS_DISPLAY")
-TOOL_TIMEOUT = 5.0  # seconds for any one xprop or xwininfo
-PANELS_DEADLINE = 12.0  # seconds for a whole `panels` run: well inside the server's 20 s for /api/panels
-DEADLINE = [None]  # when the current `panels` run must stop asking X tools (monotonic), if it has one
-
-
-class OutOfTime(Exception):
-    """The current run's deadline passed: stop and report what was found."""
-
-
-def budget(limit=TOOL_TIMEOUT):
-    """Seconds an X tool may take now: its own limit, cut to what's left of the run's deadline."""
-    if DEADLINE[0] is None:
-        return limit
-    left = DEADLINE[0] - time.monotonic()
-    if left <= 0:
-        raise OutOfTime()
-    return min(limit, left)
-
-
-def read_props(display, limit=TOOL_TIMEOUT):
-    """gamescope's root properties on one display, in one xprop call: {name: [values]} for
-    those the display has, {} if none (or xprop didn't answer)."""
+def xprop_root(display, name):
     try:
-        out = subprocess.run(["xprop", "-root", *PROPS], env=dict(os.environ, DISPLAY=display),
-                             capture_output=True, text=True, timeout=budget(limit)).stdout
+        out = subprocess.run(["xprop", "-root", name], env=dict(os.environ, DISPLAY=display),
+                             capture_output=True, text=True, timeout=5).stdout
     except (OSError, subprocess.SubprocessError):
-        return {}
-    props = {}
-    for line in out.splitlines():
-        name, sep, values = line.partition("=")
-        name = name.split("(", 1)[0].strip()
-        if sep and name in PROPS:
-            props[name] = [int(v) for v in values.replace(",", " ").split() if v.isdigit()]
-    return props
+        return []
+    values = out.split("=", 1)[1] if "=" in out else ""
+    return [int(v) for v in values.replace(",", " ").split() if v.isdigit()]
 
 
 def window_info(display, window):
@@ -97,7 +68,7 @@ def window_info(display, window):
     try:
         which = ["-root"] if window == "root" else ["-id", str(window)]
         out = subprocess.run(["xwininfo", *which], env=dict(os.environ, DISPLAY=display),
-                             capture_output=True, text=True, timeout=budget()).stdout
+                             capture_output=True, text=True, timeout=5).stdout
     except (OSError, subprocess.SubprocessError):
         return None
     if "IsViewable" not in out:
@@ -115,58 +86,13 @@ def window_info(display, window):
 
 
 def displays():
-    """Every X display on the Frame: the sockets in /tmp/.X11-unix, and the abstract ones
-    X servers on Linux usually listen on as well (in /proc/net/unix), in case a SteamOS
-    build stops sharing /tmp/.X11-unix with SSH sessions."""
-    found = set()
-    try:
-        found.update(int(n[1:]) for n in os.listdir("/tmp/.X11-unix") if n[:1] == "X" and n[1:].isdigit())
-    except OSError:
-        pass
-    try:
-        with open("/proc/net/unix") as f:
-            found.update(int(n) for n in re.findall(r"@/tmp/\.X11-unix/X(\d+)", f.read()))
-    except OSError:
-        pass
-    return [f":{n}" for n in sorted(found)]
-
-
-# The input helper (`frame_touch.py` reading events) lives for a whole Control session and
-# reads focus often, so it remembers which display has gamescope's properties: found, for
-# good; not found, for ROOT_RETRY. A `panels` run is a fresh process each time, so this
-# saves it nothing; it costs nothing either while :0 has the properties.
-_ROOT = []  # [display, when it was given up on, or None if found]
-ROOT_PROBE_TIMEOUT = 2.0  # seconds for each display other than :0, so a stalled one can't use the run
-ROOT_RETRY = 30.0
-
-
-def gamescope():
-    """(display, properties): the X display whose root window carries gamescope's panel
-    properties (GAMESCOPE_FOCUSABLE_WINDOWS and friends), and what they say now.
-
-    That's :0 on every build seen so far (SteamOS 0.3.0 to 0.4.1), so :0 is read first and,
-    when it has them, used with no other probe. Only if it hasn't are the other displays
-    asked, briefly each; with none, :0 and no properties.
-    """
-    if _ROOT and (_ROOT[1] is None or time.monotonic() - _ROOT[1] < ROOT_RETRY):
-        return _ROOT[0], read_props(_ROOT[0])
-    props, found = read_props(":0"), ":0"
-    if not props:
-        found = None
-        for display in displays():
-            if display != ":0":
-                props = read_props(display, ROOT_PROBE_TIMEOUT)
-                if props:
-                    found = display
-                    break
-    _ROOT[:] = [found, None] if found else [":0", time.monotonic()]
-    return _ROOT[0], props
+    return sorted(f":{n[1:]}" for n in os.listdir("/tmp/.X11-unix") if n[1:].isdigit())
 
