Skip to content

fix(control): drive the host pointer directly - #67

Merged
mrprecioustech merged 1 commit into
masterfrom
fix/direct-host-pointer-control
Aug 11, 2026
Merged

fix(control): drive the host pointer directly#67
mrprecioustech merged 1 commit into
masterfrom
fix/direct-host-pointer-control

Conversation

@mrprecioustech

Copy link
Copy Markdown
Contributor

PairUX now opts out of the library’s two-cursor mode for desktop remote control. Remote mouse movement continuously drives the host’s real OS cursor, including on KDE/Wayland, rather than stopping at a visual overlay.\n\nThe host retains the existing revoke-control and emergency-stop protections.\n\nVerified: desktop test suite (587 tests), desktop typecheck/lint, and repository pre-commit checks.

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

170 finding(s)

HIGH/CRITICAL: 16 | MEDIUM: 48 | LOW: 106

Severity Rule Location
HIGH sh-eval-expansion .githooks/pre-commit:33
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:691
HIGH sh-unquoted-expansion-destructive apps/installer/scripts/install.sh:715
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:813
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:815
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:894
HIGH sh-unquoted-expansion-destructive apps/installer/scripts/install.sh:910
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:1064
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:1066
HIGH sh-remote-script-execution apps/installer/scripts/install.sh:1128
HIGH secret-generic-credential apps/livekit/fly.toml:12
HIGH sh-remote-script-execution apps/livekit/setup-livekit-server.sh:93
HIGH sh-remote-script-execution apps/turn/deploy-droplet.sh:62
HIGH secret-generic-credential apps/turn/fly.toml:11
HIGH secret-generic-credential docs/API.md:747
HIGH secret-generic-credential docs/API.md:753
MEDIUM insecure-temp-file .githooks/commit-msg:19
MEDIUM insecure-temp-file .githooks/post-commit:22
MEDIUM insecure-temp-file apps/desktop/src/main/streaming/index.test.ts:64
MEDIUM insecure-temp-file apps/installer/scripts/install.sh:370
MEDIUM insecure-temp-file apps/installer/scripts/install.sh:393
MEDIUM insecure-temp-file apps/installer/scripts/install.sh:402
MEDIUM insecure-temp-file apps/installer/scripts/install.sh:438
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:48
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:73
MEDIUM js-unescaped-html-sink apps/web/src/app/c/[handle]/page.tsx:191
MEDIUM js-unescaped-html-sink apps/web/src/app/l/[joinCode]/page.tsx:165
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:128
MEDIUM js-unescaped-html-sink apps/web/src/app/live/page.tsx:145
MEDIUM js-unescaped-html-sink apps/web/src/app/page.tsx:122
MEDIUM js-unescaped-html-sink apps/web/src/app/pricing/page.tsx:284
MEDIUM js-open-redirect apps/web/src/app/pricing/UpgradeButton.tsx:50
MEDIUM js-unescaped-html-sink apps/web/src/app/u/[username]/page.tsx:282
MEDIUM manifest-install-lifecycle-script package.json:54
MEDIUM sql-template-interpolation packages/ai-core/src/prompts.ts:36
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:101
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:116
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:132
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:153
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:180
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:209
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:234
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:257
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:293
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:318
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:344
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:366
MEDIUM insecure-temp-file packages/remote-input/src/backends/waylandYdotool.test.ts:403
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:154
MEDIUM js-shell-exec-interpolation scripts/lib/package-managers/apt.ts:160

…and 120 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@mrprecioustech
mrprecioustech merged commit 4282ba9 into master Aug 11, 2026
13 checks passed
@mrprecioustech
mrprecioustech deleted the fix/direct-host-pointer-control branch August 11, 2026 12:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant