tabby-rdp 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # Changelog
 
+## 0.5.3
+
+**Added**
+- **Each desktop connection has its own WebAssembly instance**, while sharing compiled IronRDP code. Reconnecting
+  or recovering from an instance fault creates a fresh backend for that desktop without replacing other desktops.
+- **Instance lifecycle checks** cover independent memories, cleanup, reconnects and collection after disposal,
+  with a browser smoke test and a live two-desktop isolation suite.
+
+**Security** (a review of 0.5.3-rc.1; all of these were in 0.5.2 too)
+- **Moving the pointer over a desktop no longer gives it the keyboard and the clipboard.** IronRDP's canvas took the
+  focus without a click, so keys typed into the terminal next to it (a password at a prompt that doesn't echo
+  included) and this computer's clipboard went to that remote server; also from behind a maximized pane. A desktop
+  now takes the keyboard only in the pane in front, and gives it back to where it came from otherwise.
+- **A desktop lets go of the keyboard when its tab is left by keyboard** for one that takes no focus (Settings, the
+  welcome tab): it went on taking the keys typed and the clipboard copied, view only included. Keys that reach a
+  desktop not in front now stop at the plugin. The shortcut's modifier, still down as the tab goes, is let go of on
+  the remote too, whichever tab is left for: its keyup goes where the user went, and IronRDP lets go of nothing as its
+  canvas loses the focus, so the modifier stayed held there until it was pressed again (a held Alt has the next key
+  open a menu on Windows).
+- **A crafted .rdp file can't hang Tabby's window**: a line of whitespace took time that grew with the cube of its
+  length to parse (seconds for a few thousand spaces). Files over 1 MB are refused unread.
+
+**Fixed**
+- **Removing a profile without an address no longer forgets what was saved for 127.0.0.1:3389.**
+- **The architecture document gives the update check's real limit** (4 MB for the version catalog, not 256 KB).
+- **Tabby's window no longer crashes when a desktop reached directly is refused after TLS** (#69): on Linux, the
+  first connection to any desktop in a remote desktop tab (a profile, quick connect, an .rdp file), whose certificate
+  is asked about before anything of the sign-in goes to it, closed the window and left Tabby running in the
+  background. A changed certificate did the same. The plugin now closes TLS before the socket under it. Desktops
+  behind an SSH host were not affected.
+- **Removing a saved gateway account keeps gateway credentials separate.** Inherited gateway uses are listed in
+  the removal confirmation; affected desktops and group defaults ask for a gateway account on the next connection.
+  Missing named gateway accounts also ask separately instead of silently using the destination credentials.
+- **The desktop inventory shows effective profile settings**, including inherited gateway routing, gateway accounts,
+  SSH profiles, sign-in names and connection kinds.
+- **Ended connections release their backend and browser resources**, including timers, global listeners, media,
+  and the statistics indicator's canvas hook, while retaining the last picture for the disconnected pane.
+- **Profile Save validates the address and RD Gateway before committing either field.** Invalid edits keep the
+  editor open and focus the field to correct, instead of saving an invalid gateway or silently keeping an old address.
+  Blank destinations preserve custom and inherited default ports when saving unrelated changes.
+
+**Changed**
+- **The rollback minimum is 0.5.3.** Updates persists this minimum to protect saved separate gateway prompts
+  from older versions that would reuse desktop credentials, and records a target release's minimum on installation.
+- **Preview publishing uses npm's beta tag** for both beta and release-candidate versions. GitHub release drafts
+  remain unpublished until the staged npm package is approved and verified.
+
+Qualification and remaining stable-release checks are tracked in [#49](https://github.com/meanaverage/tabby-rdp/issues/49).
+
+## 0.5.2
+
+**Added**
+- **Updates settings** include stable and preview channels (beta releases and release candidates), automatic and
+  manual checks, compatible version selection, rollback and uninstall controls. Changes require confirmation and
+  take effect after restarting Tabby. Update preferences and installation history stay on this computer.
+- **Installation progress stays in the confirmation dialog**, with elapsed time and a verified success or failure
+  result. The dialog remains visible if Settings closes. The installed version is checked before reporting success.
+
+**Fixed**
+- **Commands through the system SSH report SSH's own failure** when it exits before reading their input,
+  instead of letting a broken-pipe error escape unhandled. Commands that ignore their input still return their output.
+- **Plugin startup waits for Tabby's configuration** before migrating update preferences, avoiding an error that
+  could disable third-party plugins for the session.
+
+**Changed**
+- **Troubleshooting opens the Markdown guide** from the links at the top of Remote Desktop settings. The former
+  Troubleshooting tab is now Updates; connection logs are under Desktops. Empty lists use concise status messages.
+- **Settings descriptions are shorter**, and help icons appear consistently after their descriptions.
+- **Troubleshooting and desk cleanup guides are included in the npm package.**
+- **Host compatibility checks share one layer**, with host and runtime versions, the host's declared xterm dependency,
+  and observed capabilities included in copied connection logs. Modal drag fallbacks and terminal input handling use
+  shared adapters that check the host's actual features, including on forks and nightly builds.
+- **CI and the release workflow check out the code with actions/checkout 7.0.1** (#56), pinned to its commit as before,
+  in place of 4.4.0. Nothing in the package changes.
+
 ## 0.5.1
 
