Removed RDP in favor of VNC / Made WireGuard Tunnel Persistent

Data/Engine/config.py

@@ -81,14 +81,19 @@ VPN_TUNNEL_LOG_FILE_PATH = LOG_ROOT / "VPN_Tunnel" / "tunnel.log"
 DEFAULT_WIREGUARD_PORT = 30000
 DEFAULT_WIREGUARD_ENGINE_VIRTUAL_IP = "10.255.0.1/32"
 DEFAULT_WIREGUARD_PEER_NETWORK = "10.255.0.0/16"
-DEFAULT_WIREGUARD_SHELL_PORT = 47002
-DEFAULT_WIREGUARD_ACL_WINDOWS = (3389, 5985, 5986, 5900, 3478, DEFAULT_WIREGUARD_SHELL_PORT)
 VPN_SERVER_CERT_ROOT = PROJECT_ROOT / "Engine" / "Certificates" / "VPN_Server"
-DEFAULT_GUACD_HOST = "127.0.0.1"
-DEFAULT_GUACD_PORT = 4822
-DEFAULT_RDP_WS_HOST = "0.0.0.0"
-DEFAULT_RDP_WS_PORT = 4823
-DEFAULT_RDP_SESSION_TTL_SECONDS = 120
+DEFAULT_VNC_PORT = 5900
+DEFAULT_WIREGUARD_SHELL_PORT = 47002
+DEFAULT_WIREGUARD_ACL_WINDOWS = (
+    5985,
+    5986,
+    5900,
+    3478,
+    DEFAULT_WIREGUARD_SHELL_PORT,
+)
+DEFAULT_VNC_WS_HOST = "0.0.0.0"
+DEFAULT_VNC_WS_PORT = 4823
+DEFAULT_VNC_SESSION_TTL_SECONDS = 120
 
 
 def _ensure_parent(path: Path) -> None:
@@ -290,11 +295,10 @@ class EngineSettings:
     wireguard_server_public_key_path: str
     wireguard_acl_allowlist_windows: Tuple[int, ...]
     wireguard_shell_port: int
-    guacd_host: str
-    guacd_port: int
-    rdp_ws_host: str
-    rdp_ws_port: int
-    rdp_session_ttl_seconds: int
+    vnc_port: int
+    vnc_ws_host: str
+    vnc_ws_port: int
+    vnc_session_ttl_seconds: int
     raw: MutableMapping[str, Any] = field(default_factory=dict)
 
     def to_flask_config(self) -> MutableMapping[str, Any]:
@@ -437,32 +441,27 @@ def load_runtime_config(overrides: Optional[Mapping[str, Any]] = None) -> Engine
     wireguard_server_private_key_path = str(wireguard_key_root / "server_private.key")
     wireguard_server_public_key_path = str(wireguard_key_root / "server_public.key")
 
-    guacd_host = str(
-        runtime_config.get("GUACD_HOST")
-        or os.environ.get("BOREALIS_GUACD_HOST")
-        or DEFAULT_GUACD_HOST
-    )
-    guacd_port = _parse_int(
-        runtime_config.get("GUACD_PORT") or os.environ.get("BOREALIS_GUACD_PORT"),
-        default=DEFAULT_GUACD_PORT,
+    vnc_port = _parse_int(
+        runtime_config.get("VNC_PORT") or os.environ.get("BOREALIS_VNC_PORT"),
+        default=DEFAULT_VNC_PORT,
         minimum=1,
         maximum=65535,
     )
-    rdp_ws_host = str(
-        runtime_config.get("RDP_WS_HOST")
-        or os.environ.get("BOREALIS_RDP_WS_HOST")
-        or DEFAULT_RDP_WS_HOST
+    vnc_ws_host = str(
+        runtime_config.get("VNC_WS_HOST")
+        or os.environ.get("BOREALIS_VNC_WS_HOST")
+        or DEFAULT_VNC_WS_HOST
     )
-    rdp_ws_port = _parse_int(
-        runtime_config.get("RDP_WS_PORT") or os.environ.get("BOREALIS_RDP_WS_PORT"),
-        default=DEFAULT_RDP_WS_PORT,
+    vnc_ws_port = _parse_int(
+        runtime_config.get("VNC_WS_PORT") or os.environ.get("BOREALIS_VNC_WS_PORT"),
+        default=DEFAULT_VNC_WS_PORT,
         minimum=1,
         maximum=65535,
     )
-    rdp_session_ttl_seconds = _parse_int(
-        runtime_config.get("RDP_SESSION_TTL_SECONDS")
-        or os.environ.get("BOREALIS_RDP_SESSION_TTL_SECONDS"),
-        default=DEFAULT_RDP_SESSION_TTL_SECONDS,
+    vnc_session_ttl_seconds = _parse_int(
+        runtime_config.get("VNC_SESSION_TTL_SECONDS")
+        or os.environ.get("BOREALIS_VNC_SESSION_TTL_SECONDS"),
+        default=DEFAULT_VNC_SESSION_TTL_SECONDS,
         minimum=30,
         maximum=3600,
     )
@@ -505,11 +504,10 @@ def load_runtime_config(overrides: Optional[Mapping[str, Any]] = None) -> Engine
         wireguard_server_public_key_path=wireguard_server_public_key_path,
         wireguard_acl_allowlist_windows=wireguard_acl_allowlist_windows,
         wireguard_shell_port=wireguard_shell_port,
-        guacd_host=guacd_host,
-        guacd_port=guacd_port,
-        rdp_ws_host=rdp_ws_host,
-        rdp_ws_port=rdp_ws_port,
-        rdp_session_ttl_seconds=rdp_session_ttl_seconds,
+        vnc_port=vnc_port,
+        vnc_ws_host=vnc_ws_host,
+        vnc_ws_port=vnc_ws_port,
+        vnc_session_ttl_seconds=vnc_session_ttl_seconds,
         raw=runtime_config,
     )
     return settings

Data/Engine/database_migrations.py

@@ -70,6 +70,7 @@ def _ensure_devices_table(conn: sqlite3.Connection) -> None:
         "ansible_ee_ver": "TEXT",
         "connection_type": "TEXT",
         "connection_endpoint": "TEXT",
+        "agent_vnc_password": "TEXT",
         "ssl_key_fingerprint": "TEXT",
         "token_version": "INTEGER",
         "status": "TEXT",
@@ -388,6 +389,7 @@ def _create_devices_table(cur: sqlite3.Cursor) -> None:
             ansible_ee_ver TEXT,
             connection_type TEXT,
             connection_endpoint TEXT,
+            agent_vnc_password TEXT,
             ssl_key_fingerprint TEXT,
             token_version INTEGER DEFAULT 1,
             status TEXT DEFAULT 'active',
@@ -455,9 +457,9 @@ def _rebuild_devices_table(conn: sqlite3.Connection, column_info: Sequence[Tuple
             network, software, storage, cpu, device_type, domain, external_ip,
             internal_ip, last_reboot, last_seen, last_user, operating_system,
             uptime, agent_id, ansible_ee_ver, connection_type, connection_endpoint,
-            ssl_key_fingerprint, token_version, status, key_added_at
+            agent_vnc_password, ssl_key_fingerprint, token_version, status, key_added_at
         )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         """
     )
 
@@ -496,6 +498,7 @@ def _rebuild_devices_table(conn: sqlite3.Connection, column_info: Sequence[Tuple
             record.get("ansible_ee_ver"),
             record.get("connection_type"),
             record.get("connection_endpoint"),
+            record.get("agent_vnc_password"),
             record.get("ssl_key_fingerprint"),
             record.get("token_version") or 1,
             record.get("status") or "active",

Data/Engine/server.py

@@ -128,15 +128,14 @@ class EngineContext:
     wireguard_server_public_key_path: str
     wireguard_acl_allowlist_windows: Tuple[int, ...]
     wireguard_shell_port: int
-    guacd_host: str
-    guacd_port: int
-    rdp_ws_host: str
-    rdp_ws_port: int
-    rdp_session_ttl_seconds: int
+    vnc_port: int
+    vnc_ws_host: str
+    vnc_ws_port: int
+    vnc_session_ttl_seconds: int
     wireguard_server_manager: Optional[Any] = None
     assembly_cache: Optional[Any] = None
-    rdp_proxy: Optional[Any] = None
-    rdp_registry: Optional[Any] = None
+    vnc_proxy: Optional[Any] = None
+    vnc_registry: Optional[Any] = None
 
 
 __all__ = ["EngineContext", "create_app", "register_engine_api"]
@@ -162,11 +161,10 @@ def _build_engine_context(settings: EngineSettings, logger: logging.Logger) -> E
         wireguard_server_public_key_path=settings.wireguard_server_public_key_path,
         wireguard_acl_allowlist_windows=settings.wireguard_acl_allowlist_windows,
         wireguard_shell_port=settings.wireguard_shell_port,
-        guacd_host=settings.guacd_host,
-        guacd_port=settings.guacd_port,
-        rdp_ws_host=settings.rdp_ws_host,
-        rdp_ws_port=settings.rdp_ws_port,
-        rdp_session_ttl_seconds=settings.rdp_session_ttl_seconds,
+        vnc_port=settings.vnc_port,
+        vnc_ws_host=settings.vnc_ws_host,
+        vnc_ws_port=settings.vnc_ws_port,
+        vnc_session_ttl_seconds=settings.vnc_session_ttl_seconds,
         assembly_cache=None,
     )
 

Data/Engine/services/API/__init__.py

@@ -33,7 +33,8 @@ from ..auth import DevModeManager
 from .enrollment import routes as enrollment_routes
 from .tokens import routes as token_routes
 from .devices.tunnel import register_tunnel
-from .devices.rdp import register_rdp
+from .devices.vnc import register_vnc
+from .devices.shell import register_shell
 
 from ...server import EngineContext
 from .access_management.login import register_auth
@@ -292,7 +293,8 @@ def _register_devices(app: Flask, adapters: EngineServiceAdapters) -> None:
     register_admin_endpoints(app, adapters)
     device_routes.register_agents(app, adapters)
     register_tunnel(app, adapters)
-    register_rdp(app, adapters)
+    register_vnc(app, adapters)
+    register_shell(app, adapters)
 
 def _register_filters(app: Flask, adapters: EngineServiceAdapters) -> None:
     filters_management.register_filters(app, adapters)

Data/Engine/services/API/devices/routes.py

@@ -5,6 +5,7 @@
 # API Endpoints (if applicable):
 # - POST /api/agent/heartbeat (Device Authenticated) - Updates device last-seen metadata and inventory snapshots.
 # - POST /api/agent/script/request (Device Authenticated) - Provides script execution payloads or idle signals to agents.
+# - POST /api/agent/vpn/ensure (Device Authenticated) - Ensures persistent WireGuard tunnel material.
 # ======================================================
 
 """Device-affiliated agent endpoints for the Borealis Engine runtime."""
@@ -13,12 +14,14 @@ from __future__ import annotations
 import json
 import sqlite3
 import time
+from urllib.parse import urlsplit
 from typing import TYPE_CHECKING, Any, Dict, Optional
 
 from flask import Blueprint, jsonify, request, g
 
 from ....auth.device_auth import AGENT_CONTEXT_HEADER, require_device_auth
 from ....auth.guid_utils import normalize_guid
+from .tunnel import _get_tunnel_service
 
 if TYPE_CHECKING:  # pragma: no cover - typing aide
     from .. import EngineServiceAdapters
@@ -42,6 +45,20 @@ def _json_or_none(value: Any) -> Optional[str]:
         return None
 
 
+def _infer_endpoint_host(req) -> str:
+    forwarded = (req.headers.get("X-Forwarded-Host") or req.headers.get("X-Original-Host") or "").strip()
+    host = forwarded.split(",")[0].strip() if forwarded else (req.host or "").strip()
+    if not host:
+        return ""
+    try:
+        parsed = urlsplit(f"//{host}")
+        if parsed.hostname:
+            return parsed.hostname
+    except Exception:
+        return host
+    return host
+
+
 def register_agents(app, adapters: "EngineServiceAdapters") -> None:
     """Register agent heartbeat and script polling routes."""
 
