tabby-rdp 0.4.1 → 0.5.1

package/dist/authorities.js

@@ -0,0 +1,331 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.certificateAuthorities = certificateAuthorities;
+exports.chainStanding = chainStanding;
+exports.whyNotValid = whyNotValid;
+exports.certificateDetails = certificateDetails;
+exports.describeCertificate = describeCertificate;
+exports.vouched = vouched;
+/**
+ * What a server's certificate is checked against where an authority's word is enough to connect without asking (a
+ * desktop connected to directly, an RD Gateway; see RemoteDesktopService.checkTrusted), why one that fails doesn't
+ * pass, and what a certificate says of itself, in words for the user.
+ */
+const crypto_1 = require("crypto");
+const tls = require("tls");
+const unshowable_1 = require("./unshowable");
+let authorities = null;
+let systemRead = false;
+/**
+ * The certificate authorities a server's certificate is checked against: Node's own list (Mozilla's, and any in
+ * NODE_EXTRA_CA_CERTS) and those of this computer's own store, such as an organisation's authority an administrator
+ * installed, where Tabby's Node.js can read that store (tls.getCACertificates, Node 22.15 and later). Read once.
+ * Undefined: Node's own list alone, its default.
+ */
+function certificateAuthorities() {
+    if (authorities === null) {
+        authorities = undefined;
+        const read = tls.getCACertificates;
+        if (typeof read === 'function') {
+            try {
+                const own = read('default');
+                try {
+                    authorities = [...new Set([...own, ...read('system')])];
+                    systemRead = true;
+                }
+                catch {
+                    authorities = own;
+                }
+            }
+            catch {
+                authorities = undefined;
+            }
+        }
+    }
+    return authorities;
+}
+/** Anchors by the `ca` list they were read from. */
+const anchorsByList = new WeakMap();
+function anchorsOf(authorities) {
+    const cached = typeof authorities === 'object' && authorities ? anchorsByList.get(authorities) : undefined;
+    if (cached) {
+        return cached;
+    }
+    const found = { fingerprints: new Set(), keys: new Set() };
+    for (const item of [authorities ?? []].flat()) {
+        for (const pem of String(item).matchAll(/-----BEGIN CERTIFICATE-----([^-]+)-----END CERTIFICATE-----/g)) {
+            const der = Buffer.from(pem[1].replace(/\s/g, ''), 'base64');
+            const hex = (0, crypto_1.createHash)('sha256').update(der).digest('hex').toUpperCase();
+            found.fingerprints.add(hex.replace(/(..)(?!$)/g, '$1:'));
+            const key = nameAndKey(der);
+            if (key) {
+                found.keys.add(key);
+            }
+        }
+    }
+    if (typeof authorities === 'object' && authorities) {
+        anchorsByList.set(authorities, found);
+    }
+    return found;
+}
+/**
+ * A certificate's subject and public key (from its DER), by which an authority is known whichever of its certificates
+ * comes: a certificate below it was signed with that key. '' when it can't be read.
+ */
+function nameAndKey(der) {
+    try {
+        const certificate = new crypto_1.X509Certificate(der);
+        return `${certificate.subject}\n${certificate.publicKey.export({ type: 'spki', format: 'der' }).toString('base64')}`;
+    }
+    catch {
+        return '';
+    }
+}
+/** Whether `issuer`'s key made the signature on `certificate` (both as Node reads them: their DER is `raw`). */
+function signedBy(certificate, issuer) {
+    try {
+        return new crypto_1.X509Certificate(certificate.raw).verify(new crypto_1.X509Certificate(issuer.raw).publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a certificate (its DER) names itself as its issuer and is signed with its own key, whatever its key usage.
+ * Node makes such a certificate its own issuer only where its key usage allows signing certificates, which that of
+ * Windows' own RDP certificate (key and data encipherment) and of a self-signed gateway's often don't.
