tabby-rdp 0.5.0 → 0.5.2

package/dist/ssh.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.Output = exports.MAX_OUTPUT = void 0;
 exports.isSSHTab = isSSHTab;
 exports.isConnected = isConnected;
 exports.openTcpStream = openTcpStream;
 exports.execStream = execStream;
 exports.pingRemote = pingRemote;
+exports.tooMuchOutput = tooMuchOutput;
 exports.execRemote = execRemote;
 const sshChannelStream_1 = require("./sshChannelStream");
 function isSSHTab(tab) {
@@ -80,50 +82,129 @@ async function pingRemote(tab) {
 }
 // Printed after a command's output, so that execRemote knows all of it arrived.
 const END = '__trd_exec_end__';
+/**
+ * What a command's output may be at most. The plugin's commands print a few lines (a host's VMs: a line each); a host
+ * that sends more is sending what it likes, which would otherwise all be kept, and parsed, on the thread that runs
+ * Tabby's window.
+ */
+exports.MAX_OUTPUT = 4 * 1024 * 1024;
+/** What a command that printed more than MAX_OUTPUT fails with. */
+function tooMuchOutput() {
+    return new Error(`Remote command printed more than ${exports.MAX_OUTPUT / 1024 / 1024} MB where a few lines were expected: stopped reading it`);
+}
+/**
+ * A command's output as it arrives, up to MAX_OUTPUT: copied into one buffer of its own, grown by doubling, rather than
+ * kept as the pieces it came in. A host can send its output a byte at a time, and millions of one-byte pieces take far
+ * more memory as pieces than as bytes.
+ */
+class Output {
+    constructor() {
+        this.buffer = Buffer.alloc(0);
+        /** How much has come; past MAX_OUTPUT, more than it (the rest isn't kept). */
+        this.size = 0;
+    }
+    get overflowed() {
+        return this.size > exports.MAX_OUTPUT;
+    }
+    /** Adds what came; false once there is more than MAX_OUTPUT. */
+    add(piece) {
+        if (this.size + piece.byteLength > exports.MAX_OUTPUT) {
+            this.size = exports.MAX_OUTPUT + 1;
+            return false;
+        }
+        if (this.size + piece.byteLength > this.buffer.length) {
+            const grown = Buffer.allocUnsafe(Math.min(exports.MAX_OUTPUT, Math.max(this.buffer.length * 2, this.size + piece.byteLength, 64 * 1024)));
+            this.buffer.copy(grown, 0, 0, this.size);
+            this.buffer = grown;
+        }
+        this.buffer.set(piece, this.size);
+        this.size += piece.byteLength;
+        return true;
+    }
+    /** What has come so far (not past MAX_OUTPUT). */
+    bytes() {
+        return this.buffer.subarray(0, Math.min(this.size, exports.MAX_OUTPUT));
+    }
+}
+exports.Output = Output;
 /**
  * Picks up data for a closed channel that Tabby's russh binding received after the close. Its data, EOF and close
  * events come through separate callbacks, in no fixed order, and the close drops the channel's data subscription:
  * later data waits in a new buffer that nothing reads (seen with Tabby 1.0.237 on Windows).
  * Reported upstream: https://github.com/Eugeny/russh-napi/issues/3
  */
-function drainLateData(ssh, id, out) {
+function drainLateData(ssh, id, take) {
     const data = ssh.events?.data$;
     if (typeof data?.subscribe !== 'function') {
         return;
     }
-    data.subscribe(id).subscribe((d) => out.push(Buffer.from(d))).unsubscribe();
+    data.subscribe(id).subscribe(take).unsubscribe();
     data.closeChannel?.(id);
 }
 /** Runs `command` on the remote with `stdin`, returns stdout. No PTY, no exit status (russh doesn't expose it). */
 async function execRemote(tab, command, stdin = '', timeoutMs = 60000) {
     const ssh = client(tab);
-    const channel = await ssh.activateChannel(await ssh.openSessionChannel());
-    const out = [];
-    const text = () => Buffer.concat(out).toString('utf8');
-    const closed = new Promise(resolve => channel.closed$.subscribe(() => resolve()));
-    channel.data$.subscribe((d) => out.push(Buffer.from(d)));
-    await channel.requestExec(`${command}\necho ${END}`);
-    if (stdin) {
-        await channel.write(new Uint8Array(Buffer.from(stdin)));
-    }
-    await channel.eof();
+    // One limit on time for all of it, from opening the channel on: a server that never confirms the channel, or the
+    // command, would otherwise keep whatever waits for the answer (a VM scan, a desktop's setup) waiting for good.
