updates to launcer

OrionToolbar/OrionVMController.swift

@@ -129,7 +129,7 @@ final class OrionVMController: ObservableObject {
             await refreshAll()
             await refreshServiceAvailability()
         }
-        timer = Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { [weak self] _ in Task { @MainActor in guard let self else { return }; await self.discoverVMs(); await self.refreshAll(); await self.refreshServiceAvailability() } }
+
     }
     deinit { timer?.invalidate() }
 
@@ -154,6 +154,8 @@ final class OrionVMController: ObservableObject {
 
                 if !missing { break }
 
+                guard !Task.isCancelled else { break }
+
                 if let output = try? await self.runPrlctl(["list", "-f"]) {
                     var addresses: [String: String] = [:]
 
@@ -186,13 +188,21 @@ final class OrionVMController: ObservableObject {
                             )
                             .lowercased()
 
-                        if self.discoveredVMs[index].ipAddress.isEmpty,
+                        if self.discoveredVMs[index].status.lowercased() == "running",
+                           self.discoveredVMs[index].ipAddress.isEmpty,
                            let ip = addresses[uuid] {
                             self.discoveredVMs[index].ipAddress = ip
                         }
                     }
                 }
 
+                let stillMissing = self.discoveredVMs.contains {
+                    $0.status.lowercased() == "running" &&
+                    $0.ipAddress.isEmpty
+                }
+
+                if !stillMissing { break }
+
                 try? await Task.sleep(for: .milliseconds(500))
             }
         }
@@ -216,26 +226,19 @@ final class OrionVMController: ObservableObject {
                 )
             }
 
-            // Parallels JSON may omit guest IP addresses even when running.
+            // Preserve acquired IPs while VMs remain running.
-            // The full VM listing provides the actual guest address.
+            let knownIPs = Dictionary(
-            var discoveredIPs: [String: String] = [:]
+                uniqueKeysWithValues: discoveredVMs.compactMap {
-            if let fullList = try? await runPrlctl(["list", "-f"]) {
+                    machine -> (String, String)? in
-                for line in fullList.split(separator: "\n").dropFirst() {
-                    let fields = line.split(
-                        maxSplits: 3,
-                        omittingEmptySubsequences: true,
-                        whereSeparator: { $0.isWhitespace }
-                    )
-                    guard fields.count == 4 else { continue }
 
-                    let uuid = String(fields[0])
+                    guard machine.status.lowercased() == "running",
-                    let ip = String(fields[2])
+                          !machine.ipAddress.isEmpty else {
-
+                        return nil
-                    if ip != "-" && ip != "0.0.0.0" {
-                        discoveredIPs[uuid.trimmingCharacters(in: CharacterSet(charactersIn: "{}")).lowercased()] = ip
                     }
+
+                    return (machine.id, machine.ipAddress)
                 }
-            }
+            )
 
             let knownBundlePaths = Dictionary(uniqueKeysWithValues:
                 discoveredVMs.compactMap { machine -> (String, String)? in
@@ -251,9 +254,14 @@ final class OrionVMController: ObservableObject {
 
                 let status = record["status"] as? String ?? "unknown"
                 let configuredIP = record["ip_configured"] as? String ?? ""
-                let ip = configuredIP.isEmpty || configuredIP == "-"
+
-                    ? (discoveredIPs[uuid.trimmingCharacters(in: CharacterSet(charactersIn: "{}")).lowercased()] ?? "")
+                let ip: String
-                    : configuredIP
+                if status.lowercased() == "running" {
+                    let reportedIP = configuredIP == "-" ? "" : configuredIP
+                    ip = knownIPs[uuid] ?? reportedIP
+                } else {
+                    ip = ""
+                }
 
                 return ParallelsVM(
                     id: uuid,
@@ -299,57 +307,17 @@ final class OrionVMController: ObservableObject {
                     }
                 }
             }
-            // Retry IP discovery once when a running VM has no address.
+            let needsIP = discoveredVMs.contains {
-            if discoveredVMs.contains(where: {
+                $0.status.lowercased() == "running" &&
-                $0.status.lowercased() == "running" && $0.ipAddress.isEmpty
+                $0.ipAddress.isEmpty
-            }) {
-                try? await Task.sleep(for: .seconds(1))
-
-                if let retry = try? await runPrlctl(["list", "-f"]) {
-                    var retryIPs: [String: String] = [:]
-
-                    for line in retry.split(separator: "\n").dropFirst() {
-                        let fields = line.split(
-                            maxSplits: 3,
-                            omittingEmptySubsequences: true,
-                            whereSeparator: { $0.isWhitespace }
-                        )
-
-                        guard fields.count == 4 else { continue }
-
-                        let uuid = String(fields[0])
-                            .trimmingCharacters(
-                                in: CharacterSet(charactersIn: "{}")
-                            )
-                            .lowercased()
-
-                        let ip = String(fields[2])
-
-                        if ip != "-" && ip != "0.0.0.0" {
-                            retryIPs[uuid] = ip
-                        }
-                    }
-
-                    for index in discoveredVMs.indices {
-                        guard discoveredVMs[index].status.lowercased() == "running",
-                              discoveredVMs[index].ipAddress.isEmpty else {
-                            continue
-                        }
-
-                        let uuid = discoveredVMs[index].id
-                            .trimmingCharacters(
-                                in: CharacterSet(charactersIn: "{}")
-                            )
-                            .lowercased()
-
-                        if let ip = retryIPs[uuid] {
-                            discoveredVMs[index].ipAddress = ip
-                        }
-                    }
-                }
             }
 
-            startIPRetry()
+            if needsIP {
+                startIPRetry()
+            } else {
+                ipRetryTask?.cancel()
+                ipRetryTask = nil
+            }
 
             // Keep selections only for VMs still present.
             let available = Set(discoveredVMs.map(\.id))

