tabby-rdp 0.2.7 → 0.3.1

package/CHANGELOG.md

@@ -1,9 +1,79 @@
 # Changelog
 
+## 0.3.1
+
+**New**
+- **New versions:** Tabby shows plugin upgrades only while its Plugins page is open, so tabby-rdp now says so itself.
+  Once a day it asks npm for the latest version (nothing else is sent); a newer one gets a note once, an **Update
+  available** item in the menus and a line on Settings › Remote Desktop, each leading to Tabby's Upgrade button.
+  **Tell me about new versions** turns it off.
+
+**Docs**
+- The README's demo plays in the page (a GIF), on GitHub and on npm.
+
+## 0.3.0
+
+**New**
+- **Settings › Remote Desktop:** getting started, every setting with a line on what it does, keys and tips, the
+  desktops and certificates the plugin keeps, troubleshooting, and each open desktop's log to copy for a bug report.
+  A tip the first time a desktop connects, and **What does this mean?** under a message that ends a connection.
+- **Several desktops in one tab:** **Paste to all desktops in this tab** (text, pictures, or files copied here),
+  **Type into all desktops in this tab** (a label on each says so while it's on), and **Make panes even**. As you
+  click into a desktop, its name shows in its corner for a moment; when, and its font, size, place and color, are in
+  the settings, with a preview.
+- **Files copied in Finder** (Explorer, Files) paste on the desktop with ⌘V (Ctrl+V), and the paste waits until the
+  remote has taken them in.
+- **VMs on a host:** the libvirt VMs with a desktop on an SSH host (RDP answering, or Windows and shut off) show up in
+  its menu, ready to open, or to start and open. **Find virtual machines on SSH hosts** turns it off.
+- **`ssh` typed in an SSH tab:** **Desktop** and `desk` there open the machine it went to, through the tab's host, and
+  Reconnect stays with it.
+- **Remote desktop (RDP) profiles:** desktops as Tabby profiles, in their own tab: connect directly to an RDP server
+  this machine reaches (LAN, VPN), or through an SSH profile. They show up in the profile list, quick connect
+  (`user@host:port`), recent profiles and tab recovery. **Import an .rdp file…** turns a saved Remote Desktop
+  connection into one.
+- **Linux desktops through xrdp** (KDE, XFCE, MATE, …): the SSH host's own desktop is xrdp's when GNOME isn't there,
+  and offered next to GNOME when both are; `kind: xrdp` for desktops behind a host. Signs in with the Linux account.
+- **Windows as the SSH host:** an SSH host that is itself Windows (OpenSSH server) opens its own RDP desktop.
+- **H.264 video decoding** (setting **Video decoding**, on by default), hardware-accelerated where Tabby's engine can:
+  Windows desktops now use the graphics pipeline with H.264 for what changes like video, instead of bitmaps; GNOME
+  uses it when its machine has a hardware encoder.
+- **Microphone** (off by default): an app on the remote desktop that records gets your microphone, only while it
+  records, with an indicator.
+- **Send keys:** Ctrl+Alt+Del, Win+R, Win+L, Task Manager and more for Windows; Super, the app grid, Alt+F2 for GNOME.
+  From a Mac, ⌃⌘ with a key is the Windows key with it (⌃⌘R for Win+R).
+- **View only**, **Save a screenshot** (to Downloads and the clipboard), and **actual size** with scroll bars for a
+  fixed resolution.
+- **Certificates:** GNOME desktops accept only the certificate the plugin made for them; other desktops remember theirs
+  on first use and stop to ask, before signing in, if it changes.
+- **Edit a desktop** behind a host from the menus (name, address, account, kind).
+- **Wake before connecting:** `wake: { vm }` starts a libvirt VM on the SSH host, `wake: { mac }` sends Wake-on-LAN,
+  when the desktop doesn't answer.
+- **Connection status** (off by default): throughput, frames per second, SSH round trip and how it's connected, in the
+  desktop's corner.
+
+**Fixed**
+- `desk` run on another machine than the tab's (after `ssh` there, or with a shared home folder) opened a terminal on
+  the wrong desktop; it's refused now, with a note that says why.
+- Windows over the graphics pipeline: IronRDP's RemoteFX Progressive decoder rejected Windows' refinement passes and
+  ended the session (patch 0010, for upstream).
+
+**Package**
+- IronRDP's WebAssembly ships as its own file instead of a 6.6 MB base64 string inside the JavaScript: the package is
+  about 2 MB instead of 2.7 MB.
+- Releases are built and staged on npm by GitHub Actions, with provenance.
+
+**Changed**
+- Hosts are called by their SSH profile's name (not its address) in messages and the on-screen name.
+- **Remove a desktop** asks first.
+- **Menus:** the plugin's items in a terminal's or tab's menu start with a **Remote Desktop** heading (naming the
+  desktop while one is connected), so they read as the plugin's rather than Tabby's. Under it the items are shorter:
+  **Send files…**, **Disconnect** and **Settings**, and the host's other desktops (and VMs found there) and
+  **Add a desktop behind \<host\>…** are under **Desktops**.
+
 ## 0.2.7
 
-(0.2.6 was never released: its staged publish on npm didn't go through, and npm doesn't reuse a version
-number. 0.2.7 is the same change.)
+(0.2.6 carries the same change: its staged publish on npm looked like it had failed and only appeared later, so the
+change was released again as 0.2.7.)
 