 Security fixes from an audit of 0.5.0: saved passwords and certificates, what a host says about its desktops, `desk`,

package/README.md

@@ -20,8 +20,8 @@ Linux and Windows, side by side, through the SSH connections you already have.
 ---
 
 tabby-rdp is a plugin for the [Tabby](https://tabby.sh) terminal. Press a key in an SSH tab and the machine's desktop
-appears in its place; press it again and you're back at the shell. Everything travels inside the SSH connection:
-nothing is opened on the network, and nothing has to be installed on the remote machine beforehand.
+appears in its place; press it again and you're back at the shell. SSH desktops use the connection you already have;
+remote desktop profiles can also connect directly or through an RD Gateway.
 
 - **Linux desktops without a monitor or a login.** The plugin starts a headless GNOME session for your SSH user with
   GNOME Remote Desktop, on the fly, without root. A server in a rack works as well as a workstation.
@@ -40,8 +40,8 @@ nothing is opened on the network, and nothing has to be installed on the remote
 - **`desk`:** type `desk` in the console and the same shell, with its history and running programs, moves into a
   terminal on the desktop.
 
-Everything is in **Settings › Remote Desktop**, in tabs: getting started and the shortcuts, the settings, the name
-overlay, the desktops and certificates the plugin keeps, saved accounts, and troubleshooting.
+Everything is in **Settings › Remote Desktop**: Getting started, Settings, Overlay, Desktops, Accounts and Updates.
+The **Troubleshooting** link at the top opens the [troubleshooting guide](TROUBLESHOOTING.md).
 
 The remote desktop itself is [IronRDP](https://github.com/Devolutions/IronRDP)'s web client, running inside Tabby.
 Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([below](#built-on-ironrdp)).
@@ -49,6 +49,7 @@ Making it work with GNOME took fixes in IronRDP, which we contribute upstream ([
 ## Contents
 
