//! cce-remote — use a phone as a trackpad + keyboard for the cce desktop.
 //!
 //! One small server, no GUI: it serves the embedded `index.html` (a touch
 //! trackpad + keyboard page) over HTTP on the tailnet (see `reachable`), accepts a WebSocket at
 //! `/ws`, and translates the page's compact input events into the
 //! compositor's line-oriented control socket (`/tmp/cce-{WAYLAND_DISPLAY}.sock`
 //! — the same channel `ccectl` uses, so injection goes through the real
 //! compositor input path: `pointer-move-by`, `pointer-scroll`,
 //! `pointer-press/release/click`, `keypress`, `key-down`/`key-up`).
 //!
 //! Wire protocol (WS text frames, space-separated, one event per frame):
 //!   m <dx> <dy>          relative pointer move (logical px)
 //!   s <dy> <dx>          scroll (wayland axis units)
 //!   b <btn> <down|up|click>   btn = left|right|middle
 //!   k <keycode>          tap an evdev keycode
 //!   kd <keycode> / ku <keycode>   hold / release (modifiers)
 //!
 //! Security model: pairing PIN. A persistent 6-digit PIN (generated on first
 //! run, stored 0600 under ~/.config/cce/cce-remote.pin, printed at startup)
 //! must arrive as the FIRST WebSocket frame (`auth <pin>`) before any input
 //! event is accepted; anything else closes the connection. The page remembers
 //! the PIN in localStorage after the first pairing.
 
 use std::io::{Read, Write};
 use std::net::{TcpListener, TcpStream};
 use std::os::unix::net::UnixStream;
 use std::time::Duration;
 
 mod screencopy;
 mod stream;
 mod winstream;
 
 const INDEX_HTML: &str = include_str!("../index.html");
 
 /// Identity of the embedded page (FNV-1a). Sent to the page after auth so it
 /// can notice that a restarted server is serving a NEWER page than the one it
 /// is running, and reload itself — the page is baked into the binary, so
 /// every UI change otherwise needs a manual refresh on the phone.
 fn page_version() -> &'static str {
     static V: std::sync::OnceLock<String> = std::sync::OnceLock::new();
     V.get_or_init(|| {
         let mut h: u64 = 0xcbf2_9ce4_8422_2325;
         for b in INDEX_HTML.bytes() {
             h ^= b as u64;
             h = h.wrapping_mul(0x0000_0100_0000_01b3);
         }
         format!("{h:016x}")
     })
 }
 const DEFAULT_PORT: u16 = 17017;
 
 fn control_socket_path() -> String {
     let display = std::env::var("WAYLAND_DISPLAY").unwrap_or_else(|_| "wayland-0".to_string());
     format!("/tmp/cce-{display}.sock")
 }
 
 fn pin_path() -> std::path::PathBuf {
     let base = std::env::var("XDG_CONFIG_HOME")
         .map(std::path::PathBuf::from)
         .unwrap_or_else(|_| {
             let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_string());
             std::path::PathBuf::from(home).join(".config")
         });
     base.join("cce").join("cce-remote.pin")
 }
 
 /// The pairing PIN: read from disk, or generated (6 digits from /dev/urandom)
 /// and stored 0600 on first run.
 fn load_or_create_pin() -> std::io::Result<String> {
     let path = pin_path();
     if let Ok(existing) = std::fs::read_to_string(&path) {
         let trimmed = existing.trim().to_string();
         if !trimmed.is_empty() {
             return Ok(trimmed);
         }
     }
     let mut bytes = [0u8; 4];
     std::fs::File::open("/dev/urandom")?.read_exact(&mut bytes)?;
     let pin = format!("{:06}", u32::from_le_bytes(bytes) % 1_000_000);
     if let Some(dir) = path.parent() {
         std::fs::create_dir_all(dir)?;
     }
     {
         use std::os::unix::fs::OpenOptionsExt;
         let mut f = std::fs::OpenOptions::new()
             .write(true)
             .create(true)
             .truncate(true)
             .mode(0o600)
             .open(&path)?;
         writeln!(f, "{pin}")?;
     }
     Ok(pin)
 }
 
 /// One control-socket command, one connection: the compositor's IPC server is
 /// one-shot (read → reply → close), so a fresh connect per command is the
 /// correct framing — the reply is everything until EOF (commands like
 /// `windows --json` reply with multiple lines).
 fn control_command(cmd: &str) -> std::io::Result<String> {
     let mut s = UnixStream::connect(control_socket_path())?;
     s.write_all(cmd.as_bytes())?;
     s.write_all(b"\n")?;
     let mut reply = String::new();
     s.read_to_string(&mut reply)?;
     Ok(reply)
 }
 
 /// True for tokens safe to splice into a control command (window queries:
 /// numeric ids or app_ids). The WS payload is untrusted — nothing unvalidated
 /// reaches the compositor.
 fn safe_token(t: &str) -> bool {
     !t.is_empty() && t.len() <= 128
         && t.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-' | ':'))
 }
 
 /// Whether `candidate` is the pairing PIN.
 ///
 /// An empty PIN never authorizes anything. `load_or_create_pin` cannot produce
 /// one — it regenerates on an empty file — but that is a property of a
 /// different function, and if it ever stopped holding, a bare `X-Pin:` header
 /// or an `auth ` frame with nothing after it would authenticate every request.
 /// Gate on the dangerous state here rather than trusting the caller.
 fn pin_matches(candidate: &str, pin: &str) -> bool {
     !pin.is_empty() && candidate == pin
 }
 
 /// The WebSocket auth gate: the FIRST frame must be `auth <pin>`. Everything
 /// else — a wrong PIN, a different verb, an input event sent before pairing —
 /// closes the connection, so no input can be injected unauthenticated.
 fn auth_frame_ok(frame: &str, pin: &str) -> bool {
     frame
         .strip_prefix("auth ")
         .is_some_and(|candidate| pin_matches(candidate.trim(), pin))
 }
 
 /// PIN carried by an `X-Pin` header. The header name is matched
 /// case-insensitively (HTTP field names are), the value is not.
 fn header_pin_ok(request_head: &str, pin: &str) -> bool {
     request_head.lines().any(|line| {
         line.to_ascii_lowercase()
             .starts_with("x-pin:")
             .then(|| line["x-pin:".len()..].trim())
             .is_some_and(|candidate| pin_matches(candidate, pin))
     })
 }
 