 **Security**
 - Files copied on the remote desktop are saved inside the folder you save them to (Downloads). Their names come from

package/README.md

@@ -5,13 +5,15 @@
 # tabby-rdp
 
 **Remote desktops in your Tabby SSH tabs.**<br>
-Linux (GNOME) and Windows, through the SSH connection you already have.
+Linux and Windows, side by side, through the SSH connections you already have.
 
 [![npm](https://img.shields.io/npm/v/tabby-rdp?color=3b82f6)](https://www.npmjs.com/package/tabby-rdp)
 [![License: MIT](https://img.shields.io/badge/license-MIT-3b82f6)](LICENSE)
 [![Tabby plugin](https://img.shields.io/badge/Tabby-plugin-6366f1)](https://tabby.sh)
 
-<img src="docs/images/desktop.png" width="860" alt="A GNOME desktop in a Tabby SSH tab">
+<img src="docs/images/demo.gif" width="860" alt="Four desktops in one Tabby tab (GNOME, Windows, xrdp), a file pasted to all of them, a pane switched to its console, and desk">
+
+<sub>Sharper: <a href="https://github.com/meanaverage/tabby-rdp/releases/download/v0.3.0/tabby-rdp-demo.mp4">the same demo as an MP4</a> (downloads)</sub>
 
 </div>
 
@@ -23,12 +25,24 @@ nothing is opened on the network, and nothing has to be installed on the remote
 
 - **Linux desktops without a monitor or a login.** The plugin starts a headless GNOME session for your SSH user with
   GNOME Remote Desktop, on the fly, without root. A server in a rack works as well as a workstation.
-- **Windows desktops** behind any SSH host, such as a VM on your build server.
-- **A proper desktop experience:** clipboard and files both ways, sound, live resize to the pane, sharp Retina
-  rendering, Mac keyboard shortcuts, and automatic reconnects after sleep.
+- **Other Linux desktops** (KDE, XFCE, MATE, Cinnamon, …) through xrdp, where it runs: the plugin finds it by itself.
+- **Windows desktops** behind any SSH host, such as a VM on your build server, and the desktop of a Windows machine
+  you SSH into.
+- **Remote desktop profiles** for machines you reach without SSH (LAN, VPN): in Tabby's profile list, in a tab of their
+  own.
+- **Several machines at once:** split a tab into a grid of desktops, then paste to all of them or type into all of them
+  at once. A short on-screen name says which one you're in.
+- **VMs found for you:** the libvirt VMs on an SSH host that have a desktop show up in its menu, ready to open, or to
+  start and open.
+- **`ssh` on from a host:** in an SSH tab where you typed `ssh` to another machine, the desktop is that machine's.
+- **A proper desktop experience:** clipboard and files both ways, sound and microphone, live resize to the pane,
+  sharp Retina rendering, Mac keyboard shortcuts, and automatic reconnects after sleep.
 - **`desk`:** type `desk` in the console and the same shell, with its history and running programs, moves into a
   terminal on the desktop.
 
+Everything is in **Settings › Remote Desktop**: getting started, every setting with a line on what it does, the keys,
+the desktops and certificates the plugin keeps, and troubleshooting.
+
 The remote desktop itself is [IronRDP](https://github.com/Devolutions/IronRDP)'s web client, running inside Tabby.
 Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([below](#built-on-ironrdp)).
 
@@ -38,6 +52,9 @@ Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([
 - [Use](#use)
 - [Features](#features)
 - [Windows and other desktops behind a host](#windows-and-other-desktops-behind-a-host)
+- [Remote desktop profiles](#remote-desktop-profiles)
+- [Several desktops in one tab](#several-desktops-in-one-tab)
+- [VMs on a host](#vms-on-a-host)
 - [desk: the console on the desktop](#desk-the-console-on-the-desktop)
 - [Settings](#settings)
 - [Requirements](#requirements)
@@ -63,14 +80,24 @@ Open an SSH tab to a Linux machine with GNOME, and:
 
 - press **⌘⇧G** (Ctrl+Shift+G on Windows and Linux), or
 - click **Desktop** in the SSH tab's toolbar, or the desktop button in Tabby's header, or
-- right-click the terminal or the tab: **Open remote desktop**.
+- right-click the terminal or the tab: **Open remote desktop**, under the **Remote Desktop** heading.
+
+<p align="center"><img src="docs/images/desktop.png" width="760" alt="A GNOME desktop in a Tabby SSH tab"></p>
 
 The first connection to a machine takes a few seconds while it prepares GNOME Remote Desktop and a session; later
 ones take well under a second. The same shortcut switches between the desktop and the console, and the desktop keeps
 running in the background until you disconnect or close the tab.
 
+A machine without GNOME but with [xrdp](https://github.com/neutrinolabs/xrdp) running (the usual RDP server for KDE,
+XFCE, MATE and the rest) gets xrdp's desktop instead: sign in with your Linux password, which the plugin can remember
+in the system keychain. A machine with both keeps GNOME as the tab's desktop and, once that has been opened, also
+offers **Open \<host\> desktop (xrdp)** in its menus.
+
 It also works in a plain local terminal where you typed `ssh host` (macOS and Linux), as long as that host accepts
-your key without a password prompt.
+your key without a password prompt. And in an SSH tab where you typed `ssh` on to another machine: **Desktop** there
+opens that machine's desktop, going through the first, as long as the first can log in to it by itself (a key there,
+or agent forwarding). So one pane of a split can show the first machine's desktop, and the other, after `ssh other`,
+that machine's.
 
