APK alternatives: refresh the catalogue after an install job; pin the test's premise

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.claude/skills/steam-frame/SKILL.md

@@ -27,6 +27,9 @@ desktop or panels.
 | Flatpaks | `docs/streaming.md` | `scripts/install-apps.sh` |
 | Launch an app inside the desktop panel | the script's header comment | `scripts/run-on-frame.sh` |
 | Mac GUI over all of this | `README.md` → Frame Control | `scripts/frame-ui.sh` |
+| iPhone/iPad app (server runs on the Frame, `FRAME_LOCAL=1`) | `docs/iphone.md` | `ios/`, `ui/local-bin/ssh` |
+| Recovery images, factory reset, boot loops | `docs/recovery-and-images.md`, `docs/how-the-frame-works.md` | `~/Downloads/steam-frame-recovery/` |
+| Test without the headset (the Frame OS image's own sshd) | `tests/frame-container/README.md` | `tests/frame-container/frame-image.sh` |
 | What's still unverified | `docs/open-questions.md` | — |
 
 Each script's usage is in its header comment. Read the header rather than

.gitattributes

@@ -0,0 +1,8 @@
+# Scripts run on the Frame (Linux) and on macOS/Linux: keep LF even in Windows checkouts.
+*.sh text eol=lf
+*.py text eol=lf
+*.js text eol=lf
+*.html text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.bat text eol=crlf

.github/APPROVED_CONTRIBUTORS

@@ -0,0 +1,9 @@
+# GitHub handles approved to bypass contribution auto-close
+# Format: <username> <capability>
+# capability:
+#   issue  future issues stay open
+#   pr     future issues and PRs stay open
+# Maintainers add people by replying `lgtmi` or `lgtm` on an issue
+# (.github/workflows/approve-contributor.yml); editing this file by hand works too.
+
+fbl100 pr

.github/FUNDING.yml

@@ -0,0 +1 @@
+ko_fi: alexsouthwell

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Report something that's broken
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before you start:** read [CONTRIBUTING.md](https://github.com/saphid/frame-control/blob/main/CONTRIBUTING.md).
+
+        Issues from new contributors are auto-closed by default. A maintainer reviews them and reopens worthwhile ones. The [website feedback form](https://frame-control.pages.dev/feedback/) skips that queue.
+
+        Keep this short. If it doesn't fit on one screen, it's too long. Write in your own voice.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Be specific. Include error messages and the last lines of the server log (Frame → Show Server Log).
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to trigger the bug.
+    validations:
+      required: false
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: Frame Control version
+      description: e.g. v0.3.1
+    validations:
+      required: false
+
+  - type: input
+    id: os
+    attributes:
+      label: Computer and SteamOS build
+      description: e.g. Windows 11, SteamOS 20260922.6101926 (Steam Settings → System)
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Feedback form (no GitHub account needed, skips the queue)
+    url: https://frame-control.pages.dev/feedback/
+    about: Bugs, ideas and questions from the website become issues here without being auto-closed.

.github/ISSUE_TEMPLATE/idea.yml

@@ -0,0 +1,36 @@
+name: Idea or contribution proposal
+description: Propose a change or feature (required for new contributors before opening a PR)
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before you start:** read [CONTRIBUTING.md](https://github.com/saphid/frame-control/blob/main/CONTRIBUTING.md).
+
+        Issues from new contributors are auto-closed by default. A maintainer reviews them and reopens worthwhile ones.
+
+        Keep this short. If it doesn't fit on one screen, it's too long. Write in your own voice.
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What do you want to change?
+      description: Be specific and concise.
+    validations:
+      required: true
+
+  - type: textarea
+    id: why
+    attributes:
+      label: Why?
+      description: What problem does this solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: how
+    attributes:
+      label: How? (optional)
+      description: Brief technical approach, and whether you'd like to implement it yourself.
+    validations:
+      required: false

.github/workflows/approve-contributor.yml

@@ -0,0 +1,238 @@
+# Contributor gate adapted from badlogic/pi-mono (MIT) at 6f7551516b84.
+# See CONTRIBUTING.md for how it works.
+
+name: Approve Contributor
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  approve:
+    # Only maintainers' comments that might approve someone join the queue, and
+    # they run one at a time so two lgtm replies can't race on APPROVED_CONTRIBUTORS.
+    # (The script below still checks for write access.)
+    if: >-
+      contains(github.event.comment.body, 'lgtm') &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
+    concurrency:
+      group: approve-contributor
+      cancel-in-progress: false
+      queue: max
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Update contributor approval
+        id: update
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const fs = require('fs');
+
+            const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS';
+            const VALID_CAPABILITIES = new Set(['issue', 'pr']);
+            const issueAuthor = context.payload.issue.user.login;
+            const commenter = context.payload.comment.user.login;
+            const commentBody = (context.payload.comment.body || '').trim();
+
+            const approvalAtStartPattern = /^[\s.]*(?:@[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\s*,\s*|[.:]\s*|\s+))*(lgtmi|lgtm)(?=$|[\s]|[^\p{L}\p{N}_\s])/iu;
+            const approvalAtEndPattern = /(?:^|[\s.])(lgtmi|lgtm)\s*(?:[^\p{L}\p{N}_\s])?\s*$/iu;
+            const approvalMatch = commentBody.match(approvalAtStartPattern) ?? commentBody.match(approvalAtEndPattern);
+
+            if (!approvalMatch) {
+              console.log('Comment does not start or end with lgtm or lgtmi');
+              core.setOutput('status', 'skipped');
+              return;
+            }
+
+            const targetCapability = approvalMatch[1].toLowerCase() === 'lgtmi' ? 'issue' : 'pr';
+
+            try {
+              const { data: permissionLevel } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: commenter,
+              });
+
+              if (!['admin', 'maintain', 'write'].includes(permissionLevel.permission)) {
+                console.log(`${commenter} does not have write access`);
+                core.setOutput('status', 'skipped');
+                return;
+              }
+            } catch {
+              console.log(`${commenter} does not have collaborator access`);
+              core.setOutput('status', 'skipped');
+              return;
+            }
+
+            function parseMentionedUsers(body) {
+              const users = [];
+              const seenUsers = new Set();
+              const mentionPattern = /(^|[^A-Za-z0-9_])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?)(?![A-Za-z0-9-]|\/)/g;
+
+              for (const match of body.matchAll(mentionPattern)) {
+                const username = match[2];
+                const normalizedUser = username.toLowerCase();
+                if (seenUsers.has(normalizedUser)) {
+                  continue;
+                }
+                seenUsers.add(normalizedUser);
+                users.push(username);
+              }
+
+              return users;
+            }
+
+            function parseApprovedUsers(content) {
+              const lines = content.split('\n');
+              const entries = [];
+              const users = new Map();
+
+              for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed || trimmed.startsWith('#')) {
+                  entries.push({ type: 'other', line });
+                  continue;
+                }
+
+                const parts = trimmed.split(/\s+/);
+                if (parts.length !== 2) {
+                  console.log(`Skipping malformed line: ${line}`);
+                  entries.push({ type: 'other', line });
+                  continue;
+                }
+
+                const [username, capability] = parts;
+                const normalizedCapability = capability.toLowerCase();
+                if (!VALID_CAPABILITIES.has(normalizedCapability)) {
+                  console.log(`Skipping line with invalid capability: ${line}`);
+                  entries.push({ type: 'other', line });
+                  continue;
+                }
+
+                const normalizedUser = username.toLowerCase();
+                const entry = { type: 'user', username, normalizedUser, capability: normalizedCapability };
+                entries.push(entry);
+                users.set(normalizedUser, entry);
+              }
+
+              return { entries, users };
+            }
+
+            function stringifyApprovedUsers(entries) {
+              const normalizedEntries = [...entries];
+
+              while (normalizedEntries.length > 0) {
+                const lastEntry = normalizedEntries[normalizedEntries.length - 1];
+                if (lastEntry.type !== 'other' || lastEntry.line.trim() !== '') {
+                  break;
+                }
+                normalizedEntries.pop();
+              }
+
+              return `${normalizedEntries
+                .map((entry) => (entry.type === 'user' ? `${entry.username} ${entry.capability}` : entry.line))
+                .join('\n')}\n`;
+            }
+
+            const content = fs.readFileSync(APPROVED_FILE, 'utf8');
+            const { entries, users } = parseApprovedUsers(content);
+            const mentionedUsers = parseMentionedUsers(commentBody);
+            const approvalTargets = mentionedUsers.length > 0 ? mentionedUsers : [issueAuthor];
+            const changedTargets = [];
+            const alreadyTargets = [];
+
+            for (const username of approvalTargets) {
+              const normalizedUser = username.toLowerCase();
+              const existingEntry = users.get(normalizedUser);
+              const existingCapability = existingEntry?.capability ?? null;
+
+              if (existingCapability === 'pr' || existingCapability === targetCapability) {
+                alreadyTargets.push(existingEntry?.username ?? username);
+                console.log(`${username} is already approved for ${existingCapability}`);
+                continue;
+              }
+
+              if (existingEntry) {
+                existingEntry.capability = targetCapability;
+                changedTargets.push(existingEntry.username);
+              } else {
+                const entry = { type: 'user', username, normalizedUser, capability: targetCapability };
+                entries.push(entry);
+                users.set(normalizedUser, entry);
+                changedTargets.push(username);
+              }
+
+              console.log(`Set ${username} capability to ${targetCapability}`);
+            }
+
+            core.setOutput('capability', targetCapability);
+            core.setOutput('changed_targets', JSON.stringify(changedTargets));
+            core.setOutput('already_targets', JSON.stringify(alreadyTargets));
+
+            if (changedTargets.length === 0) {
+              core.setOutput('status', 'already');
+              return;
+            }
+
+            fs.writeFileSync(APPROVED_FILE, stringifyApprovedUsers(entries));
+            core.setOutput('status', 'changed');
+
+      - name: Commit and push
+        if: steps.update.outputs.status == 'changed'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/APPROVED_CONTRIBUTORS
+          git diff --staged --quiet || git commit -m "chore: approve contributors from issue #${{ github.event.issue.number }}"
+          # main may have moved since checkout; replay the approval on top of it.
+          git pull --rebase origin "${{ github.event.repository.default_branch }}"
+          git push
+
+      - name: Comment on issue
+        if: steps.update.outputs.status == 'changed' || steps.update.outputs.status == 'already'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          CAPABILITY: ${{ steps.update.outputs.capability }}
+          CHANGED_TARGETS: ${{ steps.update.outputs.changed_targets }}
+          ALREADY_TARGETS: ${{ steps.update.outputs.already_targets }}
+        with:
+          script: |
+            const capability = process.env.CAPABILITY;
+            const changedTargets = JSON.parse(process.env.CHANGED_TARGETS || '[]');
+            const alreadyTargets = JSON.parse(process.env.ALREADY_TARGETS || '[]');
+            const defaultBranch = context.payload.repository.default_branch;
+            const formatTargets = (targets) => targets.map((target) => `@${target}`).join(', ');
+            const bodyLines = [];
+
+            if (changedTargets.length > 0) {
+              if (capability === 'issue') {
+                bodyLines.push(`${formatTargets(changedTargets)} approved for issues. Future issues will not be auto-closed. PRs still require \`lgtm\` at the start of a maintainer reply (optionally after one or more \`@username\` mentions) or at the end.`);
+              } else {
+                bodyLines.push(`${formatTargets(changedTargets)} approved for issues and PRs. Future issues and PRs will not be auto-closed.`);
+              }
+            }
+
+            if (alreadyTargets.length > 0) {
+              const verb = alreadyTargets.length === 1 ? 'is' : 'are';
+              bodyLines.push(`${formatTargets(alreadyTargets)} ${verb} already approved.`);
+            }
+
+            bodyLines.push('', `See [CONTRIBUTING.md](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${defaultBranch}/CONTRIBUTING.md).`);
+            const body = bodyLines.join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body,
+            });
+

.github/workflows/checks.yml

@@ -20,6 +20,7 @@ jobs:
         run: sudo apt-get update -qq && sudo apt-get install -y -qq zsh
       - name: Script syntax
         run: |
+          sh -n ui/local-bin/ssh
           for f in scripts/*.sh frame/*/*.sh; do
             case "$(head -n 1 "$f")" in
               *zsh*) zsh -n "$f" ;;
@@ -27,8 +28,60 @@ jobs:
             esac
           done
       - name: Python compiles
-        run: python -m py_compile ui/*.py apk-catalog/*.py frame/android/*.py
+        run: |
+          python -m py_compile ui/*.py apk-catalog/*.py frame/android/*.py ios/scripts/*.py
+          # Valve's devkit-utils (vendored; run by the Frame's python3). Most have no .py suffix.
+          python -m py_compile $(find frame/devkit-utils -type f ! -name '*.*' ! -name LICENSE) frame/devkit-utils/devkit_utils/*.py
       - name: Server tests
         run: python -m unittest discover -s tests -v
       - name: App syntax
-        run: node --check app/main.js && node --check app/build/make-icon.js
+        run: node --check app/main.js && node --check app/build/make-icon.js && node --check app/build/fetch-deps.js && node --check app/preload.js && node --check app/install-link.js
+      - name: Website
+        run: node --test site/test/*.test.mjs && node --check site/public/js/site.js && node --check site/public/js/feedback.js
+
+  # The server runs on each desktop OS the app ships for, on the Python version
+  # the app bundles (app/build/fetch-deps.js) and, on Ubuntu, a newer one.
+  server-tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            python: "3.12"
+          - os: macos-latest
+            python: "3.12"
+          - os: ubuntu-latest
+            python: "3.13"
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Server tests
+        run: python -m unittest discover -s tests -v
+
+  # The iPhone app: builds for the Simulator and runs its unit tests.
+  ios:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate the project
+        run: brew install xcodegen && cd ios && xcodegen generate
+      - name: Build and test
+        run: |
+          cd ios
+          udid=$(xcrun simctl list devices available -j | python3 -c 'import json,sys; d=json.load(sys.stdin)["devices"]; print(next(x["udid"] for r in d for x in d[r] if x["name"].startswith("iPhone")))')
+          xcodebuild -project FrameControl.xcodeproj -scheme FrameControl -destination "platform=iOS Simulator,id=$udid" CODE_SIGNING_ALLOWED=NO test
+
+  # End-to-end tests against the fake Frame (tests/fakeframe): Arch Linux ARM
+  # in Docker, on a native arm64 runner like the headset. See docs/testing.md.
+  e2e:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install zsh
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq zsh
+      - name: End-to-end tests
+        run: scripts/e2e.sh

.github/workflows/issue-gate.yml

@@ -0,0 +1,134 @@
+# Contributor gate adapted from badlogic/pi-mono (MIT) at 6f7551516b84.
+# See CONTRIBUTING.md for how it works.
+
+name: Issue Gate
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  check-contributor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Check issue author
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS';
+            const VALID_CAPABILITIES = new Set(['issue', 'pr']);
+            const TRUSTED_BOT_AUTHORS = new Set(['dependabot[bot]', 'sentry[bot]', 'claude[bot]']);
+            const issueAuthor = context.payload.issue.user.login;
+            const defaultBranch = context.payload.repository.default_branch;
+            const isBotAuthor = issueAuthor.endsWith('[bot]');
+
+            if (TRUSTED_BOT_AUTHORS.has(issueAuthor)) {
+              console.log(`Skipping trusted bot: ${issueAuthor}`);
+              return;
+            }
+
+            async function getPermission(username) {
+              try {
+                const { data: permissionLevel } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username,
+                });
+                return permissionLevel.permission;
+              } catch {
+                return null;
+              }
+            }
+
+            async function getTextFile(path) {
+              const { data: fileContent } = await github.rest.repos.getContent({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                path,
+                ref: defaultBranch,
+              });
+
+              if (!('content' in fileContent) || typeof fileContent.content !== 'string') {
+                throw new Error(`Expected file content for ${path}`);
+              }
+
+              return Buffer.from(fileContent.content, 'base64').toString('utf8');
+            }
+
+            function parseApprovedUsers(content) {
+              const users = new Map();
+
+              for (const rawLine of content.split('\n')) {
+                const line = rawLine.trim();
+                if (!line || line.startsWith('#')) continue;
+
+                const parts = line.split(/\s+/);
+                if (parts.length !== 2) {
+                  console.log(`Skipping malformed line: ${rawLine}`);
+                  continue;
+                }
+
+                const [username, capability] = parts;
+                const normalizedCapability = capability.toLowerCase();
+                if (!VALID_CAPABILITIES.has(normalizedCapability)) {
+                  console.log(`Skipping line with invalid capability: ${rawLine}`);
+                  continue;
+                }
+
+                users.set(username.toLowerCase(), normalizedCapability);
+              }
+
+              return users;
+            }
+
+            const permission = await getPermission(issueAuthor);
+            if (!isBotAuthor && ['admin', 'maintain', 'write'].includes(permission)) {
+              console.log(`${issueAuthor} is a collaborator with ${permission} access`);
+              return;
+            }
+
+            const approvedContent = await getTextFile(APPROVED_FILE);
+            const approvedUsers = parseApprovedUsers(approvedContent);
+            const capability = approvedUsers.get(issueAuthor.toLowerCase());
+
+            if (!isBotAuthor && (capability === 'issue' || capability === 'pr')) {
+              console.log(`${issueAuthor} is approved for ${capability}`);
+              return;
+            }
+
+            const message = [
+              'This issue was auto-closed. All issues from new contributors are auto-closed by default.',
+              '',
+              `Maintainers review auto-closed issues regularly and reopen worthwhile ones. Issues that do not meet the quality bar in [CONTRIBUTING.md](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${defaultBranch}/CONTRIBUTING.md) will not be reopened or receive a reply.`,
+              '',
+              'Just want to report a bug or share an idea? The [website feedback form](https://frame-control.pages.dev/feedback/) skips this queue.',
+              '',
+              'If a maintainer replies `lgtmi` on one of your issues, your future issues will stay open. If a maintainer replies `lgtm`, your future issues and PRs will stay open. The command must be at the start of the reply (optionally after one or more `@username` mentions) or at the end.',
+              '',
+              `See [CONTRIBUTING.md](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${defaultBranch}/CONTRIBUTING.md).`,
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: message,
+            });
+
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['untriaged'],
+            });
+
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: 'closed',
+              state_reason: 'not_planned',
+            });

.github/workflows/issue-triage-labels.yml

@@ -0,0 +1,145 @@
+# Contributor gate adapted from badlogic/pi-mono (MIT) at 6f7551516b84.
+# See CONTRIBUTING.md for how it works.
+
+name: Issue Triage Labels
+
+on:
+  issues:
+    types: [reopened, labeled]
+
+jobs:
+  update-labels:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Update triage labels
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const UNTRIAGED_LABEL = 'untriaged';
+            const NO_ACTION_LABEL = 'no-action';
+            const LAST_READ_LABEL = 'last-read';
+            const TO_DISCUSS_LABEL = 'to-discuss';
+            const INPROGRESS_LABEL = 'inprogress';
+
+            function issueHasLabel(issue, labelName) {
+              return (issue.labels ?? []).some((label) => label.name === labelName);
+            }
+
+            async function removeLabelIfPresent(issueNumber, issue, labelName) {
+              if (!issueHasLabel(issue, labelName)) {
+                console.log(`Issue #${issueNumber} does not have ${labelName}`);
+                return;
+              }
+
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                  name: labelName,
+                });
+                console.log(`Removed ${labelName} from #${issueNumber}`);
+              } catch (error) {
+                if (error.status === 404) {
+                  console.log(`Label ${labelName} was already absent from #${issueNumber}`);
+                  return;
+                }
+                throw error;
+              }
+            }
+
+            if (context.payload.action === 'reopened') {
+              await removeLabelIfPresent(context.issue.number, context.payload.issue, UNTRIAGED_LABEL);
+              await removeLabelIfPresent(context.issue.number, context.payload.issue, NO_ACTION_LABEL);
+              return;
+            }
+
+            if (context.payload.action === 'labeled' && context.payload.label?.name === NO_ACTION_LABEL) {
+              await removeLabelIfPresent(context.issue.number, context.payload.issue, UNTRIAGED_LABEL);
+              return;
+            }
+
+            if (context.payload.action !== 'labeled' || context.payload.label?.name !== LAST_READ_LABEL) {
+              console.log('Not a last-read label event');
+              return;
+            }
+
+            const currentIssueNumber = context.issue.number;
+            const lastReadIssues = await github.paginate(github.rest.issues.listForRepo, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'all',
+              labels: LAST_READ_LABEL,
+              per_page: 100,
+            });
+
+            const previousIssueNumbers = lastReadIssues
+              .filter((issue) => !issue.pull_request)
+              .map((issue) => issue.number)
+              .filter((issueNumber) => issueNumber !== currentIssueNumber);
+
+            if (previousIssueNumbers.length === 0) {
+              console.log('No previous last-read issue found');
+              return;
+            }
+
+            const previousIssueNumber = Math.max(...previousIssueNumbers);
+            if (currentIssueNumber <= previousIssueNumber) {
+              console.log(
+                `Last-read was added to old issue #${currentIssueNumber}; latest last-read is #${previousIssueNumber}`,
+              );
+              return;
+            }
+
+            const untriagedIssues = await github.paginate(github.rest.issues.listForRepo, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'all',
+              labels: UNTRIAGED_LABEL,
+              per_page: 100,
+            });
+
+            const issuesToMark = untriagedIssues
+              .filter((issue) => !issue.pull_request)
+              .filter((issue) => issue.number >= previousIssueNumber && issue.number <= currentIssueNumber)
+              .sort((a, b) => a.number - b.number);
+
+            if (issuesToMark.length === 0) {
+              console.log(`No untriaged issues found from #${previousIssueNumber} to #${currentIssueNumber}`);
+              return;
+            }
+
+            for (const issue of issuesToMark) {
+              if (issueHasLabel(issue, TO_DISCUSS_LABEL)) {
+                console.log(`Skipped ${NO_ACTION_LABEL} for #${issue.number} because it has ${TO_DISCUSS_LABEL}`);
+              } else {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  labels: [NO_ACTION_LABEL],
+                });
+                console.log(`Added ${NO_ACTION_LABEL} to #${issue.number}`);
+              }
+
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: 'closed',
+                state_reason: 'not_planned',
+              });
+              console.log(`Closed #${issue.number} as not planned`);
+
+              await removeLabelIfPresent(issue.number, issue, INPROGRESS_LABEL);
+
+              await github.rest.issues.removeLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                name: UNTRIAGED_LABEL,
+              });
+              console.log(`Removed ${UNTRIAGED_LABEL} from #${issue.number}`);
+            }

.github/workflows/pr-gate.yml

@@ -0,0 +1,131 @@
+# Contributor gate adapted from badlogic/pi-mono (MIT) at 6f7551516b84.
+# See CONTRIBUTING.md for how it works.
+
+name: PR Gate
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  check-contributor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Check if contributor is approved
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS';
+            const VALID_CAPABILITIES = new Set(['issue', 'pr']);
+            const TRUSTED_BOT_AUTHORS = new Set(['dependabot[bot]', 'sentry[bot]', 'claude[bot]']);
+            const prAuthor = context.payload.pull_request.user.login;
+            const defaultBranch = context.payload.repository.default_branch;
+            const isBotAuthor = prAuthor.endsWith('[bot]');
+
+            if (TRUSTED_BOT_AUTHORS.has(prAuthor)) {
+              console.log(`Skipping trusted bot: ${prAuthor}`);
+              return;
+            }
+
+            async function getPermission(username) {
+              try {
+                const { data: permissionLevel } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username,
+                });
+                return permissionLevel.permission;
+              } catch {
+                return null;
+              }
+            }
+
+            async function getTextFile(path) {
+              const { data: fileContent } = await github.rest.repos.getContent({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                path,
+                ref: defaultBranch,
+              });
+
+              if (!('content' in fileContent) || typeof fileContent.content !== 'string') {
+                throw new Error(`Expected file content for ${path}`);
+              }
+
+              return Buffer.from(fileContent.content, 'base64').toString('utf8');
+            }
+
+            function parseApprovedUsers(content) {
+              const users = new Map();
+
+              for (const rawLine of content.split('\n')) {
+                const line = rawLine.trim();
+                if (!line || line.startsWith('#')) continue;
+
+                const parts = line.split(/\s+/);
+                if (parts.length !== 2) {
+                  console.log(`Skipping malformed line: ${rawLine}`);
+                  continue;
+                }
+
+                const [username, capability] = parts;
+                const normalizedCapability = capability.toLowerCase();
+                if (!VALID_CAPABILITIES.has(normalizedCapability)) {
+                  console.log(`Skipping line with invalid capability: ${rawLine}`);
+                  continue;
+                }
+
+                users.set(username.toLowerCase(), normalizedCapability);
+              }
+
+              return users;
+            }
+
+            async function closePullRequest(message) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: message,
+              });
+
+              await github.rest.pulls.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number,
+                state: 'closed',
+              });
+            }
+
+            const permission = await getPermission(prAuthor);
+            if (!isBotAuthor && ['admin', 'maintain', 'write'].includes(permission)) {
+              console.log(`${prAuthor} is a collaborator with ${permission} access`);
+              return;
+            }
+
+            const approvedContent = await getTextFile(APPROVED_FILE);
+            const approvedUsers = parseApprovedUsers(approvedContent);
+            const capability = approvedUsers.get(prAuthor.toLowerCase());
+
+            if (!isBotAuthor && capability === 'pr') {
+              console.log(`${prAuthor} is approved for PRs`);
+              return;
+            }
+
+            console.log(`${prAuthor} is not approved, closing PR`);
+
+            const message = [
+              'This PR was auto-closed. Only contributors approved with `lgtm` can open PRs. Open an issue first and ask a maintainer for approval.',
+              '',
+              `Maintainers review auto-closed issues regularly. Issues that do not meet the quality bar in [CONTRIBUTING.md](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${defaultBranch}/CONTRIBUTING.md) will not be reopened or receive a reply.`,
+              '',
+              'If a maintainer replies `lgtmi`, your future issues will stay open. If a maintainer replies `lgtm`, your future issues and PRs will stay open. The command must be at the start of the reply (optionally after one or more `@username` mentions) or at the end.',
+              '',
+              `See [CONTRIBUTING.md](https://github.com/${context.repo.owner}/${context.repo.repo}/blob/${defaultBranch}/CONTRIBUTING.md).`,
+            ].join('\n');
+
+            await closePullRequest(message);

.github/workflows/release.yml

@@ -0,0 +1,61 @@
+name: release
+
+# Pushing a v* tag builds Frame Control for macOS, Windows and Linux and attaches
+# the installers to that tag's GitHub release (created as a draft if missing).
+# Pull requests that touch the app build the same installers as artifacts.
+on:
+  push:
+    tags: ["v*"]
+  pull_request:
+    paths: ["app/**", "ui/**", "scripts/**", "frame/**", "apk-catalog/**", ".github/workflows/release.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            script: dist
+            files: app/dist/*.dmg app/dist/*.zip
+          - os: windows-latest
+            script: dist:win
+            files: app/dist/*.exe app/dist/*.zip
+          - os: ubuntu-latest
+            script: dist:linux
+            files: app/dist/*.AppImage app/dist/*.deb
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+      - name: Build
+        working-directory: app
+        shell: bash
+        run: npm ci && npm run ${{ matrix.script }}
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: "false"
+      - name: Upload to the release
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          gh release view "$tag" >/dev/null 2>&1 || gh release create "$tag" --draft --title "Frame Control ${tag#v}" --notes ""
+          gh release upload "$tag" ${{ matrix.files }} --clobber
+      - uses: actions/upload-artifact@v4
+        with:
+          name: frame-control-${{ matrix.os }}
+          path: |
+            app/dist/*.dmg
+            app/dist/*.exe
+            app/dist/*.zip
+            app/dist/*.AppImage
+            app/dist/*.deb
+          if-no-files-found: ignore

.github/workflows/remove-inprogress-on-close.yml

@@ -0,0 +1,34 @@
+# Contributor gate adapted from badlogic/pi-mono (MIT) at 6f7551516b84.
+# See CONTRIBUTING.md for how it works.
+
+name: Remove In Progress Label On Close
+
+on:
+  issues:
+    types: [closed]
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Remove inprogress label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const labelName = 'inprogress';
+            const labels = context.payload.issue.labels ?? [];
+            const hasLabel = labels.some((label) => label.name === labelName);
+
+            if (!hasLabel) {
+              console.log(`Issue does not have ${labelName} label`);
+              return;
+            }
+
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              name: labelName,
+            });

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 __pycache__/
 apk-catalog/data/cache/
-apk-catalog/data/index-v2.json*
+apk-catalog/data/index-v2*.json*
 compat-db/.env.lakebed.server
 compat-db/.lakebed/
+tests/smoke/results/

CONTRIBUTING.md

@@ -0,0 +1,71 @@
+# Contributing to Frame Control
+
+This guide exists to save both sides time. The process is borrowed from
+[pi](https://github.com/badlogic/pi-mono/blob/main/CONTRIBUTING.md).
+
+## Just want to report something?
+
+Use the [feedback form](https://frame-control.pages.dev/feedback/). It needs no
+GitHub account, and what you send becomes an issue here that stays open.
+
+## The One Rule
+
+**You must understand your code.** If you can't explain what your change does
+and how it interacts with the rest of the app, your PR will be closed.
+
+Using AI to write code is fine. Submitting AI-generated slop you don't
+understand is not.
+
+## Contribution gate
+
+Issues and PRs opened on GitHub by new contributors are auto-closed by default.
+A maintainer reviews auto-closed issues regularly and reopens worthwhile ones.
+Issues that don't meet the quality bar below won't be reopened or get a reply.
+
+Approval happens through maintainer replies on issues:
+
+- `lgtmi`: your future issues won't be auto-closed
+- `lgtm`: your future issues and PRs won't be auto-closed
+
+The word must be at the start of the reply (optionally after one or more
+`@username` mentions) or at the end. Only `lgtm` lets you open PRs. Approved
+people are listed in [`.github/APPROVED_CONTRIBUTORS`](.github/APPROVED_CONTRIBUTORS).
+
+## Quality bar for issues
+
+Use one of the issue templates, and keep it short, concrete and worth reading.
+
+- If it doesn't fit on one screen, it's too long.
+- Write in your own voice. If you must use an LLM, say so in a clearly labelled
+  follow-up comment.
+- State the bug or request clearly, and why it matters.
+- For bugs, include your OS, your SteamOS build (Steam Settings → System), and
+  the server log (**Frame → Show Server Log** in the app).
+- If you want to implement the change yourself, say so.
+
+## Before opening a PR
+
+Don't open a PR until a maintainer has approved you with `lgtm`. Open an
+[idea or contribution proposal](https://github.com/saphid/frame-control/issues/new?template=idea.yml)
+first.
+
+Then check your change:
+
+```sh
+python3 -m unittest discover -s tests   # server tests; no headset needed
+node --test site/test/*.test.mjs        # website feedback function
+```
+
+Say what you tested, and whether you tried it on a real Steam Frame.
+
+## Blocking
+
+If you ignore this document twice, or spam the tracker with agent-generated
+issues, your GitHub account will be blocked from the repo.
+
+## Why auto-close?
+
+This is a hobby project with one maintainer. Auto-closing is a buffer against
+burnout and tracker spam: issues get reviewed on the maintainer's schedule, and
+the good ones are reopened. Short, concrete, reproducible reports and thoughtful
+contributions are welcome.

README.md

@@ -1,253 +1,214 @@
-# Steam Frame ↔ Mac
+<div align="center">
 
-**Frame Control** is a Mac app for managing a Valve Steam Frame (standalone VR
-headset: SteamOS 3, Arch-based, arm64, Snapdragon 8 Gen 3) over SSH: live
-headset view, battery and status, your Steam library, Android (Lepton) apps,
-file and clipboard transfer. This repo also holds the scripts behind it and
-field notes on how the Frame's software works, all aimed at as little typing
-on the headset's virtual keyboard as possible.
+<img src="docs/img/icon.png" width="112" alt="Frame Control icon">
 
-It's an unofficial hobby project, not affiliated with Valve.
+# Frame Control
 
-Status: written 2026-09-25 and checked against a real Frame the same day
-(SteamOS 0.3.0, variant `vr`, build 20260922). The **Frame Control** Mac app
-and most scripts are **verified** on the device. The scripts table below marks
-each one, and [docs/open-questions.md](docs/open-questions.md#verified-on-device-2026-09-25)
-lists what's still unchecked.
+**Manage your Valve Steam Frame from your computer.**<br>
+See what the headset sees, install games and Android apps, move files and text across, and check battery and status, all over SSH.
 
-## Trying it out
+[![Latest release](https://img.shields.io/github/v/release/saphid/steam-frame?label=release&color=1a9fff)](https://github.com/saphid/steam-frame/releases/latest)
+[![Platforms](https://img.shields.io/badge/macOS%20%7C%20Windows%20%7C%20Linux-2a475e?label=runs%20on)](#install)
+[![Checks](https://img.shields.io/github/actions/workflow/status/saphid/steam-frame/checks.yml?branch=main&label=checks)](https://github.com/saphid/steam-frame/actions/workflows/checks.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-66c0f4)](LICENSE)
 
-You need:
+[**Website**](https://frame-control.pages.dev) · [**Download**](#install) · [Trailer](#trailer) · [Features](#features) · [Set up the headset](#set-up-the-headset) · [Feedback](#feedback) · [Docs](#going-further)
 
-- A Steam Frame with **Developer Mode** on (next section; it's a toggle).
-- A Mac with Apple Silicon (M1 or later). Tested on macOS 26. There's no Intel
-  build.
-- `python3` on the Mac (`xcode-select --install` provides it).
-- Optional: `adb` for Android apps (`brew install android-platform-tools`).
+<br>
 
-Steps:
+<img src="docs/img/frame-control.png" alt="Frame Control's Games tab: installed games, sideloaded titles, and your Steam library with Frame ratings" width="900">
 
-1. Download the DMG from the
-   [latest release](https://github.com/saphid/steam-frame/releases/latest),
-   open it and drag **Frame Control** to Applications.
-2. The app isn't notarized (no paid Apple developer account), so macOS will
-   say it's damaged or can't be checked. Clear the download quarantine once:
-   ```sh
-   xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
-   ```
-3. Open it. With no `frame` SSH alias yet, it offers to run the connection
-   setup in Terminal. That asks for the Developer Mode password once, then
-   uses a key from then on.
+<a id="trailer"></a>
+<a href="https://github.com/saphid/steam-frame/releases/download/trailer/frame-control-trailer.mp4"><img src="docs/img/trailer.jpg" alt="Watch the Frame Control trailer" width="900"></a>
 
-**Feedback:** please open a
-[GitHub issue](https://github.com/saphid/steam-frame/issues) with what you
-tried, your SteamOS build (Steam Settings → System) and the server log
-(**Frame → Show Server Log**, at `~/Library/Logs/Frame Control/server.log`).
-Features are marked **verified** or not below; the unverified ones are the
-most useful to hear about.
+<sub>The trailer: 66 seconds, with sound. Downloads the MP4 from the trailer release.</sub>
 
-**What it changes on your Frame:** only what you click. Installs go to your
-user account (`--user` Flatpaks, Lepton instances, Steam downloads), and
-nothing needs `sudo` except the power buttons. On the Mac it adds a `Host
-frame` entry to `~/.ssh/config` and a key at `~/.ssh/id_ed25519_frame`.
+<sub>Unofficial hobby project, not affiliated with Valve. Free and open source.</sub>
 
-## Minimum typing on the headset
+</div>
 
-Valve's own developer docs say SSH, ADB, and RDP are all turned on through a
-**UI toggle**. You don't need a terminal, `passwd`, or `systemctl`. The only
-thing you type on the headset is a password you choose.
+---
 
-On the Frame:
+## Features
 
-1. **Steam Settings → System → Enable Developer Mode** (a toggle, no typing).
-2. Scroll down to the **Developer** section and click **Set User Password**.
-   Type a password. **This is the only thing you type on the headset.** Pick
-   something short, because you'll type it once more on the Mac and then
-   never again.
-3. (Optional, no typing) Note the IP address from **Quick Settings** or
-   **Steam Settings → Internet**, in case `frame.local` doesn't resolve.
-4. (Optional) Check **Steam Settings → System → Hostname**. Leaving it as
-   `frame` means the scripts work without any extra setup.
+<table>
+<tr>
+<td width="50%" valign="top">
 
-On the Mac:
+**👓 Headset view**<br>
+Live video of what the lenses show (about 30 fps), or a still of both eyes. Zoom, pan, full screen, save as PNG.
 
-To use the scripts from a checkout instead of the app:
+</td>
+<td width="50%" valign="top">
 
-```sh
-git clone https://github.com/saphid/steam-frame.git && cd steam-frame
-./scripts/connect.sh              # or: ./scripts/connect.sh 192.168.1.50
-ssh frame                          # passwordless from now on
-```
+**🔋 Battery and status**<br>
+Charge, charging watts and time left, storage, memory, temperature, Wi-Fi, and what's running.
 
-`connect.sh` does four things:
+</td>
+</tr>
+<tr>
+<td valign="top">
 
-- finds the headset (`frame.local`, then `frame`, or the IP/host you pass in)
-- creates a dedicated key (`~/.ssh/id_ed25519_frame`)
-- adds a `Host frame` block to `~/.ssh/config`
-- runs `ssh-copy-id`, which asks for the Developer Mode password once
+**🎮 Steam games**<br>
+Everything you own with its Steam Frame rating. Install onto the headset with live progress, and search the store.
 
-Run `./scripts/connect.sh --harden` later if you want to turn off SSH password
-logins.
+</td>
+<td valign="top">
 
-Sources: [Valve: Setting up your Steam Frame for development](https://partner.steamgames.com/doc/steamhardware/steamframe/setup),
-[Valve: Steam Frame Debugging](https://partner.steamgames.com/doc/steamhardware/steamframe/debugging)
-(both **confirmed on Steam Frame**, Valve official).
+**🤖 Android apps**<br>
+About 4,500 F-Droid apps rated for the Frame. One click installs each as its own app in your Steam library.
 
-**Fallback, only if the Developer Mode toggle doesn't give you SSH.** From the
-Mac, run `./scripts/serve-bootstrap.sh`. It prints a one-liner of about 30
-characters, like `curl -fsS mac.local:8765|bash`, to type into Konsole on the
-Frame's Linux desktop. The script it serves installs your Mac's public key and
-enables `sshd`. See [docs/ssh.md](docs/ssh.md#fallback-bootstrap-one-liner).
+</td>
+</tr>
+<tr>
+<td valign="top">
 
-## Recommended options
+**📁 Files, games and clipboard**<br>
+Drag files onto the window to send them. Drop a game's .zip, folder or .exe to add it to the Steam library, with Proton or the Linux runtime picked for you. Send text or your clipboard straight to the headset's desktop.
 
-| Goal | Recommended | Confidence |
+</td>
+<td valign="top">
+
+**📸 Screenshots**<br>
+Browse the shots you take in the headset and save them to your Pictures folder.
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+**🧩 Flatpaks and display**<br>
+Install desktop apps like Moonlight or VLC, and set each Android app's resolution and text size.
+
+</td>
+<td valign="top">
+
+**⚡ One-click tools**<br>
+SSH, SFTP, Steam Link, remote desktop, volume, sleep, restart and shut down.
+
+</td>
+</tr>
+</table>
+
+Nothing is installed on the Frame for any of this: the app uses what SteamOS
+already ships (sideloading a game copies Valve's own devkit scripts to
+`~/devkit-utils`, as Valve's Devkit Client does). [How each feature works](docs/frame-control.md).
+
+## Install
+
+| | Download | Needs |
 |---|---|---|
-| Shell on the Frame | `ssh frame` (user `steamos`) | Confirmed (Valve docs) |
-| **See/control the Frame from the Mac** | **Steam Link for macOS → connect to `frame`** (Valve names this). Alternatives: RDP to `xrdp` with Microsoft *Windows App* for the Linux desktop, or `adb`/`scrcpy` for the Android (Lepton) layer only | Steam Link and xrdp confirmed on Frame; the Mac RDP client is inferred |
-| **Show the Mac's desktop inside the Frame** | **macOS Screen Sharing (built-in VNC) → Remmina (Flatpak, aarch64) on the Frame's Linux desktop**, installed over SSH | Inferred: each piece is documented, but the combination hasn't been tested on a Frame |
-| File transfer | `scp` / `rsync` over the `frame` alias (`scripts/push.sh`) | **Verified** (rsync is on the image) |
-| Paste Mac clipboard into the headset | `scripts/paste-to-frame.sh` (`pbpaste` → `ssh` → Klipper over D-Bus), or the clipboard sync in an RDP session | **Verified** (script); RDP untested |
+| **macOS** (Apple Silicon) | [Frame-Control-mac-arm64.dmg](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-mac-arm64.dmg) | Nothing extra |
+| **Windows** 10 / 11 (x64) | [Frame-Control-Setup-x64.exe](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-Setup-x64.exe) · [portable .zip](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-win-x64.zip) | Nothing extra |
+| **Linux** (x64) | [AppImage](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-x86_64.AppImage) · [.deb](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-amd64.deb) | `ssh` (most desktops have it) |
+| **Linux** (arm64) | [AppImage](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-arm64.AppImage) · [.deb](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-arm64.deb) | `ssh`, and `adb` for Android apps (`sudo apt install adb`) |
 
-Details: [docs/ssh.md](docs/ssh.md), [docs/streaming.md](docs/streaming.md),
-[docs/file-transfer.md](docs/file-transfer.md),
-[docs/open-questions.md](docs/open-questions.md). For how the Frame's software
-fits together, see [docs/how-the-frame-works.md](docs/how-the-frame-works.md).
+**iPhone and iPad:** the same features from your phone, with nothing to install on
+a computer. Build it from [`ios/`](ios) in Xcode; see [docs/iphone.md](docs/iphone.md).
 
-## Windows anywhere in the room
+The app brings its own Python and `adb`; SSH is built into macOS and Windows.
+Google doesn't publish `adb` for arm64 Linux, so that build uses your
+distribution's. If you already have `adb`, the app uses yours.
 
-The in-headset Linux desktop is a single 1280×800 panel, and its windows can't
-leave it. Each Steam app, though, gets its own SteamVR panel. That also works
-for any Linux app tagged with an app id of its own:
+<details>
+<summary><b>macOS: the app isn't notarized</b></summary>
+
+There's no paid Apple developer account behind it, so macOS says the app is
+damaged or can't be checked. Drag it to Applications, then clear the download
+quarantine once:
 
 ```sh
-./scripts/panel-on-frame.sh konsole
-./scripts/panel-on-frame.sh mac-screen      # the Mac's screen, in its own panel
+xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
 ```
 
-Then use the SteamVR dashboard's **Float in World**, **Move** and **Size**
-controls to place each panel. See [docs/panels.md](docs/panels.md).
+The first time, macOS also asks to allow local network access (for SSH) and
+control of Terminal (for the password prompts).
+</details>
 
-## Frame Control (Mac app)
+<details>
+<summary><b>Windows: SmartScreen warning</b></summary>
 
-As of 2026-09-25 no other Mac app manages the Frame end to end.
-[Stream Frame](https://streamframe.app/) (macOS 14+, free) records and screenshots
-the headset over SSH. [FrameDrop](https://framedropvr.com) sideloads but is
-Windows-only. Steam Link views the headset. **Frame Control** is a Mac app over
-the scripts below. Install it from the DMG (see [Mac app](#mac-app)), or run
-the same UI in a browser without packaging:
+The installer isn't code-signed, so Windows SmartScreen may say it protected
+your PC. Choose **More info → Run anyway**. The portable `.zip` avoids the
+installer: unzip it anywhere and run `Frame Control.exe`.
+</details>
+
+<details>
+<summary><b>Linux: running the AppImage</b></summary>
 
 ```sh
-./scripts/frame-ui.sh        # opens http://127.0.0.1:47810 in its own window
+chmod +x Frame-Control-linux-*.AppImage && ./Frame-Control-linux-*.AppImage
 ```
 
-![Frame Control](docs/img/frame-control.png)
+If it complains about FUSE, install `libfuse2` (Ubuntu 24.04+: `libfuse2t64`),
+or run it with `--appimage-extract-and-run`.
+</details>
 
-- **Headset view**: what the lenses show, as SteamVR composites it (the room,
-  floating panels, dashboard and controllers). Shows the left eye, like pointing
-  a camera into one lens, or both eyes, as a single shot; saves as PNG. **Live**
-  is 720p video at about 30 fps: `ffmpeg` on the Frame encodes SteamVR's
-  headset-view device (`/dev/video99`) to H.264 over SSH, and the page decodes
-  it with WebCodecs. Live video is one eye; Capture still gets both. The viewer fits the whole frame; zoom with − / + (or scroll, or
-  double-click), drag to pan, `0` to fit, `F` for full screen. Capture uses OpenVR's `IVRScreenshots` API through Python `ctypes`
-  (`ui/frame_vrshot.py`). Nothing extra is installed on the Frame (SteamOS ships `ffmpeg`). **Desktop panel**
-  captures gamescope's flat layer instead.
-- Battery with charging state: charge rate in watts, time to full or empty,
-  charger type and wattage (for example USB-C PD 20 W), and battery temperature
-- Storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR, the desktop,
-  Lepton and xrdp are running
-- Library shelf with Steam cover art and a Play button (`steam://rungameid`)
-- **Get games**: every game you own with its Steam Frame rating (Verified,
-  Playable, Unsupported, Unknown). Install on Frame downloads it to the headset
-  with live progress. Search the Steam store with prices and Frame ratings; Buy
-  opens the store page in your browser, or Store on Frame opens it in the
-  headset. It drives the Frame's own Steam client through its DevTools port;
-  see `docs/steam-games.md`
-- Volume and mute (`wpctl`)
-- **Android apps**: search about 4,500 F-Droid apps rated for the Frame, install
-  one with a click as its own Lepton instance (it keeps its data and shows in the
-  Steam library), then launch, stop, test or remove it. **Report an APK** records whether any APK
-  worked (F-Droid or not: pick a file, type a package, or use an installed app). Your
-  reports are saved on your Mac and change the verdicts you see. They aren't
-  uploaded anywhere: the shared database is maintainer-only for now (see
-  `compat-db/README.md`)
-- **Android display**: pick a running Lepton instance (by the app in it) and set
-  its resolution (Native 1920×1080, or Sharp 2560×1440 with density scaled to
-  match), UI scale (Smaller / Default / Larger, or an exact dpi) and text size
-  (0.85–1.3×) over ADB (`wm size`, `wm density`, `font_scale`). Reset puts all three
-  back. Whether the settings survive the app relaunching is untested
-- Drag and drop files to `~/Downloads`; `.apk` files install as their own Android app
-- Send typed text, or the Mac clipboard, to the Frame clipboard
-- Install and remove Flatpaks (quick picks: Moonlight, Firefox, VLC, Remmina)
-- One-click SSH or SFTP in Terminal, Steam Link, and Windows App (RDP).
-  Sleep, restart and shut down open Terminal because SteamOS asks for the
-  sudo password over SSH.
+## Set up the headset
 
-The server is Python stdlib only and listens on 127.0.0.1. It rejects requests
-with a non-local `Host` header, and any `/api/` request without a custom
-header, so other websites can't drive it or read captures. It keeps a single multiplexed SSH connection open, so
-status and each capture take about 0.3s. Headset captures are deleted from the
-Frame as soon as they're copied, because they show everything on screen,
-including anything private. The look follows the Steam client: its palette,
-Motiva Sans (loaded from Valve's CDN), portrait library capsules and green
-Play buttons. **Verified on the Frame 2026-09-25:** status and charging details,
-both capture modes (headset view while in use, and a blank frame in standby,
-which the UI labels), clipboard, volume, file push, and input validation. **Not yet exercised from the UI:** Launch, Flatpak
-install/remove, APK drop, and the power buttons. Each of these calls a
-command or script that was verified separately.
+You type one password on the headset, once. Everything else happens on your
+computer.
 
-### Mac app
+1. **On the Frame:** Steam Settings → System → **Enable Developer Mode**, then
+   in the Developer section, **Set User Password**. Pick something short:
+   you'll type it once more on your computer and then never again.
+2. **On your computer:** open Frame Control. It offers to **Set Up
+   Connection**, which finds the headset, creates an SSH key, and asks for that
+   password once in a terminal window. If it can't find the Frame, type the
+   IP address from the Frame's Quick Settings.
 
-`app/` wraps the same UI as a standalone Mac app (Electron). The app bundles
-`ui/`, `scripts/`, `frame/android/` and the rated catalogue from `apk-catalog/`.
-It starts `ui/server.py` on a free loopback port and shows it in its own window.
-The server stops when you quit the app. A prebuilt DMG for Apple Silicon is
-attached to each [GitHub release](https://github.com/saphid/steam-frame/releases).
+   Before asking for the password it tries Valve's SteamOS devkit pairing: in
+   the headset, open Steam Settings → Developer → **Pair new host** and approve
+   the request, and no password is needed. (The service and the pairing-mode
+   step are verified on a Frame; the approval itself isn't yet. See
+   [SSH](docs/ssh.md#password-free-pairing-steamos-devkit-service).)
+3. That's it. The app now reaches the headset whenever it's awake and on the
+   same network. For anywhere else, see [Tailscale](docs/tailscale.md).
 
-```sh
-cd app
-npm install
-npm run dist     # → app/dist/Frame Control-<version>-arm64.dmg (and a .zip)
-npm start        # run from the checkout without packaging
-```
+**What it changes:** only what you click. Installs go to your user account on
+the Frame (`--user` Flatpaks, Lepton instances, Steam downloads, sideloaded
+games in `~/devkit-game`), and nothing
+needs `sudo` except the power buttons. On your computer it adds a `Host frame`
+entry to `~/.ssh/config` and keys at `~/.ssh/id_ed25519_frame` and
+`~/.ssh/id_rsa_frame_devkit` (the pairing service only takes RSA keys).
 