+ */
+function selfSigned(der) {
+    try {
+        const certificate = new crypto_1.X509Certificate(der);
+        return certificate.issuer === certificate.subject && certificate.verify(certificate.publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether a certificate (its DER) may issue others: an authority by its basic constraints (and key usage, if any). */
+function issuesCertificates(der) {
+    try {
+        return new crypto_1.X509Certificate(der).ca;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where the chain of a server's certificate stands (see ChainStanding) by `authorities`: the `ca` its connection was
+ * checked against, or Node's own list without one. From Node's reading of the chain (getPeerCertificate(true)), which
+ * follows the certificates the server sent, then those authorities, by the issuer each certificate names. Each link is
+ * checked here as the TLS library checks it: the certificate was signed with the next one's key, and the next one may
+ * issue certificates (an authority by its basic constraints, or one of the authorities whatever it says: an old root
+ * says nothing). So a certificate that only names an authority, or one signed with the key of an authority's
+ * certificate for a server, doesn't count as that authority's. One of the authorities is known by its fingerprint, or
+ * by its subject and key (see Anchors), as the TLS library takes it.
+ *
+ * Node's code for why a certificate isn't valid (TLSSocket.authorizationError) is the last of the TLS library's
+ * checks that failed, and whoever makes the certificate can choose which: one that is marked for other uses than a
+ * server's (INVALID_PURPOSE), or that has expired, gets that code whoever issued it, a made-up authority included.
+ * This says what the code can hide.
+ */
+function chainStanding(certificate, authorities) {
+    const anchors = anchorsOf(authorities ?? certificateAuthorities() ?? tls.rootCertificates);
+    const anchor = (c) => anchors.fingerprints.has(c.fingerprint256) || anchors.keys.has(nameAndKey(c.raw));
+    const seen = new Set();
+    let current = certificate;
+    while (current?.raw && !seen.has(current.fingerprint256)) {
+        if (anchor(current)) {
+            return 'authority';
+        }
+        seen.add(current.fingerprint256);
+        if (selfSigned(current.raw)) {
+            return current === certificate ? 'self-signed' : 'unknown authority';
+        }
+        // Node also makes a certificate that names itself as its issuer, but wasn't signed with its own key, its own
+        // issuer: the one that signed it isn't there.
+        const issuer = current.issuerCertificate;
+        if (!issuer?.raw || issuer.fingerprint256 === current.fingerprint256 || !signedBy(current, issuer) || !(issuesCertificates(issuer.raw) || anchor(issuer))) {
+            return 'incomplete';
+        }
+        current = issuer;
+    }
+    return 'incomplete';
+}
+/** Server authentication, in an extended key usage. */
+const SERVER_AUTH = '1.3.6.1.5.5.7.3.1';
+/** Whether a certificate's details (see CertificateDetails) mark it for other uses than a server's. */
+function otherUses(details) {
+    return !!details?.extendedKeyUsage && !details.extendedKeyUsage.includes(SERVER_AUTH);
+}
+/**
+ * Why a certificate isn't valid for `name` by those authorities, in words. Where the plugin checked it itself
+ * (`details` with a `chain`, see certificateDetails): first where its chain stands, unless it leads to an authority
+ * this computer trusts (otherwise nothing in the certificate is any authority's word); then whether it was issued for
+ * another name, its dates and the uses it is marked for; and, for a chain that leads to an authority, what else the
+ * TLS library found (Node's code, from TLSSocket.authorizationError), which is then about another certificate in the
+ * chain, or a check of the library's own. Without those checks, from Node's code alone. An unknown code is named as it
+ * is.
+ */
+function whyNotValid(reason, name, details) {
+    certificateAuthorities();
+    // The server sent its authority's own certificate, which this computer doesn't trust. Without the system's store,
+    // an organisation's own authority is one Tabby doesn't know, whatever the computer trusts: said so rather than
+    // claimed otherwise.
+    const untrusted = systemRead
+        ? 'it isn\'t from a certificate authority this computer trusts'
+        : 'it isn\'t from a certificate authority Tabby checks against (the public ones; an organisation\'s own counts as unknown here)';
+    // No way to an authority from what the server sent: the issuer a certificate names is its own word. Windows fetches
+    // an intermediate certificate a server leaves out by itself; Node doesn't. But that is no likelier than a
+    // certificate naming an issuer that never signed it, which anyone can make.