@@ -218,4 +235,76 @@ def register_agents(app, adapters: "EngineServiceAdapters") -> None:
             }
         )
 
+    @blueprint.route("/api/agent/vpn/ensure", methods=["POST"])
+    @require_device_auth(auth_manager)
+    def vpn_ensure():
+        ctx = _auth_context()
+        if ctx is None:
+            return jsonify({"error": "auth_context_missing"}), 500
+
+        body = request.get_json(silent=True) or {}
+        requested_agent = (body.get("agent_id") or "").strip()
+        guid = normalize_guid(ctx.guid)
+
+        conn = db_conn_factory()
+        resolved_agent = ""
+        try:
+            cur = conn.cursor()
+            cur.execute(
+                "SELECT agent_id FROM devices WHERE UPPER(guid) = ? ORDER BY last_seen DESC LIMIT 1",
+                (guid,),
+            )
+            row = cur.fetchone()
+            if row and row[0]:
+                resolved_agent = str(row[0]).strip()
+        finally:
+            conn.close()
+
+        if not resolved_agent:
+            log("VPN_Tunnel/tunnel", f"vpn_agent_ensure_missing_agent guid={guid}", _context_hint(ctx), level="ERROR")
+            return jsonify({"error": "agent_id_missing"}), 404
+
+        if requested_agent and requested_agent != resolved_agent:
+            log(
+                "VPN_Tunnel/tunnel",
+                "vpn_agent_ensure_agent_mismatch requested={0} resolved={1}".format(
+                    requested_agent, resolved_agent
+                ),
+                _context_hint(ctx),
+                level="WARNING",
+            )
+
+        try:
+            tunnel_service = _get_tunnel_service(adapters)
+            endpoint_host = _infer_endpoint_host(request)
+            log(
+                "VPN_Tunnel/tunnel",
+                "vpn_agent_ensure_request agent_id={0} endpoint_host={1}".format(
+                    resolved_agent, endpoint_host or "-"
+                ),
+                _context_hint(ctx),
+            )
+            payload = tunnel_service.connect(
+                agent_id=resolved_agent,
+                operator_id=None,
+                endpoint_host=endpoint_host,
+            )
+        except Exception as exc:
+            log(
+                "VPN_Tunnel/tunnel",
+                "vpn_agent_ensure_failed agent_id={0} error={1}".format(resolved_agent, str(exc)),
+                _context_hint(ctx),
+                level="ERROR",
+            )
+            return jsonify({"error": "tunnel_start_failed", "detail": str(exc)}), 500
+
+        log(
+            "VPN_Tunnel/tunnel",
+            "vpn_agent_ensure_response agent_id={0} tunnel_id={1}".format(
+                payload.get("agent_id", resolved_agent), payload.get("tunnel_id", "-")
+            ),
+            _context_hint(ctx),
+        )
+        return jsonify(payload), 200
+
     app.register_blueprint(blueprint)

Data/Engine/services/API/devices/shell.py

@@ -1,12 +1,13 @@
 # ======================================================
-# Data\Engine\services\API\devices\rdp.py
-# Description: RDP session bootstrap for Guacamole WebSocket tunnels.
+# Data\Engine\services\API\devices\shell.py
+# Description: Remote PowerShell session endpoints for persistent WireGuard tunnels.
 #
 # API Endpoints (if applicable):
-# - POST /api/rdp/session (Token Authenticated) - Issues a one-time Guacamole tunnel token for RDP.
+# - POST /api/shell/establish (Token Authenticated) - Ensure shell readiness over WireGuard.
+# - POST /api/shell/disconnect (Token Authenticated) - Disconnect the operator shell session.
 # ======================================================
 
-"""RDP session bootstrap endpoints for the Borealis Engine."""
+"""Remote PowerShell session endpoints for the Borealis Engine."""
 from __future__ import annotations
 
 import os
@@ -16,7 +17,6 @@ from urllib.parse import urlsplit
 from flask import Blueprint, jsonify, request, session
 from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
 
-from ...RemoteDesktop.guacamole_proxy import GUAC_WS_PATH, ensure_guacamole_proxy
 from .tunnel import _get_tunnel_service
 
 if False:  # pragma: no cover - hint for type checkers
@@ -81,25 +81,18 @@ def _infer_endpoint_host(req) -> str:
     return host
 
 
-def _is_secure(req) -> bool:
-    if req.is_secure:
-        return True
-    forwarded = (req.headers.get("X-Forwarded-Proto") or "").split(",")[0].strip().lower()
-    return forwarded == "https"
-
-
-def register_rdp(app, adapters: "EngineServiceAdapters") -> None:
-    blueprint = Blueprint("rdp", __name__)
-    logger = adapters.context.logger.getChild("rdp.api")
+def register_shell(app, adapters: "EngineServiceAdapters") -> None:
+    blueprint = Blueprint("vpn_shell", __name__)
+    logger = adapters.context.logger.getChild("vpn_shell.api")
     service_log = adapters.service_log
 
     def _service_log_event(message: str, *, level: str = "INFO") -> None:
         if not callable(service_log):
             return
         try:
-            service_log("RDP", message, level=level)
+            service_log("VPN_Tunnel/remote_shell", message, level=level)
         except Exception:
-            logger.debug("rdp service log write failed", exc_info=True)
+            logger.debug("vpn_shell service log write failed", exc_info=True)
 
     def _request_remote() -> str:
         forwarded = (request.headers.get("X-Forwarded-For") or "").strip()
@@ -107,8 +100,8 @@ def register_rdp(app, adapters: "EngineServiceAdapters") -> None:
             return forwarded.split(",")[0].strip()
         return (request.remote_addr or "").strip()
 
-    @blueprint.route("/api/rdp/session", methods=["POST"])
-    def rdp_session():
+    @blueprint.route("/api/shell/establish", methods=["POST"])
+    def shell_establish():
         requirement = _require_login(app)
         if requirement:
             payload, status = requirement
@@ -119,77 +112,82 @@ def register_rdp(app, adapters: "EngineServiceAdapters") -> None:
 
         body = request.get_json(silent=True) or {}
         agent_id = _normalize_text(body.get("agent_id"))
-        protocol = _normalize_text(body.get("protocol") or "rdp").lower()
-        username = _normalize_text(body.get("username"))
-        password = str(body.get("password") or "")
+        if not agent_id:
+            return jsonify({"error": "agent_id_required"}), 400
+
+        try:
+            tunnel_service = _get_tunnel_service(adapters)
+            endpoint_host = _infer_endpoint_host(request)
+            _service_log_event(
+                "vpn_shell_establish_request agent_id={0} operator={1} endpoint_host={2} remote={3}".format(
+                    agent_id,
+                    operator_id or "-",
+                    endpoint_host or "-",
+                    _request_remote() or "-",
+                )
+            )
+            payload = tunnel_service.connect(
+                agent_id=agent_id,
+                operator_id=operator_id,
+                endpoint_host=endpoint_host,
+            )
+        except Exception as exc:
+            _service_log_event(
+                "vpn_shell_establish_failed agent_id={0} operator={1} error={2}".format(
+                    agent_id,
+                    operator_id or "-",
+                    str(exc),
+                ),
+                level="ERROR",
+            )
+            return jsonify({"error": "establish_failed", "detail": str(exc)}), 500
+
+        agent_socket = False
+        registry = getattr(adapters.context, "agent_socket_registry", None)
+        if registry and hasattr(registry, "is_registered"):
+            try:
+                agent_socket = bool(registry.is_registered(agent_id))
+            except Exception:
+                agent_socket = False
+
+        response = dict(payload)
+        response["status"] = "ok"
+        response["agent_socket"] = agent_socket
+        _service_log_event(
+            "vpn_shell_establish_response agent_id={0} tunnel_id={1} agent_socket={2}".format(
+                agent_id,
+                response.get("tunnel_id", "-"),
+                str(agent_socket).lower(),
+            )
+        )
+        return jsonify(response), 200
+
+    @blueprint.route("/api/shell/disconnect", methods=["POST"])
+    def shell_disconnect():
+        requirement = _require_login(app)
+        if requirement:
+            payload, status = requirement
+            return jsonify(payload), status
+
+        body = request.get_json(silent=True) or {}
+        agent_id = _normalize_text(body.get("agent_id"))
+        reason = _normalize_text(body.get("reason") or "operator_disconnect")
+        operator_id = (_current_user(app) or {}).get("username") or None
 
         if not agent_id:
             return jsonify({"error": "agent_id_required"}), 400
-        if protocol != "rdp":
-            return jsonify({"error": "unsupported_protocol"}), 400
-
-        tunnel_service = _get_tunnel_service(adapters)
-        session_payload = tunnel_service.session_payload(agent_id, include_token=False)
-        if not session_payload:
-            return jsonify({"error": "tunnel_down"}), 409
-
-        allowed_ports = session_payload.get("allowed_ports") or []
-        if 3389 not in allowed_ports:
-            return jsonify({"error": "rdp_not_allowed"}), 403
-
-        virtual_ip = _normalize_text(session_payload.get("virtual_ip"))
-        host = virtual_ip.split("/")[0] if virtual_ip else ""
-        if not host:
-            return jsonify({"error": "virtual_ip_missing"}), 500
-
-        registry = ensure_guacamole_proxy(adapters.context, logger=logger)
-        if registry is None:
-            return jsonify({"error": "rdp_proxy_unavailable"}), 503
 
         _service_log_event(
-            "rdp_session_request agent_id={0} operator={1} protocol={2} remote={3}".format(
+            "vpn_shell_disconnect_request agent_id={0} operator={1} reason={2} remote={3}".format(
                 agent_id,
                 operator_id or "-",
-                protocol,
+                reason or "-",
                 _request_remote() or "-",
             )
         )
-
-        rdp_session = registry.create(
-            agent_id=agent_id,
-            host=host,
-            port=3389,
-            username=username,
-            password=password,
-            protocol=protocol,
-            operator_id=operator_id,
-            ignore_cert=True,
-        )
-
-        ws_scheme = "wss" if _is_secure(request) else "ws"
-        ws_host = _infer_endpoint_host(request)
-        ws_port = int(getattr(adapters.context, "rdp_ws_port", 4823))
-        ws_url = f"{ws_scheme}://{ws_host}:{ws_port}{GUAC_WS_PATH}"
-
-        _service_log_event(
-            "rdp_session_ready agent_id={0} token={1} expires_at={2}".format(
-                agent_id,
-                rdp_session.token[:8],
-                int(rdp_session.expires_at),
-            )
-        )
-
-        return (
-            jsonify(
-                {
-                    "token": rdp_session.token,
-                    "ws_url": ws_url,
-                    "expires_at": int(rdp_session.expires_at),
-                    "virtual_ip": host,
-                    "tunnel_id": session_payload.get("tunnel_id"),
-                }
-            ),
-            200,
-        )
+        return jsonify({"status": "disconnected", "reason": reason}), 200
 
     app.register_blueprint(blueprint)
+
+
+__all__ = ["register_shell"]

Data/Engine/services/API/devices/tunnel.py

@@ -1,12 +1,11 @@
 # ======================================================
 # Data\Engine\services\API\devices\tunnel.py
-# Description: WireGuard VPN tunnel API (connect/status/disconnect).
+# Description: WireGuard VPN tunnel API (connect/status).
 #
 # API Endpoints (if applicable):
 # - POST /api/tunnel/connect (Token Authenticated) - Issues VPN session material for an agent.
 # - GET /api/tunnel/status (Token Authenticated) - Returns VPN status for an agent.
 # - GET /api/tunnel/active (Token Authenticated) - Lists active VPN tunnel sessions.
-# - DELETE /api/tunnel/disconnect (Token Authenticated) - Tears down VPN session for an agent.
 # ======================================================
 
 """WireGuard VPN tunnel API (Engine side)."""
@@ -254,52 +253,4 @@ def register_tunnel(app, adapters: "EngineServiceAdapters") -> None:
         )
         return jsonify({"count": len(sessions), "tunnels": sessions}), 200
 
-    @blueprint.route("/api/tunnel/disconnect", methods=["DELETE"])
-    def disconnect_tunnel():
-        requirement = _require_login(app)
-        if requirement:
-            payload, status = requirement
-            return jsonify(payload), status
-
-        body = request.get_json(silent=True) or {}
-        agent_id = _normalize_text(body.get("agent_id"))
-        tunnel_id = _normalize_text(body.get("tunnel_id"))
-        reason = _normalize_text(body.get("reason") or "operator_stop")
-
-        tunnel_service = _get_tunnel_service(adapters)
-        _service_log_event(
-            "vpn_api_disconnect_request agent_id={0} tunnel_id={1} reason={2} operator={3} remote={4}".format(
-                agent_id or "-",
-                tunnel_id or "-",
-                reason or "-",
-                (_current_user(app) or {}).get("username") or "-",
-                _request_remote() or "-",
-            )
-        )
-        stopped = False
-        if tunnel_id:
-            stopped = tunnel_service.disconnect_by_tunnel(tunnel_id, reason=reason)
-        elif agent_id:
-            stopped = tunnel_service.disconnect(agent_id, reason=reason)
-        else:
-            return jsonify({"error": "agent_id_required"}), 400
-
-        if not stopped:
-            _service_log_event(
-                "vpn_api_disconnect_not_found agent_id={0} tunnel_id={1}".format(
-                    agent_id or "-",
-                    tunnel_id or "-",
-                ),
-                level="WARNING",
-            )
-            return jsonify({"error": "not_found"}), 404
-
-        _service_log_event(
-            "vpn_api_disconnect_response agent_id={0} tunnel_id={1} status=stopped".format(
-                agent_id or "-",
-                tunnel_id or "-",
-            )
-        )
-        return jsonify({"status": "stopped", "reason": reason}), 200
-
     app.register_blueprint(blueprint)

