HADES REMOTE

Windows 10/11, Windows PowerShell 5.1, interactive desktop session required.
Clients use normal public HTTPS. Tailscale is NOT required on the client.

CONTROLLER (your Windows account only)
Import-Module .\HadesRemote.psm1
New-HadesEnrollment
  Generates a single-use enrollment code valid for 15 minutes.
Get-HadesDevices
Send-HadesPlay
Revoke-HadesDevice -DeviceId <id>

The controller token is stored encrypted with Windows DPAPI in
%LOCALAPPDATA%\HadesRemoteController\controller.json. It is not in this package.
The desktop "Play Hades on All Devices" shortcut broadcasts once and reports
client status. Device tokens cannot broadcast or enroll additional devices.
Use "Create Hades Enrollment Code" on your desktop to prepare each additional
PC without typing PowerShell commands.

INSTALL EACH PC
Copy/extract this package onto the PC. Double-click Install Hades Remote.cmd.
Enter a fresh enrollment code. Setup installs a visible tray client for the
current Windows account, creates desktop shortcuts, and starts at sign-in.
Right-click its tray icon to pause playback, open its log, or exit.
The uninstall shortcut removes the client and startup entry.

IMPORT FROM YOUR OWN EXPLICIT SETUP SCRIPT
Import-Module "$PSScriptRoot\HadesRemote.psm1"
$code = Read-Host 'Hades enrollment code' -AsSecureString
Install-HadesRemote -RelayUrl 'https://srv1152721.tailf28a31.ts.net:10000' -EnrollmentCode $code

Importing the module has no installation side effects. Install-HadesRemote
is an explicit enrollment action, not an embedded background installation.

BEHAVIOR
Online, enrolled PCs poll about every 2 seconds and play the fixed bundled
animation on all their attached displays. Esc exits playback. Different PCs
may start a few seconds apart; this is not frame-synchronized across PCs.
Commands expire after 15 seconds; offline PCs do not replay stale commands.
The relay permits no downloads, shell commands, scripts, or arbitrary payloads.
The client checks installed player/GIF hashes before playback. Device secrets
are DPAPI-encrypted for the installing account. Tray pause/exit always available.

"played" means the player process exited successfully, not physical screen proof.
Locked, sleeping, powered-off, disconnected PCs cannot show the animation to a
viewer. Restricted networks may block outbound HTTPS on port 10000.

RELAY
relay.py runs as a separate user service bound to loopback on the VPS.
A public HTTPS reverse proxy exposes it; endpoint clients do not use Tailscale.
Only the relay's administrator token can enroll/revoke clients or broadcast.
The server stores hashes of tokens; enrollment codes expire and are single-use.