     let timer;
     const timeout = new Promise((_, reject) => {
         timer = setTimeout(() => reject(new Error(`Remote command timed out after ${timeoutMs / 1000}s`)), timeoutMs);
     });
+    timeout.catch(() => null);
+    const opening = Promise.resolve().then(() => ssh.openSessionChannel()).then((c) => ssh.activateChannel(c));
+    const output = new Output();
+    // Whether END has come: looked for in what is new and the end of what came before, since it can straddle the two.
+    let ended = false;
+    let overflow = () => null;
+    const overflowed = new Promise((_, reject) => { overflow = reject; });
+    overflowed.catch(() => null);
+    let channel = null;
+    const take = (d) => {
+        if (output.overflowed) {
+            return;
+        }
+        const from = Math.max(0, output.size - (END.length - 1));
+        if (!output.add(d)) {
+            channel?.close().catch(() => null);
+            return overflow(tooMuchOutput());
+        }
+        ended ||= output.bytes().includes(END, from);
+    };
     try {
-        await Promise.race([closed, timeout]);
+        channel = await Promise.race([opening, timeout]);
+        const closed = new Promise(resolve => channel.closed$.subscribe(() => resolve()));
+        channel.data$.subscribe(take);
+        // What the host sends meanwhile counts too: past MAX_OUTPUT it ends this, whatever step it is at.
+        const started = (async () => {
+            await channel.requestExec(`${command}\necho ${END}`);
+            if (stdin) {
+                await channel.write(new Uint8Array(Buffer.from(stdin)));
+            }
+            await channel.eof();
+        })();
+        started.catch(() => null);
+        await Promise.race([started, timeout, overflowed]);
+        await Promise.race([closed, timeout, overflowed]);
     }
     finally {
         clearTimeout(timer);
-        channel.close().catch(() => null);
+        if (channel) {
+            channel.close().catch(() => null);
+        }
+        else {
+            // A channel that opens after the time is up is closed then.
+            opening.then((c) => c?.close(), () => null).catch(() => null);
+        }
     }
-    for (let i = 0; i < 40 && !text().includes(END); i++) {
+    for (let i = 0; i < 40 && !ended && !output.overflowed; i++) {
         await new Promise(resolve => setTimeout(resolve, 50));
-        drainLateData(ssh, channel.id, out);
+        drainLateData(ssh, channel.id, take);
+    }
+    if (output.overflowed) {
+        throw tooMuchOutput();
     }
-    const result = text();
+    // Decoded once, all of it: a character's bytes can straddle two pieces.
+    const result = output.bytes().toString('utf8');
     const end = result.lastIndexOf(END);
     return end < 0 ? result : result.slice(0, end);
 }
-//# sourceMappingURL=ssh.js.map

package/dist/sshChannelStream.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SSHChannelStream = void 0;
 const stream_1 = require("stream");
+const byteQueue_1 = require("./byteQueue");
 /**
  * What may wait in the stream for its reader. The channel can't be told to slow down (russh hands the data over as
  * it arrives), so a reader that has stopped for good would otherwise have the whole of what the server sends pile up
@@ -13,22 +14,56 @@ class SSHChannelStream extends stream_1.Duplex {
     constructor(channel) {
         super();
         this.channel = channel;
+        /**
+         * What arrived while the reader wasn't reading, in one queue rather than as the pieces it came in: the server (or
+         * the host on the way) decides how small those are, and each one kept as it came costs far more than its bytes (a
+         * byte at a time, hundreds of times as much). Handed on in one piece once the reader asks again.
+         */
+        this.held = new byteQueue_1.ByteQueue();
+        /** The reader said to stop (push returned false): what comes is held until it asks again. */
+        this.waiting = false;
+        /** The channel ended while something was held: the end goes after it. */
+        this.ending = false;
         channel.data$.subscribe({
             next: d => {
-                if (!this.push(Buffer.from(d.buffer, d.byteOffset, d.byteLength)) && this.readableLength > MAX_PENDING) {
+                const piece = Buffer.from(d.buffer, d.byteOffset, d.byteLength);
+                if (!this.waiting) {
+                    this.waiting = !this.push(piece);
+                    return;
+                }
+                this.held.push(piece);
+                if (this.held.length + this.readableLength > MAX_PENDING) {
                     this.destroy(new Error('the desktop\'s data isn\'t being read: connection closed'));
                 }
             },
             error: e => this.destroy(e instanceof Error ? e : new Error(String(e))),
         });
-        channel.eof$.subscribe(() => this.push(null));
+        channel.eof$.subscribe(() => this.channelEnded());
         channel.closed$.subscribe(() => {
-            this.push(null);
+            this.channelEnded();
             this.destroy();
         });
     }
-    // The channel pushes whenever data arrives; there is no pull side to drive.
