nightshift: idea-generator — feature ideas and improvements

[nightshift-micr]

Nightshift: Idea Generator for Veyoff

Task: idea-generator | Category: options | Cost tier: medium

Analysis of veyoff — an RFB man-in-the-middle proxy that controls what Veyon classroom monitoring sees on student machines. Two implementations exist: C++ Windows (~2000 lines, production) and Python Linux (541 lines, prototype using Xlib/PIL).

---

High-Impact Feature Ideas

1. Smart Auto-Freeze on Master Connect

Priority: High | Effort: Medium

Currently freeze is manual (Ctrl+Alt+F). Veyoff already detects master connection state (amber/red outlines). Add an option to auto-freeze when the master connects and auto-unfreeze on disconnect. This eliminates the reaction-time gap where the teacher sees your real screen.

Implementation: hook into detect_master_connection() — when state transitions from inactive → active, trigger FreezeController.toggle() automatically. Add --auto-freeze CLI flag and tray menu toggle.

2. Fake Desktop / Decoy Mode

Priority: High | Effort: Medium-High

Instead of freezing the last real frame (which looks suspiciously static), capture a "clean" desktop snapshot at startup and show that when frozen. The teacher sees a believable live desktop (with clock updating, wallpaper, etc.) while the real desktop is hidden.

Implementation: take a clean screenshot at launch before any personal windows are opened. When frozen, composite a live clock overlay onto the clean snapshot before sending as RFB frame. Add --decoy mode to config.

3. Subtle Frame Noise Injection

Priority: High | Effort: Low

A frozen frame that doesn't change at all for minutes is suspicious to an attentive teacher. Add configurable pixel noise (±1-2 RGB values per pixel, changing every frame) to make the frozen/decoy output look like a live screen with camera-style noise.

Implementation: after composing the output frame, apply random noise to a configurable percentage of pixels. Very low computational cost; high realism benefit.

4. Remote Control via Local HTTP API

Priority: Medium | Effort: Medium

Add a localhost HTTP API to control freeze/hide state from another device (phone, second computer on same network). Endpoints: POST /freeze, POST /unfreeze, GET /status, POST /blacklist/reload.

This avoids the need for keyboard shortcuts entirely — the student can control veyoff from their phone in their pocket. Bind to 127.0.0.1:{port} with an optional auth token.

5. Activity Event Log (Local Only)

Priority: Medium | Effort: Low

Log master connect/disconnect events, freeze/unfreeze events, and self-destruct activations to a local encrypted file. Useful for understanding monitoring patterns (when does the teacher check, how often, for how long).

Implementation: append JSON lines to .local-data/events.log (AES-256 encrypted with a user-provided key). Add veyoff --dump-log to decrypt and display.

6. Per-Window Freeze Instead of Full Screen

Priority: Medium | Effort: High

Instead of freezing the entire screen, freeze individual windows. The user selects which windows to freeze (by title or click), and only those regions show the frozen content. Everything else updates normally.

This is more natural than full-screen freeze — the teacher sees most of the screen updating normally, making the frozen region less noticeable.

7. Configuration Profiles

Priority: Medium | Effort: Low

Support named profiles in config: school.yaml, work.yaml, home.yaml — each with different blacklists, hotkeys, auto-freeze settings, and overlay preferences. Switch profiles from the tray menu.

Currently there's only one blacklist.txt. Profiles would allow context-specific configurations without manual editing.

8. Process Watchdog and Anti-Detection

Priority: Medium | Effort: Medium

Monitor for:

• Veyon service restarts or upgrades (could indicate admin intervention)
• Process enumeration tools (Process Explorer, Task Manager launched by admin)
• Group Policy updates that might change monitoring configuration

Trigger auto-cleanup or self-destruct if suspicious admin activity is detected.

9. Mobile Push Notifications

Priority: Low | Effort: Medium

When the master connects (amber/red state), send a push notification to the user's phone via a simple relay. Useful when the student isn't looking at the screen (e.g., phone in pocket vibrates when teacher starts watching).

Implementation: WebSocket connection to a small relay server, or integration with a notification service (Gotify, ntfy.sh, Pushbullet).

10. Cross-Platform Python/C++ Unification

Priority: Low | Effort: High

The Python (Linux/Xlib) and C++ (Windows/GDI) implementations share the same concept but are completely separate codebases. Consider:

• Shared configuration format and blacklist syntax
• Shared documentation structure
• Optionally: Rust or Go rewrite that works on both platforms (Rust has good Windows/GDI and Linux/X11 bindings)

---

Quick-Win Improvements

Idea	Effort	Impact
Frame noise injection	Low	High — makes freeze undetectable
Auto-freeze on master connect	Medium	High — eliminates reaction gap
Config profiles	Low	Medium — context switching
Activity event log	Low	Medium — monitoring pattern awareness
Customizable hotkeys	Low	Medium — avoid conflicts with other tools

---

Generated by nightshift idea-generator task.