 /// PIN carried as a `?pin=` query parameter — needed because an `<img src>`
 /// cannot send headers, so `/stream` has no other way to authenticate.
 ///
 /// Parsed as an actual parameter rather than searched for as a substring: the
 /// old `target.contains("pin=<pin>")` also accepted `?notpin=<pin>` and
 /// `?pin=<pin>trailing-garbage`. Neither is exploitable without already knowing
 /// the PIN, but "close enough to the right string" is not a check.
 fn query_pin_ok(request_head: &str, pin: &str) -> bool {
     request_head
         .split_whitespace()
         .nth(1)
         .and_then(|target| target.split_once('?'))
         .is_some_and(|(_, query)| {
             query
                 .split('&')
                 .any(|kv| kv.strip_prefix("pin=").is_some_and(|c| pin_matches(c, pin)))
         })
 }
 
 /// Loopback, or an address Tailscale hands out: 100.64.0.0/10 and
 /// fd7a:115c:a1e0::/48.
 fn tailnet_or_loopback(ip: std::net::IpAddr) -> bool {
     match ip.to_canonical() {
         std::net::IpAddr::V4(v4) => {
             let o = v4.octets();
             v4.is_loopback() || (o[0] == 100 && (o[1] & 0xc0) == 64)
         }
         std::net::IpAddr::V6(v6) => {
             let s = v6.segments();
             v6.is_loopback() || (s[0] == 0xfd7a && s[1] == 0x115c && s[2] == 0xa1e0)
         }
     }
 }
 
 /// Whether a connection may be served at all, before any PIN is asked for.
 ///
 /// The PIN crosses the wire in clear — HTTP, a WS frame, a `/stream` URL — so
 /// on a network someone else can watch, anyone there who sees one pairing
 /// owns the keyboard. By default, then, only the tailnet is served: WireGuard
 /// carries it encrypted end to end, and loopback never leaves the machine.
 /// Both ends are checked. The PEER must be a tailnet (or loopback) address,
 /// and so must the LOCAL address it reached: Linux will accept a packet for
 /// the tailnet address arriving on the Wi-Fi interface, and a LAN peer
 /// spoofing a 100.x source cannot finish the handshake, since the reply is
 /// routed into the tunnel. `lan` (`--lan` / `CCE_REMOTE_LAN=1`) serves every
 /// interface, the old behaviour, for a network you trust.
 fn reachable(peer: std::net::IpAddr, local: std::net::IpAddr, lan: bool) -> bool {
     lan || (tailnet_or_loopback(peer) && tailnet_or_loopback(local))
 }
 
 /// Failed PIN attempts allowed back-to-back from one peer before it must wait.
 /// Sized for a human mistyping a PIN, not for a client retry loop.
 const PIN_ATTEMPT_BURST: f64 = 5.0;
 /// Sustained rate a peer recovers attempts at: one per 30s. That caps a
 /// brute-force at ~2/min, so walking a 6-digit space takes on the order of a
 /// year rather than the couple of hours an unthrottled LAN socket allows.
 const PIN_ATTEMPT_REFILL_PER_SEC: f64 = 1.0 / 30.0;
 /// Backstop on the tracking table so the limiter cannot itself be turned into
 /// a memory-exhaustion vector by cycling source addresses.
 const PIN_MAX_TRACKED_PEERS: usize = 4096;
 /// Failed attempts allowed back-to-back across ALL peers. The per-peer budget
 /// alone is per address, and anyone who can claim many addresses (a /22 LAN
 /// has a thousand) gets a budget for each — which brought walking the PIN
 /// space down from a year to hours. Room for a few devices mistyping at once.
 const PIN_GLOBAL_BURST: f64 = 20.0;
 /// What every peer together recovers: the same one per 30s a single peer
 /// does, so the year-long walk holds however many addresses do the guessing.
 const PIN_GLOBAL_REFILL_PER_SEC: f64 = 1.0 / 30.0;
 
 #[derive(Clone, Copy, Debug)]
 struct Bucket {
     tokens: f64,
     last: std::time::Instant,
 }
 
 /// Per-peer token bucket over failed PIN attempts.
 ///
 /// The PIN is ~20 bits and every gate compares it with `==`, so the thing that
 /// actually makes it a credential is that an attacker cannot try often. Only
 /// FAILURES consume tokens — a paired client reconnecting its stream, which
 /// the page does on every hiccup, must never be throttled — and a success
 /// clears the peer's record entirely.
 ///
 /// `now` is a parameter rather than read inside, so the behavior is testable
 /// without sleeping.
 ///
 /// Behind the per-peer buckets sits one GLOBAL bucket every failure also
 /// drains, so guessing from many addresses buys no more attempts than
 /// guessing from one. The price: whoever drains it locks out everyone,
 /// a paired phone included, until it refills. That is the trade — a denial
 /// of a trackpad for a while, against keyboard control of the desktop — and
 /// with the default reach (loopback and the tailnet, see `reachable`) only
 /// your own devices can drain it.
 struct RateLimiter {
     peers: std::sync::Mutex<std::collections::HashMap<std::net::IpAddr, Bucket>>,
     global: std::sync::Mutex<Bucket>,
 }
 
 impl RateLimiter {
     fn new() -> Self {
         Self {
             peers: std::sync::Mutex::new(std::collections::HashMap::new()),
             global: std::sync::Mutex::new(Bucket {
                 tokens: PIN_GLOBAL_BURST,
                 last: std::time::Instant::now(),
             }),
         }
     }
 
     fn refilled(bucket: Bucket, now: std::time::Instant) -> Bucket {
         Self::refilled_at(bucket, now, PIN_ATTEMPT_REFILL_PER_SEC, PIN_ATTEMPT_BURST)
     }
 
     fn refilled_at(bucket: Bucket, now: std::time::Instant, rate: f64, burst: f64) -> Bucket {
         let elapsed = now.saturating_duration_since(bucket.last).as_secs_f64();
         Bucket {
             tokens: (bucket.tokens + elapsed * rate).min(burst),
             last: now,
         }
     }
 
     fn global_refilled(bucket: Bucket, now: std::time::Instant) -> Bucket {
         Self::refilled_at(bucket, now, PIN_GLOBAL_REFILL_PER_SEC, PIN_GLOBAL_BURST)
     }
 
