tabby-rdp 0.2.7 → 0.3.1

package/dist/desktop.service.js

@@ -15,17 +15,29 @@ exports.installStyle = installStyle;
 const core_1 = require("@angular/core");
 const rxjs_1 = require("rxjs");
 const tabby_core_1 = require("tabby-core");
+const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const url_1 = require("url");
 const targets_1 = require("./targets");
 const deskScript_1 = require("./deskScript");
 const audio_1 = require("./audio");
+const connectionStatus_1 = require("./connectionStatus");
+const microphone_1 = require("./microphone");
 const desktopForm_1 = require("./desktopForm");
 const fileTransfer_1 = require("./fileTransfer");
 const desktops_1 = require("./desktops");
+const help_1 = require("./help");
+const osd_1 = require("./osd");
+const rdpFile_1 = require("./rdpFile");
 const remoteSetup_1 = require("./remoteSetup");
 const rdcleanpath_1 = require("./rdcleanpath");
 const signin_1 = require("./signin");
+const ssh_1 = require("./ssh");
+const wake_1 = require("./wake");
+const vms_1 = require("./vms");
+/** How long a desktop that was started (`wake`) gets to answer. */
+const WAKE_TIMEOUT_MS = 3 * 60 * 1000;
 // The vendored IronRDP bundles are ES modules. tsc turns import() into require(), and Node's import() is refused in
 // Tabby on Windows (no dynamic import callback), so they go through a module script: the page's own loader.
 let imports = 0;
@@ -48,7 +60,8 @@ function importESM(url) {
         script.remove();
     });
 }
-const vendor = (f) => (0, url_1.pathToFileURL)(path.join(__dirname, '..', 'vendor', f)).href;
+const vendorFile = (f) => path.join(__dirname, '..', 'vendor', f);
+const vendor = (f) => (0, url_1.pathToFileURL)(vendorFile(f)).href;
 const STYLE = `
 .trd-overlay { position: absolute; inset: 0; z-index: 30; display: flex; background: #111; }
 .trd-host { flex: auto; min-width: 0; min-height: 0; display: flex; }
@@ -58,8 +71,23 @@ const STYLE = `
     pointer-events: none; }
 .trd-status-actions { display: flex; gap: 8px; pointer-events: auto; }
 .trd-status-actions:empty { display: none; }
+.trd-status-help { pointer-events: auto; color: #8ab4f8; font-size: 12px; cursor: pointer; }
+.trd-status-help:hover { text-decoration: underline; }
 .trd-overlay.trd-dim .trd-host { opacity: 0.2; }
+.trd-view-only { display: none; position: absolute; inset: 0; }
+.trd-overlay.trd-view-only-on .trd-view-only { display: block; }
+.trd-overlay.trd-broadcast-on::before { content: 'Typing into all desktops in this tab'; position: absolute; top: 8px; left: 50%;
+    transform: translateX(-50%); z-index: 4; padding: 2px 10px; border-radius: 4px; background: rgba(214, 120, 0, 0.92); color: #fff;
+    font-size: 11px; pointer-events: none; white-space: nowrap; }
+.trd-view-only::after { content: 'View only'; position: absolute; top: 8px; left: 8px; padding: 2px 8px; border-radius: 4px;
+    background: rgba(30, 30, 30, 0.85); color: #ddd; font-size: 11px; pointer-events: none; }
+.trd-mic { position: absolute; top: 8px; right: 8px; width: 22px; height: 22px; border-radius: 50%; display: none;
+    align-items: center; justify-content: center; background: rgba(220, 38, 38, 0.85); color: #fff; font-size: 11px;
+    pointer-events: none; }
+.trd-overlay.trd-mic-on .trd-mic { display: flex; }
 `;
+/** A SHA-256 fingerprint on two lines of 16 bytes, so it fits a narrow pane. */
+const showFingerprint = (fingerprint) => fingerprint ? `${fingerprint.slice(0, 47)}\n${fingerprint.slice(48)}` : '(none)';
 /**
  * grd ignores the scale factor in RDP monitor layouts, so a Retina-sized remote monitor would render its UI at
  * half size. This applies the scale through Mutter's DisplayConfig (temporarily, like GNOME's Display settings
@@ -123,8 +151,24 @@ class DesktopSession {
         this.remote = null;
         /** Plays the remote's sound, when the sound setting was on at connect. */
         this.audio = null;
+        /** Captures the microphone for the remote, when the microphone setting was on at connect. */
+        this.mic = null;
         /** Files through the clipboard (drop on the desktop, or copy on the remote). */
         this.files = null;
+        /** Decodes H.264 for the graphics pipeline (IronRDP's WebCodecsH264Decoder), when this connection uses it. */
+        this.h264 = null;
+        /** No keyboard or mouse input goes to the remote (keys: see keyboard.ts; the mouse: a layer over the picture). */
+        this.viewOnly = false;
+        /** The host's own desktop: the certificate its setup reported for this connection. */
+        this.pinnedCertificate = null;
+        /** Set when the proxy refused the server's certificate on the current connection attempt. */
+        this.certificateProblem = null;
+        /** The connection-status indicator, made the first time it shows. */
+        this.indicator = null;
+        /** How the pictures come (for the indicator): the graphics pipeline, bitmaps, or IronRDP's choice. */
+        this.graphics = '';
+        /** "What does this mean?" under a message (see status()): opens help about it. */
+        this.onHelp = null;
         this.reclaimFocus = (event) => {
             if (this.visible && !this.overlay.contains(event.target)) {
                 setTimeout(() => this.visible && this.focusDesktop());
@@ -136,7 +180,10 @@ class DesktopSession {
         this.overlay.className = 'trd-overlay';
         this.overlay.innerHTML = `
             <div class="trd-host"></div>
-            <div class="trd-status"><div class="trd-status-text"></div><div class="trd-status-actions"></div></div>`;
+            <div class="trd-view-only" title="View only: no keyboard or mouse input goes to the remote desktop"></div>
+            <div class="trd-mic"><i class="fas fa-microphone"></i></div>
+            <div class="trd-osd"></div>
+            <div class="trd-status"><div class="trd-status-text"></div><div class="trd-status-actions"></div><a class="trd-status-help">What does this mean?</a></div>`;
         this.host = this.overlay.querySelector('.trd-host');
         this.statusEl = this.overlay.querySelector('.trd-status');
         if (getComputedStyle(container).position === 'static') {
@@ -149,6 +196,28 @@ class DesktopSession {
         this.container = container;
         container.addEventListener('focusin', this.reclaimFocus, true);
         this.overlay.addEventListener('mousedown', () => this.focusDesktop());
+        // View only: the layer takes the mouse, so the wheel scrolls an actual-size picture instead of the remote.
+        this.overlay.querySelector('.trd-view-only').addEventListener('wheel', event => {
+            const wheel = event;
+            this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('.screen-wrapper')?.scrollBy(wheel.deltaX, wheel.deltaY);
+        }, { passive: true });
+    }
+    setViewOnly(viewOnly) {
+        this.viewOnly = viewOnly;
+        this.overlay.classList.toggle('trd-view-only-on', viewOnly);
+        this.log.push(`view only: ${viewOnly ? 'on' : 'off'}`);
+    }
+    /** Shows which desktop this is, for a moment (see osd.ts). */
+    flashLabel(name, sub, settings) {
+        const osd = this.overlay.querySelector('.trd-osd');
+        (0, osd_1.renderOsd)(osd, name, sub, settings);
+        osd.classList.add('trd-shown');
+        clearTimeout(this.labelTimer);
+        this.labelTimer = setTimeout(() => osd.classList.remove('trd-shown'), settings.seconds * 1000);
+    }
+    /** IronRDP's canvas: the remote frame, at the remote resolution. */
+    canvas() {
+        return this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('canvas') ?? null;
     }
     /**
      * Shows or hides the desktop layer. While it shows, the terminal's input textarea is disabled so
@@ -165,10 +234,16 @@ class DesktopSession {
             setTimeout(() => this.visible && this.focusDesktop());
         }
     }
-    /** Shows a message over the desktop (empty: none), with buttons; with buttons the last picture is dimmed. */
-    status(msg, actions = []) {
+    /**
+     * Shows a message over the desktop (empty: none), with buttons; with buttons the last picture is dimmed. `help`:
+     * with a "What does this mean?" link, for messages that end the connection.
