From 78840510610062b0243000704f1ec99a2817c731 Mon Sep 17 00:00:00 2001
From: Thomas Bekkers <261084914+thomasbek3@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:05:47 -0400
Subject: [PATCH] final-review adjustments (plugins): keep RSA pins across
 probe/reconnect, vendor/ path in README, precise noVNC errors

computer-viewer: every persist that spreads an endpoint now starts from
liveEndpoint() (which also falls back to a settings lookup by id), and the
backoff reconnect resolves the live endpoint at fire time, so a pin stored
on first contact survives probe success and auto-reconnect instead of being
overwritten by a pre-pin copy. A pinned computer that presents no key is
rejected. loadVendoredRFB tries vendor/novnc-rfb.mjs first, then the legacy
next-to-plugin.js location, both hash-checked; a tampered candidate stops
the search. connect() error bodies name the actual reason (hash mismatch vs
could not be loaded vs missing plus CDN blocked). README paths corrected.

bot-sections: PLUGIN_CSS rename so cssAttr reaches CSS.escape. task-dock:
observer watches aria-label and drops the dead chat-surface attributes.

9 new tests (58 JS total). Manifest regenerated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 MANIFEST.sha256                 |   6 +-
 bot-sections/plugin.js          |   4 +-
 bot-sections/plugin.test.mjs    |  39 +++++-
 computer-viewer/README.md       |  25 ++--
 computer-viewer/plugin.js       |  97 +++++++++----
 computer-viewer/plugin.test.mjs | 236 ++++++++++++++++++++++++++++++--
 task-dock/plugin.js             |  12 +-
 task-dock/plugin.test.mjs       |  29 +++-
 8 files changed, 378 insertions(+), 70 deletions(-)

diff --git a/MANIFEST.sha256 b/MANIFEST.sha256
index eaa835a..d6b77c7 100644
--- a/MANIFEST.sha256
+++ b/MANIFEST.sha256
@@ -1,4 +1,4 @@
-ec106912cacb7af32006cacf01f2c1f6286d3a22855e27445db663a577a72871  bot-sections/plugin.js
+fc38ac67cd7783bbc701a229cbfa4b0be6b24b1ea74a286571249c7b252e431f  bot-sections/plugin.js
 abc2ed7fa6b6e317827b3ffe58d4d686c6169b4f9559c040730d64d8da901325  bubble-mode/plugin.js
 8437e28c1a15ded71ab48b89e047a1481a1319d6d5f9f6fb6eefc7d8c06758e0  computer-viewer/agent-plugin/orgo-computer/__init__.py
 caaaf1e751ddcba1d4b216ab18bd4077d18c4c9c8e85915d45bdbf746a5f95fc  computer-viewer/agent-plugin/orgo-computer/plugin.yaml
@@ -12,8 +12,8 @@ b8ac63b1b052a029b46ac9bda394215e7b4c2268506c9becd86eb49190a9faf6  computer-viewe
 2f0c0b90e7e5c9db0187d6693d0c0515c442c3ae17aaa590520afbb7e22650a6  computer-viewer/hiperf-linux.sh
 e3217fd93aa6c78bab712d376793a1f052740f1a6f8bfa309c63d5087e7a3632  computer-viewer/hiperf-mac.sh
 37502a54eb33646ff4eb76866f0ef2d1bb86c1ab87ce8bb85c6f7e249950447f  computer-viewer/hiperf-windows.ps1
-093aee168eb589a88f16a7402654c038b6ebca1aa36e10ea75df811c00cc34d3  computer-viewer/plugin.js
+9c4f76c9bb89e4cbf49b1c04fb02a823238c161712b88fff600aa36d94b514f3  computer-viewer/plugin.js
 08b527c943eb410ffa1a35d7d14c018d9eba22363150c3dc35a70327f1e88a28  computer-viewer/vendor/novnc-rfb.mjs
-0aceb385ca7c9f1d305b2b0d7daa0f177b3a778c60beb6e901a2f0ba5622654c  task-dock/plugin.js
+fdc05be2a112a2fece0b0db4998c13981b1fc5d15ebe372760e9f4d6c033d99d  task-dock/plugin.js
 f3e9050ac9fd66008cf775208ddcb28cc3dd44c80c268b2cbd53244f0a270429  texting-style/__init__.py
 edc6cd000b606b21499ad175bc44d1375d38cec5a1ace89c5198d85726e828f9  texting-style/plugin.yaml
diff --git a/bot-sections/plugin.js b/bot-sections/plugin.js
index ee86afb..3f9ab83 100644
--- a/bot-sections/plugin.js
+++ b/bot-sections/plugin.js
@@ -112,7 +112,7 @@ function sectionLadder() {
   return ladder
 }
 
-const CSS = /* css */ `
+const PLUGIN_CSS = /* css */ `
 body.hermes-bot-sections [${LIST_ATTR}] {
   display: flex;
   flex-direction: column;
@@ -1271,7 +1271,7 @@ function injectStyle() {
   if (document.getElementById(STYLE_ID)) return
   const el = document.createElement('style')
   el.id = STYLE_ID
-  el.textContent = CSS
+  el.textContent = PLUGIN_CSS
   ;(document.head || document.documentElement).appendChild(el)
 }
 
diff --git a/bot-sections/plugin.test.mjs b/bot-sections/plugin.test.mjs
index d54ae0e..e2ff35e 100644
--- a/bot-sections/plugin.test.mjs
+++ b/bot-sections/plugin.test.mjs
@@ -7,8 +7,19 @@ const pluginPath = new URL('./plugin.js', import.meta.url)