OrionToolbar/OrionVMController.swift.bak-20261023-111800

@@ -0,0 +1,690 @@
+import AppKit
+import Foundation
+
+struct ServerDefinition: Identifiable, Codable, Hashable {
+    var id = UUID()
+    var name: String
+    var vmName: String
+    var vmUUID: String? = nil
+    var host: String
+    var sshUser: String
+    var sshPort: Int = 22
+    var sshIdentityFile: String = ""
+    var mailpitPort: Int?
+    var customIconPath: String? = nil
+
+    static let orion = ServerDefinition(name: "Orion", vmName: "Ubuntu Linux Server", host: "10.211.55.100", sshUser: "sysadmin", sshPort: 22, sshIdentityFile: "", mailpitPort: 8025)
+}
+
+
+struct ParallelsVM: Identifiable, Hashable {
+    let id: String
+    let name: String
+    let status: String
+    var ipAddress: String
+    let operatingSystem: String
+    var bundlePath: String?
+
+    var symbol: String {
+        switch operatingSystem {
+        case "Windows": return "desktopcomputer"
+        case "Ubuntu": return "server.rack"
+        case "Debian": return "server.rack"
+        case "Fedora": return "server.rack"
+        case "CentOS": return "server.rack"
+        case "Alpine": return "server.rack"
+        case "Oracle Linux": return "server.rack"
+        default: return "desktopcomputer"
+        }
+    }
+
+    static func detectOS(_ name: String) -> String {
+        let value = name.lowercased()
+
+        if value.contains("windows") { return "Windows" }
+        if value.contains("ubuntu") { return "Ubuntu" }
+        if value.contains("debian") { return "Debian" }
+        if value.contains("fedora") { return "Fedora" }
+        if value.contains("centos") { return "CentOS" }
+        if value.contains("alpine") { return "Alpine" }
+        if value.contains("oracle") { return "Oracle Linux" }
+        if value.contains("rocky") { return "Rocky Linux" }
+        if value.contains("alma") { return "AlmaLinux" }
+        if value.contains("arch") { return "Arch Linux" }
+        if value.contains("gentoo") { return "Gentoo" }
+        if value.contains("freebsd") { return "FreeBSD" }
+
+        return "Other"
+    }
+}
+
+@MainActor
+final class OrionVMController: ObservableObject {
+    enum VMStatus: Equatable {
+        case checking, running, stopped, suspended, transitioning, unavailable(String)
+        var title: String { switch self { case .checking: "Checking…"; case .running: "Running"; case .stopped: "Stopped"; case .suspended: "Suspended"; case .transitioning: "Working…"; case .unavailable: "Unavailable" } }
+        var symbolName: String { switch self { case .running: "server.rack"; case .stopped: "power"; case .suspended: "pause.circle"; case .transitioning, .checking: "arrow.triangle.2.circlepath"; case .unavailable: "exclamationmark.triangle" } }
+    }
+
+    @Published var servers: [ServerDefinition] { didSet { saveServers() } }
+    @Published var statuses: [UUID: VMStatus] = [:]
+    @Published var busyServers: Set<UUID> = []
+    @Published private(set) var reachableSSH: Set<UUID> = []
+    @Published private(set) var reachableMailpit: Set<UUID> = []
+    @Published var lastError: String?
+    @Published var discoveredVMs: [ParallelsVM] = []
+    @Published private(set) var hiddenVMIDs: Set<String> = Set(
+        UserDefaults.standard.stringArray(forKey: "orionHiddenVMIDs.v1") ?? []
+    )
+
+    func hideVM(_ machine: ParallelsVM) {
+        hiddenVMIDs.insert(machine.id)
+        UserDefaults.standard.set(hiddenVMIDs.sorted(), forKey: "orionHiddenVMIDs.v1")
+    }
+
+    func restoreVM(_ machine: ParallelsVM) {
+        hiddenVMIDs.remove(machine.id)
+        UserDefaults.standard.set(hiddenVMIDs.sorted(), forKey: "orionHiddenVMIDs.v1")
+    }
+
+    var visibleVMs: [ParallelsVM] {
+        discoveredVMs.filter { !hiddenVMIDs.contains($0.id) }
+    }
+
+    var hiddenVMs: [ParallelsVM] {
+        discoveredVMs.filter { hiddenVMIDs.contains($0.id) }
+    }
+
+    @Published var selectedVMIDs: Set<String> = []
+    @Published var discovering = false
+    @Published var busyVMIDs: Set<String> = []
+    private var timer: Timer?
+    private let defaultsKey = "serverDefinitions.v2"
+    private let vmOrderKey = "orionVMOrder.v1"
+    private var vmOrder: [String] {
+        get { UserDefaults.standard.stringArray(forKey: vmOrderKey) ?? [] }
+        set { UserDefaults.standard.set(newValue, forKey: vmOrderKey) }
+    }
+
+    func reorderVM(draggedID: String, onto targetID: String) {
+        guard draggedID != targetID,
+              discoveredVMs.contains(where: { $0.id == draggedID }),
+              discoveredVMs.contains(where: { $0.id == targetID }) else { return }
+        var order = discoveredVMs.map(\.id)
+        guard let from = order.firstIndex(of: draggedID),
+              let to = order.firstIndex(of: targetID) else { return }
+        order.remove(at: from)
+        order.insert(draggedID, at: to)
+        vmOrder = order
+        let ranks = Dictionary(uniqueKeysWithValues: order.enumerated().map { ($0.element, $0.offset) })
+        discoveredVMs.sort { (ranks[$0.id] ?? Int.max) < (ranks[$1.id] ?? Int.max) }
+    }
+
+
+    init() {
+        if let data = UserDefaults.standard.data(forKey: defaultsKey), let saved = try? JSONDecoder().decode([ServerDefinition].self, from: data) { servers = saved }
+        else { servers = [.orion] }
+        Task {
+            await discoverVMs()
+            await refreshAll()
+            await refreshServiceAvailability()
+        }
+        timer = Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { [weak self] _ in Task { @MainActor in guard let self else { return }; await self.discoverVMs(); await self.refreshAll(); await self.refreshServiceAvailability() } }
+    }
+    deinit { timer?.invalidate() }
+
+
+    // Retry missing guest IPs every 500 ms until available.
+    // Uses the lightweight Parallels listing rather than full discovery.
+    private var ipRetryTask: Task<Void, Never>?
+
+    private func startIPRetry() {
+        guard ipRetryTask == nil else { return }
+
+        ipRetryTask = Task { @MainActor [weak self] in
+            guard let self else { return }
+
+            defer { self.ipRetryTask = nil }
+
+            while !Task.isCancelled {
+                let missing = self.discoveredVMs.contains {
+                    $0.status.lowercased() == "running" &&
+                    $0.ipAddress.isEmpty
+                }
+
+                if !missing { break }
+
+                if let output = try? await self.runPrlctl(["list", "-f"]) {
+                    var addresses: [String: String] = [:]
+
+                    for line in output.split(separator: "\n").dropFirst() {
+                        let fields = line.split(
+                            maxSplits: 3,
+                            omittingEmptySubsequences: true,
+                            whereSeparator: { $0.isWhitespace }
+                        )
+
+                        guard fields.count == 4 else { continue }
+
+                        let uuid = String(fields[0])
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        let ip = String(fields[2])
+
+                        if ip != "-" && ip != "0.0.0.0" {
+                            addresses[uuid] = ip
+                        }
+                    }
+
+                    for index in self.discoveredVMs.indices {
+                        let uuid = self.discoveredVMs[index].id
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        if self.discoveredVMs[index].ipAddress.isEmpty,