+     */
+    status(msg, actions = [], help = false) {
         this.log.push(`${new Date().toISOString()} ${msg}`);
         this.statusEl.querySelector('.trd-status-text').textContent = msg;
+        const link = this.statusEl.querySelector('.trd-status-help');
+        link.style.display = help && this.onHelp ? '' : 'none';
+        link.onclick = () => this.onHelp?.(msg);
         this.statusEl.querySelector('.trd-status-actions').replaceChildren(...actions.map(action => {
             const button = document.createElement('button');
             button.className = 'btn btn-secondary';
@@ -194,8 +269,7 @@ class DesktopSession {
             return;
         }
         const host = this.host.querySelector('iron-remote-desktop');
-        const canvas = host?.shadowRoot?.querySelector('canvas');
-        canvas?.focus();
+        this.canvas()?.focus();
         if (host && document.activeElement !== host && attempts > 1 && this.visible) {
             setTimeout(() => this.visible && this.focusDesktop(attempts - 1), 16);
         }
@@ -205,11 +279,14 @@ class DesktopSession {
         this.setVisible(false);
         this.container.removeEventListener('focusin', this.reclaimFocus, true);
         this.disposers.forEach(f => f());
+        this.indicator?.dispose();
         try {
             this.ui?.shutdown();
         }
         catch { }
         this.audio?.close();
+        this.h264?.close();
+        this.mic?.close();
         this.files?.dispose();
         this.proxy?.close();
         this.overlay.remove();
@@ -221,19 +298,63 @@ class DesktopSession {
  * running until disconnected or the pane closes. One desktop per remote account.
  */
 let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
-    constructor(app, targets, notifications, config, zone) {
+    constructor(app, targets, notifications, config, zone, profiles, help, selector, platform) {
         this.app = app;
         this.targets = targets;
         this.notifications = notifications;
         this.config = config;
         this.zone = zone;
+        this.profiles = profiles;
+        this.help = help;
+        this.selector = selector;
+        this.platform = platform;
         /** Emits whenever a pane's desktop is opened, shown, hidden, connected, ended or disconnected. */
         this.changed$ = new rxjs_1.Subject();
         this.sessions = new Map();
         this.ironrdp = null;
+        /** Whether the browser decodes H.264 (asked once). */
+        this.h264Support = null;
+        /** Desktops (session keys) where H.264 decoding failed: they connect without it until Tabby restarts. */
+        this.h264Failed = new Set();
+        /**
+         * What the setup last found on each SSH host (by target key): GNOME, xrdp (and its port) or Windows. Kept for as
+         * long as Tabby runs; a Windows host is found out on the first connect there, which costs a failed setup.
+         */
+        this.ownDesktops = new Map();
+        /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops. */
+        this.vms = new Map();
         this.lastUsed = new Map();
         /** Automatic reconnection after a desktop dropped, per pane: attempts so far and the pending timer. */
         this.reconnects = new Map();
+        /** Split tabs where keys typed on one desktop go to all of them (see DesktopKeyboard). */
+        this.broadcast = new WeakSet();
+    }
+    /**
+     * The remote a desktop opened in the pane now is on: the pane's own, or in an SSH tab where `ssh` was typed at
+     * the prompt, the machine it went to (as for a local terminal running ssh), through the tab's host. Asks when it
+     * can't tell which. Undefined: cancelled.
+     */
+    async remoteFor(pane) {
+        const own = await this.targets.targetOf(pane);
+        const nested = own && (0, ssh_1.isSSHTab)(pane) ? await this.targets.nestedSSH(pane).catch(() => []) : [];
+        if (!own || !nested.length) {
+            return own;
+        }
+        let chosen = nested[0];
+        if (nested.length > 1) {
+            const picked = await this.selector.show('Which remote desktop?', [
+                ...nested.map(n => ({ name: n.cmd.destination, description: `ssh running in a terminal on ${own.label}`, icon: 'fas fa-desktop', result: n })),
+                { name: own.label, description: 'this tab\'s own SSH connection', icon: 'fas fa-desktop', result: null },
+            ]).catch(() => undefined);
+            if (picked === undefined) {
+                return undefined;
+            }
+            if (!picked) {
+                return own;
+            }
+            chosen = picked;
+        }
+        return await this.targets.nestedTarget(pane, chosen).catch(() => null) ?? own;
     }
     has(pane) {
         this.prune();
@@ -243,16 +364,90 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return !!this.sessions.get(pane)?.visible;
     }
     async toggle(pane) {
-        if (this.isVisible(pane)) {
+        if (!this.isVisible(pane)) {
+            await this.showDesktop(pane);
+        }
+        else if (this.hasConsole(pane)) {
             this.showConsole(pane);
         }
-        else {
-            await this.showDesktop(pane);
+    }
+    /** Whether there is a console to switch to: not in a remote desktop tab, where the desktop is all there is. */
+    hasConsole(pane) {
+        return !(0, targets_1.isRDPTab)(pane);
+    }
+    /** Whether a desktop signs in with an account of its own: all but the host's own GNOME desktop. */
+    signsIn(spec) {
+        return spec.id !== desktops_1.OWN_DESKTOP || spec.kind !== 'gnome';
+    }
+    /** Whether the pane's desktop signed in with an account (which "Sign in again…" can replace). */
+    canSignInAgain(pane) {
+        const spec = this.sessions.get(pane)?.spec;
+        return !!spec && this.signsIn(spec);
+    }
+    /**
+     * Forgets the saved account of the pane's desktop and connects again, with the sign-in form. For xrdp above all:
+     * with a wrong password it shows its own login window rather than refusing, so the form never comes back.
+     */
+    async signInAgain(pane) {
+        const session = this.sessions.get(pane);
+        if (session && this.signsIn(session.spec)) {
+            await (0, signin_1.forgetCredentials)(session.key);
+            await this.reopen(pane, session.spec);
         }
     }
-    /** The desktops this pane's SSH host offers: its own, then those configured behind it. */
+    /**
+     * The desktops this pane's SSH host offers: its own, then those configured behind it, then the RDP profiles that go
+     * through its SSH profile. A remote desktop tab has just its own one.
+     */
     desktopsOf(target) {
-        return (0, desktops_1.desktopsFor)(target, this.config.store.remoteDesktop?.desktops);
+        if (target.direct) {
+            return [target.direct];
+        }
+        const viaProfile = target.profileId
+            ? (this.config.store.profiles ?? []).filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && p.options?.host && p.options.via === target.profileId)
+                .map((p) => ({ ...p.options, name: p.name }))
+            : [];
+        const specs = (0, desktops_1.desktopsFor)(target, this.config.store.remoteDesktop?.desktops, this.ownDesktops.get(target.key), viaProfile);
+        // Found VMs come last, and not where a configured desktop has the same address.
+        const found = this.settings().discoverVMs ? this.vms.get(target.key)?.specs ?? [] : [];
+        return [...specs, ...found.filter(f => !specs.some(s => s.id === f.id))];
+    }
+    /**
+     * Looks for VMs with a desktop on the host (libvirt), unless it did in the last minute or the setting is off.
+     * Resolves when the list is up to date; menus wait a little for it, and show what they have.
+     */
+    discoverVMs(target) {
+        if (!this.settings().discoverVMs || target.direct || typeof target.exec !== 'function') {
+            return Promise.resolve();
+        }
+        const known = this.vms.get(target.key);
+        if (known?.scan) {
+            return known.scan;
+        }
+        if (known && Date.now() - known.at < 60000) {
+            return Promise.resolve();
+        }
+        const scan = (0, vms_1.scanVMs)(target).then(found => {
+            this.vms.set(target.key, { at: Date.now(), specs: found.map(vms_1.vmSpec) });
+            this.changed$.next();
+        }, () => {
+            this.vms.set(target.key, { at: Date.now(), specs: known?.specs ?? [] });
+        });
+        this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], scan });
+        return scan;
+    }
+    /** Keeps a found VM open in the pane among the host's desktops (`remoteDesktop.desktops`), under its name. */
+    saveFoundDesktop(pane) {
+        const session = this.sessions.get(pane);
+        const spec = session?.spec;
+        if (!session?.remote || !spec?.found) {
+            return;
+        }
+        const entry = { name: spec.name, via: session.remote.label, host: spec.host, port: spec.port, kind: spec.kind, ...spec.wake ? { wake: spec.wake } : {} };
+        this.config.store.remoteDesktop.desktops = [...this.configuredDesktops(), entry];
+        this.config.save();
+        this.changed$.next();
+        this.notifications.notice(`Saved "${spec.name}" to ${session.remote.label}'s desktops (Settings › Remote Desktop)`);
     }
     /** The desktop a plain toggle (hotkey, header, toolbar) opens for this target: the last one used there. */
     defaultDesktop(target) {
@@ -268,7 +463,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const specs = target ? this.desktopsOf(target) : [];
         return { specs, current: this.desktopOf(pane) ?? (target ? this.defaultDesktop(target) : null) };
     }
-    /** "Send files to the remote desktop…": picks files to paste there. */
+    /** "Send files…": picks files to paste there. */
     sendFiles(pane) {
         this.sessions.get(pane)?.files?.pickAndSend().catch(() => null);
     }
@@ -297,7 +492,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         // The resolved hostname, so a profile tab and a plain `ssh` to that machine both offer it.
         const hostname = target.key.replace(/:\d+$/, '').replace(/^[^@]*@/, '');
-        const entry = await (0, desktopForm_1.askNewDesktop)(pane.element.nativeElement, hostname, target.label);
+        const entry = await (0, desktopForm_1.askDesktop)(pane.element.nativeElement, {
+            title: `Add a desktop reached through ${target.label}`,
+            action: 'Add and open',
+            entry: { via: hostname, host: '127.0.0.1', port: 3389 },
+            check: e => this.addressTaken(e, -1),
+        });
         if (!entry) {
             pane.frontend?.focus();
             return;
@@ -305,19 +505,170 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.config.store.remoteDesktop.desktops = [...this.configuredDesktops(), entry];
         this.config.save();
         this.changed$.next();
-        await this.showDesktop(pane, `${entry.host}:${entry.port}`);
+        await this.showDesktop(pane, (0, desktops_1.desktopIdOf)(entry));
+    }
+    /** Another entry for the same host already has this address (desktops are told apart by it). */
+    addressTaken(entry, index) {
+        const id = (0, desktops_1.desktopIdOf)(entry);
+        const via = (entry.via ?? '').trim().toLowerCase();
+        const taken = this.configuredDesktops().some((d, i) => i !== index && (0, desktops_1.desktopIdOf)(d) === id && (d.via ?? '').trim().toLowerCase() === via);
+        return taken ? `There is already a desktop at ${id} behind ${entry.via}.` : null;
+    }
+    /**
+     * "Edit a desktop": the same form, over the pane, filled in. A new address takes the desktop's saved accounts and
+     * sharpness along; a new user name drops the saved account, which was for the old one. Open sessions keep running.
