From cb4421228e340c9ed9909b1466076da0aee48e72 Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Mon, 20 Jul 2026 21:17:17 +0200
Subject: [PATCH] =?UTF-8?q?fix(hive-screen-mcp):=20address=20argus=20revie?=
 =?UTF-8?q?w=20=F0=9F=9F=A1=20items?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- mouse_click: error on unrecognised button name instead of silently
  treating it as left click; "left" now explicit in match arm
- rfb_handshake: cap ServerInit name-length at 256 bytes to prevent
  a multi-GB allocation from an aberrant server response
---
 hive-screen-mcp/src/main.rs | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hive-screen-mcp/src/main.rs b/hive-screen-mcp/src/main.rs
index 8fb7a0ff..09bab287 100644
--- a/hive-screen-mcp/src/main.rs
+++ b/hive-screen-mcp/src/main.rs
@@ -147,6 +147,11 @@ async fn rfb_handshake(stream: &mut TcpStream) -> Result<(), String> {
         .read_u32()
         .await
         .map_err(|e| format!("VNC: read name-len: {e}"))?;
+    if name_len > 256 {
+        return Err(format!(
+            "VNC: server-init name length {name_len} exceeds cap (256)"
+        ));
+    }
     let mut name = vec![0u8; name_len as usize];
     stream
         .read_exact(&mut name)
@@ -283,9 +288,14 @@ impl ScreenMcp {
             return "mouse_click: x and y must be in range 0–65535".to_owned();
         };
         let btn_mask: u8 = match args.button.as_deref().unwrap_or("left") {
+            "left" => 0b0000_0001,
             "right" => 0b0000_0100,
             "middle" => 0b0000_0010,
-            _ => 0b0000_0001, // left
+            other => {
+                return format!(
+                    "mouse_click: unknown button {other:?} — use \"left\", \"right\", or \"middle\""
+                )
+            }
         };
         // Move to position, press, release — all in one VNC connection.
         let events = [(0, x, y), (btn_mask, x, y), (0, x, y)];