 const SOURCE = fs.readFileSync(pluginPath, 'utf8')
 
 const HOOKS =
-  '\nglobalThis.__testHooks = { applyAssignData, applyAssignFileText, findBotsPaneRoots,' +
-  ' sectionForKey, sectionLadder, getOverrides: () => overrides, getCustomSections: () => customSections }\n'
+  '\nglobalThis.__testHooks = { applyAssignData, applyAssignFileText, findBotsPaneRoots, cssAttr,' +
+  ' HEADER_ATTR, sectionForKey, sectionLadder, getOverrides: () => overrides,' +
+  ' getCustomSections: () => customSections }\n'
+
+/** The parts of CSS.escape a section name can actually hit. */
+function cssEscape(value) {
+  return String(value).replace(/[^\w-]/g, ch => '\\' + ch)
+}
+
+/** Undo CSS string escaping, the way a selector parser would. */
+function cssUnescape(value) {
+  return String(value).replace(/\\(.)/g, '$1')
+}
 
 function classList(...names) {
   const set = new Set(names)
@@ -28,9 +39,15 @@ function el({ className = '', textContent = '', classes = [], parentElement = nu
 
 function load({ spans = [] } = {}) {
   const warnings = []
+  const escaped = []
   const context = {
     __host: { state: {} },
-    CSS: { escape: value => value },
+    CSS: {
+      escape: value => {
+        escaped.push(value)
+        return cssEscape(value)
+      }
+    },
     console: { warn: message => warnings.push(message) },
     document: {
       body: { classList: { add() {}, contains: () => false, remove() {} } },
@@ -50,7 +67,7 @@ function load({ spans = [] } = {}) {
     .concat(HOOKS)
 
   vm.runInNewContext(source, vm.createContext(context), { filename: pluginPath.pathname })
-  return { ...context.__testHooks, warnings }
+  return { ...context.__testHooks, warnings, escaped }
 }
 
 test('a valid bot-sections.json creates its sections and assigns its bots', () => {
@@ -164,3 +181,17 @@ test('findBotsPaneRoots() falls back to the grandparent when no flex column is f
   assert.equal(roots.length, 1)
   assert.equal(roots[0], grandparent)
 })
+
+test('a section name with a quote and a bracket still matches its own header', () => {
+  const kit = load()
+  const name = 'a"b]c'
+
+  const selector = `:scope > [${kit.HEADER_ATTR}="${kit.cssAttr(name)}"]`
+
+  // The module used to shadow the CSS Web API with its own stylesheet
+  // constant, so CSS.escape was never reached and the fallback regex ran.
+  assert.deepEqual(kit.escaped, [name])
+  const quoted = selector.match(/="(.*)"\]$/)
+  assert.ok(quoted, selector)
+  assert.equal(cssUnescape(quoted[1]), name)
+})
diff --git a/computer-viewer/README.md b/computer-viewer/README.md
index 4292bfd..626e310 100644
--- a/computer-viewer/README.md
+++ b/computer-viewer/README.md
@@ -86,7 +86,7 @@ viewed through the pane's noVNC connection.</em></p>
 
 ```
 plugin.js              the entire desktop plugin (single ESM file)
-vendor/novnc-rfb.mjs   bundled noVNC 1.7.0 RFB (installer copies it next to plugin.js)
+vendor/novnc-rfb.mjs   bundled noVNC 1.7.0 RFB (installer copies it to vendor/ on the target)
 connect-mac.sh         one-paste VNC bridge setup for a Mac
 connect-windows.ps1    same for Windows (TightVNC/UltraVNC + websockify + virtual display)
 connect-linux.sh       same for Linux (x11vnc / wayvnc + websockify)
@@ -373,23 +373,24 @@ be `computer-viewer`.
 
 ```bash
 # macOS / Linux (default profile)
-mkdir -p ~/.hermes/desktop-plugins/computer-viewer
+mkdir -p ~/.hermes/desktop-plugins/computer-viewer/vendor
 cp plugin.js ~/.hermes/desktop-plugins/computer-viewer/plugin.js
-cp vendor/novnc-rfb.mjs ~/.hermes/desktop-plugins/computer-viewer/novnc-rfb.mjs
+cp vendor/novnc-rfb.mjs ~/.hermes/desktop-plugins/computer-viewer/vendor/novnc-rfb.mjs
 cp connect-mac.sh connect-linux.sh hiperf-mac.sh hiperf-agent.py ~/.hermes/desktop-plugins/computer-viewer/
 chmod +x ~/.hermes/desktop-plugins/computer-viewer/connect-*.sh ~/.hermes/desktop-plugins/computer-viewer/hiperf-*.sh
 ```
 
-The kit installer places `novnc-rfb.mjs` next to `plugin.js`. The plugin
-verifies that file's SHA-256 before loading it, and only then falls back to
-the CDN.
+The kit installer places `novnc-rfb.mjs` in `computer-viewer/vendor/`. The
+plugin verifies that file's SHA-256 before loading it, and only then falls back
+to the CDN. A copy left next to `plugin.js` by an older release is still read
+(and hash-checked) if `vendor/` has none.