+     */
+    async editDesktop(pane, index) {
+        const old = this.configuredDesktops()[index];
+        if (!old) {
+            return;
+        }
+        if (this.isVisible(pane)) {
+            this.showConsole(pane);
+        }
+        const entry = await (0, desktopForm_1.askDesktop)(pane.element.nativeElement, {
+            title: `Edit ${old.name ?? (0, desktops_1.desktopIdOf)(old)} (behind ${old.via})`,
+            action: 'Save',
+            entry: old,
+            check: e => this.addressTaken(e, index),
+        });
+        pane.frontend?.focus();
+        // Compared with the entry as it is now: the config can change while the form shows.
+        const list = this.configuredDesktops();
+        if (!entry || list[index] !== old) {
+            return;
+        }
+        list[index] = entry;
+        this.config.store.remoteDesktop.desktops = list;
+        this.config.save();
+        this.changed$.next();
+        const accountChanged = (old.username ?? '') !== (entry.username ?? '') || (old.domain ?? '') !== (entry.domain ?? '');
+        await this.desktopEdited((0, desktops_1.desktopIdOf)(old), (0, desktops_1.desktopIdOf)(entry), accountChanged, false);
+    }
+    /**
+     * A desktop was edited (the edit form, or an RDP profile's settings): what is kept per desktop is keyed by its
+     * address, so a new address takes the saved account, its sharpness, its remembered certificate and the last-used
+     * choice along. (Should another machine answer at the new address, its certificate differs and the connection
+     * stops to ask, rather than trusting it silently as a first use.) A new user name or domain drops the saved
+     * account instead: it was for the old one. `direct`: a direct desktop (`rdp#<id>` keys), otherwise one behind SSH
+     * hosts (`<ssh key>#<id>`).
+     */
+    async desktopEdited(fromId, toId, accountChanged, direct) {
+        if (direct) {
+            const [from, to] = [`${desktops_1.DIRECT_KEY}#${fromId}`, `${desktops_1.DIRECT_KEY}#${toId}`];
+            const saved = !accountChanged && from !== to ? await (0, signin_1.loadCredentials)(from) : null;
+            if (saved) {
+                await (0, signin_1.saveCredentials)(to, saved).catch(() => null);
+            }
+            if (accountChanged || from !== to) {
+                await (0, signin_1.forgetCredentials)(from);
+            }
+        }
+        else if (accountChanged) {
+            await (0, signin_1.forgetCredentialsFor)(fromId);
+        }
+        else if (fromId !== toId) {
+            await (0, signin_1.moveCredentialsFor)(fromId, toId);
+        }
+        if (fromId === toId) {
+            return;
+        }
+        const moved = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${fromId}` : key.endsWith(`#${fromId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
+        const store = this.config.store.remoteDesktop;
+        for (const list of ['desktopSharpness', 'trustedCertificates']) {
+            if (Array.isArray(store[list])) {
+                store[list] = store[list].map((e) => typeof e?.desktop === 'string' && moved(e.desktop)
+                    ? { ...e, desktop: `${e.desktop.slice(0, -fromId.length)}${toId}` }
+                    : e);
+            }
+        }
+        this.config.save();
+        for (const [key, id] of this.lastUsed) {
+            if (id === fromId && (key === desktops_1.DIRECT_KEY) === direct) {
+                this.lastUsed.set(key, toId);
+            }
+        }
+    }
+    /** "Import an .rdp file…": picks one and adds it as a remote desktop profile (see importRdp). */
+    async importRdpFile() {
+        const file = await new Promise(resolve => {
+            const input = document.createElement('input');
+            input.type = 'file';
+            input.accept = '.rdp';
+            input.style.display = 'none';
+            input.addEventListener('change', () => { input.remove(); resolve(input.files?.[0] ?? null); });
+            input.addEventListener('cancel', () => { input.remove(); resolve(null); });
+            document.body.appendChild(input);
+            input.click();
+        });
+        if (file) {
+            await this.importRdp(new Uint8Array(await file.arrayBuffer()), file.name);
+        }
     }
-    /** Removes a configured desktop and its saved accounts. Open sessions to it keep running. */
+    /**
+     * Adds a "Remote desktop (RDP)" profile from a .rdp file's contents (address, user name, domain; see rdpFile.ts)
+     * and opens it; or opens the profile that already has that address and user. Returns the profile, or null.
+     */
+    async importRdp(data, fileName) {
+        const parsed = (0, rdpFile_1.parseRdpFile)(data);
+        if (!parsed) {
+            this.notifications.error(`${fileName}: no address ("full address") in it`);
+            return null;
+        }
+        const existing = (this.config.store.profiles ?? []).find((p) => p?.type === targets_1.RDP_PROFILE_TYPE && !p.options?.via &&
+            p.options?.host === parsed.host && (p.options.port || 3389) === parsed.port && (p.options.username ?? '') === (parsed.username ?? ''));
+        if (existing) {
+            this.notifications.info(`Opening "${existing.name}", which is already a profile for ${fileName}`);
+            await this.profiles.openNewTabForProfile(existing);
+            return existing;
+        }
+        const profile = {
+            type: targets_1.RDP_PROFILE_TYPE,
+            name: fileName.replace(/^.*[\\/]/, '').replace(/\.rdp$/i, '') || parsed.host,
+            icon: 'fas fa-desktop',
+            options: { host: parsed.host, port: parsed.port, kind: 'windows', username: parsed.username ?? '', domain: parsed.domain ?? '', via: '' },
+        };
+        await this.profiles.newProfile(profile);
+        this.config.save();
+        this.notifications.notice(`Added the remote desktop profile "${profile.name}" (Settings › Profiles & connections)`);
+        await this.profiles.openNewTabForProfile(profile);
+        return profile;
+    }
+    /** Asks, then removes a configured desktop (see removeDesktop). The menus and the settings page use this. */
+    async confirmRemoveDesktop(index) {
+        const d = this.configuredDesktops()[index];
+        if (!d) {
+            return false;
+        }
+        const address = `${d.host ?? '127.0.0.1'}:${d.port ?? 3389}`;
+        const { response } = await this.platform.showMessageBox({
+            type: 'warning',
+            message: `Remove the desktop "${d.name ?? address}"?`,
+            detail: `${address} behind ${d.via}. Its saved password and remembered certificate are forgotten too. ` +
+                'To open it instead, use its host\'s SSH tab: right-click › Open.',
+            buttons: ['Remove', 'Keep'],
+            defaultId: 1,
+            cancelId: 1,
+        });
+        if (response !== 0) {
+            return false;
+        }
+        this.removeDesktop(index);
+        return true;
+    }
+    /** Removes a configured desktop, its saved accounts and its remembered certificate. Open sessions to it keep running. */
     removeDesktop(index) {
         const list = this.configuredDesktops();
         const [removed] = list.splice(index, 1);
         if (!removed) {
             return;
         }
+        const id = `${removed.host ?? '127.0.0.1'}:${removed.port ?? 3389}`;
         this.config.store.remoteDesktop.desktops = list;
+        this.forgetCertificatesFor(id);
         this.config.save();
         this.changed$.next();
-        (0, signin_1.forgetCredentialsFor)(`${removed.host ?? '127.0.0.1'}:${removed.port ?? 3389}`);
+        (0, signin_1.forgetCredentialsFor)(id);
     }
     /**
      * Shows a desktop over the pane: `desktopId` (see desktopsOf), or the one it has open, or the default. A pane
@@ -331,7 +682,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session = undefined;
         }
         if (!session) {
-            const target = await this.targets.targetOf(pane);
+            const target = options.target ?? await this.remoteFor(pane);
+            if (target === undefined) {
+                return;
+            }
             if (!target) {
                 this.notifications.error('No SSH connection found in this terminal');
                 return;
@@ -351,10 +705,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             // over the session (Windows).
             const existing = this.paneWithDesktopFor(key);
             if (existing) {
+                if (existing.parent instanceof tabby_core_1.SplitTabComponent && existing.parent === pane.parent) {
+                    // Next to it, moving the focus there would go unnoticed.