Data/Engine/services/API/devices/vnc.py

@@ -0,0 +1,338 @@
+# ======================================================
+# Data\Engine\services\API\devices\vnc.py
+# Description: VNC session bootstrap for noVNC WebSocket tunnels.
+#
+# API Endpoints (if applicable):
+# - POST /api/vnc/establish (Token Authenticated) - Establish a VNC session for noVNC.
+# - POST /api/vnc/disconnect (Token Authenticated) - Disconnect the operator VNC session.
+# - POST /api/vnc/session (Token Authenticated) - Legacy alias for establish.
+# ======================================================
+
+"""VNC session bootstrap endpoints for the Borealis Engine."""
+from __future__ import annotations
+
+import os
+import secrets
+from typing import Any, Dict, Optional, Tuple
+from urllib.parse import urlsplit
+
+from flask import Blueprint, jsonify, request, session
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
+
+from ...RemoteDesktop.vnc_proxy import VNC_WS_PATH, ensure_vnc_proxy
+from .tunnel import _get_tunnel_service
+
+if False:  # pragma: no cover - hint for type checkers
+    from .. import EngineServiceAdapters
+
+
+def _current_user(app) -> Optional[Dict[str, str]]:
+    username = session.get("username")
+    role = session.get("role") or "User"
+    if username:
+        return {"username": username, "role": role}
+
+    token = None
+    auth_header = request.headers.get("Authorization") or ""
+    if auth_header.lower().startswith("bearer "):
+        token = auth_header.split(" ", 1)[1].strip()
+    if not token:
+        token = request.cookies.get("borealis_auth")
+    if not token:
+        return None
+
+    try:
+        serializer = URLSafeTimedSerializer(app.secret_key or "borealis-dev-secret", salt="borealis-auth")
+        token_ttl = int(os.environ.get("BOREALIS_TOKEN_TTL_SECONDS", 60 * 60 * 24 * 30))
+        data = serializer.loads(token, max_age=token_ttl)
+        username = data.get("u")
+        role = data.get("r") or "User"
+        if username:
+            return {"username": username, "role": role}
+    except (BadSignature, SignatureExpired, Exception):
+        return None
+    return None
+
+
+def _require_login(app) -> Optional[Tuple[Dict[str, Any], int]]:
+    user = _current_user(app)
+    if not user:
+        return {"error": "unauthorized"}, 401
+    return None
+
+
+def _normalize_text(value: Any) -> str:
+    if value is None:
+        return ""
+    try:
+        return str(value).strip()
+    except Exception:
+        return ""
+
+
+def _infer_endpoint_host(req) -> str:
+    forwarded = (req.headers.get("X-Forwarded-Host") or req.headers.get("X-Original-Host") or "").strip()
+    host = forwarded.split(",")[0].strip() if forwarded else (req.host or "").strip()
+    if not host:
+        return ""
+    try:
+        parsed = urlsplit(f"//{host}")
+        if parsed.hostname:
+            return parsed.hostname
+    except Exception:
+        return host
+    return host
+
+
+def _is_secure(req) -> bool:
+    if req.is_secure:
+        return True
+    forwarded = (req.headers.get("X-Forwarded-Proto") or "").split(",")[0].strip().lower()
+    return forwarded == "https"
+
+
+def _generate_vnc_password() -> str:
+    # UltraVNC uses the first 8 characters for VNC auth; keep the token to 8 for compatibility.
+    return secrets.token_hex(4)
+
+
+def _load_vnc_password(adapters: "EngineServiceAdapters", agent_id: str) -> Optional[str]:
+    conn = adapters.db_conn_factory()
+    try:
+        cur = conn.cursor()
+        cur.execute(
+            "SELECT agent_vnc_password FROM devices WHERE agent_id=? ORDER BY last_seen DESC LIMIT 1",
+            (agent_id,),
+        )
+        row = cur.fetchone()
+        if row and row[0]:
+            return str(row[0]).strip()
+    except Exception:
+        adapters.context.logger.debug("Failed to load agent VNC password", exc_info=True)
+    finally:
+        try:
+            conn.close()
+        except Exception:
+            pass
+    return None
+
+
+def _store_vnc_password(adapters: "EngineServiceAdapters", agent_id: str, password: str) -> None:
+    conn = adapters.db_conn_factory()
+    try:
+        cur = conn.cursor()
+        cur.execute(
+            "UPDATE devices SET agent_vnc_password=? WHERE agent_id=?",
+            (password, agent_id),
+        )
+        conn.commit()
+    except Exception:
+        adapters.context.logger.debug("Failed to store agent VNC password", exc_info=True)
+    finally:
+        try:
+            conn.close()
+        except Exception:
+            pass
+
+
+def register_vnc(app, adapters: "EngineServiceAdapters") -> None:
+    blueprint = Blueprint("vnc", __name__)
+    logger = adapters.context.logger.getChild("vnc.api")
+    service_log = adapters.service_log
+
+    def _service_log_event(message: str, *, level: str = "INFO") -> None:
+        if not callable(service_log):
+            return
+        try:
+            service_log("VNC", message, level=level)
+        except Exception:
+            logger.debug("vnc service log write failed", exc_info=True)
+
+    def _request_remote() -> str:
+        forwarded = (request.headers.get("X-Forwarded-For") or "").strip()
+        if forwarded:
+            return forwarded.split(",")[0].strip()
+        return (request.remote_addr or "").strip()
+
+    def _issue_session(agent_id: str, operator_id: Optional[str]) -> Tuple[Dict[str, Any], int]:
+        tunnel_service = _get_tunnel_service(adapters)
+        session_payload = tunnel_service.session_payload(agent_id, include_token=False)
+        if not session_payload:
+            try:
+                session_payload = tunnel_service.connect(
+                    agent_id=agent_id,
+                    operator_id=operator_id,
+                    endpoint_host=_infer_endpoint_host(request),
+                )
+            except Exception:
+                return {"error": "tunnel_down"}, 409
+
+        vnc_port = int(getattr(adapters.context, "vnc_port", 5900))
+        raw_ports = session_payload.get("allowed_ports") or []
+        allowed_ports = []
+        for value in raw_ports:
+            try:
+                allowed_ports.append(int(value))
+            except Exception:
+                continue
+        if vnc_port not in allowed_ports:
+            return {"error": "vnc_not_allowed", "vnc_port": vnc_port}, 403
+
+        virtual_ip = _normalize_text(session_payload.get("virtual_ip"))
+        host = virtual_ip.split("/")[0] if virtual_ip else ""
+        if not host:
+            return {"error": "virtual_ip_missing"}, 500
+
+        vnc_password = _load_vnc_password(adapters, agent_id)
+        if not vnc_password:
+            vnc_password = _generate_vnc_password()
+            _store_vnc_password(adapters, agent_id, vnc_password)
+        if len(vnc_password) > 8:
+            vnc_password = vnc_password[:8]
+            _store_vnc_password(adapters, agent_id, vnc_password)
+
+        registry = ensure_vnc_proxy(adapters.context, logger=logger)
+        if registry is None:
+            return {"error": "vnc_proxy_unavailable"}, 503
+
+        _service_log_event(
+            "vnc_establish_request agent_id={0} operator={1} remote={2}".format(
+                agent_id,
+                operator_id or "-",
+                _request_remote() or "-",
+            )
+        )
+
+        vnc_session = registry.create(
+            agent_id=agent_id,
+            host=host,
+            port=vnc_port,
+            operator_id=operator_id,
+        )
+
+        emit_agent = getattr(adapters.context, "emit_agent_event", None)
+        payload = {
+            "agent_id": agent_id,
+            "port": vnc_port,
+            "allowed_ips": session_payload.get("allowed_ips"),
+            "virtual_ip": host,
+            "password": vnc_password,
+            "reason": "vnc_session_start",
+        }
+        agent_socket_ready = True
+        if callable(emit_agent):
+            agent_socket_ready = bool(emit_agent(agent_id, "vnc_start", payload))
+            if agent_socket_ready:
+                _service_log_event(
+                    "vnc_start_emit agent_id={0} port={1} virtual_ip={2}".format(
+                        agent_id,
+                        vnc_port,
+                        host or "-",
+                    )
+                )
+            else:
+                _service_log_event(
+                    "vnc_start_emit_failed agent_id={0} port={1}".format(
+                        agent_id,
+                        vnc_port,
+                    ),
+                    level="WARNING",
+                )
+        if not agent_socket_ready:
+            return {"error": "agent_socket_missing"}, 409
+
+        ws_scheme = "wss" if _is_secure(request) else "ws"
+        ws_host = _infer_endpoint_host(request)
+        ws_port = int(getattr(adapters.context, "vnc_ws_port", 4823))
+        ws_url = f"{ws_scheme}://{ws_host}:{ws_port}{VNC_WS_PATH}"
+
+        _service_log_event(
+            "vnc_session_ready agent_id={0} token={1} expires_at={2}".format(
+                agent_id,
+                vnc_session.token[:8],
+                int(vnc_session.expires_at),
+            )
+        )
+
+        return (
+            {
+                "token": vnc_session.token,
+                "ws_url": ws_url,
+                "expires_at": int(vnc_session.expires_at),
+                "virtual_ip": host,
+                "tunnel_id": session_payload.get("tunnel_id"),
+                "engine_virtual_ip": session_payload.get("engine_virtual_ip"),
+                "allowed_ports": session_payload.get("allowed_ports"),
+                "vnc_password": vnc_password,
+                "vnc_port": vnc_port,
+            },
+            200,
+        )
+
+    @blueprint.route("/api/vnc/establish", methods=["POST"])
+    def vnc_establish():
+        requirement = _require_login(app)
+        if requirement:
+            payload, status = requirement
+            return jsonify(payload), status
+
+        user = _current_user(app) or {}
+        operator_id = user.get("username") or None
+
+        body = request.get_json(silent=True) or {}
+        agent_id = _normalize_text(body.get("agent_id"))
+
+        if not agent_id:
+            return jsonify({"error": "agent_id_required"}), 400
+
+        payload, status = _issue_session(agent_id, operator_id)
+        return jsonify(payload), status
+
+    @blueprint.route("/api/vnc/session", methods=["POST"])
+    def vnc_session():
+        return vnc_establish()
+
+    @blueprint.route("/api/vnc/disconnect", methods=["POST"])
+    def vnc_disconnect():
+        requirement = _require_login(app)
+        if requirement:
+            payload, status = requirement
+            return jsonify(payload), status
+
+        user = _current_user(app) or {}
+        operator_id = user.get("username") or None
+
+        body = request.get_json(silent=True) or {}
+        agent_id = _normalize_text(body.get("agent_id"))
+        reason = _normalize_text(body.get("reason") or "operator_disconnect")
+
+        if not agent_id:
+            return jsonify({"error": "agent_id_required"}), 400
+
+        registry = ensure_vnc_proxy(adapters.context, logger=logger)
+        revoked = 0
+        if registry is not None:
+            try:
+                revoked = registry.revoke_agent(agent_id)
+            except Exception:
+                revoked = 0
+
+        emit_agent = getattr(adapters.context, "emit_agent_event", None)
+        if callable(emit_agent):
+            try:
+                emit_agent(agent_id, "vnc_stop", {"agent_id": agent_id, "reason": reason})
+            except Exception:
+                pass
+
+        _service_log_event(
+            "vnc_disconnect agent_id={0} operator={1} reason={2} revoked={3}".format(
+                agent_id,
+                operator_id or "-",
+                reason or "-",
+                revoked,
+            )
+        )
+
+        return jsonify({"status": "disconnected", "revoked": revoked, "reason": reason}), 200
+
+    app.register_blueprint(blueprint)

Data/Engine/services/RemoteDesktop/__init__.py

@@ -1,9 +1,8 @@
 # ======================================================
 # Data\Engine\services\RemoteDesktop\__init__.py
-# Description: Remote desktop services (Guacamole proxy + session management).
+# Description: Remote desktop services (VNC proxy + session management).
 #
 # API Endpoints (if applicable): None
 # ======================================================
 
