tabby-rdp 0.4.0 → 0.5.0

package/dist/desktop.service.js

@@ -24,6 +24,7 @@ const deskScript_1 = require("./deskScript");
 const audio_1 = require("./audio");
 const connectionStatus_1 = require("./connectionStatus");
 const microphone_1 = require("./microphone");
+const drives_1 = require("./drives");
 const desktopForm_1 = require("./desktopForm");
 const accounts_1 = require("./accounts");
 const accountForm_1 = require("./accountForm");
@@ -37,6 +38,8 @@ const rdcleanpath_1 = require("./rdcleanpath");
 const signin_1 = require("./signin");
 const ssh_1 = require("./ssh");
 const wake_1 = require("./wake");
+const hyperv_1 = require("./hyperv");
+const gateway_1 = require("./gateway");
 const vms_1 = require("./vms");
 /** How long a desktop that was started (`wake`) gets to answer. */
 const WAKE_TIMEOUT_MS = 3 * 60 * 1000;
@@ -139,6 +142,13 @@ function remoteSizeFor(rect, settings) {
     };
 }
 class DesktopSession {
+    /**
+     * What a sign-in and a certificate are remembered under: the desktop; for a Hyper-V VM, its host, whose account
+     * and certificate they are, the same for all of its VMs.
+     */
+    get authKey() {
+        return this.spec.hyperv ? this.key.replace(/#hyperv:[^#]*$/, '#hyperv') : this.key;
+    }
     /** `key`: see sessionKey(); one desktop per key. */
     constructor(container, key, spec) {
         this.key = key;
@@ -157,6 +167,8 @@ class DesktopSession {
         this.mic = null;
         /** Files through the clipboard (drop on the desktop, or copy on the remote). */
         this.files = null;
+        /** The shared folders as drives on the remote (see drives.ts), when there were any at connect. */
+        this.drives = null;
         /** Decodes H.264 for the graphics pipeline (IronRDP's WebCodecsH264Decoder), when this connection uses it. */
         this.h264 = null;
         /** No keyboard or mouse input goes to the remote (keys: see keyboard.ts; the mouse: a layer over the picture). */
@@ -165,12 +177,18 @@ class DesktopSession {
         this.pinnedCertificate = null;
         /** Set when the proxy refused the server's certificate on the current connection attempt. */
         this.certificateProblem = null;
+        /** Set when the desktop's RD Gateway refused the sign-in on the current connection attempt: what it said. */
+        this.gatewayRefused = null;
+        /** Set when the proxy stopped at a server without Network Level Authentication on the current connection attempt. */
+        this.withoutNla = false;
         /** The connection-status indicator, made the first time it shows. */
         this.indicator = null;
         /** How the pictures come (for the indicator): the graphics pipeline, bitmaps, or IronRDP's choice. */
         this.graphics = '';
         /** "What does this mean?" under a message (see status()): opens help about it. */
         this.onHelp = null;
+        /** Keys this desktop was sent and not yet let go of (by `code`): see RemoteDesktopService.broadcastKey. */
+        this.keysDown = new Map();
         this.reclaimFocus = (event) => {
             if (this.visible && !this.overlay.contains(event.target)) {
                 setTimeout(() => this.visible && this.focusDesktop());
@@ -204,6 +222,30 @@ class DesktopSession {
             this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('.screen-wrapper')?.scrollBy(wheel.deltaX, wheel.deltaY);
         }, { passive: true });
     }
+    /** Notes a key sent to this desktop as held, or let go. */
+    noteKey(type, init) {
+        if (type === 'keydown' && init.code) {
+            this.keysDown.set(init.code, init);
+        }
+        else if (type === 'keyup' && init.code) {
+            this.keysDown.delete(init.code);
+        }
+    }
+    /**
+     * Lets go of every key still held on this desktop. For when their keyups won't reach it: view only coming on, or
+     * typing into all going off, by a shortcut whose modifiers are down at that moment. They would stay down there.
+     */
+    releaseKeys() {
+        for (const [code, init] of [...this.keysDown]) {
+            this.keysDown.delete(code);
+            try {
+                this.ui?.sendKeyboardEvent(new KeyboardEvent('keyup', { key: init.key, code, location: init.location, cancelable: true }));
+            }
+            catch (e) {
+                this.log.push(`keys: ${code} not released: ${e?.message ?? e}`);
+            }
+        }
+    }
     setViewOnly(viewOnly) {
         this.viewOnly = viewOnly;
         this.overlay.classList.toggle('trd-view-only-on', viewOnly);
@@ -291,6 +333,7 @@ class DesktopSession {
         this.h264?.close();
         this.mic?.close();
         this.files?.dispose();
+        this.drives?.dispose();
         this.proxy?.close();
         this.overlay.remove();
     }
@@ -329,7 +372,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
          * with a wrong password it shows its own login window rather than refusing, so the form never comes back.
          */
         this.askAgain = new WeakSet();
-        /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops. */
+        /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops; and what the scans learnt of the host. */
         this.vms = new Map();
         this.lastUsed = new Map();
         /** Automatic reconnection after a desktop dropped, per pane: attempts so far and the pending timer. */
@@ -399,7 +442,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async signInAgain(pane) {
         const session = this.sessions.get(pane);
         if (session && this.signsIn(session.spec)) {
-            await (0, signin_1.forgetCredentials)(session.key);
+            await (0, signin_1.forgetCredentials)(session.authKey);
             // With a saved account, the form asks for its password anew (the saved one stays until then).
             this.askAgain.add(pane);
             await this.reopen(pane, session.spec);
@@ -413,9 +456,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (target.direct) {
             return [target.direct];
         }
+        // With their group's defaults (an account for the whole group), as Tabby resolves a profile when opening it.
         const viaProfile = target.profileId
             ? (this.config.store.profiles ?? []).filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && p.options?.host && p.options.via === target.profileId)
-                .map((p) => ({ ...p.options, name: p.name }))
+                .map((p) => ({ ...this.profiles.getConfigProxyForProfile(p).options, name: p.name }))
             : [];
         const specs = (0, desktops_1.desktopsFor)(target, this.config.store.remoteDesktop?.desktops, this.ownDesktops.get(target.key), viaProfile);
         // Found VMs come last, and not where a configured desktop has the same address.