+                    this.help.note(pane.element.nativeElement, `${target.label}'s desktop is already open in the other pane.`, 'nested-ssh');
+                }
                 this.selectPane(existing);
                 return this.showDesktop(existing);
             }
             const created = new DesktopSession(pane.element.nativeElement, key, spec);
+            created.onHelp = message => this.help.explain(message);
+            if (options.viewOnly) {
+                created.setViewOnly(true);
+            }
             session = created;
             this.sessions.set(pane, created);
             pane.destroyed$.subscribe(() => this.disconnect(pane));
@@ -362,6 +724,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             const focused = pane.focused$.subscribe(() => {
                 if (created.visible) {
                     setTimeout(() => created.visible && created.focusDesktop());
+                    this.label(pane, created);
                 }
             });
             created.onDispose(() => focused.unsubscribe());
@@ -371,7 +734,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             return;
         }
         session.setVisible(true);
+        session.overlay.classList.toggle('trd-broadcast-on', this.isBroadcast(pane));
+        this.syncIndicator(session);
         this.changed$.next();
+        this.tip(pane, session);
+        this.label(pane, session);
         const shown = session;
         setTimeout(() => this.followPane(pane, shown));
     }
@@ -380,11 +747,33 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * attached to the console's tmux session (or opened in its folder when it isn't in tmux).
      */
     async openConsole(pane, request) {
-        await this.showDesktop(pane, desktops_1.OWN_DESKTOP);
         const target = await this.targets.targetOf(pane);
         if (!target) {
             return;
         }
+        // `desk` may run on another machine than the pane is connected to: `ssh` typed in its console, with the script
+        // there through a shared home folder. That machine's desktop isn't this connection's to open.
+        if (request.machine) {
+            const machineOf = async (t) => (await t.exec('sh -s', deskScript_1.MACHINE_ID_COMMAND).catch(() => '')).trim();
+            const machine = await machineOf(target);
+            if (machine && machine !== request.machine) {
+                // Typed `ssh` at the prompt: the machine it went to, when that is where desk ran.
+                for (const nested of (0, ssh_1.isSSHTab)(pane) ? await this.targets.nestedSSH(pane).catch(() => []) : []) {
+                    const there = await this.targets.nestedTarget(pane, nested).catch(() => null);
+                    if (there && await machineOf(there) === request.machine) {
+                        return this.openConsoleOn(pane, there, request);
+                    }
+                }
+                const there = request.hostname || 'another machine';
+                this.help.note(pane.element.nativeElement, `desk ran on ${there}, but this tab is connected to ${target.label}. ` +
+                    `Open ${there} in its own tab to use desk there.`, 'nested-ssh');
+                return;
+            }
+        }
+        return this.openConsoleOn(pane, target, request);
+    }
+    async openConsoleOn(pane, target, request) {
+        await this.showDesktop(pane, desktops_1.OWN_DESKTOP, { target });
         // Wait for the desktop (possibly another pane's, for the same account) to be connected.
         let session;
         for (let i = 0; i < 240; i++) {
@@ -398,6 +787,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (session?.state !== 'connected') {
             return;
         }
+        if (session.spec.kind !== 'gnome') {
+            // The terminal it opens is GNOME's, on the headless GNOME session.
+            this.notifications.error(`desk: needs a GNOME desktop; this one is ${session.spec.kind === 'xrdp' ? 'served by xrdp' : 'Windows'}`);
+            return;
+        }
         try {
             const out = await target.exec('sh -s', (0, deskScript_1.consoleScript)(request));
             const err = /^RD_ERR (.*)$/m.exec(out);
@@ -453,6 +847,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const session = this.sessions.get(pane);
         if (session) {
             session.setVisible(false);
+            this.syncIndicator(session);
             this.changed$.next();
         }
         pane.frontend?.focus();
@@ -486,11 +881,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const session = this.sessions.get(pane);
         const background = !!session && !session.visible;
         this.drop(pane, false);
-        await this.zone.run(() => this.showDesktop(pane, spec.id, { background }));
+        // The same remote as before, even if the `ssh` it was found through has ended since.
+        await this.zone.run(() => this.showDesktop(pane, spec.id, { background, viewOnly: session?.viewOnly, target: session?.remote ?? undefined }));
     }
     /** After a desktop ended: reconnect by itself if it dropped, otherwise offer to. */
     afterEnd(pane, target, spec, session, outcome) {
         session.state = 'ended';
+        this.syncIndicator(session);
         this.changed$.next();
         if (this.sessions.get(pane) !== session) {
             return;
@@ -507,7 +904,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.status(`Remote desktop session ended: ${outcome.reason ?? 'unknown reason'}`, [again('Reconnect')]);
         }
         else {
-            session.status(`Remote desktop failed: ${outcome.error ?? 'unknown error'}`, [again('Try again')]);
+            session.status(`Remote desktop failed: ${outcome.error ?? 'unknown error'}`, [again('Try again')], true);
         }
     }
     scheduleReconnect(pane, target, spec, session, message) {
@@ -536,7 +933,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const delays = RemoteDesktopService_1.RECONNECT_DELAYS;
         if (state.attempts >= delays.length) {
             this.reconnects.delete(pane);
-            session.status(`${message}\nStopped reconnecting automatically.`, [{ label: 'Reconnect', run: () => this.reopen(pane, spec) }]);
+            session.status(`${message}\nStopped reconnecting automatically.`, [{ label: 'Reconnect', run: () => this.reopen(pane, spec) }], true);
             return;
         }
         const delay = delays[state.attempts++];
@@ -551,6 +948,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             desk: store.desk === true,
             macShortcuts: store.macShortcuts !== false,
             sound: store.sound !== false,
+            h264: store.h264 !== false,
+            zoom: store.zoom === 'actual' ? 'actual' : 'fit',
+            connectionStatus: store.connectionStatus === true,
+            microphone: store.microphone === true,
+            osd: (0, osd_1.osdSettings)(store.osd),
+            discoverVMs: store.discoverVMs !== false,
+            checkUpdates: store.checkUpdates !== false,
         };
     }
     /** The sharpness chosen for the pane's desktop in particular (`remoteDesktop.desktopSharpness`), or null. */
@@ -587,21 +991,62 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     /** Changes a setting, saves it, and applies it to open desktops. */
     updateSettings(change) {
         const store = this.config.store.remoteDesktop;
-        Object.assign(store, change);
+        const { osd, ...rest } = change;
+        Object.assign(store, rest);
+        if (osd) {
+            // A nested object in Tabby's config takes its fields one by one (the object itself isn't replaced).
+            Object.assign(store.osd, osd);
+        }
+        if (change.h264) {
+            this.h264Failed.clear(); // turned on again: give it another try everywhere
+        }
         this.config.save();
         for (const [pane, session] of this.sessions) {
+            this.applyZoom(session);
+            this.syncIndicator(session);
             this.followPane(pane, session);
         }
     }
+    /** IronRDP's ScreenScale for the picture: Real (1:1, scrolling) only with a fixed resolution and zoom 'actual'. */
+    screenScale() {
+        const settings = this.settings();
+        return settings.resize === 'off' && settings.zoom === 'actual' ? 3 /* ScreenScale.Real */ : 1; /* ScreenScale.Fit */
+    }
+    applyZoom(session) {
+        try {
+            session.ui?.setScale(this.screenScale());
+        }
+        catch { }
+    }
+    /** Shows the desktop's connection-status indicator while the setting is on and the desktop shows, connected. */
+    syncIndicator(session) {
+        const on = this.settings().connectionStatus && session.visible && session.state === 'connected';
+        if (on && !session.indicator) {
+            const remote = session.remote;
+            session.indicator = new connectionStatus_1.ConnectionStatus(session.overlay, this.zone, {
+                path: () => {
+                    const spec = session.spec;
+                    const size = session.remoteSize;
+                    return [
+                        spec.id === desktops_1.OWN_DESKTOP ? spec.name : remote?.direct ? `${spec.name} (direct)` : `${spec.name} via ${remote?.label ?? '?'}`,
+                        size ? `${size.width}×${size.height}` : '',
+                        session.graphics,
+                        this.settingsFor(session).sharpness === 'retina' ? 'Retina' : 'Standard',
+                    ].filter(Boolean).join(' · ');
+                },
+                bytes: () => session.proxy?.stats ?? null,
+                ping: remote?.ping ? () => remote.ping() : undefined,
+            });
+        }
+        const canvas = session.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('canvas');
+        session.indicator?.setActive(on, on ? canvas : null);
+    }
     /** Follows the pane's size (debounced) while the desktop shows, per the resize setting. */
     watchSize(pane, session) {
         let timer;
         const observer = new ResizeObserver(() => {
             // Refit the view right away (the component only refits on window resizes by itself) ...
