Fix Cloud display ownership and connection readiness

Sources/AppDelegate+DockSurfaceMove.swift

@@ -39,9 +39,9 @@ extension AppDelegate {
 
     /// Whether a live surface can leave its current owner and be driven from
     /// `destinationDock`.
-    func canMoveSurfaceIntoDock(sourceTabId: UUID, destinationDock _: DockSplitStore) -> Bool {
+    func canMoveSurfaceIntoDock(sourceTabId: UUID, destinationDock: DockSplitStore) -> Bool {
         guard let source = locateContainerSurface(tabId: sourceTabId) else { return false }
-        return canMoveSurfaceIntoDock(source)
+        return destinationDock.surfaceOwnershipPolicy.rejection(for: machineOwningBonsplitTab(sourceTabId)) == nil && canMoveSurfaceIntoDock(source)
     }
 
     /// Whether the right sidebar (Files / Find / Dock) currently owns input
@@ -93,7 +93,7 @@ extension AppDelegate {
         destination: BonsplitController.ExternalTabDropRequest.Destination
     ) -> Bool {
         guard let source = locateContainerSurface(tabId: sourceTabId) else { return false }
-        guard canMoveSurfaceIntoDock(source) else { return false }
+        guard canMoveSurfaceIntoDock(sourceTabId: sourceTabId, destinationDock: destinationDock) else { return false }
         let shouldPreserveSourceWorkspace = shouldPreserveSourceWorkspaceAfterDockMove(
             source,
             destinationDock: destinationDock

Sources/BrowserWindowPortal.swift

@@ -4027,7 +4027,7 @@ final class WindowBrowserPortal: NSObject {
         for subview in hostView.subviews.reversed() {
             guard let container = subview as? WindowBrowserSlotView else { continue }
             guard !container.isHidden else { continue }
-            guard container.frame.contains(point) else { continue }
+            let containsPoint = container.frame.contains(point) || container.convert(container.bounds, to: nil).contains(windowPoint); guard containsPoint else { continue }
             guard let webView = entriesByWebViewId
                 .first(where: { _, entry in entry.containerView === container })?
                 .value