 
 Named Hermes profile:
 
 ```bash
-mkdir -p ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer
+mkdir -p ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/vendor
 cp plugin.js ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/plugin.js
-cp vendor/novnc-rfb.mjs ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/novnc-rfb.mjs
+cp vendor/novnc-rfb.mjs ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/vendor/novnc-rfb.mjs
 cp connect-mac.sh connect-linux.sh hiperf-mac.sh hiperf-agent.py ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/
 chmod +x ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/connect-*.sh ~/.hermes/profiles/<name>/desktop-plugins/computer-viewer/hiperf-*.sh
 ```
@@ -398,7 +399,7 @@ Windows (typical):
 
 ```text
 %LOCALAPPDATA%\hermes\desktop-plugins\computer-viewer\plugin.js
-%LOCALAPPDATA%\hermes\desktop-plugins\computer-viewer\novnc-rfb.mjs
+%LOCALAPPDATA%\hermes\desktop-plugins\computer-viewer\vendor\novnc-rfb.mjs
 %LOCALAPPDATA%\hermes\desktop-plugins\computer-viewer\connect-windows.ps1
 ```
 
@@ -734,7 +735,7 @@ The address field picks a mode for you. These names only appear under
 
 | Mode | How it connects | When to use |
 |---|---|---|
-| **WebSocket** (default) | Loads the vendored noVNC 1.7.0 (`RFB`) the installer places next to `plugin.js`, after a SHA-256 check. Falls back to jsDelivr then `esm.sh` only if that file is **missing, truncated, or unreadable**; those CDN copies are unverified. A file that is present but **fails the hash check, or fails to import**, is treated as tampering: the pane stops with **Viewer file failed verification** and no CDN copy is loaded. | Full controls: scale, view-only, clipboard, Ctrl+Alt+Del, screenshot. |
+| **WebSocket** (default) | Loads the vendored noVNC 1.7.0 (`RFB`) the installer places in `computer-viewer/vendor/`, after a SHA-256 check. Falls back to jsDelivr then `esm.sh` only if that file is **missing, truncated, or unreadable**; those CDN copies are unverified. A file that is present but **fails the hash check, or fails to import**, is treated as tampering: the pane stops with **Viewer file failed verification** and no CDN copy is loaded. | Full controls: scale, view-only, clipboard, Ctrl+Alt+Del, screenshot. |
 | **Iframe** | `<iframe>` pointed at a hosted noVNC page. No CDN. Sandboxed; the page cannot read the clipboard unless **Allow this computer to use my clipboard** is on for that computer (Advanced, off by default). | CSP blocks the noVNC module, you're offline, or you already have `vnc.html`. |
 | **Session JSON** | `GET` a session document, then WebSocket/RFB as above. | Rotating desktops (paste the API URL or an API key). |
 
@@ -849,8 +850,8 @@ the other variant and the working choice is remembered per endpoint.
 
 - Passwords in `ctx.storage` are plain text on disk
   (`hermes.plugin.computer-viewer.*`).
-- Websocket mode loads the vendored noVNC next to `plugin.js` after a
-  SHA-256 check. Installs without that file (missing, truncated, unreadable)
+- Websocket mode loads the vendored noVNC from `computer-viewer/vendor/`
+  after a SHA-256 check. Installs without that file (missing, truncated, unreadable)
   fall back to the CDN (unverified); if the CDN is blocked too, use iframe
   mode. A hash mismatch does **not** fall back — it stops the connection.
 - The VNC server's RSA key is pinned on first connect (trust on first use).
diff --git a/computer-viewer/plugin.js b/computer-viewer/plugin.js
index 8ecbf3c..b522228 100644
--- a/computer-viewer/plugin.js
+++ b/computer-viewer/plugin.js
@@ -1399,6 +1399,24 @@ function rfbStatusDetail() {
   return why
 }
 
+// A load failure already recorded *why* it failed; that reason is the
+// actionable half, so it rides along in the error detail instead of being
+// dropped for a generic body. An import or crypto failure is not a hash
+// mismatch, and calling it one sends the operator hunting for tampering that
+// never happened.
+function novncErrorBody(code) {
+  const why = rfbStatusDetail()
+  if (code === 'vendored-tampered') {
+    if (engine.rfbLoad.reason === 'integrity') {
+      return `${ERRORS['vendored-tampered'].body} (hash mismatch)`
+    }
+    const body = 'The installed noVNC bundle could not be loaded. Re-run the kit installer.'
+    return why ? `${body} (${why})` : body
+  }
+  // Missing vendored copy *and* a blocked CDN: say both, not just the CDN.
+  return why ? `${ERRORS['cdn-blocked'].body} (${why})` : ERRORS['cdn-blocked'].body
+}
+
 function hexSha256(digest) {
   return Array.from(new Uint8Array(digest), b => b.toString(16).padStart(2, '0')).join('')
 }
@@ -1419,11 +1437,15 @@ function readFailureReason(error) {
   return /ENOENT|not found/i.test(message) ? 'missing' : 'read-failed'
 }
 
-function vendoredRfbPath(root) {
+function vendoredRfbPaths(root) {
   const sep = root.includes('\\') ? '\\' : '/'
   const base = root.endsWith('\\') || root.endsWith('/') ? root.slice(0, -1) : root
-  // Must match scripts/manifest-files.txt: computer-viewer/vendor/novnc-rfb.mjs
-  return base + sep + 'computer-viewer' + sep + 'vendor' + sep + 'novnc-rfb.mjs'
+  const dir = base + sep + 'computer-viewer' + sep
+  // First must match scripts/manifest-files.txt: computer-viewer/vendor/novnc-rfb.mjs.