 
 def window_pid(display, window):
     try:
         out = subprocess.run(["xprop", "-id", str(window), "_NET_WM_PID"], env=dict(os.environ, DISPLAY=display),
-                             capture_output=True, text=True, timeout=budget()).stdout
+                             capture_output=True, text=True, timeout=5).stdout
     except (OSError, subprocess.SubprocessError):
         return None
     value = out.rsplit("=", 1)[-1].strip() if "=" in out else ""
@@ -194,20 +120,20 @@ def locate(window, pid):
             "root": [root.get("width", info["width"]), root.get("height", info["height"])]}
 
 
-def focusable(props=None):
-    """gamescope's focusable windows as (window, app id, pid), from props if already read."""
-    t = (gamescope()[1] if props is None else props).get("GAMESCOPE_FOCUSABLE_WINDOWS", [])
+def focusable():
+    """gamescope's focusable windows as (window, app id, pid)."""
+    t = xprop_root(":0", "GAMESCOPE_FOCUSABLE_WINDOWS")
     return [tuple(t[i:i + 3]) for i in range(0, len(t) - 2, 3)]
 
 
-def focus_display(props=None):
-    """The display of the focused window, from GAMESCOPE_FOCUS_DISPLAY on gamescope's root.
+def focus_display():
+    """The display of the focused window, from GAMESCOPE_FOCUS_DISPLAY on :0's root.
 
     gamescope writes the name (":1") as 32-bit items, so its first four bytes land,
     little-endian, in the first value: 12602 is 0x313A, ":1" (steamcompmgr.cpp;
     seen 2026-09-29).
     """
-    values = (gamescope()[1] if props is None else props).get("GAMESCOPE_FOCUS_DISPLAY")
+    values = xprop_root(":0", "GAMESCOPE_FOCUS_DISPLAY")
     if not values:
         return None
     name = (values[0] & 0xFFFFFFFF).to_bytes(4, "little").split(b"\0", 1)[0].decode("ascii", "replace")
@@ -215,23 +141,19 @@ def focus_display(props=None):
 
 
 def focus_now():
-    """Just which window and display have focus: one property read, for checking a press."""
-    props = gamescope()[1]
-    window = (props.get("GAMESCOPE_FOCUSED_WINDOW") or [0])[0]
-    return (window or None, focus_display(props) if window else None)
+    """Just which window and display have focus: two property reads, for checking a press."""
+    window = (xprop_root(":0", "GAMESCOPE_FOCUSED_WINDOW") or [0])[0]
+    return (window or None, focus_display() if window else None)
 
 
-def focus(props=None):
+def focus():
     """The panel that has focus in the headset: window, display, name and sizes (gamescope
-    publishes the window and its display on its root display, :0 so far). props: gamescope's
-    properties if already read."""
-    if props is None:
-        props = gamescope()[1]
-    window = (props.get("GAMESCOPE_FOCUSED_WINDOW") or [0])[0]
+    publishes the window and its display on :0's root)."""
+    window = (xprop_root(":0", "GAMESCOPE_FOCUSED_WINDOW") or [0])[0]
     if not window:
         return {"window": None}
-    app, pid = next(((a, p) for w, a, p in focusable(props) if w == window), (None, None))
-    display = focus_display(props)
+    app, pid = next(((a, p) for w, a, p in focusable() if w == window), (None, None))
+    display = focus_display()
     info = window_info(display, window) if display else None
     if info:
         root = window_info(display, "root") or {}
@@ -242,77 +164,18 @@ def focus(props=None):
     return {**panel, "app": app} if panel else {"window": None}
 
