tabby-rdp 0.4.1 → 0.5.1

package/dist/rdpFile.js

@@ -1,6 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROPHONE_NOTE = void 0;
 exports.parseRdpFile = parseRdpFile;
+/**
+ * The note for a file that asks for the microphone: not applied while the setting is off. With it on, every desktop
+ * gets the microphone, and the import says so instead (see RemoteDesktopService.importRdp).
+ */
+exports.MICROPHONE_NOTE = 'the microphone (Settings › Remote Desktop › Microphone)';
+/** What a setting in the file would mean here, when it isn't applied: by key, for the values that ask for something. */
+const NOTES = {
+    'audiomode': v => v === '1' ? 'sound left on the remote (sound plays here; Settings › Remote Desktop › Sound)' : v === '2' ? 'sound off (Settings › Remote Desktop › Sound)' : null,
+    'audiocapturemode': v => v === '1' ? exports.MICROPHONE_NOTE : null,
+    'redirectdrives': v => v === '1' ? 'its drives (share folders in Settings › Remote Desktop › Shared folders)' : null,
+    'drivestoredirect': v => v ? 'its drives (share folders in Settings › Remote Desktop › Shared folders)' : null,
+    'redirectprinters': v => v === '1' ? 'printer redirection (not supported)' : null,
+    'redirectsmartcards': v => v === '1' ? 'smart card redirection (not supported)' : null,
+    'redirectcomports': v => v === '1' ? 'serial port redirection (not supported)' : null,
+    'usbdevicestoredirect': v => v ? 'USB redirection (not supported)' : null,
+    'use multimon': v => v === '1' ? 'several monitors (one screen per desktop here)' : null,
+    'screen mode id': (v, all) => v === '1' && (all.get('desktopwidth') || all.get('desktopheight'))
+        ? `a fixed ${all.get('desktopwidth') ?? '?'}×${all.get('desktopheight') ?? '?'} window (the desktop follows the pane; Settings › Remote Desktop › When the pane is resized)` : null,
+    'gatewayhostname': (v, all) => v && !usesGateway(all) ? `the RD Gateway ${v}, which the file names but doesn't use (the profile's RD Gateway field takes it)` : null,
+    'promptcredentialonce': (v, all) => v === '0' && usesGateway(all) ? 'an account of its own for the gateway (pick a saved account as the profile\'s Gateway account)' : null,
+    'gatewaycredentialssource': (v, all) => (v === '1' || v === '5') && usesGateway(all) ? `a ${v === '1' ? 'smart card' : 'sign-in page'} at the gateway (not supported; it is signed in to with a user name and password)` : null,
+    'remoteapplicationmode': v => v === '1' ? 'RemoteApp (not supported; the whole desktop opens)' : null,
+    'alternate shell': v => v ? 'a program to start instead of the desktop (not supported)' : null,
+    'enablecredsspsupport': v => v === '0' ? 'sign-in without Network Level Authentication (it is always used)' : null,
+};
+/**
+ * Whether the file connects through its gateway: it names one, and `gatewayusagemethod` doesn't say not to (0, or 4:
+ * never; 1 to 3: always, when a direct connection fails, by the user's defaults). mstsc always writes the method; a
+ * file written by hand that only names a gateway means it.
+ */
+function usesGateway(settings) {
+    return !!settings.get('gatewayhostname') && !['0', '4'].includes(settings.get('gatewayusagemethod') ?? '');
+}
 /** mstsc writes UTF-16LE with a byte order mark; other tools write UTF-8, with or without one. */
 function decode(data) {
     const b = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
@@ -22,26 +56,41 @@ function decode(data) {
 /** The connection a .rdp file describes, or null without a usable `full address`. */
 function parseRdpFile(data) {
     const settings = new Map();
+    // A limit is kept whichever way the file writes it (`0`, `00`, `+0`), and wherever it is: a file that says it
+    // twice, differently, gets the narrower of the two rather than whichever line comes last.
+    let clipboardOff = false;
     for (const line of decode(data).split(/\r?\n/)) {
         const m = /^\s*([^:]+?)\s*:\s*([sib])\s*:(.*)$/i.exec(line);
         if (m) {
-            settings.set(m[1].toLowerCase(), m[3].trim());
+            const key = m[1].toLowerCase();
+            const value = m[3].trim();
+            settings.set(key, value);
+            clipboardOff ||= key === 'redirectclipboard' && /^[+-]?\d+$/.test(value) && Number(value) === 0;
         }
     }
     const full = settings.get('full address') ?? '';
-    // host, host:port, [v6]:port, or a bare IPv6 address (colons, no brackets).
-    const m = /^\[([^\]]+)\](?::(\d+))?$|^([^:\s]+)(?::(\d+))?$/.exec(full);
+    // host, host:port, [v6]:port, or a bare IPv6 address (colons, no brackets). No '#': session and trust keys are
+    // split on it, so a host that carried one could be taken for another desktop's key (see keyParts).