-    _read() { }
+    /** The channel's end: after what is held, if anything is. */
+    channelEnded() {
+        if (this.held.length) {
+            this.ending = true;
+        }
+        else {
+            this.push(null);
+        }
+    }
+    // The channel pushes whenever data arrives; the reader asking again only takes what was held meanwhile.
+    _read() {
+        this.waiting = false;
+        if (this.held.length) {
+            this.waiting = !this.push(this.held.take(this.held.length));
+        }
+        if (this.ending && !this.held.length) {
+            this.ending = false;
+            this.push(null);
+        }
+    }
     _write(chunk, _encoding, callback) {
         this.channel.write(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength)).then(() => callback(), callback);
     }
@@ -41,4 +76,3 @@ class SSHChannelStream extends stream_1.Duplex {
     }
 }
 exports.SSHChannelStream = SSHChannelStream;
-//# sourceMappingURL=sshChannelStream.js.map

package/dist/targets.js

@@ -5,8 +5,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RemoteTargets = exports.RDP_PROFILE_TYPE = void 0;
+exports.RemoteTargets = exports.SystemSSHTarget = exports.RDP_PROFILE_TYPE = void 0;
 exports.isRDPTab = isRDPTab;
 exports.desktopPaneOf = desktopPaneOf;
 exports.parseSSHCommand = parseSSHCommand;
@@ -19,6 +22,8 @@ const desktops_1 = require("./desktops");
 const desktopForm_1 = require("./desktopForm");
 const deskScript_1 = require("./deskScript");
 const probe_1 = require("./probe");
+const signin_1 = require("./signin");
+const unshowable_1 = require("./unshowable");
 const ssh_1 = require("./ssh");
 /** Tabby profile type of remote desktop tabs (see rdpProfile.ts). */
 exports.RDP_PROFILE_TYPE = 'rdp';
@@ -90,14 +95,13 @@ function parseSSHCommand(tokens) {
     const destination = tokens[i];
     return destination ? { options, destination } : null;
 }
-/** `user@hostname:port` from `ssh -G` output (config aliases, defaults resolved). */
-function keyFromConfig(out, destination) {
-    const get = (k) => new RegExp(`^${k} (.+)$`, 'm').exec(out)?.[1]?.trim();
-    return `${get('user') ?? ''}@${(get('hostname') ?? destination).toLowerCase()}:${get('port') ?? '22'}`;
-}
-/** `user@hostname:port` as ssh itself resolves it (config aliases, defaults). */
+/**
+ * `user@hostname:port` as ssh itself resolves it (config aliases, defaults; see keyFromConfig), and the key the plugin
+ * made of the same answer up to 0.5.0 (see RemoteTargets.keyChanged).
+ */
 async function resolveKey(options, destination) {
-    return keyFromConfig(await run('ssh', [...options, '-G', destination]), destination);
+    const out = await run('ssh', [...options, '-G', destination]);
+    return { key: (0, desktops_1.keyFromConfig)(out, destination), former: (0, desktops_1.legacyKeyFromConfig)(out, destination) };
 }
 /** A target reached with the system `ssh`, non-interactively (keys/agent/control master only). */
 class SystemSSHTarget {
@@ -111,8 +115,10 @@ class SystemSSHTarget {
     }
     async openTcp(host, port) {
         const child = (0, child_process_1.spawn)('ssh', this.args('-o', 'ExitOnForwardFailure=yes', '-W', `${host.includes(':') ? `[${host}]` : host}:${port}`), { stdio: ['pipe', 'pipe', 'pipe'] });
+        // Only the end, whose last line says why ssh stopped, as for exec: ssh prints what the server sends while
+        // signing in (its banners), for as long as the tunnel lasts, and the server decides how much.