     /// May this peer attempt a PIN right now? Does not consume anything —
     /// a correct PIN costs nothing.
     fn allow(&self, ip: std::net::IpAddr, now: std::time::Instant) -> bool {
         if Self::global_refilled(*self.global.lock().unwrap(), now).tokens < 1.0 {
             return false;
         }
         let peers = self.peers.lock().unwrap();
         match peers.get(&ip) {
             Some(&b) => Self::refilled(b, now).tokens >= 1.0,
             None => true,
         }
     }
 
     /// Charge this peer — and the global budget — for a wrong PIN.
     fn record_failure(&self, ip: std::net::IpAddr, now: std::time::Instant) {
         {
             let mut g = self.global.lock().unwrap();
             let mut b = Self::global_refilled(*g, now);
             b.tokens = (b.tokens - 1.0).max(0.0);
             *g = b;
         }
         let mut peers = self.peers.lock().unwrap();
         // A fully refilled bucket is indistinguishable from an absent one, so
         // dropping those keeps the table proportional to peers currently being
         // penalized rather than to every peer ever seen.
         peers.retain(|_, b| Self::refilled(*b, now).tokens < PIN_ATTEMPT_BURST);
         if peers.len() >= PIN_MAX_TRACKED_PEERS && !peers.contains_key(&ip) {
             // At capacity: evict whoever is closest to having recovered.
             if let Some(&victim) = peers
                 .iter()
                 .max_by(|a, b| a.1.tokens.total_cmp(&b.1.tokens))
                 .map(|(k, _)| k)
             {
                 peers.remove(&victim);
             }
         }
         let entry = peers
             .entry(ip)
             .or_insert(Bucket { tokens: PIN_ATTEMPT_BURST, last: now });
         let mut b = Self::refilled(*entry, now);
         b.tokens = (b.tokens - 1.0).max(0.0);
         *entry = b;
     }
 
     /// A correct PIN clears the peer's record.
     fn record_success(&self, ip: std::net::IpAddr) {
         self.peers.lock().unwrap().remove(&ip);
     }
 }
 
 /// `f64::from_str` accepts "NaN" / "inf" / "infinity", and `{:.2}` formats them
 /// straight back out, so without this a frame of `m NaN NaN` would reach the
 /// compositor's pointer math verbatim. Reject rather than clamp: no legitimate
 /// frame from the page contains one.
 fn finite(v: f64) -> Option<f64> {
     v.is_finite().then_some(v)
 }
 
 /// Translate one WS frame into the control-socket commands it means. Returns
 /// None for frames that don't parse — they're dropped, never forwarded raw
 /// (the WS payload is untrusted; only these fixed shapes reach the
 /// compositor). A list rather than one command so a verb can expand to
 /// several commands without the expansion living inline at the call site (the
 /// retired view-mode tap did: absolute move, then click); keeping every
 /// expansion here is what makes this the single place input is validated.
 fn translate(frame: &str) -> Option<Vec<String>> {
     let mut it = frame.split_ascii_whitespace();
     let cmd = match it.next()? {
         "m" => {
             let dx = finite(it.next()?.parse().ok()?)?;
             let dy = finite(it.next()?.parse().ok()?)?;
             format!("pointer-move-by {dx:.2} {dy:.2}")
         }
         "s" => {
             let dy = finite(it.next()?.parse().ok()?)?;
             let dx = finite(it.next().unwrap_or("0").parse().ok()?)?;
             format!("pointer-scroll {dy:.3} {dx:.3}")
         }
         "b" => {
             let btn = match it.next()? {
                 b @ ("left" | "right" | "middle") => b,
                 _ => return None,
             };
             match it.next()? {
                 "down" => format!("pointer-press {btn}"),
                 "up" => format!("pointer-release {btn}"),
                 "click" => format!("pointer-click {btn}"),
                 _ => return None,
             }
         }
         "k" => format!("keypress {}", it.next()?.parse::<u32>().ok()?),
         "kd" => format!("key-down {}", it.next()?.parse::<u32>().ok()?),
         "ku" => format!("key-up {}", it.next()?.parse::<u32>().ok()?),
         "wf" => {
             let target = it.next()?;
             if !safe_token(target) {
                 return None;
             }
             format!("focus-window {target}")
         }
         // Named commands, individually whitelisted — never pass-through.
         "cmd" => match it.next()? {
             "restart-compositor" => "restart-compositor".to_string(),
             _ => return None,
         },
         _ => return None,
     };
     Some(vec![cmd])
 }
 
 /// The `windows --json` reply (one JSON object per line) as a JSON array
 /// for the page's switcher.
 fn window_list_json() -> String {
     let reply = control_command("windows --json").unwrap_or_default();
     let objs: Vec<&str> = reply.lines().filter(|l| l.trim_start().starts_with('{')).collect();
     format!("windows [{}]", objs.join(","))
 }
 
 /// Pull a numeric field out of one windows-json line (no serde — the values
 /// are flat numbers on a single line per window).
 fn json_num(line: &str, key: &str) -> Option<f64> {
     let pat = format!("\"{key}\":");
     let rest = &line[line.find(&pat)? + pat.len()..];
     let end = rest
         .find(|c: char| !(c.is_ascii_digit() || c == '-' || c == '.'))
         .unwrap_or(rest.len());
     rest[..end].parse().ok()
 }
 
 /// The focused app window as (id, x, y, w, h) in layout px.
 fn focused_window() -> Option<(u64, f64, f64, f64, f64)> {
     let reply = control_command("windows --json").ok()?;
     for line in reply.lines() {
         if line.contains("\"focused\":true") && !line.contains("\"mode\":\"Status\"") {
             return Some((
                 json_num(line, "id")? as u64,
                 json_num(line, "x")?,
                 json_num(line, "y")?,
                 json_num(line, "w")?,
                 json_num(line, "h")?,
             ));
         }
     }
     None
 }
 