 One desktop per account: a second tab to the same `user@host` switches to the tab that has it open, rather than
 connecting again.
@@ -80,22 +107,32 @@ connecting again.
 | | |
 |---|---|
 | **Clipboard** | Copy and paste text and images in both directions. |
-| **Files** | Drop files from Finder onto the desktop, or use **Send files to the remote desktop…**, then paste them in Files or Explorer. Files copied on the remote offer **Save to Downloads**. |
+| **Files** | Copy files or folders in Finder and press ⌘V on the desktop, or drop them onto it, or use **Remote Desktop › Send files…** in the pane's menu; they paste in Files or Explorer. Files copied on the remote offer **Save to Downloads**. |
+| **Several desktops in one tab** | Paste to all of them, type into all of them, and see which is which: [below](#several-desktops-in-one-tab). |
+| **VMs on a host** | The host's VMs with a desktop, ready to open: [below](#vms-on-a-host). |
 | **Sound** | The remote desktop's sound plays locally. |
-| **Resize** | The remote resolution follows the pane as you resize the window or split it. Or reconnect at the new size, or keep a fixed resolution. |
+| **Microphone** | Optional (off by default): an app on the remote desktop that records, such as a call, gets your microphone. It is only captured while the app records, with an indicator in the corner of the desktop. |
+| **Resize** | The remote resolution follows the pane as you resize the window or split it. Or reconnect at the new size, or keep a fixed resolution, scaled to fit or at actual size with scroll bars. |
 | **Retina** | Optionally renders at device pixels, with the remote's UI scaled to match (GNOME and Windows alike), for sharp text. For all desktops, or only some. |
-| **Keyboard on macOS** | ⌘C, ⌘V, ⌘Z and the rest work as on a Mac; tapping ⌘ alone is the Windows key. Tabby's own shortcuts stay out of the way while a desktop is showing, except switching tabs and returning to the console. |
+| **Keyboard on macOS** | ⌘C, ⌘V, ⌘Z and the rest work as on a Mac; tapping ⌘ alone is the Windows key, and ⌃⌘ with a key is the Windows key with it (⌃⌘R for Win+R). Tabby's own shortcuts stay out of the way while a desktop is showing, except switching tabs and returning to the console. |
+| **Send keys** | In the desktop's menus: Ctrl+Alt+Del, Win+R, Win+L, Ctrl+Shift+Esc, Print Screen and more for Windows; Super, Super+A, Alt+F2 and more for GNOME. |
+| **View only** | In the desktop's menus: watch a desktop without touching it. No keys or clicks go to it while a "View only" label shows; the picture, clipboard and sound carry on. Kept across reconnects, until the desktop is closed. |
+| **Screenshots** | **Save a screenshot** in the desktop's menus saves the remote screen at its full resolution as a PNG in Downloads, and copies it to the clipboard. |
+| **Connection status** | Optionally, a small line in the corner of the desktop with the throughput each way, frames per second, the SSH round trip, and how it is connected (desktop, host, resolution, graphics mode, sharpness). |
 | **Reconnecting** | After sleep or a network change, the desktop reconnects by itself once the connection is back. |
-| **Sign-in** | GNOME desktops need none: the plugin manages their credentials. Windows desktops ask for the account once and can remember it in the system keychain. |
+| **Sign-in** | GNOME desktops need none: the plugin manages their credentials. Windows and xrdp desktops ask for the account once and can remember it in the system keychain; **Sign in again…** in the menu replaces it. |
+| **Certificates** | GNOME desktops accept only the certificate the plugin made for them. Windows and xrdp desktops remember theirs on first use and ask before accepting a different one. |
 
 <p align="center"><img src="docs/images/files.png" width="760" alt="A file copied on the remote desktop, offered for saving"></p>
 
 ## Windows and other desktops behind a host
 
 An SSH host can lead to other desktops it can reach, such as a Windows VM on the same machine. In that host's menu,
-choose **Add a desktop behind \<host\>…** and enter a name, the address as seen from the host, and optionally the
-user name. It opens right away, and from then on appears next to the host's own desktop in its menus. **Remote
-desktop settings › Remove a desktop** removes one, along with its saved password.
+choose **Desktops › Add a desktop behind \<host\>…** and enter a name, the address as seen from the host, and optionally the
+user name and domain. It opens right away, and from then on appears under **Desktops** in the host's menu.
+**Settings › Edit a desktop** changes one (its saved password, sharpness and remembered certificate
+follow a new address; a new user name forgets the saved password), and **Remove a desktop** removes one, along with
+its saved password and remembered certificate.
 
