tabby-rdp 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 0.3.3
+
+**Fixed**
+- **H.264 video from a hostile remote desktop:** the server picks which parts of a video frame the plugin reads back
+  from the browser's decoder, and nothing limited how much. One region larger than the picture, or many overlapping
+  copies of the whole screen, could make it allocate enough memory to crash Tabby along with every tab in it. What a
+  frame reads back is now bounded by the screen it draws on (overlapping regions are read once, as the box around
+  them), and a frame that would still need more than 256 MiB is decoded without reading anything back (IronRDP
+  patch 8). H.264 is on by default, so this applies wherever the browser decodes the video.
+
+**Docs**
+- The README's table of upstream IronRDP changes lists the keyboard API (#2026), says the Progressive decoding fix is
+  covered by IronRDP #2010 and #1977, and says what each patch not submitted yet waits for.
+
+## 0.3.2
+
+**New**
+- **Shut down VMs it started:** a VM the plugin started to open its desktop can go back off after 5 minutes, 15 or an
+  hour with no desktop open (a setting; never, by default). A watcher on the SSH host sees to it, so it also works after
+  the tab is closed or Tabby has quit.
+
+- **A GNOME desktop that's open elsewhere** (another computer, or another Tabby window): opening it asks whether to
+  take it over, as Windows does (the other connection is disconnected; the session and its apps carry on), or to open
+  a second screen, which is what happened before. A desktop taken over doesn't take itself back.
+
+**Better**
+- **The headless GNOME session** runs X11 apps (through XWayland), and GNOME's settings daemons for keyboard, media
+  keys and custom shortcuts, accessibility and sound; not power, so it never suspends the machine. A session that's
+  already running gets them on the next connect, without closing its apps.
+
+**Fixed**
+- **A blank desktop after reconnecting** (GNOME): when the server sent the end of the connection sequence and the start
+  of the graphics channel together, IronRDP lost the latter and the desktop stayed transparent. The proxy now hands it
+  each server message on its own.
+- **The clipboard with several desktops open:** closing one desktop stopped the automatic clipboard for the others,
+  and a desktop in the background could overwrite what was copied on another. The desktop with the focus syncs the
+  clipboard; copies made on another reach the Mac when it gets the focus (IronRDP patches 12 and 13).
+- IronRDP patch 14, meant for upstream: H.264 pictures read correctly in Safari, whose `copyTo` ignores the RGBA format.
+- A closed desktop no longer leaves its pane's subscription and its label timer behind.
+- The first-connect tip shows the desktop/console hotkey as text: a label from the config could carry markup into
+  the page.
+
+**Docs**
+- The limitation about Win+R from macOS is gone: ⌃⌘ with a key has been the Windows key with it since 0.3.0.
+
 ## 0.3.1
 
 **New**

package/README.md

@@ -247,6 +247,13 @@ console on the host, [above](#use)). A VM found this way asks for its account th
 desktop; **Save \<name\> to this host's desktops** in its menu keeps it, for a name of your own and other settings.
 **Settings › Remote Desktop › Find virtual machines on SSH hosts** turns this off.
 
+A VM the plugin started can go back off by itself: **Settings › Remote Desktop › Shut down VMs it started** (5
+minutes, 15 or an hour without a desktop open; never, by default). A small watcher on the SSH host sees to it, so it
+also works once the tab is closed or Tabby has quit: after that long with no connection to the VM's desktop through the
+host, it asks the VM to shut down (`virsh shutdown`, with a key press first, since Windows ignores the request while its
+screen sleeps), then ends. VMs that were already running are never touched, and neither are machines woken over the
+network.
+
 ## desk: the console on the desktop
 
 Type `desk` in an SSH console, and the tab switches to that machine's desktop with a terminal attached to the very same
@@ -281,6 +288,7 @@ They are stored in Tabby's config under `remoteDesktop`:
 | Bring the console along with `desk` (`desk`) | Off | Installs `desk` and a login line on each machine you open a desktop on; applies on the next connection there. |
 | Session backend (`sessionBackend`) | `native` | For `desk`: `native` (trd-pty) or `tmux`. Config file only. |
 | Find virtual machines on SSH hosts (`discoverVMs`) | On | Lists a host's libvirt VMs with a desktop in its menu ([VMs on a host](#vms-on-a-host)). |
+| Shut down VMs it started (`shutDownIdle`) | Never | 5, 15 or 60: minutes without a desktop open after which a VM the plugin started is shut down again ([VMs on a host](#vms-on-a-host)). |
 | Tell me about new versions (`checkUpdates`) | On | Once a day, asks npm for the latest tabby-rdp (nothing else is sent), and says so in a note, the menus and the settings page when there's a newer one: Tabby itself shows plugin upgrades only on its Plugins page. |
 | Desktop name overlay (`osd`) | When it helps | `show` (`auto`, `always`, `off`), `font`, `size`, `position`, `color` (empty: white) and `seconds`; the settings page previews it. |
 