 """Remote desktop service helpers for the Borealis Engine runtime."""
-

Data/Engine/services/RemoteDesktop/guacamole_proxy.py

@@ -1,369 +0,0 @@
-# ======================================================
-# Data\Engine\services\RemoteDesktop\guacamole_proxy.py
-# Description: Guacamole tunnel proxy (WebSocket -> guacd) for RDP sessions.
-#
-# API Endpoints (if applicable): None
-# ======================================================
-
-"""Guacamole WebSocket proxy that bridges browser tunnels to guacd."""
-from __future__ import annotations
-
-import asyncio
-import logging
-import ssl
-import threading
-import time
-import uuid
-from dataclasses import dataclass
-from typing import Any, Dict, Optional, Tuple
-from urllib.parse import parse_qs, urlsplit
-
-import websockets
-
-GUAC_WS_PATH = "/guacamole"
-_MAX_MESSAGE_SIZE = 100_000_000
-
-
-@dataclass
-class RdpSession:
-    token: str
-    agent_id: str
-    host: str
-    port: int
-    protocol: str
-    username: str
-    password: str
-    ignore_cert: bool
-    created_at: float
-    expires_at: float
-    operator_id: Optional[str] = None
-    domain: Optional[str] = None
-    security: Optional[str] = None
-
-
-class RdpSessionRegistry:
-    def __init__(self, ttl_seconds: int, logger: logging.Logger) -> None:
-        self.ttl_seconds = max(30, int(ttl_seconds))
-        self.logger = logger
-        self._lock = threading.Lock()
-        self._sessions: Dict[str, RdpSession] = {}
-
-    def _cleanup(self, now: Optional[float] = None) -> None:
-        current = now if now is not None else time.time()
-        expired = [token for token, session in self._sessions.items() if session.expires_at <= current]
-        for token in expired:
-            self._sessions.pop(token, None)
-
-    def create(
-        self,
-        *,
-        agent_id: str,
-        host: str,
-        port: int,
-        username: str,
-        password: str,
-        protocol: str = "rdp",
-        ignore_cert: bool = True,
-        operator_id: Optional[str] = None,
-        domain: Optional[str] = None,
-        security: Optional[str] = None,
-    ) -> RdpSession:
-        token = uuid.uuid4().hex
-        now = time.time()
-        expires_at = now + self.ttl_seconds
-        session = RdpSession(
-            token=token,
-            agent_id=agent_id,
-            host=host,
-            port=port,
-            protocol=protocol,
-            username=username,
-            password=password,
-            ignore_cert=ignore_cert,
-            created_at=now,
-            expires_at=expires_at,
-            operator_id=operator_id,
-            domain=domain,
-            security=security,
-        )
-        with self._lock:
-            self._cleanup(now)
-            self._sessions[token] = session
-        return session
-
-    def consume(self, token: str) -> Optional[RdpSession]:
-        if not token:
-            return None
-        with self._lock:
-            self._cleanup()
-            session = self._sessions.pop(token, None)
-        return session
-
-
-class GuacamoleProxyServer:
-    def __init__(
-        self,
-        *,
-        host: str,
-        port: int,
-        guacd_host: str,
-        guacd_port: int,
-        registry: RdpSessionRegistry,
-        logger: logging.Logger,
-        ssl_context: Optional[ssl.SSLContext] = None,
-    ) -> None:
-        self.host = host
-        self.port = port
-        self.guacd_host = guacd_host
-        self.guacd_port = guacd_port
-        self.registry = registry
-        self.logger = logger
-        self.ssl_context = ssl_context
-        self._thread: Optional[threading.Thread] = None
-        self._ready = threading.Event()
-        self._failed = threading.Event()
-
-    def ensure_started(self, timeout: float = 3.0) -> bool:
-        if self._thread and self._thread.is_alive():
-            return not self._failed.is_set()
-        self._failed.clear()
-        self._ready.clear()
-        self._thread = threading.Thread(target=self._run, daemon=True)
-        self._thread.start()
-        self._ready.wait(timeout)
-        return not self._failed.is_set()
-
-    def _run(self) -> None:
-        try:
-            asyncio.run(self._serve())
-        except Exception as exc:
-            self._failed.set()
-            self.logger.error("Guacamole proxy server failed: %s", exc)
-            self._ready.set()
-
-    async def _serve(self) -> None:
-        self.logger.info(
-            "Starting Guacamole proxy on %s:%s (guacd %s:%s)",
-            self.host,
-            self.port,
-            self.guacd_host,
-            self.guacd_port,
-        )
-        try:
-            server = await websockets.serve(
-                self._handle_client,
-                self.host,
-                self.port,
-                ssl=self.ssl_context,
-                max_size=_MAX_MESSAGE_SIZE,
-                ping_interval=20,
-                ping_timeout=20,
-            )
-        except Exception:
-            self._failed.set()
-            self._ready.set()
-            raise
-        self._ready.set()
-        await server.wait_closed()
-
-    async def _handle_client(self, websocket, path: str) -> None:
-        parsed = urlsplit(path)
-        if parsed.path != GUAC_WS_PATH:
-            await websocket.close(code=1008, reason="invalid_path")
-            return
-        query = parse_qs(parsed.query or "")
-        token = (query.get("token") or [""])[0]
-        session = self.registry.consume(token)
-        if not session:
-            await websocket.close(code=1008, reason="invalid_session")
-            return
-
-        logger = self.logger.getChild("session")
-        logger.info("Guacamole session start agent_id=%s protocol=%s", session.agent_id, session.protocol)
-
-        try:
-            reader, writer = await asyncio.open_connection(self.guacd_host, self.guacd_port)
-        except Exception as exc:
-            logger.warning("guacd connect failed: %s", exc)
-            await websocket.close(code=1011, reason="guacd_unavailable")
-            return
-
-        try:
-            await self._perform_handshake(reader, writer, session)
-        except Exception as exc:
-            logger.warning("guacd handshake failed: %s", exc)
-            try:
-                writer.close()
-                await writer.wait_closed()
-            except Exception:
-                pass
-            await websocket.close(code=1011, reason="handshake_failed")
-            return
-
-        async def _ws_to_guacd() -> None:
-            try:
-                async for message in websocket:
-                    if message is None:
-                        break
-                    if isinstance(message, str):
-                        data = message.encode("utf-8")
-                    else:
-                        data = bytes(message)
-                    writer.write(data)
-                    await writer.drain()
-            finally:
-                try:
-                    writer.close()
-                except Exception:
-                    pass
-
-        async def _guacd_to_ws() -> None:
-            try:
-                while True:
-                    data = await reader.read(8192)
-                    if not data:
-                        break
-                    await websocket.send(data.decode("utf-8", errors="ignore"))
-            finally:
-                try:
-                    await websocket.close()
-                except Exception:
-                    pass
-
-        await asyncio.wait(
-            [asyncio.create_task(_ws_to_guacd()), asyncio.create_task(_guacd_to_ws())],
-            return_when=asyncio.FIRST_COMPLETED,
-        )
-
-        logger.info("Guacamole session ended agent_id=%s", session.agent_id)
-
-    async def _perform_handshake(self, reader, writer, session: RdpSession) -> None:
-        writer.write(_encode_instruction("select", session.protocol))
-        await writer.drain()
-
-        buffer = b""
-        args = None
-        deadline = time.time() + 8
-
-        while time.time() < deadline:
-            parts, buffer = await _read_instruction(reader, buffer)
-            if not parts:
-                continue
-            op = parts[0]
-            if op == "args":
-                args = parts[1:]
-                break
-            if op == "error":
-                raise RuntimeError("guacd_error:" + " ".join(parts[1:]))
-        if not args:
-            raise RuntimeError("guacd_args_timeout")
-
-        params = {
-            "hostname": session.host,
-            "port": str(session.port),
-            "username": session.username or "",
-            "password": session.password or "",
-        }
-        if session.domain:
-            params["domain"] = session.domain
-        if session.security:
-            params["security"] = session.security
-        if session.ignore_cert:
-            params["ignore-cert"] = "true"
-
-        values = [params.get(name, "") for name in args]
-        writer.write(_encode_instruction("connect", *values))
-        await writer.drain()
-
-
-def _encode_instruction(*elements: str) -> bytes:
-    parts = []
-    for element in elements:
-        text = "" if element is None else str(element)
-        parts.append(f"{len(text)}.{text}".encode("utf-8"))
-    return b",".join(parts) + b";"
-
-
-def _parse_instruction(raw: bytes) -> Tuple[str, ...]:
-    parts = []
-    idx = 0
-    length = len(raw)
-    while idx < length:
-        dot = raw.find(b".", idx)
-        if dot < 0:
-            break
-        try:
-            element_len = int(raw[idx:dot].decode("ascii") or "0")
-        except Exception:
-            break
-        start = dot + 1
-        end = start + element_len
-        if end > length:
-            break
-        parts.append(raw[start:end].decode("utf-8", errors="ignore"))
-        idx = end
-        if idx < length and raw[idx:idx + 1] == b",":
-            idx += 1
-    return tuple(parts)
-
-
-async def _read_instruction(reader, buffer: bytes) -> Tuple[Tuple[str, ...], bytes]:
-    while b";" not in buffer:
-        chunk = await reader.read(4096)
-        if not chunk:
-            break
-        buffer += chunk
-    if b";" not in buffer:
-        return tuple(), buffer
-    instruction, remainder = buffer.split(b";", 1)
-    if not instruction:
-        return tuple(), remainder
-    return _parse_instruction(instruction), remainder
-
-
-def _build_ssl_context(cert_path: Optional[str], key_path: Optional[str]) -> Optional[ssl.SSLContext]:
-    if not cert_path or not key_path:
-        return None
-    try:
-        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        context.load_cert_chain(certfile=cert_path, keyfile=key_path)
-        return context
-    except Exception:
-        return None
-
-
-def ensure_guacamole_proxy(context: Any, *, logger: Optional[logging.Logger] = None) -> Optional[RdpSessionRegistry]:
-    if logger is None:
-        logger = context.logger if hasattr(context, "logger") else logging.getLogger("borealis.engine.rdp")
-
-    registry = getattr(context, "rdp_registry", None)
-    if registry is None:
-        ttl = int(getattr(context, "rdp_session_ttl_seconds", 120))
-        registry = RdpSessionRegistry(ttl_seconds=ttl, logger=logger)
-        setattr(context, "rdp_registry", registry)
-
-    proxy = getattr(context, "rdp_proxy", None)
-    if proxy is None:
-        cert_path = getattr(context, "tls_bundle_path", None) or getattr(context, "tls_cert_path", None)
-        ssl_context = _build_ssl_context(
-            cert_path,
-            getattr(context, "tls_key_path", None),
-        )
-        proxy = GuacamoleProxyServer(
-            host=str(getattr(context, "rdp_ws_host", "0.0.0.0")),
-            port=int(getattr(context, "rdp_ws_port", 4823)),
-            guacd_host=str(getattr(context, "guacd_host", "127.0.0.1")),
-            guacd_port=int(getattr(context, "guacd_port", 4822)),
-            registry=registry,
-            logger=logger.getChild("guacamole_proxy"),
-            ssl_context=ssl_context,
-        )
-        setattr(context, "rdp_proxy", proxy)
-
-    if not proxy.ensure_started():
-        logger.error("Guacamole proxy failed to start; RDP sessions unavailable.")
-        return None
-    return registry
-
-
-__all__ = ["GUAC_WS_PATH", "RdpSessionRegistry", "GuacamoleProxyServer", "ensure_guacamole_proxy"]

Data/Engine/services/RemoteDesktop/vnc_proxy.py

@@ -0,0 +1,285 @@
+# ======================================================
+# Data\Engine\services\RemoteDesktop\vnc_proxy.py
+# Description: VNC tunnel proxy (WebSocket -> TCP) for noVNC sessions.
+#
+# API Endpoints (if applicable): None
+# ======================================================
+
+"""VNC WebSocket proxy that bridges browser sessions to agent VNC servers."""
+from __future__ import annotations
+
+import asyncio
+import logging
+import ssl
+import threading
+import time
+import uuid
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, Optional, Tuple
+from urllib.parse import parse_qs, urlsplit
+
+import websockets
+
+VNC_WS_PATH = "/vnc"
+_MAX_MESSAGE_SIZE = 100_000_000
+
+
+@dataclass
+class VncSession:
+    token: str
+    agent_id: str
+    host: str
+    port: int
+    created_at: float
+    expires_at: float
+    operator_id: Optional[str] = None
+
+
+class VncSessionRegistry:
+    def __init__(self, ttl_seconds: int, logger: logging.Logger) -> None:
+        self.ttl_seconds = max(30, int(ttl_seconds))
+        self.logger = logger
+        self._lock = threading.Lock()
+        self._sessions: Dict[str, VncSession] = {}
+
+    def _cleanup(self, now: Optional[float] = None) -> None:
+        current = now if now is not None else time.time()
+        expired = [token for token, session in self._sessions.items() if session.expires_at <= current]
+        for token in expired:
+            self._sessions.pop(token, None)
+
+    def create(
+        self,
+        *,
+        agent_id: str,
+        host: str,
+        port: int,
+        operator_id: Optional[str] = None,
+    ) -> VncSession:
+        token = uuid.uuid4().hex
+        now = time.time()
+        expires_at = now + self.ttl_seconds
+        session = VncSession(
+            token=token,
+            agent_id=agent_id,
+            host=host,
+            port=port,
+            created_at=now,
+            expires_at=expires_at,
+            operator_id=operator_id,
+        )
+        with self._lock:
+            self._cleanup(now)
+            self._sessions[token] = session
+        return session
+
+    def consume(self, token: str) -> Optional[VncSession]:
+        if not token:
+            return None
+        with self._lock:
+            self._cleanup()
+            session = self._sessions.pop(token, None)
+        return session
+
+    def revoke_agent(self, agent_id: str) -> int:
+        if not agent_id:
+            return 0
+        removed = 0
+        with self._lock:
+            self._cleanup()
+            tokens = [token for token, session in self._sessions.items() if session.agent_id == agent_id]
+            for token in tokens:
+                if self._sessions.pop(token, None):
+                    removed += 1
+        return removed
+
+
+class VncProxyServer:
+    def __init__(
+        self,
+        *,
+        host: str,
+        port: int,
+        registry: VncSessionRegistry,
+        logger: logging.Logger,
+        emit_agent_event: Optional[Callable[[str, str, Any], bool]] = None,
+        ssl_context: Optional[ssl.SSLContext] = None,
+    ) -> None:
+        self.host = host
+        self.port = port
+        self.registry = registry
+        self.logger = logger
+        self._emit_agent_event = emit_agent_event
+        self.ssl_context = ssl_context
+        self._thread: Optional[threading.Thread] = None
+        self._ready = threading.Event()
+        self._failed = threading.Event()
+
+    def ensure_started(self, timeout: float = 3.0) -> bool:
+        if self._thread and self._thread.is_alive():
+            return not self._failed.is_set()
+        self._failed.clear()
+        self._ready.clear()
+        self._thread = threading.Thread(target=self._run, daemon=True)
+        self._thread.start()
+        self._ready.wait(timeout)
+        return not self._failed.is_set()
+
+    def _run(self) -> None:
+        try:
+            asyncio.run(self._serve())
+        except Exception as exc:
+            self._failed.set()
+            self.logger.error("VNC proxy server failed: %s", exc)
+            self._ready.set()
+
+    async def _serve(self) -> None:
+        self.logger.info("Starting VNC proxy on %s:%s", self.host, self.port)
+        try:
+            server = await websockets.serve(
+                self._handle_client,
+                self.host,
+                self.port,
+                ssl=self.ssl_context,
+                max_size=_MAX_MESSAGE_SIZE,
+                ping_interval=20,
+                ping_timeout=20,
+            )
+        except Exception:
+            self._failed.set()
+            self._ready.set()
+            raise
+        self._ready.set()
+        await server.wait_closed()
+
+    async def _handle_client(self, websocket, path: str) -> None:
+        parsed = urlsplit(path)
+        if parsed.path != VNC_WS_PATH:
+            await websocket.close(code=1008, reason="invalid_path")
+            return
+        query = parse_qs(parsed.query or "")
+        token = (query.get("token") or [""])[0]
+        session = self.registry.consume(token)
+        if not session:
+            await websocket.close(code=1008, reason="invalid_session")
+            return
+
+        logger = self.logger.getChild("session")
+        logger.info("VNC session start agent_id=%s", session.agent_id)
+
+        try:
+            try:
+                reader, writer = await self._connect_vnc(session.host, session.port)
+            except Exception as exc:
+                logger.warning("VNC connect failed: %s", exc)
+                await websocket.close(code=1011, reason="vnc_unavailable")
+                return
+
+            async def _ws_to_tcp() -> None:
+                try:
+                    async for message in websocket:
+                        if message is None:
+                            break
+                        if isinstance(message, str):
+                            data = message.encode("utf-8")
+                        else:
+                            data = bytes(message)
+                        writer.write(data)
+                        await writer.drain()
+                finally:
+                    try:
+                        writer.close()
+                    except Exception:
+                        pass
+
+            async def _tcp_to_ws() -> None:
+                try:
+                    while True:
+                        data = await reader.read(8192)
+                        if not data:
+                            break
+                        await websocket.send(data)
+                finally:
+                    try:
+                        await websocket.close()
+                    except Exception:
+                        pass
+
+            await asyncio.wait(
+                [asyncio.create_task(_ws_to_tcp()), asyncio.create_task(_tcp_to_ws())],
+                return_when=asyncio.FIRST_COMPLETED,
+            )
+        finally:
+            logger.info("VNC session ended agent_id=%s", session.agent_id)
+            self._notify_agent_session_end(session, reason="vnc_session_end")
+
+    async def _connect_vnc(self, host: str, port: int) -> Tuple[Any, Any]:
+        attempts = 5
+        delay = 0.5
+        last_exc: Optional[Exception] = None
+        for attempt in range(attempts):
+            try:
+                return await asyncio.open_connection(host, port)
+            except Exception as exc:
+                last_exc = exc
+                if attempt < attempts - 1:
+                    await asyncio.sleep(delay)
+        if last_exc:
+            raise last_exc
+        raise RuntimeError("vnc_connect_failed")
+
+    def _notify_agent_session_end(self, session: VncSession, reason: str) -> None:
+        if not self._emit_agent_event:
+            return
+        payload = {"agent_id": session.agent_id, "reason": reason}
+        try:
+            self._emit_agent_event(session.agent_id, "vnc_stop", payload)
+        except Exception:
+            self.logger.debug("Failed to emit vnc_stop for agent_id=%s", session.agent_id, exc_info=True)
+
+
+def _build_ssl_context(cert_path: Optional[str], key_path: Optional[str]) -> Optional[ssl.SSLContext]:
+    if not cert_path or not key_path:
+        return None
+    try:
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain(certfile=cert_path, keyfile=key_path)
+        return context
+    except Exception:
+        return None
+
+
+def ensure_vnc_proxy(context: Any, *, logger: Optional[logging.Logger] = None) -> Optional[VncSessionRegistry]:
+    if logger is None:
+        logger = context.logger if hasattr(context, "logger") else logging.getLogger("borealis.engine.vnc")
+
+    registry = getattr(context, "vnc_registry", None)
+    if registry is None:
+        ttl = int(getattr(context, "vnc_session_ttl_seconds", 120))
+        registry = VncSessionRegistry(ttl_seconds=ttl, logger=logger)
+        setattr(context, "vnc_registry", registry)
+
+    proxy = getattr(context, "vnc_proxy", None)
+    if proxy is None:
+        cert_path = getattr(context, "tls_bundle_path", None) or getattr(context, "tls_cert_path", None)
+        ssl_context = _build_ssl_context(
+            cert_path,
+            getattr(context, "tls_key_path", None),
+        )
+        proxy = VncProxyServer(
+            host=str(getattr(context, "vnc_ws_host", "0.0.0.0")),
+            port=int(getattr(context, "vnc_ws_port", 4823)),
+            registry=registry,
+            logger=logger.getChild("vnc_proxy"),
+            emit_agent_event=getattr(context, "emit_agent_event", None),
+            ssl_context=ssl_context,
+        )
+        setattr(context, "vnc_proxy", proxy)
+
+    if not proxy.ensure_started():
+        logger.error("VNC proxy failed to start; VNC sessions unavailable.")
+        return None
+    return registry
+
+
+__all__ = ["VNC_WS_PATH", "VncSessionRegistry", "VncProxyServer", "ensure_vnc_proxy"]