Sources/Cloud/CloudDisplayCoordinator.swift

@@ -0,0 +1,123 @@
+import Foundation
+import Observation
+
+/// Explicit display discovery/creation through the existing VM-authorized exec
+/// route. Routine terminal catalog refreshes never execute guest commands.
+@MainActor
+@Observable
+final class CloudDisplayCoordinator {
+    private let execute: @MainActor (String, Int) async throws -> VMExecResult
+    private(set) var snapshot: CloudGuestDisplaySnapshot?
+    private(set) var lastValidatedSnapshot: CloudGuestDisplaySnapshot?
+    private(set) var isAvailable = false
+    private var generation: UInt64 = 0
+    private var requestID: UUID?
+    private var refreshTask: Task<Void, Never>?
+    private var creation: Task<CloudGuestDisplaySnapshot, Error>?
+
+    init(execute: @escaping @MainActor (String, Int) async throws -> VMExecResult) {
+        self.execute = execute
+    }
+
+    var canCreate: Bool { isAvailable && (snapshot?.canCreate == true || requestID != nil) && creation == nil }
+    var displaySnapshot: CloudGuestDisplaySnapshot? { snapshot ?? lastValidatedSnapshot }
+
+    func refresh() async {
+        guard creation == nil else { return }
+        refreshTask?.cancel()
+        generation &+= 1
+        let token = generation
+        let task = Task { [weak self, execute] in
+            do {
+                var response: VMExecResult?
+                var lastError: (any Error)?
+                for attempt in 0..<3 {
+                    do {
+                        let candidate = try await execute(CloudGuestDisplayScript.command(action: "list"), 10_000)
+                        if candidate.exitCode == 0 {
+                            response = candidate
+                            break
+                        }
+                        lastError = SurfaceCatalogError.unsupported(CloudGuestDisplaySnapshot.unavailableMessage)
+                    } catch {
+                        lastError = error
+                    }
+                    if attempt < 2 { try await Task.sleep(for: .milliseconds(100)) }
+                }
+                guard let response else { throw lastError ?? SurfaceCatalogError.unsupported(CloudGuestDisplaySnapshot.unavailableMessage) }
+                guard response.exitCode == 0 else {
+                    throw SurfaceCatalogError.unsupported(CloudGuestDisplaySnapshot.unavailableMessage)
+                }
+                let snapshot = try CloudGuestDisplaySnapshot(data: Data(response.stdout.utf8))
+                guard let self, token == self.generation, !Task.isCancelled else { return }
+                self.snapshot = snapshot
+                self.lastValidatedSnapshot = snapshot
+                self.isAvailable = true
+            } catch {
+                guard let self, token == self.generation else { return }
+                self.snapshot = nil
+                self.isAvailable = false
+            }
+        }
+        refreshTask = task
+        await task.value
+        if refreshTask != nil, token == generation { refreshTask = nil }
+    }
+
+    func create() async throws -> CloudGuestDisplaySnapshot {
+        if let creation {
+            return try await withTaskCancellationHandler {
+                try await creation.value
+            } onCancel: {
+                creation.cancel()
+            }
+        }
+        guard isAvailable, snapshot?.canCreate == true || requestID != nil else {
+            throw SurfaceCatalogError.unsupported(CloudGuestDisplaySnapshot.unavailableMessage)
+        }
+        generation &+= 1
+        let token = generation
+        let request = requestID ?? UUID()
+        requestID = request
+        // The UUID is generated here and retained after failures. A retry cannot
+        // create a second guest display when the first receipt was lost.
+        let task = Task { [weak self, execute] in
+            try Task.checkCancellation()
+            let response = try await execute(CloudGuestDisplayScript.command(action: "create", requestID: request), 65_000)
+            let snapshot = try CloudGuestDisplaySnapshot(data: Data(response.stdout.utf8))
+            try Task.checkCancellation()
+            guard let self, self.generation == token else { throw CancellationError() }
+            self.snapshot = snapshot
+            self.lastValidatedSnapshot = snapshot
+            guard response.exitCode == 0, snapshot.error == nil, snapshot.created != nil else {
+                throw SurfaceCatalogError.unsupported(String(localized: "cloud.display.creationFailed", defaultValue: "The new display could not start. Refresh Displays, then retry. Existing displays are unchanged."))
+            }
+            self.requestID = nil
+            return snapshot
+        }
+        creation = task
+        defer { if generation == token { creation = nil } }
+        return try await withTaskCancellationHandler {
+            try await task.value
+        } onCancel: {
+            task.cancel()
+        }
+    }
+
+    func stop() {
+        invalidate()
+    }
+
+    /// Drops guest state when the provider identity or account scope changes.
+    func invalidate() {
+        generation &+= 1
+        refreshTask?.cancel()
+        refreshTask = nil
+        creation?.cancel()
+        creation = nil
+        snapshot = nil
+        lastValidatedSnapshot = nil
+        requestID = nil
+        isAvailable = false
+    }
+}

Sources/Cloud/CloudGuestDisplay.swift

@@ -0,0 +1,20 @@
+import Foundation
+
+/// One guest-issued display resource with a stable slot and noVNC target.
+struct CloudGuestDisplay: Decodable, Sendable {
+    let id: String
+    let number: Int
+    let port: Int
+    let state: SurfaceLifecycle
+
+    func resource(on machine: SurfaceMachineID, address: String?) -> SurfaceResource {
+        SurfaceResource(
+            id: SurfaceResourceID(machine: machine, kind: .display, key: id),
+            title: number == 1
+                ? String(localized: "cloudTree.node.desktop", defaultValue: "Desktop")
+                : String(format: String(localized: "cloud.display.numberedTitle", defaultValue: "Desktop %d"), number),
+            detail: "noVNC", lifecycle: state, agent: nil, remoteWorkspace: nil,
+            port: port, url: address.map { CmuxTuiSurfaceProvider.privateDesktopURL(privateAddress: $0, port: port) }
+        )
+    }
+}