+    const m = /^\[([^\]#]+)\](?::(\d+))?$|^([^:\s#]+)(?::(\d+))?$/.exec(full);
     const host = m?.[1] ?? m?.[3] ?? (/^[0-9a-f:.]+$/i.test(full) && (full.match(/:/g)?.length ?? 0) > 1 ? full : null);
     // A port in the address wins over `server port`, as in mstsc.
     const port = Number(m?.[2] ?? m?.[4] ?? (settings.get('server port') || 3389));
     if (!host || !Number.isInteger(port) || port < 1 || port > 65535) {
         return null;
     }
+    const scale = Number(settings.get('desktopscalefactor'));
+    // By own property only: a file whose key is `__proto__` or `constructor` names an inherited member of the NOTES
+    // object (Object.prototype, the Object constructor), not a note, and calling one would throw or inject its text.
+    const noteFor = (key) => Object.prototype.hasOwnProperty.call(NOTES, key) ? NOTES[key] : undefined;
+    const ignored = [...settings].map(([key, value]) => noteFor(key)?.(value, settings) ?? null).filter((n) => !!n);
     return {
         host,
         port,
         ...settings.get('username') ? { username: settings.get('username') } : {},
         ...settings.get('domain') ? { domain: settings.get('domain') } : {},
+        ...Number.isFinite(scale) && scale >= 100 ? { sharpness: scale >= 150 ? 'retina' : 'standard' } : {},
+        ...usesGateway(settings) ? { gateway: settings.get('gatewayhostname') } : {},
+        ...clipboardOff ? { clipboard: 'off' } : {},
+        ignored: [...new Set(ignored)],
     };
 }
-//# sourceMappingURL=rdpFile.js.map

package/dist/rdpProfile.js

@@ -18,8 +18,10 @@ const desktopForm_1 = require("./desktopForm");
 const help_1 = require("./help");
 const accounts_1 = require("./accounts");
 const accountForm_1 = require("./accountForm");
+const clipboard_1 = require("./clipboard");
 const desktops_1 = require("./desktops");
-const signin_1 = require("./signin");
+const gateway_1 = require("./gateway");
+const osd_1 = require("./osd");
 const ssh_1 = require("./ssh");
 const targets_1 = require("./targets");
 /** Input of an SSH tab opened for an RDP profile with `via`: the desktop to show once SSH is connected. */
@@ -133,7 +135,7 @@ let RDPProfileSettingsComponent = class RDPProfileSettingsComponent {
         const o = this.profile.options;
         const account = () => `${o.username ?? ''}\n${o.domain ?? ''}\n${o.account ?? ''}`;
         // No id for a new profile (no address yet): it has nothing saved to take along.
-        this.before = { id: o.host ? (0, desktops_1.desktopIdOf)(o) : '', account: account(), via: o.via ?? '' };
+        this.before = { id: o.host ? (0, desktops_1.desktopIdOf)(o) : '', account: account(), via: o.via ?? '', gateway: o.gateway ?? '' };
         const root = this.element.nativeElement;
         root.innerHTML = `
             <div class="mb-3">
@@ -167,6 +169,23 @@ let RDPProfileSettingsComponent = class RDPProfileSettingsComponent {
             <div class="mb-3" data-own-account>
                 <label>Domain</label>
                 <input class="form-control" name="domain" spellcheck="false" placeholder="Optional">
+            </div>
+            <div class="mb-3">
+                <label>RD Gateway</label>
+                <input class="form-control" name="gateway" spellcheck="false" placeholder="Optional: a Remote Desktop Gateway, e.g. rdgw.example.com">
+                <div class="text-danger small" data-for="gateway"></div>
+                <div class="text-muted small">The desktop is then reached through the gateway (HTTPS, port 443 unless given), and the address above is as the gateway sees it.</div>
+            </div>
+            <div class="mb-3" data-gateway-account>
+                <label>Gateway account</label>
+                <select class="form-control" name="gatewayAccount"></select>
+                <div class="text-muted small">A gateway that takes another account than the desktop: a saved account for it.</div>
+            </div>
+            <div class="mb-3">
+                <label>Clipboard</label>
+                <select class="form-control" name="clipboard"></select>
+                <div class="text-muted small">Which ways text, pictures and files copied on either side go between this computer and the desktop.
+                    Applies on the next connection.</div>
             </div>`;
         const field = (name) => root.querySelector(`[name="${name}"]`);
         field('address').value = o.host ? (0, desktopForm_1.formatAddress)(o.host, o.port || 3389) : '';
@@ -208,6 +227,31 @@ let RDPProfileSettingsComponent = class RDPProfileSettingsComponent {
         ownAccount();
         field('username').addEventListener('input', () => { o.username = field('username').value.trim(); });
         field('domain').addEventListener('input', () => { o.domain = field('domain').value.trim(); });
+        // The gateway, and its account where that isn't the desktop's (offered once there is a gateway and a saved account).
