tabby-rdp 0.5.0 → 0.5.2

package/dist/desktop.service.js

@@ -10,7 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 var RemoteDesktopService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RemoteDesktopService = void 0;
+exports.RemoteDesktopService = exports.DesktopSession = exports.GATEWAY_PASSWORDS_MARK = void 0;
 exports.installStyle = installStyle;
 const core_1 = require("@angular/core");
 const rxjs_1 = require("rxjs");
@@ -18,15 +18,18 @@ const tabby_core_1 = require("tabby-core");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const net_1 = require("net");
 const url_1 = require("url");
 const targets_1 = require("./targets");
 const deskScript_1 = require("./deskScript");
 const audio_1 = require("./audio");
+const clipboard_1 = require("./clipboard");
 const connectionStatus_1 = require("./connectionStatus");
 const microphone_1 = require("./microphone");
 const drives_1 = require("./drives");
 const desktopForm_1 = require("./desktopForm");
 const accounts_1 = require("./accounts");
+const accountRevisions_1 = require("./accountRevisions");
 const accountForm_1 = require("./accountForm");
 const fileTransfer_1 = require("./fileTransfer");
 const desktops_1 = require("./desktops");
@@ -40,7 +43,17 @@ const ssh_1 = require("./ssh");
 const wake_1 = require("./wake");
 const hyperv_1 = require("./hyperv");
 const gateway_1 = require("./gateway");
+const authorities_1 = require("./authorities");
 const vms_1 = require("./vms");
+const sessionLog_1 = require("./sessionLog");
+const hostCompat_1 = require("./hostCompat");
+const unshowable_1 = require("./unshowable");
+/**
+ * The keychain entry that marks the passwords 0.5.0 saved for desktops reached through a gateway forgotten from this
+ * computer's keychain (see RemoteDesktopService.gatewayPasswords): under the plugin's service, a name no saved
+ * password's key takes (no target's key is `migration`, see keyParts).
+ */
+exports.GATEWAY_PASSWORDS_MARK = 'migration#gateway-passwords';
 /** How long a desktop that was started (`wake`) gets to answer. */
 const WAKE_TIMEOUT_MS = 3 * 60 * 1000;
 // The vendored IronRDP bundles are ES modules. tsc turns import() into require(), and Node's import() is refused in
@@ -79,6 +92,7 @@ const STYLE = `
 .trd-status-help { pointer-events: auto; color: #8ab4f8; font-size: 12px; cursor: pointer; }
 .trd-status-help:hover { text-decoration: underline; }
 .trd-overlay.trd-dim .trd-host { opacity: 0.2; }
+.trd-overlay.trd-dim .trd-status-text { pointer-events: auto; user-select: text; cursor: text; }
 .trd-view-only { display: none; position: absolute; inset: 0; }
 .trd-overlay.trd-view-only-on .trd-view-only { display: block; }
 .trd-overlay.trd-broadcast-on::before { content: 'Typing into all desktops in this tab'; position: absolute; top: 8px; left: 50%;
@@ -86,11 +100,26 @@ const STYLE = `
     font-size: 11px; pointer-events: none; white-space: nowrap; }
 .trd-view-only::after { content: 'View only'; position: absolute; top: 8px; left: 8px; padding: 2px 8px; border-radius: 4px;
     background: rgba(30, 30, 30, 0.85); color: #ddd; font-size: 11px; pointer-events: none; }
-.trd-mic { position: absolute; top: 8px; right: 8px; width: 22px; height: 22px; border-radius: 50%; display: none;
+.trd-mic { position: absolute; top: 8px; right: 8px; z-index: 5; width: 22px; height: 22px; border-radius: 50%; display: none;
     align-items: center; justify-content: center; background: rgba(220, 38, 38, 0.85); color: #fff; font-size: 11px;
     pointer-events: none; }
 .trd-overlay.trd-mic-on .trd-mic { display: flex; }
+.trd-overlay.trd-mic-on > .trd-toast { right: 40px; max-width: min(420px, calc(100% - 52px)); }
+.trd-floating-mic-on .trd-overlay.trd-broadcast-on::before { top: 40px; }
 `;
+/**
+ * The name a desktop connected to directly goes by, as its certificate is checked against it (see
+ * RDCleanPathOptions.serverName): an address as it is, a host name as it resolves (lower case, punycode, without a
+ * trailing dot, which SNI doesn't take). A host with a character no host name has stays as it is: the URL parser behind
+ * domainToASCII would read part of it as something else (`a?b` as `a`), and the certificate would be checked against
+ * another name than the one connected to.
+ */
+function serverNameOf(host) {
+    if ((0, net_1.isIP)(host) || /[^A-Za-z0-9._-]/.test(host.replace(/[^\x00-\x7f]/g, ''))) {
+        return host;
+    }
+    return (0, url_1.domainToASCII)(host.replace(/\.$/, '')) || host;
+}
 /** A SHA-256 fingerprint on two lines of 16 bytes, so it fits a narrow pane. */
 const showFingerprint = (fingerprint) => fingerprint ? `${fingerprint.slice(0, 47)}\n${fingerprint.slice(48)}` : '(none)';
 /**
@@ -141,6 +170,7 @@ function remoteSizeFor(rect, settings) {
         scale: Math.round(dpr * 100),
     };
 }
+/** Exported for the unit tests, which use its keys (credentialKey) without a page to put a layer in. */
 class DesktopSession {
     /**
      * What a sign-in and a certificate are remembered under: the desktop; for a Hyper-V VM, its host, whose account
@@ -149,6 +179,16 @@ class DesktopSession {
     get authKey() {
         return this.spec.hyperv ? this.key.replace(/#hyperv:[^#]*$/, '#hyperv') : this.key;
     }
+    /**
+     * Where a saved password is kept: under authKey, and whenever the desktop is reached through an RD Gateway, that
+     * gateway too (see gatewayScope), whether the gateway takes the desktop's sign-in or an account of its own: a
+     * password saved for one gateway (or for a connection without one) is never sent through a different gateway named
+     * for the same address without asking. The certificate and the "without NLA" decision stay keyed by authKey: those
+     * are the desktop's, not the gateway's.
+     */
+    get credentialKey() {
+        return this.authKey + (0, signin_1.gatewayScope)(this.spec.gateway);
+    }
     /** `key`: see sessionKey(); one desktop per key. */
     constructor(container, key, spec) {
         this.key = key;
@@ -157,7 +197,8 @@ class DesktopSession {
         this.visible = false;
         this.proxy = null;
         this.ui = null;
-        this.log = [];
+        /** The connection's log (Copy log): its first lines and its latest, however many the remote brings about. */
+        this.log = new sessionLog_1.SessionLog();
         /** What the remote display was last set to. */
         this.remoteSize = null;
         this.remote = null;
@@ -167,6 +208,20 @@ class DesktopSession {
         this.mic = null;
         /** Files through the clipboard (drop on the desktop, or copy on the remote). */
         this.files = null;
+        /**
+         * The ways the clipboard goes with this connection: as it was set up (see clipboard.ts), narrowed when the settings
+         * narrow while it's connected; never widened again before it reconnects.
+         */
+        this.clipboard = 'off';
+        /**
+         * The narrowest clipboard asked for this desktop by another way of opening it while it was open here (another
+         * profile for the same desktop, say, which brings this one forward instead): this desktop's connections in this
+         * pane go no further until it is closed. Its reconnects carry it over to the session made in its place (see
+         * reopen), since the server can bring one about whenever it likes by dropping the connection.
+         */
+        this.clipboardCap = 'both';
+        /** Stops the sending of this computer's clipboard on this connection. */
+        this.stopSending = null;
         /** The shared folders as drives on the remote (see drives.ts), when there were any at connect. */
         this.drives = null;
         /** Decodes H.264 for the graphics pipeline (IronRDP's WebCodecsH264Decoder), when this connection uses it. */
@@ -181,17 +236,33 @@ class DesktopSession {
         this.gatewayRefused = null;
         /** Set when the proxy stopped at a server without Network Level Authentication on the current connection attempt. */
         this.withoutNla = false;
+        /**
+         * Set when the proxy let the current attempt's server on without Network Level Authentication (see
+         * checkWithoutNla): signing in there sends it the password itself, not a proof of it.
+         */
+        this.plainSignIn = false;
+        /**
+         * "Send the password anyway" was answered just now (see refusedWithoutNla): the server that answers the next
+         * attempt may have the password, and the permission is remembered with its certificate (see holdWithoutNla).
+         */
+        this.sendAnyway = false;
         /** The connection-status indicator, made the first time it shows. */
         this.indicator = null;
         /** How the pictures come (for the indicator): the graphics pipeline, bitmaps, or IronRDP's choice. */
         this.graphics = '';
         /** "What does this mean?" under a message (see status()): opens help about it. */
         this.onHelp = null;
+        /**
+         * Whether the desktop's pane is the one the user is in (see RemoteDesktopService.showsInFront): only then does a
+         * question take the keyboard as it shows (see status()), and only then does a focus that was waiting for a moment
+         * (see focusSoon) go ahead. Its pane's focus hands it over later.
+         */
+        this.inFront = () => true;
         /** Keys this desktop was sent and not yet let go of (by `code`): see RemoteDesktopService.broadcastKey. */
         this.keysDown = new Map();
         this.reclaimFocus = (event) => {
             if (this.visible && !this.overlay.contains(event.target)) {
-                setTimeout(() => this.visible && this.focusDesktop());
+                this.focusSoon();
             }
         };
         this.disposers = [];
@@ -263,6 +334,14 @@ class DesktopSession {
     canvas() {
         return this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('canvas') ?? null;
     }
+    /**
+     * Focuses the remote desktop in a moment, if it is still in the pane the user is in then (see inFront). `visible`
+     * stays true in a tab in the background, and a focus that was waiting (a retry, or Tabby's re-focus of the terminal
+     * taken back) mustn't pull the keyboard, and this computer's clipboard with it, away from where the user went.
+     */
+    focusSoon(attempts, delay = 0) {
+        setTimeout(() => this.visible && this.inFront() && this.focusDesktop(attempts), delay);
+    }
     /**
      * Shows or hides the desktop layer. While it shows, the terminal's input textarea is disabled so
      * nothing can focus it: keystrokes can't leak into the shell underneath, and Tabby's re-focus of
@@ -271,11 +350,11 @@ class DesktopSession {
     setVisible(visible) {
         this.visible = visible;
         this.overlay.style.display = visible ? '' : 'none';
-        this.container.querySelectorAll('textarea.xterm-helper-textarea').forEach(input => {
+        (0, hostCompat_1.terminalInputs)(this.container).forEach(input => {
             input.disabled = visible;
         });
         if (visible) {
-            setTimeout(() => this.visible && this.focusDesktop());
+            this.focusSoon();
         }
     }
     /**
@@ -290,13 +369,19 @@ class DesktopSession {
         link.onclick = () => this.onHelp?.(msg);
         this.statusEl.querySelector('.trd-status-actions').replaceChildren(...actions.map(action => {
             const button = document.createElement('button');
-            button.className = 'btn btn-secondary';
+            button.className = action.default ? 'btn btn-primary trd-status-default' : 'btn btn-secondary';
             button.textContent = action.label;
             button.addEventListener('click', () => action.run());
             return button;
         }));
         this.statusEl.style.display = msg || actions.length ? '' : 'none';
         this.overlay.classList.toggle('trd-dim', actions.length > 0);
+        // Not where another pane is in front: the remote decides when a question comes, and the keyboard stays where the
+        // user went (a background tab's buttons can take it: Tabby keeps those in the page, off screen). The pane's
+        // focus brings it to the default answer once the user goes there.
+        if (this.visible && actions.some(a => a.default) && this.inFront()) {
+            this.focusDesktop();
+        }
     }
     onDispose(f) {
         this.disposers.push(f);
@@ -312,10 +397,18 @@ class DesktopSession {
             }
             return;
         }
+        // A question with a default answer (see StatusAction.default) keeps the focus on it, so Enter picks that.
+        const answer = this.statusEl.querySelector('.trd-status-default');
+        if (answer) {
+            if (document.activeElement !== answer) {
+                answer.focus();
+            }
+            return;
+        }
         const host = this.host.querySelector('iron-remote-desktop');
         this.canvas()?.focus();
         if (host && document.activeElement !== host && attempts > 1 && this.visible) {
-            setTimeout(() => this.visible && this.focusDesktop(attempts - 1), 16);
+            this.focusSoon(attempts - 1, 16);
         }
     }
     dispose() {
@@ -338,6 +431,7 @@ class DesktopSession {
         this.overlay.remove();
     }
 }
+exports.DesktopSession = DesktopSession;
 /**
  * A remote desktop per terminal pane (an SSH tab, or a local terminal running `ssh`), shown as a layer
  * over that pane's terminal. Toggling hides the layer and returns to the console; the RDP session keeps
@@ -362,6 +456,17 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.h264Support = null;
         /** Desktops (session keys) where H.264 decoding failed: they connect without it until Tabby restarts. */
         this.h264Failed = new Set();
+        /** When each desktop's video decoder was last taken back by the browser (see run()). */
+        this.h264Reclaimed = new Map();
+        /**
+         * Where each host stands as far as the key `desk` has there is concerned (see deskGeneration): a count that goes up
+         * each time that key is forgotten.
+         */
+        this.deskForgotten = new Map();
+        /** How many times `desk` was turned off, for every host (see deskGeneration). */
+        this.deskTurnedOff = 0;
+        /** Whether the passwords 0.5.0 saved for gateways' desktops were handed to forgetOnce (see gatewayPasswords). */
+        this.gatewayPasswordsAsked = false;
         /**
          * What the setup last found on each SSH host (by target key): GNOME, xrdp (and its port) or Windows. Kept for as
          * long as Tabby runs; a Windows host is found out on the first connect there, which costs a failed setup.
@@ -375,19 +480,159 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops; and what the scans learnt of the host. */
         this.vms = new Map();
         this.lastUsed = new Map();
-        /** Automatic reconnection after a desktop dropped, per pane: attempts so far and the pending timer. */
+        this.accountRevisions = new accountRevisions_1.AccountRevisions();
+        /** Each pane's `desk` requests, one at a time (see DeskGate). */
+        this.deskGates = new WeakMap();
+        /**
+         * Automatic reconnection after a desktop dropped, per pane: attempts so far and the pending timer. Kept while a
+         * reconnected desktop is up, until it has stayed up for STABLE_MS (see reconnectedUntilNow): one that drops again
+         * sooner goes on where the delays were, and they run out.
+         */
         this.reconnects = new Map();
+        /**
+         * The desktops (session keys) the microphone was stopped for, by Stop in the header's microphone menu or the
+         * desktop's own menu. A server can end its connection whenever it likes, and the one made in its place would go by
+         * the setting again, so the stop holds for the desktop, reconnects included, however they come about, until it is
+         * turned back on in the desktop's menu. Kept in this window until it is closed: each Tabby window has its own.
+         */
+        this.microphoneStopped = new Set();
+        /** When each desktop's last note about its microphone was (see microphoneChanged). */
+        this.microphoneNoted = new WeakMap();
         /** Split tabs where keys typed on one desktop go to all of them (see DesktopKeyboard). */
         this.broadcast = new WeakSet();
         /** How the pane's next connection to a GNOME desktop that's open elsewhere goes, when that was chosen already. */
         this.openChoices = new Map();
         /** Each pane's name for itself on hosts, for the note a take-over leaves there (see prepareRemoteDesktop). */
         this.clients = new WeakMap();
+        // The settings also change without updateSettings: saved in another Tabby window, in Settings › Config file, or
+        // by config sync. Open desktops narrow their clipboard then too, as they do from here (see applyClipboard), and
+        // the microphone turned off stops at once there as well.
+        config.changed$.subscribe(() => this.sessions.forEach(session => {
+            this.applyClipboard(session);
+            this.applyMicrophone(session);
+        }));
+        config.changed$.subscribe(() => this.noteDesk());
+        config.ready$?.subscribe?.(() => this.migrateConfig());
+        config.changed$.subscribe(() => this.migrateConfig());
+    }
+    /**
+     * Brings what older versions saved up to date; saves only when something changed.
+     *
+     * - Profiles an .rdp import made before imports set an account of their own (0.3 to 0.5) take their group's, or the
+     *   global, default saved account, and with it its saved password, to the address the file named; the same goes for
+     *   a gateway account, to the gateway it named, and for the kind (an xrdp one would get the password without NLA,
+     *   unasked). They get `account`, `gatewayAccount` and `kind` null, as imports now have (see importRdp), so they ask
+     *   and are Windows desktops whatever the defaults say. They are known by the shape the import gave them, which no
+     *   save in Tabby's profile editor has changed (it drops options equal to their defaults, an empty `via` among
+     *   them): the desktop icon, a domain, `via: ''`, and no option the import didn't set.
+     * - Gateway certificates remembered under a spelling other than the gateway's one form (0.5.0 kept capitals and a
+     *   trailing dot, see parseGateway) are consulted by nothing any more, and only fill the list: dropped. Not moved
+     *   to the gateway's form: such a spelling may be one a file chose, its certificate trusted on first use, unasked.
+     * - Passwords 0.5.0 saved for desktops reached through a gateway are forgotten, once in each store (see
+     *   gatewayPasswords).
+     */
+    migrateConfig() {
+        let changed = false;
+        const imported = new Set(['host', 'port', 'kind', 'username', 'domain', 'via', 'gateway', 'gatewayAccount']);
+        for (const p of this.config.store.profiles ?? []) {
+            const o = p?.type === targets_1.RDP_PROFILE_TYPE && p.icon === 'fas fa-desktop' ? p.options : null;
+            if (o && typeof o === 'object' && !('account' in o) && o.via === '' && typeof o.domain === 'string' && typeof o.host === 'string' &&
+                (o.gatewayAccount ?? '') === '' && (o.kind ?? 'windows') === 'windows' && Object.keys(o).every(k => imported.has(k))) {
+                o.account = null;
+                o.gatewayAccount = null;
+                o.kind = null;
+                changed = true;
+            }
+        }
+        const store = this.config.store.remoteDesktop;
+        const list = Array.isArray(store?.trustedCertificates) ? store.trustedCertificates : [];
+        const kept = list.filter((e) => {
+            const key = typeof e?.desktop === 'string' ? e.desktop : '';
+            if (!key.startsWith('gateway#')) {
+                return true;
+            }
+            // `gateway#<host>:<port>`, an IPv6 host without its brackets.
+            const address = key.slice('gateway#'.length);
+            const colon = address.lastIndexOf(':');
+            const host = address.slice(0, colon);
+            const gateway = colon > 0 ? (0, gateway_1.parseGateway)(`${host.includes(':') ? `[${host}]` : host}:${address.slice(colon + 1)}`) : null;
+            return !!gateway && `gateway#${gateway.host}:${gateway.port}` === key;
+        });
+        if (kept.length !== list.length) {
+            store.trustedCertificates = kept;
+            changed = true;
+        }
+        if (changed) {
+            this.config.save();
+        }
+        // Whatever the config says: its mark is the Vault's, and this computer's keychain keeps one of its own (see
+        // forgetOnce).
+        if (store && !this.gatewayPasswordsAsked) {
+            this.gatewayPasswordsAsked = true;
+            (0, signin_1.forgetOnce)(exports.GATEWAY_PASSWORDS_MARK, () => this.gatewayPasswords(), {
+                done: () => !!this.config.store.remoteDesktop?.gatewayPasswordsMigrated,
+                markDone: () => {
+                    this.config.store.remoteDesktop.gatewayPasswordsMigrated = true;
+                    this.config.save();
+                },
+            });
+        }
+    }
+    /**
+     * 0.5.0 kept the saved password of a desktop reached through an RD Gateway under the desktop's key alone, which is
+     * now the key of that address reached without one (passwords are kept for the way they go now, see gatewayScope):
+     * any desktop at that address without a gateway (a quick connect, another profile, an .rdp file naming it) would
+     * use it unasked. Forgotten, for each address a remote desktop profile or a desktop behind a host reaches through a
+     * gateway; the desktops there, with a gateway or without, ask once. Which keys those are, as the config says now:
+     * forgetOnce forgets them when the store of passwords is first used (a locked Vault then asks for its passphrase at
+     * a sign-in, as it would anyway), once in this computer's keychain, marked done there (GATEWAY_PASSWORDS_MARK), and
+     * once in the Vault, marked done in the config (`gatewayPasswordsMigrated`), which config sync takes to other
+     * computers with the Vault but not with their keychains. A part that can't be done (a Vault prompt cancelled, a
+     * keychain that doesn't answer) is tried again at the next use, and what it would forget isn't used meanwhile.