+  // The legacy next-to-plugin.js location stays readable so a copy made by
+  // hand from an older README still loads — it is hash-checked either way, so
+  // the second path buys compatibility, not trust.
+  return [dir + 'vendor' + sep + 'novnc-rfb.mjs', dir + 'novnc-rfb.mjs']
 }
 
 function vendoredFailed(reason) {
@@ -1431,6 +1453,10 @@ function vendoredFailed(reason) {
   return null
 }
 
+// A vendored file that is present but wrong is an attack signal, not a
+// network hiccup: fail closed instead of silently reaching for the CDN.
+const VENDORED_TAMPERED_REASONS = { integrity: true, 'import-failed': true }
+
 async function loadVendoredRFB() {
   const bridge = globalThis.window && window.hermesDesktop
   // readPluginSource reads the whole file (16 MiB cap); readFileText is the
@@ -1446,16 +1472,29 @@ async function loadVendoredRFB() {
   }
   if (typeof root !== 'string' || !root) return vendoredFailed('no-bridge')
 
-  const filePath = vendoredRfbPath(root)
+  let reason = 'missing'
+  for (const filePath of vendoredRfbPaths(root)) {
+    const attempt = await loadVendoredRfbFrom(bridge, readSource, filePath)
+    if (attempt.ctor) return attempt.ctor
+    // A file that is present but wrong is an attack signal: stop here rather
+    // than let a second candidate paper over it.
+    if (VENDORED_TAMPERED_REASONS[attempt.reason]) return vendoredFailed(attempt.reason)
+    if (reason === 'missing') reason = attempt.reason
+  }
+  return vendoredFailed(reason)
+}
+
+// -> { ctor } once a candidate hashes and imports, else { reason }.
+async function loadVendoredRfbFrom(bridge, readSource, filePath) {
   let payload
   try {
     payload = await readSource.call(bridge, filePath)
   } catch (error) {
-    return vendoredFailed(readFailureReason(error))
+    return { ctor: null, reason: readFailureReason(error) }
   }
 
   const read = textFromReadFile(payload)
-  if (read.text == null) return vendoredFailed(read.reason || 'missing')
+  if (read.text == null) return { ctor: null, reason: read.reason || 'missing' }
   const source = read.text
 
   let hex
@@ -1463,11 +1502,11 @@ async function loadVendoredRFB() {
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(source))
     hex = hexSha256(digest)
   } catch {
-    return vendoredFailed('import-failed')
+    return { ctor: null, reason: 'import-failed' }
   }
   if (hex !== VENDORED_RFB_SHA256) {
     console.warn('[computer-viewer] vendored noVNC failed integrity check', filePath)
-    return vendoredFailed('integrity')
+    return { ctor: null, reason: 'integrity' }
   }
 
   const url = URL.createObjectURL(new Blob([source], { type: 'text/javascript' }))
@@ -1478,10 +1517,10 @@ async function loadVendoredRFB() {
     RFB = ctor
     engine.rfbLoad = { source: 'vendored', reason: null }
     console.info('[computer-viewer] noVNC source: vendored', filePath)
-    return RFB
+    return { ctor, reason: null }
   } catch (error) {
     console.warn('[computer-viewer] vendored noVNC failed to load', error)
-    return vendoredFailed('import-failed')
+    return { ctor: null, reason: 'import-failed' }
   } finally {
     try {
       URL.revokeObjectURL(url)
@@ -1491,10 +1530,6 @@ async function loadVendoredRFB() {
   }
 }
 
-// A vendored file that is present but wrong is an attack signal, not a
-// network hiccup: fail closed instead of silently reaching for the CDN.
-const VENDORED_TAMPERED_REASONS = { integrity: true, 'import-failed': true }
-
 async function loadRFB() {
   // Only a verified vendored constructor is cached. Anything else re-runs the
   // bridge attempt, so dropping a good file in place takes effect next connect.
@@ -1905,15 +1940,23 @@ function scheduleBackoff(endpoint, gen) {
     engine.backoffTimer = null
     if (!still(gen)) return
     if (!engine.paneVisible && !$ui.get().expanded) return
-    void connect(endpoint)
+    // Resolve at fire time: the copy captured when the timer was armed predates
+    // any pin written during the connection that just dropped.
+    void connect(liveEndpoint(endpoint))
   }, delay)
 }
 
-// The endpoint object the listeners captured can be a stale copy after a
-// persist; prefer the live one when the id still matches.
