diff --git a/rdp-proxy/manager.py b/rdp-proxy/manager.py
index b7e4bad..9f07c2c 100644
--- a/rdp-proxy/manager.py
+++ b/rdp-proxy/manager.py
@@ -72,6 +72,7 @@ def _monitor_loop():
 threading.Thread(target=_monitor_loop, daemon=True).start()
 def _anti_idle_loop():
     """Send Shift key every 30s while xfreerdp is connected to prevent screen lock."""
+    env = {**os.environ, "DISPLAY": DISPLAY}
     while True:
         time.sleep(30)
         with _lock:
@@ -79,19 +80,23 @@ def _anti_idle_loop():
         if not active:
             continue
         try:
-            # Try to send Shift to xfreerdp window
-            result = subprocess.run(
-                ["xdotool", "search", "--name", "FreeRDP", "key", "shift"],
-                env={**os.environ, "DISPLAY": DISPLAY},
-                capture_output=True, timeout=5,
+            r = subprocess.run(
+                ["xdotool", "search", "--name", "FreeRDP"],
+                env=env, capture_output=True, timeout=5,
             )
-            if result.returncode != 0:
-                # Fallback: mousemove
+            win_id = r.stdout.decode().strip().splitlines()[0] if r.stdout.strip() else ""
+            if win_id:
+                subprocess.run(
+                    ["xdotool", "key", "--window", win_id, "--clearmodifiers", "shift"],
+                    env=env, capture_output=True, timeout=5,
+                )
+                log.debug("anti_idle shift sent window=%s", win_id)
+            else:
                 subprocess.run(
                     ["xdotool", "mousemove", "--sync", "960", "540"],
-                    env={**os.environ, "DISPLAY": DISPLAY},
-                    capture_output=True, timeout=5,
+                    env=env, capture_output=True, timeout=5,
                 )
+                log.debug("anti_idle mousemove fallback")
         except Exception as e:
             log.debug("anti_idle error: %s", e)
 
diff --git a/universal-runtime/manager.py b/universal-runtime/manager.py
index cdc6fd4..844af19 100644
--- a/universal-runtime/manager.py
+++ b/universal-runtime/manager.py
@@ -352,8 +352,7 @@ def open_web(
     safe_w, safe_h = apply_resolution(width, height)
     profile_dir = _create_chrome_profile()
     extension_dir = _create_autofill_extension(login, password)
-    # Embed credentials in URL for HTTP Basic Auth (no dialog shown)
-    url_with_creds = _url_with_credentials(url, login, password)
+    url_with_creds = url  # credentials in URL break SPA fetch; extension handles auth
 
     # Use the real Chromium binary directly to avoid the Debian wrapper which
     # injects an empty `--load-extension=` from /etc/chromium.d/extensions.