+     */
+    gatewayPasswords() {
+        const direct = new Set();
+        const behindHosts = new Set();
+        // A profile in a shape nothing reads is left out, rather than fail this: the work couldn't be done then, and no
+        // saved password at all would be used meanwhile (see forgetOnce).
+        const profiles = this.config.store.profiles;
+        for (const p of Array.isArray(profiles) ? profiles : []) {
+            if (p?.type !== targets_1.RDP_PROFILE_TYPE) {
+                continue;
+            }
+            // As Tabby opens it, its group's gateway included (as it is saved, should Tabby not resolve it).
+            let options = p.options;
+            try {
+                options = this.profiles.getConfigProxyForProfile(p).options;
+            }
+            catch { }
+            try {
+                const spec = options?.host ? (0, desktops_1.specOf)({ ...options, wake: undefined }) : null;
+                if (spec?.gateway && (0, gateway_1.parseGateway)(spec.gateway)) {
+                    (options.via ? behindHosts : direct).add(spec.id);
+                }
+            }
+            catch { }
+        }
+        for (const entry of this.configuredDesktops()) {
+            const spec = entry ? (0, desktops_1.specOf)(entry) : null;
+            if (spec?.gateway && (0, gateway_1.parseGateway)(spec.gateway)) {
+                behindHosts.add(spec.id);
+            }
+        }
+        // Behind every host: an entry's `via` doesn't say which host's key it is (see desktopEdited).
+        return key => {
+            const { desktopId } = (0, desktops_1.keyParts)(key);
+            return direct.has(desktopId) && (0, signin_1.isFor)(key, desktopId, { direct: true, scope: '' }) ||
+                behindHosts.has(desktopId) && (0, signin_1.isFor)(key, desktopId, { scope: '' });
+        };
     }
     /**
      * The remote a desktop opened in the pane now is on: the pane's own, or in an SSH tab where `ssh` was typed at
      * the prompt, the machine it went to (as for a local terminal running ssh), through the tab's host. Asks when it
-     * can't tell which. Undefined: cancelled.
+     * can't tell which, and whenever the ssh goes somewhere not chosen "from now on" from this host: the host is what
+     * says which ssh runs in its terminal, and could otherwise have a desktop of its choosing open in place of its own,
+     * unseen. Undefined: cancelled.
      */
     async remoteFor(pane) {
         const own = await this.targets.targetOf(pane);
@@ -396,10 +641,20 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             return own;
         }
         let chosen = nested[0];
-        if (nested.length > 1) {
+        let remember = false;
+        if (nested.length > 1 || !this.nestedChosen(own, chosen.cmd.destination)) {
+            // The tab's own connection first, so that Enter opens what the tab is connected to. A machine the host says
+            // ssh leads to opens this time only, unless the user says to open it at once from now on: a first choice
+            // is no consent to every later claim of the host's under that name.
             const picked = await this.selector.show('Which remote desktop?', [
-                ...nested.map(n => ({ name: n.cmd.destination, description: `ssh running in a terminal on ${own.label}`, icon: 'fas fa-desktop', result: n })),
                 { name: own.label, description: 'this tab\'s own SSH connection', icon: 'fas fa-desktop', result: null },
+                ...nested.map(n => ({ name: n.cmd.destination, description: `ssh running in a terminal on ${own.label}`, icon: 'fas fa-desktop', result: { nested: n, remember: false } })),
+                ...nested.map(n => ({
+                    name: `${n.cmd.destination}, from now on`,
+                    description: `ssh running in a terminal on ${own.label}: opens at once from now on`,
+                    icon: 'fas fa-desktop',
+                    result: { nested: n, remember: true },
+                })),
             ]).catch(() => undefined);
             if (picked === undefined) {
                 return undefined;
@@ -407,9 +662,28 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             if (!picked) {
                 return own;
             }
-            chosen = picked;
+            chosen = picked.nested;
+            remember = picked.remember;
+        }
+        const target = await this.targets.nestedTarget(pane, chosen).catch(() => null);
+        // Remembered once it led somewhere: one the host couldn't resolve is no choice to repeat at once.
+        if (target && remember) {
+            this.chooseNested(own, chosen.cmd.destination);
+        }
+        return target ?? own;
+    }
+    /** Whether ssh to `destination`, typed on `outer`, was chosen there for a desktop before (`remoteDesktop.nestedSSH`). */
+    nestedChosen(outer, destination) {
+        const list = this.config.store.remoteDesktop?.nestedSSH;
+        return (Array.isArray(list) ? list : []).some((e) => e?.via === outer.key && e?.destination === destination);
+    }
+    /** Remembers the choice: from now on, ssh to `destination` alone in a console on `outer` opens its desktop at once. */
+    chooseNested(outer, destination) {
+        if (!this.nestedChosen(outer, destination)) {
+            const store = this.config.store.remoteDesktop;
+            store.nestedSSH = [...(Array.isArray(store.nestedSSH) ? store.nestedSSH : []), { via: outer.key, destination }];
+            this.config.save();
         }
-        return await this.targets.nestedTarget(pane, chosen).catch(() => null) ?? own;
     }
     has(pane) {
         this.prune();
@@ -442,7 +716,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async signInAgain(pane) {
         const session = this.sessions.get(pane);
         if (session && this.signsIn(session.spec)) {
-            await (0, signin_1.forgetCredentials)(session.authKey);
+            await (0, signin_1.forgetCredentials)(session.credentialKey);
             // With a saved account, the form asks for its password anew (the saved one stays until then).
             this.askAgain.add(pane);
             await this.reopen(pane, session.spec);
@@ -461,7 +735,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             ? (this.config.store.profiles ?? []).filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && p.options?.host && p.options.via === target.profileId)
                 .map((p) => ({ ...this.profiles.getConfigProxyForProfile(p).options, name: p.name }))
             : [];
-        const specs = (0, desktops_1.desktopsFor)(target, this.config.store.remoteDesktop?.desktops, this.ownDesktops.get(target.key), viaProfile);
+        const specs = (0, desktops_1.desktopsFor)(target, this.config.store.remoteDesktop?.desktops, this.ownDesktops.get(target.key), viaProfile, this.settings().clipboard);
         // Found VMs come last, and not where a configured desktop has the same address.
         const found = this.settings().discoverVMs ? this.vms.get(target.key)?.specs ?? [] : [];
         return [...specs, ...found.filter(f => !specs.some(s => s.id === f.id))];
@@ -486,21 +760,33 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.vms.set(target.key, { at: Date.now(), specs: found.map(vms_1.vmSpec), host });
             this.changed$.next();
         }, () => {
-            // Not asked, rather than nothing found (the connection wasn't up yet, say): the next look asks again.
-            this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], host });
+            // Not asked, rather than nothing found (the connection wasn't up yet, say): the next look asks again. A host
+            // that was asked and gave no usable answer (none in time, or far too much) waits its minute like any other.
+            this.vms.set(target.key, { at: target.isOpen() ? Date.now() : known?.at ?? 0, specs: known?.specs ?? [], host });
         });
         this.vms.set(target.key, { at: known?.at ?? 0, specs: known?.specs ?? [], scan, host });
         return scan;
     }
+    /**
+     * Whether the pane has a VM the host found open, for saveFoundDesktop to keep. Not one found on a machine reached
+     * with ssh typed in a host's console: desktops kept behind that machine's name, which is the host's word, would be
+     * offered in tabs connected to any host that goes by it (see viaMatches).
+     */
+    canSaveFoundDesktop(pane) {
+        const session = this.sessions.get(pane);
+        return !!session?.spec.found && !!session.remote && session.remote.via === undefined;
+    }
     /** Keeps a found VM open in the pane among the host's desktops (`remoteDesktop.desktops`), under its name. */
     saveFoundDesktop(pane) {
         const session = this.sessions.get(pane);
         const spec = session?.spec;
-        if (!session?.remote || !spec?.found) {
+        if (!session?.remote || !spec?.found || !this.canSaveFoundDesktop(pane)) {
             return;
         }
+        // Its kind stays the host's word, not a choice of the user's: an xrdp one still asks before signing in without
+        // Network Level Authentication (see xrdpUnasked), as it did when found.
         const entry = spec.hyperv ? { name: spec.name, via: session.remote.label, hyperv: spec.hyperv }
-            : { name: spec.name, via: session.remote.label, host: spec.host, port: spec.port, kind: spec.kind, ...spec.wake ? { wake: spec.wake } : {} };
+            : { name: spec.name, via: session.remote.label, host: spec.host, port: spec.port, kind: spec.kind, ...spec.kind === 'xrdp' ? { kindFromHost: true } : {}, ...spec.wake ? { wake: spec.wake } : {} };
         this.config.store.remoteDesktop.desktops = [...this.configuredDesktops(), entry];
         this.config.save();
         this.changed$.next();
@@ -513,12 +799,22 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     }
     /**
      * The desktops of the pane's SSH host (from the last lookup) and the one a plain toggle acts on: the one
-     * the pane has open, else the host's default.
+     * the pane has open, else the host's default. `chosen`: whether one of the host's desktops is that one, known by
+     * its key, since a machine reached through the host has desktops of its own with the same ids (its own desktop's
+     * is `own`, as the host's is). Worked out once, for a menu to ask of each desktop it lists: a host can list
+     * hundreds of VMs, and the host's default is found among all its desktops.
      */
     choicesOf(pane) {
         const target = this.targets.cached(pane);
         const specs = target ? this.desktopsOf(target) : [];
-        return { specs, current: this.desktopOf(pane) ?? (target ? this.defaultDesktop(target) : null) };
+        const current = this.desktopOf(pane) ?? (target ? this.defaultDesktop(target) : null);
+        const key = this.sessions.get(pane)?.key ?? (target && current ? (0, desktops_1.sessionKey)(target, current) : null);
+        return { specs, current, chosen: spec => !!target && (0, desktops_1.sessionKey)(target, spec) === key };
+    }
+    /** Whether the VMs found on the pane's host are listed only as far as MAX_VMS (see vms.ts): it may have more. */
+    vmsCut(pane) {
+        const target = this.targets.cached(pane);
+        return !!target && this.settings().discoverVMs && !!this.vms.get(target.key)?.host.cut;
     }
     /** "Send files…": picks files to paste there. */
     sendFiles(pane) {
@@ -532,22 +828,32 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     desktopOf(pane) {
         return this.sessions.get(pane)?.spec ?? null;
     }
+    /** How far the clipboard of the pane's desktop was narrowed while it was open (DesktopSession.clipboardCap). */
+    clipboardCapOf(pane) {
+        return this.sessions.get(pane)?.clipboardCap ?? 'both';
+    }
     /** `remoteDesktop.accounts`: the saved accounts desktops can sign in with (see accounts.ts). */
     accounts() {
         return (0, accounts_1.accountsOf)(this.config.store.remoteDesktop);
     }
+    accountCurrent(key, name, revision) {
+        const account = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === key);
+        return !!account && (0, accounts_1.signInName)(account) === name && (account.credentialRevision ?? '') === revision && this.accountRevisions.current(account.id, revision);
+    }
     /**
      * The desktops that sign in with a saved account, or sign in to their RD Gateway with it: configured ones behind
      * SSH hosts, and RDP profiles (their own choice, or their profile group's default when they make none). Each comes
      * with what opens its editor.
      */
     accountUses(id) {
-        const desktops = this.configuredDesktops().flatMap((d, i) => d.account === id || d.gatewayAccount === id ? [{ name: String(d.name ?? (0, desktops_1.desktopIdOf)(d)), desktopIndex: i }] : []);
+        // Names as text whatever the config holds (see entryText): the accounts list and the question before removing
+        // one show them all.
+        const desktops = this.configuredDesktops().flatMap((d, i) => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id) ? [{ name: (0, desktops_1.entryText)(d).name, desktopIndex: i }] : []);
         const groups = this.config.store.groups ?? [];
         const inherited = (p) => p.options?.account === undefined && groups.find(g => g.id === p.group)?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options?.account === id;
         const profiles = (this.config.store.profiles ?? [])
             .filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && (p.options?.account === id || p.options?.gatewayAccount === id || inherited(p)))
-            .map((p) => ({ name: String(p.name ?? p.options?.host ?? ''), profileId: p.id ? String(p.id) : undefined }));
+            .map((p) => ({ name: (0, desktops_1.configText)(p.name) || (0, desktops_1.configText)(p.options?.host), profileId: (0, desktops_1.configText)(p.id) || undefined }));
         return [...desktops, ...profiles];
     }
     /**
@@ -564,14 +870,31 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             username: account.username.trim(),
             ...account.domain?.trim() ? { domain: account.domain.trim() } : {},
         };
+        let revision;
+        try {
+            revision = this.accountRevisions.change(entry.id);
+        }
+        catch (error) {
+            return { id: entry.id, keychainError: error?.message ?? String(error) };
+        }
+        entry.credentialRevision = revision;
+        // Invalidate before any store await. Keep the old sign-in name until changing its password succeeds.
+        if (old) {
+            this.config.store.remoteDesktop.accounts = list.map(a => a.id === old.id ? { ...a, credentialRevision: revision } : a);
+            await this.config.save();
+        }
+        const current = () => this.accountRevisions.current(entry.id, revision) && (!old || this.accounts().some(a => a.id === entry.id && a.credentialRevision === revision));
         // The password first: a new user name must not be written while the old password (for the old name) stays, nor
         // a new password reported as saved when the store refused it.
         let keychainError;
         if (password !== undefined && password !== '') {
-            await (0, signin_1.saveCredentials)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
+            await (0, signin_1.saveCredentialsIf)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, current, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
         }
         else if (old && (0, accounts_1.signInName)(old) !== (0, accounts_1.signInName)(entry)) {
-            await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(entry.id)).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+            await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(entry.id), current).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+        }
+        if (!current()) {
+            return { id: entry.id, keychainError: 'The account changed again while this edit was being saved. The newer change was kept.' };
         }
         if (keychainError && !old) {
             // Not added at all: a retry would otherwise make a second account.
@@ -587,7 +910,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 delete entry.domain;
             }
         }
-        this.config.store.remoteDesktop.accounts = old ? list.map(a => a === old ? entry : a) : [...list, entry];
+        const now = this.accounts();
+        this.config.store.remoteDesktop.accounts = old ? now.map(a => a.id === old.id ? entry : a) : [...now, entry];
         await this.config.save();
         this.changed$.next();
         return { id: entry.id, keychainError };
@@ -624,15 +948,25 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (response !== 0) {
             return false;
         }
-        await this.removeAccount(id);
-        return true;
+        try {
+            await this.removeAccount(id);
+            return true;
+        }
+        catch (error) {
+            this.notifications.error(`The account could not be fully removed: ${error?.message ?? error}`);
+            return false;
+        }
     }
     /** Removes a saved account and its password; desktops that used it go back to asking. */
     async removeAccount(id) {
+        const revision = this.accountRevisions.change(id);
         const store = this.config.store.remoteDesktop;
         store.accounts = this.accounts().filter(a => a.id !== id);
-        if (this.configuredDesktops().some(d => d.account === id || d.gatewayAccount === id)) {
+        if (this.configuredDesktops().some(d => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id))) {
             store.desktops = this.configuredDesktops().map(d => {
+                if (!(0, desktops_1.isDesktopEntry)(d)) {
+                    return d;
+                }
                 const rest = { ...d };
                 if (rest.account === id) {
                     delete rest.account;
@@ -644,12 +978,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 return rest;
             });
         }
+        // Null rather than '': '' takes the group's default account, should there be one, where the profile is to ask.
         for (const profile of this.config.store.profiles ?? []) {
             if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.account === id) {
-                profile.options.account = '';
+                profile.options.account = null;
             }
             if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.gatewayAccount === id) {
-                profile.options.gatewayAccount = '';
+                profile.options.gatewayAccount = null;
             }
         }
         // A profile group's default for remote desktop profiles, too.
@@ -661,7 +996,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         await this.config.save();
         this.changed$.next();
-        await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(id)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
+        await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(id), () => this.accountRevisions.current(id, revision)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
     }
     /** `remoteDesktop.desktops`: the desktops configured behind SSH hosts. */
     configuredDesktops() {
@@ -679,7 +1014,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.showConsole(pane);
         }
         // The resolved hostname, so a profile tab and a plain `ssh` to that machine both offer it.
-        const hostname = target.key.replace(/:\d+$/, '').replace(/^[^@]*@/, '');
+        const hostname = (0, desktops_1.keyFields)(target.key).host;
         const entry = await (0, desktopForm_1.askDesktop)(pane.element.nativeElement, {
             title: `Add a desktop reached through ${target.label}`,
             action: 'Add and open',
@@ -687,6 +1022,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             addAccount: input => this.addAccountFromForm(input),
             entry: { via: hostname, host: '127.0.0.1', port: 3389 },
             check: e => this.addressTaken(e, -1),
+            clipboard: this.settings().clipboard,
         });
         if (!entry) {
             pane.frontend?.focus();
@@ -700,13 +1036,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     /** Another entry for the same host already has this address (desktops are told apart by it). */
     addressTaken(entry, index) {
         const id = (0, desktops_1.desktopIdOf)(entry);
-        const via = (entry.via ?? '').trim().toLowerCase();
-        const taken = this.configuredDesktops().some((d, i) => i !== index && (0, desktops_1.desktopIdOf)(d) === id && (d.via ?? '').trim().toLowerCase() === via);
-        return taken ? `There is already a desktop at ${id} behind ${entry.via}.` : null;
+        // As text: an edited entry keeps a `via` the form doesn't ask for, and other entries hold whatever the config does.
+        const via = (0, desktops_1.configText)(entry.via).trim().toLowerCase();
+        const taken = this.configuredDesktops().some((d, i) => i !== index && (0, desktops_1.isDesktopEntry)(d) && (0, desktops_1.desktopIdOf)(d) === id && (0, desktops_1.configText)(d.via).trim().toLowerCase() === via);
+        return taken ? `There is already a desktop at ${id} behind ${(0, desktops_1.configText)(entry.via)}.` : null;
     }
     /**
-     * "Edit a desktop": the same form, over the pane, filled in. A new address takes the desktop's saved accounts and
-     * sharpness along; a new user name drops the saved account, which was for the old one. Open sessions keep running.
+     * "Edit a desktop": the same form, over the pane, filled in. A new address takes what is kept for the desktop along
+     * (see desktopEdited); a new user name drops the saved password, which was for the old one. Open sessions keep running.