 - [Install](#install)
+- [Versions and recovery](#versions-and-recovery)
 - [Use](#use)
 - [Features](#features)
 - [Windows and other desktops behind a host](#windows-and-other-desktops-behind-a-host)
@@ -78,6 +79,25 @@ Or from a terminal, into Tabby's plugin folder (on macOS `~/Library/Application
 npm install tabby-rdp
 ```
 
+## Versions and recovery
+
+Open **Settings › Remote Desktop › Updates** to manage the installed version:
+
+- **Stable** is the default. **Preview** also offers beta releases and release candidates when available.
+- Automatic checks look for updates once a day. **Check now** checks manually; installation is always your choice.
+- Choose an exact compatible version, **Return to stable**, or **Restore previous version** after an installation
+  from this page. After running **0.5.3**, version changes require **0.5.3 or newer** to preserve separate
+  gateway sign-in prompts; returning to an older stable release is blocked.
+- **Uninstall plugin…** removes the package. **Manage in Tabby…** opens Tabby's plugin controls to disable it.
+  Saved connections, settings, passwords and remote setup are kept.
+
+The confirmation dialog stays open during installation or removal and shows progress, elapsed time and the verified
+result. After success, close remote desktops and restart Tabby. Until then, Updates shows the running version and
+the installed version waiting for restart. Preferences and version history stay on this computer.
+
+See [troubleshooting and recovery](TROUBLESHOOTING.md#recovery) if the plugin cannot load or you want to clean up saved
+data or remote helpers.
+
 ## Use
 
 Open an SSH tab to a Linux machine with GNOME, and:
@@ -371,7 +391,7 @@ the open desktops that follow it, takes back the files offered to them, and stop
 several files that is under way before its next step. Narrowing applies in full only once they reconnect: reconnect a
 desktop you don't trust that far. **Paste to all desktops** leaves out the desktops that don't take this computer's
 clipboard and says which. Shared folders are a setting of their own, and screenshots and **Copy log** (Settings ›
-Remote Desktop › Troubleshooting) still go to your clipboard: they are your own actions.
+Remote Desktop › Desktops › Open desktops) still go to your clipboard: they are your own actions.
 
 ## Shared folders
 
@@ -495,7 +515,8 @@ desktop of a machine you don't trust with `desk` off, which also has Tabby forge
 ## Settings
 
 Open **Settings › Remote Desktop** in Tabby, right-click the desktop button in Tabby's header, or open **Settings** in the Remote Desktop section of a terminal's or tab's menu.
-They are stored in Tabby's config under `remoteDesktop`:
+Desktop settings are stored in Tabby's config under `remoteDesktop`; update preferences and installation history
+are local to this computer:
 
 | Setting | Default | |
 |---|---|---|
@@ -517,12 +538,12 @@ They are stored in Tabby's config under `remoteDesktop`:
 | Session backend (`sessionBackend`) | `native` | For `desk`: `native` (trd-pty) or `tmux`. Config file only. |
 | Find virtual machines on SSH hosts (`discoverVMs`) | On | Lists a host's libvirt VMs with a desktop in its menu ([VMs on a host](#vms-on-a-host)). |
 | Shut down VMs it started (`shutDownIdle`) | Never | 5, 15 or 60: minutes without a desktop open after which a VM the plugin started is shut down again ([VMs on a host](#vms-on-a-host)). |
-| Tell me about new versions (`checkUpdates`) | On | Once a day, asks npm for the latest tabby-rdp (nothing else is sent), and says so in a note, the menus and the settings page when there's a newer one: Tabby itself shows plugin upgrades only on its Plugins page. |
+| Check for updates automatically (Updates tab) | On, Stable | Checks npm once a day; choose Stable or Preview, check manually, and install a compatible version explicitly. [Versions and recovery](#versions-and-recovery). |
 | Desktop name overlay (`osd`) | When it helps | `show` (`auto`, `always`, `off`), `font`, `size`, `position`, `color` (empty: white; else a color name, `#hex`, or a color function of numbers such as `rgb()`) and `seconds`; the settings page previews it, at a resolution you pick. |
 
 ## Requirements
 
-- **Tabby 1.0.236 or newer**, on macOS, Windows or Linux (tested with 1.0.236 and 1.0.237). On a fresh Windows, Tabby
+- **Tabby 1.0.236 or newer**, on macOS, Windows or Linux. On a fresh Windows, Tabby
   itself needs the [Microsoft Visual C++ Redistributable](https://learn.microsoft.com/cpp/windows/latest-supported-vc-redist)
   for SSH.
 - **Linux desktops:** GNOME Shell and GNOME Remote Desktop 46 or newer (Ubuntu 24.04, for example), a systemd user
@@ -536,7 +557,13 @@ They are stored in Tabby's config under `remoteDesktop`:
   host or running OpenSSH Server itself.
 
 Tested with Ubuntu 24.04 (GNOME Remote Desktop 46.3) and Windows 11 (Pro and Enterprise), from Tabby on macOS,
-Windows 11 and Ubuntu 24.04 (arm64).
+Windows 11 and Ubuntu 24.04 (arm64). Recent host compatibility tests cover official Tabby **1.0.238** on macOS
+with xterm 5, and upstream xterm 6 builds on macOS and Linux. The new package installation dialog is tested on
+macOS with Tabby 1.0.238; Windows qualification of these changes remains pending. See the
+[host test matrix](test/README.md#host-qualification) for the exact builds and coverage.
+
+The plugin checks the host's available features through a shared compatibility layer. Connection logs include the
+host and runtime versions, declared xterm dependency and observed capabilities to help diagnose forks and nightlies.
 
 ## Built on IronRDP
 
@@ -573,8 +600,10 @@ it, not just this plugin.
 ## Development
 