+        const gateway = field('gateway');
+        const gatewayAccount = field('gatewayAccount');
+        gateway.value = o.gateway ?? '';
+        gatewayAccount.append(new Option('The same as the desktop\'s', ''), ...accounts.map(a => new Option(label(a), a.id)));
+        if (o.gatewayAccount && !accounts.some(a => a.id === o.gatewayAccount)) {
+            gatewayAccount.append(new Option('(a saved account that no longer exists)', o.gatewayAccount));
+        }
+        gatewayAccount.value = o.gatewayAccount ?? '';
+        const gatewayChanged = () => {
+            const text = gateway.value.trim();
+            root.querySelector('[data-for=gateway]').textContent = text && !(0, gateway_1.parseGateway)(text) ? 'A name or address, with :port if it isn\'t 443.' : '';
+            root.querySelector('[data-gateway-account]').hidden = !text || gatewayAccount.options.length < 2;
+        };
+        gateway.addEventListener('input', () => {
+            o.gateway = gateway.value.trim();
+            gatewayChanged();
+        });
+        gatewayAccount.addEventListener('change', () => { o.gatewayAccount = gatewayAccount.value; });
+        gatewayChanged();
+        // Its own clipboard sharing, or the setting's (named, as it is now).
+        const clipboard = field('clipboard');
+        clipboard.append(new Option(`As in Settings › Remote Desktop (${clipboard_1.CLIPBOARD_LABELS[desktop.settings().clipboard].toLowerCase()})`, ''), ...Object.entries(clipboard_1.CLIPBOARD_LABELS).map(([mode, text]) => new Option(text, mode)));
+        clipboard.value = (0, clipboard_1.ownClipboard)(o.clipboard) ?? '';
+        clipboard.addEventListener('change', () => { o.clipboard = clipboard.value; });
         const via = field('via');
         via.addEventListener('change', () => { o.via = via.value; });
         this.injector.get(tabby_core_1.ProfilesService).getProfiles().then(profiles => {
@@ -221,21 +265,22 @@ let RDPProfileSettingsComponent = class RDPProfileSettingsComponent {
     }
     save() {
         const o = this.profile.options;
-        const { id, account, via } = this.before;
+        const { id, account, via, gateway } = this.before;
         if (!id) {
             return;
         }
         if ((o.via ?? '') !== via) {
-            // Reached another way, it is another desktop. A direct one's saved account and certificate were its own; one
-            // behind a host shares them with that host's desktop at the same address, so they stay.
+            // Reached another way, it is another desktop. A direct one's saved passwords (through any gateway, the ones
+            // it had before included) and certificate were its own; one behind a host shares them with that host's
+            // desktop at the same address, so they stay.
             if (!via) {
-                (0, signin_1.forgetCredentials)(`${desktops_1.DIRECT_KEY}#${id}`);
-                this.injector.get(desktop_service_1.RemoteDesktopService).forgetCertificatesFor(id, true);
+                this.injector.get(desktop_service_1.RemoteDesktopService).forgetDesktop(id, true, `"${this.profile.name}"`).catch(() => null);
             }
             return;
         }
+        // Its saved password goes with its way there (see desktopEdited): another gateway is asked for again.
         const accountChanged = `${o.username ?? ''}\n${o.domain ?? ''}\n${o.account ?? ''}` !== account;
-        this.injector.get(desktop_service_1.RemoteDesktopService).desktopEdited(id, (0, desktops_1.desktopIdOf)(o), accountChanged, !via).catch(() => null);
+        this.injector.get(desktop_service_1.RemoteDesktopService).desktopEdited(id, (0, desktops_1.desktopIdOf)(o), accountChanged, !via, { from: gateway, to: o.gateway }).catch(() => null);
     }
 };
 exports.RDPProfileSettingsComponent = RDPProfileSettingsComponent;
@@ -257,17 +302,20 @@ let RDPProfilesService = class RDPProfilesService extends tabby_core_1.QuickConn
         this.name = 'Remote desktop (RDP)';
         this.settingsComponent = RDPProfileSettingsComponent;
         this.configDefaults = {
-            options: { host: '', port: 3389, kind: 'windows', username: '', domain: '', account: '', via: '' },
+            options: { host: '', port: 3389, kind: 'windows', username: '', domain: '', account: '', via: '', gateway: '', gatewayAccount: '', clipboard: '' },
             clearServiceMessagesOnConnect: false,
         };
     }
     async getBuiltinProfiles() {
+        // No clipboard here: a new profile is made from a copy of this, and a value saved with it (even '', the
+        // setting's) would hide the clipboard its group's or the type's defaults give it, which may well be narrower.
