tabby-rdp 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.5.2
+
+**Added**
+- **Updates settings** include stable and preview channels (beta releases and release candidates), automatic and
+  manual checks, compatible version selection, rollback and uninstall controls. Changes require confirmation and
+  take effect after restarting Tabby. Update preferences and installation history stay on this computer.
+- **Installation progress stays in the confirmation dialog**, with elapsed time and a verified success or failure
+  result. The dialog remains visible if Settings closes. The installed version is checked before reporting success.
+
+**Fixed**
+- **Commands through the system SSH report SSH's own failure** when it exits before reading their input,
+  instead of letting a broken-pipe error escape unhandled. Commands that ignore their input still return their output.
+- **Plugin startup waits for Tabby's configuration** before migrating update preferences, avoiding an error that
+  could disable third-party plugins for the session.
+
+**Changed**
+- **Troubleshooting opens the Markdown guide** from the links at the top of Remote Desktop settings. The former
+  Troubleshooting tab is now Updates; connection logs are under Desktops. Empty lists use concise status messages.
+- **Settings descriptions are shorter**, and help icons appear consistently after their descriptions.
+- **Troubleshooting and desk cleanup guides are included in the npm package.**
+- **Host compatibility checks share one layer**, with host and runtime versions, the host's declared xterm dependency,
+  and observed capabilities included in copied connection logs. Modal drag fallbacks and terminal input handling use
+  shared adapters that check the host's actual features, including on forks and nightly builds.
+- **CI and the release workflow check out the code with actions/checkout 7.0.1** (#56), pinned to its commit as before,
+  in place of 4.4.0. Nothing in the package changes.
+
 ## 0.5.1
 
 Security fixes from an audit of 0.5.0: saved passwords and certificates, what a host says about its desktops, `desk`,

package/README.md

@@ -20,8 +20,8 @@ Linux and Windows, side by side, through the SSH connections you already have.
 ---
 
 tabby-rdp is a plugin for the [Tabby](https://tabby.sh) terminal. Press a key in an SSH tab and the machine's desktop
-appears in its place; press it again and you're back at the shell. Everything travels inside the SSH connection:
-nothing is opened on the network, and nothing has to be installed on the remote machine beforehand.
+appears in its place; press it again and you're back at the shell. SSH desktops use the connection you already have;
+remote desktop profiles can also connect directly or through an RD Gateway.
 
 - **Linux desktops without a monitor or a login.** The plugin starts a headless GNOME session for your SSH user with
   GNOME Remote Desktop, on the fly, without root. A server in a rack works as well as a workstation.
@@ -40,8 +40,8 @@ nothing is opened on the network, and nothing has to be installed on the remote
 - **`desk`:** type `desk` in the console and the same shell, with its history and running programs, moves into a
   terminal on the desktop.
 
-Everything is in **Settings › Remote Desktop**, in tabs: getting started and the shortcuts, the settings, the name
-overlay, the desktops and certificates the plugin keeps, saved accounts, and troubleshooting.
+Everything is in **Settings › Remote Desktop**: Getting started, Settings, Overlay, Desktops, Accounts and Updates.
+The **Troubleshooting** link at the top opens the [troubleshooting guide](TROUBLESHOOTING.md).
 
 The remote desktop itself is [IronRDP](https://github.com/Devolutions/IronRDP)'s web client, running inside Tabby.
 Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([below](#built-on-ironrdp)).
@@ -49,6 +49,7 @@ Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([
 ## Contents
 