         let stderr = '';
-        child.stderr.on('data', d => { stderr += d; });
+        child.stderr.on('data', d => { stderr = (stderr + d).slice(-4096); });
         const stream = stream_1.Duplex.from({ readable: child.stdout, writable: child.stdin });
         stream.on('close', () => child.kill());
         child.on('exit', () => stream.destroy());
@@ -130,22 +136,52 @@ class SystemSSHTarget {
     exec(command, stdin) {
         return new Promise((resolve, reject) => {
             const child = (0, child_process_1.spawn)('ssh', [...this.args('-T'), command], { stdio: ['pipe', 'pipe', 'pipe'] });
-            let stdout = '';
+            const stdout = new ssh_1.Output();
             let stderr = '';
-            child.stdout.on('data', d => { stdout += d; });
-            child.stderr.on('data', d => { stderr += d; });
-            const timer = setTimeout(() => child.kill(), 60000);
+            // Why ssh was stopped, if it was: what it printed is then no answer.
+            let stopped = null;
+            const stop = (e) => {
+                stopped ??= e;
+                child.kill();
+            };
+            // As much as execRemote takes (see MAX_OUTPUT), and of stderr only the end, whose last line says why.
+            child.stdout.on('data', (d) => {
+                if (!stdout.add(d)) {
+                    stop((0, ssh_1.tooMuchOutput)());
+                }
+            });
+            child.stderr.on('data', d => { stderr = (stderr + d).slice(-4096); });
+            const timer = setTimeout(() => stop(new Error('Remote command timed out after 60s')), 60000);
             child.on('error', reject);
-            child.on('exit', code => {
+            // ssh can exit before it reads stdin, or the command may not use it. Its status and stderr say why:
+            // EPIPE on the input pipe must not escape as an uncaught error or replace ssh's own explanation.
+            child.stdin.on('error', (e) => {
+                if (e.code !== 'EPIPE') {
+                    stop(e);
+                }
+            });
+            // All output, and any input pipe error, has arrived only once the process's streams have closed.
+            child.on('close', code => {
                 clearTimeout(timer);
-                code === 255 ? reject(new Error(sshFailure(this.label, stderr, code))) : resolve(stdout);
+                if (stopped) {
+                    reject(stopped);
+                }
+                else if (code === 255) {
+                    reject(new Error(sshFailure(this.label, stderr, code)));
+                }
+                else {
+                    resolve(stdout.bytes().toString('utf8'));
+                }
             });
             child.stdin.end(stdin);
         });
     }
 }
+exports.SystemSSHTarget = SystemSSHTarget;
 function sshFailure(label, stderr, code) {
-    const last = stderr.trim().split('\n').pop() ?? '';
+    // What the host said last (a refused channel's reason, its banner): as much of it as a host's error is shown
+    // elsewhere.
+    const last = (stderr.trim().split('\n').pop() ?? '').slice(0, 1000);
     if (/permission denied|password|keyboard-interactive/i.test(last)) {
         return `Couldn't open a second SSH connection to ${label} without a password. Use an SSH key or agent (or a ControlMaster), or open the host as a Tabby SSH profile.`;
     }
@@ -186,6 +222,34 @@ for p in $(pgrep -u "$(id -u)" -x ssh 2>/dev/null); do
     printf '\033]7777;probe;%s-%s\007' "$PROBE" "$n" > "/dev/$1" 2>/dev/null || true
 done
 `;
+/**
+ * How many `ssh` clients in a pane nestedSSH() reports at most: a terminal runs one in its foreground (a jump host's
+ * makes two), and each is a menu item, or a command to run, there.
+ */
+const MAX_NESTED = 16;
+const HOP = '\n__trd_hop ';
+/**
+ * A command's output through the host's ssh, and how that ssh ended: the line NestedSSHTarget.exec adds at the end,
+ * `__trd_hop <exit status> <ssh's last line of errors>`. Found from the end and taken apart by hand, not with a pattern
+ * whose parts can take the same characters, which a long last line of the host's making could make cost the square of
+ * its length. The error keeps any CR in it (OpenSSH ends its messages with CR LF). Null without that line.