@@ -320,9 +328,12 @@ tabby-rdp ships IronRDP with a short series of patches ([ironrdp/](ironrdp)). Th
 | Echo the correct size in the sound channel's Training Confirm | [Devolutions/IronRDP#2019](https://github.com/Devolutions/IronRDP/pull/2019) |
 | The graphics pipeline in the web client, following its resets | Covered by [Devolutions/IronRDP#1977](https://github.com/Devolutions/IronRDP/pull/1977) (not ours; [tested with GNOME](https://github.com/Devolutions/IronRDP/pull/1977#issuecomment-5851624036)) |
 | Sound in the web client | [Devolutions/IronRDP#2020](https://github.com/Devolutions/IronRDP/pull/2020) |
-| H.264 in the web client, decoded by the browser (WebCodecs) | Not submitted yet |
-| Decode Windows' RemoteFX Progressive refinements | Not submitted yet |
-| Microphone in the web client | Not submitted yet |
+| Let the host send key events to a session | [Devolutions/IronRDP#2026](https://github.com/Devolutions/IronRDP/pull/2026) (design under discussion) |
+| Decode Windows' RemoteFX Progressive refinements | Covered by [Devolutions/IronRDP#2010](https://github.com/Devolutions/IronRDP/pull/2010) and [#1977](https://github.com/Devolutions/IronRDP/pull/1977) (not ours) |
+| H.264 in the web client, decoded by the browser (WebCodecs) | Not submitted yet: waits for #1977 |
+| Microphone in the web client | Not submitted yet: waits for #2020 |
+| Keep clipboard sync working for the other desktops when one closes | Not submitted yet |
+| Sync the clipboard only for the desktop that has the focus | Not submitted yet |
 
 The aim is to make IronRDP's browser client work well with both Linux and Windows desktops, for everyone who embeds
 it, not just this plugin.
@@ -345,17 +356,19 @@ npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches:
 
 ## Limitations
 
-- **One client per account on GNOME.** A second client (another machine, or another Tabby window) gets an extra,
-  empty monitor instead of the same screen, which is how GNOME Remote Desktop's headless mode works.
-- **The headless GNOME session is a shell without `gnome-session`:** apps work (Settings, Files, Terminal, Firefox), but
-  GNOME's background settings daemons don't run, and X11-only apps don't start.
+- **One screen per connection on GNOME.** GNOME Remote Desktop's headless mode can't show the same screen to two
+  clients (another computer, or another Tabby window): a second one gets an extra, empty screen. Opening a desktop
+  that's open elsewhere asks whether to take it over (the other connection is disconnected, as on Windows; the session
+  and its apps carry on) or to open a second screen.
+- **The headless GNOME session is a shell without `gnome-session`.** Apps work, X11 ones too (through XWayland), and so
+  do GNOME's settings daemons for keyboard, media keys and custom shortcuts, accessibility and sound. The ones for
+  power, sharing and local hardware don't run, so the session never suspends or blanks the machine.
 - **GNOME's login-screen mode** isn't supported: it hands clients over with a server redirection, which IronRDP can't
   follow yet. The plugin uses per-user headless sessions instead.
 - **Remembering a Windows password on Linux** needs an unlocked keyring (GNOME Keyring or KWallet), as it does for
   Tabby's own passwords. Without one, the plugin asks each time.
 - **GNOME Remote Desktop listens on all interfaces** (password-protected, TLS); it has no setting to listen on
   loopback only. See [docs/architecture.md](docs/architecture.md#security-notes) to restrict it.
-- **Windows-key combinations** such as Win+R don't come through from macOS. Tapping ⌘ for the Windows key does.
 - **The microphone** needs the system's permission: macOS asks the first time a remote app records (if it was denied,
   allow Tabby in System Settings › Privacy & Security › Microphone, then restart Tabby), and Windows needs "Let desktop
   apps access your microphone". On GNOME, apps record from GNOME Remote Desktop's "Remoteaudio Source", which is the
@@ -371,7 +384,8 @@ npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches:
   far as that xrdp version supports them), sound through the PipeWire or PulseAudio module. Live resize needs xrdp
   0.10 or newer; with 0.9 (Ubuntu 24.04), the desktop keeps its size, scaled to fit, or choose **Reconnect at the new
   size**. xrdp's standard RDP security without TLS (`security_layer=rdp`) isn't supported. `desk` needs GNOME.
-- **Waking a desktop** starts it but never shuts it down again; that is up to you (or the VM's own settings).
+- **Waking a desktop** over the network (Wake-on-LAN) starts it but never shuts it down again; for VMs, see
+  [Shut down VMs it started](#vms-on-a-host).
 