+        // Left out, the profile follows those defaults (configDefaults has the key) until it is given one of its own.
         return [{
                 id: `${targets_1.RDP_PROFILE_TYPE}:template`,
                 type: targets_1.RDP_PROFILE_TYPE,
                 name: 'Remote desktop (RDP)',
                 icon: 'fas fa-desktop',
-                options: { host: '', port: 3389, kind: 'windows', username: '', domain: '', account: '', via: '' },
+                options: { host: '', port: 3389, kind: 'windows', username: '', domain: '', account: '', via: '', gateway: '', gatewayAccount: '' },
                 isBuiltin: true,
                 isTemplate: true,
             }];
@@ -291,12 +339,19 @@ let RDPProfilesService = class RDPProfilesService extends tabby_core_1.QuickConn
     }
     getDescription(profile) {
         const o = profile.options ?? {};
-        if (!o.host) {
+        // Each field as text whatever the config holds (see configText): Tabby asks this of every profile as it lists
+        // them in its profile selector, and one that throws keeps the selector from opening at all.
+        const host = (0, desktops_1.configText)(o.host);
+        if (!host) {
             return '';
         }
-        const address = (0, desktopForm_1.formatAddress)(o.host, o.port || 3389);
-        const via = o.via ? (this.config.store.profiles ?? []).find((p) => p.id === o.via)?.name ?? 'an SSH profile' : null;
-        return via ? `${address} via ${via}` : address;
+        const address = (0, desktopForm_1.formatAddress)(host, (0, osd_1.configNumber)(o.port || 3389));
+        const gateway = (0, desktops_1.configText)(o.gateway);
+        const via = [
+            ...gateway ? [`the gateway ${gateway}`] : [],
+            ...o.via ? [(0, desktops_1.configText)((this.config.store.profiles ?? []).find((p) => p.id === o.via)?.name) || 'an SSH profile'] : [],
+        ];
+        return via.length ? `${address} via ${via.join(', via ')}` : address;
     }
     /** `[user@]host[:port]`, typed in Tabby's profile selector. */
     quickConnect(query) {
@@ -313,16 +368,15 @@ let RDPProfilesService = class RDPProfilesService extends tabby_core_1.QuickConn
     }
     intoQuickConnectString(profile) {
         const o = profile.options;
-        return o.via ? null : `${o.username ? `${o.username}@` : ''}${(0, desktopForm_1.formatAddress)(o.host, o.port || 3389)}`;
+        // As text, as getDescription reads them: the profile selector asks this of every profile too.
+        const username = (0, desktops_1.configText)(o.username);
+        return o.via ? null : `${username ? `${username}@` : ''}${(0, desktopForm_1.formatAddress)((0, desktops_1.configText)(o.host), (0, osd_1.configNumber)(o.port || 3389))}`;
     }
     deleteProfile(profile) {
-        // A direct desktop's saved account and certificate are its own; one behind a host shares them with that host's
-        // desktop at the same address.
+        // A direct desktop's saved passwords (through any gateway: one it went through before too) and certificate are
+        // its own; one behind a host shares them with that host's desktop at the same address.
         if (!profile.options.via) {
-            const id = (0, desktops_1.desktopIdOf)(profile.options);
-            (0, signin_1.forgetCredentials)(`${desktops_1.DIRECT_KEY}#${id}`);
-            this.injector.get(desktop_service_1.RemoteDesktopService).forgetCertificatesFor(id, true);
-            this.config.save();
+            this.injector.get(desktop_service_1.RemoteDesktopService).forgetDesktop((0, desktops_1.desktopIdOf)(profile.options), true, `"${profile.name}"`).catch(() => null);
         }
     }
 };
@@ -392,4 +446,3 @@ exports.RDPProfileOpener = RDPProfileOpener = __decorate([
     (0, core_1.Injectable)(),
     __metadata("design:paramtypes", [desktop_service_1.RemoteDesktopService, core_1.NgZone])
 ], RDPProfileOpener);
-//# sourceMappingURL=rdpProfile.js.map

package/dist/remoteSetup.js

@@ -3,14 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.prepareRemoteDesktop = prepareRemoteDesktop;
 const fs = require("fs");
 const path = require("path");
+const desktops_1 = require("./desktops");
 const rdcleanpath_1 = require("./rdcleanpath");
 // Runs as the SSH user; needs no root. Prints exactly one `RD_OK port=N user=U pass=P cert=SHA256`,
 // `RD_XRDP port=N user=U` (no GNOME, but xrdp), `RD_WINDOWS` (a Windows host's POSIX sh) or `RD_ERR <reason>` line;
-// with RD_OK, also an RD_XRDP line when xrdp runs besides GNOME, `RD_CLIENTS N`, the clients connected already, and
-// `RD_TAKEN_OVER <client> <seconds ago>` after a recent take-over.