 - [Install](#install)
+- [Versions and recovery](#versions-and-recovery)
 - [Use](#use)
 - [Features](#features)
 - [Windows and other desktops behind a host](#windows-and-other-desktops-behind-a-host)
@@ -78,6 +79,24 @@ Or from a terminal, into Tabby's plugin folder (on macOS `~/Library/Application
 npm install tabby-rdp
 ```
 
+## Versions and recovery
+
+Open **Settings › Remote Desktop › Updates** to manage the installed version:
+
+- **Stable** is the default. **Preview** also offers beta releases and release candidates when available.
+- Automatic checks look for updates once a day. **Check now** checks manually; installation is always your choice.
+- Choose an exact compatible version, **Return to stable**, or **Restore previous version** after an installation
+  from this page. Version changes currently support **0.5.1 or newer**.
+- **Uninstall plugin…** removes the package. **Manage in Tabby…** opens Tabby's plugin controls to disable it.
+  Saved connections, settings, passwords and remote setup are kept.
+
+The confirmation dialog stays open during installation or removal and shows progress, elapsed time and the verified
+result. After success, close remote desktops and restart Tabby. Until then, Updates shows the running version and
+the installed version waiting for restart. Preferences and version history stay on this computer.
+
+See [troubleshooting and recovery](TROUBLESHOOTING.md#recovery) if the plugin cannot load or you want to clean up saved
+data or remote helpers.
+
 ## Use
 
 Open an SSH tab to a Linux machine with GNOME, and:
@@ -371,7 +390,7 @@ the open desktops that follow it, takes back the files offered to them, and stop
 several files that is under way before its next step. Narrowing applies in full only once they reconnect: reconnect a
 desktop you don't trust that far. **Paste to all desktops** leaves out the desktops that don't take this computer's
 clipboard and says which. Shared folders are a setting of their own, and screenshots and **Copy log** (Settings ›
-Remote Desktop › Troubleshooting) still go to your clipboard: they are your own actions.
+Remote Desktop › Desktops › Open desktops) still go to your clipboard: they are your own actions.
 
 ## Shared folders
 
@@ -495,7 +514,8 @@ desktop of a machine you don't trust with `desk` off, which also has Tabby forge
 ## Settings
 
 Open **Settings › Remote Desktop** in Tabby, right-click the desktop button in Tabby's header, or open **Settings** in the Remote Desktop section of a terminal's or tab's menu.
-They are stored in Tabby's config under `remoteDesktop`:
+Desktop settings are stored in Tabby's config under `remoteDesktop`; update preferences and installation history
+are local to this computer:
 
 | Setting | Default | |
 |---|---|---|
@@ -517,12 +537,12 @@ They are stored in Tabby's config under `remoteDesktop`:
 | Session backend (`sessionBackend`) | `native` | For `desk`: `native` (trd-pty) or `tmux`. Config file only. |
 | Find virtual machines on SSH hosts (`discoverVMs`) | On | Lists a host's libvirt VMs with a desktop in its menu ([VMs on a host](#vms-on-a-host)). |
 | Shut down VMs it started (`shutDownIdle`) | Never | 5, 15 or 60: minutes without a desktop open after which a VM the plugin started is shut down again ([VMs on a host](#vms-on-a-host)). |
-| Tell me about new versions (`checkUpdates`) | On | Once a day, asks npm for the latest tabby-rdp (nothing else is sent), and says so in a note, the menus and the settings page when there's a newer one: Tabby itself shows plugin upgrades only on its Plugins page. |
+| Check for updates automatically (Updates tab) | On, Stable | Checks npm once a day; choose Stable or Preview, check manually, and install a compatible version explicitly. [Versions and recovery](#versions-and-recovery). |
 | Desktop name overlay (`osd`) | When it helps | `show` (`auto`, `always`, `off`), `font`, `size`, `position`, `color` (empty: white; else a color name, `#hex`, or a color function of numbers such as `rgb()`) and `seconds`; the settings page previews it, at a resolution you pick. |
 
 ## Requirements
 
-- **Tabby 1.0.236 or newer**, on macOS, Windows or Linux (tested with 1.0.236 and 1.0.237). On a fresh Windows, Tabby
+- **Tabby 1.0.236 or newer**, on macOS, Windows or Linux. On a fresh Windows, Tabby
   itself needs the [Microsoft Visual C++ Redistributable](https://learn.microsoft.com/cpp/windows/latest-supported-vc-redist)
   for SSH.
 - **Linux desktops:** GNOME Shell and GNOME Remote Desktop 46 or newer (Ubuntu 24.04, for example), a systemd user
@@ -536,7 +556,13 @@ They are stored in Tabby's config under `remoteDesktop`:
   host or running OpenSSH Server itself.
 
 Tested with Ubuntu 24.04 (GNOME Remote Desktop 46.3) and Windows 11 (Pro and Enterprise), from Tabby on macOS,
-Windows 11 and Ubuntu 24.04 (arm64).
+Windows 11 and Ubuntu 24.04 (arm64). Recent host compatibility tests cover official Tabby **1.0.238** on macOS
+with xterm 5, and upstream xterm 6 builds on macOS and Linux. The new package installation dialog is tested on
+macOS with Tabby 1.0.238; Windows qualification of these changes remains pending. See the
+[host test matrix](test/README.md#host-qualification) for the exact builds and coverage.
+
+The plugin checks the host's available features through a shared compatibility layer. Connection logs include the
+host and runtime versions, declared xterm dependency and observed capabilities to help diagnose forks and nightlies.
 
 ## Built on IronRDP
 
@@ -573,8 +599,10 @@ it, not just this plugin.
 ## Development
 