-Open the DMG and drag **Frame Control** to Applications. You need `python3` on
-the Mac (Xcode Command Line Tools or Homebrew). The app reads `PATH` from your
-login shell, so Homebrew's `rsync` and `adb` work when you launch it from
-Finder. Each time it starts while there's no `frame` SSH alias, the app offers
-to run `connect.sh` in Terminal. **Frame → Set Up Connection…** does the same
-at any time. The Frame menu also shows the server log at
-`~/Library/Logs/Frame Control/server.log`. Installing APKs needs `adb`
-(`brew install android-platform-tools`). The F-Droid ratings are bundled with the app.
+## Feedback
 
-The build is ad-hoc signed and not notarized. A copy you build yourself opens
-normally. A copy downloaded from GitHub Releases is quarantined; clear it with
-`xattr -dr com.apple.quarantine "/Applications/Frame Control.app"`. The first
-time you use them, macOS asks to allow local network access (for SSH) and
-control of Terminal (for SSH and power actions). **Verified 2026-09-25:**
-installed from the DMG, launched from Finder, connected to the Frame, and
-showed live status and the library.
+This is a first public test, so reports are really useful, especially from
+Windows and Linux. The quickest way is the
+[feedback form](https://frame-control.pages.dev/feedback/): no GitHub account
+needed, and it opens an issue here. Please include:
 
-## Scripts
+- what you tried and what happened
+- your computer's OS and your SteamOS build (Steam Settings → System)
+- the server log: **Frame → Show Server Log** in the app
 
-| Script | Runs on | Purpose |
-|---|---|---|
-| `scripts/tailscale-on-frame.sh` | Mac → Frame | Install Tailscale in `~` as a userspace user service so `frame` works from anywhere; `--uninstall` (**verified** on the LAN) |
-| `scripts/connect.sh` | Mac | Discover, set up key and `~/.ssh/config`, copy key, optional `--harden` (**verified**; `--harden` untested) |
-| `scripts/install-apps.sh` | Mac → Frame | Install Flatpaks (Remmina, Moonlight, …) on the Frame over SSH as `--user` (**verified** with Remmina) |
-| `scripts/paste-to-frame.sh` | Mac → Frame | Send the Mac clipboard (or stdin) to the Frame clipboard (**verified**) |
-| `scripts/install-apk.sh` | Mac → Frame | Install APKs, each as its own persistent Lepton instance with a Steam library shortcut (`--dev`: old ADB path into Lepton Development) (**verified**; see [docs/apks.md](docs/apks.md)) |
-| `scripts/panel-on-frame.sh` | Mac → Frame | Start an app as its own floating VR panel, outside the desktop (**verified**: overlays created; in-headset placement not yet checked) |
-| `scripts/run-on-frame.sh` | Mac → Frame | Start an app on the headset desktop, e.g. `mac-screen` opens Remmina straight into the Mac (**verified**) |
-| `scripts/frame-ui.sh` | Mac | Start the Frame Control web UI (`ui/server.py`) and open it (**verified**) |
-| `scripts/apk-catalog.sh` | Mac | Refresh the rated F-Droid catalogue that Frame Control's Android section shows (**verified**) |
-| `scripts/compat-db-backup.sh` | Mac | Maintainer-only: back up the shared compatibility database locally and to Google Drive (**verified**) |
-| `scripts/push-vr-video.sh` | Mac → Frame | Upload VR180/360 videos to `~/Videos/VR`, linked into DeoVR's Proton prefix; `--launch` starts DeoVR (**verified**: upload and link; in-headset playback of local files not yet checked). See [docs/vr-video.md](docs/vr-video.md) |
-| `scripts/push.sh` | Mac → Frame | `rsync` files to `~/Downloads` (or a given path) on the Frame (**verified**) |
-| `scripts/serve-bootstrap.sh` | Mac | Fallback: serve `bootstrap-on-frame.sh` with your public key embedded |
-| `scripts/bootstrap-on-frame.sh` | Frame | Fallback: install the key and enable `sshd` |
+Issues and PRs opened directly on GitHub by new contributors are auto-closed
+until a maintainer approves them; see [CONTRIBUTING.md](CONTRIBUTING.md).
 
-## Security notes
+## Going further
+
+This repo also holds the scripts behind the app and field notes on how the
+Frame's software fits together, all checked against a real headset and labelled
+**verified** or **inferred**.
+
+| | |
+|---|---|
+| [Frame Control in detail](docs/frame-control.md) | Every feature, how it works, per-platform notes, building |
+| [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
+| [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
+| [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
+| [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
+| [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
+| [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
+| [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
+| [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
+| [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
+| [Testing](docs/testing.md) | Unit tests, end-to-end tests against a fake Frame in Docker, and the headset smoke test |
+| [Open questions](docs/open-questions.md) | What's still unchecked |
+
+<details>
+<summary><b>Security notes</b></summary>
 
 - With Developer Mode on, `sshd`, ADB and xrdp are all reachable on your LAN.
   Each running Lepton (Android) instance opens its own ADB port in 5555–5599,
@@ -256,7 +217,7 @@ showed live status and the library.
   networks only, and turn Developer Mode off when you don't need it.
 - Frame Control reaches ADB and the Steam client's DevTools port (Frame
   loopback `127.0.0.1:8080`) only through SSH tunnels. The compatibility
-  database key lives in the macOS Keychain and is never written to the repo.
+  database key (maintainer-only) is never written to the repo.
 - `steamos` has `sudo`, protected by the same Developer Mode password. Once
   you've switched to key auth, a short password still protects `sudo` and
   RDP, so pick one that isn't trivially guessable.
@@ -264,19 +225,19 @@ showed live status and the library.
   use Tailscale: `scripts/tailscale-on-frame.sh` (no sudo). In its userspace mode
   **every** Frame port is reachable from your tailnet, including Steam's DevTools
   on loopback 8080; see [docs/tailscale.md](docs/tailscale.md).
+</details>
 
 ## Development
 
 ```sh
-python3 -m unittest discover -s tests   # server guards, validation, Steam helpers; no headset needed
-cd app && npm install && npm run dist   # build the DMG
+python3 -m unittest discover -s tests   # server tests; no headset needed
+scripts/e2e.sh                          # end-to-end against a fake Frame (Linux with Docker)
+cd app && npm install && npm start      # run the app from the checkout
 ```
 
-GitHub Actions runs the tests on Python 3.9, which is the oldest `python3` the app
-may find (Xcode Command Line Tools), plus syntax checks for every script and the
-Electron main process (`.github/workflows/checks.yml`). Anything that touches the
-headset is verified by hand against a real Frame, and the docs label it
-**verified** or **inferred**.
+The server is Python stdlib only; the app is Electron. GitHub Actions runs the
+tests on macOS, Windows and Linux, and a `v*` tag builds all three installers
+into the release. See [building](docs/frame-control.md#building).
 
 ## License
 

app/.gitignore

@@ -1,2 +1,3 @@
 node_modules/
 dist/
+build/deps/

app/build/fetch-deps.js

@@ -0,0 +1,134 @@
+// Downloads what the app bundles so users install nothing else: a standalone
+// Python (python-build-standalone), adb (Android platform-tools) and a CA
+// bundle. Each goes in build/deps/<os>-<arch>/{python,tools}, which package.json
+// copies into the app's resources. Everything is pinned by version and SHA-256.
+//   node build/fetch-deps.js mac arm64 | win x64 | linux x64 arm64
+const crypto = require("crypto");
+const fs = require("fs");
+const https = require("https");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+const PY = "3.12.14+20260924";
+const PY_URL = (triple) => "https://github.com/astral-sh/python-build-standalone/releases/download/"
+  + `${PY.split("+")[1]}/cpython-${PY}-${triple}-install_only_stripped.tar.gz`;
+const PYTHON = {
+  "mac-arm64": ["aarch64-apple-darwin", "c2edb321cd32ec2b170df208db0446dccc4398db602ca27cf2079098fb1f7d9d"],
+  "win-x64": ["x86_64-pc-windows-msvc", "c5bf8edfe858c1df9891be498b5bbc8761d383df5b9790658b088fea4870433a"],
+  "linux-x64": ["x86_64-unknown-linux-gnu", "269b2c99e4db15b242bf01832f4fea1e8f1a664f273cff519393f296e9820b41"],
+  "linux-arm64": ["aarch64-unknown-linux-gnu", "c8499b61252c433280f134df954464d19811527b31cb920c35fc6967c1222e35"],
+};
+
+// Google publishes no arm64 Linux platform-tools; there the app uses the system adb.
+const PT = "37.0.1";
+const PT_URL = (os) => `https://dl.google.com/android/repository/platform-tools_r${PT}-${os}.zip`;
+const TOOLS = {
+  mac: ["darwin", "ee39ad5967e95c2a07f04dbcbde96b1a0c916ba376096db5d2f498b7727a5d1d", ["adb"]],
+  win: ["win", "45f4d63113e895ebde0c90f194099a4676b6ac653bd28d54314a9e022bbc1a99",
+        ["adb.exe", "AdbWinApi.dll", "AdbWinUsbApi.dll", "libwinpthread-1.dll"]],
+  linux: ["linux", "d230f13842f60f782a8645f9c813f8f845bf36089ea7289f28c48f17979313f1", ["adb"]],
+};
+
+// Mozilla's CA list, as curl publishes it: Python on Windows only trusts roots
+// already in the Windows store (see frame_host.trust_bundled_cas).
+const CA = "2026-09-25";
+const CA_SHA256 = "a41b5d356aea97a529fe27e0f7316d2f9d946d75927476cf9cf1b90637d00505";
+
+// Parts of Python the server never imports (GUI, tests, packaging, headers).
+const PRUNE = [
+  "include", "share", "Scripts", "libs", "tcl", "lib/pkgconfig", "lib/itcl4", "lib/tcl8", "lib/tcl8.6",
+  "lib/tk8.6", "lib/thread2.8", "bin/idle3", "bin/idle3.12", "bin/pip", "bin/pip3", "bin/pip3.12",
+  "bin/pydoc3", "bin/pydoc3.12", "bin/2to3", "bin/2to3-3.12", "bin/python3-config", "bin/python3.12-config",
+  ...["test", "idlelib", "tkinter", "turtledemo", "ensurepip", "lib2to3", "site-packages/pip", "pydoc_data", "venv"]
+    .flatMap((d) => [`lib/python3.12/${d}`, `Lib/${d}`]),
+];
+
+function get(url, redirects = 5) {
+  return new Promise((resolve, reject) => {
+    https.get(url, { timeout: 60000 }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        if (!redirects) return reject(new Error(`${url}: too many redirects`));
+        let next;
+        try { next = new URL(res.headers.location, url).href; }
+        catch { return reject(new Error(`${url}: bad redirect ${res.headers.location}`)); }
+        return resolve(get(next, redirects - 1));
+      }
+      if (res.statusCode !== 200) return reject(new Error(`${url}: HTTP ${res.statusCode}`));
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => resolve(Buffer.concat(chunks)));
+    }).on("timeout", function () { this.destroy(new Error(`${url}: timed out`)); }).on("error", reject);
+  });
+}
+
+async function download(url, sha256, file) {
+  const data = await get(url);
+  const sum = crypto.createHash("sha256").update(data).digest("hex");
+  if (sum !== sha256) throw new Error(`checksum mismatch for ${url}: ${sum}`);
+  fs.writeFileSync(file, data);
+}
+
+// Windows' own bsdtar: Git's GNU tar, often first on PATH, reads C:\ as a remote host.
+const TAR = process.platform === "win32" ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "tar.exe") : "tar";
+
+function extract(file, dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  // bsdtar (macOS, Windows 10+) reads zip files; GNU tar doesn't, so fall back to unzip.
+  try { execFileSync(TAR, ["-xf", file, "-C", dir]); }
+  catch (e) {
+    if (!file.endsWith(".zip")) throw e;
+    execFileSync("unzip", ["-q", "-o", file, "-d", dir]);
+  }
+  fs.rmSync(file);
+}
+
+async function fetch(os, arch) {
+  const key = `${os}-${arch}`;
+  if (!PYTHON[key]) throw new Error(`no bundle for ${key}`);
+  const out = path.join(__dirname, "deps", key);
+  const stamp = path.join(out, ".version");
+  const version = `python ${PY}, platform-tools ${PT}, CA ${CA}`;
+  if (fs.existsSync(stamp) && fs.readFileSync(stamp, "utf8") === version) {
+    console.log(`${key}: already fetched (${version})`);
+    return;
+  }
+  fs.rmSync(out, { recursive: true, force: true });
+  fs.mkdirSync(out, { recursive: true });
+
+  const [triple, pySha] = PYTHON[key];
+  const tgz = path.join(out, "python.tar.gz");
+  await download(PY_URL(triple), pySha, tgz);
+  extract(tgz, out);  // unpacks to python/
+  for (const p of PRUNE) fs.rmSync(path.join(out, "python", p), { recursive: true, force: true });
+  const stdlib = path.join(out, "python", "lib", "python3.12");  // macOS and Linux: drop the static libpython
+  if (fs.existsSync(stdlib)) {
+    for (const d of fs.readdirSync(stdlib)) {
+      if (d.startsWith("config-3.12")) fs.rmSync(path.join(stdlib, d), { recursive: true, force: true });
+    }
+  }
+
+  const tools = path.join(out, "tools");
+  fs.mkdirSync(tools);
+  if (!(os === "linux" && arch === "arm64")) {
+    const [name, ptSha, keep] = TOOLS[os];
+    const zip = path.join(out, "pt.zip");
+    const tmp = path.join(out, "pt");
+    await download(PT_URL(name), ptSha, zip);
+    extract(zip, tmp);
+    for (const f of [...keep, "NOTICE.txt", "source.properties"]) {
+      fs.copyFileSync(path.join(tmp, "platform-tools", f), path.join(tools, f));
+    }
+    if (os !== "win") fs.chmodSync(path.join(tools, "adb"), 0o755);
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+  await download(`https://curl.se/ca/cacert-${CA}.pem`, CA_SHA256, path.join(tools, "cacert.pem"));
+  fs.writeFileSync(stamp, version);
+  console.log(`${key}: ${version} -> ${out}`);
+}
+
+(async () => {
+  const [os, ...archs] = process.argv.slice(2);
+  if (!os || !archs.length) throw new Error("usage: node build/fetch-deps.js <mac|win|linux> <arch>...");
+  for (const arch of archs) await fetch(os, arch);
+})().catch((e) => { console.error(e.message); process.exit(1); });

app/install-link.js

@@ -0,0 +1,33 @@
+// Parses frame-control://install?manifest=URL and frame-control://install?url=URL
+// (see docs/web-install.md). Pure, so it runs under plain node for the tests.
+// This is only a first filter: ui/frame_webinstall.py applies the full URL rules
+// (HTTPS, no private addresses, redirects) before anything is fetched.
+const SCHEME = "frame-control";
+const MAX_LINK = 4096;
+const MAX_URL = 2048;
+
+// {kind: "manifest" | "url", target} or null if raw isn't a usable install link.
+function parseInstallLink(raw) {
+  if (typeof raw !== "string" || raw.length > MAX_LINK || !raw.toLowerCase().startsWith(`${SCHEME}:`)) return null;
+  let link;
+  try { link = new URL(raw); } catch { return null; }
+  // frame-control://install?… puts "install" in the host; accept a trailing slash too.
+  if (link.protocol !== `${SCHEME}:` || link.hostname !== "install" || !["", "/"].includes(link.pathname)) return null;
+  const keys = [...new Set(link.searchParams.keys())];
+  if (keys.length !== 1 || !["manifest", "url"].includes(keys[0])) return null;
+  const values = link.searchParams.getAll(keys[0]);
+  if (values.length !== 1) return null;
+  const target = values[0];
+  if (!target || target.length > MAX_URL) return null;
+  let parsed;
+  try { parsed = new URL(target); } catch { return null; }
+  if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password) return null;
+  return { kind: keys[0], target };
+}
+
+// The link among command-line arguments (Windows and Linux pass it there).
+function linkFromArgv(argv) {
+  return (argv || []).find((a) => typeof a === "string" && a.toLowerCase().startsWith(`${SCHEME}:`)) || null;
+}
+
+module.exports = { SCHEME, parseInstallLink, linkFromArgv };

app/main.js

@@ -1,7 +1,7 @@
-// Frame Control as a Mac app: starts ui/server.py on a free loopback port and
-// shows it in a native window. The server does all the work over the `frame`
-// SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, dialog, shell } = require("electron");
+// Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
+// a free loopback port and shows it in a native window. The server does all the
+// work over the `frame` SSH alias; this file only hosts it.
+const { app, BrowserWindow, Menu, clipboard, dialog, ipcMain, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -9,14 +9,20 @@ const http = require("http");
 const net = require("net");
 const os = require("os");
 const path = require("path");
+const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 
 const run = promisify(execFile);
 
-// Packaged: Contents/Resources/{ui,scripts}. Dev: the repo checkout.
+const IS_MAC = process.platform === "darwin";
+const IS_WIN = process.platform === "win32";
+
+// Packaged: <resources>/{ui,scripts,python}. Dev: the repo checkout.
 const ROOT = app.isPackaged ? process.resourcesPath : path.join(__dirname, "..");
+const TOOLS = path.join(ROOT, "tools");  // bundled adb and CA certificates
 const SERVER = path.join(ROOT, "ui", "server.py");
 const SCRIPTS = path.join(ROOT, "scripts");
-const LOG_DIR = path.join(os.homedir(), "Library", "Logs", "Frame Control");
+const LOG_DIR = IS_MAC ? path.join(os.homedir(), "Library", "Logs", "Frame Control")
+                       : path.join(app.getPath("userData"), "logs");
 const LOG = path.join(LOG_DIR, "server.log");
 const BG = "#0d1117";
 const FRAME = process.env.FRAME_ALIAS || "frame";
@@ -25,15 +31,18 @@ let server = null;
 let url = null;
 let win = null;
 let quitting = false;
+let python = null;
 
 // Apps launched from Finder get PATH=/usr/bin:/bin:/usr/sbin:/sbin, which misses
-// Homebrew's python3, rsync and adb. Take PATH from the login shell instead.
+// Homebrew's python3, rsync and adb (desktop launchers on Linux can be as bare).
+// Take PATH from the login shell instead. Windows has no login shell to ask.
 // Runs asynchronously so a slow shell profile can't freeze the window.
 let cachedPath = null;
 async function loginPath() {
+  if (IS_WIN) return process.env.PATH || "";
   if (cachedPath) return cachedPath;
-  const shellPath = os.userInfo().shell || process.env.SHELL || "/bin/zsh";
-  const extra = ["/opt/homebrew/bin", "/usr/local/bin", path.join(os.homedir(), ".homebrew", "bin")];
+  const shellPath = os.userInfo().shell || process.env.SHELL || (IS_MAC ? "/bin/zsh" : "/bin/sh");
+  const extra = IS_MAC ? ["/opt/homebrew/bin", "/usr/local/bin", path.join(os.homedir(), ".homebrew", "bin")] : [];
   let fromShell = "";
   try {
     const { stdout } = await run(shellPath, ["-ilc", 'printf "\\n__PATH__%s__PATH__" "$PATH"'],
@@ -46,19 +55,44 @@ async function loginPath() {
   return joined;
 }
 
+// The Windows build bundles Python; elsewhere use the system's python3 (3.8+).
+// -I ignores PYTHON* variables and user site-packages, so a PYTHONHOME or
+// PYTHONPATH set for another Python can't break the bundled one. That makes these
+// flags stand in for PYTHONUNBUFFERED, PYTHONDONTWRITEBYTECODE (no __pycache__
+// inside the signed app) and PYTHONUTF8.
+const PY_FLAGS = ["-I", "-u", "-B", "-X", "utf8"];
+
 async function findPython(env) {
-  for (const dir of env.PATH.split(":")) {
-    const p = path.join(dir, "python3");
+  const names = IS_WIN ? ["python.exe", "python3.exe"] : ["python3"];
+  // The packaged app bundles Python (app/build/fetch-deps.js); a checkout uses PATH.
+  const candidates = [path.join(ROOT, "python", ...(IS_WIN ? ["python.exe"] : ["bin", "python3"]))];
+  for (const dir of env.PATH.split(path.delimiter)) {
+    // The WindowsApps "python.exe" is a stub that opens the Microsoft Store.
+    if (!dir || (IS_WIN && /\\WindowsApps\\?$/i.test(dir))) continue;
+    for (const name of names) candidates.push(path.join(dir, name));
+  }
+  for (const p of candidates) {
     try {
       fs.accessSync(p, fs.constants.X_OK);
-      // /usr/bin/python3 is a stub until the Command Line Tools are installed.
-      await run(p, ["-c", "import http.server"], { timeout: 10000, env });
+      // /usr/bin/python3 on macOS is a stub until the Command Line Tools are installed.
+      await run(p, [...PY_FLAGS, "-c", "import http.server, sys; assert sys.version_info >= (3, 8)"],
+                { timeout: 10000, env, windowsHide: true });
       return p;
     } catch {}
   }
   return null;
 }
 
+async function hasSsh(env) {
+  try { await run("ssh", ["-V"], { timeout: 5000, env, windowsHide: true }); return true; } catch { return false; }
+}
+
+const PYTHON_HELP = app.isPackaged ? "The bundled Python is missing; reinstall Frame Control."
+  : "Install Python 3.8 or later, then reopen the app.";
+const SSH_HELP = IS_WIN
+  ? "Turn on Windows' OpenSSH client: Settings → System → Optional features → Add a feature → OpenSSH Client."
+  : "Install the OpenSSH client (e.g. sudo apt install openssh-client).";
+
 function freePort() {
   return new Promise((resolve, reject) => {
     const s = net.createServer();
@@ -80,17 +114,19 @@ function ping(target) {
 }
 
 async function startServer() {
-  const env = { ...process.env, PATH: await loginPath(), PYTHONUNBUFFERED: "1", PYTHONDONTWRITEBYTECODE: "1" };
-  const python = await findPython(env);
-  if (!python) {
-    throw new Error("Frame Control needs python3. Install the Xcode Command Line Tools "
-                    + "(xcode-select --install) or Homebrew's python, then reopen the app.");
-  }
+  const env = { ...process.env, PATH: await loginPath(), FRAME_CONTROL_APP: "1",
+                ...(fs.existsSync(TOOLS) ? { FRAME_CONTROL_TOOLS: TOOLS } : {}) };
+  python = await findPython(env);
+  if (!python) throw new Error(`Frame Control needs Python 3.8 or later. ${PYTHON_HELP}`);
+  if (!await hasSsh(env)) throw new Error(`Frame Control needs the ssh command. ${SSH_HELP}`);
   const port = await freePort();
   fs.mkdirSync(LOG_DIR, { recursive: true });
   const log = fs.openSync(LOG, "a");
   fs.writeSync(log, `\n--- ${new Date().toISOString()} ${python} ${SERVER} --port ${port}\n`);
-  const child = spawn(python, [SERVER, "--port", String(port)], { env, stdio: ["ignore", log, log] });
+  // stdin stays open while the app runs; the server exits cleanly when it closes.
+  const child = spawn(python, [...PY_FLAGS, SERVER, "--port", String(port), "--exit-on-eof"],
+                      { env, stdio: ["pipe", log, log], windowsHide: true });
+  child.stdin.on("error", () => {});
   fs.closeSync(log);
   server = child;
   let exited = null;
@@ -112,13 +148,20 @@ async function startServer() {
     await new Promise((r) => setTimeout(r, 100));
   }
   if (server === child) server = null;
-  child.kill("SIGTERM");
+  endServer(child);
   throw new Error(`The server didn't start within 10 seconds. See ${LOG}.`);
 }
 
+// Closing stdin lets server.py close its SSH connections and exit (the only clean
+// way on Windows); SIGTERM does the same elsewhere.
+function endServer(child) {
+  try { child.stdin.end(); } catch {}
+  if (!IS_WIN) child.kill("SIGTERM");
+  setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill(); }, 5000).unref();
+}
+
 function stopServer() {
-  // server.py handles SIGTERM by closing its shared SSH connection.
-  if (server) server.kill("SIGTERM");
+  if (server) endServer(server);
 }
 
 function errorPage(message) {
@@ -139,12 +182,12 @@ async function restartServer() {
   const old = server;
   server = null;
   url = null;
-  if (old) old.kill("SIGTERM");
+  if (old) endServer(old);
   await load();
 }
 
-// The page's sticky header becomes the title bar, clear of the traffic lights.
-const CHROME_CSS = `
+// On macOS the page's sticky header becomes the title bar, clear of the traffic lights.
+const CHROME_CSS = IS_MAC && `
   header { padding-left: 92px !important; -webkit-app-region: drag; user-select: none; }
   header a, header button, header input, header .chip { -webkit-app-region: no-drag; }
 `;
@@ -183,23 +226,77 @@ async function firstRunCheck() {
     type: "info",
     message: "Connect to your Steam Frame",
     detail: `There's no "${FRAME}" SSH alias yet. On the Frame, turn on Steam Settings → System → `
-          + "Enable Developer Mode, then Developer → Set User Password. Then run the setup script: it finds the "
-          + "headset, creates a key, and asks for that password once in Terminal.",
+          + "Enable Developer Mode, then Developer → Set User Password. Then run the setup: it finds the "
+          + "headset, creates a key, and asks for that password once in a terminal window.",
     buttons: ["Set Up Connection…", "Later"],
     defaultId: 0, cancelId: 1,
   });
   if (response === 0) setUpConnection();
 }
 
+// IPC only from our own page in our own window.
+function fromUi(e) {
+  if (!win || e.sender !== win.webContents || !url || !e.senderFrame) return false;
+  try {
+    return new URL(e.senderFrame.url).origin === new URL(url).origin;
+  } catch { return false; }
+}
+
+ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : "");
+ipcMain.handle("connection:setup", (e) => { if (fromUi(e)) setUpConnection(); });
+
+// frame-control://install links from websites (docs/web-install.md). They can
+// arrive before the window or server exists (macOS open-url on a cold launch),
+// so they wait here until the page asks for them. The page checks the link with
+// the server and installs nothing until the user confirms in its dialog.
+const pendingLinks = [];
+let linkPage = null;  // the webContents whose current page is listening
+
+function openInstallLink(raw) {
+  const req = parseInstallLink(raw);
+  if (!req) {
+    app.whenReady().then(() => dialog.showErrorBox("Frame Control can't use this link",
+      "Install links look like frame-control://install?manifest=https://… or frame-control://install?url=https://…"));
+    return;
+  }
+  pendingLinks.push(req);
+  if (pendingLinks.length > 5) pendingLinks.shift();  // a page opening links in a loop
+  deliverLinks();
+  if (win) { if (win.isMinimized()) win.restore(); win.focus(); }
+}
+
+function deliverLinks() {
+  if (!win || !linkPage || linkPage !== win.webContents) return;
+  while (pendingLinks.length) win.webContents.send("install-link", pendingLinks.shift());
+}
+
+ipcMain.on("install-link:ready", (e) => {
+  if (!fromUi(e)) return;
+  linkPage = e.sender;
+  deliverLinks();
+});
+
+function registerScheme() {
+  // A checkout runs as `electron .`, so the OS must be told the script too.
+  // (macOS takes the scheme from Info.plist, which only the built app has.)
+  if (process.defaultApp) {
+    if (process.argv.length >= 2) app.setAsDefaultProtocolClient(SCHEME, process.execPath, [path.resolve(process.argv[1])]);
+  } else {
+    app.setAsDefaultProtocolClient(SCHEME);
+  }
+}
+
 function createWindow() {
   win = new BrowserWindow({
     width: 1400, height: 950, minWidth: 760, minHeight: 560,
     title: "Frame Control", backgroundColor: BG, show: false,
-    titleBarStyle: "hiddenInset", trafficLightPosition: { x: 18, y: 26 },
-    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
+    ...(IS_MAC ? { titleBarStyle: "hiddenInset", trafficLightPosition: { x: 18, y: 26 } }
+               : { icon: path.join(__dirname, "build", "icon.png") }),
+    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true,
+                      preload: path.join(__dirname, "preload.js") },
   });
   win.once("ready-to-show", () => win.show());
-  win.webContents.on("did-finish-load", () => win.webContents.insertCSS(CHROME_CSS));
+  if (CHROME_CSS) win.webContents.on("did-finish-load", () => win.webContents.insertCSS(CHROME_CSS));
   // External links open in the default browser; the app never navigates away.
   win.webContents.setWindowOpenHandler(({ url: target }) => {
     if (/^https?:\/\//.test(target)) shell.openExternal(target);
@@ -208,40 +305,51 @@ function createWindow() {
   win.webContents.on("will-navigate", (e, target) => {
     if (!url || new URL(target).origin !== new URL(url).origin) e.preventDefault();
   });
-  win.on("closed", () => { win = null; });
+  // A reload or a new page must ask for links again before it gets any.
+  win.webContents.on("did-start-loading", () => { linkPage = null; });
+  win.on("closed", () => { win = null; linkPage = null; });
   load();
 }
 
-// Runs in Terminal because ssh-copy-id asks for the Developer Mode password.
-function runInTerminal(command) {
-  const quoted = command.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  execFile("osascript", ["-e", 'tell application "Terminal"', "-e", `do script "${quoted}"`,
-                         "-e", "activate", "-e", "end tell"], (err) => {
-    if (err) dialog.showErrorBox("Couldn't open Terminal", String(err.message || err));
-  });
+// Opens a terminal window (Terminal, a Linux terminal emulator or a console) via
+// ui/frame_host.py, which the server uses too: setup and power actions ask for the
+// Developer Mode password there.
+async function runInTerminal(argv) {
+  try {
+    const env = { ...process.env, PATH: await loginPath() };
+    const py = python || await findPython(env);
+    if (!py) throw new Error(`Python 3.8 or later is needed. ${PYTHON_HELP}`);
+    await run(py, [...PY_FLAGS, path.join(ROOT, "ui", "frame_host.py"), "terminal", "--", ...argv],
+              { env, timeout: 15000, windowsHide: true });
+  } catch (err) {
+    dialog.showErrorBox("Couldn't open a terminal", String((err.stderr || err.message || err)).trim());
+  }
 }
 
-const sh = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-
-function setUpConnection() {
-  runInTerminal(`env ${sh(`FRAME_ALIAS=${FRAME}`)} zsh ${sh(path.join(SCRIPTS, "connect.sh"))}`);
+async function setUpConnection() {
+  const alias = `FRAME_ALIAS=${FRAME}`;
+  if (IS_MAC) return runInTerminal(["env", alias, "zsh", path.join(SCRIPTS, "connect.sh")]);
+  const py = python || await findPython({ ...process.env, PATH: await loginPath() });
+  const setup = [py || "python3", ...PY_FLAGS, path.join(ROOT, "ui", "frame_connect.py")];
+  // A new console inherits our environment on Windows; Linux terminals may not.
+  runInTerminal(IS_WIN ? setup : ["env", alias, ...setup]);
 }
 
 function buildMenu() {
   const template = [
-    { role: "appMenu" },
+    ...(IS_MAC ? [{ role: "appMenu" }] : []),
     { role: "fileMenu" },
     { role: "editMenu" },
     {
       label: "Frame",
       submenu: [
         { label: "Set Up Connection…", click: setUpConnection },
-        { label: "Open SSH in Terminal", click: () => runInTerminal(`ssh ${sh(FRAME)}`) },
+        { label: IS_MAC ? "Open SSH in Terminal" : "Open SSH in a Terminal", click: () => runInTerminal(["ssh", FRAME]) },
         { type: "separator" },
         { label: "Open in Browser", click: () => url && shell.openExternal(url) },
         { label: "Restart Server", click: () => win ? restartServer() : createWindow() },
         { label: "Show Server Log", click: () => shell.openPath(fs.existsSync(LOG) ? LOG : LOG_DIR) },
-        { label: "Reveal Helper Scripts", click: () => shell.openPath(SCRIPTS) },
+        ...(IS_WIN ? [] : [{ label: "Reveal Helper Scripts", click: () => shell.openPath(SCRIPTS) }]),
       ],
     },
     {
@@ -253,7 +361,7 @@ function buildMenu() {
         { type: "separator" }, { role: "togglefullscreen" },
       ],
     },
-    { role: "windowMenu" },
+    ...(IS_MAC ? [{ role: "windowMenu" }] : []),
     {
       role: "help",
       submenu: [{ label: "Project on GitHub", click: () => shell.openExternal("https://github.com/saphid/steam-frame") }],
@@ -265,10 +373,18 @@ function buildMenu() {
 if (!app.requestSingleInstanceLock()) {
   app.quit();
 } else {
-  app.on("second-instance", () => {
+  // macOS delivers install links here, even before the app is ready.
+  app.on("open-url", (e, link) => { e.preventDefault(); openInstallLink(link); });
+  // Windows and Linux start a second instance with the link as an argument.
+  app.on("second-instance", (_e, argv) => {
     if (win) { if (win.isMinimized()) win.restore(); win.focus(); }
+    const link = linkFromArgv(argv);
+    if (link) openInstallLink(link);
   });
+  const firstLink = IS_MAC ? null : linkFromArgv(process.argv);
+  if (firstLink) openInstallLink(firstLink);
   app.whenReady().then(() => {
+    registerScheme();
     buildMenu();
     createWindow();
   });

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.2.0",
+      "version": "0.3.1",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,16 +1,18 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.2.0",
-  "description": "Mac app for managing a Valve Steam Frame over SSH",
+  "version": "0.3.1",
+  "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
   "license": "MIT",
   "scripts": {
     "start": "env -u ELECTRON_RUN_AS_NODE electron .",
     "icon": "env -u ELECTRON_RUN_AS_NODE electron build/make-icon.js",
-    "dist": "electron-builder --mac --arm64 --publish never",
-    "dist:dir": "electron-builder --mac --arm64 --dir"
+    "dist": "node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --publish never",
+    "dist:dir": "node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --dir",
+    "dist:linux": "node build/fetch-deps.js linux x64 arm64 && electron-builder --linux --x64 --arm64 --publish never",
+    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never"
   },
   "devDependencies": {
     "electron": "^44.4.5",
@@ -19,13 +21,24 @@
   "build": {
     "appId": "com.saphid.frame-control",
     "productName": "Frame Control",
+    "protocols": [
+      {
+        "name": "Frame Control install link",
+        "schemes": [
+          "frame-control"
+        ]
+      }
+    ],
     "directories": {
       "output": "dist",
       "buildResources": "build"
     },
     "files": [
       "main.js",
-      "package.json"
+      "preload.js",
+      "install-link.js",
+      "package.json",
+      "build/icon.png"
     ],
     "extraResources": [
       {
@@ -51,6 +64,14 @@
           "*.py"
         ]
       },
+      {
+        "from": "../frame/devkit-utils",
+        "to": "frame/devkit-utils",
+        "filter": [
+          "**/*",
+          "!**/__pycache__/**"
+        ]
+      },
       {
         "from": "../apk-catalog",
         "to": "apk-catalog",
@@ -59,6 +80,20 @@
           "pins.json",
           "site/apps.js"
         ]
+      },
+      {
+        "from": "build/deps/${os}-${arch}/python",
+        "to": "python",
+        "filter": [
+          "**/*"
+        ]
+      },
+      {
+        "from": "build/deps/${os}-${arch}/tools",
+        "to": "tools",
+        "filter": [
+          "**/*"
+        ]
       }
     ],
     "mac": {
@@ -73,7 +108,8 @@
       "extendInfo": {
         "NSAppleEventsUsageDescription": "Frame Control opens Terminal for SSH sessions and for power actions that need the Developer Mode password.",
         "NSLocalNetworkUsageDescription": "Frame Control connects to your Steam Frame over SSH on the local network."
-      }
+      },
+      "artifactName": "Frame-Control-mac-${arch}.${ext}"
     },
     "dmg": {
       "title": "Frame Control ${version}"
@@ -82,6 +118,46 @@
       "runAsNode": false,
       "enableNodeOptionsEnvironmentVariable": false,
       "enableNodeCliInspectArguments": false
+    },
+    "linux": {
+      "target": [
+        "AppImage",
+        "deb"
+      ],
+      "category": "Utility",
+      "icon": "build/icon.png",
+      "executableName": "frame-control",
+      "synopsis": "Manage a Valve Steam Frame over SSH",
+      "artifactName": "Frame-Control-linux-${arch}.${ext}",
+      "desktop": {
+        "entry": {
+          "StartupWMClass": "frame-control"
+        }
+      }
+    },
+    "deb": {
+      "depends": [
+        "openssh-client"
+      ]
+    },
+    "win": {
+      "target": [
+        "nsis",
+        "zip"
+      ],
+      "icon": "build/icon.png",
+      "artifactName": "Frame-Control-win-${arch}.${ext}"
+    },
+    "nsis": {
+      "oneClick": false,
+      "perMachine": false,
+      "allowToChangeInstallationDirectory": true,
+      "artifactName": "Frame-Control-Setup-${arch}.${ext}"
     }
+  },
+  "homepage": "https://github.com/saphid/steam-frame",
+  "author": {
+    "name": "saphid",
+    "email": "4596216+saphid@users.noreply.github.com"
   }
 }

app/preload.js

@@ -0,0 +1,19 @@
+// Lets the page read this computer's clipboard through Electron, so sending it
+// to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
+// the page where a dropped file or folder lives, so a folder can be sideloaded
+// as a title without zipping it (the local server reads it from there).
+// It can open Set Up Connection when the headset can't be reached.
+// It also receives frame-control://install links (docs/web-install.md): only
+// what the link asked for, never an install; the page asks the user first.
+const { contextBridge, ipcRenderer, webUtils } = require("electron");
+
+contextBridge.exposeInMainWorld("frameApp", {
+  readClipboard: () => ipcRenderer.invoke("clipboard:read"),
+  setUpConnection: () => ipcRenderer.invoke("connection:setup"),
+  pathForFile: (file) => { try { return webUtils.getPathForFile(file) || ""; } catch { return ""; } },
+  onInstallLink: (cb) => {
+    ipcRenderer.removeAllListeners("install-link");
+    ipcRenderer.on("install-link", (_e, req) => cb({ kind: req.kind, target: req.target }));
+    ipcRenderer.send("install-link:ready");
+  },
+});

docs/apks.md

@@ -18,7 +18,8 @@ python3 ui/frame_android.py list|launch|stop|remove|probe <package>
 Each APK becomes its own app, the way T3 Code is set up (see the instance
 section below), instead of going into Lepton Development:
 
-1. `aapt2` reads the package, label, version, ABIs and icon. APKs that need
+1. `ui/frame_apk.py` reads the package, label, version, ABIs and icon
+   (a stdlib parser of the binary manifest and resource table, so no Android SDK). APKs that need
    API > 30 or have no `arm64-v8a` build are refused.
 2. The APK, `frame/android/lepton-app.sh` (as `launch.sh`), `instance.id`,
    `meta.json`, the icon and the `lepton-show-flatscreen` marker go to
@@ -45,6 +46,33 @@ Lepton Development must be installed once. Over SSH,
 `ssh frame 'steam steam://install/3056000'` queues it, but the install still
 needs to be confirmed or started in the headset.
 
+## When an app needs a newer Android
+
+Lepton is Android 11 (API 30), with arm64-v8a only. If Frame Control refuses
+an APK, it shows compatible versions from F-Droid's main and archive repos and
+IzzyOnDroid. It shows at most eight version names, newest first, preferring an
+arm64-only build, and says how many compatible builds it found in total.
+Each index is reduced to its compatible builds once a day and cached (about
+16 MB). The first lookup takes about 30 s and 100 MB of memory; later ones are
+instant.
+Choose **Install** to download a listed version, verify its SHA-256 against
+the index, and install it as its own app.
+
+You can also inspect a file or look up a package from the command line:
+
+```sh
+python3 ui/frame_android.py info some-app.apk
+python3 ui/frame_android.py versions some-app.apk
+python3 ui/frame_android.py versions org.example.app
+```
+
+The search links open APKMirror, APKPure, Uptodown, F-Droid and GitHub. Pick a
+version whose minimum is Android 11 or lower and that has an arm64-v8a build
+(or no native code). Frame Control does not fetch APKs from those search sites.
+Older versions may lack fixes, and being installable does not guarantee an
+app will run: see the missing services below. Android may refuse a downgrade
+or an update signed by a different publisher; removing the app deletes its data.
+
 ## Installed apps disappear when Lepton Development closes (verified 2026-09-25)
 
 Lepton Development runs in a throwaway "dev" context. When it exits for any

docs/frame-control.md

@@ -0,0 +1,152 @@
+# Frame Control in detail
+
+What each part of the app does, how it works, and what has been checked on a
+real Frame. For installing it, see the [README](../README.md#install).
+
+As of 2026-09-25 no other desktop app manages the Frame end to end.
+[Stream Frame](https://streamframe.app/) (macOS 14+, free) records and screenshots
+the headset over SSH. [FrameDrop](https://framedropvr.com) sideloads but is
+Windows-only. Steam Link views the headset.
+
+You can also run the same UI in a browser without the app, from a checkout:
+
+```sh
+./scripts/frame-ui.sh        # macOS: opens http://127.0.0.1:47810 in its own window
+python3 ui/server.py         # anywhere: then open http://127.0.0.1:47810
+```
+
+## Features
+
+The window has four tabs: **Home** (headset view, status, screenshots),
+**Games** (installed games, sideloaded titles, getting games), **Android** (apps,
+the catalogue, display settings, reports) and **Tools** (sending files and text,
+Flatpaks, remote and power). Keys 1–4 switch between them. Files can be dropped
+anywhere in the window. When the Frame can't be reached, one banner says why in
+plain words and the app retries every few seconds, filling everything in once it
+answers. Flatpak and Android installs run in the background; the bottom bar
+counts them while they run.
+
+- **Headset view**: what the lenses show, as SteamVR composites it (the room,
+  floating panels, dashboard and controllers). Shows the left eye, like pointing
+  a camera into one lens, or both eyes, as a single shot; saves as PNG. **Live**
+  is 720p video at about 30 fps: `ffmpeg` on the Frame encodes SteamVR's
+  headset-view device (`/dev/video99`) to H.264 over SSH, and the page decodes
+  it with WebCodecs. Live video is one eye; Capture still gets both. The viewer
+  fits the whole frame; zoom with − / + (or scroll, or double-click), drag to
+  pan, `0` to fit, `F` for full screen. Capture uses OpenVR's `IVRScreenshots`
+  API through Python `ctypes` (`ui/frame_vrshot.py`). Nothing extra is
+  installed on the Frame (SteamOS ships `ffmpeg`). **Desktop panel** captures
+  gamescope's flat layer instead.
+- **Screenshots** you take in the headset with Steam's shortcut: browse them and
+  save them to `~/Pictures/SteamFrame`.
+- **Battery** with charging state: charge rate in watts, time to full or empty,
+  charger type and wattage (for example USB-C PD 20 W), and battery temperature.
+- **Status**: storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR,
+  the desktop, Lepton and xrdp are running.
+- **Library** shelf with Steam cover art and a Play button (`steam://rungameid`).
+- **Get games**: every game you own with its Steam Frame rating (Verified,
+  Playable, Unsupported, Unknown). Install on Frame downloads it to the headset
+  with live progress. Search the Steam store with prices and Frame ratings; Buy
+  opens the store page in your browser, or Store on Frame opens it in the
+  headset. It drives the Frame's own Steam client through its DevTools port;
+  see [steam-games.md](steam-games.md).
+- **Volume** and mute (`wpctl`).
+- **Android apps**: search about 4,500 F-Droid apps rated for the Frame, install
+  one with a click as its own Lepton instance (it keeps its data and shows in the
+  Steam library), then launch, stop, test or remove it. **Report an APK** records
+  whether any APK worked (F-Droid or not: pick a file, type a package, or use an
+  installed app). Your reports are saved on your computer and change the verdicts
+  you see. They aren't uploaded anywhere: the shared database is maintainer-only
+  for now (see [compat-db/README.md](../compat-db/README.md)). Uses the app's bundled
+  `adb`, or yours if you have one.
+- **Android display**: pick a running Lepton instance (by the app in it) and set
+  its resolution (Native 1920×1080, or Sharp 2560×1440 with density scaled to
+  match), UI scale (Smaller / Default / Larger, or an exact dpi) and text size
+  (0.85–1.3×) over ADB (`wm size`, `wm density`, `font_scale`). Reset puts all
+  three back. Whether the settings survive the app relaunching is untested.
+- **Transfer**: drag and drop files to `~/Downloads`; `.apk` files install as
+  their own Android app. A game's `.zip`, folder or `.exe` becomes a title in
+  the Steam library (Valve's Devkit Game path, with Proton or the Steam Linux
+  Runtime picked from the program's header), listed under **Sideloaded titles**
+  with Launch and Remove; see [sideloading.md](sideloading.md). Send typed text, or your computer's clipboard, to the
+  Frame clipboard.
+- **Flatpaks**: install and remove them (quick picks: Moonlight, Firefox, VLC,
+  Remmina).
+- **One-click tools**: SSH or SFTP in a terminal window, Steam Link, and remote
+  desktop (Windows App on macOS, Remote Desktop on Windows, Remmina or FreeRDP on
+  Linux). Sleep, restart and shut down open a terminal window because SteamOS
+  asks for the sudo password over SSH.
+
+## How it works
+
+`app/` is an Electron shell. It starts `ui/server.py` on a free loopback port
+and shows it in its own window; the server stops when you quit the app. The
+app bundles `ui/`, `scripts/`, `frame/android/`, Valve's `frame/devkit-utils/` and the rated catalogue from
+`apk-catalog/`, plus a standalone Python
+([python-build-standalone](https://github.com/astral-sh/python-build-standalone))
+and `adb` from Google's platform-tools, so there's nothing else to install. It
+also bundles curl's copy of Mozilla's CA list, because Python on Windows only
+trusts root certificates already in the Windows store.
+`app/build/fetch-deps.js` downloads both, pinned by SHA-256.
+
+The server is Python stdlib only and listens on 127.0.0.1. It rejects requests
+with a non-local `Host` header, and any `/api/` request without a custom
+header, so other websites can't drive it or read captures. Everything reaches
+the headset through the `frame` SSH alias. On macOS and Linux it keeps one
+multiplexed SSH connection open, so status and each capture take about 0.3 s.
+Windows' OpenSSH can't share a connection, so there each request connects on
+its own and the app is a little slower. What differs between the three
+systems lives in `ui/frame_host.py`.
+
+Headset captures are deleted from the Frame as soon as they're copied, because
+they show everything on screen, including anything private. The look follows
+the Steam client: its palette, Motiva Sans (loaded from Valve's CDN), portrait
+library capsules and green Play buttons.
+
+**Verified on the Frame 2026-09-25 (macOS app):** status and charging details,
+both capture modes (headset view while in use, and a blank frame in standby,
+which the UI labels), clipboard, volume, file push, and input validation.
+**Not yet exercised from the UI:** Launch, Flatpak install/remove, APK drop,
+title sideloading (not yet run on a headset at all), and the power buttons. Each of these calls a command that was verified
+separately.
+
+## Per-platform notes
+
+**macOS.** The app reads `PATH` from your login shell, so Homebrew's `rsync`
+and `adb` are used when you launch it from Finder. Set Up Connection runs
+`scripts/connect.sh` in Terminal. The log is at
+`~/Library/Logs/Frame Control/server.log`. The build is ad-hoc signed and not
+notarized: a downloaded copy is quarantined until you run
+`xattr -dr com.apple.quarantine "/Applications/Frame Control.app"`. The first
+time you use them, macOS asks to allow local network access (for SSH) and
+control of Terminal (for SSH and power actions).
+
+**Windows.** `ssh` is Windows' built-in OpenSSH client
+(Settings → System → Optional features, if it's been removed). Set Up
+Connection runs `ui/frame_connect.py` in a console window. Copies use `scp`
+because Windows has no `rsync`. The installer isn't code-signed, so SmartScreen
+warns on first run: choose **More info → Run anyway**. The log is at
+`%APPDATA%\Frame Control\logs\server.log`.
+
+**Linux.** Needs `ssh`, which most desktops have; the `.deb` pulls it in.
+The arm64 build also needs your distribution's `adb` for Android apps, because
+Google publishes no arm64 Linux platform-tools. Set Up Connection runs
+`ui/frame_connect.py` in your terminal emulator (GNOME Terminal, Konsole, xterm
+and others). The log is at
+`~/.config/Frame Control/logs/server.log`. Running `ui/server.py` in a browser
+instead of the app, sending the clipboard needs `wl-clipboard` (Wayland) or
+`xclip` (X11).
+
+## Building
+
+```sh
+cd app
+npm install
+npm start              # run from the checkout without packaging
+npm run dist           # macOS: dist/*.dmg and .zip (Apple Silicon)
+npm run dist:win       # Windows: installer and .zip
+npm run dist:linux     # Linux: AppImage and .deb, x64 and arm64
+```
+
+Pushing a `v*` tag builds all three in GitHub Actions and attaches them to the
+release (`.github/workflows/release.yml`).

