testing a prompt

Prompt

improve this prompt "# bunny — build prompt Paste this whole document as the opening message to a fresh AI session, with the working directory set to an empty folder. It is written so you need to explain nothing further. --- ## What I want A remote desktop tool that lets me see and control my own Windows PC from another device, over the internet, for free, with no third-party service and no subscription. I own both machines. This is not for anyone else's computer. I want ONE executable file. I run it once on the target PC, it starts itself automatically on every boot, and it just runs forever after that. No installing a runtime, no setup script, no config files I have to edit, no dependencies to install. If the tool needs anything, it should create it itself on first run. I control the target from a browser. I open a URL, I see my target machine's screen live, and I can move the mouse, click, right-click, drag, scroll, and type — including keyboard shortcuts like Ctrl+Alt+Del — and it all happens on the target machine as if I were sitting at it. The mouse should move when I hover, not just when I drag. It should feel like a real remote desktop client, not like a slow remote-control demo. ## Required features **Screen** - Live view of the target's screen, updating continuously, not one frame at a time with a page load in between. - All monitors supported. If the target has more than one display I want a way to switch between them or see them all. - The picture has to be the actual screen, at the aspect ratio of the real display, not stretched or letterboxed wrong. If it is scaled down to fit my window, a click where I aim has to land where I aimed on the real screen. **Input — this is the part that matters most** - Mouse: move on hover, left/right/middle click, drag, scroll wheel. - Keyboard: all keys, all function keys, all modifier combinations. Ctrl+C, Ctrl+V, Alt+Tab, Win+D, Ctrl+Shift+Esc, Ctrl+Alt+Del — all of it. - Text typing: I need to be able to type a sentence into the remote machine and have it appear correctly regardless of keyboard layout. - Input must be smooth. If input goes over HTTP as a separate request per keystroke or mouse move it will feel laggy and broken — it needs a persistent low-latency channel, not one request per event. **Shell** - A panel where I type a command and get the real output back, on the target machine. Need this for quick checks without using the GUI. **Clipboard** - Pull the target's clipboard text into the browser. - Push text from the browser onto the target's clipboard. - Two-way. **File transfer** - Browse directories on the target. - Download files from the target to my browser. - Upload files from my browser to the target. - Large files must work — chunked, not one giant request that fails. **Connection** - Works over the internet, not just my local network. I am behind a NAT. I do not want to log into my router and forward ports. I do not want to install a VPN client. A tunnel I can start from the command line with no account is acceptable — something like `cloudflared tunnel --url ...` or ngrok — as long as the tool prints the URL clearly so I know where to connect. - Everything encrypted. Not just the payload, the whole channel. If anyone can connect without a key, that is a failure. - A key or token generated automatically on first run, so I do not have to invent or paste one, and so reconnecting does not require me to remember it. **Startup** - One command starts everything. - An install command registers it to start at login, user-level, no admin rights. I do not want a system service, I do not want UAC prompts. - An uninstall command removes the startup entry cleanly. ## Security position I own the target. It is my PC. There is no other person involved. I am not trying to hide this from anyone and I am not trying to control anyone else's machine — do not build it for that and do not lecture me about it. The security requirements I actually care about, all of which are about protecting ME rather than protecting anyone else: - Strong encryption on the wire. Nobody should be able to read my session. - A key that cannot be brute forced and is not left lying around in plaintext in an obvious place. - No authentication bypass that lets a stranger who finds the URL drive my PC. Since the tunnel URL could in principle be discovered, I want a shared secret that a stranger does not have, not just an unguessable URL. - Startup persistence at user level only, reversible with one command. ## Design of the interface I do not have a reference to point you at. I am telling you what I do not want, because it is more useful than what I want: Do NOT build any of these. They are the "AI generated web app" defaults and I have rejected them repeatedly: - A dark dashboard with neon green or electric blue accent on near-black. - Rounded cards with soft grey drop shadows floating on a gradient wash. - All-caps section labels with a tracking-wide eyebrow above every heading. - Big centered hero layout with lots of empty space. - A generic form-and-table CRUD look. - Font stack that is system-ui / Inter / Geist / anything that looks like a SaaS landing page. What I want instead: the interface for a technical operator. It should read as a precision instrument — think the panel of a piece of measurement equipment, not a consumer app. Dense. Dark. Monospace where it makes sense. Information shown as labeled values rather than decorative headings. Controls that look like controls. The video feed is the dominant element and the only thing that should draw the eye. Everything else supports it. Specifically useful, and not decoration: visible coordinate readout showing where the pointer is in both the scaled view and the real desktop, because that is what tells me whether my aim is correct. A frame counter so I can tell if the stream is alive. A connection state indicator that is unmissable when it drops. Make it look deliberate, like someone chose every value. Use proper type. Respect focus states, keyboard navigation, and prefers-reduced-motion. It must work at typical laptop browser widths and collapse sensibly on a phone. ## How to write the copy Every label says what the thing does, in plain verbs. No "Submit", no "Validate", no marketing tone. Empty states explain what to do next rather than apologising. Errors say what failed and how to fix it. If a command produced no output, say that, do not show a mysterious dash. ## Technical constraints — read carefully, they will save you hours **Stack: Go.