 /// Screenshot the focused window via the compositor (it replies with the PNG
 /// path), read the bytes, and DELETE the file — the remote view must not
 /// litter ~/Pictures/screenshots.
 fn take_screenshot() -> Option<(Vec<u8>, (u64, f64, f64, f64, f64))> {
     let win = focused_window()?;
     let reply = control_command(&format!("screenshot window {}", win.0)).ok()?;
     let path = reply.trim().strip_prefix("ok ")?.trim().to_string();
     let mut bytes = None;
     for _ in 0..5 {
         match std::fs::read(&path) {
             Ok(b) if !b.is_empty() => {
                 bytes = Some(b);
                 break;
             }
             _ => std::thread::sleep(Duration::from_millis(60)),
         }
     }
     let _ = std::fs::remove_file(&path);
     Some((bytes?, win))
 }
 
 fn handle_ws(stream: TcpStream, pin: &str, ip: std::net::IpAddr, limiter: &RateLimiter) {
     let peer = stream.peer_addr().map(|a| a.to_string()).unwrap_or_default();
     // Unauthenticated clients can hold the socket only briefly.
     let _ = stream.set_read_timeout(Some(Duration::from_secs(10)));
     let mut ws = match tungstenite::accept(stream) {
         Ok(ws) => ws,
         Err(e) => {
             eprintln!("[cce-remote] ws handshake failed ({peer}): {e}");
             return;
         }
     };
     // First frame MUST be `auth <pin>` — anything else (or a timeout, or a
     // wrong PIN) closes the connection before any input can be injected.
     if !limiter.allow(ip, std::time::Instant::now()) {
         // Close WITHOUT "auth fail": that message makes the page drop its
         // stored PIN and prompt, so sending it here would punish a correctly
         // paired client for someone else's guessing on the same address. It
         // reconnects on close and succeeds once the bucket refills.
         eprintln!("[cce-remote] auth rate-limited: {peer}");
         let _ = ws.close(None);
         return;
     }
     let authed = matches!(
         ws.read(),
         Ok(tungstenite::Message::Text(t)) if auth_frame_ok(&t, pin)
     );
     if !authed {
         limiter.record_failure(ip, std::time::Instant::now());
         eprintln!("[cce-remote] auth failed: {peer}");
         let _ = ws.send(tungstenite::Message::Text("auth fail".into()));
         let _ = ws.close(None);
         return;
     }
     limiter.record_success(ip);
     let _ = ws.get_ref().set_read_timeout(None);
     let _ = ws.send(tungstenite::Message::Text("auth ok".into()));
     let _ = ws.send(tungstenite::Message::Text(format!("ver {}", page_version())));
     println!("[cce-remote] client connected: {peer}");
     loop {
         match ws.read() {
             Ok(msg) => {
                 if let tungstenite::Message::Text(text) = msg {
                     if text.trim() == "wl" {
                         // Window-list request: the one message with a reply.
                         let _ = ws.send(tungstenite::Message::Text(window_list_json()));
                     } else if text.trim() == "pl" {
                         // Pointer location (view mode's cursor marker):
                         // "x=N y=N" → "ploc N N".
                         if let Ok(reply) = control_command("pointer-location") {
                             let coords: String = reply
                                 .split_whitespace()
                                 .filter_map(|kv| kv.strip_prefix("x=").or_else(|| kv.strip_prefix("y=")))
                                 .collect::<Vec<_>>()
                                 .join(" ");
                             if !coords.is_empty() {
                                 let _ = ws.send(tungstenite::Message::Text(format!("ploc {coords}")));
                             }
                         }
                     } else if let Some(cmds) = translate(&text) {
                         // Every input-bearing frame goes through translate() —
                         // `wl` and `pl` above are the only exceptions, and they
                         // send fixed commands with no caller-supplied content.
                         for cmd in cmds {
                             let _ = control_command(&cmd);
                         }
                     }
                 }
             }
             Err(_) => break,
         }
     }
     println!("[cce-remote] client disconnected: {peer}");
 }
 
 /// MJPEG stream of the focused window: multipart/x-mixed-replace, one JPEG
 /// part per frame taken from the same latest-wins slot `/wstream` uses (the
 /// producer picks the source and follows focus). Fixed 560/q60, no acks — the
 /// curl-debuggable endpoint, not the page's path. Runs until the client closes
 /// the socket. PIN via X-Pin header or ?pin= query (an <img src> can't carry
 /// headers).
 fn handle_stream(mut stream: TcpStream, request_head: &str, pin: &str, ip: std::net::IpAddr, limiter: &RateLimiter) {
     if !limiter.allow(ip, std::time::Instant::now()) {
         let _ = write!(stream, "HTTP/1.1 429 Too Many Requests\r\nRetry-After: 30\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
         return;
     }
     // Header OR query: an <img src> cannot carry a header, so /stream accepts
     // the PIN in the URL. /shot does not — see handle_http.
     let pin_ok = header_pin_ok(request_head, pin) || query_pin_ok(request_head, pin);
     if !pin_ok {
         limiter.record_failure(ip, std::time::Instant::now());
         let _ = write!(stream, "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
         return;
     }
     limiter.record_success(ip);
     if write!(
         stream,
         "HTTP/1.1 200 OK\r\nContent-Type: multipart/x-mixed-replace; boundary=frame\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n"
     )
     .is_err()
     {
         return;
     }
     // Source selection (winstream → screencopy → grim) lives in the producer;
     // this endpoint is the curl-debuggable MJPEG view over the same slot the
     // page's ack-clocked /wstream uses.
     let slot = stream::Slot::new();
     let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
     stream::spawn_producer(std::sync::Arc::clone(&slot), std::sync::Arc::clone(&stop));
     stream::run_mjpeg_sender(&mut stream, &slot);
     stop.store(true, std::sync::atomic::Ordering::Relaxed);
 }
 