docs/how-the-frame-works.md

@@ -33,6 +33,7 @@ Lepton (Android 11, podman container "lepton-dev") ← its own panel, app 305600
 | SteamVR's `steamvr-v4l2cam.service` (`/opt/steamvr/bin/linuxarm64/v4l2cam --output=99`) copies the headset view (the `system.HeadsetView` mirror, one undistorted image) into the v4l2loopback device `/dev/video99` ("SteamVR"), 1920×1080 RGB24. `ffmpeg -f v4l2 -i /dev/video99` reads it at about 70 new frames/s; the first frame read can be black. The Frame's hardware encoder (`iris_encoder`, `/dev/video-enc0`) crashes ffmpeg's `h264_v4l2m2m`, so encode with `libx264 -preset ultrafast -tune zerolatency`: 720p30 takes about 0.7 of a core and 1080p60 about 1.7 (of 8). gamescope also publishes a PipeWire `gamescope` video source, but the Frame's GStreamer has no `pipewiresrc`. **Verified 2026-09-26.** | Frame Control's live video (`/api/stream`) |
 | Battery: `/sys/class/power_supply/max1720x_bat_7-36` gives µV/µA (current is positive while charging), `time_to_full_now`/`time_to_empty_now` in seconds, and `temp` in tenths of °C. The charger shows up as `tcpm-source-psy-…` (`type=USB`, `usb_type=C PD [PD_PPS]`), for example 12 V × 1.67 A. | Frame Control's battery card |
 | `vrcmd --stats` reports `activity_level` (3 = standby). | Telling whether the headset is being worn |
+| **Testing VR apps without wearing the headset.** In standby SteamVR keeps OpenXR sessions hidden, so they render one frame and stop. `vrcmd` (in `/opt/steamvr/bin/linuxarm64`) settings use `section.key`: `vrcmd --set-settings-bool power.pauseCompositorOnStandby 0` and `vrcmd --set-settings-float power.turnOffScreensTimeout 3600`, then `vrcmd --handlewakeup`, keep the compositor running, and the scene app becomes visible. If it stays `visible-blurred`, the Steam dashboard is open: `SteamClient.OpenVR.VROverlay.HideDashboard()` in Steam's `SharedJSContext` (CDP on 8080) closes it. The headset view then captures with `ui/frame_vrshot.py`. Restore afterwards with `--set-settings-bool power.pauseCompositorOnStandby 1` and `--set-settings-float power.turnOffScreensTimeout 5`. The bool setter reads `true` as false, so use 1/0. A Steam launch that stalls in standby at `ShowInterstitials` or `CreatingProcess` (see `console_log.txt`) continues with `SteamClient.Apps.ContinueGameAction(<action id>, "<appid>", "<task>")`. **Verified 2026-09-27.** | Proving VR output remotely, [webxr-chromium.md](webxr-chromium.md) |
 | The SteamVR dashboard has docking: Float in World, Move, Size, Curvature, controller docking, Theater, Multitasking View. **Inferred** from `/opt/steamvr/resources/webinterface/dashboard/` and not yet driven by hand. | [panels.md](panels.md) |
 | SteamVR settings live in `~/.config/openvr/config/steamvr.vrsettings`, not under `~/.local/share/Steam/config/`. `dashboard.lastAccessedExternalOverlayKey` names the last panel you used. | Settings tweaks |
 | The Steam client's journal (`journalctl --user`) carries SteamVR system UI lines such as `[Overlays] Created: …` and `vroverlay_uid<appid>`. It's the quickest way to see panels come and go. | Debugging |
@@ -44,11 +45,20 @@ Lepton (Android 11, podman container "lepton-dev") ← its own panel, app 305600
 | Lepton Development deletes every ADB-installed app when it exits (`clear_baked_app_data "non steamlaunch container"` in `…/common/Lepton/lepton`) unless `LEPTON_NO_CLEANUP` is set. | [apks.md](apks.md) |
 | Any APK can run as its own Lepton instance: run `…/common/Lepton/lepton waitforexitandrun -- app.apk` with `SteamAppId` set and `STEAM_COMPAT_DATA_PATH` under `~/.local/share/Steam`. Data persists and each gets its own container and panel. `frame/android/lepton-app.sh`, `ui/frame_android.py`. | [apks.md](apks.md) |
 | The Steam client runs with `-cef-enable-debugging`, so its UI answers Chrome DevTools on loopback `127.0.0.1:8080`. The `SharedJSContext` page has `appStore` (owned apps), `downloadsStore` and `SteamClient.*`. `steam steam://install/<appid>` over SSH installs an owned game; when the options dialog shows (state 7), `SteamClient.Installs.ContinueInstall()` accepts it. **Verified 2026-09-25** with Balatro and Broforce. The Frame rating is `steam_hw_compat_category_packed >> 8 & 3`. | [steam-games.md](steam-games.md), `ui/frame_steam.py` |
-| Chromium Flatpak 154 has **no immersive WebXR**: `navigator.xr` exists, but `isSessionSupported("immersive-vr")` returns `false`. Web VR180 players (DL8/DeoVR embeds) still play video inline as a flat, pannable view, and their VR button opens a tab on immersiveweb.dev. Forcing it doesn't help. `--enable-features=OpenXR,WebXR --force-webxr-runtime=openxr`, with `/opt/steamvr` and `XR_RUNTIME_JSON` exposed to the Flatpak, still returns `false`. The aarch64 Linux binary has no OpenXR code at all (no `XR_RUNTIME_JSON`, `xrGetInstanceProcAddr` or loader strings), even though `chrome://flags` lists `#webxr-runtime` → OpenXR. **Why (verified against source 2026-09-25):** M154 is the first release that compiles OpenXR on Linux (`enable_openxr` includes `is_linux`, `checkout_openxr` is true in Flathub's tarball, and Flathub's GN args don't turn it off). But `content/services/isolated_xr_device/xr_runtime_provider.cc` only creates an OpenXR device under `ENABLE_OPENXR && IS_WIN`, on 154, 155 and `main`. Nothing on Linux calls the OpenXR code, so the linker drops it. The missing pieces are two unmerged Gerrit CLs (bug 506004811): [8132979](https://chromium-review.googlesource.com/c/chromium/src/+/8132979) wires the provider on Linux (with `kOpenXR` still off by default, so it needs `--enable-features=OpenXR`), and [8441736](https://chromium-review.googlesource.com/c/chromium/src/+/8441736) runs the XR service in a sandbox that allows SteamVR's sockets. The Frame does have an aarch64 runtime: `~/.config/openxr/1/active_runtime.json` → SteamVR `bin/linuxarm64/vrclient.so`. To watch in 3D, use a native player, or a Chromium built with those two CLs ([webxr-chromium.md](webxr-chromium.md)). Started with `--remote-debugging-port=9222`, Chromium answers DevTools on loopback. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | Web video, [panels.md](panels.md) |
+| Chromium Flatpak 154 has **no immersive WebXR**: `navigator.xr` exists, but `isSessionSupported("immersive-vr")` returns `false`. Web VR180 players (DL8/DeoVR embeds) still play video inline as a flat, pannable view, and their VR button opens a tab on immersiveweb.dev. Forcing it doesn't help. `--enable-features=OpenXR,WebXR --force-webxr-runtime=openxr`, with `/opt/steamvr` and `XR_RUNTIME_JSON` exposed to the Flatpak, still returns `false`. The aarch64 Linux binary has no OpenXR code at all (no `XR_RUNTIME_JSON`, `xrGetInstanceProcAddr` or loader strings), even though `chrome://flags` lists `#webxr-runtime` → OpenXR. **Why (verified against source 2026-09-25):** M154 is the first release that compiles OpenXR on Linux (`enable_openxr` includes `is_linux`, `checkout_openxr` is true in Flathub's tarball, and Flathub's GN args don't turn it off). But `content/services/isolated_xr_device/xr_runtime_provider.cc` only creates an OpenXR device under `ENABLE_OPENXR && IS_WIN`, on 154, 155 and `main`. Nothing on Linux calls the OpenXR code, so the linker drops it. The missing pieces are two unmerged Gerrit CLs (bug 506004811): [8132979](https://chromium-review.googlesource.com/c/chromium/src/+/8132979) wires the provider on Linux (with `kOpenXR` still off by default, so it needs `--enable-features=OpenXR`), and [8441736](https://chromium-review.googlesource.com/c/chromium/src/+/8441736) runs the XR service in a sandbox that allows SteamVR's sockets. The Frame does have an aarch64 runtime: `~/.config/openxr/1/active_runtime.json` → SteamVR `bin/linuxarm64/vrclient.so`. To watch in 3D, use a native player, or a Chromium built with those two CLs ([webxr-chromium.md](webxr-chromium.md)). That build (156.0.8071.0, arm64) reports `immersive-vr` as supported and starts a session that SteamVR takes as its scene app. With the headset on, the WebXR samples scene and three.js's stereo 360 video demo showed in 3D (verified 2026-09-26, seccomp sandbox off). Started with `--remote-debugging-port=9222`, Chromium answers DevTools on loopback. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | Web video, [panels.md](panels.md) |
 | **DeoVR (Steam app 837380, Windows/Unity) runs immersively** under Proton ARM64 + FEX: Unity's OpenVR XR plugin finds `OpenVR Headset(Steam Frame)` and the `frame_controller`, the GPU shows as Turnip Adreno 750, and AVPro Video decodes through `MF-MediaEngine-Hardware`. It played 7680×3840 and 8192×4096 H.265 VR180 SBS streams in dome/fisheye mode (`FirstFrameReady`). Unity's own `VideoPlayer` (used for grid thumbnails) fails with `0xc00d36bb`, so thumbnail previews stay blank. The first launch takes about 45 s (`ComputeShaders: InitAsync`). Log: `compatdata/837380/pfx/drive_c/users/steamuser/AppData/LocalLow/Deo VR/Deo VR/Player.log`. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | [vr-video.md](vr-video.md) |
 | **Wolvic (VR browser APK) runs in Lepton against SteamVR's OpenXR**, with limits. The stock Lynx build aborts (`Runtime doesn't support selected swapChain color format`: it wants `GL_RGBA8`), and the stock Quest build fails with `XR_ERROR_API_VERSION_UNSUPPORTED`. Patching `DeviceDelegateOpenXR::GetSwapChainCreateInfo` in the Lynx build's `libnative-lib.so` to `GL_SRGB8_ALPHA8` (0x8C43) and re-signing fixes start-up. The Gecko engine then segfaults in `libxul`. The Chromium-engine build (Lynx v1.3-chromium) browses fine as an immersive app. Its page reports `isSessionSupported("immersive-vr") == true`, and `requestSession` succeeds, running about 36 rAF/s, but the headset shows **black** for WebXR content, or Wolvic's loading spinner that never clears, until the session is ended. Video decodes on the software `OMX.google.h264.decoder`. Tapping the URL bar's selection menu crashes it (no clipboard service). Open URLs with `am start -a VIEW -n com.igalia.wolvic/.VRBrowserActivity -d <url>` over the instance's ADB. DevTools is at `localabstract:content_shell_devtools_remote`. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | Web VR video, [apks.md](apks.md) |
 | Tailscale runs without root as a userspace `tailscaled` user service (static arm64 build in `~/.local/share/tailscale`, lingering on). In userspace mode, inbound tailnet connections reach the Frame's **loopback**, so every port, including DevTools on 8080, is reachable from the tailnet. **Verified 2026-09-25.** | [tailscale.md](tailscale.md), `scripts/tailscale-on-frame.sh` |
+| **T3 Code desktop runs natively.** The stock release `T3-Code-0.0.42-arm64.AppImage` in `~/Applications/T3CodeDesktop/` starts with no extra setup: glibc 2.39, `libfuse.so.2`, GTK 3, NSS and libsecret are on the image. `panel-on-frame.sh --name t3code-desktop -- '~/Applications/T3CodeDesktop/T3-Code.AppImage'` gives it its own panel (`valve.steam.desktopgame.2000281357`, `--ozone-platform=x11`). Its bundled server listens on `127.0.0.1:3773` and shows up in onboarding as the `frame` computer, with `passwordStore: gnome-libsecret`. The image has no agent CLI and no `node`. Agents run through the LAN CLIProxyAPI (`llm-proxy.lan:8317`, which resolves on the Frame). Claude Code 2.1.283 comes from `claude.ai/install.sh`, and Codex 0.157.1 from the `codex-aarch64-unknown-linux-musl` release tarball, both into `~/.local/bin`. `with-cliproxy` and a mode-600 `~/.config/cliproxyapi/secrets.env` are copied from the Mac. The wrappers `claude-cliproxy` and `codex-cliproxy` (a `-c model_provider=cliproxy`, `wire_api="responses"`, `env_key="CLIPROXY_API_KEY"`) are set as `providers.claudeAgent.binaryPath` and `providers.codex.binaryPath` in `~/.t3/userdata/settings.json`, and T3 picked that up without a restart. Through the wrappers, `claude auth status` reports `loggedIn: true` (`oauth_token`), and both CLIs answered a prompt with `kimi-k3`. `gamescopectl screenshot` captured another layer (the Lepton T3 app) rather than this panel. `DISPLAY=:0 xwd -id <win>` piped to `ffmpeg` captures the window itself (1920×1080). **Verified 2026-09-26**, BUILD_ID 20260922.6101926. | Running T3 Code as a host on the Frame |
 | Power actions need `sudo`, which asks for the Developer Mode password over SSH. | Frame Control's power buttons |
+| **SSH server:** OpenSSH 9.7p1. It offers `publickey,password` (keyboard-interactive is off, PAM on) and also asks `userdbctl ssh-authorized-keys` for keys. OpenSSH ≥ 8.8 rejects SHA-1 `ssh-rsa` signatures by default, so a client whose RSA support is SHA-1 only (the Swift library Citadel, for one) can't log in with the RSA key that devkit pairing installs; use ed25519 (**inferred** from OpenSSH defaults). **Verified 2026-09-27**, BUILD_ID 20260922.6101926. | [iphone.md](iphone.md), `ui/frame_connect.py` |
+| **Tools on the image:** Python 3.12.3, `ffmpeg`, `openssl`, `curl`, `rsync`, `zip`/`unzip`, `flatpak`, `wpctl`, `podman`. **No `adb`.** `steamos` is uid 1000, in `wheel`, and sudoers has `%wheel ALL=(ALL) ALL`, so `sudo -S` takes the Developer Mode password on stdin. **Verified 2026-09-27.** | Running Frame Control's server on the Frame (`FRAME_LOCAL=1`, [iphone.md](iphone.md)) |
+| **Each Lepton instance is a podman container** named `lepton-steamlaunch-<instance id>`, labelled with its ADB port (`podman ps --format '{{.Names}} {{.Labels.adb_port}}'`). `podman exec <container> /system/bin/sh -c '…'` runs Android's shell inside it with no adb at all (used for `pidof` and `logcat` by the app tester). Running `wm size`/`wm density` that way is untested. **Verified 2026-09-27.** | `ui/frame_android.py`, the iPhone app's display settings |
+| **Asleep means off the network.** In standby the Frame stops answering on its LAN address, `frame.local` and Tailscale alike (`Host is down`, `No route to host`, timeouts), and ping fails. It was unreachable for about 2.5 hours until woken. Nothing over SSH can wake it. **Verified 2026-09-27.** | Frame Control's offline banner and retries |
+| **Battery at full on a charger** can read `Discharging` at about 0 W (for example 99 %, 0.0 W, USB-C PD 18 W). Treat under 0.5 W on a charger as "not charging", not "draining". **Verified 2026-09-27.** | Frame Control's battery card |
+| **The OS image is downloadable.** Valve's recovery images for the Frame are at `https://steamdeck-images.steamos.cloud/recovery/`. The root filesystem inside is btrfs, and it runs as an SSH test target on ARM64 Linux without the headset (`tests/frame-container/frame-image.sh`). **Verified 2026-09-27.** | [recovery-and-images.md](recovery-and-images.md) |
+| **Boot / recovery menu.** Hold Power ~10 s until the LED goes off, then power on while holding the **AUX button on top of the Power button** (not the volume keys) until a text menu appears. Entries: `Current` (SteamOS-A/B + build), `Previous` (the other A/B slot), `Boot from USB`, `Repair Steam Installation`, `Erase User Data` (factory reset), `ADB mode`, `Battery Ship Mode`. It auto-boots `Current` after a ~15 s countdown. **Volume Up/Down (left side) move, AUX (right side) selects.** For a boot loop, Valve says pick `Previous` (keeps user data); then `Repair Steam Installation`; `Erase User Data` wipes `~` (SSH keys, Tailscale, Flatpaks, T3 setup). Last resort is a full re-image, two ways: (1) USB: write `steamframe-oobe-repair-<build>.img.bz2` to an 8 GB+ USB-C stick (Balena Etcher on the Mac), pick `Boot from USB`, then use "Wipe Device & Install SteamOS" / "Repair SteamOS" (keeps games and personal content) from the recovery desktop; (2) cable/EDL: `steamframe-oobe-repair-qdl-<build>.tar.gz`, run `flash.sh` (Linux) or `flash.cmd` (Windows), then with the Frame off for 10 s hold Power + Vol Up + Vol Down for 10 s and plug it in; it reflashes and reboots. Both images: `https://steamdeck-images.steamos.cloud/recovery/` (build 20260922.5153644, 0.3.0, 3.8 GiB each, no published checksums); local copies in `~/Downloads/steam-frame-recovery/`. File names, checksums and what's inside: [recovery-and-images.md](recovery-and-images.md). Source: Valve's [SteamOS Recovery FAQ](https://help.steampowered.com/en/faqs/view/1B71-EDF2-EB6D-2BB3) and [Installation and Repair FAQ](https://help.steampowered.com/en/faqs/view/65B4-2AA3-5F37-4227), plus a menu photo in [EloiStree/HelloSteamFrame#9](https://github.com/EloiStree/HelloSteamFrame/issues/9). **Inferred** (Valve docs, 2026-09-26); not yet tried on our Frame. | Recovering from a boot loop |
+| **Boot loop cause: the SteamVR health check.** `steamvr.service` runs `/usr/share/deckard/steamvr-health-check`, which appends `frog:glasses:` to `$XDG_RUNTIME_DIR/steamvr-short-session-tracker` on every failed or <10 s SteamVR run. At 3 it runs `steam-health-check --repair-now`, which **deletes all of `~/.local/share/Steam` (games, login, Developer Mode) and `~/.steam`**, keeping only `registry.vdf`. At 4 it also tries `steamos-bootconf set-mode reboot-other` (fails as the user: `bootenv: Permission denied`). SteamVR normally fails 1–2 times per boot while it waits for the Steam client (`SteamAPI_InitEx failed … Steam is probably not running`, then `fatal stalled cross-thread pipe`). Once Steam has been wiped, it has to re-download a ~210 MB client on every boot, so SteamVR keeps failing, Steam keeps getting wiped and the Frame reboots, in a loop. Also, the Steam updater can deadlock at `Installing update...` (main process blocked writing to the `-child-update-ui` process, which is stuck in `drm_syncobj_array_wait_timeout`). Killing only the `-child-update-ui` process lets the install finish (`package/*.installed` appears). **Fix without sudo:** over USB-C ADB (`adb -s frame shell` works as `steamos` while the Frame is looping; SSH is refused once Developer Mode is lost), truncate both `/run/user/1000/steam{,vr}-short-session-tracker` files and `chmod 444` them (the health check then logs `Permission denied` and does nothing; this is tmpfs, so it resets on reboot). Unstick the updater if needed, let Steam finish installing, then hold Power 10 s and start the Frame normally. `systemctl reboot` over ADB needs interactive auth. After the fix, sign in to Steam and turn Developer Mode back on. **Verified 2026-09-26**, BUILD_ID 20260922.6101926, slot B (clean boot: 0 SteamVR failures, SSH and Tailscale back). | Diagnosing a boot loop |
 
 ## Debug recipes
 
@@ -75,4 +85,6 @@ ssh frame 'cat /opt/steamvr/resources/webinterface/dashboard/localization/dashbo
 - Installing and buying Steam games: [steam-games.md](steam-games.md)
 - Remote access from anywhere: [tailscale.md](tailscale.md)
 - Floating windows in space: [panels.md](panels.md)
+- Recovery images, what's in them, testing without the headset: [recovery-and-images.md](recovery-and-images.md)
+- Frame Control on iPhone (the server running on the Frame itself): [iphone.md](iphone.md)
 - What's still unverified: [open-questions.md](open-questions.md)

docs/install.html

@@ -0,0 +1,63 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>Install with Frame Control</title>
+<!-- Landing page for install links (docs/web-install.md): install.html?manifest=URL
+     or ?url=URL opens frame-control://install?… and offers the download if the
+     app doesn't open. Static, no requests of its own. Not published yet. -->
+<style>
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #0d1117; color: #e6edf3;
+         font: 15px/1.5 -apple-system, "Segoe UI", sans-serif; }
+  main { max-width: 520px; padding: 32px; }
+  h1 { font-size: 20px; margin: 0 0 8px; }
+  p { color: #8b98a8; }
+  code { color: #e6edf3; overflow-wrap: anywhere; }
+  a.btn { display: inline-block; margin: 8px 12px 0 0; padding: 9px 16px; border-radius: 3px; text-decoration: none;
+          background: #2d333b; color: #e6edf3; }
+  a.btn.go { background: #1a9fff; color: #fff; font-weight: 600; }
+  .err { color: #ff7b72; }
+  [hidden] { display: none !important; }
+</style>
+</head>
+<body>
+<main>
+  <h1>Install with Frame Control</h1>
+  <p id="what"></p>
+  <p id="bad" class="err" hidden>This link doesn't name an https:// manifest or file, so there's nothing to install.</p>
+  <div id="actions" hidden>
+    <a class="btn go" id="open">Open in Frame Control</a>
+    <a class="btn" href="https://github.com/saphid/steam-frame/releases/latest">Get Frame Control</a>
+  </div>
+  <p id="missing" hidden>Nothing happened? Frame Control isn't installed on this computer, or is older than the
+    version that handles install links. Get it, open it once, then use the link again.</p>
+</main>
+<script>
+(() => {
+  const q = new URLSearchParams(location.search);
+  const kind = q.has("manifest") ? "manifest" : q.has("url") ? "url" : null;
+  const target = kind && q.get(kind);
+  let ok = false;
+  try {
+    const u = new URL(target);
+    const local = ["localhost", "127.0.0.1"].includes(u.hostname);
+    ok = !u.username && !u.password && (u.protocol === "https:" || (u.protocol === "http:" && local));
+  } catch {}
+  if (!ok) { document.getElementById("bad").hidden = false; return; }
+  const link = `frame-control://install?${kind}=${encodeURIComponent(target)}`;
+  document.getElementById("what").textContent = `From ${new URL(target).hostname}. Frame Control shows what it will `
+    + "install and asks you before downloading anything.";
+  document.getElementById("open").href = link;
+  document.getElementById("actions").hidden = false;
+  // If the app opens, this page loses focus or is hidden; if not, say how to get it.
+  let left = false;
+  window.addEventListener("blur", () => { left = true; });
+  document.addEventListener("visibilitychange", () => { if (document.hidden) left = true; });
+  setTimeout(() => { if (!left) document.getElementById("missing").hidden = false; }, 2000);
+  location.href = link;
+})();
+</script>
+</body>
+</html>

docs/iphone.md

@@ -0,0 +1,109 @@
+# Frame Control for iPhone
+
+The iPhone (and iPad) app does what the desktop app does, from the phone:
+headset view and live video, battery and status, screenshots, Steam games,
+Android apps and their display settings, sideloading, files, clipboard,
+Flatpaks, and power. Source: [`ios/`](../ios).
+
+## How it works
+
+An iPhone can't run Python or `ssh`, but the Frame can. So the app:
+
+1. connects to the Frame over SSH itself (the [Citadel](https://github.com/orlandos-nl/Citadel)
+   Swift SSH library), with its own ed25519 key from the Keychain;
+2. copies Frame Control's server and helpers (`ios/scripts/make_frame_bundle.py`,
+   under 1 MB) to `~/.cache/frame-control/<version>` on the Frame, once per version;
+3. starts `ui/server.py` there with `FRAME_LOCAL=1`. It listens only on the
+   Frame's own 127.0.0.1, and it stops when the phone disconnects (`--exit-on-eof`);
+4. tunnels to it through the SSH session and shows the same page as the desktop
+   app, in a web view. The page carries a fresh key each session, which the
+   server requires on every request.
+
+With `FRAME_LOCAL=1`, every `ssh frame COMMAND` the server runs goes to
+`ui/local-bin/ssh`, which runs the command on the Frame directly (rsync uses it
+as its transport too), so the desktop and phone share one code path. Android
+display settings use `podman exec` into each Lepton container instead of adb,
+which the Frame doesn't have.
+
+Nothing is left running on the Frame after the phone disconnects; the copied
+files stay in `~/.cache/frame-control` (delete it any time).
+
+## Pairing
+
+On the Frame, turn on Developer Mode and set a user password (Steam Settings →
+System, then Developer → Set User Password). In the app, enter the headset's
+address (`frame.local`, its IP, or its Tailscale name) and that password once.
+The app adds its own key to `~/.ssh/authorized_keys` and remembers the Frame's
+host key; the password isn't saved. If you already reach the Frame over SSH,
+**Or add the key yourself** shows the phone's key to paste into
+`authorized_keys`, and connects without a password.
+
+Valve's tap-to-approve devkit pairing isn't used: it only takes RSA keys, and
+the Frame's OpenSSH 9.7 rejects the SHA-1 RSA signatures the Swift SSH library
+makes.
+
+## What's different on the phone
+
+| Desktop | iPhone |
+|---|---|
+| Drop files anywhere | Tap **Send to Frame** (or Add a game) and pick files; folders need zipping |
+| Screenshots save to `~/Pictures/SteamFrame` | Save opens the share sheet: Save Image puts it in Photos |
+| SSH and SFTP open a terminal | They open an app that handles `ssh://` / `sftp://` (Blink Shell, Termius) |
+| Steam Link, remote desktop | Open the Steam Link and Windows App apps |
+| Sleep, restart, shut down ask in a terminal | The page asks for the Developer Mode password |
+| Compatibility reports kept on the computer | Kept on the Frame (`~/.local/share/Frame Control`) |
+
+## Building
+
+```sh
+cd ios
+xcodegen generate          # after changing project.yml
+open FrameControl.xcodeproj
+```
+
+The build packs the Frame bundle from the checkout, so the phone always runs
+the page and server from the same commit. Running on a phone needs your own
+signing team in Xcode (Signing & Capabilities).
+
+## Verified
+
+<img src="img/iphone-tabs.jpg" alt="The four tabs in the iPhone app, connected to a Frame" width="900">
+
+In the iOS Simulator (iOS 26.5) against a real Frame, 2026-09-27: the app connected
+with its key, copied the bundle over SFTP, started the server on the Frame and
+showed all four tabs with live data. In the app's web view, Capture returned a
+headset still and Live played H.264 video at 31 fps (WebCodecs works in
+WKWebView). Through the app's tunnel: status, games, Steam library, Android apps,
+screenshots, a file upload (checked on the Frame), a background install job, and
+the power password check (a wrong password is refused). The server on the Frame
+exits within seconds of the app closing.
+
+Against Valve's own Steam Frame OS (SteamOS 0.3.0 build 20260922.5152327, the
+`rootfs-A` partition of the Frame recovery image, run with its own sshd; see
+[tests/frame-container](../tests/frame-container)), and a Holo Core stand-in:
+pairing with the password (key added with the right
+permissions, host key pinned, password stored nowhere), the power password
+check (a wrong or missing password refused; the right one reaches `systemctl`),
+a changed host key refused with "Pair with the Frame again", and a wrong
+pairing password reported the same way.
+
+Also verified in the Simulator against the Frame (2026-09-27): the setup screen
+found the Frame by itself over Bonjour (`frame · 192.168.1.237`); a paired app
+waiting for a sleeping Frame connected 4 s after it answered; an upload from the
+app's web view landed in `~/Downloads`; the share sheet offers Save Image
+(needs `NSPhotoLibraryAddUsageDescription`, now declared); an install link opens
+the confirm dialog and downloads nothing until Install; Steam Link without the
+app installed opens its App Store page.
+
+Things iOS asks the first time: **Local Network** (tap Allow, or the app can't
+see the Frame), and **Paste** when you send the iPhone's clipboard (tap Allow
+Paste, or set Settings → Apps → Frame Control → Paste from Other Apps → Allow).
+Sending text to the Frame's clipboard needs the desktop panel open in the
+headset, as on the desktop app.
+
+Not yet exercised: Android display changes through podman (no Android app was
+running), a real sleep/restart/shut down on the Frame, and a physical iPhone.
+
+Debug builds have Simulator test hooks (`FRAME_TEST_HOST`, `FRAME_TEST_PAGE`,
+`FRAME_TEST_JS`, and the tunnel URL in the app's Caches folder); release builds
+don't.

docs/open-questions.md

@@ -33,14 +33,19 @@ build 20260922.6101926, kernel 6.18, aarch64):
 - **10.** `install-apps.sh remmina --vnc-host <mac>.local` installed Remmina as
   a `--user` Flatpak over SSH and wrote the profile. The desktop's
   `XDG_DATA_DIRS` includes the user Flatpak exports, so it shows up in the menu.
-  The Frame can reach the Mac's Screen Sharing port (5900). The Remmina
-  connection itself hasn't been tried in the headset yet (part of 11).
+  The Frame can reach the Mac's Screen Sharing port (5900).
+- **11.** Answered 2026-09-27 (BUILD_ID 20260925.6191901, macOS 27.0): the
+  pre-seeded profile connects and shows the Mac in its own panel. It asks for
+  the Mac account login rather than the VNC password, needs scale-to-fit at
+  Retina resolutions, and doesn't show the Mac cursor without
+  `scripts/mac-cursor-ring.lua`. It's usable but noticeably laggy. See
+  [streaming.md](streaming.md).
 
 - **Panels.** An X11 window on gamescope's `:0` with its own `STEAM_GAME` id
   gets its own SteamVR overlay (`valve.steam.desktopgame.<id>`). Three were
   created side by side with `panel-on-frame.sh`. See [panels.md](panels.md).
 
-Still open: 4, 6, 7, 11 (in-headset connect), 12–15, 16 (off-LAN and after a reboot), 17–21.
+Still open: 4, 6, 7, 12–15, 16 (off-LAN and after a reboot), 17–21.
 
 ## Check on the headset (in order)
 
@@ -70,12 +75,10 @@ Still open: 4, 6, 7, 11 (in-headset connect), 12–15, 16 (off-LAN and after a r
    `ssh frame 'command -v wl-copy xclip rsync flatpak'`.
 10. **Can Flatpaks be installed `--user` over SSH, and do they appear in the
     headset's desktop?** Test with `./scripts/install-apps.sh remmina`.
-11. **Remmina → macOS Screen Sharing:** does it connect, and is it usable at
-    Retina resolutions? Is the pre-seeded profile path
-    (`~/.var/app/org.remmina.Remmina/data/remmina/`) the one Remmina
-    actually reads?
-12. **Moonlight Flatpak (aarch64) + Sunshine on macOS:** worth trying only if
-    VNC is too slow.
+11. ~~**Remmina → macOS Screen Sharing**~~: answered 2026-09-27; see above
+    and [streaming.md](streaming.md).
+12. **Moonlight Flatpak (aarch64) + Sunshine on macOS:** VNC works but is
+    noticeably laggy, so this is worth trying.
 13. **KDE Connect**: is it preinstalled or installable on the Frame, and does
     it pair with KDE Connect for macOS?
 14. **Bluetooth keyboard pairing** on the Frame, for the rare times you do need
@@ -86,8 +89,9 @@ Still open: 4, 6, 7, 11 (in-headset connect), 12–15, 16 (off-LAN and after a r
     runs as a lingering user service with no sudo; see [tailscale.md](tailscale.md).
     Still open: reaching the Frame from outside the home network, and the service
     starting after a reboot.
-17. **Floating panels in the headset** (see [panels.md](panels.md)): do the
-    panels from `panel-on-frame.sh` show up, take input, and offer **Float in
+17. **Floating panels in the headset** (see [panels.md](panels.md)): panels
+    from `panel-on-frame.sh` show up and take controller input (verified
+    2026-09-27 with `mac-screen`). Still open: do they offer **Float in
     World** / **Move** / **Size**? Do floating positions survive closing and
     reopening the app, or a reboot?
 18. **`LEPTON_NO_CLEANUP=1 %command%`** as Lepton Development's launch
@@ -103,12 +107,32 @@ Still open: 4, 6, 7, 11 (in-headset connect), 12–15, 16 (off-LAN and after a r
     the colour-coded test clips play in 3D (red left eye, cyan right) for both
     H.264 and H.265? Does the DLNA browser find a server on the Mac?
 
+## Verified 2026-09-27
+
+- **Recovery images exist** for the Frame at
+  `https://steamdeck-images.steamos.cloud/recovery/`; the root filesystem inside
+  is btrfs and runs, as a userland, on ARM64 Linux. See
+  [recovery-and-images.md](recovery-and-images.md).
+- **Frame Control's server runs on the Frame itself** (the iPhone app does
+  this), including headset capture, 31 fps live video and file uploads. See
+  [iphone.md](iphone.md).
+- **Password pairing and `sudo -S`** work against the recovery image's own
+  sshd and sudo (not yet against the headset, whose password we don't hold).
+
+## Still open (2026-09-27)
+
+- Does `podman exec <lepton container> /system/bin/sh -c 'wm size'` change an
+  instance's display the way `adb shell wm size` does?
+- Can the recovery image, or its kernel, boot in a VM at all?
+- Does a real sleep, restart or shut down from the iPhone app work (via
+  `sudo -S systemctl`)?
+- The Mac EDL flashing script in `~/Downloads/steam-frame-recovery/` hasn't
+  been run against a Frame.
+
 ## Unconfirmed claims made in these docs
 
 - `/home` and `/etc` persist across Frame OS updates. This is inferred from
   Steam Deck behaviour.
-- The whole Mac → Frame desktop path (VNC → Remmina). Each part is documented
-  separately, but the combination is untested.
 - Steam Remote Play with a Mac as host is broken. That's based on community
   reports, not tested with the Frame.
 - `connect.sh --harden`, `serve-bootstrap.sh` and

docs/recovery-and-images.md

@@ -0,0 +1,109 @@
+# Recovery images and OS images for the Frame
+
+Where to get the Steam Frame's operating system, what's inside it, and how to
+run it for testing without the headset. For recovering a Frame that won't boot,
+see the boot menu and boot-loop entries in
+[how-the-frame-works.md](how-the-frame-works.md#facts-worth-knowing).
+
+## Downloads
+
+Valve's SteamOS download page (`store.steampowered.com/steamos/download`)
+redirects to the [Installation and Repair FAQ](https://help.steampowered.com/en/faqs/view/65B4-2AA3-5F37-4227),
+which offers the Steam Deck image. The **Steam Frame images are on the same
+server** but aren't linked from that page:
+**https://steamdeck-images.steamos.cloud/recovery/** (a plain directory
+listing, checked 2026-09-27).
+
+| File | Size | Use |
+|---|---|---|
+| `steamframe-oobe-repair-20260922.5153644-0.3.0.img.bz2` (or `.img.zip`) | 3.8 GiB | Write to an 8 GB+ USB-C stick, then **Boot from USB** in the Frame's boot menu |
+| `steamframe-oobe-repair-qdl-20260922.5153644-0.3.0.tar.gz` (or `.zip`) | 3.8 GiB | Flash over a USB-C cable in Qualcomm EDL mode with `flash.sh` (Linux) or `flash.cmd` (Windows), which use [qdl](https://github.com/linux-msm/qdl). **Wipes everything** |
+
+All four are dated 2026-09-22. Everything else there is for the Steam Deck
+(`steamdeck-…`, x86-64), which won't run on the Frame. Valve publishes **no
+checksums**. These are the SHA-256s of our downloads (2026-09-26), which passed
+`bzip2 -t` and `tar -t`:
+
+```
+3a4a077f1b1f40688ab3279affcb56776bd97c54db1573e7c65fc52a97106676  steamframe-oobe-repair-20260922.5153644-0.3.0.img.bz2
+d3323bfa8efe9ece1954948421cdf5f705e8942eb50c960e2916d935d1b850ab  steamframe-oobe-repair-qdl-20260922.5153644-0.3.0.tar.gz
+```
+
+Our copies, with a Mac EDL flashing script built on qdl (untested), are in
+`~/Downloads/steam-frame-recovery/` on the Mac.
+
+## What's inside the USB image
+
+A GPT disk with 512-byte sectors and one A slot (a Frame has A and B slots;
+the installer makes the rest). **Verified 2026-09-27** from
+`steamframe-oobe-repair-20260922.5153644-0.3.0.img.bz2`:
+
+| # | Name | Start sector | Size | Type GUID |
+|---|---|---|---|---|
+| 1 | `esp` | 34 | 256 MiB | `c12a7328-f81f-11d2-ba4b-00a0c93ec93b` (EFI system) |
+| 2 | `efi-A` | 524322 | 64 MiB | `ebd0a0a2-b9e5-4433-87c0-68b6b72699c7` |
+| 3 | `rootfs-A` | 655394 | 5120 MiB | `4f68bce3-e8cd-4db1-96e7-fbcaf984b709` |
+| 4 | `var-A` | 11141154 | 256 MiB | `4d21b016-b534-45c2-a9fb-5c16e091fd2d` |
+| 5 | `home` | 11665442 | 100 MiB | `933ac7e1-2eb4-4f13-b844-0e14e2aef915` |
+
+The partitions start at sector 34, not on MiB boundaries, so compute offsets
+from the table (sector × 512), not from rounded sizes. `rootfs-A` is **btrfs**
+(label `rootfs-A`, 9.2 GB of files), mounted read-only on the Frame.
+Its `/etc/os-release` says `NAME="SteamOS"`, `ID=steamos`, `ID_LIKE=arch`,
+`VERSION_CODENAME=holo`; the running system reports version 0.3.0, variant
+`vr`, build **20260922.5152327**, which is a different number from the
+`5153644` in the file name. Our headset reports build 20260922.6101926.
+
+Inside, it matches a real Frame:
+
+- User `steamos` (uid 1000) is in `wheel` (gid 998), and sudoers has
+  `%wheel ALL=(ALL) ALL`, so sudo asks for the Developer Mode password.
+- `sshd_config` includes `sshd_config.d/*.conf`, uses `.ssh/authorized_keys`
+  plus `AuthorizedKeysCommand /usr/bin/userdbctl ssh-authorized-keys %u`,
+  and sets `KbdInteractiveAuthentication no` and `UsePAM yes`. So sshd offers
+  `publickey,password`, the same as the headset.
+- `/usr/bin` has `sshd`, `sudo`, `python3` and `podman`.
+
+Get just the root filesystem without unpacking the whole 5.8 GB image (the
+partition's start and size, in sectors, come from the table above):
+
+```sh
+bzcat steamframe-oobe-repair-*.img.bz2 | tail -c +$((655394 * 512 + 1)) | head -c $((10485760 * 512)) > rootfs-A.img
+```
+
+A Mac can't mount btrfs; a Linux machine or VM can (`mount -o ro -t btrfs`).
+
+## Running it without the headset
+
+The image can't boot in a generic virtual machine: its kernel and bootloader
+are built for the Frame's Qualcomm Snapdragon 8 Gen 3 (**inferred**; not
+attempted). Its **userland** runs fine on any ARM64 Linux, which covers
+anything that talks to the Frame over SSH.
+
+[`tests/frame-container/frame-image.sh`](../tests/frame-container/frame-image.sh)
+extracts `rootfs-A`, mounts it read-only with a throwaway writable layer, and
+starts the image's own `sshd` on port 2223 (user `steamos`, a test password;
+`systemctl` only records requests). On a Mac, run it in Colima's ARM64 VM (see
+[tests/frame-container/README.md](../tests/frame-container/README.md)).
+**Verified 2026-09-27:** the iPhone app paired with it by password (the image's
+sshd logged `Accepted password`, then `Accepted publickey … ED25519`), ran
+Frame Control's server on the image's Python, and the image's sudo rejected a
+wrong power password and passed the right one to `systemctl`. Without the
+Frame's hardware there's no SteamVR, Steam client, battery or Lepton, so those
+parts stay untested this way.
+
+## Holo Core aarch64 (Valve and Collabora)
+
+The ARM64 port of Arch Linux that the Frame's SteamOS is built on, published as
+a preview in July 2026 ([Collabora's announcement](https://www.collabora.com/news-and-blog/news-and-events/building-an-arch-linux-aarch64-port-for-holo-core.html)).
+It's a base system and build environment, not the Frame's OS:
+
+- Source: `https://gitlab.steamos.cloud/holo/holo-core-aarch64-preview`
+- Packages: `https://holo-packages.steamos.cloud/holo-core-aarch64-preview/mash-20251118`
+- Container: `registry.gitlab.steamos.cloud/holo/holo-core-aarch64-preview/base-devel:latest`
+  (1.7 GB; `/etc/os-release` says "Holo core Aarch64 port (preview)"; `pacman`
+  installs OpenSSH 10.2, Python 3.13 and sudo from its repositories. Checked 2026-09-27.)
+
+[`tests/frame-container/Dockerfile`](../tests/frame-container/Dockerfile) builds a
+lighter Frame stand-in on it (a `steamos` user with a password and sudo, sshd
+with keys and passwords), handy when you don't have the 4 GB image.

docs/scripts.md

@@ -0,0 +1,106 @@
+# Scripts and headset setup
+
+The command-line side of this repo: how SSH gets set up with as little typing on
+the headset as possible, what to use for each job, and the helper scripts that
+Frame Control is built on. The scripts are zsh/bash and run on macOS; most also
+run on Linux. On Windows, use the app.
+
+## Minimum typing on the headset
+
+Valve's own developer docs say SSH, ADB, and RDP are all turned on through a
+**UI toggle**. You don't need a terminal, `passwd`, or `systemctl`. The only
+thing you type on the headset is a password you choose.
+
+On the Frame:
+
+1. **Steam Settings → System → Enable Developer Mode** (a toggle, no typing).
+2. Scroll down to the **Developer** section and click **Set User Password**.
+   Type a password. **This is the only thing you type on the headset.** Pick
+   something short, because you'll type it once more on the Mac and then
+   never again.
+3. (Optional, no typing) Note the IP address from **Quick Settings** or
+   **Steam Settings → Internet**, in case `frame.local` doesn't resolve.
+4. (Optional) Check **Steam Settings → System → Hostname**. Leaving it as
+   `frame` means the scripts work without any extra setup.
+
+On the Mac:
+
+To use the scripts from a checkout instead of the app:
+
+```sh
+git clone https://github.com/saphid/steam-frame.git && cd steam-frame
+./scripts/connect.sh              # or: ./scripts/connect.sh 192.168.1.50
+ssh frame                          # passwordless from now on
+```
+
+`connect.sh` does four things:
+
+- finds the headset (`frame.local`, then `frame`, or the IP/host you pass in)
+- creates dedicated keys (`~/.ssh/id_ed25519_frame`, plus `~/.ssh/id_rsa_frame_devkit` for pairing)
+- adds a `Host frame` block to `~/.ssh/config`
+- tries SteamOS devkit pairing (approve on the headset, no password; **inferred**,
+  see [SSH](ssh.md#password-free-pairing-steamos-devkit-service)), else runs
+  `ssh-copy-id`, which asks for the Developer Mode password once
+
+Run `./scripts/connect.sh --harden` later if you want to turn off SSH password
+logins.
+
+Sources: [Valve: Setting up your Steam Frame for development](https://partner.steamgames.com/doc/steamhardware/steamframe/setup),
+[Valve: Steam Frame Debugging](https://partner.steamgames.com/doc/steamhardware/steamframe/debugging)
+(both **confirmed on Steam Frame**, Valve official).
+
+**Fallback, only if the Developer Mode toggle doesn't give you SSH.** From the
+Mac, run `./scripts/serve-bootstrap.sh`. It prints a one-liner of about 30
+characters, like `curl -fsS mac.local:8765|bash`, to type into Konsole on the
+Frame's Linux desktop. The script it serves installs your Mac's public key and
+enables `sshd`. See [docs/ssh.md](ssh.md#fallback-bootstrap-one-liner).
+
+## Recommended options
+
+| Goal | Recommended | Confidence |
+|---|---|---|
+| Shell on the Frame | `ssh frame` (user `steamos`) | Confirmed (Valve docs) |
+| **See/control the Frame from the Mac** | **Steam Link for macOS → connect to `frame`** (Valve names this). Alternatives: RDP to `xrdp` with Microsoft *Windows App* for the Linux desktop, or `adb`/`scrcpy` for the Android (Lepton) layer only | Steam Link and xrdp confirmed on Frame; the Mac RDP client is inferred |
+| **Show the Mac's desktop inside the Frame** | **macOS Screen Sharing (built-in VNC) → Remmina (Flatpak, aarch64) on the Frame's Linux desktop**, installed over SSH | Inferred: each piece is documented, but the combination hasn't been tested on a Frame |
+| File transfer | `scp` / `rsync` over the `frame` alias (`scripts/push.sh`) | **Verified** (rsync is on the image) |
+| Paste Mac clipboard into the headset | `scripts/paste-to-frame.sh` (`pbpaste` → `ssh` → Klipper over D-Bus), or the clipboard sync in an RDP session | **Verified** (script); RDP untested |
+
+Details: [docs/ssh.md](ssh.md), [docs/streaming.md](streaming.md),
+[docs/file-transfer.md](file-transfer.md),
+[docs/open-questions.md](open-questions.md). For how the Frame's software
+fits together, see [docs/how-the-frame-works.md](how-the-frame-works.md).
+
+## Windows anywhere in the room
+
+The in-headset Linux desktop is a single 1280×800 panel, and its windows can't
+leave it. Each Steam app, though, gets its own SteamVR panel. That also works
+for any Linux app tagged with an app id of its own:
+
+```sh
+./scripts/panel-on-frame.sh konsole
+./scripts/panel-on-frame.sh mac-screen      # the Mac's screen, in its own panel
+```
+
+Then use the SteamVR dashboard's **Float in World**, **Move** and **Size**
+controls to place each panel. See [docs/panels.md](panels.md).
+
+## Scripts
+
+| Script | Runs on | Purpose |
+|---|---|---|
+| `scripts/tailscale-on-frame.sh` | Mac → Frame | Install Tailscale in `~` as a userspace user service so `frame` works from anywhere; `--uninstall` (**verified** on the LAN) |
+| `scripts/connect.sh` | Mac | Discover, set up key and `~/.ssh/config`, copy key, optional `--harden` (**verified**; `--harden` untested) |
+| `scripts/install-apps.sh` | Mac → Frame | Install Flatpaks (Remmina, Moonlight, …) on the Frame over SSH as `--user` (**verified** with Remmina) |
+| `scripts/paste-to-frame.sh` | Mac → Frame | Send the Mac clipboard (or stdin) to the Frame clipboard (**verified**) |
+| `scripts/install-apk.sh` | Mac → Frame | Install APKs, each as its own persistent Lepton instance with a Steam library shortcut (`--dev`: old ADB path into Lepton Development) (**verified**; see [docs/apks.md](apks.md)) |
+| `scripts/panel-on-frame.sh` | Mac → Frame | Start an app as its own floating VR panel, outside the desktop (**verified**, including `mac-screen` in the headset) |
+| `scripts/mac-cursor-ring.lua` | Mac | Hammerspoon script: a ring around the Mac pointer so it shows in the VNC mirror (**verified**) |
+| `scripts/run-on-frame.sh` | Mac → Frame | Start an app on the headset desktop, e.g. `mac-screen` opens Remmina straight into the Mac (**verified**) |
+| `scripts/frame-ui.sh` | Mac | Start the Frame Control web UI (`ui/server.py`) and open it (**verified**) |
+| `scripts/apk-catalog.sh` | Mac | Refresh the rated F-Droid catalogue that Frame Control's Android section shows (**verified**) |
+| `scripts/compat-db-backup.sh` | Mac | Maintainer-only: back up the shared compatibility database locally and to Google Drive (**verified**) |
+| `scripts/push-vr-video.sh` | Mac → Frame | Upload VR180/360 videos to `~/Videos/VR`, linked into DeoVR's Proton prefix; `--launch` starts DeoVR (**verified**: upload and link; in-headset playback of local files not yet checked). See [docs/vr-video.md](vr-video.md) |
+| `scripts/push.sh` | Mac → Frame | `rsync` files to `~/Downloads` (or a given path) on the Frame (**verified**) |
+| `scripts/serve-bootstrap.sh` | Mac | Fallback: serve `bootstrap-on-frame.sh` with your public key embedded |
+| `scripts/bootstrap-on-frame.sh` | Frame | Fallback: install the key and enable `sshd` |
+

docs/sideloading.md

@@ -0,0 +1,177 @@
+# Sideloading Linux and Windows games
+
+A game you have as files (an itch.io download, your own build, a DRM-free
+release) can go into the Frame's Steam library without a Steam store page.
+Frame Control uses the same path as Valve's
+[SteamOS Devkit Client](https://gitlab.steamos.cloud/devkit/steamos-devkit):
+the title becomes a Steam **Devkit Game**, with a runtime (Proton or a Steam
+Linux Runtime) chosen from the program itself.
+
+For Android APKs, see [apks.md](apks.md) instead.
+
+**Status: nothing here has run on a headset yet.** Every device-side step is
+**inferred from Valve's steamos-devkit source** (release v0.20260925.1). The
+local steps (reading the zip, picking the program and runtime, building the
+request) are covered by `tests/test_frame_titles.py`.
+
+## Using it
+
+Drop a game's `.zip`, folder or `.exe` on **Send to Frame**. (Folders need the
+desktop app, which knows where a dropped folder lives; in a plain browser, zip
+it.) A dialog shows:
+
+- **Name**: what Steam shows. Steam uses the title id as the name, so it's
+  limited to letters, digits and `_`, and can't start with a digit; the
+  dialog shows the result.
+- **Launches**: the program picked to start the game, with the other
+  candidates in the list.
+- **Runtime**: picked from the program, see below. Windows programs can switch
+  between Proton Experimental and Proton (stable).
+
+Install copies it to the Frame and registers it with Steam; progress shows in
+the bar and the activity log. **Sideloaded titles** lists what's installed,
+with Launch and Remove. **Copy to ~/Downloads instead** keeps the old
+behaviour for a zip that isn't a game.
+
+From a terminal:
+
+```sh
+python3 ui/frame_titles.py inspect Game.zip          # what would be installed, no headset needed
+python3 ui/frame_titles.py install Game.zip [--name N] [--exe REL] [--runtime R]
+python3 ui/frame_titles.py list | launch ID | remove ID
+```
+
+## Choosing the runtime
+
+The program's header decides, not its file name:
+
+| Program | Runtime (Steam compat tool) | `steam_play` | Confidence |
+|---|---|---|---|
+| Windows `.exe`, x86-64 (PE machine `0x8664`) | `proton-experimental` | 1 | Inferred: ARM64 Proton runs x86-64 code through FEX |
+| Windows `.exe`, 32-bit x86 (`0x14c`) or ARM64 (`0xaa64`) | `proton-experimental` | 1 | Inferred |
+| Linux ELF, aarch64 (`e_machine` `0xB7`) | `SteamLinuxRuntime_4-arm64` | 0 | Verified: starts, but natively (see below) |
+| Linux ELF, x86-64 (`0x3E`) | `SteamLinuxRuntime_4` | 0 | Verified not to start: the runtime isn't installed (see below) |
+| Shell script | the runtime of the Linux binary beside it, else `SteamLinuxRuntime_4-arm64` | 0 | Guess |
+| Anything else (32-bit Linux, other CPUs, DLLs, data) | refused with a message | | |
+
+Proton Experimental is the default rather than stable because the Frame's
+ARM64 Proton and FEX stack is new and Proton fixes reach Experimental first.
+If a game misbehaves, reinstall it with Proton (stable).
+
+The aliases and settings are the ones Valve's client sends: `RUNTIME_ALIASES`
+in `devkit_client/__init__.py`, and `gui2._update_game`, which sets
+`steam_play=1, steam_play_debug=0, steam_play_debug_version=2019` for Proton
+and `steam_play=0` otherwise, plus `compat_tool=<alias>`. Valve's client only
+offers `SteamLinuxRuntime_4-arm64` and Lepton when the device reports itself
+as Deckard (the Frame).
+
+## Picking the program
+
+`ui/frame_titles.py` reads every file's header: ELF executables (PIE ones are
+told from shared libraries by their `PT_INTERP` segment), PE executables (not
+DLLs) and scripts with `#!`. A zip with a single top-level folder is treated
+as that folder. Candidates are ranked by:
+
+1. Not a helper: names like `UnityCrashHandler64`, `CrashReportClient`,
+   `*setup*`, `unins*`, `vc_redist*`, `dxsetup`, `*prereq*`, and anything under
+   `_CommonRedist`, `Redist`, `DirectX` or `Engine` go last.
+2. Platform: native ARM64 Linux, then Windows x86-64, then x86-64 Linux, then
+   other Windows builds.
+3. Name: a program named like the zip or folder (build words such as
+   `-linux-arm64` or `_v1.2` are dropped from the name).
+4. Depth, then size: Unreal's top-level `Game.exe` beats
+   `Game/Binaries/Win64/Game-Win64-Shipping.exe`.
+
+A top-level shell script beats a Linux binary one folder down (`run.sh` +
+`bin/game`); a binary next to a script wins. The list in the dialog lets you
+pick another.
+
+## What happens on the Frame (inferred)
+
+1. **Tools.** `frame/devkit-utils/` (Valve's scripts, vendored unmodified, MIT)
+   is copied to `~/devkit-utils`, where Valve's client puts it, unless the
+   stamp file there already matches. Files are merged, not replaced, so a
+   newer copy from Valve's client keeps its extra files.
+2. **Folder.** `python3 ~/devkit-utils/steamos-prepare-upload --gameid ID`
+   makes `~/devkit-game/ID` and prints `{user, directory}`.
+3. **Copy.** The files go there with `rsync -a --delete` on macOS and Linux,
+   or `scp -r` into a fresh folder that then replaces it on Windows. Then
+   `chmod -R 755`, the modes Valve's client gives an upload.
+4. **Register.** `python3 ~/devkit-utils/steam-client-create-shortcut --parms JSON`
+   with `{gameid, directory, argv: [target], env: {}, settings, clear_settings,
+   force_appid: "", lepton_args: ""}`. It writes `ID-argv.json`,
+   `ID-env.json` and `ID-settings.json` next to the folder, then sends
+   `create-shortcut` to the running Steam client over `~/.steam/steam.pipe`
+   (authenticated by `~/.steam/steam.token`) and waits up to 5 s for Steam's
+   answer file. Its `error`, for example "The Steam client is not running",
+   is shown as the install error. The files stay, so installing again with
+   Steam running finishes the job.
+5. **Launch** is `steam-devkit-rpc run-game gameid=ID`. **Remove** is
+   `steamos-delete --delete-title ID`, which deletes the folder and has Steam
+   drop shortcuts with no folder. Frame Control then removes the `ID-*.json`
+   files that Valve's script leaves behind.
+
+Frame Control also writes `~/devkit-game/ID-framecontrol.json` (name, source
+file, target, runtime, size). **Sideloaded titles** lists every folder in
+`~/devkit-game`, including titles uploaded with Valve's client.
+
+`argv` is one string, as in Valve's client (the start command may carry
+arguments), so a program path with spaces is sent in double quotes. How Steam
+splits that string is **not checked**.
+
+## Safety
+
+- Zips are unpacked on your computer first. Entries with absolute paths, `..`,
+  drive letters or `:` anywhere in the path, or links that point outside the
+  zip (or at a folder they're in) are refused. So are zips over 64 GB
+  unpacked, over 200,000 entries, more than 200× compressed past 1 GB, or
+  bigger than the free space.
+- No symlink is created while unpacking, so no write can be redirected
+  through one. A link to a file inside the zip (`libfoo.so.1 → libfoo.so.1.2`)
+  becomes a copy of that file, which also works on Windows. Links to folders,
+  loops and dangling links are left out.
+- A dropped folder that contains symlinks (or Windows junctions) is copied on your computer first,
+  with the same rule, because `scp -r` would follow a link out of the folder
+  and upload whatever it points at.
+- Installs run one at a time, and Remove is refused while one runs.
+- The title id is limited to letters, digits and `_`, doesn't start with a
+  digit (one that would gets `_` in front), and is 2 to 64 characters. That's
+  what Steam's `create-shortcut` accepts: on the Frame it refused
+  `fc-smoke-exe` with `missing/invalid arguments` and registered the same
+  program as `FCSmokeProbe` (2026-09-27, BUILD_ID 20260922.6101926), and
+  Valve's client only allows `^[A-Za-z_][A-Za-z0-9_.]+$`. Valve's scripts
+  also pass the id to a shell (`steamos-delete` runs `rm -r` on it). Valve's
+  reserved sideload names (`steam`, `steamvr`, and their `deckard` forms,
+  which would replace the Steam client itself) get `_game` added.
+- Nothing needs `sudo`; everything goes to your home folder on the Frame.
+- In the app, a dropped folder is read from its local path by the app's own
+  server, which only accepts requests from its own page (see
+  [frame-control.md](frame-control.md#how-it-works)).
+
+## Checked on a headset
+
+Tested 2026-09-26 on a Frame (BUILD_ID 20260922.6101926) with small static test
+programs and PuTTY's official 64-bit `putty.exe`, through both the command line
+and the app (inspect, install job, ▶, Remove, and install links):
+
+- [x] `create-shortcut` registers a title; it shows in the Steam library and in
+  **Sideloaded titles**, and Steam maps it to the chosen compat tool.
+- [x] `steam-devkit-rpc run-game` starts it (Steam logs `devkit run-game: started
+  devkit game "<id>"`), and Remove (`steamos-delete`) deletes the files, the
+  shortcut and the Proton prefix.
+- [x] A quoted path in the start command is fine: Steam runs
+  `proton waitforexitandrun "/home/steamos/devkit-game/<id>/<exe>"`.
+- [x] An x86-64 Windows `.exe` runs under **Proton 11 (stable)** through FEX
+  (ARM64EC) inside the Steam Linux Runtime 4.0 ARM64 container; PuTTY stayed up.
+  Proton Experimental wasn't installed at the time (it was downloading), so it's
+  untested. A Go-built x86-64 test program crashed in `libarm64ecfex.dll`
+  (a FEX limitation with that program, not the sideloading).
+- [ ] **An aarch64 build runs natively, not in `SteamLinuxRuntime_4-arm64`**:
+  Steam records the mapping (`CompatToolMapping`, `compat_log.txt`) but launches
+  the devkit title without the runtime's `_v2-entry-point` prefix. Fine for a
+  self-contained build; a build that needs the runtime's libraries may not start.
+- [ ] **An x86-64 Linux build doesn't start**: Steam logs `Tool 4183110 "Steam
+  Linux Runtime 4.0" is found for appID …, but is not installed`, and the Frame
+  doesn't install that x86-64 runtime for a devkit title (a `steam://install/4183110`
+  request did nothing).
+- [ ] Whether these titles open as flat panels or need anything VR-specific.

docs/ssh.md

@@ -33,7 +33,8 @@ unless your router's DNS registers DHCP client names.
 