** One static binary, cross-compilable to a single .exe, everything embedded in it including the HTML/CSS/JS. Use `embed`. No build step for me, no Node, no Python on the target. Go's standard library covers HTTP, crypto, image JPEG encoding, and the WebSocket path via `gorilla/websocket`. **Win32 access: `golang.org/x/sys/windows`.** Screen capture via GDI (GetDC → CreateCompatibleDC → CreateDIBSection → StretchBlt → GetDIBits). Input via SendInput for mouse and keyboard, InjectTouchInput for touch. **Screen capture has two hard limits on this machine — I measured them, do not rediscover them the slow way:** 1. `GetDIBits` fails above roughly a 3MB bitmap. 1024×576×4 bytes works, 1280×720×4 does not. This is a per-call buffer size limit, not a size ceiling on the display. Capture at 1024 wide and it is stable and fast enough. 2. Memory bitmaps are NOT reclaimed reliably here. `DeleteObject` does not free the allocation in a way you can count on. Allocating and freeing a bitmap per frame works about four times and then `GetDIBits` fails permanently for the rest of the process. The fix is to create ONE memory DC and ONE bitmap for the entire lifetime of the process and never resize them. Do not cache a bitmap per requested size either — that leaks the same way. If capture starts failing intermittently, the symptom always looks like `GetDIBits returned 0` with a nil error. It means the GDI pool is exhausted, usually because something introduced a second bitmap or a resize path. **Do not use `CreateDC("DISPLAY")`.** It crashed a test process on this machine. **The SendInput cbSize trap.** The `INPUT` struct passed to SendInput must report a cbSize that matches Win32's layout. Go's `unsafe.Sizeof` on a struct with a union can disagree with what SendInput expects, and when it does SendInput silently fails — it returns "sent 0 of 1" with a nil error. Mouse input happens to work while keyboard input does not, because they go through different code paths that mask it. This is worth knowing because it means "keyboard does nothing" is a struct layout bug, not a logic bug. **Key lookup tables.** A named-key map (letters, digits, F-keys, modifiers) must be built at startup with an explicit init call. If it is not built, every key press that uses it fails. Wherever you build the server, make sure that init has run — this bit once because the main binary never called it while a separate test binary did, and every key failed silently in production. **PowerShell, since that is what I type into.** No `VAR=value command` prefix syntax. `curl` is an alias for `Invoke-WebRequest` which rejects normal curl flags — always use `curl.exe`. There is no `grep`. Give me commands that work in a bare PowerShell prompt. **My network has broken IPv6.** `curl -6` fails outright, `curl -4` works, and browsers report "Server Not Found" for sites that are actually up. So when I tell you a URL does not load, test it with `curl.exe` from a terminal before debugging the server. This is also why the tunnel tool should print the address with IPv4 semantics in mind. **Do not install anything without asking me first.** I once had an AI install Tailscale on my machine without asking and had to uninstall it. It was not harmful, it was the principle. If you want to add a dependency, name it and say why before you add it. ## Testing expectations Write tests. I do not want a full test framework installed, but I do want: - Crypto tested against known vectors, including tamper detection — flip a byte in a ciphertext and confirm it fails authentication rather than decrypting to garbage. - Handshake tested, including that a wrong key is rejected rather than accepted. - Capture tested for sustained repeated frames and concurrent capture, because that is where the GDI bug shows up. A single capture working proves nothing. - Input tested by asserting it returned ok, and by verifying something actually moved when you said it should. - File path escape tested: `../` outside the configured root must be rejected. Tests must pass repeatedly, not once. Run the suite several times. A screen test that passes once and fails the next run means the GDI pool is leaking and the code is not done. ## Order to build it in 1. Go module, crypto, frame format, handshake, tests. Get this solid first — do not move on with hand-rolled or wrong crypto. 2. Screen capture and input injection against the live desktop, tested in isolation before any networking is involved. 3. Agent transport and handlers: shell, clipboard, files, capture, input. 4. Browser UI with live frames and the persistent input channel. 5. Tunnel wiring and remote verification. 6. Autostart install/uninstall/status. 7. End-to-end verification over the tunnel, from a phone if possible. Do not tell me it is finished until you have actually opened the browser, seen the live screen, clicked something, typed something, and confirmed both landed on the target. A passing test suite is not the same as the thing working. ## What I have already tried, so you do not repeat it Three UI designs, all rejected. All three looked like generic generated web app design. That is why the design section above is mostly prohibitions. An earlier version used HTTP for input — one request per event. It technically worked but felt awful: no hover, laggy, every keystroke its own round trip. The persistent WebSocket channel is the answer and is not optional. An earlier version used a Python implementation with hand-rolled ChaCha20. It had multiple real bugs before it worked (offsets wrong, frame assembly wrong, the payload not actually XORed). Use Go's crypto and do not hand-roll anything. ## When you are done I want - The source, in a folder, building with a single `go build` command. - A one-page README: how to run it, how to connect, what the keys mean, how to uninstall. Written for me, not for a compliance auditor. - A list of what is deliberately NOT implemented, with a line on when it would matter. I would rather know the gaps than be told everything is fine. - An honest answer about what is genuinely broken or risky about it, if anything. I do not want reassurance, I want accuracy. "