@@ -437,13 +481,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (known && Date.now() - known.at < 60000) {
             return Promise.resolve();
         }
-        const scan = (0, vms_1.scanVMs)(target).then(found => {
-            this.vms.set(target.key, { at: Date.now(), specs: found.map(vms_1.vmSpec) });
+        const host = known?.host ?? { windows: this.ownDesktops.get(target.key)?.kind === 'windows' || undefined };
+        const scan = (0, vms_1.scanVMs)(target, host).then(found => {
+            this.vms.set(target.key, { at: Date.now(), specs: found.map(vms_1.vmSpec), host });
             this.changed$.next();
         }, () => {
-            this.vms.set(target.key, { at: Date.now(), specs: known?.specs ?? [] });
+            // Not asked, rather than nothing found (the connection wasn't up yet, say): the next look asks again.
+            this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], host });
         });
-        this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], scan });
+        this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], scan, host });
         return scan;
     }
     /** Keeps a found VM open in the pane among the host's desktops (`remoteDesktop.desktops`), under its name. */
@@ -453,7 +499,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (!session?.remote || !spec?.found) {
             return;
         }
-        const entry = { name: spec.name, via: session.remote.label, host: spec.host, port: spec.port, kind: spec.kind, ...spec.wake ? { wake: spec.wake } : {} };
+        const entry = spec.hyperv ? { name: spec.name, via: session.remote.label, hyperv: spec.hyperv }
+            : { name: spec.name, via: session.remote.label, host: spec.host, port: spec.port, kind: spec.kind, ...spec.wake ? { wake: spec.wake } : {} };
         this.config.store.remoteDesktop.desktops = [...this.configuredDesktops(), entry];
         this.config.save();
         this.changed$.next();
@@ -490,15 +537,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return (0, accounts_1.accountsOf)(this.config.store.remoteDesktop);
     }
     /**
-     * The desktops that sign in with a saved account: configured ones behind SSH hosts, and RDP profiles (their own
-     * choice, or their profile group's default when they make none). Each comes with what opens its editor.
+     * The desktops that sign in with a saved account, or sign in to their RD Gateway with it: configured ones behind
+     * SSH hosts, and RDP profiles (their own choice, or their profile group's default when they make none). Each comes
+     * with what opens its editor.
      */
     accountUses(id) {
-        const desktops = this.configuredDesktops().flatMap((d, i) => d.account === id ? [{ name: String(d.name ?? (0, desktops_1.desktopIdOf)(d)), desktopIndex: i }] : []);
+        const desktops = this.configuredDesktops().flatMap((d, i) => d.account === id || d.gatewayAccount === id ? [{ name: String(d.name ?? (0, desktops_1.desktopIdOf)(d)), desktopIndex: i }] : []);
         const groups = this.config.store.groups ?? [];
         const inherited = (p) => p.options?.account === undefined && groups.find(g => g.id === p.group)?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options?.account === id;
         const profiles = (this.config.store.profiles ?? [])
-            .filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && (p.options?.account === id || inherited(p)))
+            .filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && (p.options?.account === id || p.options?.gatewayAccount === id || inherited(p)))
             .map((p) => ({ name: String(p.name ?? p.options?.host ?? ''), profileId: p.id ? String(p.id) : undefined }));
         return [...desktops, ...profiles];
     }
@@ -516,16 +564,32 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             username: account.username.trim(),
             ...account.domain?.trim() ? { domain: account.domain.trim() } : {},
         };
-        this.config.store.remoteDesktop.accounts = old ? list.map(a => a === old ? entry : a) : [...list, entry];
-        this.config.save();
-        this.changed$.next();
+        // The password first: a new user name must not be written while the old password (for the old name) stays, nor
+        // a new password reported as saved when the store refused it.
         let keychainError;
         if (password !== undefined && password !== '') {
-            await (0, signin_1.saveCredentials)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }).catch(e => { keychainError = String(e?.message ?? e); });
+            await (0, signin_1.saveCredentials)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
         }
         else if (old && (0, accounts_1.signInName)(old) !== (0, accounts_1.signInName)(entry)) {
-            await (0, signin_1.forgetCredentials)((0, accounts_1.accountKey)(entry.id));
+            await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(entry.id)).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
         }
+        if (keychainError && !old) {
+            // Not added at all: a retry would otherwise make a second account.
+            return { id: entry.id, keychainError: `${keychainError}. The account wasn't added` };
+        }
+        if (keychainError && old && (0, accounts_1.signInName)(old) !== (0, accounts_1.signInName)(entry)) {
+            // The sign-in name stays as it was; the account's name can still change.
+            entry.username = old.username;
+            if (old.domain) {
+                entry.domain = old.domain;
+            }
+            else {
+                delete entry.domain;
+            }
+        }
+        this.config.store.remoteDesktop.accounts = old ? list.map(a => a === old ? entry : a) : [...list, entry];
+        await this.config.save();
+        this.changed$.next();
         return { id: entry.id, keychainError };
     }
     /** A desktop form's "New account…": saves it and hands it back for the form's list. */
@@ -567,12 +631,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async removeAccount(id) {
         const store = this.config.store.remoteDesktop;
         store.accounts = this.accounts().filter(a => a.id !== id);
-        if (this.configuredDesktops().some(d => d.account === id)) {
+        if (this.configuredDesktops().some(d => d.account === id || d.gatewayAccount === id)) {
             store.desktops = this.configuredDesktops().map(d => {
-                if (d.account !== id) {
-                    return d;
+                const rest = { ...d };
+                if (rest.account === id) {
+                    delete rest.account;
+                }
+                // A gateway that signed in with it takes the desktop's sign-in from now on.
+                if (rest.gatewayAccount === id) {
+                    delete rest.gatewayAccount;
                 }
-                const { account: _account, ...rest } = d;
                 return rest;
             });
         }
@@ -580,10 +648,20 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.account === id) {
                 profile.options.account = '';
             }
+            if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.gatewayAccount === id) {
+                profile.options.gatewayAccount = '';
+            }
         }
-        this.config.save();
+        // A profile group's default for remote desktop profiles, too.