+// The endpoint object a listener, timer or retry captured is a snapshot: any
+// persist since then (the pinned server key, above all) replaced it. Every
+// merge that spreads an endpoint, and every reconnect, has to start from the
+// freshest copy or it writes the snapshot back and silently drops the pin.
 function liveEndpoint(endpoint) {
   const live = engine.endpoint
   if (live && endpoint && live.id === endpoint.id) return live
+  if (endpoint && endpoint.id) {
+    const stored = $settings.get().endpoints.find(item => item.id === endpoint.id)
+    if (stored) return stored
+  }
   return endpoint || {}
 }
 
@@ -1922,7 +1965,10 @@ function liveEndpoint(endpoint) {
 function fingerprintDecision(stored, presented) {
   const pin = String(stored || '')
   const seen = String(presented || '')
-  if (!seen) return { action: 'approve', detail: null }
+  // Nothing presented: either a non-RSA security type or a noVNC too old to
+  // hand us the key. Fine on a computer that was never pinned; on a pinned one
+  // it is the pin check being skipped, which is exactly what an attacker wants.
+  if (!seen) return { action: pin ? 'reject' : 'approve', detail: null }
   if (!pin) return { action: 'pin', detail: 'first contact: server key pinned' }
   if (pin === seen) return { action: 'approve', detail: null }
   return { action: 'reject', detail: null }
@@ -2098,7 +2144,7 @@ async function connect(endpoint) {
     if (!still(gen)) return
     if (iframeFallbackUrl) {
       const next = normalizeEndpoint({
-        ...endpoint,
+        ...liveEndpoint(endpoint),
         mode: 'iframe',
         iframeUrl: iframeFallbackUrl,
         probe: false
@@ -2118,7 +2164,7 @@ async function connect(endpoint) {
   } catch (error) {
     if (!still(gen)) return
     const code = error && error.code === 'vendored-tampered' ? 'vendored-tampered' : 'cdn-blocked'
-    setError(code, ERRORS[code].body)
+    setError(code, novncErrorBody(code))
     return
   }
   if (!still(gen)) return
@@ -2164,7 +2210,7 @@ async function connect(endpoint) {
         const fallback = iframeFallbackUrl
         iframeFallbackUrl = ''
         const next = normalizeEndpoint({
-          ...endpoint,
+          ...liveEndpoint(endpoint),
           mode: 'iframe',
           iframeUrl: fallback,
           probe: false
@@ -2190,9 +2236,12 @@ async function connect(endpoint) {
       persistWsProtocol(endpoint.id, variant)
       engine.reconnectAttempt = 0
       if (probing) {
+        // Merge onto the live copy: a server key pinned moments ago (the
+        // serververification listener fires before 'connect') lives there, and
+        // normalizeEndpoint drops any field the spread does not carry.
         persistEndpointFields(
           normalizeEndpoint({
-            ...endpoint,
+            ...liveEndpoint(endpoint),
             mode: 'websocket',
             wsUrl,
             probe: false
@@ -2274,7 +2323,7 @@ async function connect(endpoint) {
         const fallback = iframeFallbackUrl
         iframeFallbackUrl = ''
         const next = normalizeEndpoint({
-          ...endpoint,
+          ...liveEndpoint(endpoint),
           mode: 'iframe',
           iframeUrl: fallback,
           probe: false
@@ -3510,7 +3559,7 @@ function toggleHiperfEnabled(endpoint) {
     openHiperfEditor()
     return
   }
-  persistHiperfFields({ ...endpoint, hiperfEnabled: !endpoint.hiperfEnabled })
+  persistHiperfFields({ ...liveEndpoint(endpoint), hiperfEnabled: !endpoint.hiperfEnabled })
 }
 
 function hiperfSetupCommand(os) {
diff --git a/computer-viewer/plugin.test.mjs b/computer-viewer/plugin.test.mjs
index c53a1b2..5a265c2 100644
--- a/computer-viewer/plugin.test.mjs
+++ b/computer-viewer/plugin.test.mjs
@@ -112,7 +112,7 @@ function fakeNode() {
   }
 }
 
-function loadPlugin({ fetchImpl, importHook, hermesDesktop } = {}) {
+function loadPlugin({ fetchImpl, importHook, hermesDesktop, timers } = {}) {
   const fetches = []
   const fetch =
     fetchImpl ||
@@ -179,7 +179,9 @@ function loadPlugin({ fetchImpl, importHook, hermesDesktop } = {}) {
     parseInt,
     queueMicrotask,
     setInterval,
-    setTimeout,
+    // `timers` parks every scheduled callback so a test can fire the
+    // reconnect backoff without waiting a real second.
+    setTimeout: timers ? (fn, ms) => timers.push({ fn, ms }) : setTimeout,
     undefined,
     document: {
       body: { classList: { add() {}, contains: () => false, remove() {} } },
@@ -231,7 +233,7 @@ function loadPlugin({ fetchImpl, importHook, hermesDesktop } = {}) {
       .replace(/import \{ jsx, jsxs \} from 'react\/jsx-runtime'\n/, '')
       .replace('export default {', 'globalThis.__plugin = {')
       .concat(
-        '\nglobalThis.__t = { credentialTargetAllowed, iframePolicy, classifyAddress, orgoApiOrigin, authFetch, rfbSourceOrder, loadRFB, rfbStatusDetail, engine, hiperfReadUe, probeUrlsFromHostPort, hiperfBuildUrl, hiperfHandshakeFrames, fingerprintDecision, fetchSession, attachEngine, connect, normalizeEndpoint }\n'
+        '\nglobalThis.__t = { credentialTargetAllowed, iframePolicy, classifyAddress, orgoApiOrigin, authFetch, rfbSourceOrder, loadRFB, rfbStatusDetail, engine, hiperfReadUe, probeUrlsFromHostPort, hiperfBuildUrl, hiperfHandshakeFrames, fingerprintDecision, fetchSession, attachEngine, connect, normalizeEndpoint, liveEndpoint }\n'
       )
 
   vm.runInNewContext(source, vm.createContext(context), { filename: pluginPath.pathname })
@@ -340,18 +342,28 @@ const VENDOR_RFB_SOURCE = fs.readFileSync(VENDOR_RFB_PATH, 'utf8')
 const JSDELIVR = 'https://cdn.jsdelivr.net/npm/@novnc/novnc@1.7.0/+esm'
 const ESM_SH = 'https://esm.sh/@novnc/novnc@1.7.0'
 
-function fakeBridge({ text, missing, truncated, throws } = {}) {
+// Drift guard: the first path the plugin tries must be exactly where the
+// installer puts the file, i.e. the manifest's relative path.
