Harden live-view read-only toggles and acknowledge mode changes

[ehfeng]

Make live-view input locking reliable without reconnecting the viewer. The client tells its parent whether it supports mode changes and acknowledges each applied change, allowing the dashboard to keep the iframe loaded and fall back to a reload for older images.

The viewer validates the sending parent window and origin, preserves read-only mode across connection resets, and restores the server's configured control behavior when unlocked. Locking releases held input and control, and blocks clipboard and keyboard modifier writes—including clipboard reads and paste shortcuts already in progress. Existing messages without a request ID remain supported.

Validation: 22 tests pass after a fresh dependency install, and the production client build succeeds. The viewer was live-tested on an isolated browser session: playback continued across lock/unlock, input was blocked while locked, held keys and buttons were released, unrelated-window messages were rejected, and iframe navigation/WebSocket counts stayed unchanged. Modifier resynchronization is covered by regression tests.

Issue: KERNEL-1948. Companion dashboard change: kernel#3998.

---

Note

Medium Risk
Changes remote input locking, clipboard forwarding, and cross-origin postMessage handling for embedded viewers; behavior is heavily tested but affects security-sensitive control paths.

Overview
Hardens embedded live-view read-only mode so parents can toggle input lock via postMessage without reloading the iframe, with explicit capability advertisement and per-request acknowledgement for the dashboard.

Read-only state moves from a local override in app.vue into the remote Vuex store (setReadOnly), which locks input, disables implicit hosting while preserving the server’s configured hosting on unlock, and keeps read-only across transport resets. Parent KERNEL_SET_READ_ONLY messages are validated through isReadOnlyMessage (exact parent window, non-opaque referrer origin, typed payload); valid toggles release remote control and releaseInput on the video layer, then reply with KERNEL_READ_ONLY_CHANGED. KERNEL_CONNECTED now includes capabilities: ['setReadOnly'].

The video layer treats read-only as locked input: guards clipboard sync/paste shortcuts during async work, tracks pressed mouse buttons for cleanup, and avoids caching keyboard modifier state while locked.

CI for the live-view client adds Node 22 + npm ci before Bun tests; a new README documents the embed contract. Unit tests cover message validation, store behavior, and input edge cases during lock transitions.

^{Reviewed by Cursor Bugbot for commit 587dadf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T17:22:45.383021Z	230ba44	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 230ba44. Configure here.}

[masnwilliams]

requesting two targeted changes: preserve modifier synchronization across read-only transitions, and make the live-view test workflow install the dependencies now imported by the test suite. the parent-message hardening, acknowledgement protocol, input release, and configured hosting restoration otherwise look sound.

non-blocking: the duplicated read-only/lock/hosting state and the growing input policy in video.vue would benefit from consolidation, and an integration test for message → release → state change → acknowledgement would strengthen this boundary.

[masnwilliams]

The latest commit addresses both requested changes: unlock now invalidates modifier state until the next valid synchronization point, with coverage for each lock key and the leave/reentry path; the live-view workflow now installs the pinned client dependencies before running Bun tests. I reran all 22 tests and the production build locally, and every current check including BugBot is green. No remaining blocking findings from me.