      */
     async editDesktop(pane, index) {
         if (!this.configuredDesktops()[index]) {
@@ -728,17 +1065,19 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     /** "Edit a desktop" with the form over any element (a pane, or the settings page). */
     async editDesktopIn(host, index, askVia = false) {
         const old = this.configuredDesktops()[index];
-        if (!old) {
+        if (!(0, desktops_1.isDesktopEntry)(old)) {
             return;
         }
+        const { name, via } = (0, desktops_1.entryText)(old);
         const entry = await (0, desktopForm_1.askDesktop)(host, {
-            title: `Edit ${old.name ?? (0, desktops_1.desktopIdOf)(old)}${askVia ? '' : ` (behind ${old.via})`}`,
+            title: `Edit ${name}${askVia || !via ? '' : ` (behind ${via})`}`,
             action: 'Save',
             accounts: this.accounts(),
             addAccount: input => this.addAccountFromForm(input),
             hosts: askVia ? await this.sshHosts() : undefined,
             entry: old,
             check: e => this.addressTaken(e, index),
+            clipboard: this.settings().clipboard,
         });
         // Compared with the entry as it is now: the config can change while the form shows.
         const list = this.configuredDesktops();
@@ -750,45 +1089,80 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.config.save();
         this.changed$.next();
         const accountChanged = (old.username ?? '') !== (entry.username ?? '') || (old.domain ?? '') !== (entry.domain ?? '') || (old.account ?? '') !== (entry.account ?? '');
-        await this.desktopEdited((0, desktops_1.desktopIdOf)(old), (0, desktops_1.desktopIdOf)(entry), accountChanged, false);
+        await this.desktopEdited((0, desktops_1.desktopIdOf)(old), (0, desktops_1.desktopIdOf)(entry), accountChanged, false, { from: old.gateway, to: entry.gateway });
     }
     /**
      * A desktop was edited (the edit form, or an RDP profile's settings): what is kept per desktop is keyed by its
-     * address, so a new address takes the saved account, its sharpness, its remembered certificate and the last-used
+     * address, so a new address takes the saved password, its sharpness, its remembered certificate and the last-used
      * choice along. (Should another machine answer at the new address, its certificate differs and the connection
-     * stops to ask, rather than trusting it silently as a first use.) A new user name or domain drops the saved
-     * account instead: it was for the old one. `direct`: a direct desktop (`rdp#<id>` keys), otherwise one behind SSH
-     * hosts (`<ssh key>#<id>`).
+     * stops to ask, rather than trusting it silently as a first use.) Not the permission to sign in without Network
+     * Level Authentication: that was given to the server at the old address, and is asked for again. The saved password
+     * is the one of the desktop's way there, `gateways.from` (see gatewayScope): a new user name, domain or account, or
+     * another gateway (or none where there was one), drops it instead, since it was for the old one; a new address
+     * takes it along, through the same gateway. Another desktop at the old address reached another way (a direct
+     * profile next to one through a gateway) keeps its own, and what a desktop at the new address has stays its own.
+     * Where a desktop at the new address is known already (a certificate is remembered for it), the password doesn't
+     * move either, and the edited desktop asks: its certificate stays the one of the machine there, which then checks
+     * out, and the moved password would go to that machine unasked, a desktop of another host's or profile's perhaps.
+     * Behind a host, a password moves only along with the certificate remembered for its desktop, and is dropped
+     * without one (see moveCredentialsFor). `direct`: a direct desktop (`rdp#<id>` keys), otherwise one behind SSH
+     * hosts (`<ssh key>#<id>`): those of every host, since a desktop's `via` can name its host by an alias or a
+     * profile's name that its keys don't show. Each store of passwords has its part done on its own: one that can't be
+     * read now (Tabby's Vault locked and its prompt cancelled, the keychain not answering) keeps what it holds for the
+     * desktop as it was unused, until it can be read while this window is open (see forgetLater). That is said, of that
+     * store. After a new address the certificate stays at the old one as well as going along (below), whichever
+     * passwords stayed there.
      */
-    async desktopEdited(fromId, toId, accountChanged, direct) {
-        if (direct) {
-            const [from, to] = [`${desktops_1.DIRECT_KEY}#${fromId}`, `${desktops_1.DIRECT_KEY}#${toId}`];
-            const saved = !accountChanged && from !== to ? await (0, signin_1.loadCredentials)(from) : null;
-            if (saved) {
-                await (0, signin_1.saveCredentials)(to, saved).catch(() => null);
-            }
-            if (accountChanged || from !== to) {
-                await (0, signin_1.forgetCredentials)(from);
-            }
-        }
-        else if (accountChanged) {
-            await (0, signin_1.forgetCredentialsFor)(fromId);
+    async desktopEdited(fromId, toId, accountChanged, direct, gateways) {
+        const scope = (0, signin_1.gatewayScope)(gateways.from);
+        let waiting = [];
+        if (accountChanged || scope !== (0, signin_1.gatewayScope)(gateways.to)) {
+            waiting = await (0, signin_1.forgetCredentialsFor)(fromId, { direct, scope });
         }
         else if (fromId !== toId) {
-            await (0, signin_1.moveCredentialsFor)(fromId, toId);
+            // As they are when each password is looked at, not as they were before the stores were listed (a Vault's
+            // passphrase prompt takes as long as the user does, and a connection meanwhile may remember the certificate
+            // of the new address), and before the certificates move (below).
+            waiting = await (0, signin_1.moveCredentialsFor)(fromId, toId, { direct, scope }, key => this.trustedCertificates().some(e => e.desktop === key));
+        }
+        if (waiting.length) {
+            // Not said to be there: a store that can't be read doesn't tell what it holds.
+            this.notifications.info(`If a password was saved for this desktop before the change, ${this.passwordWaits(waiting)}`);
         }
         if (fromId === toId) {
             return;
         }
-        const moved = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${fromId}` : key.endsWith(`#${fromId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
+        // Anchored on the key's parts, not an `endsWith('#'+fromId)`: a gateway pin (`gateway#…`) or a desktop whose
+        // id is a suffix of this one's isn't moved by mistake.
+        const moved = (key) => {
+            const { target, desktopId: id } = (0, desktops_1.keyParts)(key);
+            return id === fromId && (direct ? target === desktops_1.DIRECT_KEY : target !== desktops_1.DIRECT_KEY && target !== 'gateway');
+        };
         const store = this.config.store.remoteDesktop;
-        for (const list of ['desktopSharpness', 'trustedCertificates', 'withoutNla']) {
+        // The certificates go along and stay at the old address too. What is kept there still goes only to the machine
+        // it was saved for, and another machine answering there meets the certificate question rather than being
+        // trusted as a first use: the password of another desktop at that address, reached another way (a certificate
+        // belongs to the address, a password to the way there: see credentialKey), or one that a store which couldn't
+        // be read still has, found there again should this window close before it goes.
+        for (const list of ['desktopSharpness', 'trustedCertificates']) {
             if (Array.isArray(store[list])) {
-                store[list] = store[list].map((e) => typeof e?.desktop === 'string' && moved(e.desktop)
-                    ? { ...e, desktop: `${e.desktop.slice(0, -fromId.length)}${toId}` }
-                    : e);
+                // What a desktop already has at the new address (one behind the same host, say) stays its own: the moved
+                // entry is dropped rather than put next to it, where either could be the one found.
+                const isMoved = (e) => typeof e?.desktop === 'string' && moved(e.desktop);
+                const taken = new Set(store[list].filter((e) => !isMoved(e)).map((e) => e?.desktop));
+                const kept = list === 'trustedCertificates';
+                store[list] = store[list].flatMap((e) => {
+                    if (!isMoved(e)) {
+                        return [e];
+                    }
+                    const desktop = `${(0, desktops_1.keyParts)(e.desktop).target}#${toId}`;
+                    return [...kept ? [e] : [], ...taken.has(desktop) ? [] : [{ ...e, desktop }]];
+                });
             }
         }
+        if (Array.isArray(store.withoutNla)) {
+            store.withoutNla = store.withoutNla.filter((e) => !(typeof e?.desktop === 'string' && moved(e.desktop)));
+        }
         this.config.save();
         for (const [key, id] of this.lastUsed) {
             if (id === fromId && (key === desktops_1.DIRECT_KEY) === direct) {
@@ -809,7 +1183,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             input.click();
         });
         if (file) {
-            await this.importRdp(new Uint8Array(await file.arrayBuffer()), file.name);
+            // A reading or parsing failure is shown, not dropped as an unhandled rejection: this is the user's action.
+            try {
+                await this.importRdp(new Uint8Array(await file.arrayBuffer()), file.name);
+            }
+            catch (e) {
+                this.notifications.error(`${file.name}: couldn't be imported (${e?.message ?? e})`);
+            }
         }
     }
     /**
@@ -818,43 +1198,112 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * puts them.
      */
     async remoteDesktopGroup() {
-        const groups = await this.profiles.getProfileGroups({ includeNonUserGroup: false });
-        const existing = groups.find(g => g.name === 'Remote desktops');
-        if (existing?.id) {
-            return existing.id;
+        const existing = await this.existingRemoteDesktopGroup();
+        if (existing) {
+            return existing;
         }
         const group = { name: 'Remote desktops', profiles: [] };
         await this.profiles.newProfileGroup(group, { genId: true });
         return group.id;
     }
+    /** The "Remote desktops" profile group's id, when there is one yet (see remoteDesktopGroup). */
+    async existingRemoteDesktopGroup() {
+        const groups = await this.profiles.getProfileGroups({ includeNonUserGroup: false });
+        return groups.find(g => g.name === 'Remote desktops')?.id || undefined;
+    }
     /**
      * Adds a "Remote desktop (RDP)" profile from a .rdp file's contents (address, user name, domain; see rdpFile.ts)
-     * and opens it; or opens the profile that already has that address and user. Returns the profile, or null.
+     * and opens it; or opens the profile that already has that address, user and domain. Returns the profile, or null.
      */
-    async importRdp(data, fileName) {
+    async importRdp(data, rawFileName) {
+        // The file's name comes with the file, and is shown: what could reorder or hide part of it shows as �.
+        const fileName = rawFileName.replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
         const parsed = (0, rdpFile_1.parseRdpFile)(data);
         if (!parsed) {
             this.notifications.error(`${fileName}: no address ("full address") in it`);
             return null;
         }
-        const existing = (this.config.store.profiles ?? []).find((p) => p?.type === targets_1.RDP_PROFILE_TYPE && !p.options?.via &&
-            p.options?.host === parsed.host && (p.options.port || 3389) === parsed.port && (p.options.username ?? '') === (parsed.username ?? '') &&
-            (p.options.gateway ?? '') === (parsed.gateway ?? ''));
+        // The confirmation below is the only gate on an imported file, so the file can't be allowed to spoof it: an
+        // address, gateway, user name or domain with a character that could reorder or hide part of it (see
+        // UNSHOWABLE) is refused, and an international name is shown and stored as the punycode it actually resolves
+        // to, so a look-alike can't pose as a trusted name. But for the zero-width joiners between letters that Persian
+        // and Indic scripts write words with, in a user name or a domain (see withoutWordJoiners; elsewhere they don't
+        // show): an account's name decides nothing of where the sign-in goes, and such names are a person's own.
+        for (const [what, value] of [['address', parsed.host], ['RD Gateway', parsed.gateway], ['user name', parsed.username && (0, unshowable_1.withoutWordJoiners)(parsed.username)],
+            ['domain', parsed.domain && (0, unshowable_1.withoutWordJoiners)(parsed.domain)]]) {
+            if (value && unshowable_1.UNSHOWABLE.test(value)) {
+                this.notifications.error(`${fileName}: its ${what} has characters that can't be shown safely, so it wasn't imported.`);
+                return null;
+            }
+        }
+        const international = (text) => /[^\x00-\x7f]/.test(text ?? '');
+        const spoofable = international(parsed.host) || international(parsed.gateway);
+        const host = /^[\x20-\x7e]*$/.test(parsed.host) || (0, net_1.isIP)(parsed.host) ? parsed.host : (0, url_1.domainToASCII)(parsed.host) || null;
+        if (!host) {
+            this.notifications.error(`${fileName}: its address isn't one that can be reached.`);
+            return null;
+        }
+        parsed.host = host;
+        if (parsed.gateway) {
+            // As the gateway setting has it (see parseGateway): its host as it resolves, its port apart from that.
+            const gateway = (0, gateway_1.parseGateway)(parsed.gateway);
+            if (!gateway) {
+                this.notifications.error(`${fileName}: its RD Gateway isn't an address that can be reached.`);
+                return null;
+            }
+            parsed.gateway = (0, gateway_1.formatGateway)(gateway);
+        }
+        // A profile that already leads where the file does, as it resolves (its group's defaults included): opened
+        // rather than added again. It is the user's own: where it leads, and as whom, are as they set it. As whom
+        // includes the domain the question names, which Windows takes for the same in any case.
+        const sameGateway = (a, b) => {
+            const [x, y] = [(0, gateway_1.parseGateway)(a), (0, gateway_1.parseGateway)(b)];
+            return x && y ? x.host === y.host && x.port === y.port : !x && !y;
+        };
+        const sameDomain = (a, b) => (0, desktops_1.configText)(a).toLowerCase() === (b ?? '').toLowerCase();
+        const existing = (this.config.store.profiles ?? []).find((p) => {
+            const o = p?.type === targets_1.RDP_PROFILE_TYPE ? this.profiles.getConfigProxyForProfile(p).options : null;
+            return o && !o.via && o.host === parsed.host && (o.port || 3389) === parsed.port && (o.username ?? '') === (parsed.username ?? '') &&
+                sameDomain(o.domain, parsed.domain) && sameGateway(o.gateway, parsed.gateway);
+        });
         if (existing) {
+            if (parsed.clipboard && !await this.clipboardOffForFile(existing, fileName)) {
+                return null;
+            }
             this.notifications.info(`Opening "${existing.name}", which is already a profile for ${fileName}`);
             await this.profiles.openNewTabForProfile(existing);
             return existing;
         }
         // A file is someone else's word for where to connect: where it leads is said before anything goes there. The
-        // account typed into the sign-in form goes to that address, and to the gateway before it.
+        // account typed into the sign-in form goes to that address, and to the gateway before it, as a proof of the
+        // password the gateway can keep, so the gateway's part is spelled out, as is the domain the account would be
+        // taken from. A file can turn the clipboard off for its desktop (see rdpFile.ts), never on. Otherwise the
+        // profile gets no clipboard option, so that it follows the defaults of its type and of its group (Tabby's
+        // profile settings), else the setting: the question names what that comes to.
         const base = fileName.replace(/^.*[\\/]/, '');
+        const fileClipboard = parsed.clipboard ? { clipboard: parsed.clipboard } : {};
+        const group = await this.existingRemoteDesktopGroup();
+        const clipboard = (0, clipboard_1.ownClipboard)(this.profiles.getConfigProxyForProfile({ type: targets_1.RDP_PROFILE_TYPE, name: base, group, options: { ...fileClipboard } }).options.clipboard) ??
+            this.settings().clipboard;
+        // The microphone is the setting's alone: on, every desktop gets it whenever it asks for it (an honest server
+        // asks while an app there records), whatever the file.
+        const what = [...clipboard === 'both' ? ['your clipboard'] : [], 'the folders you share',
+            ...this.settings().microphone ? ['your microphone when it asks for it'] : []];
+        const listed = what.length > 1 ? `${what.slice(0, -1).join(', ')} and ${what[what.length - 1]}` : what[0];
+        const gets = clipboard === 'fromRemote' ? `${listed}${what.length > 1 ? ',' : ''} and can put things on your clipboard`
+            : clipboard === 'off' && parsed.clipboard ? `${listed} (the file turns the clipboard off for it)` : listed;
+        const as = parsed.username ? `, as ${(0, accounts_1.signInName)({ username: parsed.username, domain: parsed.domain })}`
+            : parsed.domain ? `, with an account of the domain ${parsed.domain}` : '';
         const { response } = await this.platform.showMessageBox({
             type: 'warning',
             message: `Add a remote desktop from ${base}?`,
             detail: `It connects to ${(0, desktopForm_1.formatAddress)(parsed.host, parsed.port)}${parsed.gateway ? `, through the gateway ${parsed.gateway}` : ''}` +
-                `${parsed.username ? `, as ${parsed.username}` : ''}. What you sign in with there goes to that address` +
-                `${parsed.gateway ? ' and that gateway' : ''}, and once signed in, the desktop gets the clipboard and the folders you share. ` +
-                'Add it only if you know where it leads, or trust who gave you the file.',
+                `${as}. What you sign in with there goes to that address${parsed.gateway ? ' and that gateway' : ''}, and once signed in, ` +
+                `the desktop gets ${gets}.` +
+                (parsed.gateway ? ' The gateway is signed in to first, before the desktop is reached, and is given a proof of your password ' +
+                    'that whoever runs it could try to crack offline.' : '') +
+                (spoofable ? ' A name in the file uses international characters, shown here as the punycode it resolves to.' : '') +
+                ' Add it only if you know where it leads, or trust who gave you the file.',
             buttons: ['Add and connect', 'Add only', 'Cancel'],
             defaultId: 0,
             cancelId: 2,
@@ -867,7 +1316,20 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             name: base.replace(/\.rdp$/i, '') || parsed.host,
             icon: 'fas fa-desktop',
             group: await this.remoteDesktopGroup(),
-            options: { host: parsed.host, port: parsed.port, kind: 'windows', username: parsed.username ?? '', domain: parsed.domain ?? '', via: '', gateway: parsed.gateway ?? '', gatewayAccount: '' },
+            // `account: null` on purpose: the plugin puts imported profiles in the "Remote desktops" group, and without an
+            // account of its own a profile takes that group's (or the global) default saved account, so a file could send
+            // a saved, possibly privileged, password to the address it names with no sign-in prompt. Null rather than '':
+            // Tabby's profile editor drops a value equal to the default when it saves ('' while there is no default
+            // account), and one set later would then be taken; null is never a default, and is no account (see
+            // migrateConfig). The editor still offers "Ask for the account" or a saved one. The same for the gateway's
+            // account (a default one would send its proof to the gateway the file named) and the kind (a default of xrdp
+            // would have the password go without NLA, unasked): null is the desktop's own sign-in, and Windows. The
+            // clipboard is the one default left to inherit (see above): the user's own word for the group, and named in
+            // the question.
+            options: {
+                host: parsed.host, port: parsed.port, kind: null, username: parsed.username ?? '', domain: parsed.domain ?? '', account: null, via: '',
+                gateway: parsed.gateway ?? '', gatewayAccount: null, ...fileClipboard,
+            },
         };
         await this.profiles.newProfile(profile);
         // The file's display scale, as this desktop's own sharpness (the key a direct desktop's settings are kept by).
@@ -878,26 +1340,61 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         this.config.save();
         this.notifications.notice(`Added the remote desktop profile "${profile.name}" (Settings › Profiles & connections)`);
-        if (parsed.ignored.length) {
-            // What the file asked for beyond that, so nobody wonders why the desktop doesn't behave as in mstsc.
-            this.notifications.info(`${base} also asks for ${parsed.ignored.join('; ')}. Not applied.`);
+        // What the file asked for beyond that, so nobody wonders why the desktop doesn't behave as in mstsc. The microphone
+        // isn't among it while the setting is on: the desktop gets it then (the question said so). A note can quote the
+        // file (a gateway it names but doesn't use), shown as the file name is.
+        const ignored = parsed.ignored.filter(note => note !== rdpFile_1.MICROPHONE_NOTE || !this.settings().microphone);
+        if (ignored.length) {
+            const notes = ignored.join('; ').replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
+            this.notifications.info(`${base} also asks for ${notes}. Not applied.`);
         }
         if (response === 0) {
             await this.profiles.openNewTabForProfile(profile);
         }
         return profile;
     }
+    /**
+     * An .rdp file that turns the clipboard off leads to a profile there already is: opened as it is, that profile
+     * would share the clipboard all the same. Unless it is off there too, the user is asked whether to turn it off in
+     * that profile, or to open it as it is; nothing goes in silence. False when cancelled.
+     */
+    async clipboardOffForFile(profile, fileName) {
+        const now = (0, clipboard_1.ownClipboard)(this.profiles.getConfigProxyForProfile(profile).options?.clipboard) ?? this.settings().clipboard;
+        if (now === 'off') {
+            return true;
+        }
+        const { response } = await this.platform.showMessageBox({
+            type: 'warning',
+            message: `Turn the clipboard off for "${profile.name}"?`,
+            detail: `${fileName.replace(/^.*[\\/]/, '')} turns the clipboard off for its desktop, and "${profile.name}", already a ` +
+                `profile for that desktop, ${now === 'both' ? 'shares it both ways' : 'lets that desktop put things on your clipboard'}. ` +
+                'Turned off there, it is off from now on; if the desktop is open, what you copy after that stops going ' +
+                'to it (what it was reading already may still arrive), and the clipboard is off in full once the desktop reconnects.',
+            buttons: ['Turn it off and open', 'Open as it is', 'Cancel'],
+            defaultId: 0,
+            cancelId: 2,
+        });
+        if (response === 0) {
+            // As Tabby's profile editor saves a profile: new options in place of the old. Opening it then narrows its
+            // desktop if it is open already (see showDesktop).