 - **Verified on device (2026-09-25):** `avahi-daemon` is running on the Frame
   and `frame.local` resolves from the Mac over mDNS.
-- `scripts/connect.sh` tries `frame.local`, then `frame`. If neither works, it tells you to re-run it with the IP.
+- `scripts/connect.sh` tries `frame.local`, then `frame`, then an mDNS browse for
+  the devkit service (below). If none works, it tells you to re-run it with the IP.
   Once you have a working address, the `Host frame` alias means you just type
   `ssh frame`.
 - To check discovery yourself: `dns-sd -G v4 frame.local` (Ctrl-C to stop), or
@@ -55,13 +56,64 @@ Host frame
   HostName frame.local
   User steamos
   IdentityFile ~/.ssh/id_ed25519_frame
+  IdentityFile ~/.ssh/id_rsa_frame_devkit
   IdentitiesOnly yes
   ServerAliveInterval 30
 ```
 
+The script only asks for the password if the pairing below doesn't work.
+
+## Password-free pairing (SteamOS devkit service)
+
+From Valve's source ([steamos-devkit-service](https://gitlab.steamos.cloud/devkit/steamos-devkit-service),
+[steamos-devkit](https://gitlab.steamos.cloud/devkit/steamos-devkit) client). **Verified on a
+Frame 2026-09-26** (BUILD_ID 20260922.6101926): the service runs with Developer Mode
+on, `properties.json` answers with `"login": "steamos"`, the headset advertises
+`_steamos-devkit._tcp` as `frame`, and `/register` needs pairing mode (below). The
+approve prompt and key install are not verified yet. SteamOS's devkit service is
+what Valve's Devkit Client uses to pair. `scripts/connect.sh` and
+`ui/frame_connect.py` try it first:
+
+- The headset serves HTTP on port **32000** and advertises mDNS
+  `_steamos-devkit._tcp`. `GET /properties.json` gives the `login` user; the
+  script uses it as `User` (unless you set `FRAME_USER`, or it says `root`),
+  for the password fallback too, and keeps it on re-runs.
+- **Open Steam Settings → Developer → Pair new host in the headset first.**
+  Otherwise `/register` answers at once with `403` `"please put the Steam client
+  in pairing mode: Settings -> Developer -> Pair new host"` (verified). The
+  scripts say so and keep asking for 2 minutes while you open it.
+- `POST /register` with `ssh-rsa <key> <comment> 900b919520e4cf601998a71eec318fec`
+  (a fixed token from Valve's client) shows an approve prompt inside the
+  headset naming the comment (`frame-control@<your computer>`). It waits 30 s,
+  then installs the key for the device user and turns `sshd` on. The reply is
+  `200 Registered`, or `403` with `{"error": ...}` (declined, timed out, Steam
+  not running).
+- It only accepts **RSA** keys, hence the second key,
+  `~/.ssh/id_rsa_frame_devkit` (3072-bit).
+- A host counts as found if port 22 **or** 32000 answers. With no host given,
+  and `frame.local`/`frame` unreachable, it browses `_steamos-devkit._tcp` with
+  `dns-sd` (macOS) or `avahi-browse` (Linux) for a few seconds if installed.
+- Port 32000 closed, a timeout, or an error: the script says why and falls back
+  to copying the ed25519 key with the Developer Mode password, as before.
+
+Anyone on your network can send the request, so only approve a prompt you
+started. `curl http://<frame-ip>:32000/properties.json` shows whether the service is up.
+
 `~/.ssh/authorized_keys` lives under `/home`, which SteamOS keeps across OS
 updates (inferred from Deck; the Frame uses the same A/B image scheme).
 
+## From an iPhone or iPad
+
+The iPhone app ([iphone.md](iphone.md)) makes its own ed25519 key and adds it
+with the Developer Mode password, once, over a password login; the Frame's sshd
+offers `publickey,password` (OpenSSH 9.7p1, keyboard-interactive off). It can't
+use the devkit pairing above: that installs an RSA key, and the Swift SSH
+library signs RSA only with SHA-1, which OpenSSH 8.8 and later refuse by default.
+The app pins the Frame's host key on first use and asks you to pair again if it
+changes. **Verified 2026-09-27** against the Frame's recovery image
+([recovery-and-images.md](recovery-and-images.md)); on the headset, the add-the-key-yourself
+route was used.
+
 ## Keeping `sshd` enabled across updates
 
 - **Frame**: SSH is tied to the Developer Mode toggle, so it should survive

docs/streaming.md

@@ -1,9 +1,11 @@
 # Screen and desktop streaming
 
-This covers two directions:
+This covers three directions, plus input:
 
 - **A. Frame → Mac**: see and control the headset from the Mac.
 - **B. Mac → Frame**: use the Mac's desktop inside the headset.
+- **C. iPhone → Frame**: mirror the phone inside the headset.
+- **Input**: type and point in the Frame from the Mac or iPhone.
 
 The confidence labels are the same as in [ssh.md](ssh.md).
 
@@ -32,7 +34,7 @@ flat 2D desktop streaming into a window on the Frame's Linux desktop.
 
 | Option | Setup | Confidence | Verdict |
 |---|---|---|---|
-| **macOS Screen Sharing (VNC) → Remmina on the Frame** | **Mac:** System Settings → General → Sharing → Screen Sharing on → (i) → enable "VNC viewers may control screen with password". **Frame:** `./scripts/install-apps.sh remmina` from the Mac, then open Remmina in the headset and connect to `vnc://<mac>.local` | **Inferred.** Remmina is on Flathub for **aarch64** with VNC and RDP ([Flathub](https://flathub.org/apps/org.remmina.Remmina)). The Frame desktop runs Flatpaks ([UploadVR](https://www.uploadvr.com/flatpaks-open-source-steam-frame/)). macOS VNC is built in. | **Recommended.** Nothing to install on the Mac, and it's easy to set up. Latency is fine for productivity but not for games. You'll type the Mac's hostname once in Remmina on the headset, then save the profile. To avoid even that, the script can pre-seed a Remmina profile over SSH (see below). |
+| **macOS Screen Sharing (VNC) → Remmina on the Frame** | **Mac:** System Settings → General → Sharing → Screen Sharing on → (i) → enable "VNC viewers may control screen with password". **Frame:** `./scripts/install-apps.sh remmina` from the Mac, then open Remmina in the headset and connect to `vnc://<mac>.local` | **Verified 2026-09-27** (Frame BUILD_ID 20260925.6191901, macOS 27.0), in its own panel via `panel-on-frame.sh mac-screen`. Remmina is on Flathub for **aarch64** with VNC and RDP ([Flathub](https://flathub.org/apps/org.remmina.Remmina)). The Frame desktop runs Flatpaks ([UploadVR](https://www.uploadvr.com/flatpaks-open-source-steam-frame/)). macOS VNC is built in. | **Recommended.** Nothing to install on the Mac, and it's easy to set up. Noticeable lag, even at lower Remmina quality settings on a good 5 GHz link, where neither Wi-Fi nor the Frame's CPU was the bottleneck. Usable for reading and coding, but not for games. You'll type the Mac's hostname once in Remmina on the headset, then save the profile. To avoid even that, the script can pre-seed a Remmina profile over SSH (see below). |
 | Sunshine (Mac) → Moonlight (Frame Flatpak) | `brew install` Sunshine on the Mac, then `./scripts/install-apps.sh moonlight` | Moonlight Flatpak supports **aarch64** ([Flathub](https://flathub.org/apps/com.moonlight_stream.Moonlight)). **Sunshine on macOS is poorly supported**: install problems on Apple Silicon/Sequoia, and no virtual gamepads ([LizardByte discussion #777](https://github.com/orgs/LizardByte/discussions/777)). | Try it if VNC is too laggy. Expect some friction. |
 | Steam Remote Play with the Mac as host | Steam on the Mac, Steam Link/Remote Play on the Frame | macOS-hosted Remote Play is reported broken or flaky in 2024–2026 ([Steam discussion](https://steamcommunity.com/groups/homestream/discussions/1/574921459914429988/)) | Not recommended. It's only for games, if it works at all. |
 | Immersed / Virtual Desktop | Vendor apps | Immersed has a Mac agent but no known Frame client. Virtual Desktop's developer said he'd "try" to port it ([NewsBreak](https://www.newsbreak.com/news/4892834783961-virtual-desktop-dev-says-he-ll-try-to-bring-the-app-to-steam-frame)). | Not available as of 2026-09-25. Check again later. |
@@ -45,20 +47,70 @@ them on the Frame in DeoVR instead: see [vr-video.md](vr-video.md).
 
 `scripts/install-apps.sh remmina --vnc-host <your-mac>.local` writes
 `~/.var/app/org.remmina.Remmina/data/remmina/mac-screen-sharing.remmina` on the Frame over
-SSH. The profile then appears in Remmina's list, and you just click it. You'll
-still be asked for the VNC password in the headset the first time, unless you
-choose to save it. Remmina stores passwords encrypted with a per-install key,
-so the script doesn't try to write the password. (The Remmina file format is
-standard; the Flatpak data path is inferred.)
+SSH. The profile then appears in Remmina's list, and you just click it. It
+scales the Mac's desktop to fit the window (`scale=1`, `viewmode=1`). Without
+that, Remmina shows a Retina Mac's native pixels 1:1, so you see a zoomed-in
+corner. (Verified 2026-09-27.)
 
-## Input and text entry without the virtual keyboard
+**Expect a Mac login prompt, not the VNC password.** macOS offers Apple's own
+authentication (RFB security type 30) ahead of plain VNC auth (type 2), and
+Remmina picks it. So Remmina asks for your **Mac account name and login
+password**; the "VNC viewers may control screen" password isn't used. To store
+the password without typing it in the headset, run on the Frame:
 
-- **A Bluetooth keyboard and mouse** paired to the Frame is the obvious way to
-  avoid the virtual keyboard. Road to VR says there are "only a few things
-  you'd actually want to do" on the Linux desktop unless you connect a
-  keyboard and mouse.
-  (Pairing a BT keyboard on the Frame is inferred from SteamOS; not verified.)
-- **Clipboard from the Mac**: `scripts/paste-to-frame.sh` (see
-  [file-transfer.md](file-transfer.md#clipboard)).
+```sh
+printf '%s' "$PASSWORD" | flatpak run org.remmina.Remmina \
+  --update-profile ~/.var/app/org.remmina.Remmina/data/remmina/mac-screen-sharing.remmina \
+  --set-option password
+```
+
+Remmina encrypts it into the profile with its own key, because there's no
+secret service in the SSH session. (Verified 2026-09-27.)
+
+### The Mac's cursor
+
+The mirror doesn't show the Mac's pointer, with either `showcursor` value.
+macOS keeps the pointer out of the picture it sends, and Remmina's cursor mode
+draws the cursor shape only at the Frame's own pointer, which doesn't follow
+the Mac trackpad. `scripts/mac-cursor-ring.lua` works around this: a
+[Hammerspoon](https://www.hammerspoon.org/) script that draws a ring around the
+Mac pointer as a real window, so it's part of the mirrored picture. Setup is in
+its header. (Verified 2026-09-27.)
+
+Going the other way, pointing a controller at the panel moves the Mac's mouse,
+because Remmina forwards input (`viewonly=0`).
+
+## C. Show the iPhone's screen inside the Frame
+
+iOS only shares its screen two ways: **AirPlay** (Screen Mirroring in Control
+Centre) or a **ReplayKit broadcast extension** in an app. Nothing else can
+capture it.
+
+| Option | What it takes | Confidence | Verdict |
+|---|---|---|---|
+| **UxPlay** (an open-source AirPlay receiver) on the Frame | Build it for aarch64 (no Flathub package; there's a Snap and distro packages), run it in `~` or a podman container, and advertise it over mDNS. The iPhone *and* the Mac then see "Frame" in Screen Mirroring, with nothing to install on either | **Inferred.** It runs on ARM64 Linux such as the Raspberry Pi ([UxPlay](https://github.com/FDH2/UxPlay)). Not tried on the Frame: needs mDNS registration and its ports (7000, 7001, 7100 and a UDP range) reachable | **Recommended to try first.** It's the only receiver-side option, and it covers the Mac too. The window shows in the Frame's Linux desktop panel |
+| A broadcast extension in Frame Control | ReplayKit sends the screen to a small extension (50 MB memory limit), which encodes H.264 and sends it through the app's SSH tunnel to the page, shown the same way as the Frame's live view in reverse | **Inferred** from Apple's ReplayKit docs | Full control and no network setup, but several days' work, and the picture only shows where Frame Control's page is open in the headset |
+
+## Input: type and point in the Frame from the Mac or iPhone
+
+**Verified 2026-09-27** on the headset: `steamos` is in the `input` group and
+`/dev/uinput` is `crw-rw-r-- root input`, so **our own code can create a
+virtual keyboard and mouse without sudo**. The Frame has no `python-evdev`,
+`ydotool`, `wtype` or KDE Connect; `kwin_wayland` and `plasmashell` run only
+while the desktop panel is open in the headset.
+
+| Option | Mac | iPhone | Notes |
+|---|---|---|---|
+| **A uinput keyboard and mouse in Frame Control's server** | ✓ | ✓ | **Recommended.** The server opens `/dev/uinput` with `ctypes` (standard library only) and the page sends key and pointer events through the tunnel it already has. On the phone: a trackpad area (drag to move, tap to click, two fingers to scroll) and the iOS keyboard for typing. On the Mac: a "control the Frame" mode that captures the keyboard and pointer (Esc to release). Uinput devices look like real hardware to the kernel, so libinput, KWin and gamescope should take them; [frame-voice](https://github.com/DeeJanuz/frame-voice) already types into a Frame through a uinput keyboard. **Untested**: which surfaces in VR (desktop panel, SteamVR dashboard, games, Android apps in Lepton) accept the pointer. About a day or two of work |
+| **Bluetooth keyboard and mouse** | – | – | Real hardware paired in SteamOS settings. The iPhone can't pretend to be a Bluetooth keyboard: iOS won't advertise the HID service ([Apple forums](https://developer.apple.com/forums/thread/733916)) |
+| **Deskflow** (formerly Input Leap / Barrier) | ✓ | – | Moves the Mac's own mouse and keyboard onto the Frame's screen edge. Flathub has an aarch64 build ([Flathub](https://flathub.org/apps/org.deskflow.deskflow)); on Wayland it needs the InputCapture/libei portal, and only works while Plasma is running. No iPhone client |
+| **KDE Connect** | ~ | ✓ | Its iOS app has a remote touchpad and keyboard, but the Frame would need KDE Connect installed (not on Flathub; `pacman` on a read-only root). More moving parts than the uinput route |
+| **Remmina / Steam Link / RDP** | ✓ | – | Input only reaches the streamed session, not the headset's own apps |
+
+Other ways to get text in:
+
+- **Clipboard from the Mac**: `scripts/paste-to-frame.sh`, or Frame Control's
+  clipboard box (see [file-transfer.md](file-transfer.md#clipboard)). Needs
+  the desktop panel open.
 - **RDP session**: Windows App syncs the clipboard with xrdp, but only inside
   that RDP session.

docs/support-matrix.html

@@ -0,0 +1,190 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Frame Control 0.3.1: features by OS</title>
+<style>
+  :root {
+    --bg: #1b2838; --panel: #16202d; --line: #2a3f5a; --text: #c7d5e0; --dim: #8f98a0;
+    --tested: #5ba32b; --partial: #d9a33a; --auto: #4b8bbe; --built: #3d4f63; --no: #6b2b2b;
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: linear-gradient(#171a21, var(--bg) 320px); color: var(--text);
+         font: 15px/1.5 "Motiva Sans", -apple-system, "Segoe UI", Roboto, sans-serif; }
+  main { max-width: 1180px; margin: 0 auto; padding: 40px 24px 80px; }
+  h1 { color: #fff; font-size: 30px; margin: 0 0 4px; font-weight: 600; }
+  h2 { color: #fff; font-size: 18px; margin: 40px 0 12px; font-weight: 600;
+       text-transform: uppercase; letter-spacing: .06em; }
+  .sub { color: var(--dim); margin: 0 0 28px; }
+  a { color: #66c0f4; }
+  .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 14px; }
+  .card { background: var(--panel); border: 1px solid var(--line); border-radius: 6px; padding: 16px 18px; }
+  .card h3 { margin: 0 0 8px; color: #fff; font-size: 16px; }
+  .card dl { margin: 0; display: grid; grid-template-columns: 76px 1fr; gap: 3px 10px; font-size: 13.5px; }
+  .card dt { color: var(--dim); }
+  .card dd { margin: 0; }
+  .legend { display: flex; flex-wrap: wrap; gap: 10px 20px; margin: 0 0 14px; font-size: 13.5px; }
+  .legend span { display: inline-flex; align-items: center; gap: 7px; }
+  table { width: 100%; border-collapse: collapse; background: var(--panel);
+          border: 1px solid var(--line); border-radius: 6px; overflow: hidden; }
+  th, td { padding: 9px 12px; border-bottom: 1px solid var(--line); vertical-align: top; text-align: left; }
+  thead th { background: #0e141b; color: #fff; font-weight: 600; position: sticky; top: 0; z-index: 1; }
+  thead th.os { width: 150px; text-align: center; }
+  tr.group td { background: #203044; color: #fff; font-weight: 600; font-size: 13px;
+                text-transform: uppercase; letter-spacing: .05em; }
+  td.os { text-align: center; }
+  td .feat { color: #fff; }
+  td .note { color: var(--dim); font-size: 13px; }
+  .pill { display: inline-block; min-width: 92px; padding: 2px 9px; border-radius: 999px;
+          font-size: 12.5px; font-weight: 600; color: #fff; white-space: nowrap; }
+  .t { background: var(--tested); }
+  .p { background: var(--partial); color: #1b1b1b; }
+  .a { background: var(--auto); }
+  .b { background: var(--built); color: #c7d5e0; }
+  .n { background: var(--no); }
+  .dot { width: 12px; height: 12px; border-radius: 50%; display: inline-block; }
+  ul { margin: 6px 0 0; padding-left: 20px; }
+  li { margin: 3px 0; }
+  footer { color: var(--dim); font-size: 13px; margin-top: 36px; }
+</style>
+</head>
+<body>
+<main>
+  <h1>Frame Control 0.3.1: features by OS</h1>
+  <p class="sub">Which features are built for each OS, and which were tested against a real Steam Frame
+    (SteamOS 0.3.0, build 20260922.6101926). Status as of 26 September 2026, for
+    <a href="https://github.com/saphid/steam-frame/pull/2">PR #2</a> (0.3.1). Every build now bundles its own
+    Python 3.12, <code>adb</code> and CA certificates, so nothing else needs installing (only <code>ssh</code> on Linux,
+    plus the system <code>adb</code> on arm64 Linux).</p>
+
+  <h2>Builds and test machines</h2>
+  <div class="cards">
+    <div class="card"><h3>macOS</h3><dl>
+      <dt>Built</dt><dd>Apple Silicon (arm64): <code>.dmg</code>, <code>.zip</code>. No Intel build.</dd>
+      <dt>Signing</dt><dd>Ad-hoc signed, not notarised</dd>
+      <dt>Tested on</dt><dd>Apple Silicon Mac, macOS 26, using a local 0.3.1 build with the bundled Python and <code>adb</code>. All 15 calls it made to the Frame at startup returned OK.</dd>
+    </dl></div>
+    <div class="card"><h3>Windows</h3><dl>
+      <dt>Built</dt><dd>x64: NSIS installer <code>.exe</code> and <code>.zip</code></dd>
+      <dt>Signing</dt><dd>Unsigned. SmartScreen shows a warning.</dd>
+      <dt>Tested on</dt><dd>Windows 11 x64 VM. Real-Frame results below are from 0.3.0. The 0.3.1 installer from CI installs cleanly (31 s) and reinstalls over itself (38 s). The server starts on the bundled Python, and HTTPS to Steam and F-Droid works. The Frame went offline before its 0.3.1 run on the headset.</dd>
+    </dl></div>
+    <div class="card"><h3>Linux</h3><dl>
+      <dt>Built</dt><dd>x86_64 and arm64: <code>AppImage</code> and <code>.deb</code></dd>
+      <dt>Signing</dt><dd>n/a</dd>
+      <dt>Tested on</dt><dd>x86_64 Ubuntu 26.04 with no <code>adb</code> and no clipboard tools, using the 0.3.1 AppImage under Xvfb with the bundled Python and <code>adb</code>. The arm64 builds and the <code>.deb</code> packages weren't run; the arm64 package was only checked to contain an ARM Python.</dd>
+    </dl></div>
+  </div>
+
+  <h2>Features</h2>
+  <div class="legend">
+    <span><i class="dot" style="background:var(--tested)"></i><b>Tested</b>: worked against the real Frame on that OS</span>
+    <span><i class="dot" style="background:var(--partial)"></i><b>Partial</b>: only part of the feature was tested (see note)</span>
+    <span><i class="dot" style="background:var(--auto)"></i><b>Automated</b>: covered by CI tests on that OS, not tried on a real Frame</span>
+    <span><i class="dot" style="background:var(--built)"></i><b>Built</b>: in the build, not tested</span>
+    <span><i class="dot" style="background:var(--no)"></i><b>Not built</b></span>
+  </div>
+
+  <table>
+    <thead><tr><th>Feature</th><th class="os">macOS</th><th class="os">Windows</th><th class="os">Linux</th></tr></thead>
+    <tbody>
+      <tr class="group"><td colspan="4">Connection</td></tr>
+      <tr><td><div class="feat">Set Up Connection</div><div class="note">Finds the Frame, writes the <code>frame</code> SSH alias, copies your key using the Frame's password. macOS runs <code>connect.sh</code> in Terminal; Windows and Linux run <code>frame_connect.py</code>.</div></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Existing alias used, script not re-run</div></td>
+        <td class="os"><span class="pill t">Tested</span></td>
+        <td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Shared SSH connection</div><div class="note">A single SSH connection is reused, so each request takes about 0.3 s. Windows OpenSSH can't do this, so there each request opens its own connection (about 0.5 to 1 s).</div></td>
+        <td class="os"><span class="pill t">Tested</span></td>
+        <td class="os"><span class="pill n">Not built</span><div class="note">OpenSSH limitation</div></td>
+        <td class="os"><span class="pill t">Tested</span></td></tr>
+
+      <tr class="group"><td colspan="4">Headset view</td></tr>
+      <tr><td><div class="feat">Capture headset view</div><div class="note">The left eye or both eyes as the lenses show them, saved as PNG</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Capture desktop panel</div><div class="note">gamescope's flat layer</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Live view</div><div class="note">720p H.264 at about 30 fps, decoded with WebCodecs</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Headset screenshots</div><div class="note">Browse the screenshots you took with Steam's shortcut, and save them to <code>~/Pictures/SteamFrame</code></div></td>
+        <td class="os"><span class="pill t">Tested</span></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Listed (5 found); saving not tried</div></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Listed with thumbnails; saving not tried</div></td></tr>
+
+      <tr class="group"><td colspan="4">Status</td></tr>
+      <tr><td><div class="feat">Battery and charging</div><div class="note">Percentage, watts, time to full or empty, charger type, temperature</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">System status</div><div class="note">Storage, memory, temperature, Wi-Fi, uptime, running services</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Volume and mute</div></td>
+        <td class="os"><span class="pill t">Tested</span></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Read only</div></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Read only</div></td></tr>
+
+      <tr class="group"><td colspan="4">Games</td></tr>
+      <tr><td><div class="feat">Owned games with Frame ratings</div><div class="note">Verified, Playable, Unsupported or Unknown</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Install a game on the Frame</div><div class="note">Uses the headset's Steam client, with live progress</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Store search, Buy, Store on Frame</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Library shelf and Play button</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+
+      <tr class="group"><td colspan="4">Android apps</td></tr>
+      <tr><td><div class="feat">Installed Android apps list</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">F-Droid catalogue search</div><div class="note">About 4,500 apps with Frame ratings, bundled with the app</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Install, launch, stop, test, remove an app</div><div class="note">Each app runs as its own Lepton instance, using the bundled <code>adb</code>. APK files are read by a built-in parser (no <code>aapt2</code>) that matched <code>aapt2</code> on 9 F-Droid APKs.</div></td>
+        <td class="os"><span class="pill t">Tested</span><div class="note">Diary: read, install, launch, test, remove</div></td>
+        <td class="os"><span class="pill b">Built</span></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Launch and stop</div></td></tr>
+      <tr><td><div class="feat">Report an APK</div><div class="note">Reports are saved on your computer; the shared database is maintainer-only</div></td>
+        <td class="os"><span class="pill a">Automated</span></td><td class="os"><span class="pill a">Automated</span></td><td class="os"><span class="pill a">Automated</span></td></tr>
+      <tr><td><div class="feat">Android display settings</div><div class="note">Resolution, UI scale, text size</div></td>
+        <td class="os"><span class="pill t">Tested</span><div class="note">Density and text size set, then reset</div></td>
+        <td class="os"><span class="pill b">Built</span></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Read over the bundled adb</div></td></tr>
+
+      <tr class="group"><td colspan="4">Transfer</td></tr>
+      <tr><td><div class="feat">Send files to ~/Downloads</div><div class="note">Test files had non-English characters in their names (é, ✓). macOS and Linux copy with rsync; Windows uses scp.</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+      <tr><td><div class="feat">Drop an APK to install it</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Send text or clipboard to the Frame</div><div class="note">Needs the headset desktop open. The app reads your clipboard through Electron, so no extra tools are needed.</div></td>
+        <td class="os"><span class="pill t">Tested</span><div class="note">Reading the clipboard retested in 0.3.1</div></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Reached the Frame; desktop was closed</div></td>
+        <td class="os"><span class="pill p">Partial</span><div class="note">Clipboard read with no xclip; Frame desktop was closed</div></td></tr>
+      <tr><td><div class="feat">Flatpak install and remove</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+
+      <tr class="group"><td colspan="4">One-click tools</td></tr>
+      <tr><td><div class="feat">SSH or SFTP in a terminal</div><div class="note">macOS: Terminal. Windows: cmd. Linux: GNOME Terminal, Konsole, xterm and others.</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Steam Link</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Remote desktop</div><div class="note">macOS: Windows App. Windows: Remote Desktop. Linux: Remmina or FreeRDP.</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+      <tr><td><div class="feat">Sleep, restart, shut down</div><div class="note">Opens a terminal because SteamOS asks for the sudo password</div></td>
+        <td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td><td class="os"><span class="pill b">Built</span></td></tr>
+
+      <tr class="group"><td colspan="4">App</td></tr>
+      <tr><td><div class="feat">Local server test suite</div><div class="note">Runs in GitHub Actions on every push (Python 3.12 on macOS and Windows, Python 3.13 on Ubuntu), including the APK reader tests</div></td>
+        <td class="os"><span class="pill a">Automated</span></td><td class="os"><span class="pill a">Automated</span></td><td class="os"><span class="pill a">Automated</span></td></tr>
+      <tr><td><div class="feat">Mac or PC wording</div><div class="note">The UI says Finder or File Explorer, and Mac or PC, to match your system</div></td>
+        <td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td><td class="os"><span class="pill t">Tested</span></td></tr>
+    </tbody>
+  </table>
+
+  <h2>Notes</h2>
+  <ul>
+    <li><b>Tested</b> means the app, running on that OS, got a successful response from the real Frame: for example, a PNG from a capture, 868 owned games, or the Android apps listed.</li>
+    <li>The Windows VM tests ran in its desktop session. <code>ssh.exe</code> hangs when it's started from a remote SSH session, but a normal desktop user won't hit that.</li>
+    <li>The macOS test from 25 September also covered the capture shown when the headset is in standby, input validation, and using the clipboard with the headset desktop open.</li>
+    <li>Everything marked <b>Built</b> runs a command that works on its own. It just hasn't been tried end to end from the app on that OS yet.</li>
+  </ul>
+  <footer>Frame Control is an unofficial tool, not made by Valve. MIT licence.</footer>
+</main>
+</body>
+</html>

docs/testing.md

@@ -0,0 +1,150 @@
+# Testing
+
+Frame Control is tested in three layers, from fast and fake to slow and real.
+A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/steam-frame/issues/6)).
+
+| Layer | Runs | Needs | Covers |
+|---|---|---|---|
+| Unit tests (`tests/*.py`) | `python3 -m unittest discover -s tests` | Nothing | Parsing, validation, request guards; SSH and HTTP are mocked |
+| Fake Frame (`tests/e2e`) | `scripts/e2e.sh` | Linux with Docker | The real server and scripts against a container that behaves like a Frame |
+| Headset smoke test | `scripts/frame-smoke.sh` | A Frame on the `frame` alias | Install, launch and remove on the real device, recorded with its BUILD_ID |
+
+## Unit tests
+
+```sh
+python3 -m unittest discover -s tests
+```
+
+About 120 tests, a few seconds, on Python 3.9 and newer. GitHub Actions runs
+them on macOS, Windows and Linux. They don't pick up `tests/e2e`.
+
+## The fake Frame
+
+`tests/fakeframe/` builds a container that stands in for the headset, and a
+second one for the computer Frame Control runs on. `scripts/e2e.sh` builds
+both, starts them with `docker compose`, runs `tests/e2e` in the host
+container and takes everything down, exiting with the tests' status:
+
+```sh
+scripts/e2e.sh                                   # everything, about 2 minutes plus the first build
+scripts/e2e.sh test_titles                       # one module
+scripts/e2e.sh test_faults.Faults.test_disk_full # one test
+FAKEFRAME_KEEP=1 scripts/e2e.sh                  # leave it running afterwards
+```
+
+It needs a Linux host with Docker and `docker compose`, and zsh. The images
+are `fakeframe-frame` and `fakeframe-host`; the compose project, network and
+volumes are `fakeframe-e2e*`. CI runs it on a native arm64 runner
+(`ubuntu-24.04-arm`, the `e2e` job in `.github/workflows/checks.yml`).
+
+The host container exists because OpenSSH reads `~/.ssh/config` from the
+passwd home directory, not `$HOME`. There, `ssh frame` reaches the fake Frame
+through the same `Host frame` block `ui/frame_connect.py` writes, the
+repository is mounted read-only at `/repo`, and each test module starts the
+real `ui/server.py` (Python 3.9) and talks to it over HTTP with the headers
+its guards want.
+
+### What's real and what's fake
+
+| On the fake Frame | |
+|---|---|
+| Arch Linux (`archlinux:base`, or Valve's Holo Core aarch64 preview on arm64), user `steamos`, `/etc/os-release` with BUILD_ID 20260922.6101926 | Real OS, Frame's identity |
+| `sshd` with key and password logins, `rsync`, `python3` | Real |
+| Valve's steamos-devkit-service on port 32000 and its hooks, vendored unmodified in `tests/fakeframe/steamos-devkit-service` | Real; only its `dbus` import (for mDNS through systemd-resolved) is a stand-in that logs the registration |
+| Valve's devkit-utils, copied over by Frame Control itself | Real |
+| **fakesteam**: `~/.steam/steam.pid`, `steam.token` and the `steam.pipe` FIFO; answers `approve-ssh-key`, `create-shortcut`, `run-game`, `list-shortcuts` and `delete-shortcut` with the response files devkit-utils waits for; takes `steam://rungameid`, `install` and `store` URLs | Fake |
+| DevTools on `127.0.0.1:8080` with a `SharedJSContext` target. The JavaScript Frame Control sends runs for real in Node against stand-in `SteamClient`, `appStore` and `downloadsStore` objects (`cef_shim.js`), so async functions, optional chaining and `Map`s behave as in Steam's CEF | The JS engine is real; the objects are fake |
+| `steam`, `wpctl`, `flatpak`, `podman`, `nmcli`, `qdbus6`, `gamescopectl`, SteamOS's `steamos-enable-sshd` helper, and Lepton's launcher | Stubs that record their calls |
+| Battery, charger and thermal zones under `/sys/class` | Files the supervisor writes. `/sys` is read-only in a container and Docker's AppArmor profile refuses writes under it, so each folder is a volume mounted twice: over `/sys/class/...` for `frame_status.py` to read, and under `/var/lib/fakeframe/sys` for the supervisor to write |
+| `vrserver` and `plasmashell` | Renamed `sleep` processes, so the status page and the clipboard find them |
+
+Every fake behaviour copied from the device has a comment citing the doc or
+observation and the BUILD_ID it came from; anything not seen on a headset is
+marked as a guess. The fake keeps its state in `/var/lib/fakeframe/state.json`
+(shortcuts, devkit titles, compat tool mapping, launches, pairing requests,
+Lepton instances, volume, Flatpaks, clipboard) and logs stub calls to
+`calls.jsonl` beside it.
+
+Native programs really run: a launched aarch64 title executes on an arm64
+host, and an x86-64 one on x86-64 (the container shares the host's kernel).
+Proton titles are recorded with the command Steam would run, not run.
+
+### Fault switches
+
+`fakeframe-ctl` works over SSH (`ssh frame fakeframe-ctl help`) and from the
+host container (`FAKEFRAME_CTL=http://fakeframe:9999`), so a test can flip a
+switch while SSH is down:
+
+| Command | Effect |
+|---|---|
+| `pairing on\|off` | Steam's **Pair new host** screen open or not; off gives the device's 403 text |
+| `answer approve\|deny\|timeout` | How the pairing prompt is answered |
+| `steam on\|off` | Steam client running (pid file, pipe, DevTools) |
+| `sleep on\|off` | Headset asleep: ports 22 and 32000 accept and never answer, so SSH times out |
+| `sshd on\|off` | sshd stopped: new connections are refused, open ones stay |
+| `devkit-service on\|off` | Port 32000 closed |
+| `disk-full on\|off` | Fills the small (64 MB) filesystem on `~/devkit-game` |
+| `runtime NAME installed\|missing` | Proton, the Steam Linux Runtimes, Lepton |
+| `battery KEY=VALUE...` | e.g. `capacity=15 status=Discharging current_now=-900000` |
+| `keys harness\|none`, `authorized-keys` | Set or read `~/.ssh/authorized_keys` |
+| `reset`, `state`, `calls [TOOL]` | Start over; read the state and call log |
+
+### What the fake can't show
+
+- Rendering: the headset view, desktop capture content, live video, SteamVR,
+  gamescope and panels. The capture stub returns a placeholder PNG.
+- Proton and FEX: whether a Windows or x86-64 program actually runs.
+- Android: there's no Android in the Lepton stand-in, so no ADB, display
+  settings, probes or app crashes.
+- The real Steam client's UI and anything it does that isn't modelled, and
+  mDNS discovery.
+- `sudo` and the power buttons, Tailscale, and the Windows and macOS sides of
+  the app (the host container is Linux, so the `rsync` paths are tested and the
+  `scp` fallback isn't).
+
+## Headset smoke test
+
+```sh
+scripts/frame-smoke.sh           # needs `ssh frame` to work without a password
+scripts/frame-smoke.sh --pair    # also pairs a throwaway key: approve it in the headset
+```
+
+It checks `properties.json` and the status, then installs, launches and
+removes three tiny titles built from bytes by `tests/smoke/tiny_programs.py`
+(an ARM64 and an x86-64 static Linux program that sleep for ten seconds, and
+an x86-64 `.exe` that exits at once). A launch passes only with fresh evidence:
+the ARM64 program running, the `.exe` started (its process or Steam's log),
+and the x86-64 program running or Steam logging that its runtime isn't
+installed, which is what the Frame does today. Steam's log lines about each
+title are kept.
+
+Everything it installs is removed again, also after a failure: the titles and
+their Steam shortcuts, a paired key, and `~/devkit-utils` if it wasn't there
+before (if it was, it stays, synced to this checkout as Frame Control always
+does). A cleanup that fails counts as a failed step. Results go to
+`tests/smoke/results/<time>-<BUILD_ID>.json` (not committed) with a summary on
+screen; it exits 0 when every step passed, 1 if one failed, 2 if the headset
+isn't reachable.
+
+`--pair` asks the devkit service to pair a new RSA key, which needs someone
+in the headset to open **Settings → Developer → Pair new host** and approve
+it; the key is checked and then taken out of `authorized_keys` again.
+
+## When the device disagrees with the fake
+
+The fake is only as good as what's been seen on a headset. When the smoke
+test (or anyone) finds the Frame doing something else:
+
+1. Record what the device did, with the date and BUILD_ID, in the doc that
+   covers it (`docs/sideloading.md`, `docs/ssh.md` and so on).
+2. Change the fake to match, with a comment citing that observation. The
+   behaviours are in `tests/fakeframe/rootfs/usr/local/lib/fakeframe/`
+   (`fakesteam.py` for Steam, `cef_shim.js` for DevTools, `init.py` for the
+   switches, the stubs in `rootfs/usr/local/bin`).
+3. Run `scripts/e2e.sh`. If the app is wrong, the tests now fail the way the
+   device did; fix the app and add a unit test.
+
+For example, on 2026-09-27 the smoke test found that Steam's `create-shortcut`
+refuses ids with a hyphen (`missing/invalid arguments`), which the fake had
+accepted. The fake now refuses them the same way, and Frame Control makes ids
+Steam accepts.

docs/web-install.md

@@ -0,0 +1,158 @@
+# Install links for websites
+
+A website can put an "Install with Frame Control" button next to its download.
+Clicking it opens Frame Control, which shows what the link wants to install and
+asks the user. Only after they click **Install** does it download the file and
+install it on the Frame.
+
+What's verified: the link parsing, URL rules, manifest parsing, download,
+size cap and sha256 check, by `tests/test_webinstall.py` and
+`tests/test_server.py` (no network: a stub server on 127.0.0.1). Installing on
+the headset is the same code as dropping a file on Frame Control: `.apk` files go
+to the APK installer ([apks.md](apks.md)), `.zip` and `.exe` files to the
+Linux/Windows title installer. A link hasn't been clicked through to a headset
+install yet.
+
+## The link
+
+```
+frame-control://install?manifest=<URL-encoded manifest URL>
+frame-control://install?url=<URL-encoded file URL>
+```
+
+Use `manifest` when you can: it carries the title's name and a sha256, which
+Frame Control checks before installing. `url` is for a file on its own; the
+dialog then names the title after the file.
+
+The manifest is FrameDrop's format, so one manifest serves both apps. The
+schema may be `framedrop.install/v1` or `frame-control.install/v1`:
+
+```json
+{
+  "schema": "framedrop.install/v1",
+  "name": "My Game",
+  "files": [
+    { "url": "https://cdn.example.com/mygame-arm64.apk", "sha256": "optional-but-better" }
+  ]
+}
+```
+
+| Field | |
+|---|---|
+| `schema` | Required, one of the two above |
+| `name` | Shown in the confirm dialog (at most 120 characters). Defaults to the file name. APKs are still named in the Steam library by their own label |
+| `files` | Exactly one entry for now; more is refused with a message |
+| `files[0].url` | Required. The file to install |
+| `files[0].sha256` | Optional, 64 hex digits. The download must match or nothing is installed |
+| `files[0].size` | Optional (Frame Control extension), bytes. Shown up front; the download must match |
+| `files[0].exe` | Optional (Frame Control extension), for a `.zip` title: the program inside it to run |
+
+What gets installed depends on the file name's extension:
+
+| File | Installed as |
+|---|---|
+| `.apk` | An Android app in its own Lepton instance with a Steam shortcut ([apks.md](apks.md)) |
+| `.zip`, `.exe` | A Linux or Windows title. Versions of Frame Control without the title installer say "Linux/Windows titles need a newer Frame Control" |
+| anything else | Refused |
+
+## Rules
+
+Frame Control refuses a link, and downloads nothing, unless:
+
+- Every URL (the manifest's, the file's and each redirect) is `https://`.
+  `http://` works only for `localhost` or `127.0.0.1`, for testing: only when
+  Frame Control runs with `FRAME_CONTROL_LOCAL_LINKS=1`, and only when the
+  link itself points there. It's off by default so a website's link can't make
+  the app fetch from services on your computer, and a public manifest can
+  never send it there.
+- No URL has a user name or password in it (`https://user:pw@…`).
+- No host is, or resolves to, a private, loopback, link-local, CGNAT
+  (100.64.0.0/10), multicast or otherwise non-public address. Every address
+  the name has must be public, it's checked again on every redirect (at most
+  5), and the download connects to the address that was checked.
+- The file URL ends in a file name with one of the extensions above
+  (`https://example.com/games/` is refused).
+- The manifest is JSON of at most 256 KB, and the file at most 4 GiB
+  (`MAX_MANIFEST` and `MAX_FILE` in `ui/frame_webinstall.py`).
+- The user confirms. The dialog shows the title's name, the site the link came
+  from (and the file's host if different), the file name and type, the size if
+  known, and whether a sha256 was given.
+
+A web page can't install anything itself: it can only open the link. Frame
+Control's local server refuses requests from web pages, so the only way in is
+the operating system handing the link to the app, then the user's click.
+
+## Button for your site
+
+Paste this where the download is, with your manifest's URL in `MANIFEST`:
+
+```html
+<a id="frame-control-install" href="#"
+   style="display:inline-block;padding:10px 18px;border-radius:4px;background:#1a9fff;color:#fff;
+          font:600 15px -apple-system,'Segoe UI',sans-serif;text-decoration:none">Install with Frame Control</a>
+<script>
+(() => {
+  const MANIFEST = "https://example.com/mygame/frame-control.json";
+  const GET_APP = "https://github.com/saphid/steam-frame/releases/latest";
+  const button = document.getElementById("frame-control-install");
+  button.href = "frame-control://install?manifest=" + encodeURIComponent(MANIFEST);
+  button.addEventListener("click", () => {
+    // If Frame Control opens, this page loses focus; if it doesn't, offer the download.
+    let left = false;
+    const away = () => { left = true; };
+    window.addEventListener("blur", away, { once: true });
+    setTimeout(() => {
+      window.removeEventListener("blur", away);
+      if (!left && confirm("Frame Control didn't open. Download it?")) location.href = GET_APP;
+    }, 2000);
+  });
+})();
+</script>
+```
+
+For a single file, use `"frame-control://install?url=" + encodeURIComponent(FILE_URL)`.
+
+`docs/install.html` is a landing page that does the same from a plain link:
+`install.html?manifest=<URL-encoded URL>` tries the app and shows a "Get Frame
+Control" link. It isn't published anywhere yet; host a copy to use it.
+
+## Testing locally
+
+Start Frame Control with `FRAME_CONTROL_LOCAL_LINKS=1` in its environment (for
+example `FRAME_CONTROL_LOCAL_LINKS=1 npm start` in `app/`), then serve the
+manifest and file from your own computer:
+
+```sh
+cd mygame && python3 -m http.server 8000
+open 'frame-control://install?manifest=http%3A%2F%2Flocalhost%3A8000%2Fmanifest.json'   # xdg-open on Linux, start "" on Windows
+```
+
+The manifest's file URL must then be `http://localhost:8000/…` or
+`http://127.0.0.1:8000/…` too.
+
+## How it works
+
+- `app/install-link.js` parses the link (only `frame-control://install` with
+  exactly one `manifest` or `url`); `app/main.js` registers the scheme
+  (`app.setAsDefaultProtocolClient`, and electron-builder's `protocols` for the
+  macOS Info.plist and the Linux `.desktop` file). macOS delivers links through
+  `open-url`, Windows and Linux as an argument to a second instance. Links
+  wait in the main process until the page has loaded and asked for them
+  (`frameApp.onInstallLink` in `app/preload.js`). `framedrop://` is left alone.
+- The page posts the link to `/api/webinstall/check`, which reads the manifest,
+  applies the rules, asks the file's size with a HEAD request and returns a
+  one-time id. Nothing is downloaded.
+- **Install** posts the id to `/api/webinstall/start`. The server downloads to
+  a temporary folder (progress at `/api/webinstall/job`, cancellable with
+  `/api/webinstall/cancel`), checks size and sha256, hands the file to
+  `frame_webinstall.dispatch()` and deletes the folder.
+- The app registers the scheme each time it starts, so the last Frame Control
+  started (e.g. a development checkout) handles the links.
+
+**Quitting during a stalled download.** On macOS and Linux, quitting stops a
+download at once (`shutdown()` on its socket wakes the blocked read). On
+Windows that doesn't wake a read in another thread, and closing the handle
+under a TLS read isn't safe, so a download that has stalled holds the quit for
+the 4-second grace period until the app stops the server; the partial file is
+removed on the next start. Downloads that are still moving stop at their next
+read either way.

docs/webxr-chromium.md

@@ -3,6 +3,12 @@
 Goal: open a web VR180 or 360 player (DeoVR and DL8 embeds, WebXR samples),
 press its VR button, and watch in 3D in the headset.
 
+The build and installer now live in their own public repo,
+[saphid/chromium-webxr-steam-frame](https://github.com/saphid/chromium-webxr-steam-frame):
+a build script for an x86-64 Linux host, the SO_PEERCRED patch, and a
+Frame-side installer that adds "Chromium XR" to the Steam library. This page
+keeps the findings and what was verified on this Frame.
+
 ## Why Flathub Chromium can't
 
 **Verified 2026-09-25** (Frame BUILD_ID 20260922.6101926, Flathub
@@ -41,42 +47,95 @@ gets both.
 SteamVR (`bin/linuxarm64/vrclient.so`, `VALVE_runtime_is_steamvr`). The
 Linux backend uses Vulkan (`XR_USE_GRAPHICS_API_VULKAN`).
 
-## Building it
+## Building and installing it
 
-[`scripts/build-chromium-xr.sh`](../scripts/build-chromium-xr.sh)
-cross-compiles arm64 Linux Chromium on an x64 Linux host. It doesn't need
-sudo: the arm64 sysroot comes from Chromium's own script. It needs about
-90 GB of disk. It shallow-fetches the CL ref, runs `gclient sync --no-history`,
-installs the sysroot, builds `chrome` with `symbol_level=0` and proprietary
-codecs, and packs `chromium-xr-arm64.tar.xz`. Progress is logged to
-`~/chromium-xr/stage`. The build aborts if `/` drops below 12 GB free.
+Follow the [public repo's README](https://github.com/saphid/chromium-webxr-steam-frame#build).
+In short: `build/build.sh` on an x64 Linux host (no sudo, about 90 GB of
+disk) produces `chromium-xr-arm64.tar.xz` (about 145 MB), and
+`frame/install.sh` on the Frame unpacks it to `~/chromium-xr`, installs the
+`chromium-xr` launcher in `~/.local/bin`, and adds the Steam library shortcut
+through the Steam client's DevTools port, the same way as T3 Code
+([apks.md](apks.md)). Launching the shortcut gives Chromium its own panel,
+`valve.steam.desktopgame.<appid>`, like any other app.
 
-First run: a 12-core, 31 GB x64 Linux box, started 2026-09-25.
+First build, 2026-09-25, on a 12-thread, 31 GB x64 Linux box: 9 h 33 min for
+94,835 steps, giving Chromium 156.0.8071.0. A rebuild after a one-file change
+takes under a minute, plus about 4 minutes to repack.
 
-## Running it on the Frame
+To debug from the Mac, launch it as a panel with DevTools on the Frame
+(verified 2026-09-27):
+`scripts/panel-on-frame.sh -- '~/.local/bin/chromium-xr' --remote-debugging-port=9223 URL`
+([panels.md](panels.md)). DevTools has no authentication. It listens on
+loopback, but with the userspace Tailscale from [tailscale.md](tailscale.md)
+running, loopback ports are reachable from your tailnet. Close the browser
+when you're done. Chromium runs one browser per profile, so close the
+Steam-launched one first or the flag is ignored.
 
-[`scripts/chromium-xr.sh`](../scripts/chromium-xr.sh):
+**The SO_PEERCRED fix.** The XR seccomp policy refuses `getsockopt`. SteamVR's
+client calls `getsockopt(SOL_SOCKET, SO_PEERCRED)` inside `xrCreateInstance`,
+so the XR process died with a seccomp crash (arm64 syscall 209). The patch
+allows that one option. It's needed but not enough: the launcher still turns
+seccomp off (below), so the patch only matters once that's fixed too.
 
-```sh
-BUILD_HOST=my-linux-box scripts/chromium-xr.sh install  # your build host; scp, unpack to ~/chromium-xr
-scripts/chromium-xr.sh launch [URL]     # headset desktop, --enable-features=OpenXR
-scripts/chromium-xr.sh check            # prints isSessionSupported('immersive-vr')
-```
+**Seccomp is off.** The launcher passes `--disable-seccomp-filter-sandbox`.
+With the XR seccomp policy on, SteamVR's client reads `/proc/self/status`
+through Chrome's file broker and gets the broker's pid. SteamVR then binds
+the app to the wrong process ("Unable to init path manager:
+VRInitError_Init_Internal") and `xrCreateInstance` fails. The broker can't
+answer `/proc/self` for another process, so fixing this needs a change in
+Chromium's broker client or in the CL. The namespace sandbox stays on, but
+seccomp is off for every process, so use this profile for VR sites rather
+than everyday browsing.
 
-It runs natively, not as a Flatpak, so the XR sandbox and SteamVR's IPC work
-as the CL expects. It uses its own profile (`~/.config/chromium-xr`) and
-DevTools on loopback port 9223, so it doesn't collide with the Flatpak's 9222.
+**Upstream (2026-09-27).** CL 8441736 (the XR sandbox) has merged into
+Chromium, still refusing `getsockopt`; CL 8132979 is still in review. Valve
+and the CLs' author are working on Steam Frame support
+([utzcoz/chromium-webxr-linux#5](https://github.com/utzcoz/chromium-webxr-linux/issues/5)).