Data/Engine/services/VPN/vpn_tunnel_service.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import base64
 import ipaddress
 import json
+import os
 import threading
 import time
 import uuid
@@ -22,6 +23,13 @@ from typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence, Tuple
 from .wireguard_server import WireGuardServerManager
 
 
+def _env_flag(name: str, *, default: bool) -> bool:
+    value = os.environ.get(name)
+    if value is None:
+        return default
+    return str(value).strip().lower() not in ("0", "false", "no", "off")
+
+
 @dataclass
 class VpnSession:
     tunnel_id: str
@@ -62,14 +70,17 @@ class VpnTunnelService:
         self.logger = context.logger.getChild("vpn_tunnel")
         self.activity_logger = self.wg.logger.getChild("device_activity")
         self.idle_seconds = max(60, int(idle_seconds))
+        self.persistent = _env_flag("BOREALIS_WIREGUARD_PERSISTENT", default=True)
         self._lock = threading.Lock()
         self._sessions_by_agent: Dict[str, VpnSession] = {}
         self._sessions_by_tunnel: Dict[str, VpnSession] = {}
         self._engine_ip = ipaddress.ip_interface(context.wireguard_engine_virtual_ip)
         self._peer_network = ipaddress.ip_network(context.wireguard_peer_network, strict=False)
         self._cleanup_listener()
-        self._idle_thread = threading.Thread(target=self._idle_loop, daemon=True)
-        self._idle_thread.start()
+        self._idle_thread: Optional[threading.Thread] = None
+        if not self.persistent:
+            self._idle_thread = threading.Thread(target=self._idle_loop, daemon=True)
+            self._idle_thread.start()
 
     def _idle_loop(self) -> None:
         while True:
@@ -90,7 +101,7 @@ class VpnTunnelService:
                         self.idle_seconds,
                     )
                 )
-                self.disconnect(session.agent_id, reason="idle_timeout")
+                self.disconnect(session.agent_id, reason="idle_timeout", force=True)
 
     def _allocate_virtual_ip(self, agent_id: str) -> str:
         existing = self._sessions_by_agent.get(agent_id)
@@ -226,12 +237,12 @@ class VpnTunnelService:
             self.logger.debug("Failed to write vpn_tunnel service log entry", exc_info=True)
 
     def _cleanup_listener(self) -> None:
-        try:
-            self.wg.stop_listener(ignore_missing=True)
-            self._service_log_event("vpn_listener_cleanup reason=startup")
-        except Exception:
-            self.logger.debug("Failed to clean up WireGuard listener on startup.", exc_info=True)
-            self._service_log_event("vpn_listener_cleanup_failed reason=startup", level="WARNING")
+        self._service_log_event("vpn_listener_cleanup_skipped reason=startup")
+
+    def _is_soft_disconnect(self, reason: Optional[str]) -> bool:
+        if not reason:
+            return False
+        return str(reason).lower() in ("operator_disconnect", "component_unmount")
 
     def _refresh_listener(self) -> None:
         peers: List[Mapping[str, object]] = []
@@ -432,15 +443,60 @@ class VpnTunnelService:
         except Exception:
             self.logger.debug("vpn_tunnel_activity emit failed for agent_id=%s", agent_id, exc_info=True)
 
-    def disconnect(self, agent_id: str, reason: str = "operator_stop") -> bool:
+    def disconnect(
+        self,
+        agent_id: str,
+        reason: str = "operator_stop",
+        *,
+        operator_id: Optional[str] = None,
+        force: bool = False,
+    ) -> bool:
         with self._lock:
-            session = self._sessions_by_agent.pop(agent_id, None)
+            session = self._sessions_by_agent.get(agent_id)
             if not session:
                 self._service_log_event(
                     "vpn_tunnel_disconnect_missing agent_id={0} reason={1}".format(agent_id or "-", reason or "-")
                 )
                 return False
-            self._sessions_by_tunnel.pop(session.tunnel_id, None)
+            if self.persistent and not force:
+                if operator_id:
+                    try:
+                        session.operator_ids.discard(operator_id)
+                    except Exception:
+                        pass
+                session.last_activity = time.time()
+                operator_text = ",".join(sorted(filter(None, session.operator_ids))) or "-"
+                self._service_log_event(
+                    "vpn_tunnel_keepalive agent_id={0} tunnel_id={1} reason={2} operators={3}".format(
+                        session.agent_id,
+                        session.tunnel_id,
+                        reason or "-",
+                        operator_text,
+                    )
+                )
+                return True
+            if not force and self._is_soft_disconnect(reason):
+                if operator_id:
+                    try:
+                        session.operator_ids.discard(operator_id)
+                    except Exception:
+                        pass
+                session.last_activity = time.time()
+                operator_text = ",".join(sorted(filter(None, session.operator_ids))) or "-"
+                self._service_log_event(
+                    "vpn_tunnel_keepalive agent_id={0} tunnel_id={1} reason={2} operators={3}".format(
+                        session.agent_id,
+                        session.tunnel_id,
+                        reason or "-",
+                        operator_text,
+                    )
+                )
+                return True
+            session = self._sessions_by_agent.pop(agent_id, None)
+            if session:
+                self._sessions_by_tunnel.pop(session.tunnel_id, None)
+            else:
+                return False
 
         try:
             self.wg.remove_firewall_rules(session.firewall_rules)
@@ -461,7 +517,14 @@ class VpnTunnelService:
         self._log_device_activity(session, event="stop", reason=reason)
         return True
 
-    def disconnect_by_tunnel(self, tunnel_id: str, reason: str = "operator_stop") -> bool:
+    def disconnect_by_tunnel(
+        self,
+        tunnel_id: str,
+        reason: str = "operator_stop",
+        *,
+        operator_id: Optional[str] = None,
+        force: bool = False,
+    ) -> bool:
         with self._lock:
             session = self._sessions_by_tunnel.get(tunnel_id)
         if not session:
@@ -469,7 +532,7 @@ class VpnTunnelService:
                 "vpn_tunnel_disconnect_missing tunnel_id={0} reason={1}".format(tunnel_id or "-", reason or "-")
             )
             return False
-        return self.disconnect(session.agent_id, reason=reason)
+        return self.disconnect(session.agent_id, reason=reason, operator_id=operator_id, force=force)
 
     def _emit_start(self, payload: Mapping[str, Any]) -> None:
         if not self.socketio:
@@ -704,7 +767,7 @@ class VpnTunnelService:
             "server_public_key": self.wg.server_public_key,
             "client_public_key": session.client_public_key,
             "client_private_key": session.client_private_key,
-            "idle_seconds": self.idle_seconds,
+            "idle_seconds": 0 if self.persistent else self.idle_seconds,
             "allowed_ports": list(session.allowed_ports),
             "connected_operators": len([o for o in session.operator_ids if o]),
         }
@@ -729,6 +792,6 @@ class VpnTunnelService:
             "last_activity_iso": self._ts_to_iso(session.last_activity),
             "expires_at": int(session.expires_at),
             "expires_at_iso": self._ts_to_iso(session.expires_at),
-            "idle_seconds": self.idle_seconds,
+            "idle_seconds": 0 if self.persistent else self.idle_seconds,
             "status": "up",
         }

Data/Engine/services/VPN/wireguard_server.py

@@ -164,6 +164,25 @@ class WireGuardServerManager:
                 return match.group(1).upper()
         return None
 
+    def _service_exists(self) -> bool:
+        code, _, _ = self._run_command(["sc.exe", "query", self._service_id()])
+        return code == 0
+
+    def _stop_service(self, *, timeout: int = 20) -> bool:
+        service_id = self._service_id()
+        state = self._query_service_state()
+        if not state:
+            return False
+        if state == "STOPPED":
+            return True
+        self._run_command(["sc.exe", "stop", service_id])
+        for _ in range(max(1, timeout)):
+            time.sleep(1)
+            state = self._query_service_state()
+            if state == "STOPPED":
+                return True
+        return False
+
     def _ensure_service_display_name(self) -> None:
         if not self._service_display_name:
             return
@@ -172,9 +191,9 @@ class WireGuardServerManager:
         if code != 0 and err:
             self.logger.warning("Failed to set WireGuard service display name: %s", err)
 
-    def _ensure_service_running(self) -> None:
+    def _ensure_service_running(self, *, timeout: int = 20) -> None:
         service_id = self._service_id()
-        for _ in range(6):
+        for _ in range(max(1, timeout)):
             state = self._query_service_state()
             if state == "RUNNING":
                 return
@@ -183,8 +202,20 @@ class WireGuardServerManager:
                 if code != 0:
                     self.logger.error("Failed to start WireGuard tunnel service %s err=%s", service_id, err)
                     break
+            if state in ("START_PENDING", "STOP_PENDING"):
+                time.sleep(1)
+                continue
             time.sleep(1)
         state = self._query_service_state()
+        if state == "START_PENDING":
+            self.logger.warning("WireGuard tunnel service still START_PENDING; attempting restart.")
+            self._stop_service(timeout=10)
+            self._run_command(["sc.exe", "start", service_id])
+            for _ in range(10):
+                time.sleep(1)
+                if self._query_service_state() == "RUNNING":
+                    return
+            state = self._query_service_state()
         raise RuntimeError(f"WireGuard tunnel service {service_id} failed to start (state={state})")
 
     def _normalise_allowed_ports(
@@ -329,6 +360,7 @@ class WireGuardServerManager:
         for idx, rule in enumerate(rules):
             name = f"Borealis-WG-Agent-{peer.get('agent_id','')}-{idx}"
             protocol = str(rule.get("protocol") or "TCP").upper()
+            self._run_command(["netsh", "advfirewall", "firewall", "delete", "rule", f"name={name}"])
             args = [
                 "netsh",
                 "advfirewall",
@@ -374,8 +406,12 @@ class WireGuardServerManager:
         config_path.write_text(rendered, encoding="utf-8")
         self.logger.info("Rendered WireGuard config to %s", config_path)
 
-        # Ensure old service is removed before re-installing.
-        self.stop_listener()
+        if self._service_exists():
+            if not self._stop_service(timeout=20):
+                self.logger.warning("WireGuard tunnel service did not stop cleanly before restart.")
+            self._ensure_service_display_name()
+            self._ensure_service_running(timeout=25)
+            return
 
         args = [self._wireguard_exe, "/installtunnelservice", str(config_path)]
         code, out, err = self._run_command(args)
@@ -384,21 +420,22 @@ class WireGuardServerManager:
             raise RuntimeError(f"WireGuard installtunnelservice failed: {err}")
         self.logger.info("WireGuard listener installed (service=%s)", config_path.stem)
         self._ensure_service_display_name()
-        self._ensure_service_running()
+        self._ensure_service_running(timeout=25)
 
     def stop_listener(self, *, ignore_missing: bool = False) -> None:
-        """Stop and remove the WireGuard tunnel service."""
+        """Stop the WireGuard tunnel service (leave installed for reuse)."""
 