 <p align="center"><img src="docs/images/windows.png" width="760" alt="A Windows 11 desktop, reached through an SSH host, in a Tabby tab"></p>
 
@@ -108,13 +145,108 @@ remoteDesktop:
       via: buildhost            # the SSH host: alias, hostname, user@hostname or user@hostname:port
       host: 192.168.122.20      # the RDP server as seen from that host
       port: 3389
-      kind: windows             # or gnome
+      kind: windows             # or xrdp (a Linux desktop served by xrdp), or gnome
       username: alice           # optional; DOMAIN\user works too
+      domain: CORP              # optional
+      wake: { vm: win11 }       # optional: start it when it's off (see below)
 ```
 
 The connection runs through the same SSH connection; the Windows machine needs Remote Desktop turned on, and nothing
 else.
 
+The first connection to a desktop remembers its TLS certificate, without asking (in Tabby's config, under
+`remoteDesktop.trustedCertificates`). If a later connection meets a different one, the plugin stops before signing in
+and shows both fingerprints, with **Trust the new certificate** and **Cancel**. Reinstalling Windows or renewing its
+certificate changes it; if neither happened, something else is answering at that address. Automatic reconnects stop at
+the same question.
+
+**An SSH host that is itself Windows** (with OpenSSH Server): its own desktop is Windows' Remote Desktop, at
+127.0.0.1:3389 as seen from the host. The plugin finds this out the first time you open the desktop there, and asks
+for the Windows account instead (your SSH user name is filled in), with the same keychain option.
+
+### Starting a desktop that is off
+
+A VM on the SSH host, or a machine next to it, may be shut down when you want its desktop. With `wake`, the plugin
+checks from the SSH host whether the desktop answers, and if it doesn't, starts it, shows **Starting \<name\>…** with
+the time so far, and connects as soon as it answers (it gives up after 3 minutes):
+
+- `wake: { vm: win11 }` starts the libvirt VM `win11` on the SSH host with `virsh start`, as your SSH user: first in
+  `qemu:///system` (you need to be in the `libvirt` group, or allowed by polkit), then in your own `qemu:///session`.
+  A paused VM is resumed.
+- `wake: { mac: "aa:bb:cc:dd:ee:ff" }` sends a Wake-on-LAN packet from the SSH host (with `python3`, to the broadcast
+  address, UDP port 9). Add `broadcast: 192.168.1.255` for a particular network, or `port: 7`.
+
+In the add and edit forms, the last field takes a VM name or a MAC address. Automatic reconnects never start a desktop,
+since it may have been shut down on purpose; **Reconnect** does.
+
+## Remote desktop profiles
+
+For an RDP server this computer reaches by itself (on the LAN, or over a VPN), there is a Tabby profile type:
+**Settings › Profiles & connections › New profile › Remote desktop (RDP)**. Give it the address, the kind (Windows,
+xrdp or GNOME Remote Desktop), and optionally the user name and domain. It then shows up in Tabby's profile list like
+SSH profiles do, and opens in a tab of its own that the desktop fills; there is no console under it. Sign-in, the
+keychain, certificates, resize, sharpness, clipboard, files, sound, microphone, **Send keys**, view only, screenshots
+and reconnecting work as in SSH tabs. After **Disconnect**, the tab offers **Connect**. In the profile selector you can
+also type `user@host:port` and pick **Quick connect (REMOTE DESKTOP (RDP))**.
+
+**Import an .rdp file…** (in the menu's **Settings**, or **Remote desktop: import an .rdp file…** in Tabby's
+command palette) makes such a profile from a file saved by Remote Desktop Connection or handed out by an admin: its
+address, port, user name and domain, named after the file. Other settings in the file (screen size, drives, gateway)
+are ignored.
+
+Its **Connect** setting can name an SSH profile instead of connecting directly. The address is then as that host sees
+it, and opening the profile opens that SSH tab and shows the desktop over it once SSH is connected. Such a desktop is
+also offered in the menus of that SSH profile's tabs, next to the host's own desktop, so it works like a desktop
+added with **Desktops › Add a desktop behind \<host\>…**, but with a place in the profile list.
+
+In Tabby's config file:
+
+```yaml
+profiles:
+  - type: rdp
+    name: Office PC
+    options:
+      host: 192.168.1.20        # as this computer sees it (or as the SSH host sees it, with via)
+      port: 3389
+      kind: windows             # or xrdp, or gnome
+      username: alice           # optional
+      via: ''                   # or the id of an SSH profile to go through
+```
+
+A direct connection is a plain TCP connection from this computer, encrypted with TLS like any RDP client's. The
+server's certificate is remembered on the first connection and checked on every later one, as for desktops behind a
+host (above).
+
+## Several desktops in one tab
+
+Split a tab (Tabby's **Split** in the tab's menu, or drag one tab onto another) and each pane can show a desktop: one
+machine's desktop next to another's, or next to its own console. Right-click any of them:
+
+- **Paste to all \<n\> desktops in this tab** pastes what's on your clipboard on every desktop in the tab, in whichever
+  window is active on each: text, a picture, or files and folders copied in Finder (or Explorer, or Files).
+- **Type into all \<n\> desktops in this tab** sends every key you type on one desktop to the others too, shortcuts and
+  **Send keys** included, until you turn it off. An orange label on each desktop says so while it's on. The mouse stays