 ```sh
-npm install
+npm ci --ignore-scripts
 npm run build                # TypeScript to dist/
+npm run typecheck            # plugin and test TypeScript
+npm run test:unit            # standard unit suite; no remote machine needed
 scripts/sandbox.sh           # a separate Tabby with this plugin linked in (macOS), DevTools on port 9334
 npm test                     # end-to-end suites against a test machine: see test/README.md
 npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches: see ironrdp/README.md
@@ -626,7 +655,8 @@ npm run build:ironrdp        # rebuild vendor/ from IronRDP and ironrdp/patches:
 
 Questions ("how do I…", "is this expected?") go to [Discussions › Q&A](https://github.com/meanaverage/tabby-rdp/discussions/categories/q-a);
 bugs and feature requests to the [issues](https://github.com/meanaverage/tabby-rdp/issues). A bug report is most useful
-with the connection log: **Settings › Remote Desktop › Troubleshooting › Open desktops › Copy log**.
+with the connection log: **Settings › Remote Desktop › Desktops › Open desktops › Copy log**.
+Start with the [troubleshooting guide](TROUBLESHOOTING.md) for common connection and installation problems.
 
 ## License
 

package/TROUBLESHOOTING.md

@@ -0,0 +1,82 @@
+# Troubleshooting
+
+For connection logs, open **Settings › Remote Desktop › Desktops › Open desktops**, then choose **Copy log**. In version 0.5.1, the list is in **Troubleshooting**. Review logs before sharing them.
+
+<a id="certificate"></a>
+
+## A certificate this computer can't verify, or one that has changed
+
+A desktop you connect to directly (a remote desktop profile, an imported file) and an RD Gateway connect without asking when their certificate is valid for their name by this computer's certificate authorities, as an organisation's own desktops and gateways often are. Any other is shown the first time, with why it can't be verified (most often: it is the server's own, self-signed) and its fingerprint, before anything of your sign-in is sent: check the fingerprint with whoever runs it, some other way than this connection (it is also in the desktop's connection log), then choose **Trust the certificate**. The question also says whom the certificate says it was issued to and by, and when it is valid: its own word, which nothing has checked, unless its chain leads to an authority this computer trusts (another machine's certificate then shows that machine's name) and the TLS library didn't refuse it for a reason of its own (a limit set on the authority, say). An issuer you wouldn't expect there (one that inspects your network's connections, say) is worth asking about before you trust it, but the one you would expect proves nothing: anyone can make a certificate that names it. Only the fingerprint, checked some other way, does. A desktop behind an SSH host remembers its certificate on first use without asking, since the way there runs inside SSH. When a remembered certificate differs later, the plugin stops before signing in, so nothing of your sign-in has gone to that server; only a certificate an authority vouched for is replaced without a question, by another it vouches for too. Reinstalling the machine or renewing its certificate changes it: then choose **Trust the new certificate**. If neither happened, something else is answering at that address. A GNOME desktop only ever accepts the certificate the plugin made for it; a different one there means another program listens on its port. Remembered certificates are in Settings › Remote Desktop › Desktops.
+
+<a id="sign-in"></a>
+
+## Wrong user name or password
+
+Windows and xrdp desktops sign in with an account on that machine (`DOMAIN\user` works). A saved password that no longer works is asked for again; **Sign in again…** in the tab's menu replaces it on purpose. xrdp doesn't refuse a wrong password: it shows its own login window instead. GNOME desktops never ask: the plugin manages their sign-in.
+
+<a id="no-desktop"></a>
+
+## No desktop found on a Linux host
+
+The plugin uses GNOME Remote Desktop 46 or newer (Ubuntu 24.04, for example), with no root and no login screen. For KDE, XFCE, MATE and others, install xrdp and a desktop for its sessions: on Debian and Ubuntu, `sudo apt install xrdp xfce4`. A GNOME session already shared from the machine's own screen (GNOME's Desktop Sharing) has to be turned off first.
+
+<a id="unreachable"></a>
+
+## Can't reach a Windows desktop
+
+Windows needs Remote Desktop turned on (Settings › System › Remote Desktop; Pro, Enterprise or Server). Behind an SSH host, the address is as that host sees it: from there, `nc -z <address> 3389` should succeed. For a VM or machine that may be off, give the desktop a VM name or MAC address in its edit form and it is started when opened.
+
+<a id="reconnecting"></a>
+
+## It keeps reconnecting
+
+After sleep or a network change the desktop reconnects by itself, with growing pauses, and waits while the SSH connection is down (**Reconnect SSH** hurries that along). It stops after a few tries or on **Stop**. If it drops again right after connecting, check the host's free memory and that the desktop's session is still running there.
+
+<a id="picture"></a>
+
+## The picture is blurry or slow
+
+**Sharpness › Retina** renders at your screen's device pixels, with the remote's scale set to match. Video (H.264) is used when the remote sends it: Windows does, GNOME only with a hardware encoder (VA-API or NVENC). **Show connection status** shows the frame rate, the round trip and how the picture comes.
+
+<a id="sound"></a>
+
+## No sound, or the microphone isn't heard
+