 /// The page's live view: ack-clocked latest-wins frame delivery over a
 /// dedicated WebSocket. Same first-frame `auth <pin>` gate as the input WS —
 /// and a separate socket on purpose: frames are 30-150KB and input events are
 /// bytes, so sharing one TCP stream would head-of-line-block pointer motion
 /// behind every frame on a slow link.
 fn handle_wstream(stream: TcpStream, pin: &str, ip: std::net::IpAddr, limiter: &RateLimiter) {
     let peer = stream.peer_addr().map(|a| a.to_string()).unwrap_or_default();
     let _ = stream.set_read_timeout(Some(Duration::from_secs(10)));
     let mut ws = match tungstenite::accept(stream) {
         Ok(ws) => ws,
         Err(e) => {
             eprintln!("[cce-remote] wstream handshake failed ({peer}): {e}");
             return;
         }
     };
     if !limiter.allow(ip, std::time::Instant::now()) {
         let _ = ws.close(None);
         return;
     }
     let authed = matches!(
         ws.read(),
         Ok(tungstenite::Message::Text(t)) if auth_frame_ok(&t, pin)
     );
     if !authed {
         limiter.record_failure(ip, std::time::Instant::now());
         eprintln!("[cce-remote] wstream auth failed: {peer}");
         let _ = ws.close(None);
         return;
     }
     limiter.record_success(ip);
     let _ = ws.send(tungstenite::Message::Text("auth ok".into()));
     let slot = stream::Slot::new();
     let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
     stream::spawn_producer(std::sync::Arc::clone(&slot), std::sync::Arc::clone(&stop));
     stream::run_ws_sender(&mut ws, &slot);
     stop.store(true, std::sync::atomic::Ordering::Relaxed);
     let _ = ws.close(None);
 }
 
 fn handle_http(mut stream: TcpStream, request_head: &str, pin: &str, ip: std::net::IpAddr, limiter: &RateLimiter) {
     if request_head.starts_with("GET /stream") {
         handle_stream(stream, request_head, pin, ip, limiter);
         return;
     }
     // /shot: the focused window's screenshot, PIN-gated via the X-Pin header.
     // A debug endpoint now — the page's live view rides /wstream and nothing
     // in the page fetches this.
     if request_head.starts_with("GET /shot") {
         if !limiter.allow(ip, std::time::Instant::now()) {
             let _ = write!(stream, "HTTP/1.1 429 Too Many Requests\r\nRetry-After: 30\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
             return;
         }
         // Header only: nothing loads this as an <img src>, so unlike /stream
         // there is no reason to let the PIN travel in a URL (where it lands in
         // logs).
         if !header_pin_ok(request_head, pin) {
             limiter.record_failure(ip, std::time::Instant::now());
             let _ = write!(stream, "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
             return;
         }
         limiter.record_success(ip);
         match take_screenshot() {
             Some((bytes, (id, x, y, w, h))) => {
                 let _ = write!(
                     stream,
                     "HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nX-Win: {id} {x} {y} {w} {h}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
                     bytes.len(),
                 );
                 let _ = stream.write_all(&bytes);
             }
             None => {
                 let _ = write!(stream, "HTTP/1.1 503 Service Unavailable\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
             }
         }
         return;
     }
     let ok = request_head.starts_with("GET / ") || request_head.starts_with("GET /index.html ");
     let (status, body) = if ok {
         ("200 OK", INDEX_HTML)
     } else {
         ("404 Not Found", "not found")
     };
     // no-cache: a reload (manual or the automatic version-mismatch one) must
     // refetch the page, not revalidate a heuristic cache entry.
     let _ = write!(
         stream,
         "HTTP/1.1 {status}\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-cache\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
         body.len(),
     );
 }
 
 fn main() {
     let mut port = DEFAULT_PORT;
     let mut lan = std::env::var("CCE_REMOTE_LAN").is_ok_and(|v| v == "1");
     for arg in std::env::args().skip(1) {
         if arg == "--lan" {
             lan = true;
         } else if let Ok(p) = arg.parse::<u16>() {
             port = p;
         } else {
             eprintln!("[cce-remote] usage: cce-remote [--lan] [port]");
             std::process::exit(2);
         }
     }
     let pin = match load_or_create_pin() {
         Ok(p) => p,
         Err(e) => {
             eprintln!("[cce-remote] cannot read/create PIN file {:?}: {e}", pin_path());
             std::process::exit(1);
         }
     };
     let listener = match TcpListener::bind(("0.0.0.0", port)) {
         Ok(l) => l,
         Err(e) => {
             eprintln!("[cce-remote] cannot bind port {port}: {e}");
             std::process::exit(1);
         }
     };
     let limiter = std::sync::Arc::new(RateLimiter::new());
     if lan {
         println!("[cce-remote] serving EVERY interface on :{port} (--lan: the PIN crosses the network in clear)");
     } else {
         println!("[cce-remote] serving loopback and the tailnet on :{port} (--lan or CCE_REMOTE_LAN=1 for every interface)");
     }
     println!("[cce-remote] control socket: {}", control_socket_path());
     println!("[cce-remote] pairing PIN: {pin}   (stored in {:?})", pin_path());
 
     for stream in listener.incoming() {
         let stream = match stream {
             Ok(s) => s,
             Err(_) => continue,
         };
         // Identify the peer once, here: every PIN gate is rate-limited per
         // source address, and a socket whose peer cannot be resolved cannot be
         // held accountable for its guesses, so it is refused rather than
         // exempted.
         let Ok(ip) = stream.peer_addr().map(|a| a.ip()) else { continue };
         let Ok(local) = stream.local_addr().map(|a| a.ip()) else { continue };
         if !reachable(ip, local, lan) {
             // Say why rather than just dropping it, so a phone still holding
             // the old LAN address learns where to go; nothing past this line
             // is reachable from here, the request is never parsed.
             eprintln!("[cce-remote] refused {ip} -> {local}: not the tailnet (--lan to serve it)");
             std::thread::spawn(move || {
                 let mut s = stream;
                 let _ = s.set_read_timeout(Some(Duration::from_secs(2)));
                 let mut sink = [0u8; 1024];
                 let _ = s.read(&mut sink);
                 let body = "cce-remote serves the tailnet only: open it at this machine's Tailscale address.\n";
                 let _ = write!(
                     s,
                     "HTTP/1.1 403 Forbidden\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
                     body.len()
                 );
             });
             continue;
         }
         // Input events and stream acks are tiny and latency-critical; Nagle
         // would batch them behind delayed ACKs.
         let _ = stream.set_nodelay(true);
         let pin = pin.clone();
         let limiter = std::sync::Arc::clone(&limiter);
         std::thread::spawn(move || {
             // Peek the request head without consuming it, so a WS upgrade can
             // be handed to tungstenite with the handshake bytes intact.
             let mut buf = [0u8; 1024];
             let n = match stream.peek(&mut buf) {
                 Ok(n) if n > 0 => n,
                 _ => return,
             };
             let head = String::from_utf8_lossy(&buf[..n]).to_string();
             if head.starts_with("GET /wstream") {
                 // before /ws: "GET /ws" is a prefix of this
                 handle_wstream(stream, &pin, ip, &limiter);
             } else if head.starts_with("GET /ws") {
                 handle_ws(stream, &pin, ip, &limiter);
             } else {
                 // Consume the request before replying (keeps curl happy).
                 let mut sink = [0u8; 1024];
                 let mut s = stream;
                 let _ = s.read(&mut sink);
                 handle_http(s, &head, &pin, ip, &limiter);
             }
         });
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
     // `translate` is the security boundary of this crate: it is the only thing
     // between an untrusted WebSocket frame and a control socket that can move
     // the pointer and type into whatever the user has focused. These tests
     // cover the two halves of that job — the fixed shapes it accepts, and
     // everything it must refuse — because a regression here is not a wrong
     // pixel, it is remote input injection.
 
