Fix macOS input permissions, Caps Lock, scroll and layout-independent typing, reconnect the X11 injector, and release VNC resources when start fails

client/internal/engine_vnc.go

@@ -194,6 +194,10 @@ func (e *Engine) startVNCServer(authConfig *sshauth.Config) error {
 	listenAddr := netip.AddrPortFrom(netbirdIP, vnc.InternalPort)
 	network := e.wgInterface.Address().Network
 	if err := srv.Start(e.ctx, listenAddr, network); err != nil {
+		// The server never took ownership, so nothing else will release what
+		// newPlatformVNC opened: the X11 injector's display connection, the
+		// uinput device, the framebuffer mapping.
+		closeVNCResources(capturer, injector)
 		return fmt.Errorf("start VNC server: %w", err)
 	}
 
@@ -394,3 +398,14 @@ func (e *Engine) persistVNCProcesses(state *vncserver.ShutdownState) {
 		log.Debugf("update VNC session state: %v", err)
 	}
 }
+
+// closeVNCResources releases a capturer and an injector that implement Close.
+// Either may be a stub that holds nothing.
+func closeVNCResources(capturer vncserver.ScreenCapturer, injector vncserver.InputInjector) {
+	if c, ok := capturer.(interface{ Close() }); ok {
+		c.Close()
+	}
+	if i, ok := injector.(interface{ Close() }); ok {
+		i.Close()
+	}
+}

client/internal/engine_vnc_darwin.go

@@ -13,18 +13,22 @@ import (
 func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
 	capturer := vncserver.NewMacPoller()
 
-	// Ask only when this process is the one that will capture. Screen Recording
-	// is a user-scope TCC service, so the request is dropped from a
+	// Screen Recording is asked for only when this process is the one that will
+	// capture. It is a user-scope TCC service, so the request is dropped from a
 	// LaunchDaemon: no prompt appears and NetBird never even reaches the Screen
 	// Recording list. In that case the per-user agent asks instead, see
-	// newAgentResources.
-	//
-	// Without service mode there is no agent, so this process captures and
-	// nothing else will ever raise the prompt — the client would serve a
-	// windowless desktop with no indication why.
-	if !vncNeedsServiceMode() {
-		vncserver.RequestScreenRecording()
+	// newAgentResources. Without service mode there is no agent, so nothing
+	// else will ever raise the prompt and the client would serve a windowless
+	// desktop with no indication why.
+	if vncNeedsServiceMode() {
+		// The per-user agent owns capture and input in service mode, so this
+		// process needs neither. A real injector here would still hold its
+		// PreventUserIdleDisplaySleep assertion from construction, keeping
+		// the display awake for the daemon's whole life with no VNC session
+		// in sight.
+		return capturer, &vncserver.StubInputInjector{}, true
 	}
+	vncserver.RequestScreenRecording()
 
 	injector, err := vncserver.NewMacInputInjector()
 	if err != nil {