+const MANIFEST_REL = fs
+  .readFileSync(new URL('../scripts/manifest-files.txt', import.meta.url), 'utf8')
+  .split('\n')
+  .find(line => line.endsWith('novnc-rfb.mjs'))
+const ROOT = '/tmp/hermes-home/desktop-plugins'
+const VENDOR_PATH = ROOT + '/' + MANIFEST_REL
+// Where releases before the vendor/ move told operators to copy the file.
+const LEGACY_PATH = ROOT + '/computer-viewer/novnc-rfb.mjs'
+
+function fakeBridge({ text, missing, truncated, throws, only, seen } = {}) {
   const source = text === undefined ? VENDOR_RFB_SOURCE : text
   return {
-    desktopPluginsRoot: async () => '/tmp/hermes-home/desktop-plugins',
+    desktopPluginsRoot: async () => ROOT,
     readPluginSource: async filePath => {
-      // Drift guard: the plugin must look exactly where the installer puts the
-      // file, i.e. the manifest's relative path under desktop-plugins.
-      const manifestRel = fs
-        .readFileSync(new URL('../scripts/manifest-files.txt', import.meta.url), 'utf8')
-        .split('\n')
-        .find(line => line.endsWith('novnc-rfb.mjs'))
-      assert.equal(filePath, '/tmp/hermes-home/desktop-plugins/' + manifestRel)
+      if (seen) seen.push(filePath)
+      assert.ok(
+        filePath === VENDOR_PATH || filePath === LEGACY_PATH,
+        'unexpected vendored path ' + filePath
+      )
+      if (only && filePath !== only) throw new Error('ENOENT')
       if (throws) throw throws
       if (missing) throw new Error('ENOENT')
       return {
@@ -478,7 +490,8 @@ test('loadRFB retries the desktop bridge after a CDN load', async () => {
     desktopPluginsRoot: async () => '/tmp/hermes-home/desktop-plugins',
     readPluginSource: async () => {
       reads += 1
-      if (reads === 1) throw new Error('ENOENT')
+      // Both candidate paths miss on the first loadRFB pass, so it reaches the CDN.
+      if (reads <= 2) throw new Error('ENOENT')
       return {
         binary: false,
         byteSize: Buffer.byteLength(VENDOR_RFB_SOURCE),
@@ -499,7 +512,7 @@ test('loadRFB retries the desktop bridge after a CDN load', async () => {
   await t.loadRFB()
   assert.equal(t.engine.rfbLoad.source, 'cdn-jsdelivr')
   await t.loadRFB()
-  assert.equal(reads, 2)
+  assert.equal(reads, 3)
   assert.equal(t.engine.rfbLoad.source, 'vendored')
   assert.equal(t.engine.rfbLoad.reason, null)
 })
@@ -708,3 +721,198 @@ test('a remote clipboard event is ignored unless the computer is allowed', async
   allowed.rfb.listeners.get('clipboard')({ detail: { text: 'shared' } })
   assert.deepEqual(allowed.written, ['shared'])
 })
+
+test('loadRFB reads vendor/ first and still accepts a copy left next to plugin.js', async () => {
+  const seen = []
+  const { t } = loadPlugin({
+    hermesDesktop: fakeBridge({ only: LEGACY_PATH, seen }),
+    importHook: async url => {
+      if (typeof url === 'string' && url.startsWith('blob:')) return { default: function RFB() {} }
+      throw new Error('CDN should not be tried, got ' + url)
+    }
+  })
+  const ctor = await t.loadRFB()
+  assert.equal(typeof ctor, 'function')
+  assert.deepEqual(seen, [VENDOR_PATH, LEGACY_PATH])
+  assert.equal(t.engine.rfbLoad.source, 'vendored')
+  assert.equal(t.engine.rfbLoad.reason, null)
+})
+
+test('a tampered file in vendor/ fails closed instead of falling through to the legacy path', async () => {
+  const seen = []
+  const flipped = (VENDOR_RFB_SOURCE[0] === 'x' ? 'y' : 'x') + VENDOR_RFB_SOURCE.slice(1)
+  const cdn = []
+  const { t } = loadPlugin({
+    hermesDesktop: fakeBridge({ text: flipped, seen }),
+    importHook: cdnCtorHook(cdn)
+  })
+  await assert.rejects(
+    () => t.loadRFB(),
+    err => err && err.code === 'vendored-tampered'
+  )
+  assert.deepEqual(seen, [VENDOR_PATH])
+  assert.deepEqual(cdn, [])
+})
+
+const NOVNC_BODIES = {
+  hash: 'The installed noVNC bundle does not match the expected hash. Re-run the kit installer. (hash mismatch)',
+  load: 'The installed noVNC bundle could not be loaded. Re-run the kit installer. (vendored import failed)'
+}
+
+function wsEndpoint(t, extra = {}) {
+  return t.normalizeEndpoint({
+    id: 'ep-pin',
+    name: 'Pinned box',
+    mode: 'websocket',
+    wsUrl: 'ws://127.0.0.1:6080/websockify',
+    ...extra
+  })
+}
+
+/** attachEngine + connect(), with the endpoint already in stored settings. */
+async function attached({ endpoint, importHook, hermesDesktop, timers }) {
+  const instances = []
+  const { t } = loadPlugin({