+            profile.options = { ...profile.options, clipboard: 'off' };
+            this.config.save();
+        }
+        return response === 0 || response === 1;
+    }
     /** Asks, then removes a configured desktop (see removeDesktop). The menus and the settings page use this. */
     async confirmRemoveDesktop(index) {
         const d = this.configuredDesktops()[index];
-        if (!d) {
+        if (!(0, desktops_1.isDesktopEntry)(d)) {
             return false;
         }
-        const address = `${d.host ?? '127.0.0.1'}:${d.port ?? 3389}`;
+        // A Hyper-V VM's sign-in and certificate are its host's (see DesktopSession.authKey), which its other VMs use too.
+        const { name, address, via, hyperv } = (0, desktops_1.entryText)(d);
         const { response } = await this.platform.showMessageBox({
             type: 'warning',
-            message: `Remove the desktop "${d.name ?? address}"?`,
-            detail: `${address} behind ${d.via}. Its saved password and remembered certificate are forgotten too. ` +
+            message: `Remove the desktop "${name}"?`,
+            detail: (hyperv ? `A Hyper-V VM${via ? ` on ${via}` : ''}. The sign-in and certificate kept for its host stay, for its other VMs. `
+                : `${address}${via ? ` behind ${via}` : ''}. Its saved password and remembered certificate are forgotten too. `) +
                 'To open it instead, use its host\'s SSH tab: right-click › Open.',
             buttons: ['Remove', 'Keep'],
             defaultId: 1,
@@ -906,22 +1403,57 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (response !== 0) {
             return false;
         }
-        this.removeDesktop(index);
+        // Not waited for: the stores are asked meanwhile, which a Vault's passphrase prompt can hold up.
+        this.removeDesktop(index).catch(() => null);
         return true;
     }
-    /** Removes a configured desktop, its saved accounts and its remembered certificate. Open sessions to it keep running. */
-    removeDesktop(index) {
+    /**
+     * Removes a configured desktop, its saved passwords and its remembered certificate. Open sessions to it keep
+     * running. The desktop is gone from the list at once; what is kept for it goes as forgetDesktop says, which can
+     * take as long as a Vault's passphrase prompt does: a caller needn't wait for the result.
+     */
+    async removeDesktop(index) {
         const list = this.configuredDesktops();
         const [removed] = list.splice(index, 1);
-        if (!removed) {
+        if (!(0, desktops_1.isDesktopEntry)(removed)) {
             return;
         }
-        const id = `${removed.host ?? '127.0.0.1'}:${removed.port ?? 3389}`;
+        // Its desktop's id, which what is kept for it is under: a Hyper-V VM's included.
+        const id = (0, desktops_1.desktopIdOf)(removed);
         this.config.store.remoteDesktop.desktops = list;
-        this.forgetCertificatesFor(id);
         this.config.save();
         this.changed$.next();
-        (0, signin_1.forgetCredentialsFor)(id);
+        await this.forgetDesktop(id, false, `"${(0, desktops_1.entryText)(removed).name}"`);
+    }
+    /**
+     * Forgets what is kept for a desktop that is gone (removed from the list, or a direct profile deleted or sent
+     * through an SSH host): its saved passwords from each store that can be read, and then its remembered certificate,
+     * that of every desktop at that address behind any SSH host or, with `direct`, the direct one's. Where a store
+     * can't be read just now (Tabby's Vault locked and its prompt cancelled, the keychain not answering) its password
+     * stays, unused in this window (see forgetCredentialsFor), and so do the certificates: they are what keeps that
+     * password from going to a machine that isn't the one it was saved for, where a desktop behind a host trusts the
+     * first certificate it meets unasked. The user is told, and can forget them in Settings › Remote Desktop ›
+     * Certificates. `what` names the desktop for that.
+     */
+    async forgetDesktop(id, direct, what) {
+        const waiting = await (0, signin_1.forgetCredentialsFor)(id, direct ? { direct: true } : {});
+        if (waiting.length) {
+            this.notifications.info(`If a password was saved for ${what}, ${this.passwordWaits(waiting)} Its remembered certificate stays, ` +
+                'so that the password can only go to that machine: Settings › Remote Desktop › Certificates can forget it.');
+            return;
+        }
+        this.forgetCertificatesFor(id, direct);
+        this.config.save();
+        this.changed$.next();
+    }
+    /**
+     * What becomes of a desktop's saved password that couldn't be removed from `waiting`, the stores that can't be read
+     * just now (see forgetCredentialsFor), as the end of a sentence.
+     */
+    passwordWaits(waiting) {
+        const where = waiting.map(store => store === 'vault' ? 'Tabby\'s Vault' : 'the system keychain').join(' or ');
+        const when = waiting.length > 1 ? 'each can be read' : waiting[0] === 'vault' ? 'the Vault is unlocked' : 'the keychain answers';
+        return `it couldn't be removed from ${where} just now. It won't be used in this window, and is removed once ${when}, while the window stays open.`;
     }
     /**
      * Shows a desktop over the pane: `desktopId` (see desktopsOf), or the one it has open, or the default. A pane
@@ -929,23 +1461,33 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      */
     async showDesktop(pane, desktopId, options = {}) {
         this.prune();
+        // A desktop asked for by id is one of the pane's own host's (the menus list those), not one of wherever ssh
+        // typed in its console leads: an id from that list isn't to be looked up among the desktops of a machine the
+        // host names. Nor is a desktop open in the pane taken for it by its id alone: a machine's own desktop there has
+        // the id of the host's own.
+        const requested = desktopId ? options.target ?? await this.targets.targetOf(pane) : undefined;
         let session = this.sessions.get(pane);
-        if (session?.state === 'ended' || session && desktopId && session.spec.id !== desktopId) {
+        // One that ended (the server can end it whenever it likes) is shown again as a new connection, which keeps to the
+        // clipboard it was narrowed to (see clipboardCap), as a reconnect does: below, when it is the same desktop.
+        const ended = session?.state === 'ended' ? session : undefined;
+        if (session?.state === 'ended' || session && desktopId && (session.spec.id !== desktopId || requested && session.key !== (0, desktops_1.sessionKey)(requested, { id: desktopId }))) {
             this.disconnect(pane);
             session = undefined;
         }
         if (!session) {
-            const target = options.target ?? await this.remoteFor(pane);
+            const target = desktopId ? requested : options.target ?? await this.remoteFor(pane);
             if (target === undefined) {
                 return;
             }
             if (!target) {
-                this.notifications.error('No SSH connection found in this terminal');
+                // A remote desktop tab whose profile was changed to go through an SSH profile: that one opens over its tab.
+                this.notifications.error((0, targets_1.isRDPTab)(pane) ? `${pane.profile?.name ?? 'This profile'} no longer connects directly: open it from the profile list`
+                    : 'No SSH connection found in this terminal');
                 return;
             }
             if (this.sessions.has(pane)) {
-                // Opened meanwhile (e.g. a double click); just show it.
-                return this.showDesktop(pane, desktopId);
+                // Opened meanwhile (e.g. a double click); just show it, if it is the one asked for on the same remote.
+                return this.showDesktop(pane, desktopId, { ...options, target: requested ?? options.target });
             }
             const spec = desktopId ? this.desktopsOf(target).find(s => s.id === desktopId) : this.defaultDesktop(target);
             if (!spec) {
@@ -962,14 +1504,31 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     // Next to it, moving the focus there would go unnoticed.
                     this.help.note(pane.element.nativeElement, `${target.label}'s desktop is already open in the other pane.`, 'nested-ssh');
                 }
+                // Asked for with a narrower clipboard than the open one was connected with (another profile for the same
+                // desktop, say, or an .rdp file's): that one narrows to it, rather than the request getting more.
+                const open = this.sessions.get(existing);
+                if (open && this.applyClipboard(open, (0, clipboard_1.narrowest)(spec.clipboard ?? this.settings().clipboard, options.clipboardCap ?? 'both'))) {
+                    open.files?.toast(`Clipboard sharing with this desktop is now ${clipboard_1.CLIPBOARD_LABELS[open.clipboard].toLowerCase()}, as ` +
+                        `${spec.name} has it, until it is closed. The change applies in full once the desktop reconnects.`);
+                }
                 this.selectPane(existing);
                 return this.showDesktop(existing);
             }
             const created = new DesktopSession(pane.element.nativeElement, key, spec);
             created.onHelp = message => this.help.explain(message);
-            if (options.viewOnly) {
+            // The remote it is opened on, from the start: reopening one whose connection ended before it got as far as
+            // a sign-in (cancelled, or a setup that failed) goes there again, not to the tab's own host.
+            created.remote = target;
+            created.inFront = () => this.showsInFront(created);
+            // View only stays on for the same desktop shown again after its server ended it, as on a reconnect: the
+            // keys typed there would go to it otherwise.
+            if (options.viewOnly || ended?.key === key && ended.viewOnly) {
                 created.setViewOnly(true);
             }
+            const cap = (0, clipboard_1.narrowest)(options.clipboardCap ?? 'both', ended?.key === key ? ended.clipboardCap : 'both');
+            if (cap !== 'both') {
+                created.clipboardCap = cap;
+            }
             session = created;
             this.sessions.set(pane, created);
             // Released with the session: a pane outlives the desktops opened and closed in it.
@@ -978,7 +1537,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             // Tabby focuses the terminal when the pane gets focus (tab switch, split focus); take it back.
             const focused = pane.focused$.subscribe(() => {
                 if (created.visible) {
-                    setTimeout(() => created.visible && created.focusDesktop());
+                    setTimeout(() => created.visible && this.showsInFront(created) && created.focusDesktop());
                     this.label(pane, created);
                 }
             });
@@ -997,37 +1556,234 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const shown = session;
         setTimeout(() => this.followPane(pane, shown));
     }
+    /** Whether `key` is desk's key of a host whose setup gave it to this plugin (see openConsole). */
+    knowsDeskKey(key) {
+        const digest = (0, deskScript_1.deskKeyDigest)(key);
+        return !!digest && this.deskKeys().some(e => e.sha256 === digest);
+    }
     /**
      * `desk`: show this machine's desktop and bring the console along: a terminal on the desktop,
-     * attached to the console's tmux session (or opened in its folder when it isn't in tmux).
+     * attached to the console's shared session (or opened in its folder when it isn't in one).
      */
     async openConsole(pane, request) {
+        // Anything shown in a terminal can carry what `desk` prints: a file, a log, another machine's output. A request
+        // counts only with the key of a host whose setup gave it to this plugin, which only that user can read there;
+        // others are ignored before anything runs, here or on a host, and without a word in Tabby's window.
+        if (!this.knowsDeskKey(request.key)) {
+            console.warn(`desk: ignored a request ${request.key ? 'with a key no host gave this plugin' : 'without desk\'s key'}`);
+            return;
+        }
+        let gate = this.deskGates.get(pane);
+        if (!gate) {
+            gate = new deskScript_1.DeskGate();
+            this.deskGates.set(pane, gate);
+        }
+        await gate.run(async () => {
+            if (!this.settings().desk) {
+                // A hook left from when it was on; it goes away the next time a desktop opens there. Said when `desk` is
+                // typed, in the pane in front, not whenever a host likes (see below).
+                if (this.inFront(pane)) {
+                    this.notifications.info('`desk` is off: turn it on in the menu under Remote Desktop › Settings');
+                }
+                else {
+                    console.warn('desk: ignored a request while desk is off, from a pane that isn\'t in front');
+                }
+                return;
+            }
+            // A host can always send its own key, and a recording of `desk`'s output holds it: such a request mustn't show
+            // a desktop in a pane the user isn't in, where it would take the keyboard (and this computer's clipboard)
+            // from the pane they are typing in. `desk` is typed in the pane in front.
+            if (!this.inFront(pane)) {
+                this.help.note(pane.element.nativeElement, 'desk asked for this machine\'s desktop while this pane wasn\'t the one in front, so it wasn\'t shown. Run desk again here to show it.');
+                return;
+            }
+            await this.openConsoleFor(pane, request, (0, deskScript_1.deskKeyDigest)(request.key));
+        });
+    }
+    /**
+     * Whether the pane is the one the user is in: the focused pane of the active tab. A desktop that takes the focus
+     * anywhere else takes the keyboard from that pane, even in a tab that isn't showing: Tabby keeps those in the page,
+     * off screen. (Whether Tabby's window is in front doesn't matter here: what is decided is which pane has the
+     * keyboard once the user is back.)
+     */
+    inFront(pane) {
+        return (0, targets_1.desktopPaneOf)(this.app.activeTab) === pane;
+    }
+    /** Whether `session` is the desktop of the pane the user is in (see inFront). */
+    showsInFront(session) {
+        const pane = (0, targets_1.desktopPaneOf)(this.app.activeTab);
+        return !!pane && this.sessions.get(pane) === session;
+    }
+    /**
+     * Gives a desktop that just connected the keyboard, if it shows in the pane the user is in. Not when another pane is
+     * in front by now: the connection can take as long as the remote likes, and the keyboard (and this computer's
+     * clipboard, which follows it) stays where the user went. The pane takes it back when it gets the focus again.
+     */
+    focusIfInFront(pane, session) {
+        if (session.visible && this.inFront(pane)) {
+            session.focusDesktop();
+        }
+    }
+    /**
+     * Whether another pane of the pane's split is maximized over it (Tabby's pane-maximize): it is all but hidden then,
+     * nearly transparent behind that pane, so it counts as not showing (see takesAll and inView).
+     */
+    behindMaximized(pane) {
+        const maximized = this.splitOf(pane)?.getMaximizedTab?.();
+        return !!maximized && maximized !== pane;
+    }
+    async openConsoleFor(pane, request, digest) {
         const target = await this.targets.targetOf(pane);
         if (!target) {
             return;
         }
         // `desk` may run on another machine than the pane is connected to: `ssh` typed in its console, with the script
         // there through a shared home folder. That machine's desktop isn't this connection's to open.
+        let there = target;
         if (request.machine) {
             const machineOf = async (t) => (await t.exec('sh -s', deskScript_1.MACHINE_ID_COMMAND).catch(() => '')).trim();
             const machine = await machineOf(target);
-            if (machine && machine !== request.machine) {
+            if (!machine) {
+                // Without an answer it could be either machine.
+                this.notifications.error(`desk: couldn't ask ${target.label} which machine it is`);
+                return;
+            }
+            if (machine !== request.machine) {
                 // Typed `ssh` at the prompt: the machine it went to, when that is where desk ran.
+                there = null;
                 for (const nested of (0, ssh_1.isSSHTab)(pane) ? await this.targets.nestedSSH(pane).catch(() => []) : []) {
-                    const there = await this.targets.nestedTarget(pane, nested).catch(() => null);
-                    if (there && await machineOf(there) === request.machine) {
-                        return this.openConsoleOn(pane, there, request);
+                    const candidate = await this.targets.nestedTarget(pane, nested).catch(() => null);
+                    if (candidate && await machineOf(candidate) === request.machine) {
+                        there = candidate;
+                        break;
                     }
                 }
-                const there = request.hostname || 'another machine';
-                this.help.note(pane.element.nativeElement, `desk ran on ${there}, but this tab is connected to ${target.label}. ` +
-                    `Open ${there} in its own tab to use desk there.`, 'nested-ssh');
-                return;
+                if (!there) {
+                    const elsewhere = request.hostname || 'another machine';
+                    this.help.note(pane.element.nativeElement, `desk ran on ${elsewhere}, but this tab is connected to ${target.label}. ` +
+                        `Open ${elsewhere} in its own tab to use desk there.`, 'nested-ssh');
+                    return;
+                }
             }
         }
-        return this.openConsoleOn(pane, target, request);
+        // The key must be that machine's own: the one known may be another host's (a shared home folder gives several
+        // the same one), and one set up from another computer is learned by opening the desktop from this one.
+        const known = this.deskKeyOf(there.key);
+        if (known !== digest) {
+            this.help.note(pane.element.nativeElement, known
+                ? `desk on ${there.label} sent a key that isn't the one this Tabby has for it (it was set up again since, or the key is another machine's): open its desktop once, then run desk again.`
+                : `This Tabby doesn't know desk on ${there.label} yet: open its desktop once, then run desk again.`);
+            return;
+        }
+        return this.openConsoleOn(pane, there, request);
+    }
+    /** What the setups of GNOME hosts said about `desk` (`remoteDesktop.deskKeys`): its key's digest, by account. */
+    deskKeys() {
+        const list = this.config.store.remoteDesktop?.deskKeys;
+        return (Array.isArray(list) ? list : []).filter((e) => typeof e?.desktop === 'string' && typeof e?.sha256 === 'string');
+    }
+    deskKeyOf(key) {
+        return this.deskKeys().find(e => e.desktop === key)?.sha256 ?? '';
+    }
+    /**
+     * Notes `desk` going from on to off, wherever the setting was changed (here, another window, the config file,
+     * config sync): see deskGeneration. `before`: what it was just before a change made here, where that is known.
+     */
+    noteDesk(before = this.deskWasOn) {
+        const on = this.settings().desk;
+        if (before === true && !on) {
+            this.deskTurnedOff++;
+        }
+        this.deskWasOn = on;
+    }
+    /**
+     * A number that changes whenever what a setup of the host's that began earlier learned about `desk` there is no
+     * longer to be kept: desk was turned off since (for every host), or the host's key was forgotten (by a setup run
+     * with desk off, say). A setup asked to set desk up takes it as it starts, and gives a key only if it is still the
+     * same as it ends: one that began with desk on, which was turned off meanwhile and on again, or that another setup
+     * dropped the host's key under, would otherwise put its key back after the host was dropped from desk.
+     */
+    deskGeneration(key) {
+        return this.deskTurnedOff + (this.deskForgotten.get(key) ?? 0);
+    }
+    /**
+     * Keeps what a host's setup said about `desk`: its key's digest while desk is set up there (so that desk works after
+     * Tabby restarts too), nothing otherwise. Only a setup asked to set desk up (`requested`), with desk still on as it
+     * ends, and not turned off, or the host's key forgotten, since it began (`generation`, see deskGeneration), gives a
+     * key: a host whose setup ran with desk off has none (that setup removed it), so one it reports anyway is only a
+     * way in. Any other setup forgets the host's key: desk off, or the host's own desktop no longer GNOME's. One that
+     * began before desk was turned off and on again, or before the host's key was forgotten, changes nothing.
+     */
+    rememberDeskKey(key, endpoint, requested, generation) {
+        if (!this.settings().desk) {
+            this.forgetDeskKey(key);
+            return;
+        }
+        // Begun before desk was turned off (and on again), or before the host's key was forgotten (by a setup of its
+        // own with desk off, say): what it learned isn't kept, and what came since stays as it is, a newer setup's key
+        // or none, rather than being undone by this one.
+        if (generation !== this.deskGeneration(key)) {
+            return;
+        }
+        const sha256 = requested && endpoint.kind === 'gnome' ? (0, deskScript_1.deskKeyDigest)(endpoint.deskKey) : '';
+        if (!sha256) {
+            this.forgetDeskKey(key);
+            return;
+        }
+        if (this.deskKeyOf(key) === sha256) {
+            return;
+        }
+        const store = this.config.store.remoteDesktop;
+        const others = (Array.isArray(store.deskKeys) ? store.deskKeys : []).filter((e) => e?.desktop !== key);
+        store.deskKeys = [...others, { desktop: key, sha256 }];
+        this.config.save();
+    }
+    /** Forgets a host's desk key (see rememberDeskKey); saves only when there was one. */
+    forgetDeskKey(key) {
+        this.deskForgotten.set(key, (this.deskForgotten.get(key) ?? 0) + 1);
+        const store = this.config.store.remoteDesktop;
+        const list = Array.isArray(store.deskKeys) ? store.deskKeys : [];
+        const others = list.filter((e) => e?.desktop !== key);
+        if (others.length !== list.length) {
+            store.deskKeys = others;
+            this.config.save();
+        }
+    }
+    /**
+     * The host's setup (see prepareRemoteDesktop), with `desk` as it is set as it starts, and what it says about desk
+     * kept. A setup with desk off removes desk there, which is how a host is dropped (opening its desktop with desk
+     * off), so its key is forgotten before the host is asked anything: a host that answers with an error, with nothing
+     * the setup can use, or not at all keeps none. So is the key of one whose setup fails while desk is off. One that
+     * began before desk was turned off and on again keeps nothing it learned, and leaves what came since as it is (see
+     * deskGeneration).