     /// A frame expected to mean exactly one command.
     fn one(frame: &str) -> String {
         let cmds = translate(frame).expect("frame should translate");
         assert_eq!(cmds.len(), 1, "{frame:?} yielded {cmds:?}, expected one command");
         cmds.into_iter().next().unwrap()
     }
 
     // ---- rate limiting ----
     //
     // What actually makes a 6-digit PIN a credential: not the comparison, but
     // that a peer cannot try often. Time is injected, so none of this sleeps.
 
     use std::net::{IpAddr, Ipv4Addr};
     use std::time::Instant;
 
     fn ip(last: u8) -> IpAddr {
         IpAddr::V4(Ipv4Addr::new(192, 168, 1, last))
     }
 
     #[test]
     fn a_peer_gets_a_burst_then_must_wait() {
         let rl = RateLimiter::new();
         let t0 = Instant::now();
         let peer = ip(10);
 
         for i in 0..PIN_ATTEMPT_BURST as u32 {
             assert!(rl.allow(peer, t0), "attempt {i} should be allowed");
             rl.record_failure(peer, t0);
         }
         assert!(!rl.allow(peer, t0), "the burst must be exhausted");
 
         // Still locked out just short of the refill interval, allowed after it.
         assert!(!rl.allow(peer, t0 + Duration::from_secs(29)));
         assert!(rl.allow(peer, t0 + Duration::from_secs(31)));
     }
 
     #[test]
     fn recovery_is_capped_at_the_burst_size() {
         // Asserted on refilled() directly rather than through the public API:
         // record_failure() prunes recovered peers and re-creates them at full,
         // which masks a missing cap end-to-end. (It did — this test passed
         // against a build with the .min() removed until it was written this
         // way.) Idle time must not bank attempts.
         let t0 = Instant::now();
         let drained = Bucket { tokens: 0.0, last: t0 };
         // Full recovery takes BURST * 30s = 150s; well past that, nothing accrues.
         for idle in [300u64, 3600, 86_400] {
             let b = RateLimiter::refilled(drained, t0 + Duration::from_secs(idle));
             assert_eq!(
                 b.tokens, PIN_ATTEMPT_BURST,
                 "{idle}s idle banked {} attempts", b.tokens
             );
         }
         // Partial recovery is proportional, not all-or-nothing.
         let b = RateLimiter::refilled(drained, t0 + Duration::from_secs(60));
         assert!(b.tokens > 1.0);
         let b = RateLimiter::refilled(drained, t0 + Duration::from_secs(15));
         assert!(b.tokens < 1.0, "half an interval must not buy a whole attempt");
     }
 
     #[test]
     fn peers_are_limited_independently() {
         let rl = RateLimiter::new();
         let t0 = Instant::now();
         let (attacker, phone) = (ip(20), ip(21));
         for _ in 0..PIN_ATTEMPT_BURST as u32 {
             rl.record_failure(attacker, t0);
         }
         assert!(!rl.allow(attacker, t0));
         assert!(rl.allow(phone, t0), "one peer's guessing must not lock out another");
     }
 
     #[test]
     fn a_correct_pin_costs_nothing_and_clears_the_record() {
         let rl = RateLimiter::new();
         let t0 = Instant::now();
         let peer = ip(30);
 
         // The page reconnects its stream on every hiccup, each time presenting
         // a correct PIN. If that consumed budget it would throttle itself.
         for _ in 0..1000 {
             assert!(rl.allow(peer, t0));
         }
 
         for _ in 0..(PIN_ATTEMPT_BURST as u32 - 1) {
             rl.record_failure(peer, t0);
         }
         rl.record_success(peer);
         for _ in 0..PIN_ATTEMPT_BURST as u32 {
             assert!(rl.allow(peer, t0), "success should restore the full burst");
             rl.record_failure(peer, t0);
         }
     }
 
     #[test]
     fn the_tracking_table_does_not_grow_without_bound() {
         let rl = RateLimiter::new();
         let t0 = Instant::now();
 
         // Recovered peers carry no information and must not be retained.
         for i in 0..200u8 {
             rl.record_failure(ip(i), t0);
         }
         assert!(rl.peers.lock().unwrap().len() > 1);
         rl.record_failure(ip(255), t0 + Duration::from_secs(3600));
         assert_eq!(
             rl.peers.lock().unwrap().len(),
             1,
             "fully refilled peers should have been pruned"
         );
 
         // And the table is capped even when every entry is still penalized.
         let mut rl2 = RateLimiter::new();
         // One failure per peer is enough to create (and hold) an entry.
         for i in 0..(PIN_MAX_TRACKED_PEERS + 50) {
             rl2.record_failure(IpAddr::V4(Ipv4Addr::from((i as u32).to_be_bytes())), t0);
         }
         assert!(
             rl2.peers.get_mut().unwrap().len() <= PIN_MAX_TRACKED_PEERS,
             "table exceeded its cap"
         );
     }
 
     #[test]
     fn many_addresses_share_one_global_budget() {
         // One failure from each of a LAN's worth of addresses: every per-peer
         // bucket still has four left, and still the guessing stops.
         let rl = RateLimiter::new();
         let t0 = Instant::now();
         for i in 0..PIN_GLOBAL_BURST as u8 {
             assert!(rl.allow(ip(i), t0), "global attempt {i} should be allowed");
             rl.record_failure(ip(i), t0);
         }
         assert!(!rl.allow(ip(200), t0), "a fresh address must not bring a fresh budget");
         // The documented price: a paired phone waits too, then recovers.
         assert!(!rl.allow(ip(201), t0 + Duration::from_secs(29)));
         assert!(rl.allow(ip(201), t0 + Duration::from_secs(31)));
         // A success does not refund the global budget.
         rl.record_success(ip(0));
         assert!(!rl.allow(ip(0), t0));
     }
 