-            try {
-                session.ui?.setScale(1 /* ScreenScale.Fit */);
-            }
-            catch { }
+            this.applyZoom(session);
             // ... and change the remote resolution once the size settles.
             clearTimeout(timer);
             timer = setTimeout(() => this.followPane(pane, session), 300);
@@ -625,9 +1070,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         if (settings.resize === 'reconnect') {
             session.log.push(`resize: reconnecting at ${wanted.width}x${wanted.height}`);
+            const viewOnly = session.viewOnly;
             this.zone.run(() => {
                 this.disconnect(pane);
-                this.showDesktop(pane);
+                this.showDesktop(pane, undefined, { viewOnly });
             });
             return;
         }
@@ -637,8 +1083,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         session.log.push(`resize: ${size.width}x${size.height} @${size.scale}%`);
         const before = session.remoteSize;
         session.remoteSize = size;
-        if (session.spec.kind === 'windows') {
+        if (session.spec.kind !== 'gnome') {
             // Windows takes the scale from the monitor layout only when it also has the monitor's physical size (mm).
+            // xrdp gets it too; it can take its session's DPI from it.
             const mm = (px) => Math.round(px / (size.scale / 100) / 96 * 25.4);
             session.ui.resize(size.width, size.height, size.scale, mm(size.width), mm(size.height));
         }
@@ -646,41 +1093,301 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.ui.resize(size.width, size.height, size.scale);
         }
         // grd ignores the scale in the monitor layout: it's set through Mutter (also back to 100%).
-        if ((size.scale !== 100 || (before?.scale ?? 100) !== 100) && session.remote && session.spec.id === desktops_1.OWN_DESKTOP) {
+        if ((size.scale !== 100 || (before?.scale ?? 100) !== 100) && session.remote && session.spec.id === desktops_1.OWN_DESKTOP && session.spec.kind === 'gnome') {
             session.remote.exec(`python3 - ${size.width} ${size.height} ${size.scale / 100}`, SCALE_SCRIPT).then(out => {
                 session.log.push(`scale: ${/^RD_(OK|ERR) (.*)$/m.exec(out)?.[2] ?? out.trim().slice(-120)}`);
             }, e => session.log.push(`scale: ${e?.message ?? e}`));
         }
     }
+    /**
+     * Whether this connection decodes H.264: the setting, the browser (WebCodecs), and no failure on this desktop
+     * since Tabby started.
+     */
+    async useH264(rdp, session, settings) {
+        if (!settings.h264 || this.h264Failed.has(session.key) || typeof rdp.h264Decoder !== 'function') {
+            return false;
+        }
+        this.h264Support ??= Promise.resolve(rdp.h264Supported()).catch(() => false);
+        return this.h264Support;
+    }
+    isViewOnly(pane) {
+        return !!this.sessions.get(pane)?.viewOnly;
+    }
+    /** View only: the pane's desktop gets no keyboard or mouse input (the picture, clipboard and sound go on). */
+    setViewOnly(pane, viewOnly) {
+        const session = this.sessions.get(pane);
+        if (session) {
+            session.setViewOnly(viewOnly);
+            this.changed$.next();
+        }
+    }
+    /**
+     * For keys sent from a menu: brings the pane's desktop forward and focuses it, since IronRDP only takes keys
+     * while it has focus. False when it can't take them (not connected, view only, or focus didn't stick).
+     */
+    async takeKeyboard(pane) {
+        const session = this.sessions.get(pane);
+        if (!session || session.state !== 'connected' || session.viewOnly) {
+            return false;
+        }
+        if (!session.visible) {
+            await this.showDesktop(pane);
+        }
+        if ((0, targets_1.desktopPaneOf)(this.app.activeTab) !== pane) {
+            this.selectPane(pane);
+        }
+        // After a tab switch, the pane shows on Angular's next change detection.
+        for (let i = 0; i < 30; i++) {
+            session.focusDesktop(1);
+            const focused = document.activeElement;
+            if (focused?.tagName === 'IRON-REMOTE-DESKTOP' && session.overlay.contains(focused)) {
+                return true;
+            }
+            await new Promise(resolve => setTimeout(resolve, 16));
+        }
+        session.log.push('keys: the desktop did not take the keyboard');
+        return false;
+    }
+    /**
+     * Saves the remote frame as a PNG in Downloads (never overwriting) and copies it to the clipboard. The canvas is
+     * at the remote resolution, so this is the full picture whatever the pane's size. Returns the file.
+     */
+    async saveScreenshot(pane) {
+        const session = this.sessions.get(pane);
+        const canvas = session?.state === 'connected' ? session.canvas() : null;
+        if (!session || !canvas) {
+            return null;
+        }
+        try {
+            const blob = await new Promise(resolve => canvas.toBlob(resolve, 'image/png'));
+            if (!blob) {
+                throw new Error('the picture could not be encoded');
+            }
+            const png = Buffer.from(await blob.arrayBuffer());
+            const dir = path.join(os.homedir(), 'Downloads');
+            const now = new Date();
+            const two = (n) => String(n).padStart(2, '0');
+            const stamp = `${now.getFullYear()}-${two(now.getMonth() + 1)}-${two(now.getDate())} at ${two(now.getHours())}.${two(now.getMinutes())}.${two(now.getSeconds())}`;
+            const name = `Screenshot ${session.spec.name} ${stamp}`.replace(/[\\/:*?"<>|]/g, '-');
+            await fs.promises.mkdir(dir, { recursive: true });
+            const file = (0, fileTransfer_1.uniquePath)(path.join(dir, `${name}.png`));
+            await fs.promises.writeFile(file, png, { flag: 'wx' });
+            session.log.push(`screenshot: saved ${file}`);
+            let copied = true;
+            try {
+                const { clipboard, nativeImage } = require('electron');
+                clipboard.writeImage(nativeImage.createFromBuffer(png));
+            }
+            catch (e) {
+                copied = false;
+                session.log.push(`screenshot: clipboard: ${e?.message ?? e}`);
+            }
+            session.files?.toast(`Screenshot saved to ${path.basename(dir)}${copied ? ' and copied to the clipboard' : ''}`, [{
+                    label: process.platform === 'darwin' ? 'Show in Finder' : 'Show in folder',
+                    run: () => require('electron').shell.showItemInFolder(file),
+                }]);
+            return file;
+        }
+        catch (e) {
+            session.log.push(`screenshot: ${e?.message ?? e}`);
+            this.notifications.error(`Couldn't save the screenshot: ${e?.message ?? e}`);
+            return null;
+        }
+    }
+    /**
+     * Which desktop a pane shows, for a moment (connected, shown, focused), like a TV naming its input. By default only
+     * where nothing else says: in a split, whose pane headers name the SSH connection, and for a desktop other than
+     * that connection's own (behind the host, or where ssh was typed on to).
+     */
+    label(pane, session, always = false) {
+        const target = session.remote;
+        const osd = this.settings().osd;
+        if (session.state !== 'connected' || !session.visible || !target || osd.show === 'off' && !always) {
+            return;
+        }
+        const inSplit = pane.parent instanceof tabby_core_1.SplitTabComponent && pane.parent.getAllTabs().length > 1;
+        const own = session.spec.id === desktops_1.OWN_DESKTOP;
+        if (osd.show === 'auto' && !always && !inSplit && own && !target.via) {
+            return;
+        }
+        // A desktop named after its host already says where it is ("buildhost desktop (xrdp)").