+        for (const group of this.config.store.groups ?? []) {
+            const options = group?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options;
+            if (options?.account === id) {
+                options.account = '';
+            }
+        }
+        await this.config.save();
         this.changed$.next();
-        await (0, signin_1.forgetCredentials)((0, accounts_1.accountKey)(id));
+        await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(id)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
     }
     /** `remoteDesktop.desktops`: the desktops configured behind SSH hosts. */
     configuredDesktops() {
@@ -704,7 +782,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         const moved = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${fromId}` : key.endsWith(`#${fromId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
         const store = this.config.store.remoteDesktop;
-        for (const list of ['desktopSharpness', 'trustedCertificates']) {
+        for (const list of ['desktopSharpness', 'trustedCertificates', 'withoutNla']) {
             if (Array.isArray(store[list])) {
                 store[list] = store[list].map((e) => typeof e?.desktop === 'string' && moved(e.desktop)
                     ? { ...e, desktop: `${e.desktop.slice(0, -fromId.length)}${toId}` }
@@ -760,23 +838,53 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             return null;
         }
         const existing = (this.config.store.profiles ?? []).find((p) => p?.type === targets_1.RDP_PROFILE_TYPE && !p.options?.via &&
-            p.options?.host === parsed.host && (p.options.port || 3389) === parsed.port && (p.options.username ?? '') === (parsed.username ?? ''));
+            p.options?.host === parsed.host && (p.options.port || 3389) === parsed.port && (p.options.username ?? '') === (parsed.username ?? '') &&
+            (p.options.gateway ?? '') === (parsed.gateway ?? ''));
         if (existing) {
             this.notifications.info(`Opening "${existing.name}", which is already a profile for ${fileName}`);
             await this.profiles.openNewTabForProfile(existing);
             return existing;
         }
+        // A file is someone else's word for where to connect: where it leads is said before anything goes there. The
+        // account typed into the sign-in form goes to that address, and to the gateway before it.
+        const base = fileName.replace(/^.*[\\/]/, '');
+        const { response } = await this.platform.showMessageBox({
+            type: 'warning',
+            message: `Add a remote desktop from ${base}?`,
+            detail: `It connects to ${(0, desktopForm_1.formatAddress)(parsed.host, parsed.port)}${parsed.gateway ? `, through the gateway ${parsed.gateway}` : ''}` +
+                `${parsed.username ? `, as ${parsed.username}` : ''}. What you sign in with there goes to that address` +
+                `${parsed.gateway ? ' and that gateway' : ''}, and once signed in, the desktop gets the clipboard and the folders you share. ` +
+                'Add it only if you know where it leads, or trust who gave you the file.',
+            buttons: ['Add and connect', 'Add only', 'Cancel'],
+            defaultId: 0,
+            cancelId: 2,
+        });
+        if (response !== 0 && response !== 1) {
+            return null;
+        }
         const profile = {
             type: targets_1.RDP_PROFILE_TYPE,
-            name: fileName.replace(/^.*[\\/]/, '').replace(/\.rdp$/i, '') || parsed.host,
+            name: base.replace(/\.rdp$/i, '') || parsed.host,
             icon: 'fas fa-desktop',
             group: await this.remoteDesktopGroup(),
-            options: { host: parsed.host, port: parsed.port, kind: 'windows', username: parsed.username ?? '', domain: parsed.domain ?? '', via: '' },
+            options: { host: parsed.host, port: parsed.port, kind: 'windows', username: parsed.username ?? '', domain: parsed.domain ?? '', via: '', gateway: parsed.gateway ?? '', gatewayAccount: '' },
         };
         await this.profiles.newProfile(profile);
+        // The file's display scale, as this desktop's own sharpness (the key a direct desktop's settings are kept by).
+        if (parsed.sharpness) {
+            const store = this.config.store.remoteDesktop;
+            const key = `${desktops_1.DIRECT_KEY}#${(0, desktops_1.desktopIdOf)(profile.options)}`;
+            store.desktopSharpness = [...(Array.isArray(store.desktopSharpness) ? store.desktopSharpness : []).filter((e) => e?.desktop !== key), { desktop: key, sharpness: parsed.sharpness }];
+        }
         this.config.save();
         this.notifications.notice(`Added the remote desktop profile "${profile.name}" (Settings › Profiles & connections)`);
-        await this.profiles.openNewTabForProfile(profile);
+        if (parsed.ignored.length) {
+            // What the file asked for beyond that, so nobody wonders why the desktop doesn't behave as in mstsc.
+            this.notifications.info(`${base} also asks for ${parsed.ignored.join('; ')}. Not applied.`);
+        }
+        if (response === 0) {
+            await this.profiles.openNewTabForProfile(profile);
+        }
         return profile;
     }
     /** Asks, then removes a configured desktop (see removeDesktop). The menus and the settings page use this. */
@@ -1095,6 +1203,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             sharpness: store.sharpness === 'retina' ? 'retina' : 'standard',
             desk: store.desk === true,
             macShortcuts: store.macShortcuts !== false,
+            unicodeKeys: store.unicodeKeys === true,
             sound: store.sound !== false,
             h264: store.h264 !== false,
             zoom: store.zoom === 'actual' ? 'actual' : 'fit',
@@ -1106,6 +1215,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             shutDownIdle: [5, 15, 60].includes(Number(store.shutDownIdle)) ? Number(store.shutDownIdle) : 0,
         };
     }
+    /** The folders shared with remote desktops as drives (`remoteDesktop.sharedFolders`), tidied. */
+    sharedFolders() {
+        return (0, drives_1.sharedFolders)(this.config.store.remoteDesktop);
+    }
+    /** Replaces the shared folders; applies to desktops connecting from now on. */
+    setSharedFolders(folders) {
+        this.config.store.remoteDesktop.sharedFolders = folders.map(f => ({ path: f.path, name: f.name, readOnly: f.readOnly }));
+        this.config.save();
+        this.changed$.next();
+    }
     /** The sharpness chosen for the pane's desktop in particular (`remoteDesktop.desktopSharpness`), or null. */
     ownSharpness(pane) {
         const key = this.sessions.get(pane)?.key;
@@ -1152,10 +1271,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.config.save();
         for (const [pane, session] of this.sessions) {
             this.applyZoom(session);
+            this.applyKeyboardMode(session);
             this.syncIndicator(session);
             this.followPane(pane, session);
         }
     }
+    /** IronRDP's keyboard mode for the session: characters (Unicode) or key positions (scancodes), per the setting. */
+    applyKeyboardMode(session) {
+        try {
+            session.ui?.setKeyboardUnicodeMode(this.settings().unicodeKeys);
+        }
+        catch { }
+    }
     /** IronRDP's ScreenScale for the picture: Real (1:1, scrolling) only with a fixed resolution and zoom 'actual'. */
     screenScale() {
         const settings = this.settings();
@@ -1266,6 +1393,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     setViewOnly(pane, viewOnly) {
         const session = this.sessions.get(pane);
         if (session) {
+            if (viewOnly) {
+                // From here on this desktop's keys stop at the plugin, their keyups too: let go of what is down, also
+                // on the desktops typing into all had copy them.