 ```sh
-npm install
+npm ci --ignore-scripts
 npm run build                # TypeScript to dist/
+npm run typecheck            # plugin and test TypeScript
+npm run test:unit            # standard unit suite; no remote machine needed
 scripts/sandbox.sh           # a separate Tabby with this plugin linked in (macOS), DevTools on port 9334
 npm test                     # end-to-end suites against a test machine: see test/README.md
 npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches: see ironrdp/README.md
@@ -626,7 +654,8 @@ npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches:
 
 Questions ("how do I…", "is this expected?") go to [Discussions › Q&A](https://github.com/meanaverage/tabby-rdp/discussions/categories/q-a);
 bugs and feature requests to the [issues](https://github.com/meanaverage/tabby-rdp/issues). A bug report is most useful
-with the connection log: **Settings › Remote Desktop › Troubleshooting › Open desktops › Copy log**.
+with the connection log: **Settings › Remote Desktop › Desktops › Open desktops › Copy log**.
+Start with the [troubleshooting guide](TROUBLESHOOTING.md) for common connection and installation problems.
 
 ## License
 

package/TROUBLESHOOTING.md

@@ -0,0 +1,77 @@
+# Troubleshooting
+
+For connection logs, open **Settings › Remote Desktop › Desktops › Open desktops**, then choose **Copy log**. In version 0.5.1, the list is in **Troubleshooting**. Review logs before sharing them.
+
+<a id="certificate"></a>
+
+## A certificate this computer can't verify, or one that has changed
+
+A desktop you connect to directly (a remote desktop profile, an imported file) and an RD Gateway connect without asking when their certificate is valid for their name by this computer's certificate authorities, as an organisation's own desktops and gateways often are. Any other is shown the first time, with why it can't be verified (most often: it is the server's own, self-signed) and its fingerprint, before anything of your sign-in is sent: check the fingerprint with whoever runs it, some other way than this connection (it is also in the desktop's connection log), then choose **Trust the certificate**. The question also says whom the certificate says it was issued to and by, and when it is valid: its own word, which nothing has checked, unless its chain leads to an authority this computer trusts (another machine's certificate then shows that machine's name) and the TLS library didn't refuse it for a reason of its own (a limit set on the authority, say). An issuer you wouldn't expect there (one that inspects your network's connections, say) is worth asking about before you trust it, but the one you would expect proves nothing: anyone can make a certificate that names it. Only the fingerprint, checked some other way, does. A desktop behind an SSH host remembers its certificate on first use without asking, since the way there runs inside SSH. When a remembered certificate differs later, the plugin stops before signing in, so nothing of your sign-in has gone to that server; only a certificate an authority vouched for is replaced without a question, by another it vouches for too. Reinstalling the machine or renewing its certificate changes it: then choose **Trust the new certificate**. If neither happened, something else is answering at that address. A GNOME desktop only ever accepts the certificate the plugin made for it; a different one there means another program listens on its port. Remembered certificates are in Settings › Remote Desktop › Desktops.
+
+<a id="sign-in"></a>
+
+## Wrong user name or password
+
+Windows and xrdp desktops sign in with an account on that machine (`DOMAIN\user` works). A saved password that no longer works is asked for again; **Sign in again…** in the tab's menu replaces it on purpose. xrdp doesn't refuse a wrong password: it shows its own login window instead. GNOME desktops never ask: the plugin manages their sign-in.
+
+<a id="no-desktop"></a>
+
+## No desktop found on a Linux host
+
+The plugin uses GNOME Remote Desktop 46 or newer (Ubuntu 24.04, for example), with no root and no login screen. For KDE, XFCE, MATE and others, install xrdp and a desktop for its sessions: on Debian and Ubuntu, `sudo apt install xrdp xfce4`. A GNOME session already shared from the machine's own screen (GNOME's Desktop Sharing) has to be turned off first.
+
+<a id="unreachable"></a>
+
+## Can't reach a Windows desktop
+
+Windows needs Remote Desktop turned on (Settings › System › Remote Desktop; Pro, Enterprise or Server). Behind an SSH host, the address is as that host sees it: from there, `nc -z <address> 3389` should succeed. For a VM or machine that may be off, give the desktop a VM name or MAC address in its edit form and it is started when opened.
+
+<a id="reconnecting"></a>
+
+## It keeps reconnecting
+
+After sleep or a network change the desktop reconnects by itself, with growing pauses, and waits while the SSH connection is down (**Reconnect SSH** hurries that along). It stops after a few tries or on **Stop**. If it drops again right after connecting, check the host's free memory and that the desktop's session is still running there.
+
+<a id="picture"></a>
+
+## The picture is blurry or slow
+
+**Sharpness › Retina** renders at your screen's device pixels, with the remote's scale set to match. Video (H.264) is used when the remote sends it: Windows does, GNOME only with a hardware encoder (VA-API or NVENC). **Show connection status** shows the frame rate, the round trip and how the picture comes.