+     */
+    async setUp(pane, target, takeOver = false) {
+        this.noteDesk();
+        const desk = this.settings().desk;
+        if (!desk) {
+            this.forgetDeskKey(target.key);
+        }
+        // After that, which is this setup's own: what changes the host's key's standing from here on is another's.
+        const generation = this.deskGeneration(target.key);
+        let endpoint;
+        try {
+            endpoint = await (0, remoteSetup_1.prepareRemoteDesktop)(target, desk, this.config.store.remoteDesktop?.sessionBackend, this.clientOf(pane), takeOver);
+        }
+        catch (e) {
+            if (!this.settings().desk) {
+                this.forgetDeskKey(target.key);
+            }
+            throw e;
+        }
+        this.rememberDeskKey(target.key, endpoint, desk, generation);
+        return endpoint;
     }
     async openConsoleOn(pane, target, request) {
+        // Asked again: the host decides how long its answers above take, and could wait until the user is elsewhere.
+        if (!this.inFront(pane)) {
+            this.help.note(pane.element.nativeElement, 'desk\'s desktop wasn\'t shown: another pane was in front by then. Run desk again here to show it.');
+            return;
+        }
         await this.showDesktop(pane, desktops_1.OWN_DESKTOP, { target });
         // Wait for the desktop (possibly another pane's, for the same account) to be connected.
         let session;
@@ -1049,8 +1805,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         try {
             const out = await target.exec('sh -s', (0, deskScript_1.consoleScript)(request));
-            const err = /^RD_ERR (.*)$/m.exec(out);
-            session.log.push(err ? `desk: ${err[1]}` : `desk: ${/^RD_OK (.*)$/m.exec(out)?.[1] ?? 'no result'}`);
+            // The host's words, as much of them as a notice shows: the host decides how long its lines are.
+            const err = /^RD_ERR (.{0,1000})/m.exec(out);
+            session.log.push(err ? `desk: ${err[1]}` : `desk: ${/^RD_OK (.{0,1000})/m.exec(out)?.[1] ?? 'no result'}`);
             if (err) {
                 this.notifications.error(`desk: ${err[1]}`);
             }
@@ -1088,9 +1845,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
         }
     }
+    /** The top-level tab holding a pane: the pane itself, or the split it is in. */
+    topTabOf(pane) {
+        return this.app.tabs.find(t => t === pane || (t instanceof tabby_core_1.SplitTabComponent && t.getAllTabs().includes(pane)));
+    }
     /** Brings a pane forward: its top-level tab, and the pane itself within a split. */
     selectPane(pane) {
-        const top = this.app.tabs.find(t => t === pane || (t instanceof tabby_core_1.SplitTabComponent && t.getAllTabs().includes(pane)));
+        const top = this.topTabOf(pane);
         if (top) {
             this.app.selectTab(top);
         }
@@ -1128,7 +1889,30 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         clearTimeout(this.reconnects.get(pane)?.timer);
         this.reconnects.delete(pane);
     }
-    /** Connects this pane's desktop again, keeping it shown or hidden as it was. */
+    /**
+     * The pane's desktop, reconnected, was up from `connectedAt` until now. Back for good once it stayed up STABLE_MS:
+     * a later drop starts the delays over. One that ended sooner (a server that ends every connection at once, say)
+     * goes on backing off, from when it dropped.
+     */
+    reconnectedUntilNow(pane, connectedAt) {
+        const reconnecting = this.reconnects.get(pane);
+        if (reconnecting && Date.now() - connectedAt >= RemoteDesktopService_1.STABLE_MS) {
+            this.reconnects.delete(pane);
+        }
+        else if (reconnecting) {
+            reconnecting.since = Date.now();
+        }
+    }
+    /** The browser took the desktop's video decoder back (`key`: its session's): whether it did so before, not long ago. */
+    decoderReclaimedAgain(key) {
+        const before = this.h264Reclaimed.get(key);
+        this.h264Reclaimed.set(key, Date.now());
+        return before !== undefined && Date.now() - before <= RemoteDesktopService_1.RECLAIMED_AGAIN_MS;
+    }
+    /**
+     * Connects this pane's desktop again, keeping it shown or hidden as it was, view only or not, and its clipboard no
+     * wider than a narrower way of opening it asked for (DesktopSession.clipboardCap).
+     */
     async reopen(pane, spec, automatic = false) {
         if (!automatic) {
             this.cancelReconnect(pane);
@@ -1136,8 +1920,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const session = this.sessions.get(pane);
         const background = !!session && !session.visible;
         this.drop(pane, false);
-        // The same remote as before, even if the `ssh` it was found through has ended since.
-        await this.zone.run(() => this.showDesktop(pane, spec.id, { background, viewOnly: session?.viewOnly, target: session?.remote ?? undefined }));
+        // The same remote as before, even if the `ssh` it was found through has ended since. A remote desktop tab's one
+        // desktop is made afresh instead, from its profile as saved now (see RemoteTargets.targetOf), whose address may
+        // have changed meanwhile.
+        const tab = (0, targets_1.isRDPTab)(pane);
+        await this.zone.run(() => this.showDesktop(pane, tab ? undefined : spec.id, {
+            background, viewOnly: session?.viewOnly, target: tab ? undefined : session?.remote ?? undefined, clipboardCap: session?.clipboardCap,
+        }));
     }
     /** After a desktop ended: reconnect by itself if it dropped, otherwise offer to. */
     afterEnd(pane, target, spec, session, outcome) {
@@ -1156,6 +1945,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 : `Couldn't reconnect: ${outcome.error ?? outcome.reason ?? 'unknown error'}.`);
         }
         else if (outcome.connected) {
+            this.cancelReconnect(pane);
             session.status(`Remote desktop session ended: ${outcome.reason ?? 'unknown reason'}`, [again('Reconnect')]);
         }
         else {
@@ -1209,10 +1999,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             zoom: store.zoom === 'actual' ? 'actual' : 'fit',
             connectionStatus: store.connectionStatus === true,
             microphone: store.microphone === true,
+            clipboard: (0, clipboard_1.clipboardSetting)(store.clipboard),
             osd: (0, osd_1.osdSettings)(store.osd),
             discoverVMs: store.discoverVMs !== false,
             checkUpdates: store.checkUpdates !== false,
-            shutDownIdle: [5, 15, 60].includes(Number(store.shutDownIdle)) ? Number(store.shutDownIdle) : 0,
+            shutDownIdle: [5, 15, 60].includes((0, osd_1.configNumber)(store.shutDownIdle)) ? (0, osd_1.configNumber)(store.shutDownIdle) : 0,
         };
     }
     /** The folders shared with remote desktops as drives (`remoteDesktop.sharedFolders`), tidied. */
@@ -1251,31 +2042,87 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const value = (Array.isArray(list) ? list : []).find((e) => e?.desktop === key)?.sharpness;
         return value === 'retina' || value === 'standard' ? value : null;
     }
-    /** The settings for a desktop: the defaults, with its own sharpness if it has one. */
+    /**
+     * The settings for a desktop: the defaults, with its own sharpness and clipboard sharing where it has them, the
+     * clipboard no wider than a narrower way of opening it asked for while it was open (DesktopSession.clipboardCap).
+     */
     settingsFor(session) {
         const settings = this.settings();
-        return { ...settings, sharpness: this.sharpnessFor(session.key) ?? settings.sharpness };
+        return {
+            ...settings,
+            sharpness: this.sharpnessFor(session.key) ?? settings.sharpness,
+            clipboard: (0, clipboard_1.narrowest)(session.spec.clipboard ?? settings.clipboard, session.clipboardCap),
+        };
+    }
+    /**
+     * The ways the clipboard goes with the session's desktop now: what its connection lets through, and no more than
+     * the settings say now (also when they were changed in the config file rather than here).
+     */
+    clipboardWaysOf(session) {
+        return (0, clipboard_1.clipboardWays)(session.clipboard, this.settingsFor(session).clipboard);
+    }
+    /**
+     * Narrows what the session's connection lets through when the settings narrow it while connected, or `also` does (a
+     * narrower desktop opened onto this one: see showDesktop): this computer's clipboard stops going there at once (the
+     * component's reading stopped), the files offered there are taken back, and what the plugin sends and offers
+     * itself stops too. The rest of the narrowing, like widening, waits for the next connection, which sets the
+     * clipboard up anew. True when it narrowed.
+     */
+    applyClipboard(session, also) {
+        if (also) {
+            // Kept for this desktop's connections here, a retry while connecting and its reconnects included: see
+            // settingsFor and reopen.
+            session.clipboardCap = (0, clipboard_1.narrowest)(session.clipboardCap, also);
+        }
+        const narrowed = (0, clipboard_1.narrowest)(session.clipboard, this.settingsFor(session).clipboard);
+        if (narrowed === session.clipboard) {
+            return false;
+        }
+        // Narrowed first: taking the offered files back ends a paste of them, whose hook would start the reading
+        // again if the connection still let this computer's clipboard go (see setUpClipboard).
+        session.clipboard = narrowed;
+        if (!(0, clipboard_1.clipboardWays)(narrowed).toRemote) {
+            session.stopSending?.();
+            session.files?.revoke();
+        }
+        session.log.push(`clipboard: ${narrowed === 'off' ? 'off' : 'only from the remote desktop'} from now on ` +
+            '(in full once it reconnects)');
+        return true;
     }
     /** Changes a setting, saves it, and applies it to open desktops. */
     updateSettings(change) {
         const store = this.config.store.remoteDesktop;
         const { osd, ...rest } = change;
+        const desk = this.settings().desk;
         Object.assign(store, rest);
+        this.noteDesk(desk);
         if (osd) {
             // A nested object in Tabby's config takes its fields one by one (the object itself isn't replaced).
             Object.assign(store.osd, osd);
         }
         if (change.h264) {
             this.h264Failed.clear(); // turned on again: give it another try everywhere
+            this.h264Reclaimed.clear();
         }
         this.config.save();
         for (const [pane, session] of this.sessions) {
+            this.applyMicrophone(session);
             this.applyZoom(session);
             this.applyKeyboardMode(session);
+            this.applyClipboard(session);
             this.syncIndicator(session);
             this.followPane(pane, session);
         }
     }
+    /**
+     * The microphone setting turned off stops the session's microphone at once, also on a connection still being set
+     * up (run() reads the setting again where it makes the microphone). Turned on, it takes the next connection.
+     */
+    applyMicrophone(session) {
+        if (!this.settings().microphone) {
+            session.mic?.turnOff();
+        }
+    }
     /** IronRDP's keyboard mode for the session: characters (Unicode) or key positions (scancodes), per the setting. */
     applyKeyboardMode(session) {
         try {
@@ -1346,10 +2193,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         if (settings.resize === 'reconnect') {
             session.log.push(`resize: reconnecting at ${wanted.width}x${wanted.height}`);
-            const viewOnly = session.viewOnly;
+            const { viewOnly, clipboardCap } = session;
+            // The same remote and desktop as before, rather than looking (and maybe asking) again which one the pane
+            // is on, or taking the host's last used, which may be another pane's. A remote desktop tab's one desktop is
+            // made afresh, from its profile as saved now, as reopen does.
+            const tab = (0, targets_1.isRDPTab)(pane);
+            const target = tab ? undefined : session.remote ?? undefined;
             this.zone.run(() => {
                 this.disconnect(pane);
-                this.showDesktop(pane, undefined, { viewOnly });
+                this.showDesktop(pane, tab ? undefined : session.spec.id, { viewOnly, target, clipboardCap });
             });
             return;
         }
@@ -1420,8 +2272,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if ((0, targets_1.desktopPaneOf)(this.app.activeTab) !== pane) {
             this.selectPane(pane);
         }
-        // After a tab switch, the pane shows on Angular's next change detection.
-        for (let i = 0; i < 30; i++) {
+        // After a tab switch, the pane shows on Angular's next change detection. Not once the user went elsewhere
+        // meanwhile: the keyboard stays where they went.
+        for (let i = 0; i < 30 && this.showsInFront(session); i++) {
             session.focusDesktop(1);
             const focused = document.activeElement;
             if (focused?.tagName === 'IRON-REMOTE-DESKTOP' && session.overlay.contains(focused)) {
@@ -1484,20 +2337,27 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * that connection's own (behind the host, or where ssh was typed on to).
      */
     label(pane, session, always = false) {
-        const target = session.remote;
-        const osd = this.settings().osd;
-        if (session.state !== 'connected' || !session.visible || !target || osd.show === 'off' && !always) {
-            return;
+        // The overlay is cosmetic: whatever goes wrong with it, reading its settings included, mustn't fail the connection
+        // it names (see run()).
+        try {
+            const target = session.remote;
+            const osd = (0, osd_1.osdSettings)(this.config.store.remoteDesktop?.osd);
+            if (session.state !== 'connected' || !session.visible || !target || osd.show === 'off' && !always) {
+                return;
+            }
+            const inSplit = pane.parent instanceof tabby_core_1.SplitTabComponent && pane.parent.getAllTabs().length > 1;
+            const own = session.spec.id === desktops_1.OWN_DESKTOP;
+            if (osd.show === 'auto' && !always && !inSplit && own && !target.via) {
+                return;
+            }
+            // A desktop named after its host already says where it is ("buildhost desktop (xrdp)").
+            const through = own ? target.via : target.direct || session.spec.name.startsWith(target.label) ? null : target.label;
+            const size = session.remoteSize ? `${session.remoteSize.width}×${session.remoteSize.height}` : '';
+            session.flashLabel(own ? target.label : session.spec.name, [through ? `via ${through}` : '', size].filter(Boolean).join(' · '), osd);
         }
-        const inSplit = pane.parent instanceof tabby_core_1.SplitTabComponent && pane.parent.getAllTabs().length > 1;
-        const own = session.spec.id === desktops_1.OWN_DESKTOP;
-        if (osd.show === 'auto' && !always && !inSplit && own && !target.via) {
-            return;
+        catch (e) {
+            session.log.push(`overlay: ${e?.message ?? e}`);
         }
-        // A desktop named after its host already says where it is ("buildhost desktop (xrdp)").
-        const through = own ? target.via : target.direct || session.spec.name.startsWith(target.label) ? null : target.label;
-        const size = session.remoteSize ? `${session.remoteSize.width}×${session.remoteSize.height}` : '';
-        session.flashLabel(own ? target.label : session.spec.name, [through ? `via ${through}` : '', size].filter(Boolean).join(' · '), osd);
     }
     /** Shows the on-screen display on every desktop showing now, whatever `show` says (to try the settings). */
     showOsdEverywhere() {
@@ -1510,10 +2370,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         return shown;
     }
-    /** The one-time tip (see RemoteDesktopHelp.tipOnce), once a desktop is connected and showing. */
+    /**
+     * The one-time tip (see RemoteDesktopHelp.tipOnce), once a desktop is connected and showing. Closing it (Got it, or
+     * by itself after a while) gives the desktop the keyboard back only if its pane is the one in front by then: the
+     * user may have gone to another pane, in another tab too, which would lose the keyboard (and this computer's
+     * clipboard) to it. The pane takes it back when it gets the focus again.
+     */
     tip(pane, session) {
         if (session.state === 'connected' && session.visible) {
-            this.help.tipOnce(session.overlay, this.hasConsole(pane), () => session.visible && session.focusDesktop());
+            this.help.tipOnce(session.overlay, this.hasConsole(pane), () => session.visible && this.showsInFront(session) && session.focusDesktop());
         }
     }
     /** The open desktops, for the settings page (and bug reports): where they are, and their logs. */
@@ -1527,14 +2392,93 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             log: [...session.log],
         }));
     }
-    /** The certificates remembered for desktops (`remoteDesktop.trustedCertificates`). */
+    /**
+     * The desktops sent the microphone right now (the remote has it open), for the indicator in Tabby's header
+     * (header.ts), and whether each is in view, where the dot on it says so too.
+     */
+    microphoneUsers() {
+        this.prune();
+        return [...this.sessions].filter(([, session]) => session.mic?.capturing)
+            .map(([pane, session]) => ({ pane, name: session.spec.name, inView: this.inView(pane, session) }));
+    }
+    /** Stops sending the microphone to the pane's desktop at once, and on its later connections (see microphoneStopped). */
+    stopMicrophone(pane) {
+        const session = this.sessions.get(pane);
+        if (!session) {
+            return;
+        }
+        this.microphoneStopped.add(session.key);
+        session.log.push('microphone: stopped for this desktop, its reconnects included');
+        session.mic?.turnOff();
+        this.changed$.next();
+    }
+    /** Whether the microphone was stopped for the pane's desktop (see stopMicrophone). */
+    microphoneStoppedFor(pane) {
+        const session = this.sessions.get(pane);
+        return !!session && this.microphoneStopped.has(session.key);
+    }
+    /**
+     * Sends the microphone to the pane's desktop again, after a stop: when it asks for it, at once if it has it open,
+     * as long as the setting is on.
+     */
+    resumeMicrophone(pane) {
+        const session = this.sessions.get(pane);
+        if (!session || !this.microphoneStopped.delete(session.key)) {
+            return;
+        }
+        session.log.push('microphone: sent to this desktop again');
+        if (this.settings().microphone) {
+            session.mic?.turnOn();
+        }
+        this.changed$.next();
+    }
+    /** Brings the pane's desktop on screen: its tab, the pane within a split, and the desktop over the console. */
+    async bringForward(pane) {
+        if (this.sessions.has(pane)) {
+            this.selectPane(pane);
+            await this.showDesktop(pane);
+        }
+    }
+    /**
+     * The microphone of the pane's desktop started or stopped. The dot on the desktop shows only while the desktop
+     * does; the microphone in Tabby's header (header.ts) shows whatever is in front, and over the window when there is
+     * no header (full screen). The remote decides when it takes the microphone, so a capture that starts while its
+     * desktop isn't in view (the console in front, its tab in the background, the window hidden) is also said in a note,
+     * at most once a minute each time the desktop is opened.
+     */
+    microphoneChanged(pane, session, mic) {
+        session.overlay.classList.toggle('trd-mic-on', mic.capturing);
+        this.changed$.next();
+        if (mic.capturing && !this.inView(pane, session) && Date.now() - (this.microphoneNoted.get(session) ?? 0) > 60000) {
+            this.microphoneNoted.set(session, Date.now());
+            session.log.push('microphone: capturing while the desktop isn\'t in view');
+            // What the plugin knows is that the desktop asked for the microphone and gets it, not what it does with it.
+            this.zone.run(() => this.notifications.info(`${session.spec.name} is receiving your microphone, and that desktop isn't showing. ` +
+                'A red microphone in Tabby\'s header (in full screen, at the top of the window) shows while it does: click it to show the ' +
+                'desktop, or to stop sending the microphone there.'));
+        }
+    }
+    /**
+     * Whether the pane's desktop is in view: shown over its console, not behind a pane maximized over it (see
+     * behindMaximized), in the active tab, in a window that isn't hidden.
+     */
+    inView(pane, session) {
+        return session.visible && !this.behindMaximized(pane) && this.topTabOf(pane) === this.app.activeTab && document.visibilityState !== 'hidden';
+    }
+    /**
+     * The certificates remembered for desktops and gateways (`remoteDesktop.trustedCertificates`), with how each was
+     * trusted where that is known (see RememberedCertificate).