+                session.releaseKeys();
+                if (this.isBroadcast(pane)) {
+                    this.othersInTab(pane).forEach(other => other.session.releaseKeys());
+                }
+            }
             session.setViewOnly(viewOnly);
             this.changed$.next();
         }
@@ -1403,9 +1538,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     forgetCertificate(key) {
         const store = this.config.store.remoteDesktop;
         store.trustedCertificates = (Array.isArray(store.trustedCertificates) ? store.trustedCertificates : []).filter((e) => e?.desktop !== key);
+        // What else was decided about that server goes with it: it is asked again.
+        store.withoutNla = (Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => e?.desktop !== key);
         this.config.save();
         this.changed$.next();
     }
+    /** Whether the desktop was allowed to sign in without Network Level Authentication (see refusedWithoutNla). */
+    signsInWithoutNla(key) {
+        return this.allowedWithoutNla(key);
+    }
     /** The split tab holding the pane, if it has more than one pane. */
     splitOf(pane) {
         const split = this.app.tabs.find(t => t instanceof tabby_core_1.SplitTabComponent && t.getAllTabs().includes(pane));
@@ -1432,6 +1573,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (!split) {
             return;
         }
+        if (!on && this.broadcast.has(split)) {
+            // The keyups of keys held right now (the shortcut's own modifiers) won't be copied any more.
+            this.othersInTab(pane).forEach(other => other.session.releaseKeys());
+        }
         on ? this.broadcast.add(split) : this.broadcast.delete(split);
         for (const p of split.getAllTabs()) {
             const session = this.sessions.get(p);
@@ -1440,14 +1585,19 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         this.changed$.next();
     }
-    /** A key event for the other desktops of a tab typing into all (see DesktopKeyboard). */
+    /**
+     * A key the pane's desktop was sent (see DesktopKeyboard): noted as held there or let go, and copied to the other
+     * desktops of a tab typing into all.
+     */
     broadcastKey(pane, type, init) {
+        this.sessions.get(pane)?.noteKey(type, init);
         if (!this.isBroadcast(pane)) {
             return;
         }
         for (const { session } of this.othersInTab(pane)) {
             try {
                 session.ui.sendKeyboardEvent(new KeyboardEvent(type, { ...init, cancelable: true }));
+                session.noteKey(type, init);
             }
             catch (e) {
                 session.log.push(`typing into all desktops: ${e?.message ?? e}`);
@@ -1577,6 +1727,20 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             spec.port = endpoint.port;
             spec.username ??= endpoint.username;
         }
+        // A Hyper-V VM's console: which session the guest takes right now (enhanced once its Remote Desktop Services
+        // are up, the basic console before that and for guests that have none). The sign-in is the host's.
+        let hyperv;
+        if (spec.hyperv) {
+            session.status(`Connecting to ${spec.name} via ${target.label}…`);
+            const state = await (0, hyperv_1.hyperVState)(target, spec.hyperv);
+            if (!state.running) {
+                throw new Error(`${spec.name} isn't running`);
+            }
+            hyperv = state.enhanced ? 'enhanced' : 'basic';
+            session.log.push(`hyper-v: ${hyperv === 'enhanced' ? 'an enhanced session' : 'the basic console (the guest takes no enhanced session now)'}`);
+            // The SSH user is who to try first: it got to list the VMs.
+            spec.username ??= target.key.replace(/@[^@]*$/, '') || undefined;
+        }
         // A saved account (Settings): its user name, and its password from the keychain. One that has none yet, or that
         // this desktop just refused, is asked for here and saved for every desktop that uses the account.
         const account = spec.account ? this.accounts().find(a => a.id === spec.account) : undefined;
@@ -1584,17 +1748,24 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.log.push('sign-in: its saved account no longer exists; asking');
         }
         const again = this.askAgain.delete(pane);
-        const saved = retryError || again ? null : await (0, signin_1.loadCredentials)(account ? (0, accounts_1.accountKey)(account.id) : session.key);
+        // A desktop whose account is gone asks, rather than falling back to a login of its own saved earlier.
+        let saved = retryError || again || spec.account && !account ? null : await (0, signin_1.loadCredentials)(account ? (0, accounts_1.accountKey)(account.id) : session.authKey);
+        if (saved && account && saved.username !== (0, accounts_1.signInName)(account)) {
+            // Kept for an earlier user name of the account (its change didn't reach the store): not this one's.
+            session.log.push(`sign-in: the account's saved password is for ${saved.username}, not ${(0, accounts_1.signInName)(account)}; asking`);
+            saved = null;
+        }
         if (saved) {
             if (account) {
                 session.log.push(`sign-in: the saved account "${account.name}"`);
             }
-            return { host: spec.host, port: spec.port, credentials: account ? { username: (0, accounts_1.signInName)(account), password: saved.password } : saved, remember: false };
+            return { host: spec.host, port: spec.port, credentials: account ? { username: (0, accounts_1.signInName)(account), password: saved.password } : saved, remember: false, domain: account ? account.domain ?? '' : undefined, hyperv };
         }
         session.status('');
         const asked = (0, signin_1.askCredentials)(session.overlay, {
             // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via".
