Fix macOS input permissions, Caps Lock, scroll and layout-independent typing, reconnect the X11 injector, and release VNC resources when start fails

client/internal/engine_vnc_darwin.go

@@ -13,18 +13,22 @@ import (
 func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
 	capturer := vncserver.NewMacPoller()
 
-	// Ask only when this process is the one that will capture. Screen Recording
-	// is a user-scope TCC service, so the request is dropped from a
+	// Screen Recording is asked for only when this process is the one that will
+	// capture. It is a user-scope TCC service, so the request is dropped from a
 	// LaunchDaemon: no prompt appears and NetBird never even reaches the Screen
 	// Recording list. In that case the per-user agent asks instead, see
-	// newAgentResources.
-	//
-	// Without service mode there is no agent, so this process captures and
-	// nothing else will ever raise the prompt — the client would serve a
-	// windowless desktop with no indication why.
-	if !vncNeedsServiceMode() {
-		vncserver.RequestScreenRecording()
+	// newAgentResources. Without service mode there is no agent, so nothing
+	// else will ever raise the prompt and the client would serve a windowless
+	// desktop with no indication why.
+	if vncNeedsServiceMode() {
+		// The per-user agent owns capture and input in service mode, so this
+		// process needs neither. A real injector here would still hold its
+		// PreventUserIdleDisplaySleep assertion from construction, keeping
+		// the display awake for the daemon's whole life with no VNC session
+		// in sight.
+		return capturer, &vncserver.StubInputInjector{}, true
 	}
+	vncserver.RequestScreenRecording()
 
 	injector, err := vncserver.NewMacInputInjector()
 	if err != nil {