+
+<a id="sound"></a>
+
+## No sound, or the microphone isn't heard
+
+Sound and microphone changes apply on the next connection. xrdp needs `pipewire-module-xrdp` or `pulseaudio-module-xrdp`. The microphone needs the system's permission here (macOS: System Settings › Privacy & Security › Microphone, then restart Tabby). On GNOME, apps record from "Remoteaudio Source"; on Windows, the machine must allow audio recording redirection. A desktop whose microphone was stopped (**Stop** in the microphone's menu in Tabby's header, or **Send the microphone** unchecked in the desktop's menu) gets none, its reconnects included, until **Send the microphone** is checked again in its menu or that Tabby window is closed.
+
+<a id="nested-ssh"></a>
+
+## I typed ssh to another machine in a terminal
+
+In an SSH tab (or a split pane) where you typed `ssh` on to another machine, **Desktop** opens that machine's desktop, going through the first one, and `desk` works there too. Desktop asks which desktop you mean, since which `ssh` runs there is the first machine's to say; pick the other machine's "from now on" to have it open at once the next times. Desktops you set up behind a host open in a tab connected to that host, not through another one. The first machine has to log in to the other by itself for this: with a key there, or agent forwarding, as `ssh -o BatchMode=yes` would. Tabby's **Reconnect** belongs to the tab: it reconnects the first machine and ends the ssh typed in it. To have both desktops side by side, open the first machine's desktop in one pane, and ssh on in the other.
+
+<a id="extra-monitor"></a>
+
+## The desktop is open somewhere else
+
+GNOME Remote Desktop's headless mode gives each connection a screen of its own: a second computer, or another Tabby window, connected to the same account gets an empty extra screen rather than the same one. So when the desktop is open somewhere else already, you choose. **Take it over** disconnects the other connection, as Windows does; the session and its apps carry on, on this screen. **Open a second screen** keeps both, each with a screen of its own. A desktop taken over from here doesn't take itself back: it says so, and offers the same two choices.
+
+<a id="recovery"></a>
+
+## Recover a version, disable the plugin, or remove it
+
+In **0.5.2 or newer**, open **Settings › Remote Desktop › Updates**. **Stable** is the default; **Preview** includes beta releases and release candidates when available. Choose an exact published version and confirm installation. **Return to stable** can install an older version. **Restore previous version** uses the version saved after the last successful installation from this page. On older releases, manage the package in **Tabby › Settings › Plugins**.
+
+The confirmation dialog stays open through progress and the verified result. If installation fails, the dialog shows the cause. After success, close remote desktops and restart Tabby; Updates shows the running version and the installed version waiting for restart until then.
+
+Use **0.5.1 or newer** with current account and certificate settings, and respect any higher minimum documented by a later data migration.
+
+If the plugin cannot load:
+
+1. Open **Tabby › Settings › Plugins**. Disable **tabby-rdp** to stop it loading, or uninstall and reinstall it there. Restart Tabby after changing plugins. Tabby’s [configuration locations](https://github.com/Eugeny/tabby/wiki/Config-file) help locate your profile when the application cannot open.
+2. For a specific known compatible version, open a terminal in **Tabby's plugin folder** (the folder containing the plugin installation's `package.json`, with `node_modules/tabby-rdp` below it). Run `npm install tabby-rdp@0.5.1`, replacing `0.5.1` with your known compatible exact version. Do not run this in the tabby-rdp source checkout, the application bundle, or inside `node_modules/tabby-rdp` itself. Fully quit and reopen Tabby afterwards.
+3. If a later version has migrated saved data, respect that version's documented minimum. Reinstall a compatible stable version or the last working preview; do not force an older version across a migration boundary.
+
+Disabling or uninstalling keeps desktops, profiles, settings, remembered certificates and saved credentials. It also leaves any remote helpers and remote applications in place. To remove saved entries, use **Remote Desktop › Desktops** and **Accounts**, and **Profiles & connections** for profiles, before uninstalling. Unlock the credential store first if required; check any reported failure rather than assuming a credential was deleted. Data synced to other computers may need attention there too.
+
+For the optional `desk` remote helper, turn **Settings › Remote Desktop › Settings › desk: bring the console along** off and reconnect to each host while the plugin is still installed. The next connection removes the helper's own files and login hook; an offline host cannot be cleaned this way until it returns. Read the [desk cleanup details](docs/desk.md) for manual removal and read-only startup files. End remote applications you no longer need separately. Uninstalling this plugin does not shut down remote hosts or erase their files.