+    hermesDesktop,
+    timers,
+    importHook: importHook || (async () => ({ default: fakeRfbCtorWithListeners(instances) }))
+  })
+  const ctx = makeCtx()
+  ctx.os.__written = []
+  const ep = endpoint(t)
+  ctx.storage.set('endpoints', [ep])
+  ctx.storage.set('globalEndpointId', ep.id)
+  t.attachEngine(ctx)
+  await t.connect(ep)
+  return { t, ctx, ep, instances }
+}
+
+async function keyHash(bytes) {
+  const digest = await crypto.subtle.digest('SHA-256', bytes)
+  return Array.from(new Uint8Array(digest), b => b.toString(16).padStart(2, '0')).join('')
+}
+
+const KEY_A = new Uint8Array([1, 2, 3, 4])
+const KEY_B = new Uint8Array([9, 8, 7, 6])
+
+/** Fire serververification and let the async digest settle. */
+async function presentKey(rfb, publickey) {
+  rfb.listeners.get('serververification')({ detail: publickey ? { publickey } : {} })
+  await new Promise(resolve => setTimeout(resolve, 0))
+}
+
+function storedPin(ctx, id) {
+  const found = ctx.storage.get('endpoints', []).find(item => item.id === id)
+  return found ? found.serverKeyFingerprint : null
+}
+
+test('a probe that succeeds keeps the server key pinned moments earlier', async () => {
+  const { t, ctx, ep, instances } = await attached({
+    endpoint: t => wsEndpoint(t, { probe: true, address: '192.168.1.5:6080', wsUrl: '' })
+  })
+  const rfb = instances[0]
+
+  await presentKey(rfb, KEY_A)
+  const pin = await keyHash(KEY_A)
+  assert.equal(t.engine.endpoint.serverKeyFingerprint, pin)
+
+  // Probe success rewrites the endpoint as a plain websocket one. Merging that
+  // onto the copy captured before the pin used to wipe the pin.
+  rfb.listeners.get('connect')({})
+  assert.equal(t.engine.endpoint.mode, 'websocket')
+  assert.equal(t.engine.endpoint.probe, false)
+  assert.equal(t.engine.endpoint.serverKeyFingerprint, pin)
+  assert.equal(storedPin(ctx, ep.id), pin)
+})
+
+test('an auto-reconnect presenting a different key is rejected, not re-pinned', async () => {
+  const timers = []
+  const { t, ctx, ep, instances } = await attached({
+    endpoint: t => wsEndpoint(t),
+    timers
+  })
+  const first = instances[0]
+
+  await presentKey(first, KEY_A)
+  const pin = await keyHash(KEY_A)
+  assert.equal(storedPin(ctx, ep.id), pin)
+
+  t.engine.paneVisible = true
+  first.listeners.get('connect')({})
+  first.listeners.get('disconnect')({ detail: { clean: false } })
+
+  // The backoff timer used to hand connect() the pre-pin copy it captured.
+  const backoff = timers.find(entry => entry.ms === 1000)
+  assert.ok(backoff, 'reconnect backoff should be scheduled')
+  backoff.fn()
+  await new Promise(resolve => setTimeout(resolve, 0))
+  assert.equal(instances.length, 2, 'the reconnect should build a second RFB')
+
+  await presentKey(instances[1], KEY_B)
+  const state = t.engine.state.get()
+  assert.equal(state.phase, 'error')
+  assert.equal(state.code, 'server-key-changed')
+  assert.equal(storedPin(ctx, ep.id), pin)
+  assert.equal(t.engine.endpoint.serverKeyFingerprint, pin)
+})
+
+test('a pinned computer that presents no key at all is rejected', async () => {
+  const { t, ctx, ep, instances } = await attached({ endpoint: t => wsEndpoint(t) })
+  const rfb = instances[0]
+
+  await presentKey(rfb, KEY_A)
+  const pin = await keyHash(KEY_A)
+
+  await presentKey(rfb, null)
+  const state = t.engine.state.get()
+  assert.equal(state.phase, 'error')
+  assert.equal(state.code, 'server-key-changed')
+  assert.equal(storedPin(ctx, ep.id), pin)
+})
+
+test('a computer with no pin still connects when no key is presented', async () => {
+  const { t, instances } = await attached({ endpoint: t => wsEndpoint(t) })
+
+  await presentKey(instances[0], null)
+  const state = t.engine.state.get()
+  assert.notEqual(state.phase, 'error')
+  assert.equal(t.engine.endpoint.serverKeyFingerprint, '')
+})
+
+test('connect() reports why the vendored viewer lost, not a generic body', async () => {
+  const flipped = (VENDOR_RFB_SOURCE[0] === 'x' ? 'y' : 'x') + VENDOR_RFB_SOURCE.slice(1)
+  const tampered = await attached({
+    endpoint: t => wsEndpoint(t),
+    hermesDesktop: fakeBridge({ text: flipped }),
+    importHook: async () => {
+      throw new Error('CDN blocked')
+    }
+  })
+  assert.equal(tampered.t.engine.state.get().code, 'vendored-tampered')
+  assert.equal(tampered.t.engine.state.get().detail, NOVNC_BODIES.hash)
+
+  // An import failure is fail-closed too, but it is not a hash mismatch.