 ## License
 

package/dist/desktop.service.js

@@ -277,6 +277,7 @@ class DesktopSession {
     dispose() {
         this.markDisposed();
         this.setVisible(false);
+        clearTimeout(this.labelTimer);
         this.container.removeEventListener('focusin', this.reclaimFocus, true);
         this.disposers.forEach(f => f());
         this.indicator?.dispose();
@@ -328,6 +329,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.reconnects = new Map();
         /** Split tabs where keys typed on one desktop go to all of them (see DesktopKeyboard). */
         this.broadcast = new WeakSet();
+        /** How the pane's next connection to a GNOME desktop that's open elsewhere goes, when that was chosen already. */
+        this.openChoices = new Map();
+        /** Each pane's name for itself on hosts, for the note a take-over leaves there (see prepareRemoteDesktop). */
+        this.clients = new WeakMap();
     }
     /**
      * The remote a desktop opened in the pane now is on: the pane's own, or in an SSH tab where `ssh` was typed at
@@ -719,7 +724,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
             session = created;
             this.sessions.set(pane, created);
-            pane.destroyed$.subscribe(() => this.disconnect(pane));
+            // Released with the session: a pane outlives the desktops opened and closed in it.
+            const destroyed = pane.destroyed$.subscribe(() => this.disconnect(pane));
+            created.onDispose(() => destroyed.unsubscribe());
             // Tabby focuses the terminal when the pane gets focus (tab switch, split focus); take it back.
             const focused = pane.focused$.subscribe(() => {
                 if (created.visible) {
@@ -908,7 +915,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
     }
     scheduleReconnect(pane, target, spec, session, message) {
-        const state = this.reconnects.get(pane) ?? { attempts: 0 };
+        // since: when the desktop dropped (see openElsewhere).
+        const state = this.reconnects.get(pane) ?? { attempts: 0, since: Date.now() };
         this.reconnects.set(pane, state);
         clearTimeout(state.timer);
         const current = () => this.sessions.get(pane) === session;
@@ -955,6 +963,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             osd: (0, osd_1.osdSettings)(store.osd),
             discoverVMs: store.discoverVMs !== false,
             checkUpdates: store.checkUpdates !== false,
+            shutDownIdle: [5, 15, 60].includes(Number(store.shutDownIdle)) ? Number(store.shutDownIdle) : 0,
         };
     }
     /** The sharpness chosen for the pane's desktop in particular (`remoteDesktop.desktopSharpness`), or null. */
@@ -1371,11 +1380,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * it finds xrdp or Windows instead of GNOME, as below. Others: the saved account, or the sign-in form (retryError: after a
      * failed sign-in).
      */
-    async endpointFor(target, spec, session, retryError) {
+    async endpointFor(pane, target, spec, session, automatic, retryError) {
         // A Windows host is known from an earlier connect: no setup to run there (it would only fail again).
         if (spec.id === desktops_1.OWN_DESKTOP && !retryError && this.ownDesktops.get(target.key)?.kind !== 'windows') {
             session.status(`Preparing the remote desktop on ${target.label}…`);
-            const endpoint = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend);
+            const endpoint = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend, this.clientOf(pane));
             this.ownDesktops.set(target.key, { kind: endpoint.kind, xrdpPort: endpoint.xrdpPort, xrdpUser: endpoint.xrdpUser });
             // Only the setup knows which desktop the host has; the session follows it (graphics, sign-in, resizing).
             spec.kind = endpoint.kind;
@@ -1383,7 +1392,29 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 session.log.push('setup: the SSH host runs Windows; its own desktop is its RDP server');
             }
             if (endpoint.kind === 'gnome') {
-                return { host: '127.0.0.1', port: endpoint.port, credentials: { username: endpoint.username, password: endpoint.password }, remember: false, certificate: endpoint.certificate };
+                let gnome = endpoint;
+                const chosen = this.openChoices.get(pane);
+                this.openChoices.delete(pane);
+                // An automatic reconnect also gives way to a take-over whose connection isn't up yet: one that happened
+                // when this desktop dropped (the host says how long ago, so the clocks needn't agree).
+                const dropped = this.reconnects.get(pane)?.since;
+                const displaced = automatic && gnome.takenOver !== undefined && dropped !== undefined &&
+                    Math.abs(gnome.takenOver - (Date.now() - dropped) / 1000) < 10;
+                if (gnome.clients || displaced) {
+                    const choice = chosen ?? await this.openElsewhere(pane, target, spec, session, automatic);
+                    if (!choice) {
+                        return 'stopped';
+                    }
+                    if (choice === 'take') {
+                        session.status(`Taking over the desktop on ${target.label}…`);
+                        gnome = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend, this.clientOf(pane), true);
