[Former-Stranger]

What does this change?

The About panel gets a Find the app on the client section. It offers ready-made commands for macOS, Windows or Linux, filled in for the destination, to run on a client listed under Seen from:

• Search installed apps for the name, using grep --binary-files=text, or Select-String on Windows. After Look up it searches for the registered domain instead. On Windows the pattern also matches UTF-16 text, which is how many Windows programs store strings.
• Which process is connected right now to the destination's IPs: lsof, Get-NetTCPConnection or ss.

Why: registration, DNS and certificate lookups often can't name the app behind a backend domain (privacy-redacted owner, a CDN in front, a certificate with no company name). The app that talks to the domain usually has the name built in. That's how an unexplained API domain was traced to a 3D-printer slicer's networking plugin.

Safety: SNI is controlled by whoever makes the connection. A command is only built from a name made of [a-z0-9.-] and from well-formed IPv4/IPv6 addresses; anything else gets no command, so a crafted hostname can't turn into a command you paste and run. IPv6 addresses are bracketed for ss and quoted for lsof (zsh would otherwise treat the brackets as a filename pattern).

Also: the section's open state and the chosen OS are kept across the 30-second refresh. The OS choice is remembered in localStorage (wrapped in try/catch). Demo lookups now return the registered domain the way real registries do.

How was it tested?

• uv run python -m unittest discover tests
• terraform test (not affected)
• Demo mode in a browser: the section renders, the OS switch works, it stays open after a refresh and a lookup, and click to copy works on the commands.
• Each command checked for real:
  • the macOS search found the networking plugin it was meant to find;
  • both PowerShell commands parse;
  • the UTF-16 pattern matches both UTF-16 and UTF-8 text;
  • ss accepts the IPv4/IPv6 filter;
  • lsof runs under zsh with an IPv6 argument.
• Unsafe names are rejected: ;, quotes, $(), backticks, spaces, newlines and |.

Checklist

• Docs and CHANGELOG.md (Unreleased) updated where users would notice
• No real hostnames, IPs, tenant IDs, keys or logs in code, tests or this PR

🤖 Generated with Claude Code