     #[test]
     fn only_loopback_and_the_tailnet_are_served_by_default() {
         let v4 = |a, b, c, d| IpAddr::V4(Ipv4Addr::new(a, b, c, d));
         let me_ts = v4(100, 105, 214, 102);
         let me_lan = v4(192, 168, 68, 55);
         let phone_ts = v4(100, 90, 1, 2);
         let phone_lan = v4(192, 168, 68, 77);
         let lo = v4(127, 0, 0, 1);
 
         assert!(reachable(phone_ts, me_ts, false));
         assert!(reachable(lo, lo, false));
         assert!(!reachable(phone_lan, me_lan, false), "the LAN is opt-in");
         // Linux takes a packet for the tailnet address off the Wi-Fi; the
         // peer is what gives it away.
         assert!(!reachable(phone_lan, me_ts, false));
         // A tailnet-shaped source aimed at the LAN address is not the tunnel.
         assert!(!reachable(phone_ts, me_lan, false));
         // Just outside 100.64.0.0/10 on either side.
         assert!(!reachable(v4(100, 63, 255, 255), me_ts, false));
         assert!(!reachable(v4(100, 128, 0, 1), me_ts, false));
         // Tailscale's IPv6 range, and v4 seen through a dual-stack socket.
         let ts6: IpAddr = "fd7a:115c:a1e0::dd34:d667".parse().unwrap();
         let other6: IpAddr = "fd7a:115c:a1e1::1".parse().unwrap();
         assert!(reachable(ts6, ts6, false));
         assert!(!reachable(other6, ts6, false));
         let mapped: IpAddr = "::ffff:100.90.1.2".parse().unwrap();
         assert!(reachable(mapped, me_ts, false));
 
         assert!(reachable(phone_lan, me_lan, true), "--lan serves everything");
     }
 
     // ---- the pairing PIN ----
     //
     // The other half of the security model: translate() decides what a paired
     // client may say, these decide who is paired at all. Both are reachable by
     // anyone who can open a socket to this port.
 
     const PIN: &str = "123456";
 
     fn head(lines: &[&str]) -> String {
         format!("{}\r\n\r\n", lines.join("\r\n"))
     }
 
     #[test]
     fn ws_auth_requires_exactly_auth_then_pin() {
         assert!(auth_frame_ok("auth 123456", PIN));
         assert!(auth_frame_ok("auth   123456  ", PIN)); // value is trimmed
         for frame in [
             "auth 123457",      // wrong PIN
             "auth 12345",       // prefix of it
             "auth 1234567",     // superstring of it
             "auth ",            // empty candidate
             "auth",             // no separator
             "AUTH 123456",      // verb is case-sensitive
             "auth123456",
             " auth 123456",     // must be the whole frame, unprefixed
             "m 1 2",            // an input event before pairing
             "",
         ] {
             assert!(!auth_frame_ok(frame, PIN), "{frame:?} must not authenticate");
         }
     }
 
     #[test]
     fn an_empty_pin_authorizes_nothing() {
         // load_or_create_pin() regenerates on an empty file, so this should be
         // unreachable — which is exactly why it is worth pinning. A truncated
         // PIN file must fail closed, not open.
         assert!(!auth_frame_ok("auth ", ""));
         assert!(!auth_frame_ok("auth", ""));
         assert!(!header_pin_ok(&head(&["GET /shot HTTP/1.1", "X-Pin:"]), ""));
         assert!(!header_pin_ok(&head(&["GET /shot HTTP/1.1", "X-Pin: "]), ""));
         assert!(!query_pin_ok(&head(&["GET /stream?pin= HTTP/1.1"]), ""));
     }
 
     #[test]
     fn x_pin_header_is_matched_case_insensitively_by_name_only() {
         for name in ["X-Pin", "x-pin", "X-PIN", "x-PiN"] {
             let h = head(&["GET /shot HTTP/1.1", &format!("{name}: {PIN}"), "Host: x"]);
             assert!(header_pin_ok(&h, PIN), "{name} should be accepted");
         }
         // Value whitespace is trimmed; the value itself must match exactly.
         assert!(header_pin_ok(&head(&["GET /shot HTTP/1.1", "X-Pin:   123456  "]), PIN));
         for bad in ["X-Pin: 123457", "X-Pin: 12345", "X-Pin: 1234567", "X-Pin:", "X-Pinx: 123456"] {
             let h = head(&["GET /shot HTTP/1.1", bad]);
             assert!(!header_pin_ok(&h, PIN), "{bad:?} must not authenticate");
         }
         // No header at all.
         assert!(!header_pin_ok(&head(&["GET /shot HTTP/1.1", "Host: x"]), PIN));
     }
 
     #[test]
     fn query_pin_is_a_parameter_not_a_substring() {
         assert!(query_pin_ok(&head(&["GET /stream?pin=123456 HTTP/1.1"]), PIN));
         assert!(query_pin_ok(&head(&["GET /stream?pin=123456&g=7 HTTP/1.1"]), PIN));
         assert!(query_pin_ok(&head(&["GET /stream?g=7&pin=123456 HTTP/1.1"]), PIN));
         for bad in [
             "GET /stream?notpin=123456 HTTP/1.1",  // substring match used to pass this
             "GET /stream?pin=1234567 HTTP/1.1",    // and this
             "GET /stream?xpin=123456 HTTP/1.1",
             "GET /stream?pin=12345 HTTP/1.1",
             "GET /stream?pin= HTTP/1.1",
             "GET /stream?pin HTTP/1.1",
             "GET /stream HTTP/1.1",                // no query at all
             "GET /pin=123456 HTTP/1.1",            // in the PATH, not the query
         ] {
             assert!(!query_pin_ok(&head(&[bad]), PIN), "{bad:?} must not authenticate");
         }
     }
 