-        args = [self._wireguard_exe, "/uninstalltunnelservice", self._service_name]
-        code, out, err = self._run_command(args)
-        if code != 0:
-            err_text = " ".join([out or "", err or ""]).strip().lower()
-            if ignore_missing and ("does not exist" in err_text or "not exist" in err_text):
+        if not self._service_exists():
+            if ignore_missing:
                 self.logger.info("WireGuard tunnel service already absent")
                 return
-            self.logger.warning("Failed to uninstall WireGuard tunnel service code=%s err=%s", code, err)
-        else:
-            self.logger.info("WireGuard tunnel service removed")
+            self.logger.warning("WireGuard tunnel service not found during stop.")
+            return
+
+        if not self._stop_service(timeout=20):
+            self.logger.warning("WireGuard tunnel service did not stop cleanly.")
+            return
+        self.logger.info("WireGuard tunnel service stopped")
 
     def build_firewall_rules(
         self,

Data/Engine/services/WebSocket/vpn_shell.py

@@ -187,7 +187,10 @@ class VpnShellBridge:
             existing.close()
         status = service.status(agent_id)
         if not status:
-            return None
+            try:
+                status = service.connect(agent_id=agent_id, operator_id=None, endpoint_host=None)
+            except Exception:
+                return None
         host = str(status.get("virtual_ip") or "").split("/")[0]
         port = int(self.context.wireguard_shell_port)
         tcp = None

Data/Engine/web-interface/package.json

@@ -18,8 +18,8 @@
     "@mui/x-tree-view": "8.10.0",
     "ag-grid-community": "34.2.0",
     "ag-grid-react": "34.2.0",
+    "@novnc/novnc": "^1.4.0",
     "dayjs": "1.11.18",
-    "guacamole-common-js": "1.5.0",
     "normalize.css": "8.0.1",
     "prismjs": "1.30.0",
     "react-simple-code-editor": "0.13.1",

Data/Engine/web-interface/src/Devices/Device_Details.jsx

@@ -43,7 +43,7 @@ import Editor from "react-simple-code-editor";
 import { AgGridReact } from "ag-grid-react";
 import { ModuleRegistry, AllCommunityModule, themeQuartz } from "ag-grid-community";
 import ReverseTunnelPowershell from "./ReverseTunnel/Powershell.jsx";
-import ReverseTunnelRdp from "./ReverseTunnel/RDP.jsx";
+import ReverseTunnelVnc from "./ReverseTunnel/VNC.jsx";
 
 ModuleRegistry.registerModules([AllCommunityModule]);
 
@@ -85,12 +85,6 @@ const buildVpnGroups = (shellPort) => {
       description: "Web terminal access over the VPN tunnel.",
       ports: [normalizedShell],
     },
-    {
-      key: "rdp",
-      label: "RDP",
-      description: "Remote Desktop (TCP 3389).",
-      ports: [3389],
-    },
     {
       key: "winrm",
       label: "WinRM",
@@ -121,7 +115,7 @@ const TOP_TABS = [
   { key: "activity", label: "Activity History", icon: ListAltRoundedIcon },
   { key: "advanced", label: "Advanced Config", icon: TuneRoundedIcon },
   { key: "shell", label: "Remote Shell", icon: TerminalRoundedIcon },
-  { key: "rdp", label: "Remote Desktop", icon: DesktopWindowsRoundedIcon },
+  { key: "vnc", label: "Remote Desktop (VNC)", icon: DesktopWindowsRoundedIcon },
 ];
 
 const myTheme = themeQuartz.withParams({
@@ -1542,7 +1536,7 @@ export default function DeviceDetails({ device, onBack, onQuickJobLaunch, onPage
         minHeight: 0,
       }}
     >
-      <ReverseTunnelRdp device={tunnelDevice} />
+      <ReverseTunnelVnc device={tunnelDevice} />
     </Box>
   );
 

Data/Engine/web-interface/src/Devices/ReverseTunnel/Powershell.jsx

@@ -96,7 +96,6 @@ export default function ReverseTunnelPowershell({ device }) {
   const localSocketRef = useRef(false);
   const terminalRef = useRef(null);
   const agentIdRef = useRef("");
-  const tunnelIdRef = useRef("");
 
   const agentId = useMemo(() => {
     return (
@@ -115,9 +114,6 @@ export default function ReverseTunnelPowershell({ device }) {
     agentIdRef.current = agentId;
   }, [agentId]);
 
-  useEffect(() => {
-    tunnelIdRef.current = tunnel?.tunnel_id || "";
-  }, [tunnel?.tunnel_id]);
 
   const ensureSocket = useCallback(() => {
     if (socketRef.current) return socketRef.current;
@@ -181,15 +177,14 @@ export default function ReverseTunnelPowershell({ device }) {
     scrollToBottom();
   }, [output, scrollToBottom]);
 
-  const stopTunnel = useCallback(async (reason = "operator_disconnect") => {
+  const disconnectShell = useCallback(async (reason = "operator_disconnect") => {
     const currentAgentId = agentIdRef.current;
     if (!currentAgentId) return;
-    const currentTunnelId = tunnelIdRef.current;
     try {
-      await fetch("/api/tunnel/disconnect", {
-        method: "DELETE",
+      await fetch("/api/shell/disconnect", {
+        method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ agent_id: currentAgentId, tunnel_id: currentTunnelId, reason }),
+        body: JSON.stringify({ agent_id: currentAgentId, reason }),
       });
     } catch {
       // best-effort
@@ -206,14 +201,14 @@ export default function ReverseTunnelPowershell({ device }) {
     setStatusMessage("");
     try {
       await closeShell();
-      await stopTunnel("operator_disconnect");
+      await disconnectShell("operator_disconnect");
     } finally {
       setTunnel(null);
       setShellState("closed");
       setSessionState("idle");
       setLoading(false);
     }
-  }, [closeShell, stopTunnel]);
+  }, [closeShell, disconnectShell]);
 
   useEffect(() => {
     const socket = ensureSocket();
@@ -250,77 +245,39 @@ export default function ReverseTunnelPowershell({ device }) {
   useEffect(() => {
     return () => {
       closeShell();
-      stopTunnel("component_unmount");
+      disconnectShell("component_unmount");
     };
-  }, [closeShell, stopTunnel]);
+  }, [closeShell, disconnectShell]);
 
   const requestTunnel = useCallback(async () => {
     if (!agentId) {
-      setStatusMessage("Agent ID is required to connect.");
+      setStatusMessage("Agent ID is required to establish.");
       return;
     }
     setLoading(true);
     setStatusMessage("");
     try {
-      try {
-        const readinessResp = await fetch(
-          `/api/tunnel/status?agent_id=${encodeURIComponent(agentId)}`
-        );
-        const readinessData = await readinessResp.json().catch(() => ({}));
-        if (readinessResp.ok && readinessData?.agent_socket !== true) {
-          await handleAgentOnboarding();
-          return;
-        }
-      } catch {
-        // best-effort readiness check
-      }
-
       setSessionState("connecting");
       setShellState("opening");
-      const resp = await fetch("/api/tunnel/connect", {
+      const resp = await fetch("/api/shell/establish", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ agent_id: agentId }),
       });
       const data = await resp.json().catch(() => ({}));
       if (!resp.ok) {
+        if (data?.error === "agent_socket_missing") {
+          await handleAgentOnboarding();
+          return;
+        }
         const detail = data?.detail ? `: ${data.detail}` : "";
         throw new Error(`${data?.error || `HTTP ${resp.status}`}${detail}`);
       }
-      tunnelIdRef.current = data?.tunnel_id || "";
-      const waitForTunnelReady = async () => {
-        const deadline = Date.now() + 60000;
-        let lastError = "";
-        while (Date.now() < deadline) {
-          const statusResp = await fetch(
-            `/api/tunnel/connect/status?agent_id=${encodeURIComponent(agentId)}&bump=1`
-          );
-          const statusData = await statusResp.json().catch(() => ({}));
-          if (statusData?.error === "agent_socket_missing" || (statusResp.ok && statusData?.agent_socket === false)) {
-            await handleAgentOnboarding();
-            await stopTunnel("agent_onboarding_pending");
-            return null;
-          }
-          if (statusResp.ok && statusData?.status === "up") {
-            const agentSocket = statusData?.agent_socket;
-            const agentReady = agentSocket === undefined ? true : Boolean(agentSocket);
-            if (agentReady) {
-              return statusData;
-            }
-            setStatusMessage("Waiting for agent VPN socket to register...");
-          } else if (statusData?.error) {
-            lastError = statusData.error;
-          }
-          await sleep(2000);
-        }
-        throw new Error(lastError || "Tunnel not ready");
-      };
-
-      const statusData = await waitForTunnelReady();
-      if (!statusData) {
+      if (data?.agent_socket === false) {
+        await handleAgentOnboarding();
         return;
       }
-      setTunnel({ ...data, ...statusData });
+      setTunnel(data);
 
       const socket = ensureSocket();
       const openShellWithRetry = async () => {
@@ -335,7 +292,6 @@ export default function ReverseTunnelPowershell({ device }) {
           }
           if (openResp.error === "agent_socket_missing") {
             await handleAgentOnboarding();
-            await stopTunnel("agent_onboarding_pending");
             return null;
           }
           lastError = openResp.error;
@@ -359,7 +315,7 @@ export default function ReverseTunnelPowershell({ device }) {
     } finally {
       setLoading(false);
     }
-  }, [agentId, ensureSocket, handleAgentOnboarding, stopTunnel]);
+  }, [agentId, ensureSocket, handleAgentOnboarding]);
 
   const handleSend = useCallback(
     async (text) => {
@@ -414,7 +370,7 @@ export default function ReverseTunnelPowershell({ device }) {
           disabled={loading || (!isConnected && !agentId)}
           onClick={isConnected ? handleDisconnect : requestTunnel}
         >
-          {isConnected ? "Disconnect" : "Connect"}
+          {isConnected ? "Disconnect" : "Establish"}
         </Button>
         <Stack direction="row" spacing={1}>
           {sessionChips.map((chip) => (
@@ -510,7 +466,7 @@ export default function ReverseTunnelPowershell({ device }) {
             size="small"
             value={input}
             disabled={!isConnected}
-            placeholder={isConnected ? "Enter PowerShell command and press Enter" : "Connect to start sending commands"}
+            placeholder={isConnected ? "Enter PowerShell command and press Enter" : "Establish to start sending commands"}
             onChange={(e) => setInput(e.target.value)}
             onKeyDown={(e) => {
               if (e.key === "Enter" && !e.shiftKey) {