+Sound and microphone changes apply on the next connection. xrdp needs `pipewire-module-xrdp` or `pulseaudio-module-xrdp`. The microphone needs the system's permission here (macOS: System Settings › Privacy & Security › Microphone, then restart Tabby). On GNOME, apps record from "Remoteaudio Source"; on Windows, the machine must allow audio recording redirection. A desktop whose microphone was stopped (**Stop** in the microphone's menu in Tabby's header, or **Send the microphone** unchecked in the desktop's menu) gets none, its reconnects included, until **Send the microphone** is checked again in its menu or that Tabby window is closed.
+
+<a id="nested-ssh"></a>
+
+## I typed ssh to another machine in a terminal
+
+In an SSH tab (or a split pane) where you typed `ssh` on to another machine, **Desktop** opens that machine's desktop, going through the first one, and `desk` works there too. Desktop asks which desktop you mean, since which `ssh` runs there is the first machine's to say; pick the other machine's "from now on" to have it open at once the next times. Desktops you set up behind a host open in a tab connected to that host, not through another one. The first machine has to log in to the other by itself for this: with a key there, or agent forwarding, as `ssh -o BatchMode=yes` would. Tabby's **Reconnect** belongs to the tab: it reconnects the first machine and ends the ssh typed in it. To have both desktops side by side, open the first machine's desktop in one pane, and ssh on in the other.
+
+<a id="extra-monitor"></a>
+
+## The desktop is open somewhere else
+
+GNOME Remote Desktop's headless mode gives each connection a screen of its own: a second computer, or another Tabby window, connected to the same account gets an empty extra screen rather than the same one. So when the desktop is open somewhere else already, you choose. **Take it over** disconnects the other connection, as Windows does; the session and its apps carry on, on this screen. **Open a second screen** keeps both, each with a screen of its own. A desktop taken over from here doesn't take itself back: it says so, and offers the same two choices.
+
+<a id="recovery"></a>
+
+## Recover a version, disable the plugin, or remove it
+
+In **0.5.2 or newer**, open **Settings › Remote Desktop › Updates**. **Stable** is the default; **Preview** includes beta releases and release candidates when available. Choose an exact published version and confirm installation. **Return to stable** can install an older version. **Restore previous version** uses the version saved after the last successful installation from this page. On older releases, manage the package in **Tabby › Settings › Plugins**.
+
+The confirmation dialog stays open through progress and the verified result. If installation fails, the dialog shows the cause. After success, close remote desktops and restart Tabby; Updates shows the running version and the installed version waiting for restart until then.
+
+After running **0.5.3**, use **0.5.3 or newer**, including after uninstalling and reinstalling. This version
+can save a separate gateway sign-in prompt (`@ask`) in desktops, profiles and defaults, including when a saved gateway
+account is removed. Versions **0.5.1 and 0.5.2** can silently use the desktop's credentials for that gateway instead.
+Updates records this minimum on startup even if update checks are paused, and retains the highest recorded minimum.
+The safeguard applies to this computer's Updates page; manual npm installation, Tabby's plugin controls and older
+installations on other computers can bypass it. Use the same minimum wherever this configuration is copied or synced.
+
+If the plugin cannot load:
+
+1. Open **Tabby › Settings › Plugins**. Disable **tabby-rdp** to stop it loading, or uninstall and reinstall it there. Restart Tabby after changing plugins. Tabby’s [configuration locations](https://github.com/Eugeny/tabby/wiki/Config-file) help locate your profile when the application cannot open.
+2. For a specific known compatible version, open a terminal in **Tabby's plugin folder** (the folder containing the plugin installation's `package.json`, with `node_modules/tabby-rdp` below it). Run `npm install tabby-rdp@0.5.3`, replacing `0.5.3` with your known compatible exact version at or above the minimum above. Do not run this in the tabby-rdp source checkout, the application bundle, or inside `node_modules/tabby-rdp` itself. Fully quit and reopen Tabby afterwards.
+3. If a later version has migrated saved data, respect that version's documented minimum. Reinstall a compatible stable version or the last working preview; do not force an older version across a migration boundary.
+
+Disabling or uninstalling keeps desktops, profiles, settings, remembered certificates and saved credentials. It also leaves any remote helpers and remote applications in place. To remove saved entries, use **Remote Desktop › Desktops** and **Accounts**, and **Profiles & connections** for profiles, before uninstalling. Unlock the credential store first if required; check any reported failure rather than assuming a credential was deleted. Data synced to other computers may need attention there too.
+
+For the optional `desk` remote helper, turn **Settings › Remote Desktop › Settings › desk: bring the console along** off and reconnect to each host while the plugin is still installed. The next connection removes the helper's own files and login hook; an offline host cannot be cleaned this way until it returns. Read the [desk cleanup details](docs/desk.md) for manual removal and read-only startup files. End remote applications you no longer need separately. Uninstalling this plugin does not shut down remote hosts or erase their files.