+Both sandbox problems above, with the patch, are reported in
+[utzcoz/chromium-webxr-linux#7](https://github.com/utzcoz/chromium-webxr-linux/issues/7).
 
-**Verified 2026-09-25:**
+**Verified 2026-09-26** (Frame BUILD_ID 20260922.6101926, SteamVR 2.17.10,
+this build):
 
-- Vulkan is there: Turnip (Mesa) on Adreno 750, API 1.4.359.
-- Unprivileged user namespaces work (`unshare -Ur true`), so Chromium's
-  namespace sandbox shouldn't need the setuid `chrome_sandbox`.
+- `isSessionSupported('immersive-vr')` is `true`. The WebXR samples page
+  shows "VR support detected".
+- `requestSession('immersive-vr')` succeeds after the prompt. With a WebGL
+  layer, the first XR frame has a viewer pose with 2 views and a
+  2880 × 1440 framebuffer (1440 × 1440 per eye).
+- SteamVR moves the app from `VRApplication_OpenXRInstance` to
+  `VRApplication_OpenXRScene` and gives it scene focus. `xrEndFrame` submits
+  both projection views, and the compositor receives the 2880 × 1440 scene.
+- The OpenXR runtime uses Vulkan (`XR_KHR_vulkan_enable2`). Chromium's own GPU
+  process uses ANGLE on GL, running on zink over Turnip Vulkan (Adreno 750);
+  Chromium's Vulkan backend is off. That doesn't stop the session.
+- Unprivileged user namespaces work (`unshare -Ur true`), so the namespace
+  sandbox runs without the setuid `chrome_sandbox`.
+- **With the headset on** (same day, seccomp sandbox off): the WebXR
+  samples' Immersive VR Session showed its scene in the headset, and SteamVR
+  loaded the Frame controller bindings for the app. The three.js
+  [`webxr_vr_video`](https://threejs.org/examples/webxr_vr_video.html) demo,
+  a stereo 360 video, played in 3D after pressing Enter VR.
 
-**Unverified (inferred):**
+- **Launched from the Steam library, verified remotely 2026-09-27** with
+  nobody wearing the headset (standby workaround in
+  [how-the-frame-works.md](how-the-frame-works.md)). The installer's Steam
+  shortcut starts Chromium, and SteamVR takes it as scene app
+  `steam.app.<shortcut id>`. A minimal WebXR session that clears every frame
+  to red ran at about 75 frames per second, and the stereo headset capture
+  showed both eyes solid red. Steam preloads its overlay
+  (`gameoverlayrenderer.so`), which crashed Chromium's zygote about 30 s after
+  a Steam launch. The public repo's launcher now removes it from
+  `LD_PRELOAD`. With the headset outside its playspace, SteamVR shows
+  passthrough wherever the page leaves transparent pixels.
 
-- Chromium's GPU process may still fall back from Vulkan to GL on Turnip.
-- An immersive session started from a window on the nested desktop may not
-  hand over cleanly to the SteamVR compositor.
-- If the sandbox fails to start, `--no-sandbox` is the fallback for a first
-  test.
+- **Frame rate and input, measured 2026-09-27** (standby workaround, red
+  test session): 72 fps with every frame at 13.9–14 ms over 16 s, and SteamVR
+  dropped frames only at startup. The right controller showed up as an
+  `oculus-touch` `tracked-pointer` with an `xr-standard` gamepad and a
+  25-joint hand, with poses on every frame. A real squeeze reached the page
+  as `squeezestart`/`squeeze`. Haptics aren't exposed (no actuators).
+  Details are in the public repo's technical notes.
+
+**Not verified yet:** trigger, thumbstick and face buttons, the left
+controller, bare-hand tracking, and third-party VR180 players (DeoVR and
+DL8 web embeds).

frame/devkit-utils/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017-2022 Valve Software inc., Collabora Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

frame/devkit-utils/README.md

@@ -0,0 +1,18 @@
+# Valve's devkit-utils (vendored)
+
+Unmodified copy of `client/devkit-utils/` from Valve's
+[SteamOS Devkit Client](https://gitlab.steamos.cloud/devkit/steamos-devkit),
+MIT licensed (see `LICENSE`; Valve's own notes are in `VALVE-README.md`).
+
+- Source: steamos-devkit, commit `6f0711a` ("Code drop."),
+  release **v0.20260925.1** (ChangeLog entry dated 2026-09-25).
+
+`ui/frame_titles.py` copies this folder to `~/devkit-utils` on the Frame (where
+Valve's own client puts it) and uses `steamos-prepare-upload`,
+`steam-client-create-shortcut`, `steam-devkit-rpc` and `steamos-delete` to
+register uploaded builds as Steam "Devkit Games". See `docs/sideloading.md`.
+
+To update: copy the folder from a newer checkout over this one, keep this
+README, and update the version line above. The stamp Frame Control compares
+on the headset is a hash of these files, so a changed copy is re-synced on the
+next use.

frame/devkit-utils/VALVE-README.md

@@ -0,0 +1,4 @@
+These scripts and supporting utility module are uploaded to the devkit by the devkit client:
+
+- steamos-* : scripts that operate (mostly) at SteamOS level for devkit functionality purposes
+- steam-client-* : scripts that relay commands to the local running Steam client

frame/devkit-utils/deckard-capture

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import sys
+import os
+import time
+import subprocess
+import logging
+import argparse
+import json
+import datetime
+import io
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+def main():
+    parser = argparse.ArgumentParser(description='Capture screenshot and videos on Steam Frame device')
+    parser.add_argument('--filename', '-f',
+                       default='/tmp/screenshot.png',
+                       help='Output')
+    parser.add_argument('--timestamp', action='store_true',
+                       help='Add timestamp')
+    parser.add_argument('--json', action='store_true',
+                       help='Output result as JSON')
+
+    args = parser.parse_args()
+
+    output_buffer = io.StringIO()
+    try:
+        steamvr_path = subprocess.check_output(['steamvr', 'path'], stderr=subprocess.STDOUT, universal_newlines=True).strip()
+        cdd = os.path.join(steamvr_path, 'bin/linuxarm64')
+        run_vrcmd = os.path.join(cdd, 'vrcmd')
+        assert os.path.exists(run_vrcmd), "vrcmd not found"
+
+        # Enable recording
+        cmd = [run_vrcmd, '--mailboxcmd', 'vrcompositor_systemlayer', 'set_local_video_record?enabled=true']
+        output_buffer.write(f"Command: {' '.join(cmd)}\n")
+        result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+        output_buffer.write(result.stdout)
+        if result.returncode != 0:
+            raise subprocess.CalledProcessError(result.returncode, cmd)
+
+        # Wait for the video device to produce frames.
+        # Note that even when disabled it outputs roughly 2 blank frames per second.
+        cmd = ['timeout', '1', 'ffmpeg', '-f', 'v4l2', '-i', '/dev/video99', '-frames:v', '4', '-f', 'null', '-', '-v', 'error']
+        output_buffer.write(f"Command: {' '.join(cmd)}\n")
+        retries = 2
+        while True:
+            result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+            output_buffer.write(result.stdout)
+            if result.returncode == 0:
+                break
+            retries -= 1
+            if retries <= 0:
+                raise Exception("Failed to get video frames from /dev/video99. Is VR active? Is the v4l2 configuration correct?")
+
+        output_filename = args.filename
+        if args.timestamp:
+            timestamp = datetime.datetime.now().strftime("%Y-%m-%d-%H-%M-%S")
+            base, ext = os.path.splitext(output_filename)
+            output_filename = f"{base}-{timestamp}{ext}"
+
+        # Capture screenshot
+        cmd = ['ffmpeg', '-f', 'v4l2', '-i', '/dev/video99', '-frames:v', '1', '-q:v', '1', '-y', output_filename]
+        output_buffer.write(f"Command: {' '.join(cmd)}\n")
+        result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+        output_buffer.write(result.stdout)
+        if result.returncode != 0:
+            raise subprocess.CalledProcessError(result.returncode, cmd)
+
+        # Disable recording
+        cmd = [run_vrcmd, '--mailboxcmd', 'vrcompositor_systemlayer', 'set_local_video_record?enabled=false']
+        output_buffer.write(f"Command: {' '.join(cmd)}\n")
+        result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+        output_buffer.write(result.stdout)
+        if result.returncode != 0:
+            raise subprocess.CalledProcessError(result.returncode, cmd)
+
+    except Exception as e:
+        error_msg = str(e)
+        # Print collected output to stderr on error
+        print(output_buffer.getvalue(), file=sys.stderr)
+        logger.error(error_msg)
+
+        if args.json:
+            result = {
+                'success': False,
+                'error': error_msg
+            }
+            print(json.dumps(result))
+        else:
+            print(f"Error: {error_msg}", file=sys.stderr)
+
+        return 1
+
+    if args.json:
+        result = {
+            'success': True,
+            'output': output_filename
+        }
+        print(json.dumps(result))
+    else:
+        print(f"Screenshot saved to {output_filename}")
+
+if __name__ == '__main__':
+    sys.exit(main())

frame/devkit-utils/devkit_utils/__init__.py

@@ -0,0 +1,300 @@
+#!/usr/bin/env python
+# encoding: utf-8
+"""Utility functions for the Steam client hook scripts"""
+
+import sys
+import os
+import traceback
+import tempfile
+import json
+import logging
+import fcntl
+import errno
+import contextlib
+import time
+import fcntl
+
+
+import logging as logging_module
+logger = logging_module.getLogger(__name__)
+
+
+@contextlib.contextmanager
+def wrap_outputs(stderr_prefix):
+    # capture stderr to file to support debugging
+    stderr_fd = sys.stderr.fileno()
+    tf = tempfile.NamedTemporaryFile(
+        mode='w+',
+        prefix=stderr_prefix,
+        delete=True)
+    if sys.version_info >= (3, 4):
+        # this API in the os module is only available for python3
+        # but it does not seem to work with subprocess anyway
+        os.set_inheritable(tf.file.fileno(), True)
+        assert os.get_inheritable(tf.file.fileno())
+    sys.stderr = tf.file
+
+    # we can only write out a json response to stdout,
+    # so redirect stdout to stderr,
+    # and keep a handle on the original stdout for the response
+    stdout_fd = os.dup(sys.stdout.fileno())
+    os.dup2(sys.stderr.fileno(), sys.stdout.fileno())
+
+    ctx = {}
+    try:
+        yield ctx
+    except:
+        logger.error(traceback.format_exc())
+    finally:
+        tf.flush()
+        tf.seek(0)
+        os.write(stderr_fd, tf.read().encode('utf-8'))
+        if 'ret' in ctx:
+            os.write(stdout_fd, json.dumps(ctx['ret']).encode('utf-8'))
+
+
+class SteamClientNotRunningException(Exception):
+    def __init__(self, error_message):
+        self.error_message = error_message
+
+    def __str__(self):
+        return self.error_message
+
+
+def validate_steam_client():
+    """Verify that the steam client is running, and permissions are adequate"""
+    pid_path = os.path.normpath(
+        os.path.realpath(
+            os.path.expanduser('~/.steam/steam.pid')))
+    if not os.path.exists(pid_path):
+        raise SteamClientNotRunningException('{0} does not exist'.format(pid_path))
+    try:
+        pid = int(open(pid_path, 'rt').read())
+    except Exception:
+        raise SteamClientNotRunningException('{0} is invalid'.format(pid_path))
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        raise SteamClientNotRunningException('{0} does not refer to a valid process'.format(pid_path))
+    logger.info('Found steam client pid %s', pid)
+
+
+def execute_steam_client_command(cmd):
+    """Send a command to the steam client over the IPC pipe"""
+    pipe_path = os.path.normpath(
+        os.path.realpath(
+            os.path.expanduser('~/.steam/steam.pipe')))
+    try:
+        pipe = open(pipe_path, 'wb+', 0)
+    except IOError:
+        raise Exception('cannot open steam client pipe')
+    session_token = open(os.path.expanduser('~/.steam/steam.token')).read()
+    #pipe_cmd = 'steam://{0}'.format(cmd)
+    # ^ hack to execute a normal command over the IPC directly - sometimes useful
+    pipe_cmd = 'devkit-1 steam://devkit-1/{0}/{1}'.format(
+        session_token,
+        cmd
+    )
+    logger.debug('Sending command line:')
+    logger.debug(pipe_cmd)
+    pipe.write('{0}\n'.format(pipe_cmd).encode('utf-8'))
+    pipe.close()
+
+
+def save_argv(gameid, argv):
+    """Save command line and arguments if provided"""
+
+    if argv is None:
+        return
+
+    argvfile = os.path.join(os.getenv("HOME"), "devkit-game",
+                            gameid + "-argv.json")
+    try:
+        with open(argvfile, "w") as argvf:
+            fcntl.flock(argvf, fcntl.LOCK_EX)
+            json.dump(argv, argvf)
+            fcntl.flock(argvf, fcntl.LOCK_UN)
+    except IOError:
+        raise Exception(
+            "Unable to open argv file for writing: {0}".format(argvfile))
+
+
+def obtain_argv(gameid, argv):
+    """Obtain command line with arguments"""
+
+    # If present and not None or [], just return the local arguments
+    if argv:
+        return argv
+
+    # From here, expect arguments to have been saved previously
+    argvfile = os.path.join(os.getenv("HOME"), "devkit-game",
+                            gameid + "-argv.json")
+    try:
+        with open(argvfile, "r") as argvf:
+            fcntl.flock(argvf, fcntl.LOCK_EX)
+            argv = json.load(argvf)
+            fcntl.flock(argvf, fcntl.LOCK_UN)
+    except IOError:
+        raise Exception(
+            "Unable to open argv file for reading: {0}".format(argvfile))
+    return argv
+
+
+def save_env(gameid, env):
+    """Save environment variables if provided"""
+
+    if not env:
+        return
+
+    envfile = os.path.join(os.getenv("HOME"), "devkit-game",
+                            gameid + "-env.json")
+    try:
+        with open(envfile, "w") as envf:
+            fcntl.flock(envf, fcntl.LOCK_EX)
+            json.dump(env, envf)
+            fcntl.flock(envf, fcntl.LOCK_UN)
+    except IOError:
+        raise Exception(
+            "Unable to open env file for writing: {0}".format(envfile))
+
+
+def obtain_env(gameid):
+    """Obtain environment variables for a game, if any were saved"""
+
+    envfile = os.path.join(os.getenv("HOME"), "devkit-game",
+                            gameid + "-env.json")
+    try:
+        with open(envfile, "r") as envf:
+            fcntl.flock(envf, fcntl.LOCK_EX)
+            env = json.load(envf)
+            fcntl.flock(envf, fcntl.LOCK_UN)
+    except IOError:
+        return {}
+    return env
+
+
+def save_settings(gameid, data):
+    """Save settings"""
+    settingsfile = os.path.join(os.getenv("HOME"), "devkit-game",
+                                gameid + "-settings.json")
+    settings = dict()
+
+    if data.get('clear_settings', False):
+        settings = {}
+    else:
+        try:
+            with open(settingsfile, "r") as f:
+                fcntl.flock(f, fcntl.LOCK_EX)
+                settings = json.load(f)
+                fcntl.flock(f, fcntl.LOCK_UN)
+        except IOError as e:
+            if (e.errno != errno.ENOENT):
+                raise
+
+    # Merge settings from new json
+    if 'settings' in data:
+        settings.update(data['settings'])
+
+    try:
+        with open(settingsfile, "w") as f:
+            fcntl.flock(f, fcntl.LOCK_EX)
+            json.dump(settings, f)
+            fcntl.flock(f, fcntl.LOCK_UN)
+    except (IOError):
+        raise Exception(
+            "Unable to open settings file for writing: {0}".format(
+                settingsfile
+            ))
+
+    return settings
+
+
+def load_settings(gameid):
+    settingsfile = os.path.join(os.getenv("HOME"), "devkit-game", gameid + '-settings.json')
+
+    if not os.path.isfile(settingsfile):
+        return None
+
+    with open(settingsfile, "r") as f:
+        fcntl.flock(f, fcntl.LOCK_EX)
+        settings = json.load(f)
+        fcntl.flock(f, fcntl.LOCK_UN)
+
+    return settings
+
+
+class SteamResponse_Timeout(Exception):
+    pass
+
+
+class SteamResponse_Error(Exception):
+    def __init__(self, error_response):
+        self.error_response = error_response
+
+    def __str__(self):
+        return self.error_response
+
+
+@contextlib.contextmanager
+def wait_on_file_response(path, timeout=5):
+    """
+The pipe to the Steam Client is one way.
+Responses from the Steam Client are written to filesystem.
+Protocol is as follows:
+- Steam Client creates a 'path.lock' file
+- Steam Client writes either 'path' or 'path.error' to indicate a problem
+- Steam Client deletes 'path.lock'
+- Caller (us) can then read the response
+
+NOTE 1: this function is used as a context manager and will block until a response comes in or timeout.
+
+NOTE 2: the files are created by Steam when responding to a command. If the files already exist the response protocol will break.
+    """
+    lock_path = '{0}.lock'.format(path)
+    error_path = '{0}.error'.format(path)
+    max_count = timeout
+    while True:
+        time.sleep(1)
+        if os.path.exists(error_path) or os.path.exists(path) and not os.path.exists(lock_path):
+            if os.path.exists(error_path):
+                with open(error_path, 'r') as f:
+                    fcntl.flock(f, fcntl.LOCK_EX)
+                    error_response = f.read()
+                    fcntl.flock(f, fcntl.LOCK_UN)
+                    raise SteamResponse_Error(error_response)
+            with open(path, 'r') as f:
+                fcntl.flock(f, fcntl.LOCK_EX)
+                success_response = f.read()
+                yield success_response
+                fcntl.flock(f, fcntl.LOCK_UN)
+                return
+        max_count -= 1
+        if max_count > 0:
+            continue
+        raise SteamResponse_Timeout()
+
+
+# Setting up as a context manager so we never miss the deletion
+# Creating a temporary .lock file to guard the create operation
+@contextlib.contextmanager
+def create_pid(pid_path):
+    os.makedirs(os.path.dirname(pid_path), exist_ok=True)
+    lock_path = '{0}.lock'.format(pid_path)
+    try:
+        lock_file = os.open(lock_path, os.O_CREAT | os.O_EXCL)
+    except IOError as e:
+        logger.error('cannot create lock file %s for pid file %s', lock_path, pid_path)
+        logger.error('remove the lock file manually and run again if you are confident no other instance is active')
+        raise
+
+    pid_file = open(pid_path,'w')
+    pid_file.write(str(os.getpid()))
+    pid_file.flush()
+    os.close(lock_file)
+    os.unlink(lock_path)
+    try:
+        yield pid_file
+    finally:
+        pid_file.close()
+        # Assume that's atomic and all is well, no need for another .lock
+        os.unlink(pid_path)

frame/devkit-utils/devkit_utils/resolve.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import logging
+from urllib.parse import quote_plus as urllib_quote_plus
+import json
+import tempfile
+
+from . import validate_steam_client
+from . import execute_steam_client_command
+from . import wait_on_file_response
+
+import logging as logging_module
+logger = logging_module.getLogger(__name__)
+
+
+def resolve_shortcuts():
+    # make sure there is a steam client online that we can talk to before doing anything
+    validate_steam_client()
+
+    # scan the devkit games
+    installed_gameids = set([])
+    devkit_game_path = os.path.expanduser('~/devkit-game')
+    if not os.path.exists(devkit_game_path):
+        logger.info('%r does not exist, creating', devkit_game_path)
+        os.mkdir(devkit_game_path)
+    entries = sorted(os.scandir(devkit_game_path), key=lambda entry: entry.name)
+    directories = [e for e in entries if e.is_dir()]
+    for d in directories:
+        gameid = d.name
+        file_names = [f.name for f in entries if f.is_file() and f.name.startswith(gameid)]
+        has_argv = '{0}-argv.json'.format(gameid) in file_names
+        has_settings = '{0}-settings.json'.format(gameid) in file_names
+        if (not has_argv and not has_settings):
+            logger.info('Subfolder %r in %r is not accompanied by devkit configuration files, ignoring', d.name, devkit_game_path)
+            continue
+        logger.info('Found installed Devkit Game: %r', gameid)
+        installed_gameids.add(gameid)
+
+    # ask the Steam Client which Devkit Games are registered
+    with tempfile.TemporaryDirectory(prefix='list-shortcuts') as tempdir:
+        response = os.path.join(tempdir, 'shortcuts.json')
+        cmd = 'list-shortcuts?response={}'.format(
+            urllib_quote_plus(os.path.join(response))
+        )
+        # send the request
+        execute_steam_client_command(cmd)
+        with wait_on_file_response(response) as response:
+            client_shortcuts = json.loads(response)
+    logger.debug(client_shortcuts)
+    assert client_shortcuts['version'] == 2
+    registered_gameids = set([])
+    logger.info('Steam Client has %d registered devkit game(s)', len(client_shortcuts['gameids']))
+    for gameid in client_shortcuts['gameids']:
+        logger.info('Found Devkit Game registered with Steam Client: %r', gameid)
+        registered_gameids.add(gameid)
+
+    # any registered game that is not found installed on disk needs to be removed
+    for remove_gameid in registered_gameids - installed_gameids:
+        with tempfile.TemporaryDirectory(prefix='delete-shortcut') as tempdir:
+            logger.info('Removing stale registered Devkit Game: %r', remove_gameid)
+            response = os.path.join(tempdir, 'shortcut-deleted')
+            cmd = 'delete-shortcut?response={}&gameid={}'.format(
+                urllib_quote_plus(response),
+                remove_gameid
+            )
+            execute_steam_client_command(cmd)
+            with wait_on_file_response(response) as response:
+                logger.info('from Steam Client: %s', response.strip())
+
+    # any installed game that is not found registered needs to be added
+    for add_gameid in installed_gameids - registered_gameids:
+        with tempfile.TemporaryDirectory(prefix='create-shortcut') as tempdir:
+            logger.info('Registering installed Dekit Game: %r', add_gameid)
+            response = os.path.join(tempdir, 'registered')
+            cmd = 'create-shortcut?response={}&gameid={}&directory={}'.format(
+                urllib_quote_plus(response),
+                add_gameid,
+                urllib_quote_plus(devkit_game_path)
+            )
+            execute_steam_client_command(cmd)
+            with wait_on_file_response(response) as response:
+                logger.info('from Steam Client: %s', response.strip())
+
+if __name__ == '__main__':
+    resolve_shortcuts()

frame/devkit-utils/steam-client-create-shortcut

@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+
+import os
+import logging
+import argparse
+import json
+import platform
+import tempfile
+from urllib.parse import quote_plus as urllib_quote_plus
+
+import devkit_utils
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger()
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--parms', required=True, action='store')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    parms = json.loads(conf.parms)
+    gameid = parms['gameid']
+    directory = parms['directory']
+    assert os.path.isdir(directory)
+
+    force_appid = parms['force_appid']
+    steam_appid_path = os.path.join(directory, 'steam_appid.txt')
+    if force_appid:
+        with open(steam_appid_path, 'w') as f:
+            f.write(force_appid + '\n')
+        logger.info(f'Wrote {steam_appid_path} with AppID {force_appid}')
+    elif os.path.exists(steam_appid_path):
+        # don't overwrite an existing steam_appid.txt file from the content tree
+        # NOTE: if the user sets an AppID through the tool, then delete it, we may leave it in place ..
+        # (that's ok for now, do a clean upload if you want to get rid of it)
+        logger.info(f'{steam_appid_path} already exists, leaving it in place')
+
+    # Lepton (Android runtime) titles: write UECommandLine.txt next to the .apk
+    is_lepton = parms['settings']['compat_tool'] == 'lepton'
+    uecommandline = parms['lepton_args'] if is_lepton else ''
+    uecommandline_path = os.path.join(directory, 'UECommandLine.txt')
+    if uecommandline:
+        with open(uecommandline_path, 'w') as f:
+            f.write(uecommandline + '\n')
+        logger.info(f'Wrote {uecommandline_path}')
+    elif os.path.exists(uecommandline_path):
+        # don't overwrite an existing UECommandLine.txt file from the content tree
+        # NOTE: if the user sets cmdline args through the tool, then clears them, we may leave it in place ..
+        # (that's ok for now, do a clean upload if you want to get rid of it)
+        logger.info(f'{uecommandline_path} already exists, leaving it in place')
+
+    logger.info(f'Updating command line and runtime settings for {gameid} on {platform.node()}')
+    devkit_utils.save_argv(gameid, parms['argv'])
+    devkit_utils.save_env(gameid, parms['env'])
+    devkit_utils.save_settings(gameid, parms)
+
+    ret = {}
+
+    try:
+        devkit_utils.validate_steam_client()
+    except devkit_utils.SteamClientNotRunningException as e:
+        skipping = 'The Steam client is not running. Registration did not complete.'
+        logger.warning(skipping)
+        ret['error'] = skipping
+    else:
+        with tempfile.TemporaryDirectory(prefix='create-shortcut') as tempdir:
+            logger.info(f'Registering Devkit Game {gameid} with Steam Client')
+            response = os.path.join(tempdir, 'registered')
+            cmd = 'create-shortcut?response={}&gameid={}'.format(
+                urllib_quote_plus(response),
+                gameid,
+            )
+            devkit_utils.execute_steam_client_command(cmd)
+            try:
+                with devkit_utils.wait_on_file_response(response) as success_response:
+                    logger.debug(success_response)
+                    ret['success'] = success_response
+            except devkit_utils.SteamResponse_Timeout:
+                ret['error'] = 'timeout - Steam client did not respond to registration request'
+            except devkit_utils.SteamResponse_Error as e:
+                ret['error'] = e.error_response
+
+    # response gets written out to stdout
+    print(json.dumps(ret))

frame/devkit-utils/steam-devkit-rpc

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import logging
+import argparse
+import tempfile
+import urllib.parse
+import re
+
+import devkit_utils
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger()
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('command')
+    parser.add_argument('args', nargs='*')
+    conf = parser.parse_args()
+
+    try:
+        devkit_utils.validate_steam_client()
+    except devkit_utils.SteamClientNotRunningException as e:
+        logger.error(repr(e))
+        sys.exit(-1)
+    else:
+        with tempfile.TemporaryDirectory(prefix='steam-devkit-rpc') as tempdir:
+            response = os.path.join(tempdir, 'steam-devkit-rpc')
+            parms = {
+                'response' : response,
+            }
+            for arg in conf.args:
+                (k, v) = re.split('=', arg)
+                parms[k] = v
+            cmd = f'{conf.command}/?{urllib.parse.urlencode(parms)}'
+            devkit_utils.execute_steam_client_command(cmd)
+            try:
+                with devkit_utils.wait_on_file_response(response) as success_response:
+                    logger.info('success')
+                    sys.stdout.write(success_response)
+                    sys.exit(0)
+            except devkit_utils.SteamResponse_Timeout:
+                logger.error('timeout')
+            except devkit_utils.SteamResponse_Error as e:
+                logger.error('failed')
+                sys.stdout.write(e.error_response)
+                sys.exit(-1)

frame/devkit-utils/steamos-delete

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import shutil
+import logging
+import argparse
+import subprocess
+
+import devkit_utils.resolve
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+
+def session_select_command():
+    if shutil.which('holo-session-select'):
+        return 'holo-session-select'
+    return 'steamos-session-select'
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--delete-title', required=False, action='store', help='Delete a devkit title by name')
+    parser.add_argument('--delete-all-titles', required=False, action='store_true', default=False, help='Delete all devkit titles uploaded')
+    parser.add_argument('--reset-steam-client', required=False, action='store_true', default=False, help='Reset Steam client and delete all local Steam content')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    if conf.delete_all_titles:
+        subprocess.check_call('rm -rf ~/devkit-game/*', shell=True)
+    elif conf.delete_title:
+        gamepath = os.path.expanduser( os.path.join( '~/devkit-game', conf.delete_title ) )
+        if not os.path.isdir(gamepath):
+            print(f'Not found: {gamepath}')
+        else:
+            subprocess.check_call(f'rm -r {gamepath}', shell=True)
+
+    # synchronize the Steam client's view of the devkit games with the on disk state
+    try:
+        devkit_utils.resolve.resolve_shortcuts()
+    except Exception as e:
+        logger.warning(f'Steam client sync of devkit games failed: {e}')
+
+    if conf.reset_steam_client:
+        # first make sure any sideloaded trampoline has been deleted
+        devkit_steam_trampoline_path = os.path.join(DEVKIT_TOOL_FOLDER, 'devkit-steam')
+        if os.path.exists(devkit_steam_trampoline_path):
+            os.unlink(devkit_steam_trampoline_path)
+
+        # wipe the local Steam install
+        subprocess.check_call(f'rm -rf ~/.local/share/Steam', shell=True)
+
+        # restart the session, which will initiate a reinstall of Steam from the OS client
+        subprocess.check_call([session_select_command(), 'gamescope'])

frame/devkit-utils/steamos-dump-controller-config

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+import os
+import logging
+import argparse
+import tempfile
+import json
+from urllib.parse import quote_plus as urllib_quote_plus
+
+import devkit_utils
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--appid', required=False, action='store')
+    parser.add_argument('--gameid', required=False, action='store')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    ret = {}
+
+    try:
+        devkit_utils.validate_steam_client()
+    except devkit_utils.SteamClientNotRunningException as e:
+        skipping = 'The Steam client is not running.'
+        logger.warning(skipping)
+        ret['error'] = skipping
+    else:
+        with tempfile.TemporaryDirectory(prefix='controller-config') as tempdir:
+            response = os.path.join(tempdir, 'dumpcontrollerconfig')
+            cmd = f'dumpcontrollerconfig?response={urllib_quote_plus(response)}'
+            if conf.appid:
+                cmd += f'&appid={conf.appid}'
+            if conf.gameid:
+                cmd += f'&gameid={conf.gameid}'
+            logger.debug(f'command: {cmd}')
+            devkit_utils.execute_steam_client_command(cmd)
+            try:
+                with devkit_utils.wait_on_file_response(response) as success_response:
+                    logger.debug(success_response)
+                    ret['success'] = success_response
+            except devkit_utils.SteamResponse_Timeout:
+                ret['error'] = 'timeout - Steam did not respond to the command request'
+            except devkit_utils.SteamResponse_Error as e:
+                ret['error'] = e.error_response
+
+    # response gets written out to stdout
+    print(json.dumps(ret))

frame/devkit-utils/steamos-get-status

@@ -0,0 +1,443 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import re
+import shutil
+import subprocess
+import logging
+import enum
+import argparse
+import json
+import shlex
+import datetime
+import pathlib
+import socket
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+STEAM_EXTRA_ARGS_FILE = os.path.expanduser('~/.config/systemd/user/steam.service.d/extra_args.conf')
+
+WIRELESS_DISABLE_POWER_MANAGEMENT = '/usr/bin/steamos-polkit-helpers/steamos-disable-wireless-power-management'
+
+# Must match in gui2.py
+class SteamStatus(enum.Enum):
+    NOT_RUNNING = 0
+    ERROR = 1
+    OS = 2
+    OS_DEV = 3
+    SIDELOADED = 4
+
+    @classmethod
+    def from_string(cls, status_str):
+        if not status_str:
+            return cls.ERROR
+        try:
+            if '.' in status_str:
+                name = status_str.split('.')[-1]
+            else:
+                name = status_str
+            return cls[name]
+        except KeyError:
+            return cls.ERROR
+
+    @property
+    def description(self):
+        DESCRIPTIONS = {
+            SteamStatus.NOT_RUNNING: 'not running',
+            SteamStatus.OS: 'OS client',
+            SteamStatus.OS_DEV: 'OS client dev mode',
+            SteamStatus.SIDELOADED: 'sideloaded client',
+            SteamStatus.ERROR: 'error',
+        }
+        return DESCRIPTIONS[self]
+
+
+class SteamConfig(enum.Enum):
+    ERROR = 1
+    # Matching the SteamStatus numeric values
+    OS = 2
+    OS_DEV = 3
+    SIDELOADED = 4
+
+    @property
+    def description(self):
+        DESCRIPTIONS = {
+            SteamConfig.OS: 'OS client',
+            SteamConfig.OS_DEV: 'OS client dev mode',
+            SteamConfig.SIDELOADED: 'sideloaded client',
+            SteamConfig.ERROR: 'error',
+        }
+        return DESCRIPTIONS[self]
+
+
+SESSION_NAMES = ['gamescope', 'plasma-x11', 'plasma-x11-persistent', 'plasma-wayland', 'plasma-wayland-persistent']
+
+class SessionConfig(enum.IntEnum):
+    # note: matches SESSION_NAMES indexes
+    GAMESCOPE = 0
+    PLASMA_X11 = 1
+    PLASMA_X11_PERSISTENT = 2
+    PLASMA_WAYLAND = 3
+    PLASMA_WAYLAND_PERSISTENT = 4
+    ERROR = 5
+
+def cef_debugging():
+    '''Only sane way to check is to look for the listening port.'''
+    ret = subprocess.run('/usr/bin/ss -l -t -n -p | grep steamwebhelper | grep 8080 > /dev/null', shell=True)
+    return ( ret.returncode == 0 )
+
+def steam_process_get_path_and_args():
+    ret = subprocess.run(['pgrep', '-a', '-x', 'steam'], capture_output=True, text=True)
+    if ret.returncode != 0:
+        return None
+    # Proton may run a dummy 'steam' process that confused previous implementations of this logic
+    # look for a process who's real filename is 'steam'
+    for l in ret.stdout.splitlines():
+        try:
+            pid = int(l.split(' ')[0])
+        except:
+            continue
+        rp = os.path.realpath(f'/proc/{pid}/exe')
+        if os.path.basename(rp) == 'steam':
+            try:
+                with open(f'/proc/{pid}/cmdline', 'rb') as f:
+                    cmdline = f.read()
+                argv = [a.decode('utf-8', errors='replace') for a in cmdline.split(b'\x00') if a]
+                if len(argv) >= 2:
+                    path = argv[0]
+                    args = argv[1:]
+                    # strip -srt-logger-opened: injected by steam.sh at runtime
+                    args = [a for a in args if a != '-srt-logger-opened']
+                    return (path, args)
+                return (argv[0], [])
+            except Exception as e:
+                logger.warning(f'Failed to read /proc/{pid}/cmdline: {e}')
+                return None
+
+def steam_process_get_path():
+    try:
+        (path, _) = steam_process_get_path_and_args()
+    except:
+        return None
+    return path
+
+def steam_process_get_args():
+    try:
+        (_, args) = steam_process_get_path_and_args()
+    except:
+        return ''
+    return args
+
+def steam_status():
+    '''What is the status of the Steam client on the system?'''
+    s = steam_process_get_path()
+    if s is None:
+        return SteamStatus.NOT_RUNNING
+    if s.find('.local/share/Steam/') != -1:
+        if os.path.exists(os.path.expanduser('~/devkit-game/devkit-steam')):
+            return SteamStatus.OS_DEV
+        return SteamStatus.OS
+    if s.find('devkit-game/steam/') != -1 or s.find('devkit-game/steamdeckard/') != -1:
+        return SteamStatus.SIDELOADED
+    logger.warning(f'could not interpret pgrep result to determine steam client status: {s!r}')
+    return SteamStatus.ERROR
+
+def steam_configuration():
+    '''How is the Steam client configured to run?'''
+    devkit_steam_trampoline_path = os.path.join(DEVKIT_TOOL_FOLDER, 'devkit-steam')
+    if not os.path.exists(devkit_steam_trampoline_path):
+        return SteamConfig.OS
+    t = open(devkit_steam_trampoline_path, 'rt').read()
+    if t.find('SteamStatus.OS_DEV') != -1:
+        return SteamConfig.OS_DEV
+    if t.find('SteamStatus.SIDELOADED') != -1:
+        return SteamConfig.SIDELOADED
+    logger.warning(f'could not determine what {devkit_steam_trampoline_path} means to do')
+    return SteamConfig.ERROR
+
+
+def osclient_branch(is_deckard):
+    '''Which branch is the default Steam 'OS client' configured to use?'''
+    # makes more sense to return strings here
+    beta_path = os.path.expanduser('~/.steam/steam/package/beta')
+    if not os.path.exists(beta_path):
+        return 'default' # not sure that's valid actually - would be the desktop client, which will only run in desktop mode ..
+    t = open(beta_path, 'rt').readline().strip('\n')
+    try:
+        p = 'steamdeck_(.*)'
+        if re.match(p, t):
+            branch = re.split(p, t)[1]
+            return branch
+        # internal builds
+        p = 'steampal_(.*)_.*'
+        if re.match(p, t):
+            branch = re.split(p, t)[1]
+            return branch
+        if is_deckard:
+            p = 'linux_arm64_(.*)_.*'
+            if re.match(p, t):
+                branch = re.split(p, t)[1]
+                return branch
+        raise Exception('no match')
+    except:  # noqa: E722
+        logger.warning(f'could not determine the OS client branch config: {t!r}')
+    return 'error'
+
+def osclient_version(conf):
+    '''Which version is the Steam 'OS client'?'''
+    if conf.is_deckard:
+        # old Steam client was using linuxarm64/, which is now reserved for the SDK binaries
+        for folder in ('linuxarm64', 'steamrtarm64'):
+            fn = os.path.expanduser(f'~/.steam/steam/{folder}/builddate.txt')
+            if os.path.exists(fn):
+                return open(fn, 'rt').read()
+        return 'Unknown - no builddate.txt'
+    beta_path = os.path.expanduser('~/.steam/steam/package/beta')
+    if not os.path.exists(beta_path):
+        logger.warning(f'not found: {beta_path}')
+        return None
+    t = open(beta_path, 'rt').readline().strip('\n')
+    manifest = os.path.expanduser(f'~/.steam/steam/package/steam_client_{t}_ubuntu12.manifest')
+    if not os.path.exists(manifest):
+        logger.warning(f'not found: {manifest}')
+        return None
+    try:
+        version = int(re.search('"version".*"(.*)"', open(manifest,'rt').read()).group(1))
+        return version
+    except:
+        logger.warning(f'could not parse version out of {manifest}')
+        return None
+
+def session_config():
+    '''What is the graphics session configuration?'''
+    # RESTART_SESSION writes this file
+    conf_file = '/etc/sddm.conf.d/zz-steamos-autologin.conf'
+    if not os.path.exists(conf_file):
+        # fallback to the OS default
+        conf_file = '/etc/sddm.conf.d/steamos.conf'
+    if os.path.exists(conf_file):
+        s = open(conf_file, 'rt').read()
+        if s.find('plasmawayland.desktop') != -1:
+            return SessionConfig.PLASMA_WAYLAND_PERSISTENT
+        if s.find('plasma.desktop') != -1:
+            return SessionConfig.PLASMA_X11_PERSISTENT
+        if s.find('gamescope-wayland.desktop') != -1:
+            return SessionConfig.GAMESCOPE
+        if s.find('plasma-steamos-oneshot.desktop') != -1:
+            return SessionConfig.PLASMA_X11
+        if s.find('plasma-steamos-wayland-oneshot.desktop') != -1:
+            return SessionConfig.PLASMA_WAYLAND
+    else:
+        # if the conf file doesn't exist we are likely in the default config
+        # check for a running gamescope for sanity
+        if subprocess.call('pgrep -a -x gamescope', shell=True, stdout=subprocess.DEVNULL) == 0:
+            return SessionConfig.GAMESCOPE
+    # couldn't figure it out, halp
+    return SessionConfig.ERROR
+
+def session_select_command():
+    if shutil.which('holo-session-select'):
+        return 'holo-session-select'
+    return 'steamos-session-select'
+
+def get_os_info():
+    os_info = {}
+    try:
+        for k, v in [ s.split('=') for s in open('/etc/os-release').read().split('\n') if len(s) > 0 ]:
+            os_info[k] = v.strip('"')
+    except Exception as e:
+        logger.error(e)
+        logger.error('Failed to parse OS release file')
+    return os_info
+
+def steam_default_args(conf):
+    if conf.is_deckard:
+        # Frame currently uses a different setup
+        return []
+
+    try:
+        if os.path.exists('/usr/lib/steamos/steam-launcher'):
+            output = subprocess.check_output('cat /usr/lib/steamos/steam-launcher | grep ^steamargs=',
+                                             shell=True,
+                                             universal_newlines=True)
+            ret = [ v.strip('"') for v in re.findall('\".*?\"', output) ]
+            return ret
+    except:
+        logger.warning('Failed to obtain steam default arguments from /usr/lib/steamos/steam-launcher')
+
+    # Legacy SteamOS
+    try:
+        output = subprocess.check_output('cat /usr/bin/gamescope-session | grep ^steamargs',
+                                         shell=True,
+                                         universal_newlines=True)
+        ret = [ v.strip('"') for v in re.findall('\".*?\"', output) ]
+    except:
+        logger.warning('Failed to obtain steam default arguments from /usr/bin/gamescope-session')
+
+    # Hardcoded fallback
+    return  ['-steamos3', '-steampal', '-steamdeck', '-gamepadui']
+
+def frame_osclient_extra_args(conf, steam_status):
+    if not conf.is_deckard or steam_status != SteamStatus.OS:
+        return None
+    if os.path.exists(STEAM_EXTRA_ARGS_FILE):
+        try:
+            content = open(STEAM_EXTRA_ARGS_FILE, 'rt').read()
+            match = re.search(r'Environment="STEAM_EXTRA_ARGS=(.*)"', content)
+            if match:
+                return match.group(1).replace('\\"', '"')
+        except Exception as e:
+            logger.warning(f'Failed to parse steam extra args: {e}')
+    return None
+
+def user_password_is_set():
+    ret = subprocess.run('passwd', stdin=subprocess.DEVNULL, shell=True, capture_output=True, universal_newlines=True)
+    logger.debug(repr(ret))
+    return (ret.stderr.find('Current password:') != -1)
+
+def steam_launch_flags():
+    '''Pull various steam flags that affect title execution.'''
+    ret = {}
+    if not 'XDG_RUNTIME_DIR' in os.environ:
+        logger.warning('XDK_RUNTIME_DIR is not set')
+        return ret
+    env_folder = os.path.join(os.environ['XDG_RUNTIME_DIR'], 'steam/env')
+    if not os.path.isdir(env_folder):
+        return ret
+    for fn in os.listdir(env_folder):
+        filepath = os.path.join(env_folder, fn)
+        content = open(filepath, 'rt').read()
+        # Check if this is a declaration file with key=value pairs
+        if content.count('\n') > 1 or '=' in content:
+            # Parse key=value format with comments
+            for line in content.splitlines():
+                line = line.strip()
+                # Skip comments and empty lines
+                if not line or line.startswith('#'):
+                    continue
+                # Parse key=value pairs
+                if '=' in line:
+                    key, value = line.split('=', 1)
+                    ret[key.strip()] = value.strip()
+        else:
+            # Legacy format: filename is the key, file content is the value
+            ret[fn] = content.strip('\n')
+    return ret
+
+def renderdoc_replay_server_running():
+    ret = subprocess.run(['pgrep', '-x', 'renderdoccmd'], capture_output=True)
+    return ret.returncode == 0
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--json', required=False, action='store_true')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    os_info = get_os_info()
+    assert os_info is not None
+    conf.is_deckard = os_info.get('VARIANT_ID', None) == 'vr'
+    os_name = os_info.get('PRETTY_NAME', None)
+    os_version = os_info.get('BUILD_ID', None)
+
+    _steam_launch_flags = steam_launch_flags()
+
+    if not conf.is_deckard:
+        # this bit of cargo cult is Steam Deck only
+        try:
+            # disable wireless power management for devkit usage: less latency on commands
+            subprocess.check_call(WIRELESS_DISABLE_POWER_MANAGEMENT)
+        except subprocess.CalledProcessError as e:
+            logger.warning(e)
+
+    session_config = session_config()
+    # enum -> human readable
+    session_status = SESSION_NAMES[session_config] if session_config != SessionConfig.ERROR else 'error'
+
+    steam_status = steam_status()
+    cef_debugging_enabled = False
+    if steam_status != SteamStatus.NOT_RUNNING:
+        cef_debugging_enabled = cef_debugging()
+    steam_configuration = steam_configuration()
+    osclient_branch = osclient_branch(conf.is_deckard)
+    osclient_version = osclient_version(conf)
+
+    steam_status_description = steam_status.description
+    if steam_status in (SteamStatus.OS, SteamStatus.OS_DEV) :
+        steam_status_description += f', on branch {osclient_branch!r}'
+        if osclient_version is not None:
+            if conf.is_deckard:
+                # we get builddate.txt
+                steam_status_description += f', {osclient_version}'
+            else:
+                utc_date_string = datetime.datetime.fromtimestamp(osclient_version, datetime.UTC).isoformat()
+                steam_status_description += f', version {osclient_version} {utc_date_string}'
+
+    has_side_loaded_client = os.path.exists(
+        os.path.join(
+            DEVKIT_TOOL_FOLDER,
+            'steam'
+        )
+    )
+
+    _user_password_is_set = user_password_is_set()
+
+    _renderdoc_replay_server_running = renderdoc_replay_server_running()
+    _renderdoc_layer_enabled = _steam_launch_flags.get('ENABLE_VULKAN_RENDERDOC_CAPTURE', '0') == '1'
+
+    _hostname = socket.gethostname()
+
+    if conf.json:
+        ret = {
+            'is_deckard': conf.is_deckard,
+            'hostname': _hostname,
+            'os_name': os_name,
+            'os_version': os_version,
+            'os_info': os_info,
+            'session_status': session_status,
+            'session_options': SESSION_NAMES,
+            'session_select': session_select_command(),
+            'steam_status': str(steam_status),
+            'cef_debugging_enabled': cef_debugging_enabled,
+            'steam_status_description': steam_status_description,
+            'steam_configuration': str(steam_configuration),
+            'steam_osclient_branch': osclient_branch,
+            'steam_osclient_version': osclient_version,
+            'has_side_loaded_client': has_side_loaded_client,
+            'steam_default_args': steam_default_args(conf),
+            'steam_current_args': steam_process_get_args(),
+            'frame_osclient_extra_args': frame_osclient_extra_args(conf, steam_status),
+            'user_password_is_set': _user_password_is_set,
+            'steam_launch_flags': _steam_launch_flags,
+            'renderdoc_layer_enabled': _renderdoc_layer_enabled,
+            'renderdoc_replay_server_running': _renderdoc_replay_server_running,
+        }
+        json.dump(ret, sys.stdout, sort_keys=True, indent=4)
+    else:
+        logger.info(f'Hostname                 : {_hostname}')
+        logger.info(f'OS                       : {os_name}')
+        logger.info(f'OS version               : {os_version}')
+        logger.info(f'Session mode is          : {session_status}')
+        logger.info(f'Session select command   : {session_select_command()}')
+        logger.info(f'Steam client status      : {steam_status_description}')
+        logger.info(f'Steam client args        : {steam_process_get_args()!r}')
+        logger.info(f"Steam extra args (Frame) : {frame_osclient_extra_args(conf, steam_status)!r}")
+        logger.info(f"Steam CEF debug          : {'enabled' if cef_debugging_enabled else 'disabled'}")
+        logger.info(f'Steam client config      : {steam_configuration.description}')
+        logger.info(f'Steam OS client branch   : {osclient_branch}')
+        logger.info(f'Steam OS client version  : {osclient_version}')
+        logger.info(f"Sideloaded client        : {'available' if has_side_loaded_client else 'not installed'}")
+        logger.info(f'OS client arguments      : {steam_default_args(conf)!r}')
+        logger.info(f"User password is set     : {'yes' if _user_password_is_set else 'no'}")
+        logger.info(f"Steam launch flags       : {_steam_launch_flags}")
+        logger.info(f"RenderDoc layer enabled  : {'yes' if _renderdoc_layer_enabled else 'no'}")
+        logger.info(f"RenderDoc replay running : {'yes' if _renderdoc_replay_server_running else 'no'}")

frame/devkit-utils/steamos-list-games

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+import os
+import logging
+import argparse
+import getpass
+import json
+from subprocess import DEVNULL
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    ret = []
+    if os.path.isdir(DEVKIT_TOOL_FOLDER):
+        for filename in os.listdir(DEVKIT_TOOL_FOLDER):
+            gamefolder = os.path.join(DEVKIT_TOOL_FOLDER, filename)
+            if os.path.isdir(gamefolder):