package/dist/accountRevisions.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountRevisions = exports.ACCOUNT_REMEMBER_UNAVAILABLE = void 0;
+const crypto_1 = require("crypto");
+/** No secrets: invalidates old sign-in forms in other windows before an account edit touches the store. */
+const PREFIX = 'tabby-rdp.account-revision.';
+exports.ACCOUNT_REMEMBER_UNAVAILABLE = 'To remember this password, save the account again in Settings and reopen this sign-in form.';
+class AccountRevisions {
+    constructor(storage = () => window.localStorage, coordinated = () => !!globalThis.navigator?.locks) {
+        this.storage = storage;
+        this.coordinated = coordinated;
+    }
+    /** A prompt may remember only when this window's account agrees with the shared revision. */
+    capture(account) {
+        const revision = account.credentialRevision ?? '';
+        return this.current(account.id, revision) ? revision : undefined;
+    }
+    current(id, revision) {
+        if (revision === undefined || !this.coordinated()) {
+            return false;
+        }
+        try {
+            const shared = this.storage().getItem(PREFIX + id);
+            return shared === null || shared === revision;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Synchronous publication: older writers fail their next check, including one already waiting on a store. */
+    change(id) {
+        if (!this.coordinated()) {
+            throw new Error('Saved account changes are unavailable. Restart or update Tabby and try again.');
+        }
+        const revision = (0, crypto_1.randomUUID)();
+        // A failed write must stop the edit: a revision held only in this window cannot invalidate another's form.
+        try {
+            this.storage().setItem(PREFIX + id, revision);
+        }
+        catch {
+            throw new Error('Saved account changes are unavailable. Restart Tabby and try again.');
+        }
+        return revision;
+    }
+}
+exports.AccountRevisions = AccountRevisions;

package/dist/accounts.js

@@ -16,7 +16,8 @@ function accountsOf(store) {
         }
         seen.add(id);
         const domain = typeof a.domain === 'string' && a.domain.trim() ? a.domain.trim() : undefined;
-        return [{ id, name: typeof a.name === 'string' && a.name.trim() ? a.name.trim() : signInName({ username, domain }), username, ...domain ? { domain } : {} }];
+        return [{ id, name: typeof a.name === 'string' && a.name.trim() ? a.name.trim() : signInName({ username, domain }), username,
+                ...domain ? { domain } : {}, ...typeof a.credentialRevision === 'string' ? { credentialRevision: a.credentialRevision } : {} }];
     });
 }
 /** A new account's id: nothing in it but that it is unused. */