+    const incomplete = `no certificate authority ${systemRead ? 'this computer trusts' : 'Tabby checks against (the public ones; an organisation\'s own counts as unknown here)'} ` +
+        'vouches for it from what the server sent (a server can leave out an intermediate certificate, which Tabby doesn\'t fetch, but any server can name any issuer)';
+    const selfSigned = 'it is self-signed (made by the server itself, as RDP servers make theirs unless given one), so no certificate authority vouches for it';
+    const anotherName = `it was issued for another name than ${name}`;
+    const expired = 'it has expired';
+    const notYet = 'it isn\'t valid yet (or this computer\'s clock is wrong)';
+    const marked = 'it is marked for other uses than a server\'s (its extended key usage)';
+    const chain = details?.chain;
+    if (chain) {
+        const parts = chain === 'self-signed' ? [selfSigned] : chain === 'unknown authority' ? [untrusted] : chain === 'incomplete' ? [incomplete] : [];
+        // Node checks the name only once the chain checked out; the plugin checked it whatever the chain.
+        const named = details.forName === undefined ? reason !== 'ERR_TLS_CERT_ALTNAME_INVALID' : details.forName;
+        if (!named) {
+            parts.push(anotherName);
+        }
+        // From its own dates: the code can be another certificate's, or another check's.
+        const now = Date.now();
+        const from = Date.parse(details.validFrom);
+        const to = Date.parse(details.validTo);
+        const past = Number.isNaN(to) ? reason === 'CERT_HAS_EXPIRED' : to < now;
+        const early = Number.isNaN(from) ? reason === 'CERT_NOT_YET_VALID' : from > now;
+        if (past) {
+            parts.push(expired);
+        }
+        if (early) {
+            parts.push(notYet);
+        }
+        // An organisation's Remote Desktop certificate template can name only the Remote Desktop use, not a server's:
+        // said so only of a certificate for this name whose chain leads to an authority this computer trusts.
+        // Otherwise anyone may have made it so.
+        const uses = otherUses(details);
+        if (uses) {
+            parts.push(chain === 'authority' && named ? `${marked}, as some organisations' Remote Desktop certificates are` : marked);
+        }
+        // A chain that leads to an authority, and a code that none of the above accounts for: it is about another
+        // certificate in the chain (an intermediate one that has expired, one marked for other uses), or a check of the
+        // TLS library's own.
+        const accounted = reason === 'ERR_TLS_CERT_ALTNAME_INVALID' ? !named : reason === 'CERT_HAS_EXPIRED' ? past
+            : reason === 'CERT_NOT_YET_VALID' ? early : reason === 'INVALID_PURPOSE' ? uses : false;
+        if (chain === 'authority' && !accounted) {
+            parts.push(reason === 'CERT_HAS_EXPIRED' ? 'a certificate in its chain has expired'
+                : reason === 'CERT_NOT_YET_VALID' ? 'a certificate in its chain isn\'t valid yet (or this computer\'s clock is wrong)'
+                    : reason === 'INVALID_PURPOSE' ? 'a certificate in its chain isn\'t one that may vouch for it'
+                        : `it couldn't be verified${reason ? ` (${reason})` : ''}`);
+        }
+        return parts.length > 1 ? `${parts.slice(0, -1).join(', ')}, and ${parts[parts.length - 1]}` : parts[0] ?? 'it couldn\'t be verified';
+    }
+    switch (reason) {
+        case 'DEPTH_ZERO_SELF_SIGNED_CERT':
+            return selfSigned;
+        case 'SELF_SIGNED_CERT_IN_CHAIN':
+            return untrusted;
+        case 'UNABLE_TO_GET_ISSUER_CERT':
+        case 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY':
+        case 'UNABLE_TO_VERIFY_LEAF_SIGNATURE':
+            return incomplete;
+        case 'INVALID_PURPOSE':
+            // Without the chain checked, the code may stand for a certificate anyone made (see chainStanding).