+  per desktop, and desktops in view-only mode are left out.
+- **Make panes even** evens out the split's panes, which Tabby does itself but offers nowhere else.
+
+As you click into a desktop, its name shows in its corner for a moment, like a TV naming its input ("BUILDBOX", or "WIN-11 ·
+via buildhost · 1920×1080"). It shows by default where it helps (in a split, and for a desktop other than the tab's own
+connection); **Settings › Remote Desktop › Desktop name overlay** sets when, and its font, size, place and color, with a
+preview. Desktops are named after their SSH profile's name.
+
+## VMs on a host
+
+When you right-click an SSH host, the plugin looks at the host's libvirt VMs (`virsh`, as your SSH user; read-only, at
+most once a minute) and lists the ones with a desktop under **Desktops**, with nothing to set up:
+
+- a running VM whose RDP port answers: Windows, or Linux with xrdp;
+- a Windows VM that's shut off: **Start and open**, which starts it (`virsh start`) and connects as soon as it answers.
+
+A Linux VM that runs GNOME is left out: its desktop is reached by SSH-ing to it (its own desktop, or `ssh` typed in a
+console on the host, [above](#use)). A VM found this way asks for its account the first time, like any Windows or xrdp
+desktop; **Save \<name\> to this host's desktops** in its menu keeps it, for a name of your own and other settings.
+**Settings › Remote Desktop › Find virtual machines on SSH hosts** turns this off.
+
 ## desk: the console on the desktop
 
 Type `desk` in an SSH console, and the tab switches to that machine's desktop with a terminal attached to the very same
@@ -126,24 +258,31 @@ shell: its scrollback, working directory, jobs and running programs. Type on eit
 </p>
 
 `desk` is off by default, because it makes interactive SSH logins on that machine start inside a shareable session.
-Turn it on in **Remote desktop settings**. The sessions are handled by a small helper, `trd-pty`, rather than tmux, so
+Turn it on in the pane's menu under **Remote Desktop › Settings**, or in Settings › Remote Desktop. The sessions are handled by a small helper, `trd-pty`, rather than tmux, so
 your terminal's scrollback, colors and shortcuts stay as they are. Turning it off removes it again. Details:
 [docs/desk.md](docs/desk.md).
 
 ## Settings
 
-Right-click the desktop button in Tabby's header, or open **Remote desktop settings** in a terminal's or tab's menu.
+Open **Settings › Remote Desktop** in Tabby, right-click the desktop button in Tabby's header, or open **Settings** in the Remote Desktop section of a terminal's or tab's menu.
 They are stored in Tabby's config under `remoteDesktop`:
 
 | Setting | Default | |
 |---|---|---|
-| When the pane is resized (`resize`) | Resize the remote desktop to fit (`live`) | Or reconnect at the new size (`reconnect`), or keep the resolution, scaled to fit (`off`). |
+| When the pane is resized (`resize`) | Resize the remote desktop to fit (`live`) | Or reconnect at the new size (`reconnect`), or keep the resolution (`off`). |
+| Keep the resolution: scale to fit or actual size (`zoom`) | Scale to fit (`fit`) | With `resize: off`: `actual` shows one remote pixel per point, with scroll bars when the desktop is larger than the pane (a Retina-sized desktop shows at twice the size). |
 | Sharpness (`sharpness`) | Standard (`standard`) | Retina (`retina`): device pixels, with the remote's scale set to match. |
-| For *this desktop* only (`desktopSharpness`) | As above | In the menu of a tab with a desktop open: Standard or Retina for that desktop, whatever the default. Kept by desktop (`user@host`, or `user@host#address` for one behind a host). |
+| For *this desktop* only (`desktopSharpness`) | As above | In the menu of a tab with a desktop open: Standard or Retina for that desktop, whatever the default. Kept by desktop (`user@host`, `user@host#address` for one behind a host, or `rdp#address` for a remote desktop profile's own tab). |
 | Sound (`sound`) | On | Applies on the next connection. |
+| Video decoding (`h264`) | On | H.264 decoded by Tabby's browser engine (hardware-accelerated where available), for what the remote sends as video; applies on the next connection. |
+| Microphone (`microphone`) | Off | Send your microphone while an app on the remote desktop records. Applies on the next connection. |
+| Show connection status (`connectionStatus`) | Off | The indicator in the desktop's corner; fades when the pointer comes near. |
 | Mac shortcuts (`macShortcuts`) | On | macOS. Off: ⌘ is the Windows key. |
 | Bring the console along with `desk` (`desk`) | Off | Installs `desk` and a login line on each machine you open a desktop on; applies on the next connection there. |
 | Session backend (`sessionBackend`) | `native` | For `desk`: `native` (trd-pty) or `tmux`. Config file only. |
+| Find virtual machines on SSH hosts (`discoverVMs`) | On | Lists a host's libvirt VMs with a desktop in its menu ([VMs on a host](#vms-on-a-host)). |
+| Tell me about new versions (`checkUpdates`) | On | Once a day, asks npm for the latest tabby-rdp (nothing else is sent), and says so in a note, the menus and the settings page when there's a newer one: Tabby itself shows plugin upgrades only on its Plugins page. |
+| Desktop name overlay (`osd`) | When it helps | `show` (`auto`, `always`, `off`), `font`, `size`, `position`, `color` (empty: white) and `seconds`; the settings page previews it. |
 
 ## Requirements
 
@@ -153,8 +292,12 @@ They are stored in Tabby's config under `remoteDesktop`:
 - **Linux desktops:** GNOME Shell and GNOME Remote Desktop 46 or newer (Ubuntu 24.04, for example), a systemd user