package/dist/accountRevisions.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountRevisions = exports.ACCOUNT_REMEMBER_UNAVAILABLE = void 0;
+const crypto_1 = require("crypto");
+/** No secrets: invalidates old sign-in forms in other windows before an account edit touches the store. */
+const PREFIX = 'tabby-rdp.account-revision.';
+exports.ACCOUNT_REMEMBER_UNAVAILABLE = 'To remember this password, save the account again in Settings and reopen this sign-in form.';
+class AccountRevisions {
+    constructor(storage = () => window.localStorage, coordinated = () => !!globalThis.navigator?.locks) {
+        this.storage = storage;
+        this.coordinated = coordinated;
+    }
+    /** A prompt may remember only when this window's account agrees with the shared revision. */
+    capture(account) {
+        const revision = account.credentialRevision ?? '';
+        return this.current(account.id, revision) ? revision : undefined;
+    }
+    current(id, revision) {
+        if (revision === undefined || !this.coordinated()) {
+            return false;
+        }
+        try {
+            const shared = this.storage().getItem(PREFIX + id);
+            return shared === null || shared === revision;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Synchronous publication: older writers fail their next check, including one already waiting on a store. */
+    change(id) {
+        if (!this.coordinated()) {
+            throw new Error('Saved account changes are unavailable. Restart or update Tabby and try again.');
+        }
+        const revision = (0, crypto_1.randomUUID)();
+        // A failed write must stop the edit: a revision held only in this window cannot invalidate another's form.
+        try {
+            this.storage().setItem(PREFIX + id, revision);
+        }
+        catch {
+            throw new Error('Saved account changes are unavailable. Restart Tabby and try again.');
+        }
+        return revision;
+    }
+}
+exports.AccountRevisions = AccountRevisions;