+            return `${marked}; it may also be self-signed, or not from a certificate authority this computer trusts`;
+        case 'CERT_HAS_EXPIRED':
+            return expired;
+        case 'CERT_NOT_YET_VALID':
+            return notYet;
+        case 'ERR_TLS_CERT_ALTNAME_INVALID':
+            return anotherName;
+        case '':
+            return 'no certificate authority vouches for it';
+        default:
+            return `it couldn't be verified (${reason})`;
+    }
+}
+/**
+ * The codes of the TLS library's verdict (TLSSocket.authorizationError) that the plugin's own reading of a certificate
+ * accounts for, as whyNotValid puts them: where its chain stands, its name, its dates and the uses it is marked for.
+ * For a chain that leads to an authority this computer trusts, any other code is a check the library made and the
+ * plugin doesn't (a limit the authority set on the names it signs for, on the length of a path, the strength of a key
+ * or a digest, a revocation): the chain's standing says nothing of what the library refused there.
+ */
+const READ_REASONS = new Set([
+    'ERR_TLS_CERT_ALTNAME_INVALID', 'CERT_HAS_EXPIRED', 'CERT_NOT_YET_VALID', 'INVALID_PURPOSE', 'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'UNABLE_TO_GET_ISSUER_CERT', 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+]);
+/**
+ * A certificate's details, from Node's reading of it (TLSSocket.getPeerCertificate(true)); undefined without one.
+ * `checked`: it isn't valid for `name` by `authorities` (as its connection was checked), for Node's `reason`, and the
+ * plugin checks it itself: where its chain stands, and whether it was issued for that name, which Node checks only
+ * once the chain checked out. So a name Node found wrong (ERR_TLS_CERT_ALTNAME_INVALID) says the TLS library took the
+ * chain to one of the authorities, whatever Node's reading of the chain shows (an issuer of the same name the server
+ * sent ahead of the one that signed, say).
+ */
+function certificateDetails(certificate, checked) {
+    if (!certificate || typeof certificate !== 'object' || !certificate.valid_to) {
+        return undefined;
+    }
+    const uses = Array.isArray(certificate.ext_key_usage) ? certificate.ext_key_usage.filter(use => typeof use === 'string') : undefined;
+    let forName;
+    if (checked) {
+        try {
+            forName = !tls.checkServerIdentity(checked.name, certificate);
+        }
+        catch { }
+    }
+    // A field can hold several values (two common names, say), which Node gives as an array.
+    const text = (value) => Array.isArray(value) ? value.map(String).join(', ') : typeof value === 'string' ? value : '';
+    const issuer = [text(certificate.issuer?.CN), text(certificate.issuer?.O)].filter(Boolean);
+    const chain = checked ? checked.reason === 'ERR_TLS_CERT_ALTNAME_INVALID' ? 'authority' : chainStanding(certificate, checked.authorities) : undefined;
+    return {
+        subject: text(certificate.subject?.CN),
+        // `DNS:pc.example, IP Address:10.0.0.5`: the names and addresses, without their kind.
+        names: typeof certificate.subjectaltname === 'string'
+            ? certificate.subjectaltname.split(/, (?=[A-Za-z ]+:)/).map(name => name.replace(/^(DNS|IP Address):/, ''))
+            : [],
+        issuer: issuer.length === 2 && issuer[0] !== issuer[1] ? `${issuer[0]} (${issuer[1]})` : issuer[0] ?? '',
+        validFrom: String(certificate.valid_from ?? ''),
+        validTo: String(certificate.valid_to ?? ''),
+        ...uses ? { extendedKeyUsage: uses } : {},
+        ...chain ? { chain } : {},
+        ...forName === undefined ? {} : { forName },
+        ...chain === 'authority' && !READ_REASONS.has(checked?.reason ?? '') ? { unchecked: true } : {},
+    };
+}
+/**
+ * A certificate's details in a line: "Issued to <name> (<names>) by <issuer>, valid <from> to <to>." The server chose
+ * all of it, so what could reorder or hide part of it shows as U+FFFD, and each part is cut short. `unchecked`: no
+ * authority vouched for the certificate, so the line says that this is its own word, which nothing has checked: a
+ * certificate anyone made can name the issuer one would expect, and the question shown with it is where that matters.