+                        session.log.push(`setup: took the desktop over (${endpoint.clients} other connection(s))`);
+                    }
+                    else {
+                        session.log.push(`setup: a screen of its own, besides ${endpoint.clients} other connection(s)`);
+                    }
+                }
+                return { host: '127.0.0.1', port: gnome.port, credentials: { username: gnome.username, password: gnome.password }, remember: false, certificate: gnome.certificate };
             }
             spec.host = '127.0.0.1';
             spec.port = endpoint.port;
@@ -1426,10 +1457,17 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
             // Signing in to a Windows account can take a few tries; a GNOME desktop the plugin set up can't fail that way.
             for (let attempt = 0;; attempt++) {
-                const [asked, rdp] = await Promise.all([endpoint ?? this.endpointFor(target, spec, session, retryError), this.loadIronRDP()]);
+                const [asked, rdp] = await Promise.all([endpoint ?? this.endpointFor(pane, target, spec, session, automatic, retryError), this.loadIronRDP()]);
                 if (!alive()) {
                     return;
                 }
+                if (asked === 'stopped') {
+                    // Not connecting: the reason and what to do instead are on the layer already.
+                    session.state = 'ended';
+                    this.changed$.next();
+                    this.cancelReconnect(pane);
+                    return;
+                }
                 if (!asked) {
                     session.state = 'ended';
                     this.changed$.next();
@@ -1518,6 +1556,49 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         session.log.push(`certificate: SHA-256 ${fingerprint}, as remembered`);
     }
+    clientOf(pane) {
+        let id = this.clients.get(pane);
+        if (!id) {
+            id = Math.random().toString(36).slice(2, 12);
+            this.clients.set(pane, id);
+        }
+        return id;
+    }
+    /**
+     * The host's GNOME desktop has RDP clients already (another Tabby window or computer), and GNOME gives each its own
+     * screen. Opened by hand: asks whether to take it over (disconnecting them, as Windows does), or to add a screen.
+     * An automatic reconnect doesn't ask, nor take it back: this connection gave way to the other, most likely by being
+     * taken over from there, and taking it back by itself would have the two take turns. Resolves with the choice, or
+     * null when not connecting (the layer then says so and offers the choices again).
+     */
+    async openElsewhere(pane, target, spec, session, automatic) {
+        const again = (choice) => () => {
+            this.openChoices.set(pane, choice);
+            this.reopen(pane, spec);
+        };
+        const stopped = (message) => {
+            session.status(message, [
+                { label: automatic ? 'Take it back' : 'Take it over', run: again('take') },
+                { label: 'Open a second screen', run: again('second') },
+            ], true);
+            return null;
+        };
+        if (automatic) {
+            if (!session.visible) {
+                this.notifications.notice(`The desktop on ${target.label} was opened somewhere else`);
+            }
+            return stopped(`The desktop on ${target.label} was opened somewhere else (another Tabby window or computer), and this connection gave way to it.`);
+        }
+        const choice = await new Promise(resolve => {
+            session.status(`The desktop on ${target.label} is open somewhere else too (another Tabby window or computer). GNOME gives each connection a screen of its own, so this one would get a second, empty screen.`, [
+                { label: 'Take it over', run: () => resolve('take') },
+                { label: 'Open a second screen', run: () => resolve('second') },
+                { label: 'Cancel', run: () => resolve(null) },
+            ], true);
+            session.disposed.then(() => resolve(null));
+        });
+        return choice ?? stopped(`Not opened: the desktop on ${target.label} is open somewhere else (another Tabby window or computer).`);
+    }
     /**
      * After the proxy refused a certificate; nothing was sent to that server. The host's own desktop: an error, since
      * the plugin made that certificate itself. Others: both fingerprints, to trust the new certificate or not. Either
@@ -1619,6 +1700,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const up = await this.zone.runOutsideAngular(() => (0, wake_1.waitForRdp)(target, spec.host, spec.port, WAKE_TIMEOUT_MS, () => cancelled || !alive(), progress));
         if (up) {
             session.log.push(`wake: answered after ${Math.round((Date.now() - started) / 1000)} s`);
+            // Started here, so it can go back off when it's no longer used, if the settings say so (a VM only: a machine
+            // woken over the network would need rights on it).
+            const idle = this.settings().shutDownIdle;
+            if (idle > 0 && 'vm' in spec.wake) {
+                (0, wake_1.shutDownWhenIdle)(target, spec.wake.vm, spec.host, spec.port, idle * 60)
+                    .then(done => session.log.push(`wake: ${done}`), e => session.log.push(`wake: no automatic shutdown: ${e?.message ?? e}`));
+            }
             return true;
         }
         if (cancelled || !alive()) {