package/dist/accounts.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASK_GATEWAY_ACCOUNT = void 0;
 exports.accountsOf = accountsOf;
 exports.newAccountId = newAccountId;
 exports.signInName = signInName;
 exports.accountKey = accountKey;
+/** A separate gateway sign-in prompt. The '@' cannot occur in a saved account's id. */
+exports.ASK_GATEWAY_ACCOUNT = '@ask';
 /** The usable entries of `remoteDesktop.accounts` (hand-written ones may lack fields). */
 function accountsOf(store) {
     const list = Array.isArray(store?.accounts) ? store.accounts : [];
@@ -16,7 +19,8 @@ function accountsOf(store) {
         }
         seen.add(id);
         const domain = typeof a.domain === 'string' && a.domain.trim() ? a.domain.trim() : undefined;
-        return [{ id, name: typeof a.name === 'string' && a.name.trim() ? a.name.trim() : signInName({ username, domain }), username, ...domain ? { domain } : {} }];
+        return [{ id, name: typeof a.name === 'string' && a.name.trim() ? a.name.trim() : signInName({ username, domain }), username,
+                ...domain ? { domain } : {}, ...typeof a.credentialRevision === 'string' ? { credentialRevision: a.credentialRevision } : {} }];
     });
 }
 /** A new account's id: nothing in it but that it is unused. */

package/dist/connectionStatus.js

@@ -34,7 +34,7 @@ class ConnectionStatus {
         this.ticks = 0;
         this.last = null;
         this.frames = 0;
-        this.hooked = null;
+        this.frameHook = null;
         this.latency = null;
         this.pinging = false;
         this.active = false;
@@ -57,6 +57,9 @@ class ConnectionStatus {
         if (active && canvas) {
             this.countFrames(canvas);
         }
+        else if (!active) {
+            this.releaseCanvas();
+        }
         if (active === this.active) {
             return;
         }
@@ -90,13 +93,16 @@ class ConnectionStatus {
      */
     countFrames(canvas) {
         const ctx = canvas.getContext('2d');
-        if (!ctx || ctx === this.hooked) {
+        if (ctx === this.frameHook?.context) {
+            return;
+        }
+        this.releaseCanvas();
+        if (!ctx) {
             return;
         }
-        this.hooked = ctx;
         const original = ctx.putImageData;
         let batch = false;
-        ctx.putImageData = ((...args) => {
+        const wrapped = ((...args) => {
             if (!batch) {
                 batch = true;
                 this.frames++;
@@ -104,6 +110,17 @@ class ConnectionStatus {
             }
             return original.apply(ctx, args);
         });
+        ctx.putImageData = wrapped;
+        this.frameHook = { context: ctx, original, wrapped };
+    }
+    /** A detached canvas's handlers retain its backend, even after its component has been removed. */
+    releaseCanvas() {
+        const hook = this.frameHook;
+        this.frameHook = null;
+        // Leave a later owner's replacement alone.
+        if (hook && hook.context.putImageData === hook.wrapped) {
+            hook.context.putImageData = hook.original;
+        }
     }
     tick() {
         const now = performance.now();