+ * (One whose chain leads to an authority this computer trusts is that authority's word, whatever else is wrong with
+ * it, unless the TLS library refused it for a reason of its own: see vouched.)
+ */
+function describeCertificate(details, unchecked = false) {
+    const date = (text) => {
+        const time = new Date(text);
+        return Number.isNaN(time.getTime()) ? (0, unshowable_1.showable)(text, 40) : `${time.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+    };
+    const listed = details.names.slice(0, 8).join(', ') + (details.names.length > 8 ? `, and ${details.names.length - 8} more` : '');
+    const what = `${(0, unshowable_1.showable)(details.subject || '(no name)', 100)}${listed ? ` (${(0, unshowable_1.showable)(listed, 300)})` : ''} ` +
+        `by ${(0, unshowable_1.showable)(details.issuer || '(no name)', 100)}, valid ${date(details.validFrom)} to ${date(details.validTo)}`;
+    return unchecked
+        ? `It says it was issued to ${what}: its own word, which nothing here has checked; a certificate anyone made can say the same.`
+        : `Issued to ${what}.`;
+}
+/**
+ * Whether what a certificate says of itself (`details`) is more than its own word: an authority vouched for it
+ * (`valid`), or its chain leads to an authority this computer trusts, though the certificate isn't valid here (issued
+ * for another name, expired, marked for other uses): an authority's word all the same, and the names in it are what
+ * show it to be another machine's. Not where the TLS library refused the certificate for a reason the plugin's reading
+ * doesn't account for (`unchecked`, see READ_REASONS): the authority's word may be limited, say to other names, in a
+ * way nothing here checks.
+ */
+function vouched(valid, details) {
+    return valid === true || details?.chain === 'authority' && !details.unchecked;
+}

package/dist/byteQueue.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ByteQueue = void 0;
+/**
+ * Bytes from a stream, kept as they arrived and taken off the front a whole message at a time. Joining each arrival
+ * onto all that is still waiting copies all of it again every time: a message that comes a byte at a time (a server
+ * can send one-byte TLS records) costs the square of its size, on the thread that runs Tabby's window. Here a byte is
+ * copied in once, as it arrives, and at most once more, when the message it is in is taken.
+ *
+ * What arrives is copied into storage of the queue's own rather than kept as it came: a piece can be a few bytes of a
+ * much larger buffer (a TLS record that also held other frames, say), and keeping the piece would keep all of that
+ * buffer too. A sender that had each record add a byte to a message it never finishes could otherwise have a whole
+ * record kept for every byte. So the queue holds what is waiting, and at most two slabs more.
+ */
+class ByteQueue {
+    constructor() {
+        /** Storage, oldest first: what is waiting runs from `offset` in the first slab to `filled` in the last. */
+        this.slabs = [];
+        this.offset = 0;
+        this.filled = 0;
+        /** How many bytes are waiting. */
+        this.length = 0;
+    }
+    push(chunk) {
+        for (let at = 0; at < chunk.length;) {
+            let last = this.slabs[this.slabs.length - 1];
+            if (!last || this.filled === last.length) {
+                if (!this.length) {
+                    // Nothing is waiting: the slabs there are only hold what was taken.
+                    this.slabs = [];
+                    this.offset = 0;
+                }
+                // Not from Node's pool, whose slabs are shared with whatever else is small.
+                last = Buffer.allocUnsafeSlow(ByteQueue.SLAB);
+                this.slabs.push(last);
+                this.filled = 0;
+            }
+            const n = Math.min(chunk.length - at, last.length - this.filled);
+            last.set(chunk.subarray(at, at + n), this.filled);
+            this.filled += n;
+            this.length += n;
+            at += n;
+        }
+    }
+    /** Where what is waiting in slab `i` ends. */
+    endOf(i) {
+        return i === this.slabs.length - 1 ? this.filled : this.slabs[i].length;
+    }
+    /** The first `n` bytes (or all there are, if fewer), left in place: for a header, so `n` is small. */
+    peek(n) {
+        n = Math.min(n, this.length);
+        if (!n) {
+            return Buffer.alloc(0);
+        }
+        if (this.endOf(0) - this.offset >= n) {
+            return this.slabs[0].subarray(this.offset, this.offset + n);
+        }
+        const out = Buffer.alloc(n);
+        for (let i = 0, copied = 0; copied < n; i++) {
+            const from = i ? 0 : this.offset;
+            copied += this.slabs[i].copy(out, copied, from, Math.min(this.endOf(i), from + n - copied));
+        }
+        return out;
+    }
+    /**
+     * Takes the first `n` bytes (at most all there are): part of the slab they are in when they are in one, else a
+     * copy, made once. What is written to a slab stays as it is, so such a part doesn't change after it is taken.