+     */
     trustedCertificates() {
         const list = this.config.store.remoteDesktop?.trustedCertificates;
         return (Array.isArray(list) ? list : [])
             .filter((e) => typeof e?.desktop === 'string' && typeof e?.sha256 === 'string')
-            .map((e) => ({ desktop: e.desktop, sha256: (0, rdcleanpath_1.normalizeFingerprint)(e.sha256) || e.sha256 }));
+            .map((e) => ({ desktop: e.desktop, sha256: (0, rdcleanpath_1.normalizeFingerprint)(e.sha256) || e.sha256, ...typeof e.authority === 'boolean' ? { authority: e.authority } : {} }));
     }
-    /** Forgets one remembered certificate (by session key); the next connection remembers the one it meets. */
+    /**
+     * Forgets one remembered certificate (by session key). The next connection asks about the one it meets (a desktop
+     * connected to directly, a gateway), unless an authority vouches for it; one behind an SSH host remembers it.
+     */
     forgetCertificate(key) {
         const store = this.config.store.remoteDesktop;
         store.trustedCertificates = (Array.isArray(store.trustedCertificates) ? store.trustedCertificates : []).filter((e) => e?.desktop !== key);
@@ -1543,9 +2487,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         this.config.save();
         this.changed$.next();
     }
-    /** Whether the desktop was allowed to sign in without Network Level Authentication (see refusedWithoutNla). */
+    /**
+     * Whether the desktop was allowed to sign in without Network Level Authentication (see refusedWithoutNla) with the
+     * certificate remembered for it now.
+     */
     signsInWithoutNla(key) {
-        return this.allowedWithoutNla(key);
+        const allowed = this.withoutNlaCertificate(key);
+        return !!allowed && allowed === this.trustedCertificates().find(e => e.desktop === key)?.sha256;
     }
     /** The split tab holding the pane, if it has more than one pane. */
     splitOf(pane) {
@@ -1558,10 +2506,17 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return split ? split.getAllTabs().filter(p => p !== pane).map(p => ({ pane: p, session: this.sessions.get(p) }))
             .filter(({ session }) => session?.state === 'connected' && !session.viewOnly && session.ui) : [];
     }
+    /**
+     * Whether the pane's desktop gets what is pasted or typed into all desktops of its tab: connected, taking input, and
+     * showing. One whose console is in front doesn't: nothing on screen would say that it gets them (its label is on its
+     * hidden layer), and the pane shows a terminal. Nor does one behind a pane maximized over it (see behindMaximized).
+     */
+    takesAll(pane, session) {
+        return !!session && session.state === 'connected' && !session.viewOnly && !!session.ui && session.visible && !this.behindMaximized(pane);
+    }
     /** How many desktops in the pane's tab would get a paste or typing (itself included), when that's more than one. */
     desktopsInTab(pane) {
-        const own = this.sessions.get(pane);
-        return this.othersInTab(pane).length + (own?.state === 'connected' && !own.viewOnly ? 1 : 0);
+        return this.othersInTab(pane).filter(other => this.takesAll(other.pane, other.session)).length + (this.takesAll(pane, this.sessions.get(pane)) ? 1 : 0);
     }
     isBroadcast(pane) {
         const split = this.splitOf(pane);
@@ -1594,7 +2549,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (!this.isBroadcast(pane)) {
             return;
         }
-        for (const { session } of this.othersInTab(pane)) {
+        for (const { pane: other, session } of this.othersInTab(pane)) {
+            // Only to the desktops showing (see takesAll). A key let go goes wherever it went down, so that none stays
+            // held on a desktop hidden since.
+            if (!this.takesAll(other, session) && !(type === 'keyup' && init.code && session.keysDown.has(init.code))) {
+                continue;
+            }
             try {
                 session.ui.sendKeyboardEvent(new KeyboardEvent(type, { ...init, cancelable: true }));
                 session.noteKey(type, init);
@@ -1607,17 +2567,41 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     /**
      * Pastes on every connected desktop in the pane's tab: files copied here are offered to each first (see
      * FileTransfer.pasteClipboardFiles); text and pictures are sent to each, since only the desktop with the focus
-     * follows this computer's clipboard on its own. Then Ctrl+V on each, in whatever window is active there.
+     * follows this computer's clipboard on its own. Then Ctrl+V on each, in whatever window is active there. Only the
+     * desktops showing get it (see takesAll). Those that don't take this computer's clipboard are left out, Ctrl+V
+     * included (it would paste something else there), and the pane says which.
      */
     pasteToAll(pane) {
-        const targets = [...this.sessions.get(pane) ? [{ pane, session: this.sessions.get(pane) }] : [], ...this.othersInTab(pane)]
-            .filter(({ session }) => session.state === 'connected' && !session.viewOnly && session.ui);
-        for (const { session } of targets) {
+        const all = [...this.sessions.get(pane) ? [{ pane, session: this.sessions.get(pane) }] : [], ...this.othersInTab(pane)]
+            .filter(({ pane: into, session }) => this.takesAll(into, session));
+        const { targets, left, note } = (0, clipboard_1.splitPaste)(all, ({ session }) => this.clipboardWaysOf(session), ({ session }) => session.spec.name);
+        if (note) {
+            left.forEach(({ session }) => session.log.push('paste to all desktops: left out: this computer\'s clipboard doesn\'t go to this desktop'));
+            const own = this.sessions.get(pane);
+            if (own?.visible && own.files) {
+                own.files.toast(note);
+            }
+            else {
+                this.notifications.info(note);
+            }
+        }
+        for (const { pane: into, session } of targets) {
             // Each pastes once it has taken in the new clipboard, however long that takes it.
             const offered = session.files?.pasteClipboardFiles() ?? false;
+            // Taken with nothing it could send (see FileTransfer.pasteClipboardFiles, which logs why): the remote
+            // wasn't asked, and didn't refuse anything.
+            const nothing = offered && session.files.nothingOffered;
             (offered ? session.files.offerAnswered() : this.sendClipboard(session)).then(ok => {
                 if (!ok) {
-                    session.log.push(`paste to all desktops: the remote refused the ${offered ? 'files' : 'clipboard'}`);
+                    session.log.push(nothing ? 'paste to all desktops: no Ctrl+V: none of the files copied here could be sent'
+                        : `paste to all desktops: the remote refused the ${offered ? 'files' : 'clipboard'}`);
+                    return;
+                }
+                // That can take seconds. Ctrl+V goes only if the desktop still takes a paste from here: not once the
+                // clipboard narrowed for it, or it went view only, out of sight or away meanwhile (`visible` stays true
+                // in a tab in the background, which isn't in view).
+                if (this.sessions.get(into) !== session || !this.takesAll(into, session) || !this.inView(into, session) || !this.clipboardWaysOf(session).toRemote) {
+                    session.log.push('paste to all desktops: no Ctrl+V: the desktop stopped taking a paste from here meanwhile');
                     return;
                 }
                 try {
@@ -1637,6 +2621,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * send, or no answer came: a paste then gets what that desktop has.
      */
     async sendClipboard(session) {
+        // Not where it doesn't go (pasteToAll leaves those desktops out before this).
+        if (!this.clipboardWaysOf(session).toRemote) {
+            return false;
+        }
         const answered = session.files?.clipboardAnswered() ?? new Promise(resolve => setTimeout(() => resolve(true), 300));
         try {
             await session.ui.sendClipboardData();
@@ -1691,9 +2679,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         // A Windows host is known from an earlier connect: no setup to run there (it would only fail again).
         if (spec.id === desktops_1.OWN_DESKTOP && !retryError && this.ownDesktops.get(target.key)?.kind !== 'windows') {
             session.status(`Preparing the remote desktop on ${target.label}…`);
-            const endpoint = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend, this.clientOf(pane));
+            const endpoint = await this.setUp(pane, target);
             this.ownDesktops.set(target.key, { kind: endpoint.kind, xrdpPort: endpoint.xrdpPort, xrdpUser: endpoint.xrdpUser });
-            // Only the setup knows which desktop the host has; the session follows it (graphics, sign-in, resizing).
+            endpoint.notes?.forEach(note => session.log.push(`setup: ${note}`));
+            // Only the setup knows which desktop the host has; the session follows it (graphics, sign-in, resizing). It is
+            // the host's word about itself, which spares no question (see DesktopSpec.kindTrusted).
             spec.kind = endpoint.kind;
             if (endpoint.kind === 'windows') {
                 session.log.push('setup: the SSH host runs Windows; its own desktop is its RDP server');
@@ -1714,7 +2704,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     }
                     if (choice === 'take') {
                         session.status(`Taking over the desktop on ${target.label}…`);
-                        gnome = await (0, remoteSetup_1.prepareRemoteDesktop)(target, this.settings().desk, this.config.store.remoteDesktop?.sessionBackend, this.clientOf(pane), true);
+                        gnome = await this.setUp(pane, target, true);
                         session.log.push(`setup: took the desktop over (${endpoint.clients} other connection(s))`);
                     }
                     else {
@@ -1739,7 +2729,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             hyperv = state.enhanced ? 'enhanced' : 'basic';
             session.log.push(`hyper-v: ${hyperv === 'enhanced' ? 'an enhanced session' : 'the basic console (the guest takes no enhanced session now)'}`);
             // The SSH user is who to try first: it got to list the VMs.
-            spec.username ??= target.key.replace(/@[^@]*$/, '') || undefined;
+            spec.username ??= (0, desktops_1.keyUser)(target.key) || undefined;
         }
         // A saved account (Settings): its user name, and its password from the keychain. One that has none yet, or that
         // this desktop just refused, is asked for here and saved for every desktop that uses the account.
@@ -1749,7 +2739,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         const again = this.askAgain.delete(pane);
         // A desktop whose account is gone asks, rather than falling back to a login of its own saved earlier.
-        let saved = retryError || again || spec.account && !account ? null : await (0, signin_1.loadCredentials)(account ? (0, accounts_1.accountKey)(account.id) : session.authKey);
+        let saved = retryError || again || spec.account && !account ? null : await (0, signin_1.loadCredentials)(account ? (0, accounts_1.accountKey)(account.id) : session.credentialKey);
         if (saved && account && saved.username !== (0, accounts_1.signInName)(account)) {
             // Kept for an earlier user name of the account (its change didn't reach the store): not this one's.
             session.log.push(`sign-in: the account's saved password is for ${saved.username}, not ${(0, accounts_1.signInName)(account)}; asking`);
@@ -1762,23 +2752,29 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             return { host: spec.host, port: spec.port, credentials: account ? { username: (0, accounts_1.signInName)(account), password: saved.password } : saved, remember: false, domain: account ? account.domain ?? '' : undefined, hyperv };
         }
         session.status('');
+        const mark = (0, signin_1.forgetMark)();
+        const accountRevision = account && this.accountRevisions.capture(account);
+        // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via". A machine reached
+        // with ssh typed in a host's console says which host: that host is what leads there.
+        const hostOwn = spec.id === desktops_1.OWN_DESKTOP || spec.kind === 'xrdp' && spec.host === '127.0.0.1';
+        const via = !target.via ? target.label : hostOwn ? target.via : `${target.label}, through ${target.via}`;
         const asked = (0, signin_1.askCredentials)(session.overlay, {
-            // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via".
-            title: spec.hyperv ? `Sign in to ${target.label}, to open ${spec.name}`
-                : spec.id === desktops_1.OWN_DESKTOP || target.direct || spec.kind === 'xrdp' && spec.host === '127.0.0.1' ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${target.label})`,
+            title: spec.hyperv ? `Sign in to ${target.label}${target.via ? ` (via ${target.via})` : ''}, to open ${spec.name}`
+                : hostOwn && !target.via || target.direct ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${via})`,
             username: account ? (0, accounts_1.signInName)(account) : spec.username,
-            error: retryError,
-            canRemember: true,
+            error: [retryError, account && accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: !account || accountRevision !== undefined,
             account: account?.name,
         }, session.disposed);
-        if (session.visible) {
-            setTimeout(() => session.visible && session.focusDesktop());
+        // Only in the pane in front, as when connected (see run()): the form gets the keyboard when its pane does.
+        if (session.visible && this.inFront(pane)) {
+            setTimeout(() => session.visible && this.showsInFront(session) && session.focusDesktop());
         }
         const entered = await asked;
         return entered && {
             host: spec.host, port: spec.port, credentials: entered, remember: entered.remember, domain: account ? account.domain ?? '' : undefined,
             saveKey: account && (0, accounts_1.accountKey)(account.id), saveLabel: account && `saved account ${account.name}`, saveFor: account && (0, accounts_1.signInName)(account),
-            hyperv,
+            hyperv, mark, accountRevision,
         };
     }
     async connect(pane, target, spec, session) {
@@ -1842,7 +2838,24 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                     asked.gatewayAccount = signIn;
                 }
                 // The proxy outlives an attempt: it reads the sign-in of the attempt it serves.
-                session.proxy ??= await (0, rdcleanpath_1.startRDCleanPathProxy)(() => gateway ? this.throughGateway(target, spec, session, gateway, endpoint) : target.openTcp(asked.host, asked.port), fingerprint => this.checkCertificate(session, fingerprint), m => session.log.push(m), { autologon: spec.kind === 'xrdp', withoutNla: () => this.checkWithoutNla(session) });
+                if (!session.proxy) {
+                    const proxy = await (0, rdcleanpath_1.startRDCleanPathProxy)((_destination, signal) => gateway ? this.throughGateway(target, spec, session, gateway, endpoint, signal) : target.openTcp(asked.host, asked.port), (fingerprint, valid, reason, details) => this.checkCertificate(session, fingerprint, valid, reason, details), m => session.log.push(m), {
+                        autologon: spec.kind === 'xrdp',
+                        withoutNla: () => this.checkWithoutNla(session),
+                        // Let through before TLS: the permission is held to the certificate the server then shows.
+                        withoutNlaCertificate: fingerprint => this.holdWithoutNla(session, fingerprint),
+                        // A desktop connected to directly is checked against its name and this computer's
+                        // certificate authorities (see checkTrusted). One behind an SSH host goes by that host's
+                        // names, which its certificate can't be checked against: trusted on first use.
+                        serverName: target.direct ? serverNameOf(asked.host) : undefined,
+                    });
+                    // The desktop was closed while the proxy started: closing it found no proxy, and nothing else would.
+                    if (!alive()) {
+                        proxy.close();
+                        return;
+                    }
+                    session.proxy = proxy;
+                }
                 const outcome = await this.run(pane, target, spec, session, rdp, asked);
                 if (outcome.certificate && alive()) {
                     // A changed certificate, now trusted: the same account again, without asking for it again.
@@ -1867,7 +2880,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 if (outcome.signInFailed && this.signsIn(spec) && attempt < 5 && alive()) {
                     // The desktop's own saved account goes. A shared one stays until a new password is entered: this
                     // desktop refusing it doesn't make it wrong for the others.
-                    await (0, signin_1.forgetCredentials)(session.authKey);
+                    await (0, signin_1.forgetCredentials)(session.credentialKey);
                     retryError = outcome.signInFailed;
                     endpoint = null;
                     continue;
@@ -1915,7 +2928,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.log.push('gateway: its saved account no longer exists; signing in with the desktop\'s');
             return undefined;
         }
-        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account) };
+        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account), accountRevision: this.accountRevisions.capture(account) };
         const saved = retryError ? null : await (0, signin_1.loadCredentials)(signIn.saveKey);
         if (saved && saved.username === (0, accounts_1.signInName)(account)) {
             session.log.push(`gateway: the saved account "${account.name}"`);
@@ -1925,12 +2938,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const asked = (0, signin_1.askCredentials)(session.overlay, {
             title: `Sign in to the gateway ${gateway.host}, to reach ${spec.name}`,
             username: (0, accounts_1.signInName)(account),
-            error: retryError,
-            canRemember: true,
+            error: [retryError, signIn.accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: signIn.accountRevision !== undefined,
             account: account.name,
         }, session.disposed);
-        if (session.visible) {
-            setTimeout(() => session.visible && session.focusDesktop());
+        // Only in the pane in front (see endpointFor).
+        if (session.visible && this.showsInFront(session)) {
+            setTimeout(() => session.visible && this.showsInFront(session) && session.focusDesktop());
         }
         const entered = await asked;
         return entered && { ...signIn, credentials: entered, remember: entered.remember };
@@ -1939,20 +2953,17 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * The proxy's stream to a desktop behind an RD Gateway (see gateway.ts): to the gateway as the SSH host (or this
      * computer) reaches it, signed in with the gateway's own account or else the desktop's, then on to the desktop.
      */
-    async throughGateway(target, spec, session, gateway, endpoint) {
+    async throughGateway(target, spec, session, gateway, endpoint, signal) {
         session.gatewayRefused = null;
         const own = endpoint.gatewayAccount;
         const credentials = own?.credentials ?? endpoint.credentials;
         session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its saved account' : 'the desktop\'s sign-in'}`);
         try {
-            const stream = await (0, gateway_1.openThroughGateway)(() => target.openTcp(gateway.host, gateway.port), gateway, { username: credentials.username, password: credentials.password, domain: (own ? own.domain : endpoint.domain ?? spec.domain) || undefined }, { host: endpoint.host, port: endpoint.port }, (fingerprint, valid) => this.checkGatewayCertificate(session, gateway, fingerprint, valid), { log: m => session.log.push(m), clientName: os.hostname() });
+            const stream = await (0, gateway_1.openThroughGateway)(() => target.openTcp(gateway.host, gateway.port), gateway, { username: credentials.username, password: credentials.password, domain: (own ? own.domain : endpoint.domain ?? spec.domain) || undefined }, { host: endpoint.host, port: endpoint.port }, (fingerprint, valid, reason, details) => this.checkGatewayCertificate(session, gateway, fingerprint, valid, reason, details), { log: m => session.log.push(m), clientName: os.hostname(), signal });
             // Entered a moment ago and taken by the gateway: kept, while the account is still what it was signed in as.
             if (own?.remember) {
                 own.remember = false;
-                const accountNow = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === own.saveKey);
-                if (accountNow && (0, accounts_1.signInName)(accountNow) === own.saveFor) {
-                    (0, signin_1.saveCredentials)(own.saveKey, own.credentials, own.saveLabel).then(() => session.log.push(`gateway: saved as the account's password in ${(0, signin_1.storeName)()}`), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
-                }
+                (0, signin_1.saveCredentialsIf)(own.saveKey, own.credentials, () => this.accountCurrent(own.saveKey, own.saveFor, own.accountRevision), own.saveLabel).then(saved => session.log.push(saved ? `gateway: saved as the account's password in ${(0, signin_1.storeName)()}` : 'gateway: not saved: the account changed meanwhile'), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             return stream;
         }
@@ -1964,70 +2975,161 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
     }
     /**
-     * A gateway's certificate, before the sign-in goes to it. One that is valid for the gateway's name by this
-     * computer's certificate authorities is accepted (a gateway on the internet has one); any other is trusted on
-     * first use, like a desktop's. Either way it is remembered, by the gateway's address: after a valid one, an invalid
-     * one is a change to decide on, not a first use.
+     * A gateway's certificate, before the sign-in goes to it. The sign-in reaches the gateway as a proof of the
+     * password, one that can be cracked offline, so a gateway is not trusted silently the way a desktop behind a host
+     * is: it is checked as a desktop connected to directly is (see checkTrusted), by the gateway's address, whether the
+     * gateway is reached from here or from an SSH host.
      */
-    checkGatewayCertificate(session, gateway, raw, valid) {
-        const fingerprint = (0, rdcleanpath_1.normalizeFingerprint)(raw);
-        const address = `${gateway.host}:${gateway.port}`;
-        const key = `gateway#${address}`;
+    checkGatewayCertificate(session, gateway, raw, valid, reason = '', details) {
+        const key = `gateway#${gateway.host}:${gateway.port}`;
+        this.checkTrusted(session, key, (0, rdcleanpath_1.normalizeFingerprint)(raw), valid, reason, gateway.host, { address: (0, desktopForm_1.formatAddress)(gateway.host, gateway.port), key }, details);
+    }
+    /**
+     * The certificate of a server whose name an authority can vouch for: a desktop connected to directly, an RD
+     * Gateway. One valid for that name by this computer's certificate authorities connects without asking, and is
+     * remembered as such. Any other is asked about the first time, with why it isn't valid and its fingerprint, before
+     * anything goes to the server, and is remembered once trusted (refusedCertificate). Once remembered, the same
+     * certificate connects, unless an authority's word is all that remembered it and no longer holds (it has expired,
+     * or the authority is gone from this computer's store): nobody confirmed it, so it is asked about as a first use. A
+     * different one: where an authority vouched for the one before, another it vouches for replaces it (a renewal,
+     * logged); one the user trusted stops the connection whatever replaces it, as does any replacement that isn't
+     * valid. Throws, with the problem on the session, to stop and ask. What a certificate says of itself (`details`)
+     * goes to the log whenever it isn't the one remembered, and with the problem to the question.