package/dist/desktop.service.js

@@ -29,6 +29,7 @@ const microphone_1 = require("./microphone");
 const drives_1 = require("./drives");
 const desktopForm_1 = require("./desktopForm");
 const accounts_1 = require("./accounts");
+const accountRevisions_1 = require("./accountRevisions");
 const accountForm_1 = require("./accountForm");
 const fileTransfer_1 = require("./fileTransfer");
 const desktops_1 = require("./desktops");
@@ -45,6 +46,7 @@ const gateway_1 = require("./gateway");
 const authorities_1 = require("./authorities");
 const vms_1 = require("./vms");
 const sessionLog_1 = require("./sessionLog");
+const hostCompat_1 = require("./hostCompat");
 const unshowable_1 = require("./unshowable");
 /**
  * The keychain entry that marks the passwords 0.5.0 saved for desktops reached through a gateway forgotten from this
@@ -348,7 +350,7 @@ class DesktopSession {
     setVisible(visible) {
         this.visible = visible;
         this.overlay.style.display = visible ? '' : 'none';
-        this.container.querySelectorAll('textarea.xterm-helper-textarea').forEach(input => {
+        (0, hostCompat_1.terminalInputs)(this.container).forEach(input => {
             input.disabled = visible;
         });
         if (visible) {
@@ -478,6 +480,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops; and what the scans learnt of the host. */
         this.vms = new Map();
         this.lastUsed = new Map();
+        this.accountRevisions = new accountRevisions_1.AccountRevisions();
         /** Each pane's `desk` requests, one at a time (see DeskGate). */
         this.deskGates = new WeakMap();
         /**
@@ -833,6 +836,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     accounts() {
         return (0, accounts_1.accountsOf)(this.config.store.remoteDesktop);
     }
+    accountCurrent(key, name, revision) {
+        const account = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === key);
+        return !!account && (0, accounts_1.signInName)(account) === name && (account.credentialRevision ?? '') === revision && this.accountRevisions.current(account.id, revision);
+    }
     /**
      * The desktops that sign in with a saved account, or sign in to their RD Gateway with it: configured ones behind
      * SSH hosts, and RDP profiles (their own choice, or their profile group's default when they make none). Each comes
@@ -863,14 +870,31 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             username: account.username.trim(),
             ...account.domain?.trim() ? { domain: account.domain.trim() } : {},
         };
+        let revision;
+        try {
+            revision = this.accountRevisions.change(entry.id);
+        }
+        catch (error) {
+            return { id: entry.id, keychainError: error?.message ?? String(error) };
+        }
+        entry.credentialRevision = revision;
+        // Invalidate before any store await. Keep the old sign-in name until changing its password succeeds.
+        if (old) {
+            this.config.store.remoteDesktop.accounts = list.map(a => a.id === old.id ? { ...a, credentialRevision: revision } : a);
+            await this.config.save();
+        }
+        const current = () => this.accountRevisions.current(entry.id, revision) && (!old || this.accounts().some(a => a.id === entry.id && a.credentialRevision === revision));
         // The password first: a new user name must not be written while the old password (for the old name) stays, nor
         // a new password reported as saved when the store refused it.
         let keychainError;
         if (password !== undefined && password !== '') {
-            await (0, signin_1.saveCredentials)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
+            await (0, signin_1.saveCredentialsIf)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, current, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
         }
         else if (old && (0, accounts_1.signInName)(old) !== (0, accounts_1.signInName)(entry)) {
-            await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(entry.id)).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+            await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(entry.id), current).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+        }
+        if (!current()) {
+            return { id: entry.id, keychainError: 'The account changed again while this edit was being saved. The newer change was kept.' };
         }
         if (keychainError && !old) {
             // Not added at all: a retry would otherwise make a second account.
@@ -886,7 +910,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 delete entry.domain;
             }
         }
-        this.config.store.remoteDesktop.accounts = old ? list.map(a => a === old ? entry : a) : [...list, entry];
+        const now = this.accounts();
+        this.config.store.remoteDesktop.accounts = old ? now.map(a => a.id === old.id ? entry : a) : [...now, entry];
         await this.config.save();
         this.changed$.next();
         return { id: entry.id, keychainError };
@@ -923,11 +948,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (response !== 0) {