+// with RD_OK, also an RD_XRDP line when xrdp runs besides GNOME, `RD_CLIENTS N`, the clients connected already,
+// `RD_TAKEN_OVER <client> <seconds ago>` after a recent take-over, `RD_DESK <key>` with 'desk' on, and an `RD_NOTE <text>`
+// for each rc file it couldn't change.
 // The RDP password is generated once per remote user and kept in a 0600 file; grd reads credentials only
 // at startup, so grd is restarted only when its configuration actually changes (that drops live sessions).
-// (grdctl takes the credentials as arguments, so they are briefly visible in the remote's process list.)
+// Secrets never go on a command line, which any user there can see in the process list, except where grdctl can't
+// read the password from its input: then it is an argument once, when the credentials are set.
 const SETUP_SCRIPT = String.raw `
 say () { printf '%s\n' "$*"; }
 fail () { say "RD_ERR $*"; exit 0; }
@@ -59,12 +62,49 @@ OLD="$HOME/.local/share/tabby-remote-desktop"
 if [ -d "$OLD" ] && [ ! -e "$D" ]; then
     mv "$OLD" "$D" || fail "could not move $OLD to $D"
 fi
-for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
-    if [ -f "$rc" ] && grep -qF '# tabby-remote-desktop' "$rc"; then
-        sed -i.trd-bak '/# tabby-remote-desktop$/d' "$rc" && rm -f "$rc.trd-bak"
+mkdir -p "$D" && chmod 700 "$D" || fail "could not create $D"
+# The login hook ('desk'): this one line in ~/.bashrc and ~/.zshrc, added and removed exactly, so that a line of the
+# user's own that only looks like it stays.
+HOOK='[ -f "$HOME/.local/share/tabby-rdp/login.sh" ] && . "$HOME/.local/share/tabby-rdp/login.sh"  # tabby-rdp'
+# Takes the lines that are exactly $2 out of rc file $1 and changes nothing else. grep reads it byte by byte, as text
+# (LC_ALL=C, -a): otherwise a NUL byte, or a byte the host's locale can't read, has it leave lines out or print "Binary
+# file … matches" in their place. What it leaves must be the file less those lines, to the byte, and is written into
+# the file itself, so that a symbolic link to it, another name for it (a hard link), its mode and its owner all stay.
+# A file that can't be written (read-only) or doesn't add up is left as it is, and the setup says so (RD_NOTE).
+unhook () {
+    [ -f "$1" ] || return 0
+    LC_ALL=C grep -a -q -xF -- "$2" "$1" 2>/dev/null
+    case $? in 0) ;; 1) return 0 ;; *) say "RD_NOTE desk's line may be in $1, which can't be read"; return 0 ;; esac
+    uh_tmp=$(mktemp "$D/rc.XXXXXX") || { say "RD_NOTE desk's line stays in $1: no temporary file could be made in $D"; return 0; }
+    LC_ALL=C grep -a -v -xF -- "$2" "$1" > "$uh_tmp"
+    # 1: no line left, the file held only the hook. Each line taken out goes with its newline, and grep ends a last line
+    # that has none with one: so what is left is shorter by exactly that, or one byte longer than that. A step that fails
+    # counts as a mismatch (rather than ending the script, as a failed sum would).
+    if [ $? -le 1 ] && uh_was=$(wc -c < "$1") && uh_lines=$(LC_ALL=C grep -a -c -xF -- "$2" "$1") && uh_now=$(wc -c < "$uh_tmp"); then
+        uh_more=$(( $uh_now - ($uh_was - $uh_lines * (${"$"}{#2} + 1)) ))
+    else
+        uh_more=-1
     fi
+    if [ "$uh_more" != 0 ] && [ "$uh_more" != 1 ]; then
+        say "RD_NOTE desk's line stays in $1: the rest of it didn't copy exactly"
+    elif ! cat "$uh_tmp" 2>/dev/null > "$1"; then
+        # Not opened (read-only), the file is as it was, its line in it. Otherwise writing it failed on the way (a full
+        # disk): what it is to hold stays where the user can find it.
+        if ! LC_ALL=C grep -a -q -xF -- "$2" "$1" 2>/dev/null; then
+            say "RD_NOTE writing $1 failed; what it should hold (without desk's line) is in $uh_tmp"
+            return 0
+        fi
+        say "RD_NOTE desk's line stays in $1: it can't be written (read-only?)"
+    fi
+    rm -f "$uh_tmp"
+}
+# The hook from before 0.2, as those versions wrote it, and what it sources, where the old folder is still there (it
+# couldn't be moved over): so that a copy of the line that was changed since, and stays, does nothing either.