+     */
+    checkTrusted(session, key, fingerprint, valid, reason, name, gateway, details) {
+        const what = gateway ? 'gateway certificate' : 'certificate';
         const known = this.trustedCertificate(key);
-        if (valid || !known) {
-            if (known !== fingerprint) {
-                this.trustCertificate(key, fingerprint);
-            }
-            session.log.push(`gateway certificate: SHA-256 ${fingerprint}, ${valid ? `valid for ${gateway.host}` : 'remembered (first connection)'}`);
+        // Remembered before the two were told apart: a gateway's on an authority's word whatever came before, a
+        // desktop's held to the one remembered. Each keeps the rule it was checked by.
+        const byAuthority = known?.authority ?? key.startsWith('gateway#');
+        // Remembered on an authority's word, which no longer holds: the same certificate, but the user never confirmed
+        // it. One the user trusted (`authority` false) and one from before the two were told apart connect on their
+        // fingerprint, as they were remembered.
+        const lapsed = known?.sha256 === fingerprint && known.authority === true && !valid;
+        if (known && fingerprint === known.sha256 && !lapsed) {
+            if (valid && known.authority === undefined) {
+                // One remembered before, unasked, that an authority vouches for: from here on, a renewal by one goes
+                // through too, as it would for this certificate met for the first time now. One the user trusted stays
+                // the user's: a different one is asked about, whatever vouches for it.
+                this.trustCertificate(key, fingerprint, true);
+            }
+            session.log.push(`${what}: SHA-256 ${fingerprint}, as remembered${valid ? `, valid for ${name}` : ''}`);
             return;
         }
-        if (fingerprint !== known) {
-            session.certificateProblem = { expected: known, actual: fingerprint, pinned: false, gateway: { address, key } };
-            throw new Error(`the gateway's certificate SHA-256 ${fingerprint} is not the one remembered (${known})`);
+        if (lapsed) {
+            session.log.push(`${what}: SHA-256 ${fingerprint}, as remembered, but no longer valid for ${name}: ${reason || 'unchecked'}`);
+        }
+        if (details) {
+            session.log.push(`${what}: ${(0, authorities_1.describeCertificate)(details, !(0, authorities_1.vouched)(valid, details))}`);
+        }
+        if (valid && (!known || byAuthority)) {
+            this.trustCertificate(key, fingerprint, true);
+            session.log.push(`${what}: SHA-256 ${fingerprint}, valid for ${name}${known ? `, in place of ${known.sha256} (renewed)` : ', remembered'}`);
+            return;
         }
-        session.log.push(`gateway certificate: SHA-256 ${fingerprint}, as remembered`);
+        // `expected` empty marks a first use rather than a change (see refusedCertificate), also for a remembered
+        // certificate that no longer holds.
+        const replaced = lapsed ? null : known;
+        const replaces = !replaced || byAuthority ? {} : { replaces: replaced.authority === false ? 'yours' : 'first use' };
+        session.certificateProblem = {
+            expected: replaced?.sha256 ?? '', actual: fingerprint, pinned: false, valid, name, reason, ...replaces, ...gateway ? { gateway } : {}, ...details ? { details } : {},
+        };
+        const whose = gateway ? 'the gateway\'s certificate' : 'certificate';
+        throw new Error(replaced
+            ? `${whose} SHA-256 ${fingerprint} is not the one remembered (${replaced.sha256})`
+            : `${whose} SHA-256 ${fingerprint} can't be verified (${reason || 'unchecked'}), and ${lapsed ? 'was remembered on an authority\'s word, which no longer holds' : 'hasn\'t been seen before'}`);
     }
-    /** The desktops allowed to sign in without Network Level Authentication (`remoteDesktop.withoutNla`), by session key. */
-    allowedWithoutNla(key) {
+    /**
+     * The certificate a desktop was allowed to sign in without Network Level Authentication with, or null
+     * (`remoteDesktop.withoutNla`, by session key: see holdWithoutNla). An entry without one isn't a permission: such a
+     * desktop asks again. Only development builds wrote those; 0.5.0 never saved the permission (`withoutNla` was
+     * missing from its defaults, so Tabby didn't write it).
+     */
+    withoutNlaCertificate(key) {
         const list = this.config.store.remoteDesktop?.withoutNla;
-        return (Array.isArray(list) ? list : []).some((e) => e?.desktop === key);
+        const value = (Array.isArray(list) ? list : []).find((e) => e?.desktop === key)?.sha256;
+        return typeof value === 'string' ? (0, rdcleanpath_1.normalizeFingerprint)(value) || null : null;
+    }
+    /** Whether a desktop was allowed to sign in without Network Level Authentication (see withoutNlaCertificate). */
+    allowedWithoutNla(key) {
+        return !!this.withoutNlaCertificate(key);
     }
     /**
      * The proxy found a server that doesn't use Network Level Authentication: the password would go to it as it is,
-     * before the server has shown anything but a certificate. That is how xrdp signs in, so an xrdp desktop goes on.
-     * A Windows machine or GNOME Remote Desktop always uses it unless it was turned off, and something posing as one
-     * (the address in a file someone sent) doesn't: those stop here, until the desktop is allowed (refusedWithoutNla).
+     * before the server has shown anything but a certificate. That is how xrdp signs in, so a desktop the user made an
+     * xrdp one goes on (see xrdpUnasked). A Windows machine or GNOME Remote Desktop always uses it unless it was turned
+     * off, and something posing as one (the address in a file someone sent), or as an xrdp desktop a host offers or
+     * says it has itself, doesn't: those stop here, until the desktop is allowed (refusedWithoutNla). One that was goes
+     * on to TLS, where the permission is held to the certificate it was given with (holdWithoutNla).
      */
     checkWithoutNla(session) {
-        if (session.spec.kind === 'xrdp') {
+        if ((0, desktops_1.xrdpUnasked)(session.spec)) {
+            session.plainSignIn = true;
             return;
         }
-        if (this.allowedWithoutNla(session.authKey)) {
+        if (session.sendAnyway || this.allowedWithoutNla(session.authKey)) {
             session.log.push('sign-in: without Network Level Authentication, as allowed for this desktop');
+            session.plainSignIn = true;
             return;
         }
         session.withoutNla = true;
         throw new Error('the server doesn\'t use Network Level Authentication');
     }
+    /**
+     * After the certificate check, for a server that doesn't use Network Level Authentication (checkWithoutNla let it on
+     * to TLS; the proxy's withoutNlaCertificate): the permission to send it the password is for the server with one
+     * certificate. Given just now, it is remembered with this one; one remembered holds only for the certificate it was
+     * given with. Anything else (a permission taken back meanwhile, by another connection of the desktop that trusted a
+     * new certificate) stops here, before the client hears back and so before the password goes, and asks again.
+     */
+    holdWithoutNla(session, fingerprint) {
+        if ((0, desktops_1.xrdpUnasked)(session.spec)) {
+            return;
+        }
+        if (session.sendAnyway) {
+            session.sendAnyway = false;
+            const store = this.config.store.remoteDesktop;
+            store.withoutNla = [...(Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => e?.desktop !== session.authKey), { desktop: session.authKey, sha256: fingerprint }];
+            this.config.save();
+            session.log.push(`sign-in: allowed without Network Level Authentication for certificate SHA-256 ${fingerprint}`);
+            return;
+        }
+        if (this.withoutNlaCertificate(session.authKey) === fingerprint) {
+            return;
+        }
+        session.withoutNla = true;
+        throw new Error('the server doesn\'t use Network Level Authentication, and wasn\'t allowed to sign in without it with this certificate');
+    }
     /**
      * After the proxy stopped at a server without Network Level Authentication; nothing but the connection request
-     * was sent to it. Says what going on would mean and asks; automatic reconnecting stops here. Resolves true to
-     * connect again (the desktop is then allowed, and remembered as such).
+     * (without the user name: see withoutUserCookie) was sent to it, or, where it stopped after the certificate check
+     * (see holdWithoutNla), the TLS handshake. Says what going on would mean and asks; automatic reconnecting stops
+     * here. Resolves true to connect again: the server that answers then may have the password, and the permission is
+     * remembered with its certificate (see holdWithoutNla).
      */
     async refusedWithoutNla(pane, target, spec, session) {
         this.cancelReconnect(pane);
         const alive = () => this.sessions.get(pane) === session;
         session.log.push('sign-in: the server doesn\'t use Network Level Authentication; asking before the password goes to it');
-        if (!session.visible) {
-            this.notifications.notice(`${spec.name}${target.direct ? '' : ` (via ${target.label})`} would get your password as it is. Open that desktop to decide.`);
-        }
+        // A note that stays a while (notice() is gone in a second): the question waits unseen until the user goes
+        // there.
+        if (!this.inView(pane, session)) {
+            this.notifications.info(`${spec.name}${target.direct ? '' : ` (via ${target.label})`} would get your password as it is. Open that desktop to decide.`);
+        }
+        // An xrdp desktop asks only where that it is xrdp is a host's word (see xrdpUnasked): a VM the host found, the
+        // host's own desktop, a machine reached through it. Only a desktop the user configured has a kind to set: a VM
+        // saved from the host's list (kindTrusted false, see xrdpFromHost) is told how.
+        const why = spec.kind === 'xrdp'
+            ? `xrdp signs in this way by design. That ${spec.name} is xrdp is what ${target.via ?? target.label} reported, not a ` +
+                `setting of yours: send the password if you know it is${spec.kindTrusted === false ? ', or pick its kind in its edit form, which makes it one' : ''}.`
+            : 'A Windows machine asks for Network Level Authentication unless that was turned off on it. A server posing as one doesn\'t' +
+                (spec.kindTrusted && spec.id !== desktops_1.OWN_DESKTOP ? `, and neither does xrdp: if ${spec.name} is an xrdp server, set its kind to xrdp instead.` : '.');
         const allowed = await new Promise(resolve => {
             session.status(`${spec.name} doesn't use Network Level Authentication, so your password would be sent to it as it is: ` +
-                'encrypted on the way, but readable to whatever answered there, before it has proved anything. Nothing has been sent.\n\n' +
-                'A Windows machine asks for Network Level Authentication unless that was turned off on it. A server posing as one doesn\'t, ' +
-                `and neither does xrdp: if ${spec.name} is an xrdp server, set its kind to xrdp instead.`, [
+                `encrypted on the way, but readable to whatever answered there, before it has proved anything. Your password hasn't been sent.\n\n${why}`, [
                 { label: 'Send the password anyway', run: () => resolve(true) },
-                { label: 'Cancel', run: () => resolve(false) },
+                // What Enter picks, as for the certificate questions: sending the password is the risk.
+                { label: 'Cancel', run: () => resolve(false), default: true },
             ], true);
             session.disposed.then(() => resolve(false));
         });
@@ -2040,19 +3142,21 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.status('Not connected: the password was not sent.', [{ label: 'Try again', run: () => this.reopen(pane, spec) }], true);
             return false;
         }
-        const store = this.config.store.remoteDesktop;
-        store.withoutNla = [...(Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => e?.desktop !== session.authKey), { desktop: session.authKey }];
-        this.config.save();
+        // Not remembered yet: the permission goes with a certificate, which the next attempt's server shows.
+        session.sendAnyway = true;
         return true;
     }
     /**
      * The proxy's check of the server's certificate, before any credentials go out. The host's own desktop must show
-     * the certificate its setup reported. Others (behind a host, a Windows host's own, a remote desktop tab's) are
-     * trusted on first use: remembered silently the first time (most connections already run inside SSH, and a prompt
+     * the certificate its setup reported. A desktop connected to directly (a remote desktop tab's: a profile, quick
+     * connect, an imported file, a restored tab) is checked against its name and this computer's certificate
+     * authorities, and asked about the first time when they don't vouch for it (see checkTrusted): nothing else stands
+     * between it and the network on the way. The others (behind a host, a Windows host's own) are trusted on first
+     * use: remembered silently the first time (the way there runs inside SSH, which vouches for the host, and a prompt
      * on every new desktop would only teach clicking it away), and refused when it changes, until the new one is
      * trusted (see refusedCertificate). Remembered by session key, like saved accounts.
      */
-    checkCertificate(session, fingerprint) {
+    checkCertificate(session, fingerprint, valid = false, reason = '', details) {
         session.certificateProblem = null;
         // The host's own GNOME desktop; its own xrdp makes its certificate itself, so that one is trusted on first use.
         if (session.spec.id === desktops_1.OWN_DESKTOP && session.spec.kind === 'gnome') {
@@ -2064,14 +3168,21 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.log.push(`certificate: SHA-256 ${fingerprint}, as set up`);
             return;
         }
-        const known = this.trustedCertificate(session.authKey);
+        if ((0, desktops_1.keyParts)(session.authKey).target === desktops_1.DIRECT_KEY) {
+            this.checkTrusted(session, session.authKey, fingerprint, valid, reason, serverNameOf(session.spec.host), undefined, details);
+            return;
+        }
+        const known = this.trustedCertificate(session.authKey)?.sha256;
+        if (details && fingerprint !== known) {
+            session.log.push(`certificate: ${(0, authorities_1.describeCertificate)(details, !(0, authorities_1.vouched)(valid, details))}`);
+        }
         if (!known) {
             this.trustCertificate(session.authKey, fingerprint);
             session.log.push(`certificate: SHA-256 ${fingerprint}, remembered (first connection)`);
             return;
         }
         if (fingerprint !== known) {
-            session.certificateProblem = { expected: known, actual: fingerprint, pinned: false };
+            session.certificateProblem = { expected: known, actual: fingerprint, pinned: false, ...details ? { details } : {} };
             throw new Error(`certificate SHA-256 ${fingerprint} is not the one remembered (${known})`);
         }
         session.log.push(`certificate: SHA-256 ${fingerprint}, as remembered`);
@@ -2120,9 +3231,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return choice ?? stopped(`Not opened: the desktop on ${target.label} is open somewhere else (another Tabby window or computer).`);
     }
     /**
-     * After the proxy refused a certificate; nothing was sent to that server. The host's own desktop: an error, since
-     * the plugin made that certificate itself. Others: both fingerprints, to trust the new certificate or not. Either
-     * way, automatic reconnecting stops here. Resolves true to connect again (the new certificate is then trusted).
+     * After the proxy refused a certificate; nothing of the sign-in was sent to that server (only the connection request
+     * and the TLS handshake). The host's own desktop: an error, since the plugin made that certificate itself. Others: a
+     * first one (see checkTrusted) with why it can't be verified (see whyNotValid), its fingerprint and what it says of
+     * itself (marked as its own word unless an authority vouched for it, see vouched), a changed one with both
+     * fingerprints, to trust it or not; Cancel is what Enter picks. Either way, automatic reconnecting stops here.
+     * Resolves true to connect again (the certificate is then trusted).
      */
     async refusedCertificate(pane, target, spec, session, endpoint, problem) {
         this.cancelReconnect(pane);
@@ -2132,24 +3246,73 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.changed$.next();
             session.status(message, [{ label: 'Try again', run: () => this.reopen(pane, spec) }], true);
         };
-        const fingerprints = `${problem.pinned ? 'Expected' : 'Remembered'} (SHA-256):\n${showFingerprint(problem.expected)}\n\nNow:\n${showFingerprint(problem.actual)}`;
         if (problem.pinned) {
+            const fingerprints = `Expected (SHA-256):\n${showFingerprint(problem.expected)}\n\nNow:\n${showFingerprint(problem.actual)}`;
             stop(`The remote desktop on ${target.label} answered with a certificate other than the one set up for it. ` +
                 `The connection was stopped before signing in.\n\n${fingerprints}\n\n` +
                 `Something other than GNOME Remote Desktop may be listening on port ${endpoint.port}.`);
             return false;
         }
-        // The desktop's, or its gateway's.
+        // The desktop's, or its gateway's. With nothing remembered (no expected fingerprint), a first use: a certificate
+        // no authority vouches for, where the sign-in would go, confirmed rather than trusted silently (see checkTrusted).
         const whose = problem.gateway ? `${spec.name}'s gateway ${problem.gateway.address}` : spec.name;
-        if (!session.visible) {
-            this.notifications.notice(`The certificate of ${whose}${target.direct ? '' : ` (via ${target.label})`} has changed. Open that desktop to decide.`);
-        }
+        const it = problem.gateway ? 'the gateway' : spec.name;
+        const via = target.direct ? '' : ` (via ${target.label})`;
+        // Named as the certificate was checked for them, as the .rdp import shows names: the desktop's as it resolves
+        // (an international name as its punycode, see serverNameOf), its gateway in its one form (see parseGateway).
+        const address = problem.gateway?.address ?? (0, desktopForm_1.formatAddress)(problem.name ?? spec.host, spec.port);
+        const throughGateway = !problem.gateway && spec.gateway ? (0, gateway_1.parseGateway)(spec.gateway) : null;
+        const firstUse = !problem.expected;
+        // What the certificate says of itself, under its fingerprint (shown as the import shows a file's): an issuer
+        // one wouldn't expect there (an authority that inspects the network's TLS) tells against it. Unless an
+        // authority vouched for it (`valid`), or its chain leads to one this computer trusts (another machine's
+        // certificate, which the names in it give away), all of it is the certificate's own word, which a certificate
+        // anyone made can match, an organisation's own issuer included: the line says so, where the user decides.
+        const about = problem.details ? `\n${(0, authorities_1.describeCertificate)(problem.details, !(0, authorities_1.vouched)(problem.valid, problem.details))}` : '';
+        const fingerprints = firstUse
+            ? `SHA-256:\n${showFingerprint(problem.actual)}${about}`
+            : `Remembered (SHA-256):\n${showFingerprint(problem.expected)}\n\nNow:\n${showFingerprint(problem.actual)}${about}`;
+        // Also for a desktop showing in a tab that isn't in front: the question doesn't take the keyboard there (see
+        // DesktopSession.status), and would wait unseen. A note that stays a while (notice() is gone in a second).
+        if (!this.inView(pane, session)) {
+            this.notifications.info(firstUse
+                ? `${whose}${via} has a certificate this computer can't verify. Open that desktop to decide.`
+                : `The certificate of ${whose}${via} has changed. Open that desktop to decide.`);
+        }
+        // Signing in without Network Level Authentication was allowed for the server with the old certificate, and goes
+        // with it, as when that is forgotten (see forgetCertificate); so does an answer given just now, before this
+        // certificate showed. A gateway's certificate has nothing to do with it.
+        const plain = !problem.gateway && (session.sendAnyway || this.allowedWithoutNla(session.authKey));
+        // Where an authority's word counts: why the certificate isn't valid, or, for one that wasn't remembered on an
+        // authority's word replaced by one an authority vouches for, why that is asked about all the same.
+        const why = problem.valid === false ? (0, authorities_1.whyNotValid)(problem.reason ?? '', problem.name ?? address, problem.details) : '';
+        const verdict = problem.valid === undefined ? ''
+            : problem.valid ? `The new one is valid for ${problem.name} by this computer's certificate authorities, but the one it replaces ` +
+                `${problem.replaces === 'yours' ? 'is one you trusted yourself' : 'was remembered the first time it was seen, without that check'}. `
+                : `The new one can't be verified: ${why}. `;
+        // What signing in gives the server: a proof of the password, with Network Level Authentication; without it (the
+        // proxy let this attempt's server on without, see checkWithoutNla), the password itself. A gateway gets a proof.