+                           let ip = addresses[uuid] {
+                            self.discoveredVMs[index].ipAddress = ip
+                        }
+                    }
+                }
+
+                try? await Task.sleep(for: .milliseconds(500))
+            }
+        }
+    }
+
+    func discoverVMs() async {
+        guard !discovering else { return }
+
+        discovering = true
+        defer { discovering = false }
+
+        do {
+            let output = try await runPrlctl(["list", "-a", "-j"])
+
+            guard let data = output.data(using: .utf8),
+                  let records = try JSONSerialization.jsonObject(
+                    with: data
+                  ) as? [[String: Any]] else {
+                throw OrionError.commandFailed(
+                    "Invalid Parallels VM discovery response."
+                )
+            }
+
+            // Parallels JSON may omit guest IP addresses even when running.
+            // The full VM listing provides the actual guest address.
+            var discoveredIPs: [String: String] = [:]
+            if let fullList = try? await runPrlctl(["list", "-f"]) {
+                for line in fullList.split(separator: "\n").dropFirst() {
+                    let fields = line.split(
+                        maxSplits: 3,
+                        omittingEmptySubsequences: true,
+                        whereSeparator: { $0.isWhitespace }
+                    )
+                    guard fields.count == 4 else { continue }
+
+                    let uuid = String(fields[0])
+                    let ip = String(fields[2])
+
+                    if ip != "-" && ip != "0.0.0.0" {
+                        discoveredIPs[uuid.trimmingCharacters(in: CharacterSet(charactersIn: "{}")).lowercased()] = ip
+                    }
+                }
+            }
+
+            let knownBundlePaths = Dictionary(uniqueKeysWithValues:
+                discoveredVMs.compactMap { machine -> (String, String)? in
+                    guard let path = machine.bundlePath else { return nil }
+                    return (machine.id, path)
+                }
+            )
+            discoveredVMs = records.compactMap { record in
+                guard let uuid = record["uuid"] as? String,
+                      let name = record["name"] as? String else {
+                    return nil
+                }
+
+                let status = record["status"] as? String ?? "unknown"
+                let configuredIP = record["ip_configured"] as? String ?? ""
+                let ip = configuredIP.isEmpty || configuredIP == "-"
+                    ? (discoveredIPs[uuid.trimmingCharacters(in: CharacterSet(charactersIn: "{}")).lowercased()] ?? "")
+                    : configuredIP
+
+                return ParallelsVM(
+                    id: uuid,
+                    name: name,
+                    status: status,
+                    ipAddress: ip == "-" ? "" : ip,
+                    operatingSystem: ParallelsVM.detectOS(name),
+                    bundlePath: knownBundlePaths[uuid]
+                )
+            }
+            .sorted {
+                $0.name.localizedStandardCompare($1.name)
+                    == .orderedAscending
+            }
+
+            // Keep the user's VM order through every 15-second discovery refresh.
+            // New VMs are appended in discovery order.
+            let savedOrder = vmOrder
+            let ranks = Dictionary(uniqueKeysWithValues: savedOrder.enumerated().map { ($0.element, $0.offset) })
+            discoveredVMs.sort { left, right in
+                let a = ranks[left.id] ?? Int.max
+                let b = ranks[right.id] ?? Int.max
+                if a != b { return a < b }
+                return left.name.localizedStandardCompare(right.name) == .orderedAscending
+            }
+
+            // Resolve Parallels VM bundles without requiring the guest to run.
+            for i in discoveredVMs.indices where discoveredVMs[i].bundlePath == nil {
+                if let detail = try? await runPrlctl(["list", "-i", discoveredVMs[i].id]) {
+                    // `Home:` ends with .pvm/ on this Parallels installation.
+                    if let homeLine = detail.split(separator: "\n").first(where: {
+                        $0.trimmingCharacters(in: .whitespaces).hasPrefix("Home:")
+                    }) {
+                        let trimmed = homeLine.trimmingCharacters(in: .whitespaces)
+                        let raw = String(trimmed.dropFirst("Home:".count))
+                            .trimmingCharacters(in: .whitespacesAndNewlines)
+                            .trimmingCharacters(in: CharacterSet(charactersIn: "\"'"))
+                        let expanded = (raw as NSString).expandingTildeInPath
+                        let normalized = (expanded as NSString).standardizingPath
+                        if FileManager.default.fileExists(atPath: normalized) {
+                            discoveredVMs[i].bundlePath = normalized
+                        }
+                    }
+                }
+            }
+            // Retry IP discovery once when a running VM has no address.
+            if discoveredVMs.contains(where: {
+                $0.status.lowercased() == "running" && $0.ipAddress.isEmpty
+            }) {
+                try? await Task.sleep(for: .seconds(1))
+
+                if let retry = try? await runPrlctl(["list", "-f"]) {
+                    var retryIPs: [String: String] = [:]
+
+                    for line in retry.split(separator: "\n").dropFirst() {
+                        let fields = line.split(
+                            maxSplits: 3,
+                            omittingEmptySubsequences: true,
+                            whereSeparator: { $0.isWhitespace }
+                        )
+
+                        guard fields.count == 4 else { continue }
+
+                        let uuid = String(fields[0])
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        let ip = String(fields[2])
+
+                        if ip != "-" && ip != "0.0.0.0" {
+                            retryIPs[uuid] = ip
+                        }
+                    }
+
+                    for index in discoveredVMs.indices {
+                        guard discoveredVMs[index].status.lowercased() == "running",
+                              discoveredVMs[index].ipAddress.isEmpty else {
+                            continue
+                        }
+
+                        let uuid = discoveredVMs[index].id
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        if let ip = retryIPs[uuid] {
+                            discoveredVMs[index].ipAddress = ip
+                        }
+                    }
+                }
+            }
+
+            startIPRetry()
+
+            // Keep selections only for VMs still present.
+            let available = Set(discoveredVMs.map(\.id))
+            selectedVMIDs.formIntersection(available)
+
+            // Associate existing configurations with discovered VMs.
+            // This preserves the original Orion configuration.
+            for machine in discoveredVMs {
+                guard let index = servers.firstIndex(where: {
+                    $0.vmUUID == machine.id ||
+                    ($0.vmUUID == nil && $0.vmName == machine.name)
+                }) else {
+                    continue
+                }
+
+                if servers[index].vmUUID == nil {