+                ret.append( {
+                    'gameid': filename,
+                } )
+
+    print(json.dumps(ret))

frame/devkit-utils/steamos-prepare-upload

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import logging
+import argparse
+import getpass
+import json
+import shutil
+import subprocess
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--gameid', required=True, action='store')
+    parser.add_argument('--restart-steam', required=False, default='0', action='store')
+    parser.add_argument('--use-mask-unmask', required=False, default='0', action='store')
+    parser.add_argument('--prevent-auto-repair', required=False, default='0', action='store')
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    directory = os.path.join(
+        os.path.expanduser(DEVKIT_TOOL_FOLDER),
+        conf.gameid
+    )
+    os.makedirs(directory, exist_ok=True)
+
+    INHIBIT_SENTINEL = os.path.expanduser('~/.config/inhibit-short-session-tracker')
+    if int(conf.prevent_auto_repair) == 1:
+        open(INHIBIT_SENTINEL, 'w').close()
+        logger.info(f'Created sentinel file: {INHIBIT_SENTINEL}')
+    elif os.path.exists(INHIBIT_SENTINEL):
+        os.remove(INHIBIT_SENTINEL)
+        logger.info(f'Removed sentinel file: {INHIBIT_SENTINEL}')
+
+
+    ret = {
+        'user': getpass.getuser(),
+        'directory': directory,
+    }
+    print(json.dumps(ret))

frame/devkit-utils/steamos-set-password.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# meant to be executed remotely/interactively for password prompts
+
+# there's some annoying trash at the top of the remote ssh screen
+clear
+passwd
+sleep 2

frame/devkit-utils/steamos-set-steam-client

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+import logging
+import argparse
+import enum
+import subprocess
+import shutil
+import pathlib
+
+logging.basicConfig(format='%(message)s', level=logging.DEBUG)
+logger = logging.getLogger(__name__)
+
+DEVKIT_TOOL_FOLDER = os.path.expanduser('~/devkit-game')
+# NOTE: only relevant to Frame + OS client with extra arguments
+# sideloaded client on Frame supports full command line edit instead 
+STEAM_EXTRA_ARGS_FILE = os.path.expanduser('~/.config/systemd/user/steam.service.d/extra_args.conf')
+
+class SteamStatus(enum.Enum):
+    # Supported values from steamos-get-status
+    OS = 2
+    OS_DEV = 3
+    SIDELOADED = 4
+
+STATUS_STRINGS = [
+    ( SteamStatus.OS, 'SteamStatus.OS' ),
+    ( SteamStatus.OS_DEV, 'SteamStatus.OS_DEV' ),
+    ( SteamStatus.SIDELOADED, 'SteamStatus.SIDELOADED' ),
+]
+
+# gamescope-session passes the execution to this script if it exists rather than start steam itself
+DEVKIT_STEAM_TRAMPOLINE = os.path.expanduser('~/devkit-game/devkit-steam')
+
+# this script executes the sideloaded Steam client (part of the steamos-devkit-service package)
+SIDE_LOADED_STEAM_CLIENT = '/usr/share/steamos-devkit/bin/devkit-standalone.py'
+
+def write_trampoline(text):
+    with open(DEVKIT_STEAM_TRAMPOLINE, 'w') as devkit_steam:
+        devkit_steam.write(text)
+        devkit_steam.flush()
+    os.chmod(DEVKIT_STEAM_TRAMPOLINE, 0o770)
+    # trying really hard to avoid leaving a zero sized trampoline if the deck is about to hang on the session restart coming next
+    subprocess.run(['/usr/bin/sync', DEVKIT_TOOL_FOLDER])
+
+def get_os_info():
+    os_info = {}
+    try:
+        for k, v in [ s.split('=') for s in open('/etc/os-release').read().split('\n') if len(s) > 0 ]:
+            os_info[k] = v.strip('"')
+    except Exception as e:
+        logger.error(e)
+        logger.error('Failed to parse OS release file')
+    return os_info
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--verbose', required=False, action='store_true')
+    parser.add_argument('--client', action='store', required=True, choices=[ v[1] for v in STATUS_STRINGS ])
+    parser.add_argument('--args', action='store', required=False, help='steam client command line arguments')
+    parser.add_argument('--gameid', required=True, action='store')
+    parser.add_argument('--gdbserver', action='store_true', required=False)
+    conf = parser.parse_args()
+
+    if conf.verbose:
+        logger.setLevel(logging.DEBUG)
+    else:
+        logger.setLevel(logging.INFO)
+
+    target = [ v for v in STATUS_STRINGS if v[1] == conf.client ][0][0]
+    logging.info(f'Set steam client on device to {target}')
+
+    if os.path.exists(DEVKIT_STEAM_TRAMPOLINE):
+        os.unlink(DEVKIT_STEAM_TRAMPOLINE)
+
+    os_info = get_os_info()
+    assert os_info is not None
+    is_deckard = os_info.get('VARIANT_ID', None) == 'vr'
+
+    if target == SteamStatus.OS:
+        if is_deckard:
+            # conf.args is the extra arguments for the normal Steam 'OS client', update it now
+            if conf.args is None or conf.args == '':
+                logger.info('Clearning extra arguments for normal Steam client')
+                if os.path.exists(STEAM_EXTRA_ARGS_FILE):
+                    os.unlink(STEAM_EXTRA_ARGS_FILE)
+                    subprocess.run(['systemctl', '--user', 'daemon-reload'], check=True)
+            else:
+                logger.info(f'Setting extra arguments for normal Steam client: {conf.args}')
+                os.makedirs(os.path.dirname(STEAM_EXTRA_ARGS_FILE), exist_ok=True)
+                with open(STEAM_EXTRA_ARGS_FILE, 'wt') as extra_args_file:
+                    escaped_args = conf.args.replace('"', '\\"')
+                    extra_args_file.write(f'[Service]\nEnvironment="STEAM_EXTRA_ARGS={escaped_args}"')
+                subprocess.run(['systemctl', '--user', 'daemon-reload'], check=True)
+
+            # When disabling a sideloaded client, also delete the ~/.steam symlinks:
+            # They will be re-created by the OS client when starting,
+            # this prevents SteamVR trying to use the sideloaded binaries that are still there for the steam API.
+            # (this may happen because SteamVR starts before Steam starts and has a chance to set those symlinks correctly)
+            for path in pathlib.Path(os.path.expanduser('~/.steam')).glob('*'):
+                if path.is_symlink():
+                    try:
+                        lnk = path.resolve()
+                        if 'devkit-game' in str(lnk):
+                            path.unlink()
+                            print(f'Deleted: {path} -> {lnk}')
+                    except Exception as e:
+                        print(f'Error processing {path}: {e}')
+        logger.info('Devkit Steam client override is disabled - default OS client execution will resume.')
+        sys.exit(0)
+
+    os.makedirs(os.path.dirname(DEVKIT_STEAM_TRAMPOLINE), exist_ok=True)
+
+    # OS client
+    steam_client = '$HOME/.local/share/Steam/steam.sh'
+    if target == SteamStatus.SIDELOADED:
+        steam_client = '$HOME/devkit-game/steam/steam.sh'
+
+    if is_deckard:
+        # RUNSTEAM.sh checks for SIDELOADED_STEAMROOT="${HOME}/devkit-game/steam"
+        # this is consistent with sideload on Steam Deck, but we use a different name 'steamdeckard'
+        # will be addressed when reworking the sideload and debug strategy, for now just drop in a symlink
+        steam_symlink = os.path.expanduser('~/devkit-game/steam')
+        if os.path.lexists(steam_symlink):
+            if os.path.islink(steam_symlink):
+                os.unlink(steam_symlink)
+            else:
+                # this happens if an upload in Steam Deck mode was attempted against a Steam Frame for instance
+                # was an easy mistake to make before recent changes
+                logger.warning('warning: ~/devkit-game/steam exists but is not a symlink. Removing anyway.')
+                shutil.rmtree(steam_symlink)
+        os.symlink(
+            os.path.expanduser('~/devkit-game/steamdeckard'),
+            steam_symlink,
+        )
+
+    args = '"$@"'
+    if conf.args is not None:
+        args = conf.args
+
+    gdbserver = ''
+    if conf.gdbserver:
+        logger.info('Configuring for remote debugging via gdbserver')
+        gdbserver = 'export DEBUGGER="gdbserver 0.0.0.0:2345"'
+
+    write_trampoline('''#!/bin/bash
+# Generated by steamos-set-steam-client, do not edit!
+# configuration tag (do not delete): {}
+{}
+mkdir -p $HOME/.steam/steam/logs
+exec {} {}
+'''.format(
+    conf.client,
+    gdbserver,
+    steam_client,
+    args
+))

ios/.gitignore

@@ -0,0 +1,4 @@
+xcuserdata/
+*.xcuserstate
+build/
+DerivedData/

ios/FrameControl.xcodeproj/project.pbxproj

@@ -0,0 +1,539 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 77;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		0DEE50BD563B1D8C328C4C0A /* HeadsetServer.swift in Sources */ = {isa = PBXBuildFile; fileRef = EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */; };
+		12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */ = {isa = PBXBuildFile; fileRef = 16644E7FDA7ADD5B232EB700 /* FrameLink.swift */; };
+		1A07EC692B0FF723907EA77B /* WebShell.swift in Sources */ = {isa = PBXBuildFile; fileRef = D6C4E6C28315CA8729FCAAEA /* WebShell.swift */; };
+		41A697B9924018DA48F24A1F /* Keys.swift in Sources */ = {isa = PBXBuildFile; fileRef = 237D9AF04EEA257AB382F60E /* Keys.swift */; };
+		4622FE0F0D6499CD642C29A2 /* InstallLink.swift in Sources */ = {isa = PBXBuildFile; fileRef = BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */; };
+		476D8858DC2C9E6616B084BC /* PortForwarder.swift in Sources */ = {isa = PBXBuildFile; fileRef = A7F6ED116569D0ABABF6ED65 /* PortForwarder.swift */; };
+		765661DBC0E6798A27CC60DB /* RootView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 9B24E1BCD4F69A24C7DEF02F /* RootView.swift */; };
+		78427FC66780623F31E7501E /* FrameControlApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */; };
+		84423CB45629465420180A64 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 8F2CB550FC81C01E6BDD5A71 /* Assets.xcassets */; };
+		9657F7BC23E3352E5AB30777 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = DB544223FC60A59CC3E8EF5F /* SetupView.swift */; };
+		A8C7AED25A6280682FCE45DC /* Citadel in Frameworks */ = {isa = PBXBuildFile; productRef = 6BA549B6CC0A0CB847126456 /* Citadel */; };
+		DC043FB74BE2D23F3A5826BF /* FrameControlTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */; };
+		E6898C714A92D3979F73B6E1 /* FrameFinder.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2F288DF6636A417F0CA3A6CD /* FrameFinder.swift */; };
+		F94D0252F8CC5854314B84B2 /* AppModel.swift in Sources */ = {isa = PBXBuildFile; fileRef = 8A11F3431826A26B247C0695 /* AppModel.swift */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		E1823E86AC0698172B566DB0 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 72E728699F904E68DEC369D3 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 1015B8BE90EB02C2062752A1;
+			remoteInfo = FrameControl;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXFileReference section */
+		16644E7FDA7ADD5B232EB700 /* FrameLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameLink.swift; sourceTree = "<group>"; };
+		1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameControlTests.swift; sourceTree = "<group>"; };
+		237D9AF04EEA257AB382F60E /* Keys.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Keys.swift; sourceTree = "<group>"; };
+		2F288DF6636A417F0CA3A6CD /* FrameFinder.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameFinder.swift; sourceTree = "<group>"; };
+		6B5B6718C5EA77FA67F6B14C /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
+		6FBC8D0B5ED7BF1C06F99892 /* FrameControlTests.xctest */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.cfbundle; path = FrameControlTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		8A11F3431826A26B247C0695 /* AppModel.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppModel.swift; sourceTree = "<group>"; };
+		8F2CB550FC81C01E6BDD5A71 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
+		93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameControlApp.swift; sourceTree = "<group>"; };
+		9B24E1BCD4F69A24C7DEF02F /* RootView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = RootView.swift; sourceTree = "<group>"; };
+		A7F6ED116569D0ABABF6ED65 /* PortForwarder.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PortForwarder.swift; sourceTree = "<group>"; };
+		BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = InstallLink.swift; sourceTree = "<group>"; };
+		D6C4E6C28315CA8729FCAAEA /* WebShell.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebShell.swift; sourceTree = "<group>"; };
+		DB544223FC60A59CC3E8EF5F /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
+		EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HeadsetServer.swift; sourceTree = "<group>"; };
+		F3E2F5607DD877272483D64E /* FrameControl.app */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.application; path = FrameControl.app; sourceTree = BUILT_PRODUCTS_DIR; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		35C098707058D19A2E23092E /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				A8C7AED25A6280682FCE45DC /* Citadel in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		1518C8775325C731AD7E2421 = {
+			isa = PBXGroup;
+			children = (
+				B4F84A5777E9EFEAEB54DB91 /* FrameControl */,
+				75A17B1C79C8C3C60FEABBA6 /* FrameControlTests */,
+				59B34B34E2BE8BCD237BCF26 /* Products */,
+			);
+			sourceTree = "<group>";
+		};
+		5064A5B6FE5B17B18E5FA4B8 /* SSH */ = {
+			isa = PBXGroup;
+			children = (
+				2F288DF6636A417F0CA3A6CD /* FrameFinder.swift */,
+				16644E7FDA7ADD5B232EB700 /* FrameLink.swift */,
+				EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */,
+				237D9AF04EEA257AB382F60E /* Keys.swift */,
+				A7F6ED116569D0ABABF6ED65 /* PortForwarder.swift */,
+			);
+			path = SSH;
+			sourceTree = "<group>";
+		};
+		59B34B34E2BE8BCD237BCF26 /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				F3E2F5607DD877272483D64E /* FrameControl.app */,
+				6FBC8D0B5ED7BF1C06F99892 /* FrameControlTests.xctest */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+		68AF00C8593B71502E1FB72B /* App */ = {
+			isa = PBXGroup;
+			children = (
+				8A11F3431826A26B247C0695 /* AppModel.swift */,
+				93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */,
+				BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */,
+			);
+			path = App;
+			sourceTree = "<group>";
+		};
+		75A17B1C79C8C3C60FEABBA6 /* FrameControlTests */ = {
+			isa = PBXGroup;
+			children = (
+				1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */,
+			);
+			path = FrameControlTests;
+			sourceTree = "<group>";
+		};
+		A939D1267299AE8A48092557 /* Views */ = {
+			isa = PBXGroup;
+			children = (
+				9B24E1BCD4F69A24C7DEF02F /* RootView.swift */,
+				DB544223FC60A59CC3E8EF5F /* SetupView.swift */,
+			);
+			path = Views;
+			sourceTree = "<group>";
+		};
+		B4F84A5777E9EFEAEB54DB91 /* FrameControl */ = {
+			isa = PBXGroup;
+			children = (
+				8F2CB550FC81C01E6BDD5A71 /* Assets.xcassets */,
+				6B5B6718C5EA77FA67F6B14C /* Info.plist */,
+				68AF00C8593B71502E1FB72B /* App */,
+				5064A5B6FE5B17B18E5FA4B8 /* SSH */,
+				A939D1267299AE8A48092557 /* Views */,
+				CC25EAB6C385A68D63F7DDF7 /* Web */,
+			);
+			path = FrameControl;
+			sourceTree = "<group>";
+		};
+		CC25EAB6C385A68D63F7DDF7 /* Web */ = {
+			isa = PBXGroup;
+			children = (
+				D6C4E6C28315CA8729FCAAEA /* WebShell.swift */,
+			);
+			path = Web;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+		1015B8BE90EB02C2062752A1 /* FrameControl */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = F08406CA3118DCFFD91EEA4D /* Build configuration list for PBXNativeTarget "FrameControl" */;
+			buildPhases = (
+				81ACE79C878CE95DC2C74A8B /* Pack the Frame bundle */,
+				D452F3AE39D323226E2E4D1D /* Sources */,
+				B6E396EEA6D8BB0EE84E01A4 /* Resources */,
+				35C098707058D19A2E23092E /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = FrameControl;
+			packageProductDependencies = (
+				6BA549B6CC0A0CB847126456 /* Citadel */,
+			);
+			productName = FrameControl;
+			productReference = F3E2F5607DD877272483D64E /* FrameControl.app */;
+			productType = "com.apple.product-type.application";
+		};
+		88565F33E966FD0BAC7AC9C8 /* FrameControlTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 3EE44365AF181B5C85B38B07 /* Build configuration list for PBXNativeTarget "FrameControlTests" */;
+			buildPhases = (
+				F220B2041FE675A075E860BB /* Sources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				B88C5AA6F25947DCEE51C178 /* PBXTargetDependency */,
+			);
+			name = FrameControlTests;
+			packageProductDependencies = (
+			);
+			productName = FrameControlTests;
+			productReference = 6FBC8D0B5ED7BF1C06F99892 /* FrameControlTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		72E728699F904E68DEC369D3 /* Project object */ = {
+			isa = PBXProject;
+			attributes = {
+				BuildIndependentTargetsInParallel = YES;
+				LastUpgradeCheck = 1430;
+				TargetAttributes = {
+				};
+			};
+			buildConfigurationList = D6217CB1638429ED91524BB3 /* Build configuration list for PBXProject "FrameControl" */;
+			developmentRegion = en;
+			hasScannedForEncodings = 0;
+			knownRegions = (
+				Base,
+				en,
+			);
+			mainGroup = 1518C8775325C731AD7E2421;
+			minimizedProjectReferenceProxies = 1;
+			packageReferences = (
+				AD49230A09C7F457BC247E4D /* XCRemoteSwiftPackageReference "Citadel" */,
+			);
+			preferredProjectObjectVersion = 77;
+			productRefGroup = 59B34B34E2BE8BCD237BCF26 /* Products */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				1015B8BE90EB02C2062752A1 /* FrameControl */,
+				88565F33E966FD0BAC7AC9C8 /* FrameControlTests */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		B6E396EEA6D8BB0EE84E01A4 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				84423CB45629465420180A64 /* Assets.xcassets in Resources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXShellScriptBuildPhase section */
+		81ACE79C878CE95DC2C74A8B /* Pack the Frame bundle */ = {
+			isa = PBXShellScriptBuildPhase;
+			alwaysOutOfDate = 1;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputFileListPaths = (
+			);
+			inputPaths = (
+			);
+			name = "Pack the Frame bundle";
+			outputFileListPaths = (
+			);
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "mkdir -p \"${DERIVED_FILE_DIR}\"\npython3 \"${SRCROOT}/scripts/make_frame_bundle.py\" \"${DERIVED_FILE_DIR}/frame-bundle.tar.gz\" > \"${DERIVED_FILE_DIR}/frame-bundle.version\"\nmkdir -p \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}\"\ncp \"${DERIVED_FILE_DIR}/frame-bundle.tar.gz\" \"${DERIVED_FILE_DIR}/frame-bundle.version\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/\"\n";
+		};
+/* End PBXShellScriptBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		D452F3AE39D323226E2E4D1D /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				F94D0252F8CC5854314B84B2 /* AppModel.swift in Sources */,
+				78427FC66780623F31E7501E /* FrameControlApp.swift in Sources */,
+				E6898C714A92D3979F73B6E1 /* FrameFinder.swift in Sources */,
+				12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */,
+				0DEE50BD563B1D8C328C4C0A /* HeadsetServer.swift in Sources */,
+				4622FE0F0D6499CD642C29A2 /* InstallLink.swift in Sources */,
+				41A697B9924018DA48F24A1F /* Keys.swift in Sources */,
+				476D8858DC2C9E6616B084BC /* PortForwarder.swift in Sources */,
+				765661DBC0E6798A27CC60DB /* RootView.swift in Sources */,
+				9657F7BC23E3352E5AB30777 /* SetupView.swift in Sources */,
+				1A07EC692B0FF723907EA77B /* WebShell.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		F220B2041FE675A075E860BB /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				DC043FB74BE2D23F3A5826BF /* FrameControlTests.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		B88C5AA6F25947DCEE51C178 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 1015B8BE90EB02C2062752A1 /* FrameControl */;
+			targetProxy = E1823E86AC0698172B566DB0 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		0B43879551190738EFF21848 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CODE_SIGN_IDENTITY = "iPhone Developer";
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = FrameControl/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.saphid.framecontrol;
+				PRODUCT_NAME = "Frame Control";
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Release;
+		};
+		3228B6B229BF6430C8338B55 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				CURRENT_PROJECT_VERSION = 1;
+				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu11;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 17.0;
+				MARKETING_VERSION = 0.1.0;
+				MTL_ENABLE_DEBUG_INFO = NO;
+				MTL_FAST_MATH = YES;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SWIFT_COMPILATION_MODE = wholemodule;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		54BEF779B5906F671E4134CE /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_SEARCH_USER_PATHS = NO;
+				CLANG_ANALYZER_NONNULL = YES;
+				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
+				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
+				CLANG_CXX_LIBRARY = "libc++";
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_ARC = YES;
+				CLANG_ENABLE_OBJC_WEAK = YES;
+				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
+				CLANG_WARN_BOOL_CONVERSION = YES;
+				CLANG_WARN_COMMA = YES;
+				CLANG_WARN_CONSTANT_CONVERSION = YES;
+				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
+				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
+				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
+				CLANG_WARN_EMPTY_BODY = YES;
+				CLANG_WARN_ENUM_CONVERSION = YES;
+				CLANG_WARN_INFINITE_RECURSION = YES;
+				CLANG_WARN_INT_CONVERSION = YES;
+				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
+				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
+				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
+				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
+				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
+				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
+				CLANG_WARN_STRICT_PROTOTYPES = YES;
+				CLANG_WARN_SUSPICIOUS_MOVE = YES;
+				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
+				CLANG_WARN_UNREACHABLE_CODE = YES;
+				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
+				COPY_PHASE_STRIP = NO;
+				CURRENT_PROJECT_VERSION = 1;
+				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_STRICT_OBJC_MSGSEND = YES;
+				ENABLE_TESTABILITY = YES;
+				GCC_C_LANGUAGE_STANDARD = gnu11;
+				GCC_DYNAMIC_NO_PIC = NO;
+				GCC_NO_COMMON_BLOCKS = YES;
+				GCC_OPTIMIZATION_LEVEL = 0;
+				GCC_PREPROCESSOR_DEFINITIONS = (
+					"$(inherited)",
+					"DEBUG=1",
+				);
+				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
+				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
+				GCC_WARN_UNDECLARED_SELECTOR = YES;
+				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
+				GCC_WARN_UNUSED_FUNCTION = YES;
+				GCC_WARN_UNUSED_VARIABLE = YES;
+				IPHONEOS_DEPLOYMENT_TARGET = 17.0;
+				MARKETING_VERSION = 0.1.0;
+				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
+				MTL_FAST_MATH = YES;
+				ONLY_ACTIVE_ARCH = YES;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Debug;
+		};
+		57A1F4BD520A2EDA424181E8 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				GENERATE_INFOPLIST_FILE = YES;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@loader_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.saphid.FrameControlTests;
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Frame Control.app/Frame Control";
+			};
+			name = Release;
+		};
+		6E69BB8A560DC32B8D0E10A6 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				GENERATE_INFOPLIST_FILE = YES;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+					"@loader_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.saphid.FrameControlTests;
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Frame Control.app/Frame Control";
+			};
+			name = Debug;
+		};
+		C7FCE7EB18B4AEF8EFEC8FDE /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CODE_SIGN_IDENTITY = "iPhone Developer";
+				ENABLE_USER_SCRIPT_SANDBOXING = NO;
+				GENERATE_INFOPLIST_FILE = YES;
+				INFOPLIST_FILE = FrameControl/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.saphid.framecontrol;
+				PRODUCT_NAME = "Frame Control";
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		3EE44365AF181B5C85B38B07 /* Build configuration list for PBXNativeTarget "FrameControlTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				6E69BB8A560DC32B8D0E10A6 /* Debug */,
+				57A1F4BD520A2EDA424181E8 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Debug;
+		};
+		D6217CB1638429ED91524BB3 /* Build configuration list for PBXProject "FrameControl" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				54BEF779B5906F671E4134CE /* Debug */,
+				3228B6B229BF6430C8338B55 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Debug;
+		};
+		F08406CA3118DCFFD91EEA4D /* Build configuration list for PBXNativeTarget "FrameControl" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				C7FCE7EB18B4AEF8EFEC8FDE /* Debug */,
+				0B43879551190738EFF21848 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Debug;
+		};
+/* End XCConfigurationList section */
+
+/* Begin XCRemoteSwiftPackageReference section */
+		AD49230A09C7F457BC247E4D /* XCRemoteSwiftPackageReference "Citadel" */ = {
+			isa = XCRemoteSwiftPackageReference;
+			repositoryURL = "https://github.com/orlandos-nl/Citadel.git";
+			requirement = {
+				kind = exactVersion;
+				version = 0.12.1;
+			};
+		};
+/* End XCRemoteSwiftPackageReference section */
+
+/* Begin XCSwiftPackageProductDependency section */
+		6BA549B6CC0A0CB847126456 /* Citadel */ = {
+			isa = XCSwiftPackageProductDependency;
+			package = AD49230A09C7F457BC247E4D /* XCRemoteSwiftPackageReference "Citadel" */;
+			productName = Citadel;
+		};
+/* End XCSwiftPackageProductDependency section */
+	};
+	rootObject = 72E728699F904E68DEC369D3 /* Project object */;
+}

ios/FrameControl.xcodeproj/project.xcworkspace/contents.xcworkspacedata

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Workspace
+   version = "1.0">
+   <FileRef
+      location = "self:">
+   </FileRef>
+</Workspace>

ios/FrameControl.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -0,0 +1,96 @@
+{
+  "originHash" : "06e1233a9a9b220c5f5b14eefc3220aa9e394ac504fece9df28b2a550b7d6017",
+  "pins" : [
+    {
+      "identity" : "bigint",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/attaswift/BigInt.git",
+      "state" : {
+        "revision" : "e07e00fa1fd435143a2dcf8b7eec9a7710b2fdfe",
+        "version" : "5.7.0"
+      }
+    },
+    {
+      "identity" : "citadel",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/orlandos-nl/Citadel.git",
+      "state" : {
+        "revision" : "ae8562f895de06ccb86fdb1cbb65fd99c8976e12",
+        "version" : "0.12.1"
+      }
+    },
+    {
+      "identity" : "swift-asn1",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-asn1.git",
+      "state" : {
+        "revision" : "3b6410f7dee09eb33cdd26260c5fd47fda19b0e2",
+        "version" : "1.7.3"
+      }
+    },
+    {
+      "identity" : "swift-atomics",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-atomics.git",
+      "state" : {
+        "revision" : "0442cb5a3f98ab802acb777929fdb446bda11a34",
+        "version" : "1.3.1"
+      }
+    },
+    {
+      "identity" : "swift-collections",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-collections.git",
+      "state" : {
+        "revision" : "98ef3c98609a1e31b7e157b5b619579001a789d6",
+        "version" : "1.7.1"
+      }
+    },
+    {
+      "identity" : "swift-crypto",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-crypto.git",
+      "state" : {
+        "revision" : "95ba0316a9b733e92bb6b071255ff46263bbe7dc",
+        "version" : "3.15.1"
+      }
+    },
+    {
+      "identity" : "swift-log",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-log.git",
+      "state" : {
+        "revision" : "9c6fb14227f55d8f711ce3847dc2f419fb0ecacb",
+        "version" : "1.15.1"
+      }
+    },
+    {
+      "identity" : "swift-nio",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-nio.git",
+      "state" : {
+        "revision" : "21de5f08c1a166a6dd293d0e587ad977bf8dac5d",
+        "version" : "2.103.0"
+      }
+    },
+    {
+      "identity" : "swift-nio-ssh",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/Wellz26/swift-nio-ssh.git",
+      "state" : {
+        "revision" : "d88989f3d3bb1dfb2a38ce4af598afbf7fc3095c",
+        "version" : "0.3.7"
+      }
+    },
+    {
+      "identity" : "swift-system",
+      "kind" : "remoteSourceControl",
+      "location" : "https://github.com/apple/swift-system.git",
+      "state" : {
+        "revision" : "869129b7bf4ecc57b97d0193ad29690ca2134750",
+        "version" : "1.8.1"
+      }
+    }
+  ],
+  "version" : 3
+}

ios/FrameControl.xcodeproj/xcshareddata/xcschemes/FrameControl.xcscheme

@@ -0,0 +1,116 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Scheme
+   LastUpgradeVersion = "1430"
+   version = "1.7">
+   <BuildAction
+      parallelizeBuildables = "YES"
+      buildImplicitDependencies = "YES"
+      runPostActionsOnFailure = "NO">
+      <BuildActionEntries>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "YES"
+            buildForProfiling = "YES"
+            buildForArchiving = "YES"
+            buildForAnalyzing = "YES">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "1015B8BE90EB02C2062752A1"
+               BuildableName = "FrameControl.app"
+               BlueprintName = "FrameControl"
+               ReferencedContainer = "container:FrameControl.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+         <BuildActionEntry
+            buildForTesting = "YES"
+            buildForRunning = "NO"
+            buildForProfiling = "NO"
+            buildForArchiving = "NO"
+            buildForAnalyzing = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "88565F33E966FD0BAC7AC9C8"
+               BuildableName = "FrameControlTests.xctest"
+               BlueprintName = "FrameControlTests"
+               ReferencedContainer = "container:FrameControl.xcodeproj">
+            </BuildableReference>
+         </BuildActionEntry>
+      </BuildActionEntries>
+   </BuildAction>
+   <TestAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      onlyGenerateCoverageForSpecifiedTargets = "NO">
+      <MacroExpansion>
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "1015B8BE90EB02C2062752A1"
+            BuildableName = "FrameControl.app"
+            BlueprintName = "FrameControl"
+            ReferencedContainer = "container:FrameControl.xcodeproj">
+         </BuildableReference>
+      </MacroExpansion>
+      <Testables>
+         <TestableReference
+            skipped = "NO"
+            parallelizable = "NO">
+            <BuildableReference
+               BuildableIdentifier = "primary"
+               BlueprintIdentifier = "88565F33E966FD0BAC7AC9C8"
+               BuildableName = "FrameControlTests.xctest"
+               BlueprintName = "FrameControlTests"
+               ReferencedContainer = "container:FrameControl.xcodeproj">
+            </BuildableReference>
+         </TestableReference>
+      </Testables>
+      <CommandLineArguments>
+      </CommandLineArguments>
+   </TestAction>
+   <LaunchAction
+      buildConfiguration = "Debug"
+      selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
+      selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
+      launchStyle = "0"
+      useCustomWorkingDirectory = "NO"
+      ignoresPersistentStateOnLaunch = "NO"
+      debugDocumentVersioning = "YES"
+      debugServiceExtension = "internal"
+      allowLocationSimulation = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "1015B8BE90EB02C2062752A1"
+            BuildableName = "FrameControl.app"
+            BlueprintName = "FrameControl"
+            ReferencedContainer = "container:FrameControl.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </LaunchAction>
+   <ProfileAction
+      buildConfiguration = "Release"
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      savedToolIdentifier = ""
+      useCustomWorkingDirectory = "NO"
+      debugDocumentVersioning = "YES">
+      <BuildableProductRunnable
+         runnableDebuggingMode = "0">
+         <BuildableReference
+            BuildableIdentifier = "primary"
+            BlueprintIdentifier = "1015B8BE90EB02C2062752A1"
+            BuildableName = "FrameControl.app"
+            BlueprintName = "FrameControl"
+            ReferencedContainer = "container:FrameControl.xcodeproj">
+         </BuildableReference>
+      </BuildableProductRunnable>
+   </ProfileAction>
+   <AnalyzeAction
+      buildConfiguration = "Debug">
+   </AnalyzeAction>
+   <ArchiveAction
+      buildConfiguration = "Release"
+      revealArchiveInOrganizer = "YES">
+   </ArchiveAction>
+</Scheme>

ios/FrameControl/App/AppModel.swift

@@ -0,0 +1,291 @@
+import Citadel
+import Foundation
+import SwiftUI
+import UIKit
+
+/// The app's one piece of state: which headset, and how far along connecting to it is.
+@MainActor
+final class AppModel: ObservableObject {
+    enum Phase: Equatable {
+        case setup
+        case connecting(String)
+        case ready(URL)
+        case failed(String)
+    }
+
+    @Published private(set) var phase: Phase
+    @Published private(set) var settings: FrameSettings?
+    /// Install links that arrived before the page was ready for them.
+    @Published var pendingInstallLinks: [InstallLink] = []
+
+    private var link: FrameLink?
+    private var server: HeadsetServer?
+    private var forwarder: PortForwarder?
+    private var attempt = 0
+
+    private static let settingsKey = "frame.settings"
+    private static let hostKeyKey = "frame.hostKey"
+
+    init() {
+        let saved = UserDefaults.standard.data(forKey: Self.settingsKey).flatMap { try? JSONDecoder().decode(FrameSettings.self, from: $0) }
+        settings = saved
+        phase = saved == nil ? .setup : .connecting("Connecting")
+    }
+
+    var deviceName: String { UIDevice.current.userInterfaceIdiom == .pad ? "iPad" : "iPhone" }
+    private var hostKey: String? { UserDefaults.standard.string(forKey: Self.hostKeyKey) }
+
+    // MARK: pairing
+
+    /// First time: log in with the Developer Mode password, add this phone's key to
+    /// ~/.ssh/authorized_keys, record the Frame's host key, then connect with the key.
+    func pair(host: String, user: String, password: String) async {
+        guard let target = Self.parse(host: host, user: user) else {
+            fail("Enter the headset's address and user name.", retry: false)
+            return
+        }
+        invalidate()
+        let mine = attempt
+        await teardown()
+        guard mine == attempt else { return }
+        phase = .connecting("Signing in to \(target.host)")
+        let pin = PinnedHostKey(expected: nil)
+        do {
+            let link = try await FrameLink.connect(target, auth: .passwordBased(username: target.user, password: password), hostKey: pin)
+            defer { Task { await link.close() } }
+            guard mine == attempt else { return }
+            phase = .connecting("Adding this \(deviceName)'s key")
+            let line = authorizedKeysLine
+            // A file whose last line has no newline would otherwise swallow the key.
+            let file = "~/.ssh/authorized_keys"
+            try await link.check("umask 077; mkdir -p ~/.ssh && touch \(file) && "
+                                 + "{ grep -qxF \(shellQuote(line)) \(file) || { "
+                                 + "[ -s \(file) ] && [ -n \"$(tail -c 1 \(file))\" ] && printf '\\n' >> \(file); "
+                                 + "printf '%s\\n' \(shellQuote(line)) >> \(file); }; }",
+                                 "Couldn't add the key on the Frame")
+            guard mine == attempt else { return }  // cancelled meanwhile: save nothing
+            guard let seen = pin.seen else { throw FrameFailure("The Frame didn't show a host key") }
+            UserDefaults.standard.set(seen, forKey: Self.hostKeyKey)
+            UserDefaults.standard.set(try JSONEncoder().encode(target), forKey: Self.settingsKey)
+            settings = target
+        } catch {
+            guard mine == attempt else { return }
+            let failure = error as? FrameFailure
+            fail(failure?.message ?? FrameLink.describe(error, host: target.host), retry: false,
+                 needsPairing: failure?.needsPairing ?? false)
+            return
+        }
+        await connect()
+    }
+
+    /// For someone who added this phone's key to the Frame themselves: no password.
+    /// The Frame's host key is recorded on this first connection.
+    func useKey(host: String, user: String) async {
+        guard let target = Self.parse(host: host, user: user) else {
+            fail("Enter the headset's address and user name.", retry: false)
+            return
+        }
+        UserDefaults.standard.removeObject(forKey: Self.hostKeyKey)
+        UserDefaults.standard.set(try? JSONEncoder().encode(target), forKey: Self.settingsKey)
+        settings = target
+        await connect()
+    }
+
+    /// "host", "host:port" or "[v6]:port", plus a user name.
+    nonisolated static func parse(host: String, user: String) -> FrameSettings? {
+        var target = FrameSettings(host: host.trimmingCharacters(in: .whitespaces), user: user.trimmingCharacters(in: .whitespaces))
+        if target.host.hasPrefix("["), let close = target.host.firstIndex(of: "]") {
+            let rest = target.host[target.host.index(after: close)...]
+            if rest.hasPrefix(":"), let port = Int(rest.dropFirst()) { target.port = port }
+            target.host = String(target.host[target.host.index(after: target.host.startIndex)..<close])
+        } else if target.host.filter({ $0 == ":" }).count == 1, let colon = target.host.lastIndex(of: ":"),
+                  let port = Int(target.host[target.host.index(after: colon)...]) {
+            target.port = port
+            target.host = String(target.host[..<colon])
+        }
+        guard !target.host.isEmpty, !target.user.isEmpty, (1...65535).contains(target.port) else { return nil }
+        return target
+    }
+
+    /// This phone's line for ~/.ssh/authorized_keys on the Frame.
+    var authorizedKeysLine: String {
+        DeviceKey.authorizedKeysLine(DeviceKey.loadOrCreate(), comment: "frame-control@\(deviceName)")
+    }
+
+    /// Forget the headset: back to the pairing screen. The Frame keeps the key line;
+    /// remove it from ~/.ssh/authorized_keys there to revoke this phone.
+    func forget() async {
+        invalidate()
+        await teardown()
+        UserDefaults.standard.removeObject(forKey: Self.settingsKey)
+        UserDefaults.standard.removeObject(forKey: Self.hostKeyKey)
+        settings = nil
+        phase = .setup
+    }
+
+    func showSetup() {
+        invalidate()
+        Task { await teardown() }
+        phase = .setup
+    }
+
+    /// Whether the failure screen is retrying on its own.
+    @Published private(set) var retrying = false
+
+    // MARK: connecting
+
+    /// Every connection attempt has a number; anything that finishes after a newer
+    /// attempt started (or the user went back to setup) closes what it made and stops.
+    private func invalidate() {
+        attempt += 1
+        retrying = false
+    }
+
+    /// quiet: a background retry, which leaves the failure screen up until it works.
+    func connect(quiet: Bool = false) async {
+        guard let settings else {
+            phase = .setup
+            return
+        }
+        invalidate()
+        let mine = attempt
+        await teardown()
+        func current() -> Bool { mine == attempt }
+        func step(_ s: String) { if current() && !quiet { phase = .connecting(s) } }
+        step("Connecting to \(settings.host)")
+        var link: FrameLink?
+        var forwarder: PortForwarder?
+        do {
+            let bundle = try HeadsetServer.Bundle.fromApp()
+            let auth = SSHAuthenticationMethod.ed25519(username: settings.user, privateKey: DeviceKey.loadOrCreate())
+            let pin = PinnedHostKey(expected: hostKey)
+            let l = try await FrameLink.connect(settings, auth: auth, hostKey: pin)
+            link = l
+            guard current() else { throw CancellationError() }
+            if hostKey == nil, let seen = pin.seen { UserDefaults.standard.set(seen, forKey: Self.hostKeyKey) }
+            let dir = try await HeadsetServer.deploy(bundle, over: l) { s in Task { @MainActor in step(s) } }
+            guard current() else { throw CancellationError() }
+            step("Starting Frame Control on the headset")
+            let key = Self.randomKey()
+            let server = try await HeadsetServer.start(in: dir, over: l, key: key, device: deviceName)
+            guard current() else { throw CancellationError() }
+            let f = try await PortForwarder.start(over: l, to: server.port)
+            forwarder = f
+            guard current() else { throw CancellationError() }
+            if let tail = server.exited {  // stopped while the tunnel was opening
+                throw FrameFailure("Frame Control on the headset stopped. \(tail.suffix(200))")
+            }
+            // Only now does this attempt's connection become the app's.
+            self.link = l
+            self.server = server
+            self.forwarder = f
+            readySince = Date()
+            var page = "http://127.0.0.1:\(f.localPort)/?key=\(key)"
+            #if DEBUG
+            // Test hooks for the Simulator: open on a given tab, and leave the URL where
+            // a test can drive the same tunnel (`simctl get_app_container … data`).
+            if let tab = ProcessInfo.processInfo.environment["FRAME_TEST_PAGE"] { page += "#\(tab)" }
+            if let dir = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask).first {
+                try? page.write(to: dir.appendingPathComponent("frame-test-url.txt"), atomically: true, encoding: .utf8)
+            }
+            #endif
+            phase = .ready(URL(string: page)!)
+            // Runs at once if it stopped in the moment since the check above.
+            server.whenExited { [weak self] tail in
+                Task { @MainActor in self?.lost(mine, "Frame Control on the headset stopped. \(tail.suffix(200))") }
+            }
+            watchHealth(mine)
+        } catch {
+            forwarder?.stop()
+            if let link { await link.close() }  // ends its server too
+            guard current(), !(error is CancellationError) else { return }
+            let failure = error as? FrameFailure
+            fail(failure?.message ?? FrameLink.describe(error, host: settings.host), retry: !(failure?.needsPairing ?? false),
+                 needsPairing: failure?.needsPairing ?? false)
+        }
+    }
+
+    /// Whether the last failure needs the user to pair again rather than wait.
+    @Published private(set) var needsPairing = false
+
+    private func fail(_ message: String, retry: Bool, needsPairing: Bool = false) {
+        self.needsPairing = needsPairing
+        phase = .failed(message)
+        retrying = retry && settings != nil
+        guard retrying else { return }
+        // Keep trying quietly while the app is open: the Frame may just be asleep.
+        // A new task each time, so retrying for hours doesn't nest awaits.
+        let mine = attempt
+        Task { [weak self] in
+            try? await Task.sleep(nanoseconds: 10_000_000_000)
+            guard let self, mine == self.attempt, case .failed = self.phase,
+                  UIApplication.shared.applicationState == .active else { return }
+            await self.connect(quiet: true)
+        }
+    }
+
+    /// While connected, check every 20 s that the SSH session still answers: a
+    /// network change can leave it looking open while nothing gets through.
+    private func watchHealth(_ mine: Int) {
+        Task { [weak self] in
+            while true {
+                try? await Task.sleep(nanoseconds: 20_000_000_000)
+                guard let self, mine == self.attempt, case .ready = self.phase else { return }
+                if UIApplication.shared.applicationState != .active { continue }
+                if await !(self.link?.answers() ?? false) {
+                    guard mine == self.attempt else { return }
+                    await self.connect(quiet: true)
+                    return
+                }
+            }
+        }
+    }
+
+    /// Called when the app comes back to the foreground: iOS may have dropped the
+    /// connection, or left it looking open, while it was in the background.
+    func resume() {
+        switch phase {
+        case .ready:
+            let mine = attempt
+            Task {
+                let ok = await link?.answers() ?? false
+                if (!ok || server?.exited != nil), mine == attempt { await connect() }
+            }
+        case .failed:
+            // A changed identity or a refused login needs the user, not another try.
+            if settings != nil, !needsPairing { Task { await connect() } }
+        default:
+            break
+        }
+    }
+
+    private var readySince = Date.distantPast
+
+    private func lost(_ which: Int, _ why: String) {
+        guard which == attempt, case .ready = phase else { return }
+        // Restart it once; if it dies again straight away, say so instead of looping.
+        if Date().timeIntervalSince(readySince) < 20 {
+            invalidate()
+            Task { await teardown() }
+            fail(why, retry: false)
+        } else {
+            Task { await connect() }
+        }
+    }
+
+    private func teardown() async {
+        forwarder?.stop()
+        forwarder = nil
+        server = nil
+        if let link {
+            self.link = nil
+            await link.close()  // ends the server too: its stdin closes
+        }
+    }
+
+    private static func randomKey() -> String {
+        var bytes = [UInt8](repeating: 0, count: 24)
+        _ = SecRandomCopyBytes(kSecRandomDefault, bytes.count, &bytes)
+        return bytes.map { String(format: "%02x", $0) }.joined()
+    }
+}

ios/FrameControl/App/FrameControlApp.swift

@@ -0,0 +1,44 @@
+import SwiftUI
+
+@main
+struct FrameControlApp: App {
+    @StateObject private var model = AppModel()
+    @Environment(\.scenePhase) private var scenePhase
+
+    var body: some Scene {
+        WindowGroup {
+            RootView(model: model)
+                .task {
+                    #if DEBUG
+                    // Simulator testing without the pairing screen: print this device's key,
+                    // and connect to FRAME_TEST_HOST with it (`simctl launch` passes
+                    // SIMCTL_CHILD_FRAME_TEST_HOST through as FRAME_TEST_HOST).
+                    print("FRAME_CONTROL_KEY: \(model.authorizedKeysLine)")
+                    // FRAME_TEST_LANDSCAPE=1 turns the app on its side, to check the safe areas there.
+                    if ProcessInfo.processInfo.environment["FRAME_TEST_LANDSCAPE"] != nil,
+                       let scene = UIApplication.shared.connectedScenes.first as? UIWindowScene {
+                        scene.requestGeometryUpdate(.iOS(interfaceOrientations: .landscapeRight))
+                    }
+                    // FRAME_TEST_PAIR="host|user|password" runs the real password pairing.
+                    if model.settings == nil, let pair = ProcessInfo.processInfo.environment["FRAME_TEST_PAIR"] {
+                        let f = pair.components(separatedBy: "|")
+                        if f.count == 3 { await model.pair(host: f[0], user: f[1], password: f[2]); return }
+                    }
+                    if model.settings == nil, let host = ProcessInfo.processInfo.environment["FRAME_TEST_HOST"] {
+                        await model.useKey(host: host, user: "steamos")
+                        return
+                    }
+                    #endif
+                    if model.settings != nil { await model.connect() }
+                }
+                .onOpenURL { url in
+                    // frame-control://install?… from a website (docs/web-install.md).
+                    guard let link = InstallLink(url.absoluteString), model.pendingInstallLinks.count < 5 else { return }
+                    model.pendingInstallLinks.append(link)
+                }
+                .onChange(of: scenePhase) { _, phase in
+                    if phase == .active { model.resume() }
+                }
+        }
+    }
+}

ios/FrameControl/App/InstallLink.swift

@@ -0,0 +1,27 @@
+import Foundation
+
+/// frame-control://install?manifest=URL or ?url=URL (docs/web-install.md), the same
+/// first filter as app/install-link.js. The server on the Frame applies the full
+/// rules (HTTPS, no private addresses, redirects) before fetching anything.
+struct InstallLink: Equatable {
+    enum Kind: String { case manifest, url }
+    let kind: Kind
+    let target: String
+
+    static let scheme = "frame-control"
+    private static let maxLink = 4096
+    private static let maxURL = 2048
+
+    init?(_ raw: String) {
+        guard raw.count <= Self.maxLink, raw.lowercased().hasPrefix("\(Self.scheme):"),
+              let link = URLComponents(string: raw), link.scheme?.lowercased() == Self.scheme,
+              link.host?.lowercased() == "install", ["", "/"].contains(link.path) else { return nil }
+        let items = link.queryItems ?? []
+        guard items.count == 1, let item = items.first, let kind = Kind(rawValue: item.name),
+              let target = item.value, !target.isEmpty, target.count <= Self.maxURL,