+        const through = own ? target.via : target.direct || session.spec.name.startsWith(target.label) ? null : target.label;
+        const size = session.remoteSize ? `${session.remoteSize.width}×${session.remoteSize.height}` : '';
+        session.flashLabel(own ? target.label : session.spec.name, [through ? `via ${through}` : '', size].filter(Boolean).join(' · '), osd);
+    }
+    /** Shows the on-screen display on every desktop showing now, whatever `show` says (to try the settings). */
+    showOsdEverywhere() {
+        let shown = 0;
+        for (const [pane, session] of this.sessions) {
+            if (session.state === 'connected' && session.visible) {
+                this.label(pane, session, true);
+                shown++;
+            }
+        }
+        return shown;
+    }
+    /** The one-time tip (see RemoteDesktopHelp.tipOnce), once a desktop is connected and showing. */
+    tip(pane, session) {
+        if (session.state === 'connected' && session.visible) {
+            this.help.tipOnce(session.overlay, this.hasConsole(pane), () => session.visible && session.focusDesktop());
+        }
+    }
+    /** The open desktops, for the settings page (and bug reports): where they are, and their logs. */
+    sessionSummaries() {
+        this.prune();
+        return [...this.sessions.values()].map(session => ({
+            name: session.spec.name,
+            where: session.remote && !session.remote.direct ? session.remote.label : null,
+            state: session.state === 'connected' ? (session.visible ? 'connected, showing' : 'connected, in the background')
+                : session.state === 'connecting' ? 'connecting' : 'not connected',
+            log: [...session.log],
+        }));
+    }
+    /** The certificates remembered for desktops (`remoteDesktop.trustedCertificates`). */
+    trustedCertificates() {
+        const list = this.config.store.remoteDesktop?.trustedCertificates;
+        return (Array.isArray(list) ? list : [])
+            .filter((e) => typeof e?.desktop === 'string' && typeof e?.sha256 === 'string')
+            .map((e) => ({ desktop: e.desktop, sha256: (0, rdcleanpath_1.normalizeFingerprint)(e.sha256) || e.sha256 }));
+    }
+    /** Forgets one remembered certificate (by session key); the next connection remembers the one it meets. */
+    forgetCertificate(key) {
+        const store = this.config.store.remoteDesktop;
+        store.trustedCertificates = (Array.isArray(store.trustedCertificates) ? store.trustedCertificates : []).filter((e) => e?.desktop !== key);
+        this.config.save();
+        this.changed$.next();
+    }
+    /** The split tab holding the pane, if it has more than one pane. */
+    splitOf(pane) {
+        const split = this.app.tabs.find(t => t instanceof tabby_core_1.SplitTabComponent && t.getAllTabs().includes(pane));
+        return split && split.getAllTabs().length > 1 ? split : null;
+    }
+    /** The other connected desktops in the pane's tab that take input (not view only), with their sessions. */
+    othersInTab(pane) {
+        const split = this.splitOf(pane);
+        return split ? split.getAllTabs().filter(p => p !== pane).map(p => ({ pane: p, session: this.sessions.get(p) }))
+            .filter(({ session }) => session?.state === 'connected' && !session.viewOnly && session.ui) : [];
+    }
+    /** How many desktops in the pane's tab would get a paste or typing (itself included), when that's more than one. */
+    desktopsInTab(pane) {
+        const own = this.sessions.get(pane);
+        return this.othersInTab(pane).length + (own?.state === 'connected' && !own.viewOnly ? 1 : 0);
+    }
+    isBroadcast(pane) {
+        const split = this.splitOf(pane);
+        return !!split && this.broadcast.has(split);
+    }
+    /** Keys typed on one desktop of the pane's tab go to all of them, or no longer; each shows it while it does. */
+    setBroadcast(pane, on) {
+        const split = this.splitOf(pane);
+        if (!split) {
+            return;
+        }
+        on ? this.broadcast.add(split) : this.broadcast.delete(split);
+        for (const p of split.getAllTabs()) {
+            const session = this.sessions.get(p);
+            session?.overlay.classList.toggle('trd-broadcast-on', on);
+            session?.log.push(`typing into all desktops: ${on ? 'on' : 'off'}`);
+        }
+        this.changed$.next();
+    }
+    /** A key event for the other desktops of a tab typing into all (see DesktopKeyboard). */
+    broadcastKey(pane, type, init) {
+        if (!this.isBroadcast(pane)) {
+            return;
+        }
+        for (const { session } of this.othersInTab(pane)) {
+            try {
+                session.ui.sendKeyboardEvent(new KeyboardEvent(type, { ...init, cancelable: true }));
+            }
+            catch (e) {
+                session.log.push(`typing into all desktops: ${e?.message ?? e}`);
+            }
+        }
+    }
+    /**
+     * Pastes on every connected desktop in the pane's tab: files copied here are offered to each first (see
+     * FileTransfer.pasteClipboardFiles); text and pictures are on their clipboards already. Then Ctrl+V on each, in
+     * whatever window is active there.
+     */
+    pasteToAll(pane) {
+        const targets = [...this.sessions.get(pane) ? [{ pane, session: this.sessions.get(pane) }] : [], ...this.othersInTab(pane)]
+            .filter(({ session }) => session.state === 'connected' && !session.viewOnly && session.ui);
+        for (const { session } of targets) {
+            // Each pastes once it has taken in the files (when there are files to offer), however long that takes it.
+            const offered = session.files?.pasteClipboardFiles() ?? false;
+            (offered ? session.files.offerAnswered() : Promise.resolve(true)).then(ok => {
+                if (!ok) {
+                    session.log.push('paste to all desktops: the remote refused the files');
+                    return;
+                }
+                try {
+                    session.ui.ctrlV();
+                    session.log.push('keys: Ctrl+V (paste to all desktops)');
+                }
+                catch (e) {
+                    session.log.push(`paste to all desktops: ${e?.message ?? e}`);
+                }
+            });
+        }
+        return targets.length;
+    }
+    /** Resolves when the pane's desktop has taken in the files just offered to it, so a paste then gets them. */
+    pasteReady(pane) {
+        return this.sessions.get(pane)?.files?.offerAnswered() ?? Promise.resolve(true);
+    }
+    /** ⌘V on the pane's desktop: offers files copied here for it (see FileTransfer.pasteClipboardFiles). */
+    pasteClipboardFiles(pane) {
+        const session = this.sessions.get(pane);
+        return !!session?.files && this.isConnected(pane) && !session.viewOnly && session.files.pasteClipboardFiles();
+    }
     /** Status log of the pane's desktop session (for tests and troubleshooting). */
     logOf(pane) {
         return this.sessions.get(pane)?.log ?? [];
     }
     loadIronRDP() {
         this.ironrdp ??= (async () => {
-            await importESM(vendor('iron-remote-desktop.js'));
-            const rdp = await importESM(vendor('iron-remote-desktop-rdp.js'));
+            // The WebAssembly ships as its own file (not inlined in the bundle). It is read here and handed to init,
+            // rather than fetched by the bundle from next to itself: fetch() of file:// URLs is up to the Electron
+            // build (a fuse turns it off), and a plain file path needs no URL escaping for spaces or drive letters.
+            const [rdp, wasm] = await Promise.all([
+                importESM(vendor('iron-remote-desktop.js')).then(() => importESM(vendor('iron-remote-desktop-rdp.js'))),
+                fs.promises.readFile(vendorFile('ironrdp_web_bg.wasm')),
+            ]);
             // Troubleshooting: localStorage.trdLogLevel = 'DEBUG' (or TRACE), then restart Tabby.
             let level = 'INFO';
             try {
                 level = localStorage.getItem('trdLogLevel') || level;
             }
             catch { }
-            await rdp.init(level);
+            await rdp.init(level, wasm);
             return rdp;
         })();
         this.ironrdp.catch(() => { this.ironrdp = null; });
         return this.ironrdp;
     }
     /**
-     * Where to connect and as whom. The host's own desktop: the setup script (grd, generated credentials).
-     * Others: the saved account, or the sign-in form (retry=true after a failed sign-in).
+     * Where to connect and as whom. The host's own desktop: the setup script (grd, generated credentials), or, where
+     * it finds xrdp or Windows instead of GNOME, as below. Others: the saved account, or the sign-in form (retryError: after a
+     * failed sign-in).
      */
     async endpointFor(target, spec, session, retryError) {
-        if (spec.id === desktops_1.OWN_DESKTOP) {
+        // A Windows host is known from an earlier connect: no setup to run there (it would only fail again).
+        if (spec.id === desktops_1.OWN_DESKTOP && !retryError && this.ownDesktops.get(target.key)?.kind !== 'windows') {
             session.status(`Preparing the remote desktop on ${target.label}…`);
             const endpoint = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend);
-            return { host: '127.0.0.1', port: endpoint.port, credentials: { username: endpoint.username, password: endpoint.password }, remember: false };
+            this.ownDesktops.set(target.key, { kind: endpoint.kind, xrdpPort: endpoint.xrdpPort, xrdpUser: endpoint.xrdpUser });
+            // Only the setup knows which desktop the host has; the session follows it (graphics, sign-in, resizing).
+            spec.kind = endpoint.kind;
+            if (endpoint.kind === 'windows') {
+                session.log.push('setup: the SSH host runs Windows; its own desktop is its RDP server');
+            }
+            if (endpoint.kind === 'gnome') {
+                return { host: '127.0.0.1', port: endpoint.port, credentials: { username: endpoint.username, password: endpoint.password }, remember: false, certificate: endpoint.certificate };
+            }
+            spec.host = '127.0.0.1';
+            spec.port = endpoint.port;
+            spec.username ??= endpoint.username;
         }
         const saved = retryError ? null : await (0, signin_1.loadCredentials)(session.key);
         if (saved) {
@@ -688,7 +1395,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         session.status('');
         const asked = (0, signin_1.askCredentials)(session.overlay, {
-            title: `Sign in to ${spec.name} (via ${target.label})`,
+            // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via".
+            title: spec.id === desktops_1.OWN_DESKTOP || target.direct || spec.kind === 'xrdp' && spec.host === '127.0.0.1' ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${target.label})`,
             username: spec.username,
             error: retryError,
             canRemember: true,
@@ -702,28 +1410,71 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async connect(pane, target, spec, session) {
         const alive = () => this.sessions.get(pane) === session;
         let retryError;
+        // Automatic reconnects never start a desktop (`wake`): it may have been shut down on purpose.
+        const automatic = this.reconnects.has(pane);
+        // A desktop that was just started can answer before it takes connections: a few more tries, same account.
+        let woken = false;
+        let startupRetries = 0;
+        let endpoint = null;
         try {
-            // Signing in to a desktop behind the host can take a few tries; the host's own one can't fail that way.