+                    servers[index].vmUUID = machine.id
+                }
+            }
+
+        } catch {
+            lastError = error.localizedDescription
+        }
+    }
+
+    func isIntegrated(_ machine: ParallelsVM) -> Bool {
+        servers.contains {
+            $0.vmUUID == machine.id ||
+            ($0.vmUUID == nil && $0.vmName == machine.name)
+        }
+    }
+
+    func toggleSelection(_ machine: ParallelsVM) {
+        if selectedVMIDs.contains(machine.id) {
+            selectedVMIDs.remove(machine.id)
+        } else {
+            selectedVMIDs.insert(machine.id)
+        }
+    }
+
+    func selectAllVMs() {
+        selectedVMIDs = Set(discoveredVMs.map(\.id))
+    }
+
+    func clearVMSelection() {
+        selectedVMIDs.removeAll()
+    }
+
+    func integrateSelectedVMs() {
+        let selected = discoveredVMs.filter {
+            selectedVMIDs.contains($0.id)
+        }
+
+        for machine in selected {
+            guard !isIntegrated(machine) else { continue }
+
+            let server = ServerDefinition(
+                name: machine.name,
+                vmName: machine.name,
+                vmUUID: machine.id,
+                host: machine.ipAddress,
+                sshUser: "sysadmin",
+                sshPort: 22,
+                sshIdentityFile: "",
+                mailpitPort: nil
+            )
+
+            add(server)
+        }
+
+        selectedVMIDs.removeAll()
+    }
+
+    func icon(for machine: ParallelsVM) -> NSImage? {
+        guard let path = machine.bundlePath,
+              FileManager.default.fileExists(atPath: path) else { return nil }
+        let bundle = URL(fileURLWithPath: path, isDirectory: true)
+
+        // Parallels stores the per-VM application under <VM>.pvm/VM.app.
+        // The .pvm Finder icon itself is generic and must not be used.
+        let app = bundle.appendingPathComponent("VM.app", isDirectory: true)
+        let plist = app.appendingPathComponent("Contents/Info.plist")
+        if let info = NSDictionary(contentsOf: plist) as? [String: Any] {
+            let resourceDir = app.appendingPathComponent("Contents/Resources", isDirectory: true)
+            for key in ["CFBundleIconFile", "CFBundleIconName"] {
+                if let name = info[key] as? String, !name.isEmpty {
+                    let names = name.lowercased().hasSuffix(".icns") ? [name] : [name + ".icns", name]
+                    for candidate in names {
+                        if let image = NSImage(contentsOf: resourceDir.appendingPathComponent(candidate)) {
+                            return image
+                        }
+                    }
+                }
+            }
+        }
+        for name in ["icon.png", "Icon.png", "icon.icns", "Icon.icns", ".VolumeIcon.icns"] {
+            if let image = NSImage(contentsOf: bundle.appendingPathComponent(name)) { return image }
+        }
+        // Never return NSWorkspace.icon(forFile: path): it is the generic .pvm icon.
+        return nil
+    }
+
+    func status(for server: ServerDefinition) -> VMStatus { statuses[server.id] ?? .checking }
+    func isBusy(_ server: ServerDefinition) -> Bool { busyServers.contains(server.id) }
+    func add(_ server: ServerDefinition) { servers.append(server); Task { await refreshStatus(server) } }
+    func update(_ server: ServerDefinition) { if let i = servers.firstIndex(where: { $0.id == server.id }) { servers[i] = server; Task { await refreshStatus(server) } } }
+    func delete(at offsets: IndexSet) { for i in offsets { statuses[servers[i].id] = nil }; servers.remove(atOffsets: offsets) }
+
+    func refreshAll() async {
+        for server in servers { await refreshStatus(server) }
+    }
+
+    func refreshStatus(_ server: ServerDefinition) async {
+        guard !isBusy(server) else { return }
+        guard let machine = discoveredVMs.first(where: {
+            $0.id == server.vmUUID || $0.name == server.vmName
+        }) else {
+            statuses[server.id] = .unavailable("VM not found in Parallels")
+            return
+        }
+        switch machine.status.lowercased() {
+        case "running": statuses[server.id] = .running
+        case "stopped": statuses[server.id] = .stopped
+        case "suspended", "paused": statuses[server.id] = .suspended
+        default: statuses[server.id] = .unavailable(machine.status)
+        }
+    }
+
+    func removeDefinition(_ server: ServerDefinition) {
+        servers.removeAll { $0.id == server.id }
+        statuses.removeValue(forKey: server.id)
+        busyServers.remove(server.id)
+    }
+
+    var runningVMs: [ParallelsVM] {
+        discoveredVMs.filter { $0.status.lowercased() == "running" }
+    }
+
+    func start(_ s: ServerDefinition) { perform(["start", s.vmUUID ?? s.vmName], server: s) }
+    func stop(_ s: ServerDefinition) { perform(["stop", s.vmUUID ?? s.vmName], server: s) }
+    func restart(_ s: ServerDefinition) { perform(["restart", s.vmUUID ?? s.vmName], server: s) }
+    func forceStop(_ s: ServerDefinition) { perform(["stop", s.vmUUID ?? s.vmName, "--kill"], server: s) }
+
+    private func perform(_ arguments: [String], server: ServerDefinition) {
+        guard !isBusy(server) else { return }; busyServers.insert(server.id); statuses[server.id] = .transitioning; lastError = nil
+        Task { do { _ = try await runPrlctl(arguments) } catch { lastError = error.localizedDescription }; busyServers.remove(server.id); try? await Task.sleep(for: .seconds(1)); await refreshStatus(server) }
+    }
+
+    func operate(_ machine: ParallelsVM, action: String) {
+        guard !busyVMIDs.contains(machine.id) else { return }
+        busyVMIDs.insert(machine.id)
+        lastError = nil
+        Task {
+            let arguments = action == "force-stop"
+                ? ["stop", machine.id, "--kill"]
+                : [action, machine.id]
+            do { _ = try await runPrlctl(arguments) }
+            catch { lastError = error.localizedDescription }
+            busyVMIDs.remove(machine.id)
+            await discoverVMs()
+            await refreshAll()
+            await refreshServiceAvailability()
+        }
+    }
+
+    func integrate(_ machine: ParallelsVM) {
+        guard !isIntegrated(machine) else { return }
+        add(ServerDefinition(name: machine.name, vmName: machine.name,
+            vmUUID: machine.id, host: machine.ipAddress, sshUser: "",
+            sshPort: 22, sshIdentityFile: "", mailpitPort: nil))
+    }
+
+    func moveServer(from source: IndexSet, to destination: Int) {
+        servers.move(fromOffsets: source, toOffset: destination)
+    }
+
+    func moveServer(_ id: UUID, by delta: Int) {
+        guard let index = servers.firstIndex(where: { $0.id == id }) else { return }
+        let target = index + delta
+        guard servers.indices.contains(target) else { return }
+        servers.swapAt(index, target)
+    }
+
+    func reorderServer(draggedID: UUID, onto targetID: UUID) {
+        guard draggedID != targetID,
+              let from = servers.firstIndex(where: { $0.id == draggedID }),
+              let to = servers.firstIndex(where: { $0.id == targetID }) else { return }
+        let moved = servers.remove(at: from)
+        servers.insert(moved, at: to) // @Published didSet persists the order.
+    }
+
+    func icon(for server: ServerDefinition) -> NSImage? {
+        if let path = server.customIconPath, let image = NSImage(contentsOfFile: path) {
+            return image
+        }
+