+OLD_HOOK='[ -f "$HOME/.local/share/tabby-remote-desktop/login.sh" ] && . "$HOME/.local/share/tabby-remote-desktop/login.sh"  # tabby-remote-desktop'
+for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
+    unhook "$rc" "$OLD_HOOK"
 done
-mkdir -p "$D" && chmod 700 "$D" || fail "could not create $D"
+rm -f "$OLD/login.sh"
 NEW_CERT=0
 if [ ! -s "$D/tls.key" ]; then
     openssl req -new -newkey rsa:3072 -days 3650 -nodes -x509 -subj "/CN=$(hostname)" \
@@ -77,8 +117,29 @@ CERT=$(openssl x509 -in "$D/tls.crt" -noout -fingerprint -sha256 2>/dev/null | s
 # 'desk' support (setting, off by default): interactive SSH logins start inside a shareable session (trd-pty,
 # or tmux), so 'desk' can attach this exact console to a terminal on the desktop. Rewritten on every connect;
 # opt out per login with TABBY_NO_SESSION=1. When the setting is off, the hook and helpers are removed.
+DESK_KEY=
 if [ "${"$"}{TRD_DESK:-0}" = 1 ]; then
 mkdir -p "$D/bin"
+# 'desk' sends this key with each request, and the plugin (told it below) ignores requests without it: anything shown
+# in a terminal could print the rest. Only this user can read it. Made once, like the RDP password: a key is a file of
+# this user's own (not a link), private, holding 128 bits in hex.
+desk_key () {
+    DESK_KEY=
+    [ -f "$D/desk-key" ] && [ ! -L "$D/desk-key" ] && [ -O "$D/desk-key" ] || return 1
+    DESK_KEY=$(cat "$D/desk-key")
+    case $DESK_KEY in *[!0-9a-f]*) DESK_KEY= ;; esac
+    [ ${"$"}{#DESK_KEY} = 32 ] || { DESK_KEY=; return 1; }
+    chmod 600 "$D/desk-key"
+}
+if ! desk_key; then
+    # Put in place in one step, where there is none: of two setups making one at once (two panes, or two computers),
+    # the first one's stays, and both report it.
+    T=$(mktemp "$D/desk-key.XXXXXX") && od -An -N16 -tx1 /dev/urandom | tr -d ' \n' > "$T" || fail "could not create a key for desk"
+    { [ -e "$D/desk-key" ] || [ -L "$D/desk-key" ]; } && ! desk_key && rm -f "$D/desk-key"
+    ln "$T" "$D/desk-key" 2>/dev/null || desk_key || mv -f "$T" "$D/desk-key"
+    rm -f "$T"
+    desk_key || fail "could not create a key for desk"
+fi
 cat > "$D/login.sh" <<'TRD_EOF'
 # tabby-rdp ('desk' setting): interactive SSH logins run inside a shareable session, so 'desk' in Tabby can
 # bring this console to the remote desktop. Backend ("native" trd-pty or "tmux") is in $TRD_HOME/backend.
@@ -128,7 +189,9 @@ fi
 # Which machine this is: a shared home folder puts this script on others too, and the tab may be connected to another
 # machine than the one this runs on (ssh typed in its console).
 MACHINE=$(cat /etc/machine-id 2>/dev/null || hostname)
-SEQ=$(printf '\033]7777;desk;%s;%s;%s;%s;%s;%s\007' "$(b64 "$SESSION")" "$(b64 "$SOCKET")" "$(b64 "$PWD")" "$(b64 "$KIND")" "$(b64 "$MACHINE")" "$(b64 "$(hostname)")")
+# What Tabby knows a real request by: other output can't read this.
+KEY=$(cat "$HOME/.local/share/tabby-rdp/desk-key" 2>/dev/null)
+SEQ=$(printf '\033]7777;desk;%s;%s;%s;%s;%s;%s;%s\007' "$(b64 "$SESSION")" "$(b64 "$SOCKET")" "$(b64 "$PWD")" "$(b64 "$KIND")" "$(b64 "$MACHINE")" "$(b64 "$(hostname)")" "$(b64 "$KEY")")
 if [ "$KIND" = tmux ]; then
     printf '\033Ptmux;\033%s\033\\' "$SEQ"   # tmux only lets it through as passthrough
 else
@@ -143,19 +206,18 @@ chmod 755 "$D/bin/trd-pty"
 printf '%s\n' "${"$"}{TRD_BACKEND:-native}" > "$D/backend"
 for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
     [ -f "$rc" ] || continue
-    grep -qF '# tabby-rdp' "$rc" && continue
-    # Only one line: turning desk off deletes exactly it, so on/off cycles leave the file as it was.
-    [ -z "$(tail -c1 "$rc")" ] || echo >> "$rc"
-    printf '[ -f "$HOME/.local/share/tabby-rdp/login.sh" ] && . "$HOME/.local/share/tabby-rdp/login.sh"  # tabby-rdp\n' >> "$rc"
+    LC_ALL=C grep -a -q -xF -- "$HOOK" "$rc" && continue
+    # Only one line: turning desk off deletes exactly it, so on/off cycles leave the file as it was. A line of its own:
+    # a newline first, unless the file is empty or its last byte is one (counted, as a NUL there reads as nothing).