+            if (spec.wake) {
+                const woke = await this.wakeIfDown(pane, target, spec, session, automatic);
+                if (woke === null) {
+                    return;
+                }
+                woken = woke;
+            }
+            // Signing in to a Windows account can take a few tries; a GNOME desktop the plugin set up can't fail that way.
             for (let attempt = 0;; attempt++) {
-                const [endpoint, rdp] = await Promise.all([this.endpointFor(target, spec, session, retryError), this.loadIronRDP()]);
+                const [asked, rdp] = await Promise.all([endpoint ?? this.endpointFor(target, spec, session, retryError), this.loadIronRDP()]);
                 if (!alive()) {
                     return;
                 }
-                if (!endpoint) {
+                if (!asked) {
                     session.state = 'ended';
                     this.changed$.next();
                     this.cancelReconnect(pane);
                     session.status('Sign-in cancelled.', [{ label: 'Sign in', run: () => this.reopen(pane, spec) }]);
                     return;
                 }
+                endpoint = asked;
                 session.remote = target;
-                session.proxy ??= await (0, rdcleanpath_1.startRDCleanPathProxy)(() => target.openTcp(endpoint.host, endpoint.port), m => session.log.push(m));
-                const outcome = await this.run(pane, target, spec, session, rdp, endpoint);
-                if (outcome.signInFailed && spec.id !== desktops_1.OWN_DESKTOP && attempt < 5 && alive()) {
+                session.pinnedCertificate = asked.certificate ?? null;
+                session.proxy ??= await (0, rdcleanpath_1.startRDCleanPathProxy)(() => target.openTcp(asked.host, asked.port), fingerprint => this.checkCertificate(session, fingerprint), m => session.log.push(m), { autologon: spec.kind === 'xrdp' });
+                const outcome = await this.run(pane, target, spec, session, rdp, asked);
+                if (outcome.certificate && alive()) {
+                    // A changed certificate, now trusted: the same account again, without asking for it again.
+                    if (await this.refusedCertificate(pane, target, spec, session, asked, outcome.certificate)) {
+                        continue;
+                    }
+                    return;
+                }
+                if (outcome.signInFailed && this.signsIn(spec) && attempt < 5 && alive()) {
                     await (0, signin_1.forgetCredentials)(session.key);
                     retryError = outcome.signInFailed;
+                    endpoint = null;
                     continue;
                 }
+                if (spec.wake && !outcome.connected && !outcome.signInFailed && alive()) {
+                    if (woken && startupRetries < 3) {
+                        startupRetries++;
+                        session.log.push(`wake: not taking connections yet: ${outcome.error ?? outcome.reason ?? 'unknown error'}`);
+                        session.status(`${spec.name} is still starting…`);
+                        await this.zone.runOutsideAngular(() => new Promise(resolve => setTimeout(resolve, 5000)));
+                        continue;
+                    }
+                    // It answered before, but not now: it may have been shut down since.
+                    if (!woken && !automatic) {
+                        const woke = await this.wakeIfDown(pane, target, spec, session, false);
+                        if (woke === null) {
+                            return;
+                        }
+                        if (woke) {
+                            woken = true;
+                            continue;
+                        }
+                    }
+                }
                 if (alive()) {
                     this.afterEnd(pane, target, spec, session, outcome);
                 }
@@ -736,13 +1487,153 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
         }
     }
+    /**
+     * The proxy's check of the server's certificate, before any credentials go out. The host's own desktop must show
+     * the certificate its setup reported. Others (behind a host, a Windows host's own, a remote desktop tab's) are
+     * trusted on first use: remembered silently the first time (most connections already run inside SSH, and a prompt
+     * on every new desktop would only teach clicking it away), and refused when it changes, until the new one is
+     * trusted (see refusedCertificate). Remembered by session key, like saved accounts.
+     */
+    checkCertificate(session, fingerprint) {
+        session.certificateProblem = null;
+        // The host's own GNOME desktop; its own xrdp makes its certificate itself, so that one is trusted on first use.
+        if (session.spec.id === desktops_1.OWN_DESKTOP && session.spec.kind === 'gnome') {
+            const expected = session.pinnedCertificate ?? '';
+            if (fingerprint !== expected) {
+                session.certificateProblem = { expected, actual: fingerprint, pinned: true };
+                throw new Error(`certificate SHA-256 ${fingerprint} is not the one set up (${expected || 'none'})`);
+            }
+            session.log.push(`certificate: SHA-256 ${fingerprint}, as set up`);
+            return;
+        }
+        const known = this.trustedCertificate(session.key);
+        if (!known) {
+            this.trustCertificate(session.key, fingerprint);
+            session.log.push(`certificate: SHA-256 ${fingerprint}, remembered (first connection)`);
+            return;
+        }
+        if (fingerprint !== known) {
+            session.certificateProblem = { expected: known, actual: fingerprint, pinned: false };
+            throw new Error(`certificate SHA-256 ${fingerprint} is not the one remembered (${known})`);
+        }
+        session.log.push(`certificate: SHA-256 ${fingerprint}, as remembered`);
+    }
+    /**
+     * After the proxy refused a certificate; nothing was sent to that server. The host's own desktop: an error, since
+     * the plugin made that certificate itself. Others: both fingerprints, to trust the new certificate or not. Either
+     * way, automatic reconnecting stops here. Resolves true to connect again (the new certificate is then trusted).
+     */
+    async refusedCertificate(pane, target, spec, session, endpoint, problem) {
+        this.cancelReconnect(pane);
+        const alive = () => this.sessions.get(pane) === session;
+        const stop = (message) => {
+            session.state = 'ended';
+            this.changed$.next();
+            session.status(message, [{ label: 'Try again', run: () => this.reopen(pane, spec) }], true);
+        };
+        const fingerprints = `${problem.pinned ? 'Expected' : 'Remembered'} (SHA-256):\n${showFingerprint(problem.expected)}\n\nNow:\n${showFingerprint(problem.actual)}`;
+        if (problem.pinned) {
+            stop(`The remote desktop on ${target.label} answered with a certificate other than the one set up for it. ` +
+                `The connection was stopped before signing in.\n\n${fingerprints}\n\n` +
+                `Something other than GNOME Remote Desktop may be listening on port ${endpoint.port}.`);
+            return false;
+        }
+        if (!session.visible) {
+            this.notifications.notice(`The certificate of ${spec.name}${target.direct ? '' : ` (via ${target.label})`} has changed. Open that desktop to decide.`);
+        }
+        const trusted = await new Promise(resolve => {
+            session.status(`The certificate of ${spec.name} has changed since it was last used. Nothing has been sent to it.\n\n` +
+                `${fingerprints}\n\nReinstalling the machine or renewing its certificate changes it. If neither happened, ` +
+                `something else may be answering at ${spec.host}:${spec.port}.`, [
+                { label: 'Trust the new certificate', run: () => resolve(true) },
+                { label: 'Cancel', run: () => resolve(false) },
+            ], true);
+            session.disposed.then(() => resolve(false));
+        });
+        if (!alive()) {
+            return false;
+        }
+        if (!trusted) {
+            stop('Not connected: the new certificate was not trusted.');
+            return false;
+        }
+        this.trustCertificate(session.key, problem.actual);
+        session.log.push(`certificate: SHA-256 ${problem.actual}, trusted instead of ${problem.expected}`);
+        return true;
+    }
+    /** The certificate remembered for a desktop behind a host (`remoteDesktop.trustedCertificates`), if any. */
+    trustedCertificate(key) {
+        const list = this.config.store.remoteDesktop?.trustedCertificates;
+        const value = (Array.isArray(list) ? list : []).find((e) => e?.desktop === key)?.sha256;
+        return typeof value === 'string' ? (0, rdcleanpath_1.normalizeFingerprint)(value) || null : null;
+    }
+    trustCertificate(key, fingerprint) {
+        const store = this.config.store.remoteDesktop;
+        const others = (Array.isArray(store.trustedCertificates) ? store.trustedCertificates : []).filter((e) => e?.desktop !== key);
+        store.trustedCertificates = [...others, { desktop: key, sha256: fingerprint }];
+        this.config.save();
+    }
+    /**
+     * Forgets the certificates remembered for a desktop behind any SSH host (keys ending in `#<id>`, not a direct
+     * one's `rdp#<id>`), or with `direct`, for that direct desktop; doesn't save.
+     */
+    forgetCertificatesFor(desktopId, direct = false) {
+        const store = this.config.store.remoteDesktop;
+        const list = Array.isArray(store.trustedCertificates) ? store.trustedCertificates : [];
+        const forget = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${desktopId}` : key.endsWith(`#${desktopId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
+        store.trustedCertificates = list.filter((e) => !forget(String(e?.desktop ?? '')));
+    }
+    /**
+     * For a desktop with `wake`: when its RDP server doesn't answer (probed from the SSH host), starts it and waits
+     * until it does. True when it had to be started, false when it was up, null when the wait was cancelled (the layer
+     * says so). Throws when it couldn't be started, didn't come up in time, or is down during an automatic reconnect.