+        guard let machine = discoveredVMs.first(where: {
+            $0.id == server.vmUUID || $0.name == server.vmName
+        }) else { return nil }
+        return icon(for: machine)
+    }
+
+    // Availability is probed off the main actor. An open SSH port means
+    // the SSH action can be offered; credentials are checked by ssh itself.
+    func refreshServiceAvailability() async {
+        let candidates = servers.filter { server in
+            guard !server.host.isEmpty else { return false }
+            return discoveredVMs.contains {
+                ($0.id == server.vmUUID || $0.name == server.vmName) &&
+                $0.status.lowercased() == "running"
+            }
+        }
+        let results = await withTaskGroup(of: (UUID, Bool, Bool).self,
+                                          returning: [(UUID, Bool, Bool)].self) { group in
+            for server in candidates {
+                group.addTask {
+                    async let ssh = Self.tcpPortOpen(host: server.host, port: server.sshPort)
+                    async let mailpit = Self.mailpitResponding(host: server.host, port: server.mailpitPort)
+                    return (server.id, await ssh, await mailpit)
+                }
+            }
+            var values: [(UUID, Bool, Bool)] = []
+            for await result in group { values.append(result) }
+            return values
+        }
+        reachableSSH = Set(results.filter { $0.1 }.map { $0.0 })
+        reachableMailpit = Set(results.filter { $0.2 }.map { $0.0 })
+    }
+
+    private nonisolated static func tcpPortOpen(host: String, port: Int) async -> Bool {
+        guard (1...65535).contains(port), !host.isEmpty else { return false }
+        return await Task.detached(priority: .utility) {
+            let process = Process()
+            process.executableURL = URL(fileURLWithPath: "/usr/bin/nc")
+            process.arguments = ["-G", "2", "-z", host, String(port)]
+            process.standardOutput = FileHandle.nullDevice
+            process.standardError = FileHandle.nullDevice
+            do {
+                try process.run()
+                process.waitUntilExit()
+                return process.terminationStatus == 0
+            } catch { return false }
+        }.value
+    }
+
+    private nonisolated static func mailpitResponding(host: String, port: Int?) async -> Bool {
+        guard let port, (1...65535).contains(port), !host.isEmpty,
+              let url = URL(string: "http://\(host):\(port)/") else { return false }
+        var request = URLRequest(url: url)
+        request.timeoutInterval = 3
+        request.httpMethod = "GET"
+        do {
+            let (_, response) = try await URLSession.shared.data(for: request)
+            guard let http = response as? HTTPURLResponse else { return false }
+            return (200..<500).contains(http.statusCode)
+        } catch { return false }
+    }
+
+    func openSSH(_ s: ServerDefinition) {
+        NSApp.hide(nil)
+        let userHost = "\(s.sshUser)@\(s.host)"
+        var command = "/usr/bin/ssh -p \(s.sshPort)"
+        let identity = s.sshIdentityFile.trimmingCharacters(in: .whitespacesAndNewlines)
+        if !identity.isEmpty {
+            command += " -i \(shellQuote((identity as NSString).expandingTildeInPath))"
+        }
+        command += " \(shellQuote(userHost))"
+
+        do {
+            // Terminal reliably opens executable .command files without requiring
+            // Apple Events/Automation permission from this menu-bar application.
+            let directory = FileManager.default.temporaryDirectory
+                .appendingPathComponent("OrionToolbar", isDirectory: true)
+            try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+
+            let safeName = s.name.replacingOccurrences(of: "/", with: "-")
+            let scriptURL = directory.appendingPathComponent("SSH-\(safeName).command")
+            let script = """
+            #!/bin/zsh
+            clear
+            echo "Connecting to \(s.name) (\(userHost))..."
+            exec \(command)
+            """
+            try script.write(to: scriptURL, atomically: true, encoding: .utf8)
+            try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: scriptURL.path)
+
+            guard let terminalURL = NSWorkspace.shared.urlForApplication(withBundleIdentifier: "com.apple.Terminal") else {
+                lastError = "Terminal.app could not be found."
+                return
+            }
+
+            let configuration = NSWorkspace.OpenConfiguration()
+            configuration.activates = true
+            NSWorkspace.shared.open([scriptURL], withApplicationAt: terminalURL, configuration: configuration) { application, error in
+                Task { @MainActor in
+                    if let error {
+                        self.lastError = "Could not open Terminal: \(error.localizedDescription)"
+                    } else {
+                        DispatchQueue.main.asyncAfter(deadline: .now() + 0.35) {
+                            application?.activate(options: [.activateAllWindows])
+                        }
+                    }
+                }
+            }
+        } catch {
+            lastError = "Could not create SSH launcher: \(error.localizedDescription)"
+        }
+    }
+
+    private func shellQuote(_ value: String) -> String {
+        "'" + value.replacingOccurrences(of: "'", with: "'\"'\"'") + "'"
+    }
+    func openMailpit(_ s: ServerDefinition) {
+        guard let p = s.mailpitPort,
+              let url = URL(string: "http://\(s.host):\(p)") else { return }
+        NSApp.hide(nil)
+        let browserURL = NSWorkspace.shared.urlForApplication(toOpen: url)
+        NSWorkspace.shared.open(url)
+        if let browserURL {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.4) {
+                let browser = NSWorkspace.shared.runningApplications.first {
+                    $0.bundleURL == browserURL
+                }
+                browser?.activate(options: [.activateAllWindows])
+            }
+        }
+    }
+    func openParallels() { NSWorkspace.shared.openApplication(at: URL(fileURLWithPath: "/Applications/Parallels Desktop.app"), configuration: .init()) }
+
+    private func saveServers() { if let data = try? JSONEncoder().encode(servers) { UserDefaults.standard.set(data, forKey: defaultsKey) } }
+    private func prlctlURL() -> URL? { ["/usr/local/bin/prlctl", "/Applications/Parallels Desktop.app/Contents/MacOS/prlctl"].map(URL.init(fileURLWithPath:)).first { FileManager.default.isExecutableFile(atPath: $0.path) } }
+    private func runPrlctl(_ arguments: [String]) async throws -> String {
+        guard let executable = prlctlURL() else { throw OrionError.prlctlNotFound }
+        return try await Task.detached(priority: .userInitiated) { let p = Process(); let pipe = Pipe(); p.executableURL = executable; p.arguments = arguments; p.standardOutput = pipe; p.standardError = pipe; try p.run(); let data = pipe.fileHandleForReading.readDataToEndOfFile(); p.waitUntilExit(); let out = String(decoding: data, as: UTF8.self); guard p.terminationStatus == 0 else { throw OrionError.commandFailed(out) }; return out }.value
+    }
+}
+
+enum OrionError: LocalizedError { case prlctlNotFound, commandFailed(String); var errorDescription: String? { switch self { case .prlctlNotFound: "Parallels prlctl was not found."; case .commandFailed(let o): o.trimmingCharacters(in: .whitespacesAndNewlines) } } }