+  const unloadable = await attached({
+    endpoint: t => wsEndpoint(t),
+    hermesDesktop: fakeBridge(),
+    importHook: async url => {
+      if (typeof url === 'string' && url.startsWith('blob:')) throw new Error('bad module')
+      throw new Error('CDN blocked')
+    }
+  })
+  assert.equal(unloadable.t.engine.state.get().code, 'vendored-tampered')
+  assert.equal(unloadable.t.engine.state.get().detail, NOVNC_BODIES.load)
+
+  // Missing vendored copy and a blocked CDN: the pane names both.
+  const blocked = await attached({
+    endpoint: t => wsEndpoint(t),
+    hermesDesktop: fakeBridge({ missing: true }),
+    importHook: async () => {
+      throw new Error('CDN blocked')
+    }
+  })
+  const state = blocked.t.engine.state.get()
+  assert.equal(state.code, 'cdn-blocked')
+  assert.match(state.detail, /noVNC couldn't be fetched from the CDN/)
+  assert.match(state.detail, /vendored file missing/)
+})
diff --git a/task-dock/plugin.js b/task-dock/plugin.js
index 58a5363..6bd3e20 100644
--- a/task-dock/plugin.js
+++ b/task-dock/plugin.js
@@ -1147,14 +1147,10 @@ function startDomObserver() {
     childList: true,
     characterData: true,
     attributes: true,
-    attributeFilter: [
-      PANE_HIDDEN_ATTR,
-      'aria-selected',
-      'data-tree-tab',
-      'data-chat-surface',
-      'data-composer-target',
-      'data-session-anchor'
-    ]
+    // Same set bubble-mode watches: a tab caption that is retitled after mount
+    // has to re-run the gate, and the three chat-surface attributes this used
+    // to list are long gone from the DOM.
+    attributeFilter: [PANE_HIDDEN_ATTR, 'aria-selected', 'aria-label', 'data-tree-tab']
   })
 }
 
diff --git a/task-dock/plugin.test.mjs b/task-dock/plugin.test.mjs
index 79632bf..4309b4f 100644
--- a/task-dock/plugin.test.mjs
+++ b/task-dock/plugin.test.mjs
@@ -13,6 +13,7 @@ function loadSelection(setup = {}) {
     'hermes-bots:pane': bots,
     'hermes-bots:routines': routines
   }
+  const observed = []
   const context = {
     __host: {
       paneVisibility: id => ({ get: () => Boolean(paneValues[id]) }),
@@ -20,8 +21,14 @@ function loadSelection(setup = {}) {
     },
     CSS: { escape: value => value },
     Date: now ? { now } : Date,
-    document: buildGateDocument(setup),
+    document: { ...buildGateDocument(setup), documentElement: {} },
     globalThis: null,
+    MutationObserver: class {
+      observe(_target, options) {
+        observed.push(options)
+      }
+      disconnect() {}
+    },
     setInterval: () => 0,
     setTimeout: () => 0
   }
@@ -37,12 +44,12 @@ function loadSelection(setup = {}) {
     .concat(
       '\nglobalThis.__testHooks = { matchingStoredSnapshot, workspaceBotChatVisible, botModeChatVisible,' +
         ' isCanonicalBotChatLabel, knownBotChatTabs, markLiveSources, clearLiveSources, isCompletedView,' +
-        ' viewKey, relativeTime }\n'
+        ' viewKey, relativeTime, startDomObserver }\n'
     )
 
   vm.runInNewContext(source, vm.createContext(context), { filename: pluginPath.pathname })
   for (const id of setup.remembered || []) context.__testHooks.knownBotChatTabs.add(id)
-  return context.__testHooks
+  return { ...context.__testHooks, observed }
 }
 
 function snapshot({ bot = 'gamer-boy', sessionId = 'gamer-session' } = {}) {
@@ -154,3 +161,19 @@ test('a stale snapshot ages instead of freezing at "just now"', () => {
   // "last updated …" label keeps whatever text it was first given.
   assert.notEqual(viewKey(view, true), fresh)
 })
+
+test('the DOM observer watches captions and no longer watches dead chat-surface attributes', () => {
+  const kit = loadSelection()
+
+  kit.startDomObserver()
+  const [options] = kit.observed
+
+  assert.ok(options)
+  assert.equal(options.characterData, true)
+  assert.deepEqual(Array.from(options.attributeFilter), [
+    'data-pane-hidden',
+    'aria-selected',
+    'aria-label',
+    'data-tree-tab'
+  ])
+})