Data/Engine/web-interface/src/Devices/ReverseTunnel/RDP.jsx

@@ -1,552 +0,0 @@
-import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import {
-  Box,
-  Button,
-  Chip,
-  FormControl,
-  InputLabel,
-  MenuItem,
-  Select,
-  Stack,
-  TextField,
-  Typography,
-  LinearProgress,
-} from "@mui/material";
-import {
-  DesktopWindowsRounded as DesktopIcon,
-  PlayArrowRounded as PlayIcon,
-  StopRounded as StopIcon,
-  LinkRounded as LinkIcon,
-  LanRounded as IpIcon,
-} from "@mui/icons-material";
-import Guacamole from "guacamole-common-js";
-
-const MAGIC_UI = {
-  panelBorder: "rgba(148, 163, 184, 0.35)",
-  textMuted: "#94a3b8",
-  textBright: "#e2e8f0",
-  accentA: "#7dd3fc",
-  accentB: "#c084fc",
-  accentC: "#34d399",
-};
-
-const gradientButtonSx = {
-  backgroundImage: "linear-gradient(135deg,#7dd3fc,#c084fc)",
-  color: "#0b1220",
-  borderRadius: 999,
-  textTransform: "none",
-  px: 2.2,
-  minWidth: 120,
-  "&:hover": {
-    backgroundImage: "linear-gradient(135deg,#86e1ff,#d1a6ff)",
-  },
-};
-
-const PROTOCOLS = [{ value: "rdp", label: "RDP" }];
-
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-function normalizeText(value) {
-  if (value == null) return "";
-  try {
-    return String(value).trim();
-  } catch {
-    return "";
-  }
-}
-
-export default function ReverseTunnelRdp({ device }) {
-  const [sessionState, setSessionState] = useState("idle");
-  const [statusMessage, setStatusMessage] = useState("");
-  const [loading, setLoading] = useState(false);
-  const [tunnel, setTunnel] = useState(null);
-  const [protocol, setProtocol] = useState("rdp");
-  const [username, setUsername] = useState("");
-  const [password, setPassword] = useState("");
-  const containerRef = useRef(null);
-  const displayRef = useRef(null);
-  const clientRef = useRef(null);
-  const tunnelRef = useRef(null);
-  const mouseRef = useRef(null);
-  const agentIdRef = useRef("");
-  const tunnelIdRef = useRef("");
-  const bumpTimerRef = useRef(null);
-
-  const agentId = useMemo(() => {
-    return (
-      normalizeText(device?.agent_id) ||
-      normalizeText(device?.agentId) ||
-      normalizeText(device?.agent_guid) ||
-      normalizeText(device?.agentGuid) ||
-      normalizeText(device?.id) ||
-      normalizeText(device?.guid) ||
-      normalizeText(device?.summary?.agent_id) ||
-      ""
-    );
-  }, [device]);
-
-  useEffect(() => {
-    agentIdRef.current = agentId;
-  }, [agentId]);
-
-  useEffect(() => {
-    tunnelIdRef.current = tunnel?.tunnel_id || "";
-  }, [tunnel?.tunnel_id]);
-
-  const notifyAgentOnboarding = useCallback(async () => {
-    try {
-      await fetch("/api/notifications/notify", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        credentials: "include",
-        body: JSON.stringify({
-          title: "Agent Onboarding Underway",
-          message:
-            "Please wait for the agent to finish onboarding into Borealis. It takes about 1 minute to finish the process.",
-          icon: "info",
-          variant: "info",
-        }),
-      });
-    } catch {
-      /* ignore notification transport errors */
-    }
-  }, []);
-
-  const handleAgentOnboarding = useCallback(async () => {
-    await notifyAgentOnboarding();
-    setStatusMessage("Agent Onboarding Underway.");
-    setSessionState("idle");
-    setTunnel(null);
-  }, [notifyAgentOnboarding]);
-
-  const teardownDisplay = useCallback(() => {
-    try {
-      const client = clientRef.current;
-      if (client) {
-        client.disconnect();
-      }
-    } catch {
-      /* ignore */
-    }
-    clientRef.current = null;
-    tunnelRef.current = null;
-    mouseRef.current = null;
-    const host = displayRef.current;
-    if (host) {
-      host.innerHTML = "";
-    }
-  }, []);
-
-  const stopTunnel = useCallback(async (reason = "operator_disconnect") => {
-    const currentAgentId = agentIdRef.current;
-    if (!currentAgentId) return;
-    const currentTunnelId = tunnelIdRef.current;
-    try {
-      await fetch("/api/tunnel/disconnect", {
-        method: "DELETE",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ agent_id: currentAgentId, tunnel_id: currentTunnelId, reason }),
-      });
-    } catch {
-      // best-effort
-    }
-  }, []);
-
-  const clearBumpTimer = useCallback(() => {
-    if (bumpTimerRef.current) {
-      clearInterval(bumpTimerRef.current);
-      bumpTimerRef.current = null;
-    }
-  }, []);
-
-  const startBumpTimer = useCallback(
-    (currentAgentId) => {
-      clearBumpTimer();
-      if (!currentAgentId) return;
-      bumpTimerRef.current = setInterval(async () => {
-        try {
-          await fetch(`/api/tunnel/connect/status?agent_id=${encodeURIComponent(currentAgentId)}&bump=1`);
-        } catch {
-          /* ignore */
-        }
-      }, 60000);
-    },
-    [clearBumpTimer]
-  );
-
-  const handleDisconnect = useCallback(async () => {
-    setLoading(true);
-    setStatusMessage("");
-    clearBumpTimer();
-    try {
-      teardownDisplay();
-      await stopTunnel("operator_disconnect");
-    } finally {
-      setTunnel(null);
-      setSessionState("idle");
-      setLoading(false);
-    }
-  }, [clearBumpTimer, stopTunnel, teardownDisplay]);
-
-  const scaleToFit = useCallback(() => {
-    const client = clientRef.current;
-    const container = containerRef.current;
-    if (!client || !container) return;
-    const display = client.getDisplay();
-    const displayWidth = display.getWidth();
-    const displayHeight = display.getHeight();
-    const bounds = container.getBoundingClientRect();
-    if (!displayWidth || !displayHeight || !bounds.width || !bounds.height) return;
-    const scale = Math.min(bounds.width / displayWidth, bounds.height / displayHeight);
-    display.scale(scale);
-  }, []);
-
-  useEffect(() => {
-    const handleResize = () => scaleToFit();
-    window.addEventListener("resize", handleResize);
-    let observer = null;
-    if (typeof ResizeObserver !== "undefined" && containerRef.current) {
-      observer = new ResizeObserver(() => scaleToFit());
-      observer.observe(containerRef.current);
-    }
-    return () => {
-      window.removeEventListener("resize", handleResize);
-      if (observer) observer.disconnect();
-    };
-  }, [scaleToFit]);
-
-  useEffect(() => {
-    return () => {
-      clearBumpTimer();
-      teardownDisplay();
-      stopTunnel("component_unmount");
-    };
-  }, [clearBumpTimer, stopTunnel, teardownDisplay]);
-
-  const requestTunnel = useCallback(async () => {
-    if (!agentId) {
-      setStatusMessage("Agent ID is required to connect.");
-      return null;
-    }
-    setLoading(true);
-    setStatusMessage("");
-    try {
-      try {
-        const readinessResp = await fetch(`/api/tunnel/status?agent_id=${encodeURIComponent(agentId)}`);
-        const readinessData = await readinessResp.json().catch(() => ({}));
-        if (readinessResp.ok && readinessData?.agent_socket !== true) {
-          await handleAgentOnboarding();
-          return null;
-        }
-      } catch {
-        // best-effort readiness check
-      }
-
-      setSessionState("connecting");
-      const resp = await fetch("/api/tunnel/connect", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ agent_id: agentId }),
-      });
-      const data = await resp.json().catch(() => ({}));
-      if (!resp.ok) {
-        const detail = data?.detail ? `: ${data.detail}` : "";
-        throw new Error(`${data?.error || `HTTP ${resp.status}`}${detail}`);
-      }
-      tunnelIdRef.current = data?.tunnel_id || "";
-
-      const waitForTunnelReady = async () => {
-        const deadline = Date.now() + 60000;
-        let lastError = "";
-        while (Date.now() < deadline) {
-          const statusResp = await fetch(
-            `/api/tunnel/connect/status?agent_id=${encodeURIComponent(agentId)}&bump=1`
-          );
-          const statusData = await statusResp.json().catch(() => ({}));
-          if (statusData?.error === "agent_socket_missing" || (statusResp.ok && statusData?.agent_socket === false)) {
-            await handleAgentOnboarding();
-            await stopTunnel("agent_onboarding_pending");
-            return null;
-          }
-          if (statusResp.ok && statusData?.status === "up") {
-            const agentSocket = statusData?.agent_socket;
-            const agentReady = agentSocket === undefined ? true : Boolean(agentSocket);
-            if (agentReady) {
-              return statusData;
-            }
-            setStatusMessage("Waiting for agent VPN socket to register...");
-          } else if (statusData?.error) {
-            lastError = statusData.error;
-          }
-          await sleep(2000);
-        }
-        throw new Error(lastError || "Tunnel not ready");
-      };
-
-      const statusData = await waitForTunnelReady();
-      if (!statusData) {
-        return null;
-      }
-      setTunnel({ ...data, ...statusData });
-      startBumpTimer(agentId);
-      return statusData;
-    } catch (err) {
-      setSessionState("error");
-      setStatusMessage(String(err.message || err));
-      return null;
-    } finally {
-      setLoading(false);
-    }
-  }, [agentId, handleAgentOnboarding, startBumpTimer, stopTunnel]);
-
-  const openRdpSession = useCallback(
-    async () => {
-      const currentAgentId = agentIdRef.current;
-      if (!currentAgentId) return;
-      const payload = {
-        agent_id: currentAgentId,
-        protocol,
-        username: username.trim(),
-        password,
-      };
-      const resp = await fetch("/api/rdp/session", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(payload),
-      });
-      const data = await resp.json().catch(() => ({}));
-      if (!resp.ok) {
-        const detail = data?.detail ? `: ${data.detail}` : "";
-        throw new Error(`${data?.error || `HTTP ${resp.status}`}${detail}`);
-      }
-      const token = data?.token;
-      const wsUrl = data?.ws_url;
-      if (!token || !wsUrl) {
-        throw new Error("RDP session unavailable.");
-      }
-      const tunnelUrl = `${wsUrl}?token=${encodeURIComponent(token)}`;
-      const tunnel = new Guacamole.WebSocketTunnel(tunnelUrl);
-      const client = new Guacamole.Client(tunnel);
-      const displayHost = displayRef.current;
-
-      tunnel.onerror = (status) => {
-        setStatusMessage(status?.message || "RDP tunnel error.");
-      };
-      client.onerror = (status) => {
-        setStatusMessage(status?.message || "RDP client error.");
-      };
-      client.onstatechange = (state) => {
-        if (state === Guacamole.Client.State.CONNECTED) {
-          setSessionState("connected");
-          setStatusMessage("");
-        } else if (state === Guacamole.Client.State.DISCONNECTED) {
-          setSessionState("idle");
-        }
-      };
-      client.onresize = () => {
-        scaleToFit();
-      };
-
-      if (displayHost) {
-        displayHost.innerHTML = "";
-        displayHost.appendChild(client.getDisplay().getElement());
-      }
-
-      const mouse = new Guacamole.Mouse(client.getDisplay().getElement());
-      mouse.onmousemove = (state) => client.sendMouseState(state);
-      mouse.onmousedown = (state) => client.sendMouseState(state);
-      mouse.onmouseup = (state) => client.sendMouseState(state);
-
-      clientRef.current = client;
-      tunnelRef.current = tunnel;
-      mouseRef.current = mouse;
-      client.connect();
-      scaleToFit();
-      setStatusMessage("Connecting to RDP...");
-    },
-    [password, protocol, scaleToFit, username]
-  );
-
-  const handleConnect = useCallback(async () => {
-    if (sessionState === "connected") return;
-    setStatusMessage("");
-    setSessionState("connecting");
-    try {
-      const tunnelReady = await requestTunnel();
-      if (!tunnelReady) {
-        return;
-      }
-      await openRdpSession();
-    } catch (err) {
-      setSessionState("error");
-      setStatusMessage(String(err.message || err));
-    }
-  }, [openRdpSession, requestTunnel, sessionState]);
-
-  const isConnected = sessionState === "connected";
-  const sessionChips = [
-    tunnel?.tunnel_id
-      ? {
-          label: `Tunnel ${tunnel.tunnel_id.slice(0, 8)}`,
-          color: MAGIC_UI.accentB,
-          icon: <LinkIcon sx={{ fontSize: 18 }} />,
-        }
-      : null,
-    tunnel?.virtual_ip
-      ? {
-          label: `IP ${String(tunnel.virtual_ip).split("/")[0]}`,
-          color: MAGIC_UI.accentA,
-          icon: <IpIcon sx={{ fontSize: 18 }} />,
-        }
-      : null,
-  ].filter(Boolean);
-
-  return (
-    <Box sx={{ display: "flex", flexDirection: "column", gap: 1.5, flexGrow: 1, minHeight: 0 }}>
-      <Stack direction={{ xs: "column", md: "row" }} spacing={1.5} alignItems={{ xs: "flex-start", md: "center" }}>
-        <Button
-          size="small"
-          startIcon={isConnected ? <StopIcon /> : <PlayIcon />}
-          sx={gradientButtonSx}
-          disabled={loading || (!isConnected && !agentId)}
-          onClick={isConnected ? handleDisconnect : handleConnect}
-        >
-          {isConnected ? "Disconnect" : "Connect"}
-        </Button>
-        <Stack direction="row" spacing={1} sx={{ flexWrap: "wrap", alignItems: "center" }}>
-          <FormControl
-            size="small"
-            sx={{
-              minWidth: 140,
-              "& .MuiOutlinedInput-root": {
-                backgroundColor: "rgba(12,18,35,0.9)",
-                color: MAGIC_UI.textBright,
-                borderRadius: 2,
-                "& fieldset": { borderColor: "rgba(148,163,184,0.45)" },
-                "&:hover fieldset": { borderColor: MAGIC_UI.accentA },
-              },
-              "& .MuiInputLabel-root": { color: MAGIC_UI.textMuted },
-            }}
-          >
-            <InputLabel>Protocol</InputLabel>
-            <Select
-              label="Protocol"
-              value={protocol}
-              onChange={(e) => setProtocol(e.target.value)}
-              disabled={isConnected}
-            >
-              {PROTOCOLS.map((item) => (
-                <MenuItem key={item.value} value={item.value}>
-                  {item.label}
-                </MenuItem>
-              ))}
-            </Select>
-          </FormControl>
-          <TextField
-            size="small"
-            label="Username"
-            value={username}
-            onChange={(e) => setUsername(e.target.value)}
-            disabled={isConnected}
-            sx={{
-              minWidth: 180,
-              input: { color: MAGIC_UI.textBright },
-              "& .MuiOutlinedInput-root": {
-                backgroundColor: "rgba(12,18,35,0.9)",
-                borderRadius: 2,
-                "& fieldset": { borderColor: "rgba(148,163,184,0.45)" },
-                "&:hover fieldset": { borderColor: MAGIC_UI.accentA },
-              },
-              "& .MuiInputLabel-root": { color: MAGIC_UI.textMuted },
-            }}
-          />
-          <TextField
-            size="small"
-            type="password"
-            label="Password"
-            value={password}
-            onChange={(e) => setPassword(e.target.value)}
-            disabled={isConnected}
-            sx={{
-              minWidth: 180,
-              input: { color: MAGIC_UI.textBright },
-              "& .MuiOutlinedInput-root": {
-                backgroundColor: "rgba(12,18,35,0.9)",
-                borderRadius: 2,
-                "& fieldset": { borderColor: "rgba(148,163,184,0.45)" },
-                "&:hover fieldset": { borderColor: MAGIC_UI.accentA },
-              },
-              "& .MuiInputLabel-root": { color: MAGIC_UI.textMuted },
-            }}
-          />
-        </Stack>
-        <Stack direction="row" spacing={1}>
-          {sessionChips.map((chip) => (
-            <Chip
-              key={chip.label}
-              icon={chip.icon}
-              label={chip.label}
-              sx={{
-                borderRadius: 999,
-                color: chip.color,
-                border: `1px solid ${MAGIC_UI.panelBorder}`,
-                backgroundColor: "rgba(8,12,24,0.65)",
-              }}
-            />
-          ))}
-        </Stack>
-      </Stack>
-
-      <Box
-        sx={{
-          flexGrow: 1,
-          minHeight: 320,
-          display: "flex",
-          flexDirection: "column",
-          borderRadius: 3,
-          border: `1px solid ${MAGIC_UI.panelBorder}`,
-          background:
-            "linear-gradient(145deg, rgba(8,12,24,0.94), rgba(10,16,30,0.9)), radial-gradient(circle at 20% 20%, rgba(125,211,252,0.08), transparent 35%)",
-          boxShadow: "0 25px 80px rgba(2,6,23,0.85)",
-          overflow: "hidden",
-          position: "relative",
-        }}
-      >
-        {loading ? <LinearProgress color="info" sx={{ height: 3 }} /> : null}
-        <Box
-          ref={containerRef}
-          sx={{
-            flexGrow: 1,
-            position: "relative",
-            backgroundColor: "rgba(2,6,20,0.9)",
-            display: "flex",
-            alignItems: "center",
-            justifyContent: "center",
-            overflow: "hidden",
-          }}
-        >
-          <Box ref={displayRef} sx={{ width: "100%", height: "100%" }} />
-          {!isConnected ? (
-            <Stack spacing={1} sx={{ position: "absolute", alignItems: "center" }}>
-              <DesktopIcon sx={{ color: MAGIC_UI.accentA, fontSize: 40 }} />
-              <Typography variant="body2" sx={{ color: MAGIC_UI.textMuted }}>
-                Connect to start the remote desktop session.
-              </Typography>
-            </Stack>
-          ) : null}
-        </Box>
-      </Box>
-
-      <Stack spacing={0.3} sx={{ mt: 1 }}>
-        <Typography variant="body2" sx={{ color: MAGIC_UI.textMuted }}>
-          Session: {isConnected ? "Active" : sessionState}
-        </Typography>
-        {statusMessage ? (
-          <Typography variant="body2" sx={{ color: sessionState === "error" ? "#ff7b89" : MAGIC_UI.textMuted }}>
-            {statusMessage}
-          </Typography>
-        ) : null}
-      </Stack>
-    </Box>
-  );
-}