+ */
+function hopResult(out) {
+    const at = out.lastIndexOf(HOP);
+    if (at < 0) {
+        return null;
+    }
+    let line = out.slice(at + HOP.length);
+    if (line.endsWith('\n')) {
+        line = line.slice(0, -1);
+    }
+    const space = line.indexOf(' ');
+    const status = space < 0 ? line : line.slice(0, space);
+    if (!/^\d+$/.test(status) || line.includes('\n')) {
+        return null;
+    }
+    return { output: out.slice(0, at), status, error: space < 0 ? '' : line.slice(space + 1) };
+}
 /**
  * A machine reached from an SSH tab's host with the `ssh` typed there: each command and tunnel runs that host's own
  * ssh, non-interactively (its keys, or a forwarded agent). Like SystemSSHTarget, one hop further.
@@ -208,13 +272,15 @@ class NestedSSHTarget {
         // ssh's exit status and last error line come after the output, so a failed login says why.
         const out = await this.outer.exec(`e=$(mktemp); ${this.ssh('-T')} ${(0, deskScript_1.shq)(command)} 2>"$e"; r=$?; ` +
             `printf '\n__trd_hop %s %s\n' "$r" "$(tail -n 1 "$e")"; rm -f "$e"`, stdin);
-        const m = /\n__trd_hop (\d+) ?(.*)\n?$/.exec(out);
-        if (m?.[1] === '255') {
-            throw new Error(/permission denied|password|keyboard-interactive|host key/i.test(m[2])
-                ? `${this.outer.label} couldn't log in to ${this.label} by itself (${m[2].trim()}). The desktop goes through ${this.outer.label}'s own ssh, which needs a key for ${this.label} there, or agent forwarding.`
-                : `ssh from ${this.outer.label} to ${this.label} failed${m[2] ? `: ${m[2].trim()}` : ''}`);
+        const hop = hopResult(out);
+        if (hop?.status === '255') {
+            // The host's ssh's words, as long as it likes: as much as a status line shows.
+            const why = hop.error.trim().slice(0, 1000);
+            throw new Error(/permission denied|password|keyboard-interactive|host key/i.test(why)
+                ? `${this.outer.label} couldn't log in to ${this.label} by itself (${why}). The desktop goes through ${this.outer.label}'s own ssh, which needs a key for ${this.label} there, or agent forwarding.`
+                : `ssh from ${this.outer.label} to ${this.label} failed${why ? `: ${why}` : ''}`);
         }
-        return m ? out.slice(0, m.index) : out;
+        return hop ? hop.output : out;
     }
     isOpen() { return this.outer.isOpen(); }
     ping() { return this.outer.ping(); }
@@ -249,12 +315,23 @@ class DirectTarget {
     isOpen() { return true; }
 }
 // ---- detection ---------------------------------------------------------------------------------
+/**
+ * Whether a name a host gave can be shown as it is: none of the characters that could hide part of it or show it in
+ * another order without showing themselves (UNSHOWABLE: control and format characters, the other default-ignorable
+ * ones such as variation selectors and Hangul fillers, separators, blanks other than the space). The .rdp import
+ * refuses the same in the addresses a file names.
+ */
+function shownAsIs(name) {
+    return !unshowable_1.UNSHOWABLE.test(name);
+}
 /**
  * Works out which remote a pane is logged into. SSH tabs: their profile. Local terminals: an `ssh`
  * process running under the shell. Results are cached so the header can be updated synchronously.
  */
 let RemoteTargets = class RemoteTargets {
-    constructor() {
+    constructor(config, profiles) {
+        this.config = config;
+        this.profiles = profiles;
         this.cache = new WeakMap();
         this.keys = new Map();
     }
@@ -267,10 +344,12 @@ let RemoteTargets = class RemoteTargets {
         let pid;
         try {
             if (isRDPTab(pane)) {
-                // Made afresh each time (it holds no state), so that an edited profile applies on the next connection.
-                const profile = pane.profile;
-                // No `wake` for a direct one: starting a machine takes an SSH host to do it from.
-                const spec = (0, desktops_1.specOf)({ ...profile.options, name: profile.name, wake: undefined });
+                // Made afresh each time (it holds no state), from the profile as saved now, so that an edited profile
+                // applies on the next connection.
+                const profile = this.savedProfile(pane);
+                // No `wake` for a direct one: starting a machine takes an SSH host to do it from. None for a profile that
+                // goes through an SSH profile (`via`): its address is as that host sees it, and it opens over that tab.