+     */
+    take(n) {
+        n = Math.min(n, this.length);
+        if (!n) {
+            return Buffer.alloc(0);
+        }
+        let out;
+        if (this.endOf(0) - this.offset >= n) {
+            out = this.slabs[0].subarray(this.offset, this.offset + n);
+            this.offset += n;
+        }
+        else {
+            out = Buffer.allocUnsafe(n);
+            for (let copied = 0; copied < n;) {
+                const end = Math.min(this.endOf(0), this.offset + n - copied);
+                copied += this.slabs[0].copy(out, copied, this.offset, end);
+                this.offset = end;
+                if (copied < n) {
+                    this.slabs.shift();
+                    this.offset = 0;
+                }
+            }
+        }
+        this.length -= n;
+        // A slab whose bytes have all been taken is let go, unless it is the one being filled.
+        if (this.offset === this.endOf(0) && this.slabs.length > 1) {
+            this.slabs.shift();
+            this.offset = 0;
+        }
+        return out;
+    }
+}
+exports.ByteQueue = ByteQueue;
+/** How large each slab of storage is. */
+ByteQueue.SLAB = 64 * 1024;

package/dist/clipboard.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * Clipboard sharing with remote desktops: the ways the clipboard goes (the setting `clipboard`, or a desktop's own),
+ * and IronRDP's component set up for them before each connection.
+ *
+ * While a desktop has the keyboard, the component reads this computer's clipboard every 100 ms and announces what
+ * changed to the server, and it writes what the server's clipboard gets to this one; files go through the same
+ * channel (CLIPRDR, see fileTransfer.ts). What the component lets the plugin enforce:
+ * - Off: the component's clipboard turned off, so IronRDP leaves the clipboard channel out of the connection (it
+ *   attaches CLIPRDR only with the clipboard callbacks the component hands it). Nothing goes either way, files
+ *   included, and this computer's clipboard isn't read.
+ * - Only from the remote desktop: the reading stopped through the hook the component composes into the file transfer
+ *   provider (`onUploadStarted`, which it has to keep the reading from overwriting a paste of files), with the
+ *   matching `onUploadFinished` held back so that nothing starts it again. A server connected this way only ever
+ *   gets an empty clipboard from this side (one narrowed to it while connected gets that in full from its next
+ *   connection: see RemoteDesktopService.applyClipboard); the plugin's own sending (paste to all, files) checks the
+ *   ways as well.
+ * The other way only, from this computer to the remote desktop, isn't offered.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIPBOARD_LABELS = void 0;
+exports.ownClipboard = ownClipboard;
+exports.clipboardSetting = clipboardSetting;
+exports.clipboardWays = clipboardWays;
+exports.narrowest = narrowest;
+exports.setUpClipboard = setUpClipboard;
+exports.splitPaste = splitPaste;
+/** The modes, in the order the settings page, the forms and the menus offer them. */
+exports.CLIPBOARD_LABELS = {
+    both: 'Both ways',
+    fromRemote: 'Only from the remote desktop to this computer',
+    off: 'Off',
+};
+/**
+ * A desktop's own mode (its entry's or profile's `clipboard`): none when unset or empty, so the setting applies. A
+ * value the plugin doesn't know (one written by hand, say) is off: what limits the clipboard must never end up
+ * letting more through than it says.