+    { [ ! -s "$rc" ] || [ $(( $(tail -c1 "$rc" | wc -l) )) = 1 ] || echo; printf '%s\n' "$HOOK"; } 2>/dev/null >> "$rc" \
+        || say "RD_NOTE desk's line couldn't be added to $rc (read-only?): logins there don't start in a shared session"
 done
 else
     for rc in "$HOME/.bashrc" "$HOME/.zshrc"; do
-        if [ -f "$rc" ] && grep -qF '# tabby-rdp' "$rc"; then
-            sed -i.trd-bak '/# tabby-rdp$/d' "$rc" && rm -f "$rc.trd-bak"
-        fi
+        unhook "$rc" "$HOOK"
     done
     # Sessions already running keep going; new logins are plain again.
-    rm -f "$D/login.sh" "$D/tmux.conf" "$D/backend" "$D/bin/desk" "$D/bin/trd-pty"
+    rm -f "$D/login.sh" "$D/tmux.conf" "$D/backend" "$D/bin/desk" "$D/bin/trd-pty" "$D/desk-key"
 fi
 if [ ! -s "$D/rdp-password" ]; then
     ( umask 077; od -An -N18 -tx1 /dev/urandom | tr -d ' \n' > "$D/rdp-password" ) || fail "could not create credentials"
@@ -164,7 +226,11 @@ RD_USER=tabby
 RD_PASS=$(cat "$D/rdp-password")
 
 STATUS=$(grdctl --headless status --show-credentials 2>/dev/null)
-has () { printf '%s\n' "$STATUS" | grep -qxF "$(printf '\t%s' "$1")"; }
+TAB=$(printf '\t') NL='
+'
+# Whether grd's status has this line. Compared in the shell: as a command's argument, the password would show in the
+# process list on every connect.
+has () { case "$NL$STATUS$NL" in *"$NL$TAB$1$NL"*) return 0 ;; esac; return 1; }
 g () { grdctl --headless rdp "$@" >/dev/null 2>&1; }
 RESTART=0
 # grd reads the certificate at startup: a new one at the same path needs a restart too, or grd would keep serving
@@ -176,7 +242,18 @@ fi
 if ! has "View-only: no"; then g disable-view-only || fail "grdctl could not disable view-only"; RESTART=1; fi
 if ! has "Status: enabled"; then g enable || fail "grdctl could not enable RDP"; RESTART=1; fi
 if ! has "Username: $RD_USER" || ! has "Password: $RD_PASS"; then
-    g set-credentials "$RD_USER" "$RD_PASS" || fail "grdctl could not set credentials"
+    # Left off the command line, the password stays out of the process list: grdctl versions that ask for it then read
+    # it from their input. Where that didn't take, it goes as an argument. Without timeout(1) on the host, grdctl runs
+    # as it is: its input is a pipe that ends after the password, so it doesn't wait for more.
+    if command -v timeout >/dev/null 2>&1; then
+        printf '%s\n' "$RD_PASS" | timeout 10 grdctl --headless rdp set-credentials "$RD_USER" >/dev/null 2>&1
+    else
+        printf '%s\n' "$RD_PASS" | grdctl --headless rdp set-credentials "$RD_USER" >/dev/null 2>&1
+    fi
+    STATUS=$(grdctl --headless status --show-credentials 2>/dev/null)
+    if ! has "Username: $RD_USER" || ! has "Password: $RD_PASS"; then
+        g set-credentials "$RD_USER" "$RD_PASS" || fail "grdctl could not set credentials"
+    fi
     RESTART=1
 fi
 
@@ -309,6 +386,7 @@ if [ -s "$D/taken-over" ]; then
 fi
 # xrdp besides GNOME (on a port of its own; on grd's, one of them couldn't listen): offered as another desktop.
 [ -z "$XRDP_PORT" ] || [ "$XRDP_PORT" = "$PORT" ] || say "RD_XRDP port=$XRDP_PORT user=$(id -un)"
+[ -z "$DESK_KEY" ] || say "RD_DESK $DESK_KEY"
 say "RD_OK port=$PORT user=$RD_USER pass=$RD_PASS cert=$CERT"
 `;
 let trdPtySource = null;
@@ -343,9 +421,10 @@ async function prepareRemoteDesktop(target, desk, backend = 'native', client = '
     // it worth asking, so a Linux host costs nothing extra.
     if (/^RD_WINDOWS$/m.test(out) || !/^RD_(OK|XRDP|ERR) /m.test(out) && await isWindows(target)) {
         // Its RDP server makes its own certificate: trusted on first use, like a desktop behind the host.