+              let url = URLComponents(string: target), ["https", "http"].contains(url.scheme?.lowercased() ?? ""),
+              url.host?.isEmpty == false, url.user == nil, url.password == nil else { return nil }
+        self.kind = kind
+        self.target = target
+    }
+}

ios/FrameControl/Assets.xcassets/AccentColor.colorset/Contents.json

@@ -0,0 +1,4 @@
+{
+  "colors" : [ { "color" : { "color-space" : "srgb", "components" : { "alpha" : "1.000", "blue" : "0xFF", "green" : "0x9F", "red" : "0x1A" } }, "idiom" : "universal" } ],
+  "info" : { "author" : "xcode", "version" : 1 }
+}

ios/FrameControl/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,4 @@
+{
+  "images" : [ { "filename" : "icon-1024.png", "idiom" : "universal", "platform" : "ios", "size" : "1024x1024" } ],
+  "info" : { "author" : "xcode", "version" : 1 }
+}

ios/FrameControl/Assets.xcassets/AppIconImage.imageset/Contents.json

@@ -0,0 +1 @@
+{ "images" : [ { "filename" : "icon.png", "idiom" : "universal" } ], "info" : { "author" : "xcode", "version" : 1 } }

ios/FrameControl/Assets.xcassets/Contents.json

@@ -0,0 +1 @@
+{ "info" : { "author" : "xcode", "version" : 1 } }

ios/FrameControl/Info.plist

@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleDisplayName</key>
+	<string>Frame Control</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>com.saphid.framecontrol.install</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>frame-control</string>
+			</array>
+		</dict>
+	</array>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>LSApplicationQueriesSchemes</key>
+	<array>
+		<string>ssh</string>
+		<string>sftp</string>
+		<string>steamlink</string>
+		<string>rdp</string>
+	</array>
+	<key>NSAppTransportSecurity</key>
+	<dict>
+		<key>NSAllowsLocalNetworking</key>
+		<true/>
+	</dict>
+	<key>NSBonjourServices</key>
+	<array>
+		<string>_steamos-devkit._tcp</string>
+	</array>
+	<key>NSLocalNetworkUsageDescription</key>
+	<string>Frame Control finds your Steam Frame on your network and connects to it.</string>
+	<key>NSPhotoLibraryAddUsageDescription</key>
+	<string>Frame Control saves headset captures and screenshots to your photo library when you ask it to.</string>
+	<key>UILaunchScreen</key>
+	<dict>
+		<key>UIColorName</key>
+		<string></string>
+	</dict>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UIUserInterfaceStyle</key>
+	<string>Dark</string>
+</dict>
+</plist>

ios/FrameControl/SSH/FrameFinder.swift

@@ -0,0 +1,125 @@
+import Foundation
+import Network
+
+/// Finds the Frame on the local network so nobody has to type its address.
+/// A Frame in Developer Mode advertises Valve's devkit service over Bonjour
+/// (`_steamos-devkit._tcp`); failing that, `fallback` (the saved address, or
+/// frame.local) is checked by opening its SSH port. Both repeat until stopped.
+@MainActor
+final class FrameFinder: ObservableObject {
+    struct Found: Equatable {
+        let host: String   // what to connect to
+        let name: String   // what to call it
+    }
+
+    @Published private(set) var found: Found?
+    /// When the search began, to tell "still looking" from "can't find it".
+    @Published private(set) var since = Date()
+
+    private var browser: NWBrowser?
+    private var probeTask: Task<Void, Never>?
+    private var fallback = "frame.local"
+
+    func start(fallback: String?) {
+        stop()
+        self.fallback = (fallback?.isEmpty == false ? fallback : nil) ?? "frame.local"
+        found = nil
+        since = Date()
+        browse()
+        probeTask = Task { [weak self] in
+            while !Task.isCancelled {
+                guard let self else { return }
+                let host = self.fallback
+                if self.found == nil, await Self.sshAnswers(host: host) {
+                    self.found = Found(host: host, name: host)
+                }
+                try? await Task.sleep(nanoseconds: 3_000_000_000)
+            }
+        }
+    }
+
+    func stop() {
+        browser?.cancel()
+        browser = nil
+        probeTask?.cancel()
+        probeTask = nil
+    }
+
+    private func browse() {
+        let browser = NWBrowser(for: .bonjour(type: "_steamos-devkit._tcp", domain: nil), using: .tcp)
+        browser.browseResultsChangedHandler = { [weak self] results, _ in
+            for result in results {
+                guard case let .service(name, _, _, _) = result.endpoint else { continue }
+                Self.resolve(result.endpoint) { host in
+                    Task { @MainActor in
+                        guard let self, let host else { return }
+                        // A found device is used over the fallback probe.
+                        self.found = Found(host: host, name: name)
+                    }
+                }
+            }
+        }
+        browser.start(queue: .main)
+        self.browser = browser
+    }
+
+    /// The device's IP address: connect to the service and read where it went.
+    nonisolated private static func resolve(_ endpoint: NWEndpoint, done: @escaping @Sendable (String?) -> Void) {
+        let connection = NWConnection(to: endpoint, using: .tcp)
+        let once = Once()
+        connection.stateUpdateHandler = { state in
+            switch state {
+            case .ready:
+                var host: String?
+                if case let .hostPort(h, _)? = connection.currentPath?.remoteEndpoint {
+                    host = "\(h)".components(separatedBy: "%").first  // drop an IPv6 interface suffix
+                }
+                connection.cancel()
+                if once.claim() { done(host) }
+            case .failed, .cancelled:
+                if once.claim() { done(nil) }
+            default:
+                break
+            }
+        }
+        connection.start(queue: .global())
+        DispatchQueue.global().asyncAfter(deadline: .now() + 5) {
+            connection.cancel()
+            if once.claim() { done(nil) }
+        }
+    }
+
+    /// Whether something answers on the SSH port of "host" or "host:port" within a few seconds.
+    nonisolated static func sshAnswers(host address: String) async -> Bool {
+        var host = address, port: UInt16 = 22
+        if let target = AppModel.parse(host: address, user: "steamos") {
+            host = target.host
+            port = UInt16(target.port)
+        }
+        return await sshAnswers(host: host, port: port)
+    }
+
+    nonisolated static func sshAnswers(host: String, port: UInt16) async -> Bool {
+        await withCheckedContinuation { (c: CheckedContinuation<Bool, Never>) in
+            let connection = NWConnection(host: NWEndpoint.Host(host), port: NWEndpoint.Port(rawValue: port) ?? 22, using: .tcp)
+            let once = Once()
+            connection.stateUpdateHandler = { state in
+                switch state {
+                case .ready:
+                    connection.cancel()
+                    if once.claim() { c.resume(returning: true) }
+                case .failed, .waiting:
+                    connection.cancel()
+                    if once.claim() { c.resume(returning: false) }
+                default:
+                    break
+                }
+            }
+            connection.start(queue: .global())
+            DispatchQueue.global().asyncAfter(deadline: .now() + 3) {
+                connection.cancel()
+                if once.claim() { c.resume(returning: false) }
+            }
+        }
+    }
+}

ios/FrameControl/SSH/FrameLink.swift

@@ -0,0 +1,152 @@
+import Citadel
+import CryptoKit
+import Foundation
+import NIOCore
+import NIOSSH
+
+/// Where the Frame is and who to log in as.
+struct FrameSettings: Codable, Equatable {
+    var host: String
+    var port: Int = 22
+    var user: String = "steamos"
+}
+
+struct FrameFailure: LocalizedError {
+    let message: String
+    /// Retrying can't help: the Frame's identity changed, or it refused this phone's login.
+    var needsPairing = false
+    init(_ message: String, needsPairing: Bool = false) {
+        self.message = message
+        self.needsPairing = needsPairing
+    }
+    var errorDescription: String? { message }
+}
+
+/// Trust on first use: pairing records the Frame's host key; later connections
+/// accept that key and nothing else, as ssh's known_hosts does.
+final class PinnedHostKey: NIOSSHClientServerAuthenticationDelegate, @unchecked Sendable {
+    struct Changed: Error {}
+    let expected: String?
+    private let lock = NSLock()
+    private var _seen: String?
+    var seen: String? { lock.withLock { _seen } }
+
+    init(expected: String?) { self.expected = expected }
+
+    func validateHostKey(hostKey: NIOSSHPublicKey, validationCompletePromise: EventLoopPromise<Void>) {
+        let key = String(openSSHPublicKey: hostKey)
+        lock.withLock { _seen = key }
+        if expected == nil || expected == key {
+            validationCompletePromise.succeed(())
+        } else {
+            validationCompletePromise.fail(Changed())
+        }
+    }
+}
+
+/// One SSH connection to the Frame, and the few things the app does over it.
+final class FrameLink: @unchecked Sendable {
+    let client: SSHClient
+
+    private init(client: SSHClient) { self.client = client }
+
+    static func connect(_ settings: FrameSettings, auth: SSHAuthenticationMethod, hostKey: PinnedHostKey) async throws -> FrameLink {
+        do {
+            let client = try await SSHClient.connect(
+                host: settings.host, port: settings.port, authenticationMethod: auth,
+                hostKeyValidator: .custom(hostKey), reconnect: .never, connectTimeout: .seconds(8))
+            return FrameLink(client: client)
+        } catch {
+            let text = String(describing: error)
+            throw FrameFailure(describe(error, host: settings.host),
+                               needsPairing: error is PinnedHostKey.Changed || text.contains("allAuthenticationOptionsFailed"))
+        }
+    }
+
+    /// The plain-language reason a connection failed, like the desktop server's messages.
+    static func describe(_ error: Error, host: String) -> String {
+        if error is PinnedHostKey.Changed {
+            return "The Frame's SSH identity changed (after a reinstall, or a different device at \(host)). Pair again."
+        }
+        let text = String(describing: error)
+        if text.contains("allAuthenticationOptionsFailed") || text.contains("authentication") {
+            return "The Frame didn't accept the login. Pair again, and check the Developer Mode password."
+        }
+        if ["timeout", "Timeout", "timed out", "Host is down", "No route to host", "Network is unreachable",
+            "errno: 64", "errno: 65", "errno: 51", "errno: 60"].contains(where: text.contains) {
+            return "The Frame isn't answering at \(host). It may be asleep, switched off, or on another network."
+        }
+        if text.contains("refused") || text.contains("ECONNREFUSED") {
+            return "The Frame refused the connection at \(host). Check Developer Mode is still on."
+        }
+        if text.contains("NXDOMAIN") || text.contains("resolve") || text.contains("unknownHost") || text.contains("NoAddress") {
+            return "Can't find \(host) on the network. Check the address, and that the Frame is on the same network."
+        }
+        return "Couldn't connect to \(host): \(text)"
+    }
+
+    var isConnected: Bool { client.isConnected }
+
+    /// Whether the Frame answers a trivial command within a few seconds. The probe
+    /// runs unstructured: a dead link can keep it waiting well past the deadline,
+    /// and the answer mustn't wait for it.
+    func answers(within seconds: Double = 6) async -> Bool {
+        guard client.isConnected else { return false }
+        let once = Once()
+        return await withCheckedContinuation { (c: CheckedContinuation<Bool, Never>) in
+            Task { let ok = (try? await self.run("true").status) == 0; if once.claim() { c.resume(returning: ok) } }
+            Task { try? await Task.sleep(nanoseconds: UInt64(seconds * 1e9)); if once.claim() { c.resume(returning: false) } }
+        }
+    }
+
+    func close() async {
+        try? await client.close()
+    }
+
+    /// Runs a shell command; returns its combined output and exit status.
+    func run(_ command: String) async throws -> (output: String, status: Int) {
+        // stderr joins stdout (Citadel treats any stderr as a failure), and the
+        // status comes back as the last line so a non-zero exit isn't an exception.
+        let buffer = try await client.executeCommand("{ \(command)\n} 2>&1; echo \"@@rc=$?\"")
+        var text = String(buffer: buffer)
+        var status = 0
+        if let range = text.range(of: "@@rc=", options: .backwards) {
+            status = Int(text[range.upperBound...].trimmingCharacters(in: .whitespacesAndNewlines)) ?? -1
+            text = String(text[..<range.lowerBound])
+        }
+        return (text.trimmingCharacters(in: .whitespacesAndNewlines), status)
+    }
+
+    /// Runs a command that must succeed; its output, or a FrameFailure with it.
+    @discardableResult
+    func check(_ command: String, _ what: String) async throws -> String {
+        let r = try await run(command)
+        guard r.status == 0 else { throw FrameFailure("\(what): \(r.output.isEmpty ? "exit \(r.status)" : r.output)") }
+        return r.output
+    }
+
+    /// Writes data to a path relative to the home directory.
+    func upload(_ data: Data, to path: String) async throws {
+        let sftp = try await client.openSFTP()
+        do {
+            try await sftp.withFile(filePath: path, flags: [.write, .create, .truncate]) { file in
+                try await file.write(ByteBuffer(bytes: data))
+            }
+            try? await sftp.close()
+        } catch {
+            try? await sftp.close()
+            throw error
+        }
+    }
+}
+
+/// True for the first caller only.
+final class Once: @unchecked Sendable {
+    private let lock = NSLock()
+    private var done = false
+    func claim() -> Bool { lock.withLock { defer { done = true }; return !done } }
+}
+
+func shellQuote(_ s: String) -> String {
+    "'" + s.replacingOccurrences(of: "'", with: "'\\''") + "'"
+}

ios/FrameControl/SSH/HeadsetServer.swift

@@ -0,0 +1,177 @@
+import Citadel
+import Foundation
+import NIOCore
+
+/// Frame Control's server, running on the Frame itself. The app copies the bundle
+/// (ios/scripts/make_frame_bundle.py) to ~/.cache/frame-control/<version> once per
+/// version, then starts ui/server.py there over SSH. It listens only on the Frame's
+/// 127.0.0.1, and it exits when this SSH session ends (--exit-on-eof).
+final class HeadsetServer: @unchecked Sendable {
+    let port: Int
+    private let lock = NSLock()
+    private var _exited: String?
+    private var onExit: (@Sendable (String) -> Void)?
+    /// Set once the server stops, with its last output.
+    var exited: String? { lock.withLock { _exited } }
+
+    private init(port: Int) { self.port = port }
+
+    /// Calls back once when the server stops, at once if it already has.
+    func whenExited(_ callback: @escaping @Sendable (String) -> Void) {
+        let already: String? = lock.withLock {
+            if _exited == nil { onExit = callback }
+            return _exited
+        }
+        if let already { callback(already) }
+    }
+
+    fileprivate func markExited(_ tail: String) {
+        let callback: (@Sendable (String) -> Void)? = lock.withLock {
+            guard _exited == nil else { return nil }
+            _exited = tail
+            defer { onExit = nil }
+            return onExit
+        }
+        callback?(tail)
+    }
+
+    static let cacheDir = ".cache/frame-control"
+
+    struct Bundle {
+        let data: Data
+        let version: String
+
+        static func fromApp() throws -> Bundle {
+            guard let url = Foundation.Bundle.main.url(forResource: "frame-bundle", withExtension: "tar.gz"),
+                  let data = try? Data(contentsOf: url),
+                  let vurl = Foundation.Bundle.main.url(forResource: "frame-bundle", withExtension: "version"),
+                  let version = try? String(contentsOf: vurl, encoding: .utf8).trimmingCharacters(in: .whitespacesAndNewlines),
+                  version.range(of: "^[0-9a-f]{16}$", options: .regularExpression) != nil else {
+                throw FrameFailure("This build of the app is missing its Frame bundle")
+            }
+            return Bundle(data: data, version: version)
+        }
+    }
+
+    /// Copies the bundle over unless this version is already there; removes older versions.
+    static func deploy(_ bundle: Bundle, over link: FrameLink, progress: @escaping @Sendable (String) -> Void) async throws -> String {
+        let dir = "\(cacheDir)/\(bundle.version)"
+        let py = try await link.run("command -v python3 >/dev/null && python3 -c 'import sys; print(sys.version_info >= (3, 8))'")
+        guard py.status == 0, py.output.hasSuffix("True") else {
+            throw FrameFailure("The Frame has no Python 3.8 or later, which Frame Control needs there.")
+        }
+        if try await link.run("test -f \(dir)/ui/server.py").status != 0 {
+            progress("Copying Frame Control to the headset")
+            try await link.check("mkdir -p \(cacheDir)", "Couldn't make \(cacheDir)")
+            let archive = "\(dir).tar.gz"
+            try await link.upload(bundle.data, to: archive)
+            progress("Unpacking")
+            try await link.check("rm -rf \(dir).tmp && mkdir \(dir).tmp && tar xzf \(archive) -C \(dir).tmp && rm -f \(archive) "
+                                 + "&& rm -rf \(dir) && mv \(dir).tmp \(dir)", "Couldn't unpack Frame Control on the headset")
+        }
+        // Another phone or iPad may be running a different version right now: a version
+        // goes only when no server runs from it and it hasn't been used for two weeks
+        // (this one is marked as used). Servers run by absolute path, so pgrep sees it.
+        _ = try? await link.run("touch \(dir) && cd \(cacheDir) && for d in */; do d=${d%/}; "
+                                + "[ \"$d\" = \(bundle.version) ] && continue; "
+                                + "[ -n \"$(find \"$d\" -maxdepth 0 -mtime +14)\" ] || continue; "
+                                + "pgrep -f \"$PWD/$d/\" >/dev/null && continue; rm -rf -- \"$d\"; done")
+        return dir
+    }
+
+    /// Starts the server in dir and waits for it to say which port it took.
+    static func start(in dir: String, over link: FrameLink, key: String, device: String) async throws -> HeadsetServer {
+        let command = "cd \(dir) && FRAME_LOCAL=1 FRAME_UI_KEY=\(key) FRAME_DEVICE=\(shellQuote(device)) "
+            + "exec python3 -I -u -B \"$PWD/ui/server.py\" --port 0 --exit-on-eof 2>&1"
+        let stream = try await link.client.executeCommandStream(command)
+        let box = PortWaiter()
+        let reader = Task { () -> Void in
+            var text = ""
+            do {
+                for try await chunk in stream {
+                    switch chunk {
+                    case .stdout(let b), .stderr(let b): text += String(buffer: b)
+                    }
+                    if text.count > 20_000 { text = String(text.suffix(10_000)) }
+                    if let port = Self.port(in: text) { box.found(port) }
+                }
+            } catch {
+                text += "\n\(error)"
+            }
+            box.ended(text)
+        }
+        let server: HeadsetServer
+        do {
+            server = HeadsetServer(port: try await box.wait(seconds: 30))
+        } catch {
+            reader.cancel()
+            throw error
+        }
+        box.whenEnded { [weak server] tail in server?.markExited(tail) }
+        return server
+    }
+
+    /// The port from the server's first line. Output arrives in chunks, so the digits
+    /// only count once something follows them (the line goes on after the port).
+    static func port(in text: String) -> Int? {
+        guard let r = text.range(of: #"Frame Control on http://127\.0\.0\.1:[0-9]+\s"#, options: .regularExpression),
+              let port = Int(text[r].dropLast().split(separator: ":").last ?? ""), (1...65535).contains(port) else { return nil }
+        return port
+    }
+}
+
+/// Hands the port from the output reader to start(), or the output if the server died first.
+private final class PortWaiter: @unchecked Sendable {
+    private let lock = NSLock()
+    private var continuation: CheckedContinuation<Int, Error>?
+    private var result: Result<Int, Error>?
+    private var endedTail: String?
+    private var onEnd: (@Sendable (String) -> Void)?
+
+    /// Calls back when the output ends, at once if it already has.
+    func whenEnded(_ callback: @escaping @Sendable (String) -> Void) {
+        let already: String? = lock.withLock {
+            if endedTail == nil { onEnd = callback }
+            return endedTail
+        }
+        if let already { callback(already) }
+    }
+
+    func found(_ port: Int) { finish(.success(port)) }
+
+    func ended(_ text: String) {
+        let tail = String(text.suffix(600)).trimmingCharacters(in: .whitespacesAndNewlines)
+        let callback: (@Sendable (String) -> Void)? = lock.withLock {
+            endedTail = tail
+            defer { onEnd = nil }
+            return onEnd
+        }
+        finish(.failure(FrameFailure("Frame Control's server on the headset stopped: \(tail.isEmpty ? "no output" : tail)")))
+        callback?(tail)
+    }
+
+    private func finish(_ r: Result<Int, Error>) {
+        let c: CheckedContinuation<Int, Error>? = lock.withLock {
+            guard result == nil else { return nil }
+            result = r
+            defer { continuation = nil }
+            return continuation
+        }
+        c?.resume(with: r)
+    }
+
+    func wait(seconds: Double) async throws -> Int {
+        Task { [weak self] in
+            try? await Task.sleep(nanoseconds: UInt64(seconds * 1e9))
+            self?.finish(.failure(FrameFailure("Frame Control's server on the headset didn't start within \(Int(seconds)) s")))
+        }
+        return try await withCheckedThrowingContinuation { c in
+            let done: Result<Int, Error>? = lock.withLock {
+                if let result { return result }
+                continuation = c
+                return nil
+            }
+            if let done { c.resume(with: done) }
+        }
+    }
+}

ios/FrameControl/SSH/Keys.swift

@@ -0,0 +1,54 @@
+import CryptoKit
+import Foundation
+import NIOSSH
+import Security
+
+/// Small wrapper over the Keychain for this app's secrets.
+enum Keychain {
+    private static let service = "com.saphid.framecontrol"
+
+    private static func query(_ account: String) -> [String: Any] {
+        [kSecClass as String: kSecClassGenericPassword, kSecAttrService as String: service,
+         kSecAttrAccount as String: account]
+    }
+
+    static func data(_ account: String) -> Data? {
+        var q = query(account)
+        q[kSecReturnData as String] = true
+        q[kSecMatchLimit as String] = kSecMatchLimitOne
+        var out: AnyObject?
+        return SecItemCopyMatching(q as CFDictionary, &out) == errSecSuccess ? out as? Data : nil
+    }
+
+    static func set(_ data: Data, _ account: String) {
+        SecItemDelete(query(account) as CFDictionary)
+        var q = query(account)
+        q[kSecValueData as String] = data
+        // Only on this device and not in backups: the key is this phone's identity.
+        q[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        SecItemAdd(q as CFDictionary, nil)
+    }
+
+    static func delete(_ account: String) {
+        SecItemDelete(query(account) as CFDictionary)
+    }
+}
+
+/// This phone's SSH key: ed25519, made once, kept in the Keychain.
+enum DeviceKey {
+    private static let account = "ssh-ed25519"
+
+    static func loadOrCreate() -> Curve25519.Signing.PrivateKey {
+        if let raw = Keychain.data(account), let key = try? Curve25519.Signing.PrivateKey(rawRepresentation: raw) {
+            return key
+        }
+        let key = Curve25519.Signing.PrivateKey()
+        Keychain.set(key.rawRepresentation, account)
+        return key
+    }
+
+    /// The line for ~/.ssh/authorized_keys, e.g. "ssh-ed25519 AAAA… frame-control@iPhone".
+    static func authorizedKeysLine(_ key: Curve25519.Signing.PrivateKey, comment: String) -> String {
+        String(openSSHPublicKey: NIOSSHPrivateKey(ed25519Key: key).publicKey) + " " + comment
+    }
+}

ios/FrameControl/SSH/PortForwarder.swift

@@ -0,0 +1,113 @@
+import Citadel
+import Foundation
+import NIOCore
+import NIOPosix
+import NIOSSH
+
+/// Listens on this phone's 127.0.0.1 and carries each connection to a port on the
+/// Frame's 127.0.0.1 through the SSH session (ssh -L). The web view loads the
+/// server from here; every API request still needs the session's key.
+final class PortForwarder: @unchecked Sendable {
+    private let channel: Channel
+    let localPort: Int
+
+    private init(channel: Channel, localPort: Int) {
+        self.channel = channel
+        self.localPort = localPort
+    }
+
+    static func start(over link: FrameLink, to remotePort: Int) async throws -> PortForwarder {
+        let client = link.client
+        // The listener shares the SSH connection's event loop, so the glue between
+        // each pair of channels never crosses threads.
+        let bootstrap = ServerBootstrap(group: client.eventLoop)
+            .serverChannelOption(ChannelOptions.socketOption(.so_reuseaddr), value: 1)
+            .childChannelOption(ChannelOptions.allowRemoteHalfClosure, value: true)
+            // Nothing is read from the web view until the SSH side is ready for it.
+            .childChannelOption(ChannelOptions.autoRead, value: false)
+            .childChannelInitializer { inbound in
+                inbound.eventLoop.makeFutureWithTask {
+                    let (local, remote) = GlueHandler.matchedPair()
+                    try await inbound.pipeline.addHandler(local).get()
+                    let origin = try inbound.remoteAddress ?? SocketAddress(ipAddress: "127.0.0.1", port: 0)
+                    _ = try await client.createDirectTCPIPChannel(
+                        using: SSHChannelType.DirectTCPIP(targetHost: "127.0.0.1", targetPort: remotePort, originatorAddress: origin)
+                    ) { channel in channel.pipeline.addHandler(remote) }
+                    try await inbound.setOption(ChannelOptions.autoRead, value: true).get()
+                }
+            }
+        let channel = try await bootstrap.bind(host: "127.0.0.1", port: 0).get()
+        guard let port = channel.localAddress?.port else { throw FrameFailure("Couldn't open a local port") }
+        return PortForwarder(channel: channel, localPort: port)
+    }
+
+    func stop() {
+        channel.close(promise: nil)
+    }
+}
+
+/// Joins two channels: what one reads, the other writes, with backpressure and
+/// half-close passed across (the pattern from SwiftNIO's examples).
+final class GlueHandler: ChannelDuplexHandler, @unchecked Sendable {
+    typealias InboundIn = NIOAny
+    typealias OutboundIn = NIOAny
+    typealias OutboundOut = NIOAny
+
+    private var partner: GlueHandler?
+    private var context: ChannelHandlerContext?
+    private var pendingRead = false
+
+    static func matchedPair() -> (GlueHandler, GlueHandler) {
+        let a = GlueHandler(), b = GlueHandler()
+        a.partner = b
+        b.partner = a
+        return (a, b)
+    }
+
+    private func partnerWrite(_ data: NIOAny) { context?.write(data, promise: nil) }
+    private func partnerFlush() { context?.flush() }
+    private func partnerWriteEOF() { context?.close(mode: .output, promise: nil) }
+    private func partnerClose() { context?.close(promise: nil) }
+    private var partnerWritable: Bool { context?.channel.isWritable ?? false }
+
+    private func partnerBecameWritable() {
+        if pendingRead {
+            pendingRead = false
+            context?.read()
+        }
+    }
+
+    func handlerAdded(context: ChannelHandlerContext) { self.context = context }
+
+    func handlerRemoved(context: ChannelHandlerContext) {
+        self.context = nil
+        partner = nil
+    }
+
+    func channelRead(context: ChannelHandlerContext, data: NIOAny) { partner?.partnerWrite(data) }
+    func channelReadComplete(context: ChannelHandlerContext) { partner?.partnerFlush() }
+    func channelInactive(context: ChannelHandlerContext) { partner?.partnerClose() }
+
+    func userInboundEventTriggered(context: ChannelHandlerContext, event: Any) {
+        if let e = event as? ChannelEvent, case .inputClosed = e {
+            partner?.partnerWriteEOF()
+        }
+        context.fireUserInboundEventTriggered(event)
+    }
+
+    func errorCaught(context: ChannelHandlerContext, error: Error) {
+        partner?.partnerClose()
+    }
+
+    func channelWritabilityChanged(context: ChannelHandlerContext) {
+        if context.channel.isWritable { partner?.partnerBecameWritable() }
+    }
+
+    func read(context: ChannelHandlerContext) {
+        if let partner, partner.partnerWritable {
+            context.read()
+        } else {
+            pendingRead = true
+        }
+    }
+}

ios/FrameControl/Views/RootView.swift

@@ -0,0 +1,121 @@
+import SwiftUI
+
+struct RootView: View {
+    @ObservedObject var model: AppModel
+
+    var body: some View {
+        ZStack {
+            Color.frameBackground.ignoresSafeArea()
+            switch model.phase {
+            case .setup:
+                SetupView(model: model)
+            case .connecting(let step):
+                ConnectingView(step: step, host: model.settings?.host) { model.showSetup() }
+            case .failed(let message) where model.retrying && !model.needsPairing:
+                WaitingView(host: model.settings.map { $0.port == 22 ? $0.host : "\($0.host):\($0.port)" } ?? "", detail: message, deviceName: model.deviceName,
+                            reachable: { Task { await model.connect(quiet: true) } }, change: { model.showSetup() })
+            case .failed(let message):
+                FailedView(message: message, canRetry: model.settings != nil, retrying: model.retrying, needsPairing: model.needsPairing,
+                           retry: { Task { await model.connect() } }, change: { model.showSetup() })
+            case .ready(let url):
+                WebShell(url: url, model: model).ignoresSafeArea()
+            }
+        }
+        .preferredColorScheme(.dark)
+        .tint(.frameBlue)
+    }
+}
+
+extension Color {
+    static let frameBackground = Color(red: 0.055, green: 0.078, blue: 0.106)
+    static let framePanel = Color(red: 0.118, green: 0.137, blue: 0.161)
+    static let frameBlue = Color(red: 0.102, green: 0.624, blue: 1.0)
+    static let frameMuted = Color(red: 0.561, green: 0.596, blue: 0.627)
+}
+
+struct ConnectingView: View {
+    let step: String
+    let host: String?
+    let cancel: () -> Void
+
+    var body: some View {
+        VStack(spacing: 18) {
+            Image("AppIconImage").resizable().frame(width: 76, height: 76).clipShape(RoundedRectangle(cornerRadius: 17))
+            ProgressView().controlSize(.large)
+            Text(step).font(.headline).multilineTextAlignment(.center)
+            if let host { Text(host).font(.subheadline).foregroundStyle(Color.frameMuted) }
+            Button("Change headset", action: cancel).padding(.top, 8)
+        }
+        .padding(32)
+    }
+}
+
+struct FailedView: View {
+    let message: String
+    let canRetry: Bool
+    let retrying: Bool
+    let needsPairing: Bool
+    let retry: () -> Void
+    let change: () -> Void
+
+    var body: some View {
+        VStack(spacing: 16) {
+            Image(systemName: needsPairing ? "lock.trianglebadge.exclamationmark" : "wifi.exclamationmark")
+                .font(.system(size: 44)).foregroundStyle(.orange)
+            Text(needsPairing ? "Pair with the Frame again" : "Can't reach the Frame").font(.title3.bold())
+            Text(message).multilineTextAlignment(.center).foregroundStyle(Color.frameMuted)
+            if retrying { Text("Trying again every few seconds.").font(.footnote).foregroundStyle(Color.frameMuted) }
+            if needsPairing {
+                Button("Pair again", action: change).buttonStyle(.borderedProminent).controlSize(.large)
+            } else if canRetry {
+                Button("Try again", action: retry).buttonStyle(.borderedProminent).controlSize(.large)
+            }
+            if !needsPairing { Button(canRetry ? "Change headset" : "Back", action: change) }
+        }
+        .padding(32)
+        .frame(maxWidth: 480)
+    }
+}
+
+/// A paired Frame that isn't answering is almost always asleep: say how to wake
+/// it, and connect the moment it does (its SSH port is checked every 3 s).
+struct WaitingView: View {
+    let host: String
+    let detail: String
+    let deviceName: String
+    let reachable: () -> Void
+    let change: () -> Void
+    @State private var pulse = false
+
+    var body: some View {
+        VStack(spacing: 18) {
+            Image("AppIconImage").resizable().frame(width: 76, height: 76)
+                .clipShape(RoundedRectangle(cornerRadius: 17))
+                .opacity(pulse ? 1 : 0.55)
+                .animation(.easeInOut(duration: 1.2).repeatForever(autoreverses: true), value: pulse)
+            Text("Waiting for your Frame").font(.title3.bold())
+            Text("Put the headset on, or press its power button, to wake it. Frame Control connects by itself as soon as it's awake.")
+                .multilineTextAlignment(.center)
+            VStack(alignment: .leading, spacing: 10) {
+                Tip(icon: "wifi", text: "Same Wi-Fi as this \(deviceName), or both on Tailscale.")
+                Tip(icon: "bolt.horizontal", text: "Asleep, the Frame drops off the network entirely; nothing can wake it remotely.")
+            }
+            .padding(14)
+            .background(Color.framePanel, in: RoundedRectangle(cornerRadius: 12))
+            Text(detail).font(.footnote).foregroundStyle(Color.frameMuted).multilineTextAlignment(.center)
+            Button("Connect to a different Frame", action: change).font(.footnote)
+        }
+        .padding(28)
+        .frame(maxWidth: 480)
+        .onAppear { pulse = true }
+        .task(id: host) {
+            while !Task.isCancelled {
+                try? await Task.sleep(nanoseconds: 3_000_000_000)
+                if !host.isEmpty, await FrameFinder.sshAnswers(host: host) {
+                    reachable()
+                    return
+                }
+            }
+        }
+    }
+}

ios/FrameControl/Views/SetupView.swift

@@ -0,0 +1,197 @@
+import SwiftUI
+import UIKit
+
+/// First run: two steps. Wake the Frame (the app finds it by itself), then type the
+/// Developer Mode password once. Everything else waits under "Other ways to connect".
+struct SetupView: View {
+    @ObservedObject var model: AppModel
+    @StateObject private var finder = FrameFinder()
+    @State private var password = ""
+    @State private var manualHost = ""
+    @State private var user = "steamos"
+    @State private var showOther = false
+    @State private var showHelp = false
+    @FocusState private var passwordFocused: Bool
+
+    /// Where Connect goes: what the finder saw, else what was typed, else frame.local.
+    private var host: String {
+        let typed = manualHost.trimmingCharacters(in: .whitespaces)
+        return finder.found?.host ?? (typed.isEmpty ? "frame.local" : typed)
+    }
+
+    var body: some View {
+        ScrollView {
+            VStack(alignment: .leading, spacing: 22) {
+                header
+                StepCard(number: 1, title: "Wake your Frame", done: finder.found != nil) { wakeStep }
+                StepCard(number: 2, title: "Enter its Developer Mode password", done: false) { passwordStep }
+                otherWays
+            }
+            .padding(20)
+            .frame(maxWidth: 560)
+            .frame(maxWidth: .infinity)
+        }
+        .scrollDismissesKeyboard(.interactively)
+        .background(Color.frameBackground)
+        .onAppear {
+            manualHost = model.settings?.host ?? ""
+            user = model.settings?.user ?? "steamos"
+            var fallback = model.settings?.host
+            #if DEBUG
+            fallback = ProcessInfo.processInfo.environment["FRAME_TEST_FALLBACK"] ?? fallback  // Simulator test hook
+            #endif
+            finder.start(fallback: fallback)
+        }
+        .onDisappear { finder.stop() }
+        // After a few seconds of not finding it, say exactly what to check.
+        .task(id: finder.since) {
+            try? await Task.sleep(nanoseconds: 8_000_000_000)
+            showHelp = true
+        }
+    }
+
+    private var header: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            Image("AppIconImage").resizable().frame(width: 56, height: 56).clipShape(RoundedRectangle(cornerRadius: 13))
+            Text("Connect to your Steam Frame").font(.title2.bold())
+            Text("One time only. After this, the app connects by itself whenever your Frame is awake.")
+                .foregroundStyle(Color.frameMuted)
+        }
+    }
+
+    // MARK: step 1
+
+    @ViewBuilder private var wakeStep: some View {
+        if let found = finder.found {
+            Label {
+                VStack(alignment: .leading, spacing: 2) {
+                    Text("Found your Frame").fontWeight(.semibold)
+                    Text(found.name == found.host ? found.host : "\(found.name) · \(found.host)")
+                        .font(.footnote).foregroundStyle(Color.frameMuted)
+                }
+            } icon: {
+                Image(systemName: "checkmark.circle.fill").foregroundStyle(.green)
+            }
+        } else {
+            HStack(spacing: 10) {
+                ProgressView()
+                Text("Looking for it on this network…").foregroundStyle(Color.frameMuted)
+            }
+            Text("Put the headset on, or press its power button, so it's awake.")
+            if showHelp {
+                VStack(alignment: .leading, spacing: 10) {
+                    Text("Still can't see it? Check:").font(.subheadline.weight(.semibold))
+                    Tip(icon: "wifi", text: "The Frame and this \(model.deviceName) are on the same Wi-Fi.")
+                    Tip(icon: "hammer", text: "Developer Mode is on: on the Frame, Steam Settings → System → Enable Developer Mode.")
+                    Tip(icon: "network", text: "Local Network is allowed for Frame Control: \(model.deviceName) Settings → Apps → Frame Control.")
+                }
+                .padding(.top, 4)
+            }
+        }
+    }
+
+    // MARK: step 2
+
+    @ViewBuilder private var passwordStep: some View {
+        SecureField("Developer Mode password", text: $password)
+            .textContentType(.password)
+            .submitLabel(.go)
+            .focused($passwordFocused)
+            .onSubmit(connect)
+            .padding(12)
+            .background(Color.black.opacity(0.28), in: RoundedRectangle(cornerRadius: 10))
+        Text("Haven't set one? On the Frame: Steam Settings → Developer → Set User Password. It's only used now, to let this \(model.deviceName) in; it isn't saved.")
+            .font(.footnote).foregroundStyle(Color.frameMuted)
+        Button(action: connect) {
+            Text(finder.found == nil ? "Connect to \(host)" : "Connect")
+                .fontWeight(.semibold).frame(maxWidth: .infinity).padding(.vertical, 4)
+        }
+        .buttonStyle(.borderedProminent)
+        .controlSize(.large)
+        .disabled(password.isEmpty)
+    }
+
+    // MARK: everything else, out of the way
+
+    private var otherWays: some View {
+        DisclosureGroup(isExpanded: $showOther) {
+            VStack(alignment: .leading, spacing: 14) {
+                VStack(alignment: .leading, spacing: 6) {
+                    Text("Address").font(.footnote).foregroundStyle(Color.frameMuted)
+                    TextField("frame.local, an IP, or a Tailscale name", text: $manualHost)
+                        .keyboardType(.URL).textInputAutocapitalization(.never).autocorrectionDisabled()
+                        .onSubmit { finder.start(fallback: manualHost) }
+                        .padding(10).background(Color.black.opacity(0.28), in: RoundedRectangle(cornerRadius: 8))
+                    TextField("User", text: $user)
+                        .textInputAutocapitalization(.never).autocorrectionDisabled()
+                        .padding(10).background(Color.black.opacity(0.28), in: RoundedRectangle(cornerRadius: 8))
+                    Text("Typing an address here uses it instead of searching.").font(.caption).foregroundStyle(Color.frameMuted)
+                }
+                VStack(alignment: .leading, spacing: 6) {
+                    Text("Already reach the Frame over SSH? Add this \(model.deviceName)'s key to ~/.ssh/authorized_keys there, then connect without a password.")
+                        .font(.footnote).foregroundStyle(Color.frameMuted)
+                    HStack {
+                        Button("Copy key") { UIPasteboard.general.string = model.authorizedKeysLine }
+                        Spacer()
+                        Button("Connect with the key") {
+                            let (h, u) = (host, user)
+                            Task { await model.useKey(host: h, user: u) }
+                        }
+                    }
+                }
+                if let saved = model.settings {
+                    Button("Forget \(saved.host)", role: .destructive) { Task { await model.forget() } }
+                }
+            }
+            .padding(.top, 10)
+        } label: {
+            Text("Other ways to connect").foregroundStyle(Color.frameMuted)
+        }
+        .onChange(of: manualHost) { _, value in
+            // A typed address replaces the search.
+            if !value.trimmingCharacters(in: .whitespaces).isEmpty, finder.found?.host != value { finder.start(fallback: value) }
+        }
+    }
+
+    private func connect() {
+        guard !password.isEmpty else { passwordFocused = true; return }
+        let (h, u, p) = (host, user, password)
+        password = ""
+        finder.stop()
+        Task { await model.pair(host: h, user: u, password: p) }
+    }
+}
+
+/// A numbered step with a tick once it's done.
+struct StepCard<Content: View>: View {
+    let number: Int
+    let title: String
+    let done: Bool
+    @ViewBuilder let content: Content
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 12) {
+            HStack(spacing: 10) {
+                ZStack {
+                    Circle().fill(done ? Color.green : Color.frameBlue).frame(width: 26, height: 26)
+                    if done { Image(systemName: "checkmark").font(.caption.bold()) } else { Text("\(number)").font(.subheadline.bold()) }
+                }
+                .foregroundStyle(.white)
+                Text(title).font(.headline)
+            }
+            content
+        }
+        .padding(16)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .background(Color.framePanel, in: RoundedRectangle(cornerRadius: 14))
+    }
+}
+
+struct Tip: View {
+    let icon: String
+    let text: String
+
+    var body: some View {
+        Label { Text(text).font(.subheadline).fixedSize(horizontal: false, vertical: true) } icon: { Image(systemName: icon).foregroundStyle(Color.frameBlue) }
+    }
+}

ios/FrameControl/Web/WebShell.swift

@@ -0,0 +1,195 @@
+import SwiftUI
+import UIKit
+import WebKit
+
+/// The Frame Control page, served by the server on the headset, in a web view.
+/// window.frameApp (the same bridge the desktop app's preload.js provides) lets
+/// the page use the phone: clipboard, saving images, other apps, install links.
+struct WebShell: UIViewRepresentable {
+    let url: URL
+    @ObservedObject var model: AppModel
+
+    func makeCoordinator() -> Coordinator { Coordinator(model: model) }
+
+    func makeUIView(context: Context) -> WKWebView {
+        let config = WKWebViewConfiguration()
+        let content = WKUserContentController()
+        content.addUserScript(WKUserScript(source: Self.bridge, injectionTime: .atDocumentStart, forMainFrameOnly: true))
+        content.addScriptMessageHandler(context.coordinator, contentWorld: .page, name: "frameApp")
+        config.userContentController = content
+        config.allowsInlineMediaPlayback = true
+        let web = WKWebView(frame: .zero, configuration: config)
+        web.navigationDelegate = context.coordinator
+        web.uiDelegate = context.coordinator
+        web.isOpaque = false
+        web.backgroundColor = UIColor(red: 0.055, green: 0.078, blue: 0.106, alpha: 1)
+        web.scrollView.backgroundColor = web.backgroundColor
+        web.scrollView.contentInsetAdjustmentBehavior = .never  // the page pads for the safe area itself
+        web.allowsBackForwardNavigationGestures = false
+        #if DEBUG
+        web.isInspectable = true
+        #endif
+        context.coordinator.web = web
+        web.load(URLRequest(url: url))
+        return web
+    }
+
+    func updateUIView(_ web: WKWebView, context: Context) {
+        if context.coordinator.loaded != url {
+            context.coordinator.loaded = url
+            web.load(URLRequest(url: url))
+        }
+        context.coordinator.deliverInstallLinks()
+    }
+
+    static let bridge = """
+    (() => {
+      const call = (name, arg) => window.webkit.messageHandlers.frameApp.postMessage({ name, arg: arg ?? null });
+      let installCb = null;
+      window.frameApp = {
+        platform: "ios",
+        readClipboard: () => call("readClipboard"),
+        setUpConnection: () => call("setUpConnection"),
+        open: (what) => call("open", what),
+        saveImages: (images) => call("saveImages", images),
+        onInstallLink: (cb) => { installCb = cb; return call("installLinkReady"); },
+      };
+      window.__frameInstallLink = (req) => { if (installCb) installCb(req); };
+    })();
+    """
+
+    final class Coordinator: NSObject, WKScriptMessageHandlerWithReply, WKNavigationDelegate, WKUIDelegate {
+        let model: AppModel
+        weak var web: WKWebView?
+        var loaded: URL?
+        private var installReady = false
+
+        init(model: AppModel) { self.model = model }
+
+        // MARK: bridge
+
+        @MainActor
+        func userContentController(_ controller: WKUserContentController, didReceive message: WKScriptMessage,
+                                   replyHandler: @escaping (Any?, String?) -> Void) {
+            guard let body = message.body as? [String: Any], let name = body["name"] as? String else {
+                return replyHandler(nil, "bad message")
+            }
+            let arg = body["arg"]
+            switch name {
+            case "readClipboard":
+                replyHandler(UIPasteboard.general.string ?? "", nil)
+            case "setUpConnection":
+                model.showSetup()
+                replyHandler(nil, nil)
+            case "open":
+                let result = open(arg as? String ?? "")
+                replyHandler(result.message.map { ["message": $0] }, result.error)
+            case "saveImages":
+                let images = (arg as? [[String: Any]] ?? []).compactMap { item -> UIImage? in
+                    guard let b64 = item["data"] as? String, let data = Data(base64Encoded: b64) else { return nil }
+                    return UIImage(data: data)
+                }
+                guard !images.isEmpty else { return replyHandler(nil, "No images to save") }
+                share(images)
+                replyHandler(["message": "Choose Save Image to keep \(images.count == 1 ? "it" : "them") in Photos"], nil)
+            case "installLinkReady":
+                installReady = true
+                deliverInstallLinks()
+                replyHandler(nil, nil)
+            default:
+                replyHandler(nil, "unknown request \(name)")
+            }
+        }
+
+        @MainActor
+        func deliverInstallLinks() {
+            guard installReady, let web, !model.pendingInstallLinks.isEmpty else { return }
+            let links = model.pendingInstallLinks
+            model.pendingInstallLinks = []
+            for link in links {
+                let req = ["kind": link.kind.rawValue, "target": link.target]
+                guard let json = try? JSONSerialization.data(withJSONObject: req), let text = String(data: json, encoding: .utf8) else { continue }
+                web.evaluateJavaScript("window.__frameInstallLink(\(text))")
+            }
+        }
+
+        /// SSH, SFTP, Steam Link and remote desktop open in the apps that handle them.
+        @MainActor
+        private func open(_ what: String) -> (message: String?, error: String?) {
+            guard let s = model.settings else { return (nil, "Not paired with a Frame") }
+            let host = s.host.contains(":") ? "[\(s.host)]" : s.host
+            let target: (url: String, app: String, store: String)
+            switch what {
+            case "terminal": target = ("ssh://\(s.user)@\(host):\(s.port)", "an SSH app such as Blink Shell or Termius", "https://apps.apple.com/search?term=ssh")
+            case "sftp": target = ("sftp://\(s.user)@\(host):\(s.port)", "an SFTP app such as Termius or Secure ShellFish", "https://apps.apple.com/search?term=sftp")
+            case "steamlink": target = ("steamlink://", "Steam Link", "https://apps.apple.com/app/steam-link/id1246969117")