+ */
+function ownClipboard(value) {
+    if (value === undefined || value === null || value === '') {
+        return undefined;
+    }
+    return value === 'both' || value === 'fromRemote' || value === 'off' ? value : 'off';
+}
+/** The setting's mode: both ways when unset (the default, and how the clipboard always went), else as ownClipboard. */
+function clipboardSetting(value) {
+    return ownClipboard(value) ?? 'both';
+}
+/** The ways that every one of the modes lets the clipboard go. */
+function clipboardWays(...modes) {
+    return {
+        toRemote: modes.every(mode => mode === 'both'),
+        fromRemote: modes.every(mode => mode !== 'off'),
+    };
+}
+/** The mode that lets the clipboard go only the ways every one of the modes does. */
+function narrowest(...modes) {
+    const ways = clipboardWays(...modes);
+    return ways.toRemote && ways.fromRemote ? 'both' : ways.fromRemote ? 'fromRemote' : 'off';
+}
+/**
+ * Sets up the component's clipboard for `mode`, before connect(): registers the provider (files through the
+ * clipboard) and turns off what the mode doesn't allow. `sending` says whether this computer's clipboard may still go
+ * to the desktop: while it may, a paste of files ends with the component's reading started again, as usual.
+ */
+function setUpClipboard(ui, provider, mode, sending) {
+    if (typeof ui.setEnableClipboard !== 'function') {
+        throw new Error('this build of IronRDP can\'t turn its clipboard off');
+    }
+    // Registering the provider is what composes the hooks, and it turns the component's clipboard on: whatever is turned
+    // off comes after it.
+    const own = provider.onUploadStarted;
+    ui.enableFileTransfer(provider);
+    const stop = provider.onUploadStarted;
+    const resume = provider.onUploadFinished;
+    // Without the hooks composed (a component that doesn't), its reading can't be stopped: nothing goes either way.
+    const applied = typeof stop === 'function' && typeof resume === 'function' && stop !== own ? mode : 'off';
+    provider.onUploadFinished = () => {
+        if (sending()) {
+            resume?.call(provider);
+        }
+    };
+    const stopSending = () => stop?.call(provider);
+    if (applied !== 'both') {
+        stopSending();
+    }
+    if (applied === 'off') {
+        ui.setEnableClipboard(false);
+    }
+    return { mode: applied, stopSending };
+}
+/** Splits a paste to all desktops by the ways the clipboard goes with each one now (`waysOf`). */
+function splitPaste(desktops, waysOf, nameOf) {
+    const taking = desktops.map(desktop => waysOf(desktop).toRemote);
+    const targets = desktops.filter((_, i) => taking[i]);
+    const left = desktops.filter((_, i) => !taking[i]);
+    if (!left.length) {
+        return { targets, left, note: null };
+    }
+    const names = left.map(nameOf);
+    const which = names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}` : names[0];
+    const note = targets.length
+        ? `Pasting on ${targets.length} of ${desktops.length} desktops: not on ${which}, which ${left.length > 1 ? 'don\'t' : 'doesn\'t'} take this computer's clipboard.`
+        : `Not pasted: ${desktops.length > 1 ? 'these desktops don\'t' : 'this desktop doesn\'t'} take this computer's clipboard.`;
+    return { targets, left, note };
+}

package/dist/connectionStatus.js

@@ -137,4 +137,3 @@ class ConnectionStatus {
     }
 }
 exports.ConnectionStatus = ConnectionStatus;
-//# sourceMappingURL=connectionStatus.js.map

package/dist/desk.js

@@ -11,78 +11,48 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeskTriggerDecorator = void 0;
 const core_1 = require("@angular/core");
-const tabby_core_1 = require("tabby-core");
 const tabby_terminal_1 = require("tabby-terminal");
 const desktop_service_1 = require("./desktop.service");
 const targets_1 = require("./targets");
+const deskScript_1 = require("./deskScript");
 const probe_1 = require("./probe");
-const PREFIX = Buffer.from('\x1b]7777;');
-const BEL = 0x07;
-const ST = Buffer.from('\x1b\\');
-function parse(payload) {
-    const [session, socket, cwd, kind, machine, hostname] = payload.split(';').map(f => Buffer.from(f ?? '', 'base64').toString('utf8'));
-    // Older `desk` scripts sent no kind (they only knew tmux), and no machine.