OrionToolbar/OrionVMController.swift.bak-20261023-111914

@@ -0,0 +1,650 @@
+import AppKit
+import Foundation
+
+struct ServerDefinition: Identifiable, Codable, Hashable {
+    var id = UUID()
+    var name: String
+    var vmName: String
+    var vmUUID: String? = nil
+    var host: String
+    var sshUser: String
+    var sshPort: Int = 22
+    var sshIdentityFile: String = ""
+    var mailpitPort: Int?
+    var customIconPath: String? = nil
+
+    static let orion = ServerDefinition(name: "Orion", vmName: "Ubuntu Linux Server", host: "10.211.55.100", sshUser: "sysadmin", sshPort: 22, sshIdentityFile: "", mailpitPort: 8025)
+}
+
+
+struct ParallelsVM: Identifiable, Hashable {
+    let id: String
+    let name: String
+    let status: String
+    var ipAddress: String
+    let operatingSystem: String
+    var bundlePath: String?
+
+    var symbol: String {
+        switch operatingSystem {
+        case "Windows": return "desktopcomputer"
+        case "Ubuntu": return "server.rack"
+        case "Debian": return "server.rack"
+        case "Fedora": return "server.rack"
+        case "CentOS": return "server.rack"
+        case "Alpine": return "server.rack"
+        case "Oracle Linux": return "server.rack"
+        default: return "desktopcomputer"
+        }
+    }
+
+    static func detectOS(_ name: String) -> String {
+        let value = name.lowercased()
+
+        if value.contains("windows") { return "Windows" }
+        if value.contains("ubuntu") { return "Ubuntu" }
+        if value.contains("debian") { return "Debian" }
+        if value.contains("fedora") { return "Fedora" }
+        if value.contains("centos") { return "CentOS" }
+        if value.contains("alpine") { return "Alpine" }
+        if value.contains("oracle") { return "Oracle Linux" }
+        if value.contains("rocky") { return "Rocky Linux" }
+        if value.contains("alma") { return "AlmaLinux" }
+        if value.contains("arch") { return "Arch Linux" }
+        if value.contains("gentoo") { return "Gentoo" }
+        if value.contains("freebsd") { return "FreeBSD" }
+
+        return "Other"
+    }
+}
+
+@MainActor
+final class OrionVMController: ObservableObject {
+    enum VMStatus: Equatable {
+        case checking, running, stopped, suspended, transitioning, unavailable(String)
+        var title: String { switch self { case .checking: "Checking…"; case .running: "Running"; case .stopped: "Stopped"; case .suspended: "Suspended"; case .transitioning: "Working…"; case .unavailable: "Unavailable" } }
+        var symbolName: String { switch self { case .running: "server.rack"; case .stopped: "power"; case .suspended: "pause.circle"; case .transitioning, .checking: "arrow.triangle.2.circlepath"; case .unavailable: "exclamationmark.triangle" } }
+    }
+
+    @Published var servers: [ServerDefinition] { didSet { saveServers() } }
+    @Published var statuses: [UUID: VMStatus] = [:]
+    @Published var busyServers: Set<UUID> = []
+    @Published private(set) var reachableSSH: Set<UUID> = []
+    @Published private(set) var reachableMailpit: Set<UUID> = []
+    @Published var lastError: String?
+    @Published var discoveredVMs: [ParallelsVM] = []
+    @Published private(set) var hiddenVMIDs: Set<String> = Set(
+        UserDefaults.standard.stringArray(forKey: "orionHiddenVMIDs.v1") ?? []
+    )
+
+    func hideVM(_ machine: ParallelsVM) {
+        hiddenVMIDs.insert(machine.id)
+        UserDefaults.standard.set(hiddenVMIDs.sorted(), forKey: "orionHiddenVMIDs.v1")
+    }
+
+    func restoreVM(_ machine: ParallelsVM) {
+        hiddenVMIDs.remove(machine.id)
+        UserDefaults.standard.set(hiddenVMIDs.sorted(), forKey: "orionHiddenVMIDs.v1")
+    }
+
+    var visibleVMs: [ParallelsVM] {
+        discoveredVMs.filter { !hiddenVMIDs.contains($0.id) }
+    }
+
+    var hiddenVMs: [ParallelsVM] {
+        discoveredVMs.filter { hiddenVMIDs.contains($0.id) }
+    }
+
+    @Published var selectedVMIDs: Set<String> = []
+    @Published var discovering = false
+    @Published var busyVMIDs: Set<String> = []
+    private var timer: Timer?
+    private let defaultsKey = "serverDefinitions.v2"
+    private let vmOrderKey = "orionVMOrder.v1"
+    private var vmOrder: [String] {
+        get { UserDefaults.standard.stringArray(forKey: vmOrderKey) ?? [] }
+        set { UserDefaults.standard.set(newValue, forKey: vmOrderKey) }
+    }
+
+    func reorderVM(draggedID: String, onto targetID: String) {
+        guard draggedID != targetID,
+              discoveredVMs.contains(where: { $0.id == draggedID }),
+              discoveredVMs.contains(where: { $0.id == targetID }) else { return }
+        var order = discoveredVMs.map(\.id)
+        guard let from = order.firstIndex(of: draggedID),
+              let to = order.firstIndex(of: targetID) else { return }
+        order.remove(at: from)
+        order.insert(draggedID, at: to)
+        vmOrder = order
+        let ranks = Dictionary(uniqueKeysWithValues: order.enumerated().map { ($0.element, $0.offset) })
+        discoveredVMs.sort { (ranks[$0.id] ?? Int.max) < (ranks[$1.id] ?? Int.max) }
+    }
+
+
+    init() {
+        if let data = UserDefaults.standard.data(forKey: defaultsKey), let saved = try? JSONDecoder().decode([ServerDefinition].self, from: data) { servers = saved }
+        else { servers = [.orion] }
+        Task {
+            await discoverVMs()
+            await refreshAll()
+            await refreshServiceAvailability()
+        }
+        timer = Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { [weak self] _ in Task { @MainActor in guard let self else { return }; await self.discoverVMs(); await self.refreshAll(); await self.refreshServiceAvailability() } }
+    }
+    deinit { timer?.invalidate() }
+
+
+    // Retry missing guest IPs every 500 ms until available.
+    // Uses the lightweight Parallels listing rather than full discovery.
+    private var ipRetryTask: Task<Void, Never>?
+
+    private func startIPRetry() {
+        guard ipRetryTask == nil else { return }
+
+        ipRetryTask = Task { @MainActor [weak self] in
+            guard let self else { return }
+
+            defer { self.ipRetryTask = nil }
+
+            while !Task.isCancelled {
+                let missing = self.discoveredVMs.contains {
+                    $0.status.lowercased() == "running" &&
+                    $0.ipAddress.isEmpty
+                }
+
+                if !missing { break }
+
+                if let output = try? await self.runPrlctl(["list", "-f"]) {
+                    var addresses: [String: String] = [:]
+
+                    for line in output.split(separator: "\n").dropFirst() {
+                        let fields = line.split(
+                            maxSplits: 3,
+                            omittingEmptySubsequences: true,
+                            whereSeparator: { $0.isWhitespace }
+                        )
+
+                        guard fields.count == 4 else { continue }
+
+                        let uuid = String(fields[0])
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        let ip = String(fields[2])
+
+                        if ip != "-" && ip != "0.0.0.0" {
+                            addresses[uuid] = ip
+                        }
+                    }
+
+                    for index in self.discoveredVMs.indices {
+                        let uuid = self.discoveredVMs[index].id
+                            .trimmingCharacters(
+                                in: CharacterSet(charactersIn: "{}")
+                            )
+                            .lowercased()
+
+                        if self.discoveredVMs[index].ipAddress.isEmpty,
+                           let ip = addresses[uuid] {
+                            self.discoveredVMs[index].ipAddress = ip
+                        }
+                    }
+                }
+
+                let stillMissing = self.discoveredVMs.contains {
+                    $0.status.lowercased() == "running" &&
+                    $0.ipAddress.isEmpty
+                }
+
+                if !stillMissing { break }
+
+                try? await Task.sleep(for: .milliseconds(500))
+            }
+        }
+    }
+
+    func discoverVMs() async {
+        guard !discovering else { return }
+
+        discovering = true
+        defer { discovering = false }
+
+        do {
+            let output = try await runPrlctl(["list", "-a", "-j"])
+
+            guard let data = output.data(using: .utf8),
+                  let records = try JSONSerialization.jsonObject(
+                    with: data
+                  ) as? [[String: Any]] else {
+                throw OrionError.commandFailed(
+                    "Invalid Parallels VM discovery response."
+                )
+            }
+
+            // Preserve acquired IPs while VMs remain running.
+            let knownIPs = Dictionary(
+                uniqueKeysWithValues: discoveredVMs.compactMap {
+                    machine -> (String, String)? in
+
+                    guard machine.status.lowercased() == "running",
+                          !machine.ipAddress.isEmpty else {
+                        return nil
+                    }
+
+                    return (machine.id, machine.ipAddress)
+                }
+            )
+
+            let knownBundlePaths = Dictionary(uniqueKeysWithValues:
+                discoveredVMs.compactMap { machine -> (String, String)? in
+                    guard let path = machine.bundlePath else { return nil }