-            title: spec.id === desktops_1.OWN_DESKTOP || target.direct || spec.kind === 'xrdp' && spec.host === '127.0.0.1' ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${target.label})`,
+            title: spec.hyperv ? `Sign in to ${target.label}, to open ${spec.name}`
+                : spec.id === desktops_1.OWN_DESKTOP || target.direct || spec.kind === 'xrdp' && spec.host === '127.0.0.1' ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${target.label})`,
             username: account ? (0, accounts_1.signInName)(account) : spec.username,
             error: retryError,
             canRemember: true,
@@ -1604,7 +1775,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             setTimeout(() => session.visible && session.focusDesktop());
         }
         const entered = await asked;
-        return entered && { host: spec.host, port: spec.port, credentials: entered, remember: entered.remember, saveKey: account && (0, accounts_1.accountKey)(account.id) };
+        return entered && {
+            host: spec.host, port: spec.port, credentials: entered, remember: entered.remember, domain: account ? account.domain ?? '' : undefined,
+            saveKey: account && (0, accounts_1.accountKey)(account.id), saveLabel: account && `saved account ${account.name}`, saveFor: account && (0, accounts_1.signInName)(account),
+            hyperv,
+        };
     }
     async connect(pane, target, spec, session) {
         const alive = () => this.sessions.get(pane) === session;
@@ -1615,7 +1790,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         let woken = false;
         let startupRetries = 0;
         let endpoint = null;
+        let gatewayError;
         try {
+            const gateway = spec.gateway ? (0, gateway_1.parseGateway)(spec.gateway) : null;
+            if (spec.gateway && !gateway) {
+                throw new Error(`"${spec.gateway}" isn't a gateway's address (a name or address, or name:port)`);
+            }
             if (spec.wake) {
                 const woke = await this.wakeIfDown(pane, target, spec, session, automatic);
                 if (woke === null) {
@@ -1646,7 +1826,23 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 endpoint = asked;
                 session.remote = target;
                 session.pinnedCertificate = asked.certificate ?? null;
-                session.proxy ??= await (0, rdcleanpath_1.startRDCleanPathProxy)(() => target.openTcp(asked.host, asked.port), fingerprint => this.checkCertificate(session, fingerprint), m => session.log.push(m), { autologon: spec.kind === 'xrdp' });
+                // A gateway with a saved account of its own: its password, asked for when there is none or it was refused.
+                if (gateway && spec.gatewayAccount && !asked.gatewayAccount) {
+                    const signIn = await this.gatewayAccountFor(spec, session, gateway, gatewayError);
+                    if (!alive()) {
+                        return;
+                    }
+                    if (signIn === null) {
+                        session.state = 'ended';
+                        this.changed$.next();
+                        this.cancelReconnect(pane);
+                        session.status('Sign-in cancelled.', [{ label: 'Sign in', run: () => this.reopen(pane, spec) }]);
+                        return;
+                    }
+                    asked.gatewayAccount = signIn;
+                }
+                // The proxy outlives an attempt: it reads the sign-in of the attempt it serves.
+                session.proxy ??= await (0, rdcleanpath_1.startRDCleanPathProxy)(() => gateway ? this.throughGateway(target, spec, session, gateway, endpoint) : target.openTcp(asked.host, asked.port), fingerprint => this.checkCertificate(session, fingerprint), m => session.log.push(m), { autologon: spec.kind === 'xrdp', withoutNla: () => this.checkWithoutNla(session) });
                 const outcome = await this.run(pane, target, spec, session, rdp, asked);
                 if (outcome.certificate && alive()) {
                     // A changed certificate, now trusted: the same account again, without asking for it again.
@@ -1655,10 +1851,23 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     }
                     return;
                 }
+                if (outcome.withoutNla && alive()) {
+                    // Allowed now: the same account again, without asking for it again.
+                    if (await this.refusedWithoutNla(pane, target, spec, session)) {
+                        continue;
+                    }
+                    return;
+                }
+                if (outcome.gatewayRefused && asked.gatewayAccount && attempt < 5 && alive()) {
+                    // The gateway's own account was refused: asked for again, the desktop's sign-in kept.
+                    gatewayError = outcome.signInFailed;
+                    asked.gatewayAccount = undefined;
+                    continue;
+                }
                 if (outcome.signInFailed && this.signsIn(spec) && attempt < 5 && alive()) {
                     // The desktop's own saved account goes. A shared one stays until a new password is entered: this
                     // desktop refusing it doesn't make it wrong for the others.
-                    await (0, signin_1.forgetCredentials)(session.key);
+                    await (0, signin_1.forgetCredentials)(session.authKey);
                     retryError = outcome.signInFailed;
                     endpoint = null;
                     continue;
@@ -1695,6 +1904,147 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
         }
     }
+    /**
+     * The sign-in to a desktop's RD Gateway with the saved account it names: the account's password from the keychain,
+     * or asked for (when none is saved, or `retryError`: the gateway just refused it). Undefined when that account no
+     * longer exists (the desktop's own sign-in is then tried); null when the form was cancelled.
+     */
+    async gatewayAccountFor(spec, session, gateway, retryError) {
+        const account = this.accounts().find(a => a.id === spec.gatewayAccount);
+        if (!account) {
+            session.log.push('gateway: its saved account no longer exists; signing in with the desktop\'s');
+            return undefined;
+        }
+        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account) };
+        const saved = retryError ? null : await (0, signin_1.loadCredentials)(signIn.saveKey);
+        if (saved && saved.username === (0, accounts_1.signInName)(account)) {
+            session.log.push(`gateway: the saved account "${account.name}"`);
+            return { ...signIn, credentials: { username: (0, accounts_1.signInName)(account), password: saved.password }, remember: false };
+        }
+        session.status('');
+        const asked = (0, signin_1.askCredentials)(session.overlay, {
+            title: `Sign in to the gateway ${gateway.host}, to reach ${spec.name}`,
+            username: (0, accounts_1.signInName)(account),
+            error: retryError,
+            canRemember: true,
+            account: account.name,
+        }, session.disposed);
+        if (session.visible) {
+            setTimeout(() => session.visible && session.focusDesktop());
+        }
+        const entered = await asked;
+        return entered && { ...signIn, credentials: entered, remember: entered.remember };
+    }
+    /**
+     * The proxy's stream to a desktop behind an RD Gateway (see gateway.ts): to the gateway as the SSH host (or this
+     * computer) reaches it, signed in with the gateway's own account or else the desktop's, then on to the desktop.
+     */
+    async throughGateway(target, spec, session, gateway, endpoint) {
+        session.gatewayRefused = null;
+        const own = endpoint.gatewayAccount;
+        const credentials = own?.credentials ?? endpoint.credentials;
+        session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its saved account' : 'the desktop\'s sign-in'}`);
+        try {
+            const stream = await (0, gateway_1.openThroughGateway)(() => target.openTcp(gateway.host, gateway.port), gateway, { username: credentials.username, password: credentials.password, domain: (own ? own.domain : endpoint.domain ?? spec.domain) || undefined }, { host: endpoint.host, port: endpoint.port }, (fingerprint, valid) => this.checkGatewayCertificate(session, gateway, fingerprint, valid), { log: m => session.log.push(m), clientName: os.hostname() });
+            // Entered a moment ago and taken by the gateway: kept, while the account is still what it was signed in as.