-    return {
-        session: session ?? '', socket: socket ?? '', cwd: cwd ?? '', kind: kind ?? (session ? 'tmux' : ''),
-        machine: machine?.trim() ?? '', hostname: hostname?.trim() ?? '',
-    };
-}
 /** Strips `desk` requests (and probes, see probe.ts) out of a session's output and reports them. */
 class DeskTrigger extends tabby_terminal_1.SessionMiddleware {
-    constructor(onDesk, onProbe) {
+    constructor(known, onDesk, onProbe) {
         super();
         this.onDesk = onDesk;
         this.onProbe = onProbe;
+        this.requests = new deskScript_1.DeskRequests(known);
     }
     feedFromSession(data) {
         // Tabby's OSC processor runs first and passes unknown OSCs through whole, so each request
         // arrives complete within one chunk.
-        let start = data.indexOf(PREFIX);
-        while (start !== -1) {
-            const body = start + PREFIX.length;
-            const bel = data.indexOf(BEL, body);
-            const st = data.indexOf(ST, body);
-            const end = bel === -1 ? st : st === -1 ? bel : Math.min(bel, st);
-            if (end === -1) {
-                break;
-            }
-            const payload = data.subarray(body, end).toString('utf8');
-            data = Buffer.concat([data.subarray(0, start), data.subarray(end + (end === st ? ST.length : 1))]);
-            if (payload.startsWith('desk;')) {
-                const request = parse(payload.slice('desk;'.length));
-                setTimeout(() => this.onDesk(request));
-            }
-            else if (payload.startsWith('probe;')) {
-                this.onProbe(payload.slice('probe;'.length));
-            }
-            start = data.indexOf(PREFIX, start);
+        const { output, desk, probes } = this.requests.take(data);
+        probes.forEach(id => this.onProbe(id));
+        if (desk) {
+            setTimeout(() => this.onDesk(desk));
         }
-        if (data.length) {
-            super.feedFromSession(data);
+        if (output.length) {
+            super.feedFromSession(output);
         }
     }
 }
 /** Listens for `desk` in every terminal (SSH tabs and local terminals running ssh). */
 let DeskTriggerDecorator = class DeskTriggerDecorator extends tabby_terminal_1.TerminalDecorator {
-    constructor(desktop, zone, notifications) {
+    constructor(desktop, zone) {
         super();
         this.desktop = desktop;
         this.zone = zone;
-        this.notifications = notifications;
     }
     attach(terminal) {
         const install = () => {
-            terminal.session?.middleware.push(new DeskTrigger(request => this.zone.run(() => {
+            // Only requests with a key a host gave get this far, one in a while (see DeskRequests); the service checks
+            // the rest, the `desk` setting included.
+            terminal.session?.middleware.push(new DeskTrigger(key => this.desktop.knowsDeskKey(key), request => this.zone.run(() => {
                 const pane = (0, targets_1.desktopPaneOf)(terminal);
-                if (!pane) {
-                    return;
-                }
-                if (!this.desktop.settings().desk) {
-                    // A hook left from when it was on; it goes away the next time a desktop opens there.
-                    this.notifications.info('`desk` is off: turn it on in the menu under Remote Desktop › Settings');
-                    return;
+                if (pane) {
+                    this.desktop.openConsole(pane, request);
                 }
-                this.desktop.openConsole(pane, request);
             }), id => (0, probe_1.probeArrived)(id, terminal)));
         };
         install();
@@ -92,6 +62,5 @@ let DeskTriggerDecorator = class DeskTriggerDecorator extends tabby_terminal_1.T
 exports.DeskTriggerDecorator = DeskTriggerDecorator;
 exports.DeskTriggerDecorator = DeskTriggerDecorator = __decorate([
     (0, core_1.Injectable)(),
-    __metadata("design:paramtypes", [desktop_service_1.RemoteDesktopService, core_1.NgZone, tabby_core_1.NotificationsService])
+    __metadata("design:paramtypes", [desktop_service_1.RemoteDesktopService, core_1.NgZone])
 ], DeskTriggerDecorator);
-//# sourceMappingURL=desk.js.map