[masnwilliams]

Summary

Adds a view-only Neko member profile for read-only live view links.

• Neko base: bumps to ghcr.io/kernel/neko/base:3.0.8-v1.6.4-rc.1, which includes Refuse input from sessions without host permission neko#30 (members without host permission don't send input, clipboard or keyboard changes).
• neko.yaml: the multiuser user member becomes a view-only profile (can_host, can_share_media, can_access_clipboard, sends_inactive_cursor and is_admin all false) with its own password, used by the live-view proxy for read-only links.
• Client: when the page sets window.KERNEL_LIVE_VIEW_READ_ONLY = true, the viewer starts read-only and answers KERNEL_SET_READ_ONLY unlock requests with readOnly: true, so it doesn't offer controls the member can't use. Without the flag, behavior is unchanged.

The admin member and the default live view behavior are unchanged.

Before merging

The base image is a release candidate from kernel/neko#30. Once that PR merges and v3.0.8-v1.6.4 is published, bump the FROM line to it.

Testing

• bun test tests in the client: 252 pass, including new cases for read-only links.
• vue-cli-service build succeeds; lint has no new warnings.
• The Neko change has its own unit tests in Refuse input from sessions without host permission neko#30.

---

Note

Medium Risk
Tightens live-view session permissions and depends on a Neko RC for server-side input blocking; misconfiguration could affect who can control the browser, but admin/default paths are unchanged.

Overview
Introduces a view-only Neko member for read-only live view links and aligns the viewer UI with server-enforced input limits.

The chromium-headful image bumps the Neko base to 3.0.8-v1.6.4-rc.1 (members without host permission do not send input, clipboard, or keyboard changes). neko.yaml repurposes the multiuser user account: dedicated password live-view-read-only, with can_host, media, clipboard, and inactive-cursor permissions turned off.

The client adds resolveReadOnly() so when the live-view proxy sets window.KERNEL_LIVE_VIEW_READ_ONLY = true, initial mode and parent KERNEL_SET_READ_ONLY unlock requests stay read-only (acknowledgements still report readOnly: true). Without that flag, behavior is unchanged. README and unit tests cover the new rules.

^{Reviewed by Cursor Bugbot for commit b6cca85. Bugbot is set up for automated code reviews on this repo. Configure here.}