+            if (own?.remember) {
+                own.remember = false;
+                const accountNow = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === own.saveKey);
+                if (accountNow && (0, accounts_1.signInName)(accountNow) === own.saveFor) {
+                    (0, signin_1.saveCredentials)(own.saveKey, own.credentials, own.saveLabel).then(() => session.log.push(`gateway: saved as the account's password in ${(0, signin_1.storeName)()}`), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
+                }
+            }
+            return stream;
+        }
+        catch (e) {
+            if (e instanceof gateway_1.GatewaySignInError) {
+                session.gatewayRefused = e.message;
+            }
+            throw e;
+        }
+    }
+    /**
+     * A gateway's certificate, before the sign-in goes to it. One that is valid for the gateway's name by this
+     * computer's certificate authorities is accepted (a gateway on the internet has one); any other is trusted on
+     * first use, like a desktop's. Either way it is remembered, by the gateway's address: after a valid one, an invalid
+     * one is a change to decide on, not a first use.
+     */
+    checkGatewayCertificate(session, gateway, raw, valid) {
+        const fingerprint = (0, rdcleanpath_1.normalizeFingerprint)(raw);
+        const address = `${gateway.host}:${gateway.port}`;
+        const key = `gateway#${address}`;
+        const known = this.trustedCertificate(key);
+        if (valid || !known) {
+            if (known !== fingerprint) {
+                this.trustCertificate(key, fingerprint);
+            }
+            session.log.push(`gateway certificate: SHA-256 ${fingerprint}, ${valid ? `valid for ${gateway.host}` : 'remembered (first connection)'}`);
+            return;
+        }
+        if (fingerprint !== known) {
+            session.certificateProblem = { expected: known, actual: fingerprint, pinned: false, gateway: { address, key } };
+            throw new Error(`the gateway's certificate SHA-256 ${fingerprint} is not the one remembered (${known})`);
+        }
+        session.log.push(`gateway certificate: SHA-256 ${fingerprint}, as remembered`);
+    }
+    /** The desktops allowed to sign in without Network Level Authentication (`remoteDesktop.withoutNla`), by session key. */
+    allowedWithoutNla(key) {
+        const list = this.config.store.remoteDesktop?.withoutNla;
+        return (Array.isArray(list) ? list : []).some((e) => e?.desktop === key);
+    }
+    /**
+     * The proxy found a server that doesn't use Network Level Authentication: the password would go to it as it is,
+     * before the server has shown anything but a certificate. That is how xrdp signs in, so an xrdp desktop goes on.
+     * A Windows machine or GNOME Remote Desktop always uses it unless it was turned off, and something posing as one
+     * (the address in a file someone sent) doesn't: those stop here, until the desktop is allowed (refusedWithoutNla).
+     */
+    checkWithoutNla(session) {
+        if (session.spec.kind === 'xrdp') {
+            return;
+        }
+        if (this.allowedWithoutNla(session.authKey)) {
+            session.log.push('sign-in: without Network Level Authentication, as allowed for this desktop');
+            return;
+        }
+        session.withoutNla = true;
+        throw new Error('the server doesn\'t use Network Level Authentication');
+    }
+    /**
+     * After the proxy stopped at a server without Network Level Authentication; nothing but the connection request
+     * was sent to it. Says what going on would mean and asks; automatic reconnecting stops here. Resolves true to
+     * connect again (the desktop is then allowed, and remembered as such).
+     */
+    async refusedWithoutNla(pane, target, spec, session) {
+        this.cancelReconnect(pane);
+        const alive = () => this.sessions.get(pane) === session;
+        session.log.push('sign-in: the server doesn\'t use Network Level Authentication; asking before the password goes to it');
+        if (!session.visible) {
+            this.notifications.notice(`${spec.name}${target.direct ? '' : ` (via ${target.label})`} would get your password as it is. Open that desktop to decide.`);
+        }
+        const allowed = await new Promise(resolve => {
+            session.status(`${spec.name} doesn't use Network Level Authentication, so your password would be sent to it as it is: ` +
+                'encrypted on the way, but readable to whatever answered there, before it has proved anything. Nothing has been sent.\n\n' +
+                'A Windows machine asks for Network Level Authentication unless that was turned off on it. A server posing as one doesn\'t, ' +
+                `and neither does xrdp: if ${spec.name} is an xrdp server, set its kind to xrdp instead.`, [
+                { label: 'Send the password anyway', run: () => resolve(true) },
+                { label: 'Cancel', run: () => resolve(false) },
+            ], true);
+            session.disposed.then(() => resolve(false));
+        });
+        if (!alive()) {
+            return false;
+        }
+        if (!allowed) {
+            session.state = 'ended';
+            this.changed$.next();
+            session.status('Not connected: the password was not sent.', [{ label: 'Try again', run: () => this.reopen(pane, spec) }], true);
+            return false;
+        }
+        const store = this.config.store.remoteDesktop;
+        store.withoutNla = [...(Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => e?.desktop !== session.authKey), { desktop: session.authKey }];
+        this.config.save();
+        return true;
+    }
     /**
      * The proxy's check of the server's certificate, before any credentials go out. The host's own desktop must show
      * the certificate its setup reported. Others (behind a host, a Windows host's own, a remote desktop tab's) are
@@ -1714,9 +2064,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.log.push(`certificate: SHA-256 ${fingerprint}, as set up`);
             return;
         }
-        const known = this.trustedCertificate(session.key);
+        const known = this.trustedCertificate(session.authKey);
         if (!known) {
-            this.trustCertificate(session.key, fingerprint);
+            this.trustCertificate(session.authKey, fingerprint);
             session.log.push(`certificate: SHA-256 ${fingerprint}, remembered (first connection)`);
             return;
         }
@@ -1789,13 +2139,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 `Something other than GNOME Remote Desktop may be listening on port ${endpoint.port}.`);
             return false;
         }
+        // The desktop's, or its gateway's.