+                const spec = profile.options?.via ? null : (0, desktops_1.specOf)({ ...profile.options, name: profile.name, wake: undefined });
                 target = spec && new DirectTarget((0, desktopForm_1.formatAddress)(spec.host, spec.port), spec);
             }
             else if ((0, ssh_1.isSSHTab)(pane)) {
@@ -298,6 +377,17 @@ let RemoteTargets = class RemoteTargets {
         this.cache.set(pane, { target, pid });
         return target;
     }
+    /**
+     * A remote desktop tab's profile as saved now, with its type's and group's defaults as Tabby resolves a profile
+     * when opening it. Not the tab's own: Tabby's proxy of that keeps the options of when the tab opened (saving the
+     * profile editor puts new ones in their place), and a restored tab has a copy. The tab's own where it isn't a saved
+     * profile (quick connect).
+     */
+    savedProfile(pane) {
+        const own = pane.profile;
+        const saved = own.id ? (this.config.store.profiles ?? []).find((p) => p?.id === own.id && p.type === exports.RDP_PROFILE_TYPE) : null;
+        return saved ? { name: saved.name, options: this.profiles.getConfigProxyForProfile(saved).options } : own;
+    }
     /**
      * `ssh` clients typed at a prompt in this pane, on its SSH tab's host: only those whose terminal there is this pane's
      * (see probe.ts), since other panes and tabs can be on the same host. Empty elsewhere.
@@ -309,37 +399,99 @@ let RemoteTargets = class RemoteTargets {
         }
         const probe = `trd${Math.random().toString(36).slice(2, 10)}`;
         const { result: out, ids } = await (0, probe_1.probesIn)(pane, probe, () => outer.exec('sh -s', nestedSSHScript(probe)));
+        // One per destination (the host says what its lines are, and can repeat them), MAX_NESTED at most. A destination
+        // is shown as the machine's name (in the question which desktop to open, in the sign-in form): one that can't be
+        // shown as it is, no ssh a user typed would have, isn't offered.
         const found = [];
+        const destinations = new Set();
         for (const line of out.split('\n')) {
             const m = /^TRD_SSH (\d+)\|([^|]*)\|(.*)$/.exec(line.trim());
             const args = m?.[3].split('\x1f').filter(Boolean) ?? [];
             const cmd = /(^|\/)ssh$/.test(args[0] ?? '') ? parseSSHCommand(args.slice(1)) : null;
-            if (m && cmd && ids.has(`${probe}-${m[1]}`)) {
+            if (m && cmd && ids.has(`${probe}-${m[1]}`) && !destinations.has(cmd.destination) && shownAsIs(cmd.destination)) {
+                destinations.add(cmd.destination);
                 found.push({ cmd, tty: m[2] });
+                if (found.length === MAX_NESTED) {
+                    break;
+                }
             }
         }
-        // One per destination.
-        return found.filter((f, i, all) => all.findIndex(g => g.cmd.destination === f.cmd.destination) === i);
+        return found;
     }
-    /** A target for an `ssh` found by nestedSSH(), going through the pane's SSH connection. */
+    /**
+     * A target for an `ssh` found by nestedSSH(), going through the pane's SSH connection. Its key is under the pane's
+     * (see nestedKey): what the host there says about the machine, `ssh -G` included, is only that host's word.
+     */
     async nestedTarget(pane, nested) {
         const outer = await this.targetOf(pane);
         if (!(outer instanceof TabbySSHTarget)) {
             return null;
         }
         const config = await outer.exec(`${['ssh', ...nested.cmd.options, '-G', nested.cmd.destination].map(deskScript_1.shq).join(' ')} 2>/dev/null`, '');
-        return new NestedSSHTarget(keyFromConfig(config, nested.cmd.destination), nested.cmd.destination, outer, nested.cmd);
+        return new NestedSSHTarget((0, desktops_1.nestedKey)(outer.key, config, nested.cmd.destination), nested.cmd.destination, outer, nested.cmd);
     }
     key(options, destination) {
         const id = JSON.stringify([options, destination]);
         let key = this.keys.get(id);
         if (!key) {
-            key = resolveKey(options, destination);
+            key = resolveKey(options, destination).then(resolved => {
+                this.keyChanged(resolved.former, resolved.key);
+                return resolved.key;
+            });
             key.catch(() => this.keys.delete(id));
             this.keys.set(id, key);
         }
         return key;
     }
+    /**
+     * A target whose key reads otherwise than up to 0.5.0: one of its fields has a character keyFromConfig now writes
+     * as `%xx` (the `%` of an IPv6 address's zone, a `#` in a user name). It is the same target, resolved here by ssh
+     * from this computer's own config, so what was kept under its former key moves to the new one: the certificates
+     * remembered for its desktops and their sharpness now, a saved password the first time it is looked for (see
+     * renameCredentials). An entry already kept under the new key stays as it is. What else was kept by its key (desk's
+     * key, a "from now on" choice of a machine reached through it) stays behind, and is asked about again: neither
+     * gives anything away. Nothing moves where the former key could be another target's key now (see isTargetKey):
+     * what is kept under it may then be that one's, and this target's desktops ask again instead.