+                    return (machine.id, path)
+                }
+            )
+            discoveredVMs = records.compactMap { record in
+                guard let uuid = record["uuid"] as? String,
+                      let name = record["name"] as? String else {
+                    return nil
+                }
+
+                let status = record["status"] as? String ?? "unknown"
+                let configuredIP = record["ip_configured"] as? String ?? ""
+
+                let ip: String
+                if status.lowercased() == "running" {
+                    let reportedIP = configuredIP == "-" ? "" : configuredIP
+                    ip = knownIPs[uuid] ?? reportedIP
+                } else {
+                    ip = ""
+                }
+
+                return ParallelsVM(
+                    id: uuid,
+                    name: name,
+                    status: status,
+                    ipAddress: ip == "-" ? "" : ip,
+                    operatingSystem: ParallelsVM.detectOS(name),
+                    bundlePath: knownBundlePaths[uuid]
+                )
+            }
+            .sorted {
+                $0.name.localizedStandardCompare($1.name)
+                    == .orderedAscending
+            }
+
+            // Keep the user's VM order through every 15-second discovery refresh.
+            // New VMs are appended in discovery order.
+            let savedOrder = vmOrder
+            let ranks = Dictionary(uniqueKeysWithValues: savedOrder.enumerated().map { ($0.element, $0.offset) })
+            discoveredVMs.sort { left, right in
+                let a = ranks[left.id] ?? Int.max
+                let b = ranks[right.id] ?? Int.max
+                if a != b { return a < b }
+                return left.name.localizedStandardCompare(right.name) == .orderedAscending
+            }
+
+            // Resolve Parallels VM bundles without requiring the guest to run.
+            for i in discoveredVMs.indices where discoveredVMs[i].bundlePath == nil {
+                if let detail = try? await runPrlctl(["list", "-i", discoveredVMs[i].id]) {
+                    // `Home:` ends with .pvm/ on this Parallels installation.
+                    if let homeLine = detail.split(separator: "\n").first(where: {
+                        $0.trimmingCharacters(in: .whitespaces).hasPrefix("Home:")
+                    }) {
+                        let trimmed = homeLine.trimmingCharacters(in: .whitespaces)
+                        let raw = String(trimmed.dropFirst("Home:".count))
+                            .trimmingCharacters(in: .whitespacesAndNewlines)
+                            .trimmingCharacters(in: CharacterSet(charactersIn: "\"'"))
+                        let expanded = (raw as NSString).expandingTildeInPath
+                        let normalized = (expanded as NSString).standardizingPath
+                        if FileManager.default.fileExists(atPath: normalized) {
+                            discoveredVMs[i].bundlePath = normalized
+                        }
+                    }
+                }
+            }
+            if discoveredVMs.contains(where: {
+                $0.status.lowercased() == "running" &&
+                $0.ipAddress.isEmpty
+            }) {
+                startIPRetry()
+            }
+
+            // Keep selections only for VMs still present.
+            let available = Set(discoveredVMs.map(\.id))
+            selectedVMIDs.formIntersection(available)
+
+            // Associate existing configurations with discovered VMs.
+            // This preserves the original Orion configuration.
+            for machine in discoveredVMs {
+                guard let index = servers.firstIndex(where: {
+                    $0.vmUUID == machine.id ||
+                    ($0.vmUUID == nil && $0.vmName == machine.name)
+                }) else {
+                    continue
+                }
+
+                if servers[index].vmUUID == nil {
+                    servers[index].vmUUID = machine.id
+                }
+            }
+
+        } catch {
+            lastError = error.localizedDescription
+        }
+    }
+
+    func isIntegrated(_ machine: ParallelsVM) -> Bool {
+        servers.contains {
+            $0.vmUUID == machine.id ||
+            ($0.vmUUID == nil && $0.vmName == machine.name)
+        }
+    }
+
+    func toggleSelection(_ machine: ParallelsVM) {
+        if selectedVMIDs.contains(machine.id) {
+            selectedVMIDs.remove(machine.id)
+        } else {
+            selectedVMIDs.insert(machine.id)
+        }
+    }
+
+    func selectAllVMs() {
+        selectedVMIDs = Set(discoveredVMs.map(\.id))
+    }
+
+    func clearVMSelection() {
+        selectedVMIDs.removeAll()
+    }
+
+    func integrateSelectedVMs() {
+        let selected = discoveredVMs.filter {
+            selectedVMIDs.contains($0.id)
+        }
+
+        for machine in selected {
+            guard !isIntegrated(machine) else { continue }
+
+            let server = ServerDefinition(
+                name: machine.name,
+                vmName: machine.name,
+                vmUUID: machine.id,
+                host: machine.ipAddress,
+                sshUser: "sysadmin",
+                sshPort: 22,
+                sshIdentityFile: "",
+                mailpitPort: nil
+            )
+
+            add(server)
+        }
+
+        selectedVMIDs.removeAll()
+    }
+
+    func icon(for machine: ParallelsVM) -> NSImage? {
+        guard let path = machine.bundlePath,
+              FileManager.default.fileExists(atPath: path) else { return nil }
+        let bundle = URL(fileURLWithPath: path, isDirectory: true)
+
+        // Parallels stores the per-VM application under <VM>.pvm/VM.app.
+        // The .pvm Finder icon itself is generic and must not be used.
+        let app = bundle.appendingPathComponent("VM.app", isDirectory: true)
+        let plist = app.appendingPathComponent("Contents/Info.plist")
+        if let info = NSDictionary(contentsOf: plist) as? [String: Any] {
+            let resourceDir = app.appendingPathComponent("Contents/Resources", isDirectory: true)
+            for key in ["CFBundleIconFile", "CFBundleIconName"] {
+                if let name = info[key] as? String, !name.isEmpty {
+                    let names = name.lowercased().hasSuffix(".icns") ? [name] : [name + ".icns", name]
+                    for candidate in names {
+                        if let image = NSImage(contentsOf: resourceDir.appendingPathComponent(candidate)) {
+                            return image
+                        }
+                    }
+                }
+            }
+        }
+        for name in ["icon.png", "Icon.png", "icon.icns", "Icon.icns", ".VolumeIcon.icns"] {
+            if let image = NSImage(contentsOf: bundle.appendingPathComponent(name)) { return image }
+        }
+        // Never return NSWorkspace.icon(forFile: path): it is the generic .pvm icon.
+        return nil
+    }
+
+    func status(for server: ServerDefinition) -> VMStatus { statuses[server.id] ?? .checking }
+    func isBusy(_ server: ServerDefinition) -> Bool { busyServers.contains(server.id) }
+    func add(_ server: ServerDefinition) { servers.append(server); Task { await refreshStatus(server) } }
+    func update(_ server: ServerDefinition) { if let i = servers.firstIndex(where: { $0.id == server.id }) { servers[i] = server; Task { await refreshStatus(server) } } }
+    func delete(at offsets: IndexSet) { for i in offsets { statuses[servers[i].id] = nil }; servers.remove(atOffsets: offsets) }
+
+    func refreshAll() async {
+        for server in servers { await refreshStatus(server) }
+    }
+
+    func refreshStatus(_ server: ServerDefinition) async {
+        guard !isBusy(server) else { return }
+        guard let machine = discoveredVMs.first(where: {
+            $0.id == server.vmUUID || $0.name == server.vmName
+        }) else {
+            statuses[server.id] = .unavailable("VM not found in Parallels")
+            return
+        }
+        switch machine.status.lowercased() {
+        case "running": statuses[server.id] = .running
+        case "stopped": statuses[server.id] = .stopped
+        case "suspended", "paused": statuses[server.id] = .suspended
+        default: statuses[server.id] = .unavailable(machine.status)
+        }
+    }
+
+    func removeDefinition(_ server: ServerDefinition) {
+        servers.removeAll { $0.id == server.id }
+        statuses.removeValue(forKey: server.id)
+        busyServers.remove(server.id)
+    }
+
+    var runningVMs: [ParallelsVM] {
+        discoveredVMs.filter { $0.status.lowercased() == "running" }
+    }
+
+    func start(_ s: ServerDefinition) { perform(["start", s.vmUUID ?? s.vmName], server: s) }
+    func stop(_ s: ServerDefinition) { perform(["stop", s.vmUUID ?? s.vmName], server: s) }
+    func restart(_ s: ServerDefinition) { perform(["restart", s.vmUUID ?? s.vmName], server: s) }
+    func forceStop(_ s: ServerDefinition) { perform(["stop", s.vmUUID ?? s.vmName, "--kill"], server: s) }
+
+    private func perform(_ arguments: [String], server: ServerDefinition) {
+        guard !isBusy(server) else { return }; busyServers.insert(server.id); statuses[server.id] = .transitioning; lastError = nil
+        Task { do { _ = try await runPrlctl(arguments) } catch { lastError = error.localizedDescription }; busyServers.remove(server.id); try? await Task.sleep(for: .seconds(1)); await refreshStatus(server) }