+        const whose = problem.gateway ? `${spec.name}'s gateway ${problem.gateway.address}` : spec.name;
         if (!session.visible) {
-            this.notifications.notice(`The certificate of ${spec.name}${target.direct ? '' : ` (via ${target.label})`} has changed. Open that desktop to decide.`);
+            this.notifications.notice(`The certificate of ${whose}${target.direct ? '' : ` (via ${target.label})`} has changed. Open that desktop to decide.`);
         }
         const trusted = await new Promise(resolve => {
-            session.status(`The certificate of ${spec.name} has changed since it was last used. Nothing has been sent to it.\n\n` +
+            session.status(`The certificate of ${whose} has changed since it was last used. Nothing has been sent to it.\n\n` +
                 `${fingerprints}\n\nReinstalling the machine or renewing its certificate changes it. If neither happened, ` +
-                `something else may be answering at ${spec.host}:${spec.port}.`, [
+                `something else may be answering at ${problem.gateway?.address ?? `${spec.host}:${spec.port}`}.`, [
                 { label: 'Trust the new certificate', run: () => resolve(true) },
                 { label: 'Cancel', run: () => resolve(false) },
             ], true);
@@ -1808,8 +2160,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             stop('Not connected: the new certificate was not trusted.');
             return false;
         }
-        this.trustCertificate(session.key, problem.actual);
-        session.log.push(`certificate: SHA-256 ${problem.actual}, trusted instead of ${problem.expected}`);
+        this.trustCertificate(problem.gateway?.key ?? session.authKey, problem.actual);
+        session.log.push(`${problem.gateway ? 'gateway ' : ''}certificate: SHA-256 ${problem.actual}, trusted instead of ${problem.expected}`);
         return true;
     }
     /** The certificate remembered for a desktop behind a host (`remoteDesktop.trustedCertificates`), if any. */
@@ -1833,6 +2185,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const list = Array.isArray(store.trustedCertificates) ? store.trustedCertificates : [];
         const forget = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${desktopId}` : key.endsWith(`#${desktopId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
         store.trustedCertificates = list.filter((e) => !forget(String(e?.desktop ?? '')));
+        store.withoutNla = (Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => !forget(String(e?.desktop ?? '')));
     }
     /**
      * For a desktop with `wake`: when its RDP server doesn't answer (probed from the SSH host), starts it and waits
@@ -1842,7 +2195,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async wakeIfDown(pane, target, spec, session, automatic) {
         const alive = () => this.sessions.get(pane) === session;
         session.status(`Connecting to ${spec.name} via ${target.label}…`);
-        if (await (0, wake_1.rdpAnswers)(target, spec.host, spec.port)) {
+        if (await (0, wake_1.desktopUp)(target, spec.host, spec.port, spec.wake)) {
             return false;
         }
         if (!alive()) {
@@ -1867,7 +2220,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const started = Date.now();
         const progress = () => session.status(`Starting ${spec.name}…\nWaiting for it to answer: ${Math.round((Date.now() - started) / 1000)} s`, [cancel]);
         progress();
-        const up = await this.zone.runOutsideAngular(() => (0, wake_1.waitForRdp)(target, spec.host, spec.port, WAKE_TIMEOUT_MS, () => cancelled || !alive(), progress));
+        const up = await this.zone.runOutsideAngular(() => (0, wake_1.waitForRdp)(target, spec.host, spec.port, WAKE_TIMEOUT_MS, () => cancelled || !alive(), progress, spec.wake));
         if (up) {
             session.log.push(`wake: answered after ${Math.round((Date.now() - started) / 1000)} s`);
             // Started here, so it can go back off when it's no longer used, if the settings say so (a VM only: a machine
@@ -1889,6 +2242,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const credentials = endpoint.credentials;
         const alive = () => this.sessions.get(pane) === session;
         session.certificateProblem = null;
+        session.gatewayRefused = null;
+        session.withoutNla = false;
         const el = document.createElement('iron-remote-desktop');
         try {
             el.setAttribute('scale', this.screenScale() === 3 ? 'real' : 'fit');
@@ -1915,13 +2270,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             const size = remoteSizeFor(session.overlay.getBoundingClientRect(), settings);
             const { width, height } = size;
             // DOMAIN\user or user@domain go to the server as typed; only the former needs splitting.
-            const [domain, username] = /^([^\\]+)\\(.+)$/.exec(credentials.username)?.slice(1) ?? [spec.domain ?? '', credentials.username];
+            const [domain, username] = /^([^\\]+)\\(.+)$/.exec(credentials.username)?.slice(1) ?? [endpoint.domain ?? spec.domain ?? '', credentials.username];
             session.status(spec.id === desktops_1.OWN_DESKTOP ? `Connecting to ${target.label}…`
                 : target.direct ? `Connecting to ${spec.name}…` : `Connecting to ${spec.name} via ${target.label}…`);
             const config = session.ui.configBuilder()
                 .withUsername(username)
                 .withPassword(credentials.password)
-                .withDestination(`${spec.id === desktops_1.OWN_DESKTOP ? target.hostname ?? target.label : endpoint.host}:${endpoint.port}`)
+                // The name the server is signed in to as: the SSH host's for its own desktop, and for its VMs' consoles.
+                .withDestination(`${spec.id === desktops_1.OWN_DESKTOP || spec.hyperv ? target.hostname ?? target.label : endpoint.host}:${endpoint.port}`)
                 .withProxyAddress(session.proxy.url)
                 .withServerDomain(domain)
                 .withAuthToken(session.proxy.token)
@@ -1931,9 +2287,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             // H.264 in the graphics pipeline, decoded by the browser (hardware-accelerated where it can be). A decoder
             // failure ends the connection, which then reconnects without H.264 (see below). Not for xrdp: it encodes
             // H.264 only in some builds, and without it bitmaps do better there than the pipeline.
+            // A Hyper-V VM's console: the VM's id goes ahead of everything, and the sign-in (the host's) before the RDP
+            // handshake. Its basic console is a picture, keyboard and mouse: no channels for sound, files or resizing.