+     */
+    async wakeIfDown(pane, target, spec, session, automatic) {
+        const alive = () => this.sessions.get(pane) === session;
+        session.status(`Connecting to ${spec.name} via ${target.label}…`);
+        if (await (0, wake_1.rdpAnswers)(target, spec.host, spec.port)) {
+            return false;
+        }
+        if (!alive()) {
+            return null;
+        }
+        if (automatic) {
+            throw new Error(`${spec.name} doesn't answer; it may have been shut down`);
+        }
+        session.status(`Starting ${spec.name}…`);
+        session.log.push(`wake: ${await (0, wake_1.wakeDesktop)(target, spec.wake)}`);
+        let cancelled = false;
+        const cancel = {
+            label: 'Cancel',
+            run: () => {
+                cancelled = true;
+                session.state = 'ended';
+                this.changed$.next();
+                this.cancelReconnect(pane);
+                session.status(`Stopped waiting for ${spec.name}.`, [{ label: 'Try again', run: () => this.reopen(pane, spec) }]);
+            },
+        };
+        const started = Date.now();
+        const progress = () => session.status(`Starting ${spec.name}…\nWaiting for it to answer: ${Math.round((Date.now() - started) / 1000)} s`, [cancel]);
+        progress();
+        const up = await this.zone.runOutsideAngular(() => (0, wake_1.waitForRdp)(target, spec.host, spec.port, WAKE_TIMEOUT_MS, () => cancelled || !alive(), progress));
+        if (up) {
+            session.log.push(`wake: answered after ${Math.round((Date.now() - started) / 1000)} s`);
+            return true;
+        }
+        if (cancelled || !alive()) {
+            return null;
+        }
+        throw new Error(`${spec.name} didn't answer within ${WAKE_TIMEOUT_MS / 60000} minutes of starting it`);
+    }
     /** One RDP connection attempt, until it ends. */
     async run(pane, target, spec, session, rdp, endpoint) {
         const credentials = endpoint.credentials;
         const alive = () => this.sessions.get(pane) === session;
+        session.certificateProblem = null;
         const el = document.createElement('iron-remote-desktop');
         try {
-            el.setAttribute('scale', 'fit');
+            el.setAttribute('scale', this.screenScale() === 3 ? 'real' : 'fit');
             el.setAttribute('flexcenter', 'true');
             el.module = rdp.Backend;
             const ready = new Promise(resolve => el.addEventListener('ready', (e) => resolve(e.detail.irgUserInteraction), { once: true }));
@@ -767,33 +1658,62 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             const { width, height } = size;
             // DOMAIN\user or user@domain go to the server as typed; only the former needs splitting.
             const [domain, username] = /^([^\\]+)\\(.+)$/.exec(credentials.username)?.slice(1) ?? [spec.domain ?? '', credentials.username];
-            session.status(spec.id === desktops_1.OWN_DESKTOP ? `Connecting to ${target.label}…` : `Connecting to ${spec.name} via ${target.label}…`);
+            session.status(spec.id === desktops_1.OWN_DESKTOP ? `Connecting to ${target.label}…`
+                : target.direct ? `Connecting to ${spec.name}…` : `Connecting to ${spec.name} via ${target.label}…`);
             const config = session.ui.configBuilder()
                 .withUsername(username)
                 .withPassword(credentials.password)
-                .withDestination(`${spec.id === desktops_1.OWN_DESKTOP ? target.label : endpoint.host}:${endpoint.port}`)
+                .withDestination(`${spec.id === desktops_1.OWN_DESKTOP ? target.hostname ?? target.label : endpoint.host}:${endpoint.port}`)
                 .withProxyAddress(session.proxy.url)
                 .withServerDomain(domain)
                 .withAuthToken(session.proxy.token)
                 .withDesktopSize({ width, height })
                 // Display control lets the remote monitor follow the pane (live resize, remote scaling).
                 .withExtension(rdp.displayControl(true));
-            // GNOME Remote Desktop requires the graphics pipeline; Windows does better with bitmaps (IronRDP decodes
-            // EGFX without H.264, which Windows would want). A build without the switch decides by itself.
+            // H.264 in the graphics pipeline, decoded by the browser (hardware-accelerated where it can be). A decoder
+            // failure ends the connection, which then reconnects without H.264 (see below). Not for xrdp: it encodes
+            // H.264 only in some builds, and without it bitmaps do better there than the pipeline.
+            session.h264?.close();
+            session.h264 = null;
+            if (spec.kind !== 'xrdp' && typeof rdp.graphicsPipeline === 'function' && await this.useH264(rdp, session, settings)) {
+                session.h264 = new rdp.WebCodecsH264Decoder({ onFailure: (reason) => session.log.push(`h264: failed: ${reason}`) });
+                config.withExtension(rdp.h264Decoder(session.h264));
+            }
+            // GNOME Remote Desktop requires the graphics pipeline. Windows (and xrdp) do better with bitmaps than with
+            // the pipeline without H.264; with H.264, Windows streams what changes a lot (video) as video. A build
+            // without the switch decides by itself.
             if (typeof rdp.graphicsPipeline === 'function') {
-                config.withExtension(rdp.graphicsPipeline(spec.kind === 'gnome'));
+                const pipeline = spec.kind === 'gnome' || !!session.h264;
+                config.withExtension(rdp.graphicsPipeline(pipeline));
+                session.graphics = pipeline ? `graphics pipeline${session.h264 ? ' with H.264' : ''}` : 'bitmaps';
+            }
+            else {
+                session.graphics = 'automatic graphics';
             }
+            session.log.push(`graphics: ${session.graphics}`);
             if (settings.sound) {
                 session.audio?.close();
                 session.audio = new audio_1.AudioPlayer();
                 config.withExtension(rdp.audioPlayback(session.audio.callback));
             }
+            session.mic?.close();
+            session.mic = null;
+            if (settings.microphone && typeof rdp.audioInput === 'function') {
+                const ui = session.ui;
+                const mic = new microphone_1.Microphone(pcm => ui.invokeExtension(rdp.audioInputData(pcm)), () => session.overlay.classList.toggle('trd-mic-on', mic.capturing), m => session.log.push(m), m => this.zone.run(() => this.notifications.error(m)));
+                session.mic = mic;
+                config.withExtension(rdp.audioInput(mic.callback));
+            }
             const built = config.build();
             let info;
             try {
                 info = await session.ui.connect(built);
             }
             catch (e) {
+                // The proxy refused the server's certificate, before CredSSP (see checkCertificate).
+                if (session.certificateProblem) {
+                    return { connected: false, certificate: session.certificateProblem };
+                }
                 // IronErrorKind: 1 WrongPassword, 2 LogonFailure.
                 const kind = typeof e?.kind === 'function' ? e.kind() : undefined;
                 const detail = typeof e?.backtrace === 'function' ? e.backtrace() : (e?.message ?? String(e));
@@ -801,7 +1721,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     session.log.push(`sign-in failed: ${detail.split('\n')[0]}`);
                     return { connected: false, signInFailed: kind === 1 ? 'Wrong user name or password.' : 'The sign-in was refused.' };
                 }
-                throw new Error(detail);
+                throw new Error(session.proxy?.failure ?? detail);
             }
             if (!alive()) {
                 return { connected: false };
@@ -815,7 +1735,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
             this.watchSize(pane, session);
             session.state = 'connected';
+            session.log.push(`connected: ${width}x${height}`);
             session.status('');
+            this.tip(pane, session);
+            this.label(pane, session);
+            this.syncIndicator(session);
             this.changed$.next();
             this.reconnects.delete(pane); // connected again: a later drop starts over
             if (endpoint.remember) {
@@ -829,8 +1753,21 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 end = await info.run();
             }
             catch (e) {
+                if (session.h264?.failed) {
+                    // Reconnects (automatically, like any dropped connection) without H.264, unless the browser only
+                    // took an idle decoder back (a hidden window): then with it, as a new stream starts with a key frame.
+                    if (session.h264.reclaimed) {
+                        return { connected: true, error: 'the video decoder was reclaimed' };
+                    }
+                    this.h264Failed.add(session.key);
+                    return { connected: true, error: `H.264 decoding failed (${session.h264.failed}); continuing without it` };
+                }
                 return { connected: true, error: typeof e?.backtrace === 'function' ? e.backtrace().split('\n')[0] : (e?.message ?? String(e)) };
             }
+            finally {
+                // The server can't close the microphone once the connection is gone.
+                session.mic?.close();
+            }
             return { connected: true, reason: end?.reason?.() };
         }
         catch (e) {
@@ -846,7 +1783,11 @@ exports.RemoteDesktopService = RemoteDesktopService = RemoteDesktopService_1 = _
         targets_1.RemoteTargets,
         tabby_core_1.NotificationsService,
         tabby_core_1.ConfigService,
-        core_1.NgZone])
+        core_1.NgZone,
+        tabby_core_1.ProfilesService,
+        help_1.RemoteDesktopHelp,
+        tabby_core_1.SelectorService,
+        tabby_core_1.PlatformService])
 ], RemoteDesktopService);
 let styleInstalled = false;
 function installStyle() {
@@ -855,7 +1796,7 @@ function installStyle() {
     }
     styleInstalled = true;
     const style = document.createElement('style');
-    style.textContent = STYLE + signin_1.STYLE + fileTransfer_1.STYLE;
+    style.textContent = STYLE + signin_1.STYLE + fileTransfer_1.STYLE + connectionStatus_1.STYLE + osd_1.OSD_STYLE;
     document.head.appendChild(style);
 }
 //# sourceMappingURL=desktop.service.js.map