+    }
+
+    func operate(_ machine: ParallelsVM, action: String) {
+        guard !busyVMIDs.contains(machine.id) else { return }
+        busyVMIDs.insert(machine.id)
+        lastError = nil
+        Task {
+            let arguments = action == "force-stop"
+                ? ["stop", machine.id, "--kill"]
+                : [action, machine.id]
+            do { _ = try await runPrlctl(arguments) }
+            catch { lastError = error.localizedDescription }
+            busyVMIDs.remove(machine.id)
+            await discoverVMs()
+            await refreshAll()
+            await refreshServiceAvailability()
+        }
+    }
+
+    func integrate(_ machine: ParallelsVM) {
+        guard !isIntegrated(machine) else { return }
+        add(ServerDefinition(name: machine.name, vmName: machine.name,
+            vmUUID: machine.id, host: machine.ipAddress, sshUser: "",
+            sshPort: 22, sshIdentityFile: "", mailpitPort: nil))
+    }
+
+    func moveServer(from source: IndexSet, to destination: Int) {
+        servers.move(fromOffsets: source, toOffset: destination)
+    }
+
+    func moveServer(_ id: UUID, by delta: Int) {
+        guard let index = servers.firstIndex(where: { $0.id == id }) else { return }
+        let target = index + delta
+        guard servers.indices.contains(target) else { return }
+        servers.swapAt(index, target)
+    }
+
+    func reorderServer(draggedID: UUID, onto targetID: UUID) {
+        guard draggedID != targetID,
+              let from = servers.firstIndex(where: { $0.id == draggedID }),
+              let to = servers.firstIndex(where: { $0.id == targetID }) else { return }
+        let moved = servers.remove(at: from)
+        servers.insert(moved, at: to) // @Published didSet persists the order.
+    }
+
+    func icon(for server: ServerDefinition) -> NSImage? {
+        if let path = server.customIconPath, let image = NSImage(contentsOfFile: path) {
+            return image
+        }
+
+        guard let machine = discoveredVMs.first(where: {
+            $0.id == server.vmUUID || $0.name == server.vmName
+        }) else { return nil }
+        return icon(for: machine)
+    }
+
+    // Availability is probed off the main actor. An open SSH port means
+    // the SSH action can be offered; credentials are checked by ssh itself.
+    func refreshServiceAvailability() async {
+        let candidates = servers.filter { server in
+            guard !server.host.isEmpty else { return false }
+            return discoveredVMs.contains {
+                ($0.id == server.vmUUID || $0.name == server.vmName) &&
+                $0.status.lowercased() == "running"
+            }
+        }
+        let results = await withTaskGroup(of: (UUID, Bool, Bool).self,
+                                          returning: [(UUID, Bool, Bool)].self) { group in
+            for server in candidates {
+                group.addTask {
+                    async let ssh = Self.tcpPortOpen(host: server.host, port: server.sshPort)
+                    async let mailpit = Self.mailpitResponding(host: server.host, port: server.mailpitPort)
+                    return (server.id, await ssh, await mailpit)
+                }
+            }
+            var values: [(UUID, Bool, Bool)] = []
+            for await result in group { values.append(result) }
+            return values
+        }
+        reachableSSH = Set(results.filter { $0.1 }.map { $0.0 })
+        reachableMailpit = Set(results.filter { $0.2 }.map { $0.0 })
+    }
+
+    private nonisolated static func tcpPortOpen(host: String, port: Int) async -> Bool {
+        guard (1...65535).contains(port), !host.isEmpty else { return false }
+        return await Task.detached(priority: .utility) {
+            let process = Process()
+            process.executableURL = URL(fileURLWithPath: "/usr/bin/nc")
+            process.arguments = ["-G", "2", "-z", host, String(port)]
+            process.standardOutput = FileHandle.nullDevice
+            process.standardError = FileHandle.nullDevice
+            do {
+                try process.run()
+                process.waitUntilExit()
+                return process.terminationStatus == 0
+            } catch { return false }
+        }.value
+    }
+
+    private nonisolated static func mailpitResponding(host: String, port: Int?) async -> Bool {
+        guard let port, (1...65535).contains(port), !host.isEmpty,
+              let url = URL(string: "http://\(host):\(port)/") else { return false }
+        var request = URLRequest(url: url)
+        request.timeoutInterval = 3
+        request.httpMethod = "GET"
+        do {
+            let (_, response) = try await URLSession.shared.data(for: request)
+            guard let http = response as? HTTPURLResponse else { return false }
+            return (200..<500).contains(http.statusCode)
+        } catch { return false }
+    }
+
+    func openSSH(_ s: ServerDefinition) {
+        NSApp.hide(nil)
+        let userHost = "\(s.sshUser)@\(s.host)"
+        var command = "/usr/bin/ssh -p \(s.sshPort)"
+        let identity = s.sshIdentityFile.trimmingCharacters(in: .whitespacesAndNewlines)
+        if !identity.isEmpty {
+            command += " -i \(shellQuote((identity as NSString).expandingTildeInPath))"
+        }
+        command += " \(shellQuote(userHost))"
+
+        do {
+            // Terminal reliably opens executable .command files without requiring
+            // Apple Events/Automation permission from this menu-bar application.
+            let directory = FileManager.default.temporaryDirectory
+                .appendingPathComponent("OrionToolbar", isDirectory: true)
+            try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+
+            let safeName = s.name.replacingOccurrences(of: "/", with: "-")
+            let scriptURL = directory.appendingPathComponent("SSH-\(safeName).command")
+            let script = """
+            #!/bin/zsh
+            clear
+            echo "Connecting to \(s.name) (\(userHost))..."
+            exec \(command)
+            """
+            try script.write(to: scriptURL, atomically: true, encoding: .utf8)
+            try FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: scriptURL.path)
+
+            guard let terminalURL = NSWorkspace.shared.urlForApplication(withBundleIdentifier: "com.apple.Terminal") else {
+                lastError = "Terminal.app could not be found."
+                return
+            }
+
+            let configuration = NSWorkspace.OpenConfiguration()
+            configuration.activates = true
+            NSWorkspace.shared.open([scriptURL], withApplicationAt: terminalURL, configuration: configuration) { application, error in
+                Task { @MainActor in
+                    if let error {
+                        self.lastError = "Could not open Terminal: \(error.localizedDescription)"
+                    } else {
+                        DispatchQueue.main.asyncAfter(deadline: .now() + 0.35) {
+                            application?.activate(options: [.activateAllWindows])
+                        }
+                    }
+                }
+            }
+        } catch {
+            lastError = "Could not create SSH launcher: \(error.localizedDescription)"
+        }
+    }
+
+    private func shellQuote(_ value: String) -> String {
+        "'" + value.replacingOccurrences(of: "'", with: "'\"'\"'") + "'"
+    }
+    func openMailpit(_ s: ServerDefinition) {
+        guard let p = s.mailpitPort,
+              let url = URL(string: "http://\(s.host):\(p)") else { return }
+        NSApp.hide(nil)
+        let browserURL = NSWorkspace.shared.urlForApplication(toOpen: url)
+        NSWorkspace.shared.open(url)
+        if let browserURL {
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.4) {
+                let browser = NSWorkspace.shared.runningApplications.first {
+                    $0.bundleURL == browserURL
+                }
+                browser?.activate(options: [.activateAllWindows])
+            }
+        }
+    }
+    func openParallels() { NSWorkspace.shared.openApplication(at: URL(fileURLWithPath: "/Applications/Parallels Desktop.app"), configuration: .init()) }
+
+    private func saveServers() { if let data = try? JSONEncoder().encode(servers) { UserDefaults.standard.set(data, forKey: defaultsKey) } }
+    private func prlctlURL() -> URL? { ["/usr/local/bin/prlctl", "/Applications/Parallels Desktop.app/Contents/MacOS/prlctl"].map(URL.init(fileURLWithPath:)).first { FileManager.default.isExecutableFile(atPath: $0.path) } }
+    private func runPrlctl(_ arguments: [String]) async throws -> String {
+        guard let executable = prlctlURL() else { throw OrionError.prlctlNotFound }
+        return try await Task.detached(priority: .userInitiated) { let p = Process(); let pipe = Pipe(); p.executableURL = executable; p.arguments = arguments; p.standardOutput = pipe; p.standardError = pipe; try p.run(); let data = pipe.fileHandleForReading.readDataToEndOfFile(); p.waitUntilExit(); let out = String(decoding: data, as: UTF8.self); guard p.terminationStatus == 0 else { throw OrionError.commandFailed(out) }; return out }.value
+    }
+}
+
+enum OrionError: LocalizedError { case prlctlNotFound, commandFailed(String); var errorDescription: String? { switch self { case .prlctlNotFound: "Parallels prlctl was not found."; case .commandFailed(let o): o.trimmingCharacters(in: .whitespacesAndNewlines) } } }