             return false;
         }
-        await this.removeAccount(id);
-        return true;
+        try {
+            await this.removeAccount(id);
+            return true;
+        }
+        catch (error) {
+            this.notifications.error(`The account could not be fully removed: ${error?.message ?? error}`);
+            return false;
+        }
     }
     /** Removes a saved account and its password; desktops that used it go back to asking. */
     async removeAccount(id) {
+        const revision = this.accountRevisions.change(id);
         const store = this.config.store.remoteDesktop;
         store.accounts = this.accounts().filter(a => a.id !== id);
         if (this.configuredDesktops().some(d => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id))) {
@@ -964,7 +996,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         await this.config.save();
         this.changed$.next();
-        await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(id)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
+        await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(id), () => this.accountRevisions.current(id, revision)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
     }
     /** `remoteDesktop.desktops`: the desktops configured behind SSH hosts. */
     configuredDesktops() {
@@ -2721,6 +2753,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         session.status('');
         const mark = (0, signin_1.forgetMark)();
+        const accountRevision = account && this.accountRevisions.capture(account);
         // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via". A machine reached
         // with ssh typed in a host's console says which host: that host is what leads there.
         const hostOwn = spec.id === desktops_1.OWN_DESKTOP || spec.kind === 'xrdp' && spec.host === '127.0.0.1';
@@ -2729,8 +2762,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             title: spec.hyperv ? `Sign in to ${target.label}${target.via ? ` (via ${target.via})` : ''}, to open ${spec.name}`
                 : hostOwn && !target.via || target.direct ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${via})`,
             username: account ? (0, accounts_1.signInName)(account) : spec.username,
-            error: retryError,
-            canRemember: true,
+            error: [retryError, account && accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: !account || accountRevision !== undefined,
             account: account?.name,
         }, session.disposed);
         // Only in the pane in front, as when connected (see run()): the form gets the keyboard when its pane does.
@@ -2741,7 +2774,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return entered && {
             host: spec.host, port: spec.port, credentials: entered, remember: entered.remember, domain: account ? account.domain ?? '' : undefined,
             saveKey: account && (0, accounts_1.accountKey)(account.id), saveLabel: account && `saved account ${account.name}`, saveFor: account && (0, accounts_1.signInName)(account),
-            hyperv, mark,
+            hyperv, mark, accountRevision,
         };
     }
     async connect(pane, target, spec, session) {
@@ -2895,7 +2928,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.log.push('gateway: its saved account no longer exists; signing in with the desktop\'s');
             return undefined;
         }
-        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account) };
+        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account), accountRevision: this.accountRevisions.capture(account) };
         const saved = retryError ? null : await (0, signin_1.loadCredentials)(signIn.saveKey);
         if (saved && saved.username === (0, accounts_1.signInName)(account)) {
             session.log.push(`gateway: the saved account "${account.name}"`);
@@ -2905,8 +2938,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         const asked = (0, signin_1.askCredentials)(session.overlay, {
             title: `Sign in to the gateway ${gateway.host}, to reach ${spec.name}`,
             username: (0, accounts_1.signInName)(account),
-            error: retryError,
-            canRemember: true,
+            error: [retryError, signIn.accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: signIn.accountRevision !== undefined,
             account: account.name,
         }, session.disposed);
         // Only in the pane in front (see endpointFor).
@@ -2930,10 +2963,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             // Entered a moment ago and taken by the gateway: kept, while the account is still what it was signed in as.
             if (own?.remember) {
                 own.remember = false;
-                const accountNow = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === own.saveKey);
-                if (accountNow && (0, accounts_1.signInName)(accountNow) === own.saveFor) {
-                    (0, signin_1.saveCredentials)(own.saveKey, own.credentials, own.saveLabel).then(() => session.log.push(`gateway: saved as the account's password in ${(0, signin_1.storeName)()}`), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