-        return { kind: 'windows', port: 3389, username: target.key.replace(/@[^@]*$/, ''), password: '', certificate: '' };
+        return { kind: 'windows', port: 3389, username: (0, desktops_1.keyUser)(target.key), password: '', certificate: '' };
     }
-    const err = /^RD_ERR (.*)$/m.exec(out);
+    // The host's reason, as much of it as a status line shows: the host decides how long the line is.
+    const err = /^RD_ERR (.{0,1000})/m.exec(out);
     if (err) {
         throw new Error(err[1]);
     }
@@ -354,13 +433,15 @@ async function prepareRemoteDesktop(target, desk, backend = 'native', client = '
     if (ok) {
         const certificate = (0, rdcleanpath_1.normalizeFingerprint)(ok[4]);
         if (!certificate) {
-            throw new Error(`Remote setup reported no usable certificate fingerprint (${ok[4]})`);
+            // What the host put there, as long as it likes: as much of it as a fingerprint takes, for a status line.
+            throw new Error(`Remote setup reported no usable certificate fingerprint (${ok[4].slice(0, 100)})`);
         }
         const clients = Number(/^RD_CLIENTS (\d+)$/m.exec(out)?.[1] ?? 0);
         const taken = /^RD_TAKEN_OVER (\S+) (\d+)$/m.exec(out);
         return {
             kind: 'gnome', port: Number(ok[1]), username: ok[2], password: ok[3], certificate, xrdpPort: xrdp ? Number(xrdp[1]) : undefined, xrdpUser: xrdp?.[2],
-            clients, takenOver: taken && taken[1] !== client ? Number(taken[2]) : undefined,
+            clients, takenOver: taken && taken[1] !== client ? Number(taken[2]) : undefined, deskKey: /^RD_DESK ([0-9a-f]{32})$/m.exec(out)?.[1],
+            notes: [...out.matchAll(/^RD_NOTE (.+)$/gm)].map(m => m[1]),
         };
     }
     if (xrdp) {
@@ -369,4 +450,3 @@ async function prepareRemoteDesktop(target, desk, backend = 'native', client = '
     }
     throw new Error('Remote setup gave no result');
 }
-//# sourceMappingURL=remoteSetup.js.map

package/dist/sessionLog.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionLog = void 0;
+/**
+ * A line as a string of its own. V8 keeps a part cut out of a string (a slice, a pattern's match; 13 characters or
+ * more) as a view of the string it came from, and joining strings as a list of them: a short line made from a host's
+ * answer of megabytes would keep all of it in memory for as long as the line is kept. Joined to a character and cut
+ * from it again: V8 copies a joined string's characters into one string before it cuts a part out of it, so the line
+ * is a part of that copy, every character as it was, unpaired surrogates included. A copy through UTF-16 and back
+ * does the same at several times the cost, which every line logged pays.
+ */
+function copied(line) {
+    return (' ' + line).slice(1);
+}
+/**
+ * A desktop's connection log (DesktopSession.log): what the settings page's Copy log hands out. Much of it is of the
+ * remote's making (an RD Gateway's administrator's messages, a server's), which decides how many lines there are and
+ * when, for as long as the desktop stays open: kept whole, they could fill Tabby's memory and crash its window. So the
+ * log keeps the first lines (how the connection was set up) and the latest ones, with a line between them saying how
+ * many were left out, and each line is cut at MAX_LINE characters and kept as a copy of its own (see copied), which
+ * the text it was made from doesn't stay in memory with.
+ */
+class SessionLog extends Array {
+    constructor() {
+        super(...arguments);
+        /** How many lines were left out so far. */
+        this.dropped = 0;
+    }
+    // What is made from the log (filter, slice, map) is a plain array.
+    static get [Symbol.species]() {
+        return Array;
+    }
+    push(...lines) {
+        const { FIRST, LATEST, MAX_LINE } = SessionLog;
+        super.push(...lines.map(line => typeof line === 'string' ? copied(line.length > MAX_LINE ? `${line.slice(0, MAX_LINE)}…` : line) : line));
+        // Once the latest lines are twice as many as are kept, the older half of them goes in one step: each line then
+        // costs the same however many come.
+        const said = this.dropped ? 1 : 0;
+        const over = this.length - FIRST - said - LATEST;
+        if (over >= LATEST) {
+            this.dropped += over;
+            this.splice(FIRST, said + over, `(${this.dropped} lines left out here)`);
+        }
+        return this.length;
+    }
+}
+exports.SessionLog = SessionLog;
+/** The first lines, kept whatever follows. */
+SessionLog.FIRST = 200;
+/** At least this many of the latest lines are kept (and at most twice as many, see push). */
+SessionLog.LATEST = 2000;
+/** The longest a line is kept. */
+SessionLog.MAX_LINE = 4096;