   session, and SSH access with a key or agent. `desk` also needs `python3` and GNOME Terminal. No root, no display, no
   login screen.
+- **Other Linux desktops:** xrdp running on the machine, with a desktop for its sessions (on Debian and Ubuntu:
+  `sudo apt install xrdp xfce4`, or KDE, MATE, …), and an account with a password. xrdp's default settings work
+  (`security_layer=negotiate`, its own certificate); the port is read from `/etc/xrdp/xrdp.ini`. Sound needs
+  `pipewire-module-xrdp` or `pulseaudio-module-xrdp`.
 - **Windows desktops:** Windows 10 or 11 Pro, or Windows Server, with Remote Desktop turned on, reachable from an SSH
-  host.
+  host or running OpenSSH Server itself.
 
 Tested with Ubuntu 24.04 (GNOME Remote Desktop 46.3) and Windows 11 (Pro and Enterprise), from Tabby on macOS,
 Windows 11 and Ubuntu 24.04 (arm64).
@@ -177,6 +320,9 @@ tabby-rdp ships IronRDP with a short series of patches ([ironrdp/](ironrdp)). Th
 | Echo the correct size in the sound channel's Training Confirm | [Devolutions/IronRDP#2019](https://github.com/Devolutions/IronRDP/pull/2019) |
 | The graphics pipeline in the web client, following its resets | Covered by [Devolutions/IronRDP#1977](https://github.com/Devolutions/IronRDP/pull/1977) (not ours; [tested with GNOME](https://github.com/Devolutions/IronRDP/pull/1977#issuecomment-5851624036)) |
 | Sound in the web client | [Devolutions/IronRDP#2020](https://github.com/Devolutions/IronRDP/pull/2020) |
+| H.264 in the web client, decoded by the browser (WebCodecs) | Not submitted yet |
+| Decode Windows' RemoteFX Progressive refinements | Not submitted yet |
+| Microphone in the web client | Not submitted yet |
 
 The aim is to make IronRDP's browser client work well with both Linux and Windows desktops, for everyone who embeds
 it, not just this plugin.
@@ -210,7 +356,22 @@ npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches:
 - **GNOME Remote Desktop listens on all interfaces** (password-protected, TLS); it has no setting to listen on
   loopback only. See [docs/architecture.md](docs/architecture.md#security-notes) to restrict it.
 - **Windows-key combinations** such as Win+R don't come through from macOS. Tapping ⌘ for the Windows key does.
-- **Desktops behind a host** can be added and removed from the menus, but not edited there.
+- **The microphone** needs the system's permission: macOS asks the first time a remote app records (if it was denied,
+  allow Tabby in System Settings › Privacy & Security › Microphone, then restart Tabby), and Windows needs "Let desktop
+  apps access your microphone". On GNOME, apps record from GNOME Remote Desktop's "Remoteaudio Source", which is the
+  default input on a machine without a microphone of its own; otherwise pick it in Settings › Sound. On Windows, the
+  remote machine must allow audio recording redirection (the Remote Desktop Session Host policy "Allow audio recording
+  redirection").
+- **xrdp sessions are separate X sessions**, not the machine's screen, and use whatever `~/.xsession` or the system
+  default starts. Don't have them start GNOME for a user who also has a GNOME session (the plugin's headless one, or
+  a login at the machine): GNOME runs once per user.
+- **xrdp and a wrong password:** xrdp doesn't refuse the connection, it shows its own login window instead, where you
+  can sign in. A remembered password that no longer works leads there each time; **Sign in again…** replaces it.
+- **What works on xrdp** depends on its channels: the clipboard through `xrdp-chansrv` (text; images and files as
+  far as that xrdp version supports them), sound through the PipeWire or PulseAudio module. Live resize needs xrdp
+  0.10 or newer; with 0.9 (Ubuntu 24.04), the desktop keeps its size, scaled to fit, or choose **Reconnect at the new
+  size**. xrdp's standard RDP security without TLS (`security_layer=rdp`) isn't supported. `desk` needs GNOME.
+- **Waking a desktop** starts it but never shuts it down again; that is up to you (or the VM's own settings).
 
 ## License
 

package/dist/connectionStatus.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionStatus = exports.STYLE = void 0;
+exports.STYLE = `
+.trd-stats { position: absolute; left: 8px; bottom: 8px; z-index: 2; padding: 3px 7px; border-radius: 4px;
+    background: rgba(20, 20, 20, 0.7); color: #ddd; font: 11px/1.45 ui-monospace, Menlo, Consolas, monospace;
+    white-space: pre; pointer-events: none; transition: opacity 0.15s; }
+.trd-stats-path { color: #999; }
+.trd-stats.trd-stats-away { opacity: 0.1; }
+`;
+// Rates are per second; the round trip is measured less often, since it opens a channel on the SSH server.
+const TICK_MS = 1000;
+const PING_EVERY_TICKS = 5;
+function rate(bytesPerSecond) {
+    if (bytesPerSecond < 1000) {
+        return `${Math.round(bytesPerSecond)} B/s`;
+    }
+    if (bytesPerSecond < 1e6) {
+        return `${(bytesPerSecond / 1e3).toFixed(bytesPerSecond < 1e4 ? 1 : 0)} kB/s`;
+    }
+    return `${(bytesPerSecond / 1e6).toFixed(1)} MB/s`;
+}
+/**
+ * The connection-status indicator in a desktop layer: throughput, frames per second, SSH round trip, and the
+ * connection path. Runs only while active (the setting is on and the desktop shows and is connected); its timers
+ * and listeners stay outside Angular's zone, like everything that runs on its own (see docs/architecture.md).
+ */
+class ConnectionStatus {
+    constructor(overlay, zone, info) {
+        this.overlay = overlay;
+        this.zone = zone;
+        this.info = info;
+        this.timer = null;
+        this.ticks = 0;
+        this.last = null;