+            case "rdp": target = ("rdp://full%20address=s:\(s.host):3389", "Windows App (Microsoft Remote Desktop)", "https://apps.apple.com/app/windows-app/id714464092")
+            default: return (nil, "Can't open \(what) on this \(model.deviceName)")
+            }
+            guard let url = URL(string: target.url) else { return (nil, "Bad address") }
+            if UIApplication.shared.canOpenURL(url) {
+                UIApplication.shared.open(url)
+                return ("Opening \(target.app)", nil)
+            }
+            if let store = URL(string: target.store) { UIApplication.shared.open(store) }
+            return (nil, "Install \(target.app) to open this; opening the App Store")
+        }
+
+        @MainActor
+        private func share(_ images: [UIImage]) {
+            guard let web, let root = web.window?.rootViewController else { return }
+            let sheet = UIActivityViewController(activityItems: images, applicationActivities: nil)
+            sheet.popoverPresentationController?.sourceView = web
+            sheet.popoverPresentationController?.sourceRect = CGRect(x: web.bounds.midX, y: web.bounds.midY, width: 1, height: 1)
+            (root.presentedViewController ?? root).present(sheet, animated: true)
+        }
+
+        #if DEBUG
+        /// Simulator test hook: FRAME_TEST_JS runs in the page once it has loaded.
+        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
+            guard let js = ProcessInfo.processInfo.environment["FRAME_TEST_JS"] else { return }
+            DispatchQueue.main.asyncAfter(deadline: .now() + 4) { webView.evaluateJavaScript(js) }
+        }
+        #endif
+
+        // MARK: navigation: the app's page stays here; other sites open in Safari
+
+        func webView(_ webView: WKWebView, decidePolicyFor action: WKNavigationAction,
+                     decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
+            guard let url = action.request.url else { return decisionHandler(.cancel) }
+            if url.host == "127.0.0.1" || url.scheme == "about" || url.scheme == "blob" || url.scheme == "data" {
+                return decisionHandler(.allow)
+            }
+            UIApplication.shared.open(url)
+            decisionHandler(.cancel)
+        }
+
+        func webView(_ webView: WKWebView, createWebViewWith configuration: WKWebViewConfiguration,
+                     for action: WKNavigationAction, windowFeatures: WKWindowFeatures) -> WKWebView? {
+            if let url = action.request.url { UIApplication.shared.open(url) }  // target="_blank" links
+            return nil
+        }
+
+        // MARK: alert() and confirm(), which the page uses before removing things
+
+        func webView(_ webView: WKWebView, runJavaScriptAlertPanelWithMessage message: String,
+                     initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping () -> Void) {
+            present(message, actions: [UIAlertAction(title: "OK", style: .default) { _ in completionHandler() }], fallback: completionHandler)
+        }
+
+        func webView(_ webView: WKWebView, runJavaScriptConfirmPanelWithMessage message: String,
+                     initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (Bool) -> Void) {
+            present(message, actions: [
+                UIAlertAction(title: "Cancel", style: .cancel) { _ in completionHandler(false) },
+                UIAlertAction(title: "OK", style: .default) { _ in completionHandler(true) },
+            ], fallback: { completionHandler(false) })
+        }
+
+        private func present(_ message: String, actions: [UIAlertAction], fallback: @escaping () -> Void) {
+            guard let root = web?.window?.rootViewController else { return fallback() }
+            let alert = UIAlertController(title: nil, message: message, preferredStyle: .alert)
+            actions.forEach(alert.addAction)
+            (root.presentedViewController ?? root).present(alert, animated: true)
+        }
+    }
+}

ios/FrameControlTests/FrameControlTests.swift

@@ -0,0 +1,56 @@
+import CryptoKit
+import XCTest
+@testable import Frame_Control
+
+final class InstallLinkTests: XCTestCase {
+    func testAcceptsManifestAndURLLinks() {
+        XCTAssertEqual(InstallLink("frame-control://install?manifest=https://example.com/app.json"),
+                       InstallLink("frame-control://install/?manifest=https://example.com/app.json"))
+        XCTAssertEqual(InstallLink("frame-control://install?url=https://example.com/a.apk")?.kind, .url)
+        XCTAssertEqual(InstallLink("FRAME-CONTROL://install?manifest=https://example.com/m.json")?.target, "https://example.com/m.json")
+    }
+
+    func testRejectsAnythingElse() {
+        for raw in ["frame-control://other?url=https://example.com/a.apk",
+                    "frame-control://install?url=ftp://example.com/a.apk",
+                    "frame-control://install?url=https://user:pw@example.com/a.apk",
+                    "frame-control://install?url=https://example.com/a&manifest=https://example.com/b",
+                    "frame-control://install?url=https://a.example/x&url=https://b.example/y",
+                    "frame-control://install?url=",
+                    "frame-control://install/deeper?url=https://example.com/a.apk",
+                    "https://example.com/?url=https://example.com/a.apk",
+                    "frame-control://install?url=https://example.com/" + String(repeating: "a", count: 2100)] {
+            XCTAssertNil(InstallLink(raw), raw)
+        }
+    }
+}
+
+final class HeadsetServerTests: XCTestCase {
+    func testReadsThePortTheServerPrints() {
+        XCTAssertEqual(HeadsetServer.port(in: "Frame Control on http://127.0.0.1:41234  (alias: frame; Ctrl-C to stop)\n"), 41234)
+        XCTAssertNil(HeadsetServer.port(in: "Traceback (most recent call last):"))
+        XCTAssertNil(HeadsetServer.port(in: "Frame Control on http://127.0.0.1:4"))  // more digits may follow
+        XCTAssertNil(HeadsetServer.port(in: "Frame Control on http://127.0.0.1:99999 "))
+    }
+
+    func testBundleIsInTheApp() throws {
+        let bundle = try HeadsetServer.Bundle.fromApp()
+        XCTAssertGreaterThan(bundle.data.count, 100_000)
+        XCTAssertEqual(bundle.version.count, 16)
+    }
+}
+
+final class KeyTests: XCTestCase {
+    func testAuthorizedKeysLine() {
+        let line = DeviceKey.authorizedKeysLine(Curve25519.Signing.PrivateKey(), comment: "frame-control@iPhone")
+        let parts = line.split(separator: " ")
+        XCTAssertEqual(parts.count, 3)
+        XCTAssertEqual(parts[0], "ssh-ed25519")
+        XCTAssertEqual(Data(base64Encoded: String(parts[1]))?.count, 51)  // string "ssh-ed25519" + 32-byte key
+        XCTAssertEqual(parts[2], "frame-control@iPhone")
+    }
+
+    func testShellQuote() {
+        XCTAssertEqual(shellQuote("it's"), "'it'\\''s'")
+    }
+}

ios/project.yml

@@ -0,0 +1,79 @@
+name: FrameControl
+options:
+  bundleIdPrefix: com.saphid
+  deploymentTarget:
+    iOS: "17.0"
+  createIntermediateGroups: true
+packages:
+  Citadel:
+    url: https://github.com/orlandos-nl/Citadel.git
+    exactVersion: 0.12.1
+settings:
+  base:
+    SWIFT_VERSION: "5.0"
+    MARKETING_VERSION: "0.1.0"
+    CURRENT_PROJECT_VERSION: "1"
+targets:
+  FrameControl:
+    type: application
+    platform: iOS
+    sources:
+      - path: FrameControl
+    dependencies:
+      - package: Citadel
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: com.saphid.framecontrol
+        PRODUCT_NAME: Frame Control
+        TARGETED_DEVICE_FAMILY: "1,2"
+        ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+        GENERATE_INFOPLIST_FILE: YES
+        INFOPLIST_FILE: FrameControl/Info.plist
+        ENABLE_USER_SCRIPT_SANDBOXING: NO
+    info:
+      path: FrameControl/Info.plist
+      properties:
+        CFBundleDisplayName: Frame Control
+        UILaunchScreen:
+          UIColorName: ""
+        UISupportedInterfaceOrientations: [UIInterfaceOrientationPortrait, UIInterfaceOrientationLandscapeLeft, UIInterfaceOrientationLandscapeRight]
+        UISupportedInterfaceOrientations~ipad: [UIInterfaceOrientationPortrait, UIInterfaceOrientationPortraitUpsideDown, UIInterfaceOrientationLandscapeLeft, UIInterfaceOrientationLandscapeRight]
+        UIUserInterfaceStyle: Dark
+        NSLocalNetworkUsageDescription: Frame Control finds your Steam Frame on your network and connects to it.
+        NSBonjourServices: [_steamos-devkit._tcp]
+        NSPhotoLibraryAddUsageDescription: Frame Control saves headset captures and screenshots to your photo library when you ask it to.
+        NSAppTransportSecurity:
+          NSAllowsLocalNetworking: true
+        LSApplicationQueriesSchemes: [ssh, sftp, steamlink, rdp]
+        CFBundleURLTypes:
+          - CFBundleURLName: com.saphid.framecontrol.install
+            CFBundleURLSchemes: [frame-control]
+    preBuildScripts:
+      - name: Pack the Frame bundle
+        # The server, headset helpers and catalogue, as the app copies them to the Frame.
+        script: |
+          mkdir -p "${DERIVED_FILE_DIR}"
+          python3 "${SRCROOT}/scripts/make_frame_bundle.py" "${DERIVED_FILE_DIR}/frame-bundle.tar.gz" > "${DERIVED_FILE_DIR}/frame-bundle.version"
+          mkdir -p "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}"
+          cp "${DERIVED_FILE_DIR}/frame-bundle.tar.gz" "${DERIVED_FILE_DIR}/frame-bundle.version" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/"
+        basedOnDependencyAnalysis: false
+  FrameControlTests:
+    type: bundle.unit-test
+    platform: iOS
+    sources:
+      - path: FrameControlTests
+    dependencies:
+      - target: FrameControl
+    settings:
+      base:
+        GENERATE_INFOPLIST_FILE: YES
+        TEST_HOST: "$(BUILT_PRODUCTS_DIR)/Frame Control.app/Frame Control"
+        BUNDLE_LOADER: "$(TEST_HOST)"
+schemes:
+  FrameControl:
+    build:
+      targets:
+        FrameControl: all
+        FrameControlTests: [test]
+    test:
+      targets: [FrameControlTests]

ios/scripts/icon-ios.svg

@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#1a9fff"/>
+      <stop offset="1" stop-color="#6f42c1"/>
+    </linearGradient>
+    <linearGradient id="visor" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#ffffff"/>
+      <stop offset="1" stop-color="#dfe8f5"/>
+    </linearGradient>
+    <clipPath id="tile"><rect x="100" y="100" width="824" height="824" rx="185"/></clipPath>
+    <mask id="nose">
+      <rect width="1024" height="1024" fill="#fff"/>
+      <ellipse cx="512" cy="690" rx="78" ry="96" fill="#000"/>
+    </mask>
+    <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="18" stdDeviation="22" flood-color="#0b1020" flood-opacity=".35"/>
+    </filter>
+  </defs>
+  <rect width="1024" height="1024" fill="url(#bg)"/>
+  <g transform="translate(512 512) scale(1.2427) translate(-512 -512)">
+  <g filter="url(#shadow)">
+    <rect x="222" y="350" width="580" height="320" rx="130" fill="url(#visor)" mask="url(#nose)"/>
+  </g>
+  <rect x="300" y="430" width="160" height="124" rx="50" fill="#13233a"/>
+  <rect x="564" y="430" width="160" height="124" rx="50" fill="#13233a"/>
+  <rect x="320" y="448" width="56" height="30" rx="15" fill="#66c0f4" opacity=".9"/>
+  <rect x="584" y="448" width="56" height="30" rx="15" fill="#66c0f4" opacity=".9"/>
+  </g>
+</svg>

ios/scripts/make_frame_bundle.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""Pack what Frame Control's server needs to run on the Frame itself (the files the
+desktop app ships, plus ui/local-bin) into one reproducible .tar.gz.
+
+The iPhone app copies it to ~/.cache/frame-control/<version> on the Frame and
+starts ui/server.py there. <version> is the SHA-256 of the archive, so a new
+build replaces an old one and an unchanged one isn't copied again.
+
+Usage: make_frame_bundle.py OUT.tar.gz   (prints the version)
+"""
+import gzip
+import hashlib
+import io
+import sys
+import tarfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+PATTERNS = ["ui/*.py", "ui/*.html", "ui/local-bin/*", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py",
+            "frame/devkit-utils/**/*", "apk-catalog/*.py", "apk-catalog/pins.json", "apk-catalog/site/apps.js"]
+
+
+def files():
+    found = set()
+    for pattern in PATTERNS:
+        for p in ROOT.glob(pattern):
+            if p.is_file() and "__pycache__" not in p.parts:
+                found.add(p)
+    return sorted(found)
+
+
+def build():
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode="w", format=tarfile.PAX_FORMAT) as tar:
+        for p in files():
+            info = tarfile.TarInfo(str(p.relative_to(ROOT)))
+            data = p.read_bytes()
+            info.size, info.mtime, info.uid, info.gid, info.uname, info.gname = len(data), 0, 0, 0, "", ""
+            info.mode = 0o755 if p.stat().st_mode & 0o111 else 0o644
+            tar.addfile(info, io.BytesIO(data))
+    out = io.BytesIO()
+    with gzip.GzipFile(fileobj=out, mode="wb", mtime=0) as gz:
+        gz.write(raw.getvalue())
+    return out.getvalue()
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        sys.exit(__doc__)
+    data = build()
+    Path(sys.argv[1]).write_bytes(data)
+    print(hashlib.sha256(data).hexdigest()[:16])

scripts/build-chromium-xr.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-# Linux-side (x64 host): cross-compile arm64 Chromium with the Linux OpenXR CLs
-# (8441736 + 8132979, bug 506004811) so WebXR immersive-vr works on the Frame.
-# Needs ~90 GB free, no sudo. Takes hours; run it detached on the build host:
-#   scp scripts/build-chromium-xr.sh buildhost:chromium-xr/build.sh
-#   ssh buildhost 'cd ~/chromium-xr && tmux new -d -s chromium-xr "./build.sh > build.log 2>&1"'
-# Progress: ~/chromium-xr/stage. Output: ~/chromium-xr/chromium-xr-arm64.tar.xz,
-# which scripts/chromium-xr.sh install copies to the Frame.
-# Re-running resumes: existing checkout and out/XR are reused.
-set -euo pipefail
-W=~/chromium-xr
-cd "$W"
-stage(){ echo "$(date -Is) $*" | tee -a "$W/stage"; }
-# Returns non-zero below 12 GB free; set -e turns that into an exit at top level.
-guard(){ avail=$(df --output=avail -BG "$W" | tail -n 1 | tr -dc 0-9); if [ "$avail" -lt 12 ]; then stage "ABORT: only ${avail}G free for $W"; return 3; fi; }
-[ -d depot_tools ] || git clone -q https://chromium.googlesource.com/chromium/tools/depot_tools.git
-export PATH="$W/depot_tools:$PATH" DEPOT_TOOLS_UPDATE=1 DEPOT_TOOLS_METRICS=0
-CL_REF=refs/changes/79/8132979/44
-if [ ! -f .gclient ]; then
-  cat > .gclient <<'G'
-solutions = [{ "name": "src", "url": "https://chromium.googlesource.com/chromium/src.git",
-  "managed": False, "custom_deps": {}, "custom_vars": { "checkout_nacl": False } }]
-target_os = ["linux"]
-target_cpu = ["arm64"]
-G
-fi
-# Keyed on a real commit, so an interrupted first fetch is retried on re-run.
-if ! git -C src rev-parse -q --verify HEAD >/dev/null 2>&1; then
-  stage "clone src at $CL_REF"
-  mkdir -p src
-  [ -d src/.git ] || git -C src init -q
-  git -C src remote get-url origin >/dev/null 2>&1 || git -C src remote add origin https://chromium.googlesource.com/chromium/src.git
-  git -C src fetch -q --depth=1 origin "$CL_REF"
-  git -C src checkout -q FETCH_HEAD
-fi
-guard
-stage "src at $(git -C src log -1 --format='%h %s')"
-stage "gclient sync"
-gclient sync --nohooks --no-history -D --shallow --revision "src@$(git -C src rev-parse HEAD)" -j 8
-guard
-stage "runhooks"
-gclient runhooks
-src/build/linux/sysroot_scripts/install-sysroot.py --arch=arm64
-guard
-cd src
-mkdir -p out/XR
-cat > out/XR/args.gn <<'A'
-target_os = "linux"
-target_cpu = "arm64"
-is_debug = false
-is_official_build = false
-is_component_build = false
-dcheck_always_on = false
-symbol_level = 0
-blink_symbol_level = 0
-v8_symbol_level = 0
-proprietary_codecs = true
-ffmpeg_branding = "Chrome"
-use_remoteexec = false
-use_siso = true
-treat_warnings_as_errors = false
-A
-stage "gn gen"
-gn gen out/XR
-gn args out/XR --list=enable_openxr --short | tee -a "$W/stage"
-stage "build"
-( while sleep 600; do guard || { pkill -u "$(id -u)" -f "siso|ninja"; exit 3; }; done ) &
-GUARD=$!
-trap 'kill $GUARD 2>/dev/null || true' EXIT
-autoninja -C out/XR chrome chrome_sandbox chrome_crashpad_handler
-stage "package"
-cd out/XR
-files=(chrome chrome_sandbox chrome_crashpad_handler *.pak *.bin icudtl.dat locales)
-# GPU libraries aren't produced by every config; pack the ones that exist.
-for f in libEGL.so libGLESv2.so libvk_swiftshader.so libvulkan.so.1 vk_swiftshader_icd.json; do
-  [ -e "$f" ] && files+=("$f")
-done
-tar -cJf "$W/chromium-xr-arm64.tar.xz" "${files[@]}"
-stage "DONE $(ls -la $W/chromium-xr-arm64.tar.xz)"

scripts/chromium-xr.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env zsh
-# Mac-side: install and launch the WebXR-enabled Chromium build on the Frame.
-#
-# Flathub Chromium can't enter immersive WebXR on Linux: upstream only wires
-# the OpenXR device on Windows (see docs/webxr-chromium.md). This deploys an
-# arm64 build with the Linux OpenXR CLs, made on a Linux host by
-# scripts/build-chromium-xr.sh, into ~/chromium-xr on the Frame (not a
-# Flatpak, so SteamVR's sockets and the XR sandbox work unmodified).
-#
-# Usage:
-#   scripts/chromium-xr.sh install [TARBALL]  # default: scp from $BUILD_HOST
-#   scripts/chromium-xr.sh launch [URL]       # opens in the headset desktop
-#   scripts/chromium-xr.sh check              # isSessionSupported via DevTools
-set -euo pipefail
-
-FRAME_ALIAS=${FRAME_ALIAS:-frame}
-BUILD_HOST=${BUILD_HOST:-}
-BUILD_TARBALL=${BUILD_TARBALL:-chromium-xr/chromium-xr-arm64.tar.xz}
-DEVTOOLS_PORT=${DEVTOOLS_PORT:-9223}
-here=${0:A:h}
-
-case "${1:-}" in
-  install)
-    tarball=${2:-}
-    if [[ -z "$tarball" ]]; then
-      [[ -n "$BUILD_HOST" ]] || { print -u2 "Pass a tarball, or set BUILD_HOST to the build machine"; exit 2; }
-      tmp=$(mktemp -d)
-      trap 'rm -rf "$tmp"' EXIT
-      tarball=$tmp/chromium-xr-arm64.tar.xz
-      scp -q "$BUILD_HOST:$BUILD_TARBALL" "$tarball"
-    fi
-    ssh "$FRAME_ALIAS" 'rm -rf ~/chromium-xr.new && mkdir -p ~/chromium-xr.new'
-    ssh "$FRAME_ALIAS" 'tar -xJf - -C ~/chromium-xr.new' < "$tarball"
-    # Check the new build runs before replacing the old one.
-    ssh "$FRAME_ALIAS" '~/chromium-xr.new/chrome --version && rm -rf ~/chromium-xr && mv ~/chromium-xr.new ~/chromium-xr'
-    ;;
-  launch)
-    # run-on-frame starts in $HOME on the Frame, so the profile path is relative.
-    exec "$here/run-on-frame.sh" -- '~/chromium-xr/chrome' \
-      --user-data-dir=.config/chromium-xr \
-      --enable-features=OpenXR \
-      --remote-debugging-port="$DEVTOOLS_PORT" \
-      "${2:-https://immersive-web.github.io/webxr-samples/}"
-    ;;
-  check)
-    # DevTools listens on the Frame's loopback only; evaluate there.
-    ssh "$FRAME_ALIAS" python3 - "$DEVTOOLS_PORT" <<'EOF'
-import json, sys, urllib.request, base64, os, socket, struct
-port = int(sys.argv[1])
-tabs = json.load(urllib.request.urlopen(f"http://127.0.0.1:{port}/json", timeout=10))
-page = next((t for t in tabs if t["type"] == "page"), None)
-if page is None:
-    sys.exit("no open page: run 'chromium-xr.sh launch' first")
-path = page["webSocketDebuggerUrl"].split(f":{port}", 1)[1]
-s = socket.create_connection(("127.0.0.1", port), timeout=30)
-key = base64.b64encode(os.urandom(16)).decode()
-s.sendall(f"GET {path} HTTP/1.1\r\nHost: 127.0.0.1\r\nUpgrade: websocket\r\n"
-       f"Connection: Upgrade\r\nSec-WebSocket-Key: {key}\r\n"
-       "Sec-WebSocket-Version: 13\r\n\r\n".encode())
-s.recv(4096)
-msg = json.dumps({"id": 1, "method": "Runtime.evaluate", "params": {
-    "expression": "navigator.xr ? navigator.xr.isSessionSupported('immersive-vr') : 'no navigator.xr'",
-    "awaitPromise": True}}).encode()
-mask = os.urandom(4)
-hdr = bytes([0x81]) + (bytes([0x80 | len(msg)]) if len(msg) < 126
-                       else bytes([0x80 | 126]) + struct.pack(">H", len(msg)))
-s.sendall(hdr + mask + bytes(b ^ mask[i % 4] for i, b in enumerate(msg)))
-buf = b""
-reply = None
-while reply is None:
-    chunk = s.recv(65536)
-    if not chunk:
-        sys.exit("DevTools closed the connection")
-    buf += chunk
-    # Consume every complete frame already buffered before reading again.
-    while len(buf) >= 2:
-        n = buf[1] & 0x7F
-        off = 2
-        if n == 126:
-            if len(buf) < 4:
-                break
-            n, off = struct.unpack(">H", buf[2:4])[0], 4
-        elif n == 127:
-            if len(buf) < 10:
-                break
-            n, off = struct.unpack(">Q", buf[2:10])[0], 10
-        if len(buf) < off + n:
-            break
-        frame, buf = buf[off:off + n], buf[off + n:]
-        msg = json.loads(frame)
-        if msg.get("id") == 1:
-            reply = msg
-            break
-print("immersive-vr supported:", reply["result"]["result"].get("value"))
-EOF
-    ;;
-  *) sed -n '2,13p' "$0"; exit 2 ;;
-esac

scripts/connect.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env zsh
-# Mac-side: find the Steam Frame, create a key, add a `Host frame` alias to
-# ~/.ssh/config, copy the key, and optionally disable SSH password logins.
+# Mac-side: find the Steam Frame, create keys, add a `Host frame` alias to
+# ~/.ssh/config, get a key onto the headset, and optionally disable SSH password
+# logins. It first pairs through Valve's SteamOS devkit service (port 32000:
+# approve on the headset, no password), else copies the key with the password.
 #
-# Verified on a Frame 2026-09-25 (except --harden). Idempotent: safe to re-run.
+# Verified on a Frame 2026-09-25 (except --harden and devkit pairing). Idempotent.
 #
 # Usage:
 #   scripts/connect.sh [HOST_OR_IP]          # set up key + alias
@@ -11,93 +13,232 @@
 # Env: FRAME_USER (default steamos), FRAME_ALIAS (default frame).
 set -euo pipefail
 
+user_from_env=${+FRAME_USER}
 FRAME_USER=${FRAME_USER:-steamos}
 FRAME_ALIAS=${FRAME_ALIAS:-frame}
 KEY="$HOME/.ssh/id_ed25519_frame"
+# The devkit service only accepts ssh-rsa keys, so pairing uses a second key.
+DEVKIT_KEY="$HOME/.ssh/id_rsa_frame_devkit"
 CONFIG="$HOME/.ssh/config"
 BEGIN_MARK="# >>> steam-frame ($FRAME_ALIAS) >>>"
 END_MARK="# <<< steam-frame ($FRAME_ALIAS) <<<"
+DEVKIT_PORT=32000
+DEVKIT_SERVICE=_steamos-devkit._tcp
+MAGIC_PHRASE=900b919520e4cf601998a71eec318fec  # fixed token Valve's client appends
+NAME_RE='^[A-Za-z0-9][A-Za-z0-9._-]*$'
+HOST_RE='^[A-Za-z0-9][A-Za-z0-9.:%-]*$'
 
 harden=0
 host_arg=""
 for arg in "$@"; do
   case "$arg" in
     --harden) harden=1 ;;
-    -h|--help) sed -n '2,11p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,13p' "$0"; exit 0 ;;
     *) host_arg="$arg" ;;
   esac
 done
 
 port_open() {
   # nc resolves through the system resolver (including mDNS for .local).
-  nc -z -G 3 "$1" 22 >/dev/null 2>&1
+  nc -z -G 3 "$1" "$2" >/dev/null 2>&1
+}
+
+# sshd, or the devkit service, which turns sshd on once a pairing is approved.
+reachable() {
+  port_open "$1" 22 || port_open "$1" $DEVKIT_PORT
+}
+
+# What a command printed within $1 seconds; dns-sd never exits by itself.
+run_for() {
+  local secs=$1; shift
+  "$@" 2>/dev/null &
+  local pid=$!
+  sleep "$secs"
+  kill $pid 2>/dev/null || true
+  wait $pid 2>/dev/null || true
+}
+
+# Hosts advertising the devkit service over mDNS (dns-sd -B, then -L each).
+discover_devkit() {
+  local name target
+  run_for 3 dns-sd -B $DEVKIT_SERVICE local. \
+    | sed -n "s/.* Add .*${DEVKIT_SERVICE//./\\.}\\.[[:space:]]*//p" | awk '!seen[$0]++' | head -n 4 \
+    | while IFS= read -r name; do
+        target=$(run_for 2 dns-sd -L "$name" $DEVKIT_SERVICE local. \
+          | sed -n 's/.* can be reached at \([^ :]*\):[0-9].*/\1/p' | head -n 1)
+        [[ -n "$target" ]] && print -r -- "${target%.}"
+      done | awk '!seen[$0]++'
 }
 
 pick_host() {
   local candidates=()
   [[ -n "$host_arg" ]] && candidates+=("$host_arg")
-  candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
+  [[ -z "$host_arg" ]] && candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
   local h
   for h in "${candidates[@]}"; do
-    if port_open "$h"; then
+    if reachable "$h"; then
       print -r -- "$h"; return 0
     fi
-    print -u2 "  - $h: not resolvable or port 22 closed"
+    print -u2 "  - $h: not resolvable, or ports 22 and $DEVKIT_PORT closed"
+  done
+  [[ -n "$host_arg" ]] && return 1
+  print -u2 "  - asking mDNS for $DEVKIT_SERVICE"
+  for h in ${(f)"$(discover_devkit)"}; do
+    if [[ "$h" =~ $HOST_RE ]] && reachable "$h"; then
+      print -r -- "$h"; return 0
+    fi
+    print -u2 "  - $h: advertised, but not reachable"
   done
   return 1
 }
 
+make_key() {  # path type comment [extra ssh-keygen args]
+  if [[ ! -f "$1" ]]; then
+    ssh-keygen -q -t "$2" "${@:4}" -N '' -C "$3" -f "$1"
+    print "    created $1"
+  else
+    print "    exists: $1"
+  fi
+}
+
+# Checks each step itself: pair_with_devkit calls this from an `elif`, where set -e is off.
+write_config() {
+  touch "$CONFIG" && chmod 600 "$CONFIG" || return 1
+  local tmp
+  tmp=$(mktemp) || return 1
+  # Drop any previous managed block, then PREPEND a fresh one: ssh uses the first
+  # value it sees per option, so this block must precede any other "Host frame"
+  # or "Host *". The trailing "Host *" returns the rest of the file to global scope.
+  awk -v b="$BEGIN_MARK" -v e="$END_MARK" '
+    $0==b {skip=1; next}
+    $0==e {skip=0; next}
+    !skip {print}
+  ' "$CONFIG" > "$tmp" || { rm -f "$tmp"; return 1; }
+  {
+    print -r -- "$BEGIN_MARK"
+    print -r -- "Host $FRAME_ALIAS"
+    print -r -- "  HostName $HOST"
+    print -r -- "  User $FRAME_USER"
+    print -r -- "  IdentityFile $KEY"
+    print -r -- "  IdentityFile $DEVKIT_KEY"
+    print -r -- "  IdentitiesOnly yes"
+    print -r -- "  ServerAliveInterval 30"
+    print -r -- "Host *"
+    print -r -- "$END_MARK"
+    cat "$tmp"
+  } > "$CONFIG" || { print -u2 "!! Writing $CONFIG failed; its previous contents are in $tmp"; return 1; }
+  rm -f "$tmp"
+}
+
+# accept-new: after pairing, this is the first contact, so trust a first-seen host
+# key (as ssh-copy-id's prompt would); a changed one still fails.
+key_login_works() {
+  ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new "$FRAME_ALIAS" true 2>/dev/null
+}
+
+# The User in our managed block, so a re-run keeps one the headset named earlier.
+configured_user() {
+  [[ -f "$CONFIG" ]] || return 0
+  awk -v b="$BEGIN_MARK" -v e="$END_MARK" '
+    $0==b {inside=1; next}
+    $0==e {exit}
+    inside && $1=="User" {print $2; exit}
+  ' "$CONFIG"
+}
+
+devkit_url() {
+  if [[ "$HOST" == *:* ]]; then print -r -- "http://[$HOST]:$DEVKIT_PORT$1"
+  else print -r -- "http://$HOST:$DEVKIT_PORT$1"; fi
+}
+
+# Valve's steamos-devkit-service: GET /properties.json names the login user; POST
+# /register with "ssh-rsa <key> <comment> <magic>" shows an approve prompt in the
+# headset (the comment is what it displays, 30 s to answer), then installs the key
+# and turns sshd on. Returns non-zero with the reason in $devkit_why to fall back.
+devkit_why=""
+pair_with_devkit() {
+  local props login comment body resp code text err
+  print "==> Pairing through the headset's SteamOS devkit service (no password)"
+  if [[ ! -r "$DEVKIT_KEY.pub" ]]; then
+    devkit_why="can't read the pairing key $DEVKIT_KEY.pub"; return 1
+  fi
+  if ! props=$(curl -fsS --noproxy '*' -m 5 "$(devkit_url /properties.json)" 2>&1); then
+    devkit_why="devkit service not reachable on port $DEVKIT_PORT: ${${props##*curl: }%%$'\n'*}"; return 1
+  fi
+  # properties.json is Valve's json.dumps(indent=2): "login" sits on its own line.
+  login=$(print -r -- "$props" | sed -n 's/.*"login"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
+  [[ "$login" =~ $NAME_RE && "$login" != root ]] || login=""
+  # Before the prompt, so the password fallback uses this user too.
+  if [[ -n "$login" && "$login" != "$FRAME_USER" ]]; then
+    if (( user_from_env )); then
+      print "    the headset logs in as '$login'; keeping FRAME_USER=$FRAME_USER"
+    else
+      FRAME_USER=$login
+      print "    the headset logs in as '$FRAME_USER'"
+      write_config || { print -u2 "Could not rewrite $CONFIG."; exit 1; }
+    fi
+  fi
+  # One word: the headset splits the body on spaces and shows the third field.
+  comment="frame-control@$(hostname -s | tr -cs 'A-Za-z0-9._-' '-' | sed 's/^[-.]*//; s/[-.]*$//')"
+  [[ "$comment" == "frame-control@" ]] && comment="frame-control@computer"
+  body="ssh-rsa $(awk '{print $2}' "$DEVKIT_KEY.pub") $comment $MAGIC_PHRASE"
+  print "    In the headset: Steam Settings > Developer > Pair new host, then approve the request"
+  # The headset refuses at once unless Steam is on its "Pair new host" screen
+  # (verified on a Frame, 2026-09-26), so keep asking for 2 minutes while it's opened.
+  local deadline=$(( SECONDS + 120 ))
+  while true; do
+    if ! resp=$(print -r -- "$body" | curl -sS --noproxy '*' -m 60 -H 'Content-Type: text/plain' \
+        --data-binary @- -w '\n%{http_code}' "$(devkit_url /register)" 2>&1); then
+      devkit_why="devkit pairing failed: no answer (${${resp##*curl: }%%$'\n'*})"; return 1
+    fi
+    code=${resp##*$'\n'}
+    text=${resp%$'\n'*}
+    [[ "$code" == 2* ]] && break
+    err=$(print -r -- "$text" | sed -n 's/.*"error"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
+    devkit_why="devkit pairing failed: ${err:-${text:-HTTP $code}}"
+    [[ "$devkit_why" == *"pairing mode"* ]] && (( SECONDS < deadline )) || return 1
+    sleep 3
+  done
+  # The approval is what turns sshd on, so it may take a moment to answer.
+  local i
+  for i in {1..10}; do
+    key_login_works && return 0
+    sleep 1
+  done
+  devkit_why="paired, but key login still fails"; return 1
+}
+
 print "==> Looking for the Steam Frame"
 if ! HOST=$(pick_host); then
-  print -u2 "Could not reach the Frame on port 22."
+  print -u2 "Could not reach the Frame on port 22 or $DEVKIT_PORT."
   print -u2 "Check: Developer Mode on + user password set; same Wi-Fi; no client isolation."
   print -u2 "Then re-run with the IP from Quick Settings: scripts/connect.sh 192.168.x.y"
   exit 1
 fi
 print "    found: $HOST"
 
-print "==> SSH key"
+print "==> SSH keys"
 mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
-if [[ ! -f "$KEY" ]]; then
-  ssh-keygen -q -t ed25519 -N '' -C "mac->steam-frame" -f "$KEY"
-  print "    created $KEY"
-else
-  print "    exists: $KEY"
-fi
+make_key "$KEY" ed25519 "mac->steam-frame"
+make_key "$DEVKIT_KEY" rsa "frame-control@$(hostname -s | tr -cs 'A-Za-z0-9._-' '-' | sed 's/^[-.]*//; s/[-.]*$//')" -b 3072
 
+if (( ! user_from_env )); then
+  prev_user=$(configured_user)
+  if [[ "$prev_user" =~ $NAME_RE ]]; then FRAME_USER=$prev_user; fi
+fi
 print "==> ~/.ssh/config alias '$FRAME_ALIAS' -> $HOST"
-touch "$CONFIG" && chmod 600 "$CONFIG"
-tmp=$(mktemp)
-# Drop any previous managed block, then PREPEND a fresh one: ssh uses the first
-# value it sees per option, so this block must precede any other "Host frame"
-# or "Host *". The trailing "Host *" returns the rest of the file to global scope.
-awk -v b="$BEGIN_MARK" -v e="$END_MARK" '
-  $0==b {skip=1; next}
-  $0==e {skip=0; next}
-  !skip {print}
-' "$CONFIG" > "$tmp"
-{
-  print -r -- "$BEGIN_MARK"
-  print -r -- "Host $FRAME_ALIAS"
-  print -r -- "  HostName $HOST"
-  print -r -- "  User $FRAME_USER"
-  print -r -- "  IdentityFile $KEY"
-  print -r -- "  IdentitiesOnly yes"
-  print -r -- "  ServerAliveInterval 30"
-  print -r -- "Host *"
-  print -r -- "$END_MARK"
-  cat "$tmp"
-} > "$CONFIG"
-rm -f "$tmp"
+write_config
 
 print "==> Checking key login"
-if ssh -o BatchMode=yes -o ConnectTimeout=5 "$FRAME_ALIAS" true 2>/dev/null; then
+if key_login_works; then
   print "    key login already works"
+elif pair_with_devkit; then
+  print "    paired; key login OK"
 else
+  print "    $devkit_why; falling back to the password"
   print "    copying key (enter the Developer Mode password once)"
   ssh-copy-id -i "$KEY.pub" -o IdentitiesOnly=yes "$FRAME_USER@$HOST"
-  ssh -o BatchMode=yes -o ConnectTimeout=5 "$FRAME_ALIAS" true \
-    || { print -u2 "Key login still failing after ssh-copy-id."; exit 1; }
+  key_login_works || { print -u2 "Key login still failing after ssh-copy-id."; exit 1; }
   print "    key login OK"
 fi
 

scripts/e2e.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env zsh
+# Linux host with Docker: run the end-to-end tests against the fake Frame.
+# Builds the fake Frame and host images (tests/fakeframe), starts them with
+# docker compose, runs tests/e2e in the host container, prints the results
+# and takes everything down again. Exits with the tests' status (2 if the
+# harness itself didn't come up). See docs/testing.md.
+#
+# Usage: scripts/e2e.sh [TEST...]     e.g. scripts/e2e.sh test_titles test_faults.Faults.test_disk_full
+# Env:   FAKEFRAME_BASE   base image (default: archlinux:base, or Valve's Holo Core aarch64 on arm64)
+#        FAKEFRAME_KEEP=1 leave the containers running afterwards
+set -uo pipefail
+
+root=${0:A:h:h}
+cd "$root" || exit 2
+case $(uname -m) in
+  x86_64|amd64) base=archlinux:base ;;
+  aarch64|arm64) base=registry.gitlab.steamos.cloud/holo/holo-core-aarch64-preview/base-devel:latest ;;
+  *) print -u2 "No Arch Linux base image known for $(uname -m); set FAKEFRAME_BASE"; exit 2 ;;
+esac
+base=${FAKEFRAME_BASE:-$base}
+compose=(docker compose -p fakeframe-e2e -f tests/fakeframe/compose.yaml)
+started=$SECONDS
+
+print "==> Building fakeframe-frame (from $base) and fakeframe-host"
+# Quiet when it works; if a build fails, build again with the full log so CI shows why.
+build() { docker build -q "$@" >/dev/null || { docker build --progress=plain "$@"; exit 2 } }
+build --build-arg BASE="$base" -t fakeframe-frame -f tests/fakeframe/Containerfile tests/fakeframe
+build -t fakeframe-host -f tests/fakeframe/host.Containerfile tests/fakeframe
+
+logs() {
+  print "\n==> Fake Frame logs"
+  $compose logs --no-color --tail 80 fakeframe
+  $compose exec -T fakeframe sh -c 'for f in /var/log/fakeframe/*.log; do echo "--- $f"; tail -n 40 "$f"; done' 2>/dev/null
+  print "\n==> ui/server.py log"
+  $compose exec -T host sh -c 'tail -n 80 /tmp/fakeframe-e2e-server.log' 2>/dev/null
+}
+
+finish() {
+  if [[ ${FAKEFRAME_KEEP:-0} == 1 ]]; then
+    print "==> Left running: ${(j: :)compose} exec host bash"
+  else
+    $compose down -v --remove-orphans >/dev/null 2>&1
+  fi
+}
+trap finish EXIT
+
+$compose down -v --remove-orphans >/dev/null 2>&1
+print "==> Starting the fake Frame and the host"
+if ! $compose up -d --wait; then
+  logs
+  exit 2
+fi
+print "==> Up after $(( SECONDS - started )) s; running tests/e2e"
+
+if (( $# )); then
+  args=(-v "$@")
+else
+  args=(discover -v -s .)
+fi
+tests_started=$SECONDS
+$compose exec -T -w /repo/tests/e2e host python3 -m unittest "${args[@]}"
+rc=$?
+(( rc == 0 )) || logs
+print "\n==> tests/e2e: $([[ $rc == 0 ]] && echo passed || echo "FAILED (exit $rc)") in $(( SECONDS - tests_started )) s" \
+      "($(( SECONDS - started )) s with builds)"
+exit $rc

scripts/frame-smoke.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env zsh
+# Mac or Linux: the headset smoke test. Installs, launches and removes tiny
+# test titles on the Frame (the `frame` alias) and records the results with
+# its BUILD_ID under tests/smoke/results/. See docs/testing.md.
+#
+# Usage: scripts/frame-smoke.sh [--pair]   (--pair needs you in the headset to approve)
+set -euo pipefail
+exec python3 "${0:A:h:h}/tests/smoke/frame_smoke.py" "$@"

scripts/install-apps.sh

@@ -59,9 +59,13 @@ colordepth=32
 quality=9
 viewonly=0
 showcursor=1
+scale=1
+viewmode=1
+window_maximize=1
 EOF
     echo \"wrote \$d/mac-screen-sharing.remmina\"
   "
   print "On the Mac: System Settings > General > Sharing > Screen Sharing (i) >"
   print "  enable 'VNC viewers may control screen with password' and set one."
+  print "Remmina may ask for your Mac account name + login password instead (Apple auth)."
 fi

scripts/mac-cursor-ring.lua

@@ -0,0 +1,40 @@
+-- Hammerspoon: draw a ring around the Mac pointer so it shows in the VNC
+-- mirror on the Frame. macOS Screen Sharing leaves the pointer out of the
+-- framebuffer; a real on-screen window is captured like anything else.
+--
+-- Install: brew install --cask hammerspoon, then in ~/.hammerspoon/init.lua:
+--   dofile("/path/to/frame-control/scripts/mac-cursor-ring.lua")
+-- Toggle: ctrl+alt+cmd+M. Polls the pointer position, so no Accessibility
+-- permission is needed.
+
+local SIZE, WIDTH = 34, 3
+local COLOR = { red = 1, green = 0.2, blue = 0.2, alpha = 0.9 }
+
+local ring = hs.canvas.new({ x = 0, y = 0, w = SIZE, h = SIZE })
+ring:appendElements({
+  type = "circle", action = "stroke",
+  strokeColor = COLOR, strokeWidth = WIDTH,
+  radius = (SIZE - WIDTH) / 2,
+})
+ring:level(hs.canvas.windowLevels.cursor)
+ring:behavior({ "canJoinAllSpaces", "stationary", "ignoresCycle" })
+
+local last = {}
+local function follow()
+  local p = hs.mouse.absolutePosition()
+  if p.x ~= last.x or p.y ~= last.y then
+    ring:topLeft({ x = p.x - SIZE / 2, y = p.y - SIZE / 2 })
+    last = p
+  end
+end
+
+frameCursorRing = { canvas = ring, timer = hs.timer.new(1 / 60, follow) }
+
+local function show() follow(); ring:show(); frameCursorRing.timer:start() end
+local function hide() frameCursorRing.timer:stop(); ring:hide() end
+
+hs.hotkey.bind({ "ctrl", "alt", "cmd" }, "M", function()
+  if ring:isShowing() then hide() else show() end
+end)
+
+show()

site/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+.wrangler/
+.dev.vars

site/README.md

@@ -0,0 +1,35 @@
+# Website
+
+The Frame Control website, <https://frame-control.pages.dev>, on Cloudflare Pages.
+
+- `public/`: static pages. `/` is the landing page, `/feedback/` the feedback form, `/privacy/` the privacy note.
+- `functions/api/feedback.js`: `POST /api/feedback`, which turns the form into a GitHub issue labelled `feedback`.
+- `lib/feedback.js`: validation and issue formatting, tested by `test/feedback.test.mjs`.
+- `public/js/site.js`: settings, including the Ko-fi page name for the donate buttons.
+
+## Feedback → GitHub issues
+
+The function needs a `GITHUB_TOKEN` secret: a fine-grained token with **Issues: read and write** on
+`saphid/frame-control` only. Issues are opened as the token's owner, so they pass the contributor gate
+(`.github/workflows/issue-gate.yml`) and stay open. Without the token the form answers 503 and offers a
+prefilled GitHub issue instead.
+
+```sh
+cd site
+npx wrangler pages secret put GITHUB_TOKEN --project-name frame-control
+```
+
+Spam protection: a hidden honeypot field, a 3-second minimum fill time, 5 submissions per hour per IP
+(a salted hash, kept in the `FEEDBACK_RL` KV namespace for about an hour), and 100 a day in total.
+User text has `@mentions` and `#123` references broken so nobody gets pinged.
+
+## Run and deploy
+
+```sh
+cd site
+node --test test/*.test.mjs
+npx wrangler pages dev --port 8788           # local; put GITHUB_TOKEN/GITHUB_REPO in .dev.vars to test issues
+npx wrangler pages deploy --branch main      # production
+```
+
+Point `GITHUB_REPO` in `.dev.vars` at a scratch repo when testing locally so test issues don't land on the real tracker.

site/functions/api/feedback.js

@@ -0,0 +1,86 @@
+// POST /api/feedback: turns the website's feedback form into a GitHub issue.
+//
+// Environment (Cloudflare Pages → Settings → Variables and Secrets):
+//   GITHUB_TOKEN  secret. Fine-grained token with Issues: read and write on GITHUB_REPO only.
+//   GITHUB_REPO   owner/name, e.g. saphid/frame-control (wrangler.toml sets it).
+//   FEEDBACK_RL   KV namespace binding for rate limits (optional; without it there is no limit).
+
+import { buildIssue, hashIp, validate } from "../../lib/feedback.js";
+
+const PER_IP_PER_HOUR = 5;
+const TOTAL_PER_DAY = 100;
+
+const json = (status, data) =>
+  new Response(JSON.stringify(data), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" },
+  });
+
+async function overLimit(kv, key, limit, ttl) {
+  const count = Number(await kv.get(key)) || 0;
+  if (count >= limit) return true;
+  await kv.put(key, String(count + 1), { expirationTtl: ttl });
+  return false;
+}
+
+export async function onRequestPost({ request, env }) {
+  if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) {
+    return json(503, { error: "Feedback isn't connected to GitHub yet. Use the GitHub link instead." });
+  }
+
+  const origin = request.headers.get("origin");
+  if (origin && new URL(origin).host !== new URL(request.url).host) {
+    return json(403, { error: "Send feedback from the website's form." });
+  }
+
+  let input;
+  try {
+    input = await request.json();
+  } catch {
+    return json(400, { error: "Send the form as JSON." });
+  }
+
+  const checked = validate(input);
+  // Bots get a success-shaped answer so they don't learn what tripped them.
+  if (checked.spam) return json(200, { ok: true });
+  if (checked.error) return json(400, { error: checked.error });
+
+  // Best effort: KV is eventually consistent, so bursts can slip past, and a
+  // storage error lets the feedback through rather than losing it.
+  if (env.FEEDBACK_RL) try {
+    const ip = request.headers.get("cf-connecting-ip") || "unknown";
+    const hour = Math.floor(Date.now() / 3600e3);
+    const day = Math.floor(Date.now() / 86400e3);
+    // Salted with the secret token, so the stored hashes can't be reversed by trying every IP.
+    const who = await hashIp(ip, env.GITHUB_TOKEN);
+    if (await overLimit(env.FEEDBACK_RL, `ip:${who}:${hour}`, PER_IP_PER_HOUR, 3900)) {
+      return json(429, { error: "That's a lot of feedback in one hour. Try again later, or use GitHub." });
+    }
+    if (await overLimit(env.FEEDBACK_RL, `day:${day}`, TOTAL_PER_DAY, 90000)) {
+      return json(429, { error: "The form has had a busy day. Try again tomorrow, or use GitHub." });
+    }
+  } catch (err) {
+    console.log(`Rate limit check failed: ${err}`);
+  }
+
+  const res = await fetch(`https://api.github.com/repos/${env.GITHUB_REPO}/issues`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${env.GITHUB_TOKEN}`,
+      accept: "application/vnd.github+json",
+      "x-github-api-version": "2022-11-28",
+      "user-agent": "frame-control-website",
+      "content-type": "application/json",
+    },
+    body: JSON.stringify(buildIssue(checked.value)),
+  });
+
+  if (!res.ok) {
+    console.log(`GitHub answered ${res.status}: ${(await res.text()).slice(0, 500)}`);
+    return json(502, { error: "GitHub didn't accept it just now. Try again, or use the GitHub link." });
+  }
+  const issue = await res.json();
+  return json(201, { ok: true, number: issue.number, url: issue.html_url });
+}
+
+export const onRequest = () => json(405, { error: "POST only." });

site/lib/feedback.js

@@ -0,0 +1,102 @@
+// Feedback form → GitHub issue. Pure functions, so tests can run them without
+// Cloudflare or GitHub (site/test/feedback.test.mjs).
+
+export const KINDS = {
+  bug: { label: "bug", title: "Bug report" },
+  idea: { label: "enhancement", title: "Idea" },
+  question: { label: "question", title: "Question" },
+  other: { label: null, title: "Other feedback" },
+};
+
+export const LIMITS = { title: [5, 120], message: [10, 5000], field: 120 };
+
+// Anyone who fills the form in under this many milliseconds is a script.
+export const MIN_FILL_MS = 3000;
+
+const GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+
+const oneLine = (value, max) => String(value ?? "").replace(/\s+/g, " ").trim().slice(0, max);
+
+// Mentions in someone else's text would ping strangers, and issue references
+// (#1, owner/repo#1, GH-1, github.com links) would add backlinks to other
+// people's issues, so break them all with a zero-width space. Escaping & first
+// stops @ and # from turning back into @ and # when GitHub renders,
+// escaping < keeps out raw HTML such as an unclosed <!-- comment, and doubling
+// backslashes stops GH\-1 or github\.com from being unescaped back into references.
+const ZWSP = "\u200b";
+export function defang(text) {
+  return text
+    .replace(/\\/g, "\\\\")
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/@(?=[A-Za-z0-9])/g, `@${ZWSP}`)
+    .replace(/#(?=\d)/g, `#${ZWSP}`)
+    .replace(/\b(GH)-(?=\d)/gi, `$1${ZWSP}-`)
+    .replace(/\b(github)\.com/gi, `$1${ZWSP}.com`);
+}
+
+// Returns { error } or { value } with every field trimmed and bounded.
+export function validate(input) {
+  if (!input || typeof input !== "object") return { error: "Send the form as JSON." };
+  if (oneLine(input.website, 200)) return { spam: true };
+  // Measured in the browser with a monotonic clock, so clock skew doesn't matter.
+  const elapsed = Number(input.elapsed);
+  if (!Number.isFinite(elapsed)) return { spam: true };
+  // The page waits this long before sending, so only scripts get here; say so anyway.
+  if (elapsed < MIN_FILL_MS) return { error: "That was quick. Send it again in a moment." };
+
+  const kind = Object.hasOwn(KINDS, input.kind) ? input.kind : "other";
+  const title = oneLine(input.title, LIMITS.title[1]);
+  const message = String(input.message ?? "").replace(/\r\n?/g, "\n").trim();
+  if (title.length < LIMITS.title[0]) return { error: "Give it a short title (at least 5 characters)." };
+  if (message.length < LIMITS.message[0]) return { error: "Tell us a little more (at least 10 characters)." };
+  if (message.length > LIMITS.message[1]) return { error: `Keep it under ${LIMITS.message[1]} characters.` };
+
+  const github = oneLine(input.github, 40).replace(/^@/, "");
+  if (github && !GITHUB_LOGIN.test(github)) return { error: "That doesn't look like a GitHub username." };
+
+  return {
+    value: {
+      kind,
+      title,
+      message,
+      github,
+      version: oneLine(input.version, LIMITS.field),
+      os: oneLine(input.os, LIMITS.field),
+      steamos: oneLine(input.steamos, LIMITS.field),
+    },
+  };
+}
+
+export function buildIssue(value) {
+  const kind = KINDS[value.kind];
+  const details = [
+    ["Frame Control version", value.version],
+    ["Computer", value.os],
+    ["SteamOS build", value.steamos],
+  ].filter(([, v]) => v);
+
+  // Our own lines go first, so nothing in the sender's text can hide them.
+  const lines = [
+    value.github
+      ? `> Sent from the website feedback form by @${value.github}.`
+      : "> Sent from the website feedback form. The sender left no GitHub username, so they won't see replies here.",
+    "",
+  ];
+  if (details.length) {
+    lines.push("| | |", "|---|---|", ...details.map(([k, v]) => `| ${k} | ${defang(v).replace(/\|/g, "\\|")} |`), "");
+  }
+  lines.push(defang(value.message));
+
+  return {
+    title: `${kind.title}: ${value.title}`,
+    body: lines.join("\n"),
+    labels: ["feedback", ...(kind.label ? [kind.label] : [])],
+  };
+}
+
+export async function hashIp(ip, salt) {
+  const bytes = new TextEncoder().encode(`${salt}:${ip}`);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].slice(0, 12).map((b) => b.toString(16).padStart(2, "0")).join("");
+}

site/package.json

@@ -0,0 +1 @@
+{ "type": "module", "private": true }

site/public/404.html

@@ -0,0 +1,60 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Not found · Frame Control</title>
+<meta name="description" content="Page not found.">
+<meta name="theme-color" content="#0e141b">
+<link rel="icon" href="/favicon.png">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<link rel="stylesheet" href="/css/site.css">
+<script src="/js/site.js" defer></script>
+</head>
+<body>
+
+<header class="top">
+  <div class="wrap">
+    <a class="brand" href="/"><img src="/img/icon.png" alt="">Frame Control</a>
+    <nav aria-label="Sections">
+      <a href="/#features">Features</a>
+      <a href="/#setup">Setup</a>
+      <a href="/#download">Download</a>
+      <a href="/#faq">FAQ</a>
+      <a href="/feedback/">Feedback</a>
+    </nav>
+    <div class="end">
+      <a class="btn small ghost" href="https://github.com/saphid/frame-control">
+        <svg viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>
+        GitHub
+      </a>
+      <a class="btn small coffee" data-kofi href="#" target="_blank" rel="noopener">Support</a>
+    </div>
+  </div>
+</header>
+
+<main class="page">
+  <div class="wrap" style="text-align:center;padding:80px 24px">
+    <span class="kicker">404</span>
+    <h1>That page isn't here</h1>
+    <p style="color:var(--muted);margin-top:14px">It may have moved. Try the home page, or tell us what you were looking for.</p>
+    <div class="cta"><a class="btn primary" href="/">Home</a><a class="btn ghost" href="/feedback/">Send feedback</a></div>
+  </div>
+</main>
+
+<footer>
+  <div class="wrap">
+    <a class="brand" href="/"><img src="/img/icon.png" alt="">Frame Control</a>
+    <div class="cols">
+      <a href="https://github.com/saphid/frame-control">GitHub</a>
+      <a href="https://github.com/saphid/frame-control/releases">Releases</a>
+      <a href="https://github.com/saphid/frame-control/blob/main/docs/frame-control.md">Docs</a>
+      <a href="/feedback/">Feedback</a>
+      <a href="https://github.com/saphid/frame-control/blob/main/CONTRIBUTING.md">Contributing</a>
+      <a href="/privacy/">Privacy</a>
+    </div>
+    <p class="legal">© <span data-year>2026</span> saphid · MIT licence. Unofficial and not affiliated with or endorsed by Valve. Steam, Steam Frame and SteamVR are trademarks of Valve Corporation.</p>
+  </div>
+</footer>
+</body>
+</html>

site/public/_headers

@@ -0,0 +1,15 @@
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  X-Frame-Options: DENY
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self'; connect-src 'self' https://api.github.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
+
+/css/*
+  Cache-Control: public, max-age=3600
+/js/*
+  Cache-Control: public, max-age=3600
+/img/*
+  Cache-Control: public, max-age=86400
+/media/*
+  Cache-Control: public, max-age=604800