+     *
+     * Nor do the saved passwords of a former key with a `#` in it (a user name's): a desktop's key splits at its first
+     * `#` (see keyParts), so its desktops' passwords there read as no desktop's, and nothing that forgets or moves a
+     * desktop's passwords by its address (removing it, a new user name, gateway or address, the gateway passwords 0.5.0
+     * kept, see RemoteDesktopService.gatewayPasswords) has touched them. Moved now, a password forgotten that way would
+     * come back. That host's desktops ask for their passwords again instead, and those passwords are forgotten (see
+     * forgetFormerKey): no key a target has now has a `#` there, so what is kept under that one can only be this
+     * target's, and would otherwise stay kept for good, unused.
+     */
+    keyChanged(from, to) {
+        if (from === to || (0, desktops_1.isTargetKey)(from)) {
+            return;
+        }
+        if (!from.includes('#')) {
+            (0, signin_1.renameCredentials)(from, to);
+        }
+        else {
+            (0, signin_1.forgetFormerKey)(from);
+        }
+        const store = this.config.store.remoteDesktop;
+        let moved = false;
+        // The permission to sign in without NLA with them: it holds for one certificate (see holdWithoutNla), which moves.
+        // (None under a former key has one, which it needs: 0.5.0 never saved them, and builds since gave them one only
+        // under the new keys. Moved all the same, they count for nothing.)
+        for (const list of ['trustedCertificates', 'desktopSharpness', 'withoutNla']) {
+            const entries = Array.isArray(store?.[list]) ? store[list] : [];
+            const taken = new Set(entries.map(e => e?.desktop));
+            const renamed = entries.map(e => {
+                const desktop = typeof e?.desktop === 'string' ? (0, desktops_1.rekeyed)(e.desktop, from, to) : null;
+                return desktop && !taken.has(desktop) ? { ...e, desktop } : e;
+            });
+            if (renamed.some((e, i) => e !== entries[i])) {
+                store[list] = renamed;
+                moved = true;
+            }
+        }
+        if (moved) {
+            this.config.save();
+        }
+    }
     /**
      * The nearest `ssh` client running in the pane: a descendant of the terminal's own process.
      *
@@ -359,11 +511,13 @@ let RemoteTargets = class RemoteTargets {
         // pid, ppid, full command line (ps loses quoting; ssh arguments rarely need it)
         const children = new Map();
         for (const line of (await run('ps', ['-ax', '-ww', '-o', 'pid=,ppid=,args='])).split('\n')) {
-            const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
-            if (m) {
-                const list = children.get(Number(m[2])) ?? [];
-                list.push({ pid: Number(m[1]), args: m[3].trim().split(/\s+/) });
-                children.set(Number(m[2]), list);
+            // Split at whitespace, not matched with a pattern whose parts can take the same spaces: any program here
+            // decides what its arguments are, and a long run of spaces in them could take the square of its length.
+            const [pid, ppid, ...args] = line.trim().split(/\s+/);
+            if (/^\d+$/.test(pid) && /^\d+$/.test(ppid ?? '')) {
+                const list = children.get(Number(ppid)) ?? [];
+                list.push({ pid: Number(pid), args });
+                children.set(Number(ppid), list);
             }
         }
         // Breadth first, so the nearest ssh wins (e.g. the one typed at the prompt, not one it spawned).
@@ -388,6 +542,6 @@ let RemoteTargets = class RemoteTargets {
 };
 exports.RemoteTargets = RemoteTargets;
 exports.RemoteTargets = RemoteTargets = __decorate([
-    (0, core_1.Injectable)({ providedIn: 'root' })
+    (0, core_1.Injectable)({ providedIn: 'root' }),
+    __metadata("design:paramtypes", [tabby_core_1.ConfigService, tabby_core_1.ProfilesService])
 ], RemoteTargets);
-//# sourceMappingURL=targets.js.map