+        this.frames = 0;
+        this.hooked = null;
+        this.latency = null;
+        this.pinging = false;
+        this.active = false;
+        /** The indicator fades while the pointer is near it, so it never hides what is under it for long. */
+        this.onMouseMove = (event) => {
+            const r = this.el.getBoundingClientRect();
+            const near = event.clientX > r.left - 24 && event.clientX < r.right + 24 && event.clientY > r.top - 24 && event.clientY < r.bottom + 24;
+            if (near !== this.el.classList.contains('trd-stats-away')) {
+                this.el.classList.toggle('trd-stats-away', near);
+            }
+        };
+        this.el = document.createElement('div');
+        this.el.className = 'trd-stats';
+        this.el.innerHTML = '<div class="trd-stats-numbers"></div><div class="trd-stats-path"></div>';
+        this.numbersEl = this.el.querySelector('.trd-stats-numbers');
+        this.pathEl = this.el.querySelector('.trd-stats-path');
+    }
+    /** Starts or stops the indicator. `canvas`: the remote display, whose updates are counted as frames. */
+    setActive(active, canvas) {
+        if (active && canvas) {
+            this.countFrames(canvas);
+        }
+        if (active === this.active) {
+            return;
+        }
+        this.active = active;
+        if (!active) {
+            clearInterval(this.timer ?? undefined);
+            this.timer = null;
+            this.overlay.removeEventListener('mousemove', this.onMouseMove, true);
+            this.el.remove();
+            return;
+        }
+        this.last = null;
+        this.ticks = 0;
+        this.latency = null;
+        this.numbersEl.textContent = '…';
+        this.pathEl.textContent = this.info.path();
+        this.el.classList.remove('trd-stats-away');
+        this.overlay.appendChild(this.el);
+        this.zone.runOutsideAngular(() => {
+            this.timer = setInterval(() => this.tick(), TICK_MS);
+            this.overlay.addEventListener('mousemove', this.onMouseMove, { capture: true, passive: true });
+            this.tick();
+        });
+    }
+    dispose() {
+        this.setActive(false);
+    }
+    /**
+     * IronRDP's web client blits each changed region with putImageData and tells nobody, so the canvas context's
+     * putImageData is wrapped (on that one context object). A frame is one synchronous batch of blits.
+     */
+    countFrames(canvas) {
+        const ctx = canvas.getContext('2d');
+        if (!ctx || ctx === this.hooked) {
+            return;
+        }
+        this.hooked = ctx;
+        const original = ctx.putImageData;
+        let batch = false;
+        ctx.putImageData = ((...args) => {
+            if (!batch) {
+                batch = true;
+                this.frames++;
+                queueMicrotask(() => { batch = false; });
+            }
+            return original.apply(ctx, args);
+        });
+    }
+    tick() {
+        const now = performance.now();
+        const bytes = this.info.bytes() ?? { bytesIn: 0, bytesOut: 0 };
+        const current = { at: now, bytesIn: bytes.bytesIn, bytesOut: bytes.bytesOut, frames: this.frames };
+        const parts = [];
+        if (this.last && now > this.last.at) {
+            const seconds = (now - this.last.at) / 1000;
+            parts.push(`↓ ${rate((current.bytesIn - this.last.bytesIn) / seconds)}`, `↑ ${rate((current.bytesOut - this.last.bytesOut) / seconds)}`, `${Math.round((current.frames - this.last.frames) / seconds)} fps`);
+        }
+        else {
+            parts.push('↓ …', '↑ …', '… fps');
+        }
+        if (this.info.ping) {
+            parts.push(this.latency === null ? 'ping …' : `ping ${this.latency < 10 ? this.latency.toFixed(1) : Math.round(this.latency)} ms`);
+            if (this.ticks++ % PING_EVERY_TICKS === 0) {
+                this.measureLatency();
+            }
+        }
+        this.last = current;
+        this.numbersEl.textContent = parts.join('  ');
+        this.pathEl.textContent = this.info.path();
+    }
+    measureLatency() {
+        // Nothing to show while the window is hidden; and never two at once on a slow link.
+        if (this.pinging || document.hidden) {
+            return;
+        }
+        this.pinging = true;
+        this.info.ping().then(ms => { this.latency = ms; }, () => { this.latency = null; }).finally(() => { this.pinging = false; });
+    }
+}
+exports.ConnectionStatus = ConnectionStatus;
+//# sourceMappingURL=connectionStatus.js.map

package/dist/connectionStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionStatus.js","sourceRoot":"","sources":["../src/connectionStatus.ts"],"names":[],"mappings":";;;AAEa,QAAA,KAAK,GAAG;;;;;;CAMpB,CAAA;AAYD,2GAA2G;AAC3G,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B,SAAS,IAAI,CAAE,cAAsB;IACjC,IAAI,cAAc,GAAG,IAAI,EAAE,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAA;IAC9C,CAAC;IACD,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAa,gBAAgB;IAazB,YAAqB,OAAoB,EAAU,IAAY,EAAU,IAAoB;QAAxE,YAAO,GAAP,OAAO,CAAa;QAAU,SAAI,GAAJ,IAAI,CAAQ;QAAU,SAAI,GAAJ,IAAI,CAAgB;QATrF,UAAK,GAA0C,IAAI,CAAA;QACnD,UAAK,GAAG,CAAC,CAAA;QACT,SAAI,GAA6E,IAAI,CAAA;QACrF,WAAM,GAAG,CAAC,CAAA;QACV,WAAM,GAAoC,IAAI,CAAA;QAC9C,YAAO,GAAkB,IAAI,CAAA;QAC7B,YAAO,GAAG,KAAK,CAAA;QACf,WAAM,GAAG,KAAK,CAAA;QAoGtB,qGAAqG;QACpF,gBAAW,GAAG,CAAC,KAAiB,EAAQ,EAAE;YACvD,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAA;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAA;YACvI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;YACpD,CAAC;QACL,CAAC,CAAA;QAxGG,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