+        const gives = !problem.gateway && session.plainSignIn
+            ? `This server doesn't use Network Level Authentication: signing in sends it your password itself, readable to a server posing as ${it}.`
+            : `Signing in gives ${it} a proof of your password, which a server posing as ${it} could try to crack offline.`;
         const trusted = await new Promise(resolve => {
-            session.status(`The certificate of ${whose} has changed since it was last used. Nothing has been sent to it.\n\n` +
-                `${fingerprints}\n\nReinstalling the machine or renewing its certificate changes it. If neither happened, ` +
-                `something else may be answering at ${problem.gateway?.address ?? `${spec.host}:${spec.port}`}.`, [
-                { label: 'Trust the new certificate', run: () => resolve(true) },
-                { label: 'Cancel', run: () => resolve(false) },
+            // Nothing of the sign-in: the connection request and the TLS handshake have gone to the server by now.
+            session.status(firstUse
+                ? `${whose}${problem.gateway ? '' : ` (${address}${throughGateway ? `, through the gateway ${(0, gateway_1.formatGateway)(throughGateway)}` : ''})`} ` +
+                    `has a certificate this computer can't verify: ${why}. Nothing of your sign-in has been sent to it yet` +
+                    // The gateway on the way has had the sign-in already, as its own certificate allowed.
+                    `${throughGateway ? '; only the gateway has had your sign-in' : ''}. ${gives}\n\n${fingerprints}\n\n` +
+                    `Check this fingerprint with whoever runs ${it}, some other way than this connection, before you trust it. ` +
+                    'Once trusted, it is remembered, and a different certificate there stops the connection again.'
+                : `The certificate of ${whose} has changed since it was last used. Nothing of your sign-in has been sent to it.\n\n` +
+                    `${fingerprints}\n\n${verdict}Reinstalling the machine or renewing its certificate changes it. If neither happened, ` +
+                    `something else may be answering at ${address}.` +
+                    (plain ? '\n\nIt was allowed to sign in without Network Level Authentication, which goes with the old certificate: ' +
+                        'if the server still doesn\'t use it, you\'ll be asked again.'
+                        // An xrdp desktop of the user's, which signs in that way unasked (see xrdpUnasked).
+                        : !problem.gateway && session.plainSignIn ? `\n\n${gives}` : ''), [
+                { label: firstUse ? 'Trust the certificate' : 'Trust the new certificate', run: () => resolve(true) },
+                { label: 'Cancel', run: () => resolve(false), default: true },
             ], true);
             session.disposed.then(() => resolve(false));
         });
@@ -2157,23 +3320,36 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             return false;
         }
         if (!trusted) {
-            stop('Not connected: the new certificate was not trusted.');
+            stop(firstUse ? 'Not connected: the certificate was not trusted.' : 'Not connected: the new certificate was not trusted.');
             return false;
         }
-        this.trustCertificate(problem.gateway?.key ?? session.authKey, problem.actual);
-        session.log.push(`${problem.gateway ? 'gateway ' : ''}certificate: SHA-256 ${problem.actual}, trusted instead of ${problem.expected}`);
+        // Trusting a certificate never allows signing in without NLA. One allowed for a desktop whose first certificate
+        // is trusted now was allowed before any certificate of it was seen (that stop comes first, before TLS), and stays.
+        if (!problem.gateway && !firstUse) {
+            const store = this.config.store.remoteDesktop;
+            store.withoutNla = (Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => e?.desktop !== session.authKey);
+            session.sendAnyway = false;
+            if (plain) {
+                session.log.push('sign-in: no longer allowed without Network Level Authentication: that was for the old certificate');
+            }
+        }
+        // Where an authority's word counts, remembered as one the user trusted, or (a replacement it vouches for) as its.
+        this.trustCertificate(problem.gateway?.key ?? session.authKey, problem.actual, problem.valid);
+        session.log.push(`${problem.gateway ? 'gateway ' : ''}certificate: SHA-256 ${problem.actual}, ${firstUse ? 'trusted (first connection)' : `trusted instead of ${problem.expected}`}`);
         return true;
     }
-    /** The certificate remembered for a desktop behind a host (`remoteDesktop.trustedCertificates`), if any. */
+    /** The certificate remembered for a desktop or a gateway (`remoteDesktop.trustedCertificates`), if any. */
     trustedCertificate(key) {
         const list = this.config.store.remoteDesktop?.trustedCertificates;
-        const value = (Array.isArray(list) ? list : []).find((e) => e?.desktop === key)?.sha256;
-        return typeof value === 'string' ? (0, rdcleanpath_1.normalizeFingerprint)(value) || null : null;
+        const entry = (Array.isArray(list) ? list : []).find((e) => e?.desktop === key);
+        const sha256 = typeof entry?.sha256 === 'string' ? (0, rdcleanpath_1.normalizeFingerprint)(entry.sha256) : '';
+        return sha256 ? { sha256, ...typeof entry.authority === 'boolean' ? { authority: entry.authority } : {} } : null;
     }
-    trustCertificate(key, fingerprint) {
+    /** Remembers a server's certificate; `authority` as RememberedCertificate has it (none: trusted on first use). */
+    trustCertificate(key, fingerprint, authority) {
         const store = this.config.store.remoteDesktop;
         const others = (Array.isArray(store.trustedCertificates) ? store.trustedCertificates : []).filter((e) => e?.desktop !== key);
-        store.trustedCertificates = [...others, { desktop: key, sha256: fingerprint }];
+        store.trustedCertificates = [...others, { desktop: key, sha256: fingerprint, ...authority === undefined ? {} : { authority } }];
         this.config.save();
     }
     /**
@@ -2183,9 +3359,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     forgetCertificatesFor(desktopId, direct = false) {
         const store = this.config.store.remoteDesktop;
         const list = Array.isArray(store.trustedCertificates) ? store.trustedCertificates : [];
-        const forget = (key) => direct ? key === `${desktops_1.DIRECT_KEY}#${desktopId}` : key.endsWith(`#${desktopId}`) && !key.startsWith(`${desktops_1.DIRECT_KEY}#`);
-        store.trustedCertificates = list.filter((e) => !forget(String(e?.desktop ?? '')));
-        store.withoutNla = (Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => !forget(String(e?.desktop ?? '')));
+        // Anchored on the key's parts (see keyParts): a gateway pin or a desktop whose id is a suffix of this one's
+        // keeps its certificate.
+        const forget = (key) => {
+            const { target, desktopId: id } = (0, desktops_1.keyParts)(key);
+            return id === desktopId && (direct ? target === desktops_1.DIRECT_KEY : target !== desktops_1.DIRECT_KEY && target !== 'gateway');
+        };
+        // Keys as text only (String() of an object from the config can throw), as desktopEdited reads them.
+        store.trustedCertificates = list.filter((e) => !(typeof e?.desktop === 'string' && forget(e.desktop)));
+        store.withoutNla = (Array.isArray(store.withoutNla) ? store.withoutNla : []).filter((e) => !(typeof e?.desktop === 'string' && forget(e.desktop)));
     }
     /**
      * For a desktop with `wake`: when its RDP server doesn't answer (probed from the SSH host), starts it and waits
@@ -2244,6 +3426,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         session.certificateProblem = null;
         session.gatewayRefused = null;
         session.withoutNla = false;
+        session.plainSignIn = false;
         const el = document.createElement('iron-remote-desktop');
         try {
             el.setAttribute('scale', this.screenScale() === 3 ? 'real' : 'fit');
@@ -2251,11 +3434,22 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             el.module = rdp.Backend;
             const ready = new Promise(resolve => el.addEventListener('ready', (e) => resolve(e.detail.irgUserInteraction), { once: true }));
             session.host.replaceChildren(el);
-            session.ui = await ready;
-            // Files through the clipboard: registered before connecting, which sets up its channel messages.
+            // The element only gets ready in the page: one whose desktop was closed meanwhile (the layer gone) never does.
+            // Closed as it got ready, it isn't given the clipboard, files and the rest that closing it has ended already.
+            session.ui = await Promise.race([ready, session.disposed.then(() => null)]);
+            if (!session.ui || !alive()) {
+                return { connected: false };
+            }
+            // Files through the clipboard: registered before connecting, which sets up its channel messages. The
+            // clipboard goes only the ways the settings let it, as they are now, for this connection (see clipboard.ts).
             session.files?.dispose();
-            session.files = new fileTransfer_1.FileTransfer(rdp, session.overlay, m => session.log.push(m));
-            session.ui.enableFileTransfer(session.files.provider);
+            // What it reads for the remote waits for room in the connection (see ServerFlow).
+            session.files = new fileTransfer_1.FileTransfer(rdp, session.overlay, m => session.log.push(m), () => this.clipboardWaysOf(session), session.proxy ?? undefined);
+            const clipboard = (0, clipboard_1.setUpClipboard)(session.ui, session.files.provider, this.settingsFor(session).clipboard, () => this.clipboardWaysOf(session).toRemote);
+            session.clipboard = clipboard.mode;
+            session.stopSending = clipboard.stopSending;
+            session.log.push(`clipboard: ${clipboard.mode === 'both' ? 'both ways'
+                : clipboard.mode === 'fromRemote' ? 'only from the remote desktop (this computer\'s is neither read nor sent)' : 'off (no clipboard channel)'}`);
             // The component outlines itself while it has the keyboard; the desktop should look like the
             // terminal it replaces, edge to edge. Its styles live in a shadow root, so adopt a sheet there.
             // Not a <style> element: the component only forwards keys while its own container is the shadow
@@ -2298,7 +3492,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
             session.h264?.close();
             session.h264 = null;
-            if (spec.kind !== 'xrdp' && !basic && typeof rdp.graphicsPipeline === 'function' && await this.useH264(rdp, session, settings)) {
+            const h264 = spec.kind !== 'xrdp' && !basic && typeof rdp.graphicsPipeline === 'function' && await this.useH264(rdp, session, settings);
+            // Asking the browser about H.264 can take a moment, the first time: a desktop closed meanwhile gets no decoder,
+            // sound, microphone or drives, which nothing would close.
+            if (!alive()) {
+                return { connected: false };
+            }
+            if (h264) {
                 session.h264 = new rdp.WebCodecsH264Decoder({ onFailure: (reason) => session.log.push(`h264: failed: ${reason}`) });
                 config.withExtension(rdp.h264Decoder(session.h264));
             }
@@ -2321,9 +3521,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
             session.mic?.close();
             session.mic = null;
-            if (settings.microphone && !basic && typeof rdp.audioInput === 'function') {
+            // The setting as it is now: `settings` was read before the wait for H.264 above, and turned off meanwhile it
+            // found no microphone here to stop (see applyMicrophone).
+            if (this.settings().microphone && !basic && typeof rdp.audioInput === 'function') {
                 const ui = session.ui;
-                const mic = new microphone_1.Microphone(pcm => ui.invokeExtension(rdp.audioInputData(pcm)), () => session.overlay.classList.toggle('trd-mic-on', mic.capturing), m => session.log.push(m), m => this.zone.run(() => this.notifications.error(m)));
+                const mic = new microphone_1.Microphone(pcm => ui.invokeExtension(rdp.audioInputData(pcm)), () => this.microphoneChanged(pane, session, mic), m => session.log.push(m), m => this.zone.run(() => this.notifications.error(m)));
+                // Stopped for this desktop, also on this connection, which its server may have brought about by ending
+                // the last one. The remote can still open the microphone, and gets nothing until it is turned back on.
+                if (this.microphoneStopped.has(session.key)) {
+                    mic.turnOff();
+                }
                 session.mic = mic;
                 config.withExtension(rdp.audioInput(mic.callback));
             }
@@ -2333,7 +3540,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.drives = null;
             const folders = this.sharedFolders();
             if (folders.length && spec.kind !== 'gnome' && !basic && typeof rdp.driveRedirection === 'function') {
-                session.drives = new drives_1.SharedDrives(folders, m => session.log.push(m));
+                session.drives = new drives_1.SharedDrives(folders, m => session.log.push(m), session.proxy ?? undefined);
                 config.withExtension(rdp.driveRedirection(session.drives));
                 session.log.push(`drives: ${folders.map(f => `${f.name}${f.readOnly ? ' (read-only)' : ''}`).join(', ')}`);
             }
@@ -2358,7 +3565,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }
                 // IronErrorKind: 1 WrongPassword, 2 LogonFailure.
                 const kind = typeof e?.kind === 'function' ? e.kind() : undefined;
-                const detail = typeof e?.backtrace === 'function' ? e.backtrace() : (e?.message ?? String(e));
+                // Not the proxy's token, which is in the address IronRDP names when it can't connect there.
+                const detail = (0, rdcleanpath_1.withoutToken)(typeof e?.backtrace === 'function' ? e.backtrace() : (e?.message ?? String(e)), session.proxy);
                 if (kind === 1 || kind === 2) {
                     session.log.push(`sign-in failed: ${detail.split('\n')[0]}`);
                     return { connected: false, signInFailed: kind === 1 ? 'Wrong user name or password.' : 'The sign-in was refused.' };
@@ -2384,19 +3592,31 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.label(pane, session);
             this.syncIndicator(session);
             this.changed$.next();
-            this.reconnects.delete(pane); // connected again: a later drop starts over
             // Under a saved account only while that account is still there with the same sign-in name: the prompt may
             // have been open while it was removed or changed in Settings.
-            const accountNow = endpoint.saveKey ? this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === endpoint.saveKey) : undefined;
-            if (endpoint.remember && endpoint.saveKey && (!accountNow || (0, accounts_1.signInName)(accountNow) !== endpoint.saveFor)) {
-                session.log.push(`sign-in: not saved: the account ${accountNow ? 'changed' : 'was removed'} meanwhile`);
+            if (endpoint.remember && endpoint.saveKey) {
+                const key = endpoint.saveKey;
+                (0, signin_1.saveCredentialsIf)(key, credentials, () => this.accountCurrent(key, endpoint.saveFor, endpoint.accountRevision), endpoint.saveLabel).then(saved => session.log.push(saved ? `sign-in: saved as the account's password in ${(0, signin_1.storeName)()}` : 'sign-in: not saved: the account changed meanwhile'), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
-            else if (endpoint.remember) {
-                (0, signin_1.saveCredentials)(endpoint.saveKey ?? session.authKey, credentials, endpoint.saveLabel).then(() => session.log.push(`sign-in: saved ${endpoint.saveKey ? 'as the account\'s password ' : ''}in ${(0, signin_1.storeName)()}`), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
+            else if (endpoint.remember && endpoint.mark !== undefined && (0, signin_1.forgottenSince)(session.credentialKey, endpoint.mark)) {
+                // Edited (its user name, gateway or address) or removed while the server delayed the sign-in: what was
+                // forgotten then stays forgotten, and the desktop asks the next time.
+                session.log.push('sign-in: not saved: the desktop was changed or removed meanwhile');
             }
-            if (session.visible) {
-                session.focusDesktop();
+            else if (endpoint.remember) {
+                const key = endpoint.saveKey ?? session.credentialKey;
+                const writing = (0, signin_1.forgetMark)();
+                (0, signin_1.saveCredentials)(key, credentials, endpoint.saveLabel).then(() => {
+                    // A forget that came while it was being written (an edit, a removal) found nothing to forget
+                    // yet: it wins, and the password goes again now that it is there.
+                    if (!endpoint.saveKey && (0, signin_1.forgottenSince)(key, writing)) {
+                        session.log.push('sign-in: saved, then forgotten again: the desktop was changed or removed meanwhile');
+                        return (0, signin_1.forgetCredentials)(key);
+                    }
+                    session.log.push(`sign-in: saved ${endpoint.saveKey ? 'as the account\'s password ' : ''}in ${(0, signin_1.storeName)()}`);
+                }, e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
+            this.focusIfInFront(pane, session);
             const connectedAt = Date.now();
             let end;
             try {
@@ -2406,13 +3626,15 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 if (session.h264?.failed) {
                     // Reconnects (automatically, like any dropped connection) without H.264, unless the browser only
                     // took an idle decoder back (a hidden window): then with it, as a new stream starts with a key frame.
-                    if (session.h264.reclaimed) {
+                    // Taken back again soon after, it goes like any other failure: the connection would otherwise start
+                    // over and over for as long as the window stays hidden, or the browser keeps taking decoders back.
+                    if (session.h264.reclaimed && !this.decoderReclaimedAgain(session.key)) {
                         return { connected: true, error: 'the video decoder was reclaimed' };
                     }
                     this.h264Failed.add(session.key);
                     return { connected: true, error: `H.264 decoding failed (${session.h264.failed}); continuing without it` };
                 }
-                const error = typeof e?.backtrace === 'function' ? e.backtrace().split('\n')[0] : (e?.message ?? String(e));
+                const error = (0, rdcleanpath_1.withoutToken)(typeof e?.backtrace === 'function' ? e.backtrace().split('\n')[0] : (e?.message ?? String(e)), session.proxy);
                 // A Hyper-V host signs anyone in that it knows, and ends the connection at once when that account may not
                 // open the VM's console: a refused sign-in in effect, so the form comes back, saying so.
                 if (spec.hyperv && Date.now() - connectedAt < 5000 && /disconnect provider ultimatum/i.test(error)) {
@@ -2425,6 +3647,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 // The server can't close the microphone, or its files, once the connection is gone.
                 session.mic?.close();
                 session.drives?.dispose();
+                if (alive()) {
+                    this.reconnectedUntilNow(pane, connectedAt);
+                }
             }
             return { connected: true, reason: end?.reason?.() };
         }
@@ -2435,6 +3660,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
 };
 exports.RemoteDesktopService = RemoteDesktopService;
 RemoteDesktopService.RECONNECT_DELAYS = [1, 2, 4, 8, 15, 30];
+/** How long a connection has to stay up to count as back: a drop after that starts the delays over. */
+RemoteDesktopService.STABLE_MS = 30000;
+/** A video decoder the browser takes back twice within this turns H.264 off for the desktop (see run()). */
+RemoteDesktopService.RECLAIMED_AGAIN_MS = 10 * 60000;
 exports.RemoteDesktopService = RemoteDesktopService = RemoteDesktopService_1 = __decorate([
     (0, core_1.Injectable)({ providedIn: 'root' }),
     __metadata("design:paramtypes", [tabby_core_1.AppService,
@@ -2448,7 +3677,7 @@ exports.RemoteDesktopService = RemoteDesktopService = RemoteDesktopService_1 = _
         tabby_core_1.PlatformService])
 ], RemoteDesktopService);
 let styleInstalled = false;
-function installStyle() {
+function installStyle(compat) {
     if (styleInstalled) {
         return;
     }
@@ -2456,7 +3685,7 @@ function installStyle() {
     const style = document.createElement('style');
     style.textContent = STYLE + signin_1.STYLE + fileTransfer_1.STYLE + connectionStatus_1.STYLE + osd_1.OSD_STYLE + DRAGBAR_STYLE + accountForm_1.STYLE;
     document.head.appendChild(style);
-    keepWindowDraggable();
+    keepWindowDraggable(compat);
 }
 /** A strip the height of the tab bar that stays a window drag region over a dialog (the plugin's, and Tabby's). */
 const DRAGBAR_STYLE = `
@@ -2464,12 +3693,14 @@ const DRAGBAR_STYLE = `
 .modal > .trd-form-dragbar { display: block; position: fixed; left: 0; right: 0; top: 0; height: var(--tabs-height, 38px); -webkit-app-region: drag; }
 `;
 /**
- * Tabby's dialogs (ng-bootstrap modals) cover the whole window, tab bar included, with nothing marked as a drag
- * region, so the window can't be moved while one shows. Each gets a strip where the tab bar is; the dialog box itself
- * is below it. The plugin's own dialogs do the same (see settingsPage.ts).
+ * Older Tabby dialogs cover the tab bar without a drag region. Supply their fallback strip, deferring to the host's
+ * modal pseudo-element when it provides one. The plugin's own dialogs still need their strips (see settingsPage.ts).
  */
-function keepWindowDraggable() {
+function keepWindowDraggable(compat) {
     const strip = (modal) => {
+        if (compat.hasNativeModalDragRegion(modal)) {
+            return;
+        }
         if (!modal.querySelector(':scope > .trd-form-dragbar')) {
             const bar = document.createElement('div');
             bar.className = 'trd-form-dragbar';
@@ -2488,4 +3719,3 @@ function keepWindowDraggable() {
         }
     }).observe(document.body, { childList: true });
 }
-//# sourceMappingURL=desktop.service.js.map