     #[test]
     fn the_two_http_gates_are_not_interchangeable() {
         // /stream takes either (an <img src> cannot send headers); /shot takes
         // the header only, so the PIN stays out of URLs and logs where it can.
         let query_only = head(&["GET /stream?pin=123456 HTTP/1.1", "Host: x"]);
         assert!(query_pin_ok(&query_only, PIN));
         assert!(!header_pin_ok(&query_only, PIN), "/shot must not accept a URL PIN");
 
         let header_only = head(&["GET /shot HTTP/1.1", "X-Pin: 123456"]);
         assert!(header_pin_ok(&header_only, PIN));
         assert!(!query_pin_ok(&header_only, PIN));
     }
 
     #[test]
     fn pointer_and_scroll_carry_fixed_precision() {
         assert_eq!(one("m 1 -2"), "pointer-move-by 1.00 -2.00");
         assert_eq!(one("m 0.126 -0.126"), "pointer-move-by 0.13 -0.13");
         // Exact .5 ties round half-to-even, not away from zero — sub-pixel
         // detail the page never notices, but pin it so a formatting change
         // shows up here rather than as drifting pointer feel.
         assert_eq!(one("m 0.125 0.135"), "pointer-move-by 0.12 0.14");
         // `s` takes dy first; dx is optional and defaults to 0.
         assert_eq!(one("s 5"), "pointer-scroll 5.000 0.000");
         assert_eq!(one("s 5 -1.5"), "pointer-scroll 5.000 -1.500");
     }
 
     #[test]
     fn buttons_map_to_press_release_click() {
         assert_eq!(one("b left down"), "pointer-press left");
         assert_eq!(one("b left up"), "pointer-release left");
         assert_eq!(one("b right click"), "pointer-click right");
         assert_eq!(one("b middle click"), "pointer-click middle");
     }
 
     #[test]
     fn keys_map_to_tap_and_hold() {
         assert_eq!(one("k 28"), "keypress 28");
         assert_eq!(one("kd 42"), "key-down 42");
         assert_eq!(one("ku 42"), "key-up 42");
     }
 
     #[test]
     fn unknown_verbs_are_dropped() {
         // Note the compositor's own command names: a frame naming one directly
         // must NOT be honored, or the whitelist would be decorative.
         for frame in [
             "", "   ", "x 1", "exit", "spawn foot", "reload",
             "pointer-click left", "keypress 28", "restart-compositor",
             // retired 2026-08-23: view-mode taps are plain trackpad clicks,
             // so the verbs left the whitelist rather than lingering as
             // unused injection surface
             "tap 100 200", "tapr 5 5",
         ] {
             assert!(translate(frame).is_none(), "{frame:?} should be dropped");
         }
     }
 
     #[test]
     fn missing_or_malformed_arguments_are_dropped() {
         for frame in [
             "m", "m 1", "m a b", "m 1 b",
             "s", "s abc", "s 1 abc",
             "k", "k abc", "k -1", "k 1.5", "k 99999999999999999999",
             "kd", "ku",
             "b", "b left", "b left bogus", "b sideways click", "b LEFT click",
             "wf", "cmd",
         ] {
             assert!(translate(frame).is_none(), "{frame:?} should be dropped");
         }
     }
 
     #[test]
     fn non_finite_coordinates_are_dropped() {
         // The hazard is real rather than theoretical — this is exactly what
         // finite() exists to stop, and it is why parse().ok() alone is not
         // enough validation for a float.
         assert!("NaN".parse::<f64>().is_ok());
         assert_eq!(format!("{:.2}", "NaN".parse::<f64>().unwrap()), "NaN");
         assert_eq!(format!("{:.2}", "inf".parse::<f64>().unwrap()), "inf");
 
         for frame in [
             "m NaN 1", "m 1 NaN", "m inf 0", "m -inf 0", "m 1 infinity",
             "s NaN", "s 1 inf", "s nan 0",
         ] {
             assert!(translate(frame).is_none(), "{frame:?} should be dropped");
         }
     }
 
     #[test]
     fn focus_target_is_restricted_to_safe_tokens() {
         assert_eq!(one("wf 12"), "focus-window 12");
         assert_eq!(one("wf org.cce.files"), "focus-window org.cce.files");
         assert_eq!(one("wf a-b_c:d.1"), "focus-window a-b_c:d.1");
         for frame in [
             "wf ../etc", "wf a/b", "wf a;b", "wf a$b", "wf a*b",
             "wf a'b", "wf a\"b", "wf a|b", "wf a&b", "wf a\\b",
         ] {
             assert!(translate(frame).is_none(), "{frame:?} should be dropped");
         }
         // safe_token's length bound, exercised on both sides.
         assert!(translate(&format!("wf {}", "a".repeat(128))).is_some());
         assert!(translate(&format!("wf {}", "a".repeat(129))).is_none());
     }
 
     #[test]
     fn named_commands_are_whitelisted_never_passed_through() {
         assert_eq!(one("cmd restart-compositor"), "restart-compositor");
         // Trailing junk is discarded, not appended.
         assert_eq!(one("cmd restart-compositor rm -rf"), "restart-compositor");
         for frame in ["cmd exit", "cmd reload", "cmd spawn foot", "cmd RESTART-COMPOSITOR"] {
             assert!(translate(frame).is_none(), "{frame:?} should be dropped");
         }
     }
 
     #[test]
     fn a_newline_can_never_smuggle_a_second_command() {
         // control_command() appends "\n", so an embedded newline in the output
         // would be a second command on the socket. split_ascii_whitespace()
         // eats it and every command is REBUILT from re-parsed values, so
         // trailing tokens are discarded rather than forwarded.
         assert_eq!(one("m 1 2\npointer-click left"), "pointer-move-by 1.00 2.00");
         assert_eq!(one("wf 12\nexit"), "focus-window 12");
 
         // The property that matters, over every shape the page can send plus
         // deliberate junk: whatever comes out is a single line.
         for frame in [
             "m 1 2\nexit", "m 1\n2", "s 1\nexit", "b left\nclick", "b left click\nexit",
             "k 28\nexit", "kd 42\nexit", "ku 42\nexit", "wf 1\nexit",
             "cmd restart-compositor\nexit", "m\t1\t2", "wf\n12", "  m   1   2  ",
             "tap 1 2\nexit",
         ] {
             for out in translate(frame).unwrap_or_default() {
                 assert!(!out.contains('\n'), "{frame:?} produced a multi-line command: {out:?}");
                 assert!(!out.contains('\r'), "{frame:?} produced a CR: {out:?}");
             }
         }
     }
 }