,WAAW,CAAA;QAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,GAAG,yEAAyE,CAAA;QAC7F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,oBAAoB,CAAE,CAAA;QAC7D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAE,CAAA;IAC3D,CAAC;IAED,wGAAwG;IACxG,SAAS,CAAE,MAAe,EAAE,MAAiC;QACzD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,OAAM;QACV,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,CAAA;YACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;YACjB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACrE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAA;YAChB,OAAM;QACV,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;QACd,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,GAAG,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9F,IAAI,CAAC,IAAI,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;IACN,CAAC;IAED,OAAO;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAED;;;OAGG;IACK,WAAW,CAAE,MAAyB;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAM;QACV,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;QACjB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAA;QACjC,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,IAAI,CAAA;gBACZ,IAAI,CAAC,MAAM,EAAE,CAAA;gBACb,cAAc,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;YAC3C,CAAC;YACD,OAAQ,QAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAQ,CAAA;IACb,CAAC;IAEO,IAAI;QACR,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QAC9D,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;QAClG,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;YAC3C,KAAK,CAAC,IAAI,CACN,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE,EAC5D,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,EAAE,EAC9D,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAClI,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,gBAAgB,KAAK,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,cAAc,EAAE,CAAA;YACzB,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC9C,CAAC;IAEO,cAAc;QAClB,oFAAoF;QACpF,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClC,OAAM;QACV,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,IAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;IAC9H,CAAC;CAUJ;AAvHD,4CAuHC"}

package/dist/desk.js

@@ -15,19 +15,24 @@ const tabby_core_1 = require("tabby-core");
 const tabby_terminal_1 = require("tabby-terminal");
 const desktop_service_1 = require("./desktop.service");
 const targets_1 = require("./targets");
-const PREFIX = Buffer.from('\x1b]7777;desk;');
+const probe_1 = require("./probe");
+const PREFIX = Buffer.from('\x1b]7777;');
 const BEL = 0x07;
 const ST = Buffer.from('\x1b\\');
 function parse(payload) {
-    const [session, socket, cwd, kind] = payload.split(';').map(f => Buffer.from(f ?? '', 'base64').toString('utf8'));
-    // Older `desk` scripts sent no kind: they only knew tmux.
-    return { session: session ?? '', socket: socket ?? '', cwd: cwd ?? '', kind: kind ?? (session ? 'tmux' : '') };
+    const [session, socket, cwd, kind, machine, hostname] = payload.split(';').map(f => Buffer.from(f ?? '', 'base64').toString('utf8'));
+    // Older `desk` scripts sent no kind (they only knew tmux), and no machine.
+    return {
+        session: session ?? '', socket: socket ?? '', cwd: cwd ?? '', kind: kind ?? (session ? 'tmux' : ''),
+        machine: machine?.trim() ?? '', hostname: hostname?.trim() ?? '',
+    };
 }
-/** Strips `desk` requests out of a session's output and reports them. */
+/** Strips `desk` requests (and probes, see probe.ts) out of a session's output and reports them. */
 class DeskTrigger extends tabby_terminal_1.SessionMiddleware {
-    constructor(onDesk) {
+    constructor(onDesk, onProbe) {
         super();
         this.onDesk = onDesk;
+        this.onProbe = onProbe;
     }
     feedFromSession(data) {
         // Tabby's OSC processor runs first and passes unknown OSCs through whole, so each request
@@ -41,9 +46,15 @@ class DeskTrigger extends tabby_terminal_1.SessionMiddleware {
             if (end === -1) {
                 break;
             }
-            const request = parse(data.subarray(body, end).toString('utf8'));
+            const payload = data.subarray(body, end).toString('utf8');
             data = Buffer.concat([data.subarray(0, start), data.subarray(end + (end === st ? ST.length : 1))]);
-            setTimeout(() => this.onDesk(request));
+            if (payload.startsWith('desk;')) {
+                const request = parse(payload.slice('desk;'.length));
+                setTimeout(() => this.onDesk(request));
+            }
+            else if (payload.startsWith('probe;')) {
+                this.onProbe(payload.slice('probe;'.length));
+            }
             start = data.indexOf(PREFIX, start);
         }
         if (data.length) {
@@ -68,11 +79,11 @@ let DeskTriggerDecorator = class DeskTriggerDecorator extends tabby_terminal_1.T
                 }
                 if (!this.desktop.settings().desk) {
                     // A hook left from when it was on; it goes away the next time a desktop opens there.
-                    this.notifications.info('`desk` is off: turn it on in Remote desktop settings');
+                    this.notifications.info('`desk` is off: turn it on in the menu under Remote Desktop › Settings');
                     return;
                 }
                 this.desktop.openConsole(pane, request);
-            })));
+            }), id => (0, probe_1.probeArrived)(id, terminal)));
         };
         install();
         this.subscribeUntilDetached(terminal, terminal.sessionChanged$.subscribe(() => install()));