+            const basic = endpoint.hyperv === 'basic';
+            if (spec.hyperv) {
+                if (typeof rdp.vmConnect !== 'function') {
+                    throw new Error('this build of IronRDP has no Hyper-V console support');
+                }
+                config.withExtension(rdp.vmConnect(spec.hyperv, endpoint.hyperv ?? 'basic'));
+            }
             session.h264?.close();
             session.h264 = null;
-            if (spec.kind !== 'xrdp' && typeof rdp.graphicsPipeline === 'function' && await this.useH264(rdp, session, settings)) {
+            if (spec.kind !== 'xrdp' && !basic && typeof rdp.graphicsPipeline === 'function' && await this.useH264(rdp, session, settings)) {
                 session.h264 = new rdp.WebCodecsH264Decoder({ onFailure: (reason) => session.log.push(`h264: failed: ${reason}`) });
                 config.withExtension(rdp.h264Decoder(session.h264));
             }
@@ -1949,19 +2314,29 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 session.graphics = 'automatic graphics';
             }
             session.log.push(`graphics: ${session.graphics}`);
-            if (settings.sound) {
+            if (settings.sound && !basic) {
                 session.audio?.close();
                 session.audio = new audio_1.AudioPlayer();
                 config.withExtension(rdp.audioPlayback(session.audio.callback));
             }
             session.mic?.close();
             session.mic = null;
-            if (settings.microphone && typeof rdp.audioInput === 'function') {
+            if (settings.microphone && !basic && typeof rdp.audioInput === 'function') {
                 const ui = session.ui;
                 const mic = new microphone_1.Microphone(pcm => ui.invokeExtension(rdp.audioInputData(pcm)), () => session.overlay.classList.toggle('trd-mic-on', mic.capturing), m => session.log.push(m), m => this.zone.run(() => this.notifications.error(m)));
                 session.mic = mic;
                 config.withExtension(rdp.audioInput(mic.callback));
             }
+            // Shared folders as drives (\\tsclient\<name>). GNOME Remote Desktop doesn't serve drives; Windows and xrdp
+            // do. Also skipped with no folder shared: the server then sees no drive device at all.
+            session.drives?.dispose();
+            session.drives = null;
+            const folders = this.sharedFolders();
+            if (folders.length && spec.kind !== 'gnome' && !basic && typeof rdp.driveRedirection === 'function') {
+                session.drives = new drives_1.SharedDrives(folders, m => session.log.push(m));
+                config.withExtension(rdp.driveRedirection(session.drives));
+                session.log.push(`drives: ${folders.map(f => `${f.name}${f.readOnly ? ' (read-only)' : ''}`).join(', ')}`);
+            }
             const built = config.build();
             let info;
             try {
@@ -1972,6 +2347,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 if (session.certificateProblem) {
                     return { connected: false, certificate: session.certificateProblem };
                 }
+                // The proxy stopped at a server that would get the password as it is (see checkWithoutNla).
+                if (session.withoutNla) {
+                    return { connected: false, withoutNla: true };
+                }
+                // Its gateway refused the sign-in, before anything went to the desktop.
+                if (session.gatewayRefused) {
+                    session.log.push(`gateway: ${session.gatewayRefused}`);
+                    return { connected: false, signInFailed: session.gatewayRefused, gatewayRefused: true };
+                }
                 // IronErrorKind: 1 WrongPassword, 2 LogonFailure.
                 const kind = typeof e?.kind === 'function' ? e.kind() : undefined;
                 const detail = typeof e?.backtrace === 'function' ? e.backtrace() : (e?.message ?? String(e));
@@ -1985,8 +2369,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 return { connected: false };
             }
             session.ui.setVisibility(true);
+            this.applyKeyboardMode(session);
             session.remoteSize = { width, height, scale: 100 };
-            if (size.scale !== 100 || spec.kind === 'windows') {
+            if (!basic && (size.scale !== 100 || spec.kind === 'windows')) {
                 // Retina: the connection starts unscaled; ask for the matching remote scale right away. Windows also
                 // keeps a signed-in session's scale from the last connection: set it either way.
                 this.applySize(session, size);
@@ -2000,12 +2385,19 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.syncIndicator(session);
             this.changed$.next();
             this.reconnects.delete(pane); // connected again: a later drop starts over
-            if (endpoint.remember) {
-                (0, signin_1.saveCredentials)(endpoint.saveKey ?? session.key, credentials, endpoint.saveLabel).then(() => session.log.push(`sign-in: saved ${endpoint.saveKey ? 'as the account\'s password ' : ''}in ${(0, signin_1.storeName)()}`), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
+            // Under a saved account only while that account is still there with the same sign-in name: the prompt may
+            // have been open while it was removed or changed in Settings.
+            const accountNow = endpoint.saveKey ? this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === endpoint.saveKey) : undefined;
+            if (endpoint.remember && endpoint.saveKey && (!accountNow || (0, accounts_1.signInName)(accountNow) !== endpoint.saveFor)) {
+                session.log.push(`sign-in: not saved: the account ${accountNow ? 'changed' : 'was removed'} meanwhile`);
+            }
+            else if (endpoint.remember) {
+                (0, signin_1.saveCredentials)(endpoint.saveKey ?? session.authKey, credentials, endpoint.saveLabel).then(() => session.log.push(`sign-in: saved ${endpoint.saveKey ? 'as the account\'s password ' : ''}in ${(0, signin_1.storeName)()}`), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             if (session.visible) {
                 session.focusDesktop();
             }
+            const connectedAt = Date.now();
             let end;
             try {
                 end = await info.run();
@@ -2020,11 +2412,19 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     this.h264Failed.add(session.key);
                     return { connected: true, error: `H.264 decoding failed (${session.h264.failed}); continuing without it` };
                 }
-                return { connected: true, error: typeof e?.backtrace === 'function' ? e.backtrace().split('\n')[0] : (e?.message ?? String(e)) };
+                const error = typeof e?.backtrace === 'function' ? e.backtrace().split('\n')[0] : (e?.message ?? String(e));
+                // A Hyper-V host signs anyone in that it knows, and ends the connection at once when that account may not
+                // open the VM's console: a refused sign-in in effect, so the form comes back, saying so.
+                if (spec.hyperv && Date.now() - connectedAt < 5000 && /disconnect provider ultimatum/i.test(error)) {
+                    session.log.push(`hyper-v: disconnected at once (${error}): the account may not open this VM's console`);
+                    return { connected: false, signInFailed: `${target.label} ended the connection at once: this account may not open ${spec.name}'s console. Use an administrator of the host, a member of its Hyper-V Administrators, or an account given access with Grant-VMConnectAccess.` };
+                }
+                return { connected: true, error };
             }
             finally {
-                // The server can't close the microphone once the connection is gone.
+                // The server can't close the microphone, or its files, once the connection is gone.
                 session.mic?.close();
+                session.drives?.dispose();
             }
             return { connected: true, reason: end?.reason?.() };
         }