-                }
+                (0, signin_1.saveCredentialsIf)(own.saveKey, own.credentials, () => this.accountCurrent(own.saveKey, own.saveFor, own.accountRevision), own.saveLabel).then(saved => session.log.push(saved ? `gateway: saved as the account's password in ${(0, signin_1.storeName)()}` : 'gateway: not saved: the account changed meanwhile'), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             return stream;
         }
@@ -3564,11 +3594,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.changed$.next();
             // Under a saved account only while that account is still there with the same sign-in name: the prompt may
             // have been open while it was removed or changed in Settings.
-            const accountNow = endpoint.saveKey ? this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === endpoint.saveKey) : undefined;
-            if (endpoint.remember && endpoint.saveKey && (!accountNow || (0, accounts_1.signInName)(accountNow) !== endpoint.saveFor)) {
-                session.log.push(`sign-in: not saved: the account ${accountNow ? 'changed' : 'was removed'} meanwhile`);
+            if (endpoint.remember && endpoint.saveKey) {
+                const key = endpoint.saveKey;
+                (0, signin_1.saveCredentialsIf)(key, credentials, () => this.accountCurrent(key, endpoint.saveFor, endpoint.accountRevision), endpoint.saveLabel).then(saved => session.log.push(saved ? `sign-in: saved as the account's password in ${(0, signin_1.storeName)()}` : 'sign-in: not saved: the account changed meanwhile'), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
-            else if (endpoint.remember && !endpoint.saveKey && endpoint.mark !== undefined && (0, signin_1.forgottenSince)(session.credentialKey, endpoint.mark)) {
+            else if (endpoint.remember && endpoint.mark !== undefined && (0, signin_1.forgottenSince)(session.credentialKey, endpoint.mark)) {
                 // Edited (its user name, gateway or address) or removed while the server delayed the sign-in: what was
                 // forgotten then stays forgotten, and the desktop asks the next time.
                 session.log.push('sign-in: not saved: the desktop was changed or removed meanwhile');
@@ -3647,7 +3677,7 @@ exports.RemoteDesktopService = RemoteDesktopService = RemoteDesktopService_1 = _
         tabby_core_1.PlatformService])
 ], RemoteDesktopService);
 let styleInstalled = false;
-function installStyle() {
+function installStyle(compat) {
     if (styleInstalled) {
         return;
     }
@@ -3655,7 +3685,7 @@ function installStyle() {
     const style = document.createElement('style');
     style.textContent = STYLE + signin_1.STYLE + fileTransfer_1.STYLE + connectionStatus_1.STYLE + osd_1.OSD_STYLE + DRAGBAR_STYLE + accountForm_1.STYLE;
     document.head.appendChild(style);
-    keepWindowDraggable();
+    keepWindowDraggable(compat);
 }
 /** A strip the height of the tab bar that stays a window drag region over a dialog (the plugin's, and Tabby's). */
 const DRAGBAR_STYLE = `
@@ -3663,12 +3693,14 @@ const DRAGBAR_STYLE = `
 .modal > .trd-form-dragbar { display: block; position: fixed; left: 0; right: 0; top: 0; height: var(--tabs-height, 38px); -webkit-app-region: drag; }
 `;
 /**
- * Tabby's dialogs (ng-bootstrap modals) cover the whole window, tab bar included, with nothing marked as a drag
- * region, so the window can't be moved while one shows. Each gets a strip where the tab bar is; the dialog box itself
- * is below it. The plugin's own dialogs do the same (see settingsPage.ts).
+ * Older Tabby dialogs cover the tab bar without a drag region. Supply their fallback strip, deferring to the host's
+ * modal pseudo-element when it provides one. The plugin's own dialogs still need their strips (see settingsPage.ts).
  */
-function keepWindowDraggable() {
+function keepWindowDraggable(compat) {
     const strip = (modal) => {
+        if (compat.hasNativeModalDragRegion(modal)) {
+            return;
+        }
         if (!modal.querySelector(':scope > .trd-form-dragbar')) {
             const bar = document.createElement('div');
             bar.className = 'trd-form-dragbar';

package/dist/desktopForm.js

@@ -10,6 +10,7 @@ const desktops_1 = require("./desktops");
 const gateway_1 = require("./gateway");
 const osd_1 = require("./osd");
 const wake_1 = require("./wake");
+const hostCompat_1 = require("./hostCompat");
 /** host:port, [v6]:port, or a bare host (RDP's 3389); null if it doesn't look like an address. */
 function parseAddress(text) {
     // No '#' in a host: session and trust keys are split on it (see keyParts).
@@ -134,7 +135,7 @@ function askDesktop(pane, options) {
     }
     pane.appendChild(overlay);
     // Same as a desktop layer: the terminal underneath can't take the keyboard while the form shows.
-    const inputs = Array.from(pane.querySelectorAll('textarea.xterm-helper-textarea')).filter(t => !t.disabled);
+    const inputs = (0, hostCompat_1.terminalInputs)(pane).filter(t => !t.disabled);
     inputs.forEach(t => { t.disabled = true; });
     const focusForm = () => {
         if (!form.contains(document.activeElement)) {