Data/Engine/web-interface/src/Devices/ReverseTunnel/VNC.jsx

@@ -0,0 +1,351 @@
+import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  Box,
+  Button,
+  Chip,
+  Stack,
+  Typography,
+  LinearProgress,
+} from "@mui/material";
+import {
+  DesktopWindowsRounded as DesktopIcon,
+  PlayArrowRounded as PlayIcon,
+  StopRounded as StopIcon,
+  LinkRounded as LinkIcon,
+  LanRounded as IpIcon,
+} from "@mui/icons-material";
+import RFB from "@novnc/novnc/lib/rfb";
+
+const MAGIC_UI = {
+  panelBorder: "rgba(148, 163, 184, 0.35)",
+  textMuted: "#94a3b8",
+  textBright: "#e2e8f0",
+  accentA: "#7dd3fc",
+  accentB: "#c084fc",
+  accentC: "#34d399",
+};
+
+const gradientButtonSx = {
+  backgroundImage: "linear-gradient(135deg,#7dd3fc,#c084fc)",
+  color: "#0b1220",
+  borderRadius: 999,
+  textTransform: "none",
+  px: 2.2,
+  minWidth: 120,
+  "&:hover": {
+    backgroundImage: "linear-gradient(135deg,#86e1ff,#d1a6ff)",
+  },
+};
+
+function normalizeText(value) {
+  if (value == null) return "";
+  try {
+    return String(value).trim();
+  } catch {
+    return "";
+  }
+}
+
+export default function ReverseTunnelVnc({ device }) {
+  const [sessionState, setSessionState] = useState("idle");
+  const [statusMessage, setStatusMessage] = useState("");
+  const [loading, setLoading] = useState(false);
+  const [tunnel, setTunnel] = useState(null);
+  const containerRef = useRef(null);
+  const displayRef = useRef(null);
+  const rfbRef = useRef(null);
+  const agentIdRef = useRef("");
+
+  const agentId = useMemo(() => {
+    return (
+      normalizeText(device?.agent_id) ||
+      normalizeText(device?.agentId) ||
+      normalizeText(device?.agent_guid) ||
+      normalizeText(device?.agentGuid) ||
+      normalizeText(device?.id) ||
+      normalizeText(device?.guid) ||
+      normalizeText(device?.summary?.agent_id) ||
+      ""
+    );
+  }, [device]);
+
+  useEffect(() => {
+    agentIdRef.current = agentId;
+  }, [agentId]);
+
+
+  const notifyAgentOnboarding = useCallback(async () => {
+    try {
+      await fetch("/api/notifications/notify", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify({
+          title: "Agent Onboarding Underway",
+          message:
+            "Please wait for the agent to finish onboarding into Borealis. It takes about 1 minute to finish the process.",
+          icon: "info",
+          variant: "info",
+        }),
+      });
+    } catch {
+      /* ignore notification transport errors */
+    }
+  }, []);
+
+  const handleAgentOnboarding = useCallback(async () => {
+    await notifyAgentOnboarding();
+    setStatusMessage("Agent Onboarding Underway.");
+    setSessionState("idle");
+    setTunnel(null);
+  }, [notifyAgentOnboarding]);
+
+  const teardownDisplay = useCallback(() => {
+    try {
+      const client = rfbRef.current;
+      if (client) {
+        client.disconnect();
+      }
+    } catch {
+      /* ignore */
+    }
+    rfbRef.current = null;
+    const host = displayRef.current;
+    if (host) {
+      host.innerHTML = "";
+    }
+  }, []);
+
+  const disconnectVnc = useCallback(async (reason = "operator_disconnect") => {
+    const currentAgentId = agentIdRef.current;
+    if (!currentAgentId) return;
+    try {
+      await fetch("/api/vnc/disconnect", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ agent_id: currentAgentId, reason }),
+      });
+    } catch {
+      // best-effort
+    }
+  }, []);
+
+  const handleDisconnect = useCallback(async () => {
+    setLoading(true);
+    setStatusMessage("");
+    try {
+      teardownDisplay();
+      await disconnectVnc("operator_disconnect");
+    } finally {
+      setTunnel(null);
+      setSessionState("idle");
+      setLoading(false);
+    }
+  }, [disconnectVnc, teardownDisplay]);
+
+  useEffect(() => {
+    return () => {
+      teardownDisplay();
+      disconnectVnc("component_unmount");
+    };
+  }, [disconnectVnc, teardownDisplay]);
+
+  const requestTunnel = useCallback(async () => {
+    if (!agentId) {
+      setStatusMessage("Agent ID is required to establish.");
+      return null;
+    }
+    setLoading(true);
+    setStatusMessage("");
+    try {
+      setSessionState("connecting");
+      const resp = await fetch("/api/vnc/establish", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ agent_id: agentId }),
+      });
+      const data = await resp.json().catch(() => ({}));
+      if (!resp.ok) {
+        if (data?.error === "agent_socket_missing") {
+          await handleAgentOnboarding();
+          return null;
+        }
+        const detail = data?.detail ? `: ${data.detail}` : "";
+        throw new Error(`${data?.error || `HTTP ${resp.status}`}${detail}`);
+      }
+      setTunnel({
+        tunnel_id: data?.tunnel_id,
+        virtual_ip: data?.virtual_ip,
+      });
+      return data;
+    } catch (err) {
+      setSessionState("error");
+      setStatusMessage(String(err.message || err));
+      return null;
+    } finally {
+      setLoading(false);
+    }
+  }, [agentId, handleAgentOnboarding]);
+
+  const openVncSession = useCallback(async (data) => {
+    const token = data?.token;
+    const wsUrl = data?.ws_url;
+    const vncPassword = data?.vnc_password || "";
+    if (!token || !wsUrl) {
+      throw new Error("VNC session unavailable.");
+    }
+    const tunnelUrl = `${wsUrl}?token=${encodeURIComponent(token)}`;
+    const displayHost = displayRef.current;
+    if (!displayHost) {
+      throw new Error("VNC display container missing.");
+    }
+    displayHost.innerHTML = "";
+
+    const rfb = new RFB(displayHost, tunnelUrl, {
+      credentials: { password: vncPassword },
+    });
+    rfb.scaleViewport = true;
+    rfb.resizeSession = true;
+    rfb.clipViewport = true;
+
+    rfb.addEventListener("connect", () => {
+      setSessionState("connected");
+      setStatusMessage("");
+    });
+    rfb.addEventListener("disconnect", () => {
+      setSessionState("idle");
+      rfbRef.current = null;
+    });
+    rfb.addEventListener("securityfailure", (evt) => {
+      const detail = evt?.detail?.reason ? ` (${evt.detail.reason})` : "";
+      setSessionState("error");
+      setStatusMessage(`VNC authentication failed${detail}.`);
+    });
+    rfb.addEventListener("credentialsrequired", () => {
+      try {
+        rfb.sendCredentials({ password: vncPassword });
+      } catch {
+        // ignore
+      }
+    });
+
+    rfbRef.current = rfb;
+    setStatusMessage("Establishing VNC...");
+  }, []);
+
+  const handleConnect = useCallback(async () => {
+    if (sessionState === "connected") return;
+    setStatusMessage("");
+    setSessionState("connecting");
+    try {
+      const sessionData = await requestTunnel();
+      if (!sessionData) {
+        return;
+      }
+      await openVncSession(sessionData);
+    } catch (err) {
+      setSessionState("error");
+      setStatusMessage(String(err.message || err));
+    }
+  }, [openVncSession, requestTunnel, sessionState]);
+
+  const isConnected = sessionState === "connected";
+  const sessionChips = [
+    tunnel?.tunnel_id
+      ? {
+          label: `Tunnel ${tunnel.tunnel_id.slice(0, 8)}`,
+          color: MAGIC_UI.accentB,
+          icon: <LinkIcon sx={{ fontSize: 18 }} />,
+        }
+      : null,
+    tunnel?.virtual_ip
+      ? {
+          label: `IP ${String(tunnel.virtual_ip).split("/")[0]}`,
+          color: MAGIC_UI.accentA,
+          icon: <IpIcon sx={{ fontSize: 18 }} />,
+        }
+      : null,
+  ].filter(Boolean);
+
+  return (
+    <Box sx={{ display: "flex", flexDirection: "column", gap: 1.5, flexGrow: 1, minHeight: 0 }}>
+      <Stack direction={{ xs: "column", md: "row" }} spacing={1.5} alignItems={{ xs: "flex-start", md: "center" }}>
+        <Button
+          size="small"
+          startIcon={isConnected ? <StopIcon /> : <PlayIcon />}
+          sx={gradientButtonSx}
+          disabled={loading || (!isConnected && !agentId)}
+          onClick={isConnected ? handleDisconnect : handleConnect}
+        >
+          {isConnected ? "Disconnect" : "Establish"}
+        </Button>
+        <Stack direction="row" spacing={1}>
+          {sessionChips.map((chip) => (
+            <Chip
+              key={chip.label}
+              icon={chip.icon}
+              label={chip.label}
+              sx={{
+                borderRadius: 999,
+                color: chip.color,
+                border: `1px solid ${MAGIC_UI.panelBorder}`,
+                backgroundColor: "rgba(8,12,24,0.65)",
+              }}
+            />
+          ))}
+        </Stack>
+      </Stack>
+
+      <Box
+        sx={{
+          flexGrow: 1,
+          minHeight: 320,
+          display: "flex",
+          flexDirection: "column",
+          borderRadius: 3,
+          border: `1px solid ${MAGIC_UI.panelBorder}`,
+          background:
+            "linear-gradient(145deg, rgba(8,12,24,0.94), rgba(10,16,30,0.9)), radial-gradient(circle at 20% 20%, rgba(125,211,252,0.08), transparent 35%)",
+          boxShadow: "0 25px 80px rgba(2,6,23,0.85)",
+          overflow: "hidden",
+          position: "relative",
+        }}
+      >
+        {loading ? <LinearProgress color="info" sx={{ height: 3 }} /> : null}
+        <Box
+          ref={containerRef}
+          sx={{
+            flexGrow: 1,
+            position: "relative",
+            backgroundColor: "rgba(2,6,20,0.9)",
+            display: "flex",
+            alignItems: "center",
+            justifyContent: "center",
+            overflow: "hidden",
+          }}
+        >
+          <Box ref={displayRef} sx={{ width: "100%", height: "100%" }} />
+          {!isConnected ? (
+            <Stack spacing={1} sx={{ position: "absolute", alignItems: "center" }}>
+              <DesktopIcon sx={{ color: MAGIC_UI.accentA, fontSize: 40 }} />
+              <Typography variant="body2" sx={{ color: MAGIC_UI.textMuted }}>
+                Establish to start the VNC session.
+              </Typography>
+            </Stack>
+          ) : null}
+        </Box>
+      </Box>
+
+      <Stack spacing={0.3} sx={{ mt: 1 }}>
+        <Typography variant="body2" sx={{ color: MAGIC_UI.textMuted }}>
+          Session: {isConnected ? "Active" : sessionState}
+        </Typography>
+        {statusMessage ? (
+          <Typography variant="body2" sx={{ color: sessionState === "error" ? "#ff7b89" : MAGIC_UI.textMuted }}>
+            {statusMessage}
+          </Typography>
+        ) : null}
+      </Stack>
+    </Box>
+  );
+}

Data/Engine/web-interface/vite.config.mts

@@ -42,6 +42,14 @@ const httpsOptions = certPath && keyPath
 
 export default defineConfig({
   plugins: [react()],
+  esbuild: {
+    target: "es2022",
+  },
+  optimizeDeps: {
+    esbuildOptions: {
+      target: "es2022",
+    },
+  },
   server: {
     open: true,
     host: true,
@@ -69,6 +77,7 @@ export default defineConfig({
     outDir: 'build',
     emptyOutDir: true,
     chunkSizeWarningLimit: 1000,
+    target: 'es2022',
     rollupOptions: {
       output: {
         // split each npm package into its own chunk