 
-def panels(limit=None):
-    """Every app panel (gamescope's focusable windows), for watching one that hasn't focus.
-
-    One deadline (PANELS_DEADLINE) covers the whole run, inside the server's timeout: past
-    it, the panels found so far come back with a "why" saying the headset was too slow.
-    """
-    DEADLINE[0] = time.monotonic() + (PANELS_DEADLINE if limit is None else limit)
-    now, found, unfound, late = {}, [], 0, False
-    try:
-        props = gamescope()[1]
-        now = focus(props)
-        for window, app, pid in focusable(props):
-            panel = locate(window, pid)
-            unfound += panel is None
-            if panel and panel["width"] > 1 and panel["height"] > 1 and \
-                    not any(f["window"] == window and f["display"] == panel["display"] for f in found):
-                panel.pop("root", None)
-                found.append({**panel, "app": app, "focused": (window, panel["display"]) ==
-                              (now.get("window"), now.get("display"))})
-        late = time.monotonic() >= DEADLINE[0]  # the last read may have been cut short
-    except OutOfTime:
-        late = True
-    finally:
-        DEADLINE[0] = None
-    out = {"focus": now.get("window"), "focus_display": now.get("display"), "panels": found}
-    if late:
-        out["why"] = ("The headset took too long to list its panels (its X tools didn't answer in time). "
-                      + ("Some may be missing. " if found else "") + "Try again, or use the Headset view.")
-    elif not found:
-        out["why"] = why_none(unfound)
-    return out
-
-
-# The headset's Linux desktop, by process name (docs/how-the-frame-works.md).
-DESKTOP = ("plasmashell", "kwin_wayland", "kwin_wayland_wrapper", "steamos-nested-desktop", "startplasma-wayland")
-
-
-def desktop_running():
-    """Whether the headset's Linux desktop (the nested Plasma session) is running."""
-    try:
-        pids = [p for p in os.listdir("/proc") if p.isdigit()]
-    except OSError:
-        return False
-    for pid in pids:
-        try:
-            with open(f"/proc/{pid}/comm") as f:
-                if f.read().strip() in DESKTOP:
-                    return True
-        except OSError:
-            continue
-    return False
-
-
-def why_none(listed):
-    """Why panels() found nothing, in words the person at the computer can act on.
-    listed: how many of the windows gamescope lists aren't X11 windows on any display."""
-    missing = [tool for tool in ("xprop", "xwininfo") if not shutil.which(tool)]
-    if missing:
-        return (f"This SteamOS build has no {' or '.join(missing)}, which Frame Control uses to find the "
-                "headset's panels. Use the Headset view instead, and please report your SteamOS version.")
-    if listed:
-        # gamescope lists windows, but none is an X11 window on any display: a Wayland
-        # window (a desktop drawn straight to gamescope, say) can't be found or captured this way.
-        return (f"The headset has {listed} panel{'s' if listed > 1 else ''} open, but Frame Control can't "
-                f"find {'its' if listed == 1 else 'their'} window. This SteamOS build may draw "
-                f"{'it' if listed == 1 else 'them'} in a way the Desktop view can't capture yet. "
-                "Use the Headset view instead, and please report your SteamOS version.")
-    if desktop_running():
-        return ("The headset's desktop is running, but SteamOS isn't listing it as a panel. Look at it in "
-                "the headset (or close and reopen it), then try again, or use the Headset view.")
-    return "No app panel is open in the headset. Open the desktop or an app in the headset, then try again."
+def panels():
+    """Every app panel (gamescope's focusable windows), for watching one that hasn't focus."""
+    now = focus()
+    found = []
+    for window, app, pid in focusable():
+        panel = locate(window, pid)
+        if panel and panel["width"] > 1 and panel["height"] > 1 and \
+                not any(f["window"] == window and f["display"] == panel["display"] for f in found):
+            panel.pop("root", None)
+            found.append({**panel, "app": app, "focused": (window, panel["display"]) ==
+                          (now.get("window"), now.get("display"))})
+    return {"focus": now.get("window"), "focus_display": now.get("display"), "panels": found}
 
 
 def to_root(panel, fx, fy):

ui/frame_webinstall.py

@@ -456,9 +456,7 @@ def dispatch(path, name=None, exe=None, progress=None, source=None):
             m = frame_android.install(path, source=source or os.path.basename(path))
         except frame_android.FrameError as e:
             raise WebInstallError(str(e))
-        message = f"Installed {m['label']} as its own app in the Steam library"
-        note = frame_android.layer_note(m)
-        return {"message": f"{message}. {note}" if note else message, "kind": kind, "result": m}
+        return {"message": f"Installed {m['label']} as its own app in the Steam library", "kind": kind, "result": m}
     try:
         import frame_titles
     except ImportError as e: