tabby-rdp 0.5.1 → 0.5.3

package/dist/desktop.service.js

@@ -23,12 +23,14 @@ const url_1 = require("url");
 const targets_1 = require("./targets");
 const deskScript_1 = require("./deskScript");
 const audio_1 = require("./audio");
+const ironrdp_1 = require("./ironrdp");
 const clipboard_1 = require("./clipboard");
 const connectionStatus_1 = require("./connectionStatus");
 const microphone_1 = require("./microphone");
 const drives_1 = require("./drives");
 const desktopForm_1 = require("./desktopForm");
 const accounts_1 = require("./accounts");
+const accountRevisions_1 = require("./accountRevisions");
 const accountForm_1 = require("./accountForm");
 const fileTransfer_1 = require("./fileTransfer");
 const desktops_1 = require("./desktops");
@@ -45,6 +47,7 @@ const gateway_1 = require("./gateway");
 const authorities_1 = require("./authorities");
 const vms_1 = require("./vms");
 const sessionLog_1 = require("./sessionLog");
+const hostCompat_1 = require("./hostCompat");
 const unshowable_1 = require("./unshowable");
 /**
  * The keychain entry that marks the passwords 0.5.0 saved for desktops reached through a gateway forgotten from this
@@ -82,6 +85,7 @@ const STYLE = `
 .trd-overlay { position: absolute; inset: 0; z-index: 30; display: flex; background: #111; }
 .trd-host { flex: auto; min-width: 0; min-height: 0; display: flex; }
 .trd-host iron-remote-desktop { flex: auto; }
+.trd-last-frame { max-width: 100%; max-height: 100%; object-fit: contain; align-self: center; margin: auto; }
 .trd-status { position: absolute; inset: 0; display: flex; flex-direction: column; gap: 14px; align-items: center;
     justify-content: center; padding: 2em; text-align: center; color: #bbb; font-size: 13px; white-space: pre-line;
     pointer-events: none; }
@@ -105,6 +109,10 @@ const STYLE = `
 .trd-overlay.trd-mic-on > .trd-toast { right: 40px; max-width: min(420px, calc(100% - 52px)); }
 .trd-floating-mic-on .trd-overlay.trd-broadcast-on::before { top: 40px; }
 `;
+/** A file's name as it is shown: it comes with the file, and what could reorder or hide part of it shows as �. */
+function showableFileName(raw) {
+    return raw.replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
+}
 /**
  * The name a desktop connected to directly goes by, as its certificate is checked against it (see
  * RDCleanPathOptions.serverName): an address as it is, a host name as it resolves (lower case, punycode, without a
@@ -259,11 +267,24 @@ class DesktopSession {
         /** Keys this desktop was sent and not yet let go of (by `code`): see RemoteDesktopService.broadcastKey. */
         this.keysDown = new Map();
         this.reclaimFocus = (event) => {
-            if (this.visible && !this.overlay.contains(event.target)) {
+            if (!this.visible) {
+                return;
+            }
+            if (!this.overlay.contains(event.target)) {
                 this.focusSoon();
+                return;
+            }
+            // The focus came to the desktop while its pane isn't the one the user is in: IronRDP's canvas takes it as the
+            // pointer passes over it (its `mouseenter`), without a click, and with it the keys typed and this computer's
+            // clipboard (its monitor follows the focus). It goes back where it came from. A click hands it over still:
+            // Tabby makes the pane the one in front on the click, and the pane's focus gives the desktop the keyboard. (The
+            // layer's own fields and buttons, a sign-in form's, send nothing anywhere until they are used.)
+            if (event.target?.tagName === 'IRON-REMOTE-DESKTOP' && !this.inFront()) {
+                this.letGo(event.relatedTarget);
             }
         };
         this.disposers = [];
+        this.connectionDisposers = [];
         this.disposed = new Promise(resolve => { this.markDisposed = resolve; });
         this.overlay = document.createElement('div');
         this.overlay.className = 'trd-overlay';
@@ -302,7 +323,9 @@ class DesktopSession {
     }
     /**
      * Lets go of every key still held on this desktop. For when their keyups won't reach it: view only coming on, or
-     * typing into all going off, by a shortcut whose modifiers are down at that moment. They would stay down there.
+     * typing into all going off, by a shortcut whose modifiers are down at that moment, or the user leaving its pane
+     * by one (see RemoteDesktopService.letGoUnlessInFront). They would stay down there. Sent through IronRDP's
+     * component, which takes a key sent this way whether or not it has the focus.
      */
     releaseKeys() {
         for (const [code, init] of [...this.keysDown]) {
@@ -332,6 +355,33 @@ class DesktopSession {
     canvas() {
         return this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('canvas') ?? null;
     }
+    /** Whether the focus is on the desktop: IronRDP's component, its sign-in form, a question's buttons. */
+    holdsFocus() {
+        return this.overlay.contains(document.activeElement);
+    }
+    /**
+     * Takes the focus from the desktop, if it has it, back to `to` (where it came from) when that is still there to
+     * take it, or else to nothing. On IronRDP's component it is its canvas, in the component's shadow root, that has
+     * it, and has to let go. The keys held on the remote stay held: IronRDP lets go of them as the window loses the
+     * focus or the pointer leaves the canvas, not as the canvas loses the focus. Where the focus goes back to the
+     * desktop in front (the pointer passed over this one), their keyups still come from there, copied when typing
+     * into all; where the user left the pane, they don't, and the keys are let go of (see
+     * RemoteDesktopService.letGoUnlessInFront).
+     */
+    letGo(to) {
+        const active = document.activeElement;
+        if (!active || !this.overlay.contains(active)) {
+            return;
+        }
+        const back = to;
+        if (typeof back?.focus === 'function' && back.isConnected !== false && !this.overlay.contains(back)) {
+            back.focus({ preventScroll: true });
+        }
+        if (this.overlay.contains(document.activeElement)) {
+            ;
+            (active.shadowRoot?.activeElement ?? active).blur();
+        }
+    }
     /**
      * Focuses the remote desktop in a moment, if it is still in the pane the user is in then (see inFront). `visible`
      * stays true in a tab in the background, and a focus that was waiting (a retry, or Tabby's re-focus of the terminal
@@ -348,7 +398,7 @@ class DesktopSession {
     setVisible(visible) {
         this.visible = visible;
         this.overlay.style.display = visible ? '' : 'none';
-        this.container.querySelectorAll('textarea.xterm-helper-textarea').forEach(input => {
+        (0, hostCompat_1.terminalInputs)(this.container).forEach(input => {
             input.disabled = visible;
         });
         if (visible) {
@@ -384,6 +434,58 @@ class DesktopSession {
     onDispose(f) {
         this.disposers.push(f);
     }
+    onConnectionEnd(f) {
+        this.connectionDisposers.push(f);
+    }
+    /** Release browser resources and references to one backend, including when its WASM has trapped. */
+    endConnection(keepPicture = true) {
+        const clean = (f) => {
+            try {
+                f();
+            }
+            catch (error) {
+                this.log.push(`cleanup: ${error?.message ?? error}`);
+            }
+        };
+        let picture = keepPicture ? this.host.querySelector('.trd-last-frame') : null;
+        // Preserve the dimmed disconnect picture as plain pixels, without the component's backend or listeners.
+        clean(() => {
+            const frame = keepPicture ? this.canvas() : null;
+            if (!frame?.width || !frame.height) {
+                return;
+            }
+            const copy = document.createElement('canvas');
+            copy.width = frame.width;
+            copy.height = frame.height;
+            copy.className = 'trd-last-frame';
+            const rect = frame.getBoundingClientRect();
+            copy.style.width = `${rect.width || frame.width}px`;
+            copy.style.height = `${rect.height || frame.height}px`;
+            const ctx = copy.getContext('2d');
+            if (ctx) {
+                ctx.drawImage(frame, 0, 0);
+                picture = copy;
+            }
+        });
+        this.connectionDisposers.splice(0).forEach(clean);
+        clean(() => this.indicator?.setActive(false));
+        clean(() => this.ui?.shutdown());
+        // Removing the component stops its clipboard loop and removes its global listeners.
+        clean(() => this.host.replaceChildren(...picture ? [picture] : []));
+        this.ui = null;
+        this.stopSending = null;
+        clean(() => this.audio?.close());
+        this.audio = null;
+        clean(() => this.h264?.close());
+        this.h264 = null;
+        clean(() => this.mic?.close());
+        this.mic = null;
+        clean(() => this.files?.dispose());
+        this.files = null;
+        clean(() => this.drives?.dispose());
+        this.drives = null;
+        this.remoteSize = null;
+    }
     /** Focuses the remote desktop. IronRDP reveals its canvas asynchronously, so retry for about half a second. */
     focusDesktop(attempts = 30) {
         // While the sign-in form shows, it is what takes focus back (the user name, or the password once filled).
@@ -415,16 +517,7 @@ class DesktopSession {
         clearTimeout(this.labelTimer);
         this.container.removeEventListener('focusin', this.reclaimFocus, true);
         this.disposers.forEach(f => f());
-        this.indicator?.dispose();
-        try {
-            this.ui?.shutdown();
-        }
-        catch { }
-        this.audio?.close();
-        this.h264?.close();
-        this.mic?.close();
-        this.files?.dispose();
-        this.drives?.dispose();
+        this.endConnection(false);
         this.proxy?.close();
         this.overlay.remove();
     }
@@ -449,7 +542,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         /** Emits whenever a pane's desktop is opened, shown, hidden, connected, ended or disconnected. */
         this.changed$ = new rxjs_1.Subject();
         this.sessions = new Map();
-        this.ironrdp = null;
+        this.ironrdp = new ironrdp_1.IronRDPLoader(async () => {
+            const [factory, bytes] = await Promise.all([
+                importESM(vendor('iron-remote-desktop.js')).then(() => importESM(vendor('ironrdp-factory.js'))),
+                fs.promises.readFile(vendorFile('ironrdp_web_bg.wasm')),
+            ]);
+            return { module: await WebAssembly.compile(bytes), createBackend: factory.createBackend };
+        });
         /** Whether the browser decodes H.264 (asked once). */
         this.h264Support = null;
         /** Desktops (session keys) where H.264 decoding failed: they connect without it until Tabby restarts. */
@@ -478,6 +577,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         /** VMs found on SSH hosts (see vms.ts), by target key: when, and as desktops; and what the scans learnt of the host. */
         this.vms = new Map();
         this.lastUsed = new Map();
+        this.accountRevisions = new accountRevisions_1.AccountRevisions();
         /** Each pane's `desk` requests, one at a time (see DeskGate). */
         this.deskGates = new WeakMap();
         /**
@@ -833,6 +933,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     accounts() {
         return (0, accounts_1.accountsOf)(this.config.store.remoteDesktop);
     }
+    accountCurrent(key, name, revision) {
+        const account = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === key);
+        return !!account && (0, accounts_1.signInName)(account) === name && (account.credentialRevision ?? '') === revision && this.accountRevisions.current(account.id, revision);
+    }
     /**
      * The desktops that sign in with a saved account, or sign in to their RD Gateway with it: configured ones behind
      * SSH hosts, and RDP profiles (their own choice, or their profile group's default when they make none). Each comes
@@ -842,10 +946,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         // Names as text whatever the config holds (see entryText): the accounts list and the question before removing
         // one show them all.
         const desktops = this.configuredDesktops().flatMap((d, i) => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id) ? [{ name: (0, desktops_1.entryText)(d).name, desktopIndex: i }] : []);
-        const groups = this.config.store.groups ?? [];
-        const inherited = (p) => p.options?.account === undefined && groups.find(g => g.id === p.group)?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options?.account === id;
         const profiles = (this.config.store.profiles ?? [])
-            .filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && (p.options?.account === id || p.options?.gatewayAccount === id || inherited(p)))
+            .filter((p) => {
+            if (p?.type !== targets_1.RDP_PROFILE_TYPE) {
+                return false;
+            }
+            const options = this.profiles.getConfigProxyForProfile(p).options;
+            return options?.account === id || options?.gatewayAccount === id;
+        })
             .map((p) => ({ name: (0, desktops_1.configText)(p.name) || (0, desktops_1.configText)(p.options?.host), profileId: (0, desktops_1.configText)(p.id) || undefined }));
         return [...desktops, ...profiles];
     }
@@ -863,14 +971,31 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             username: account.username.trim(),
             ...account.domain?.trim() ? { domain: account.domain.trim() } : {},
         };
+        let revision;
+        try {
+            revision = this.accountRevisions.change(entry.id);
+        }
+        catch (error) {
+            return { id: entry.id, keychainError: error?.message ?? String(error) };
+        }
+        entry.credentialRevision = revision;
+        // Invalidate before any store await. Keep the old sign-in name until changing its password succeeds.
+        if (old) {
+            this.config.store.remoteDesktop.accounts = list.map(a => a.id === old.id ? { ...a, credentialRevision: revision } : a);
+            await this.config.save();
+        }
+        const current = () => this.accountRevisions.current(entry.id, revision) && (!old || this.accounts().some(a => a.id === entry.id && a.credentialRevision === revision));
         // The password first: a new user name must not be written while the old password (for the old name) stays, nor
         // a new password reported as saved when the store refused it.
         let keychainError;
         if (password !== undefined && password !== '') {
-            await (0, signin_1.saveCredentials)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
+            await (0, signin_1.saveCredentialsIf)((0, accounts_1.accountKey)(entry.id), { username: (0, accounts_1.signInName)(entry), password }, current, `saved account ${entry.name}`).catch(e => { keychainError = String(e?.message ?? e); });
         }
         else if (old && (0, accounts_1.signInName)(old) !== (0, accounts_1.signInName)(entry)) {
-            await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(entry.id)).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+            await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(entry.id), current).catch(e => { keychainError = `the old password couldn't be removed: ${e?.message ?? e}`; });
+        }
+        if (!current()) {
+            return { id: entry.id, keychainError: 'The account changed again while this edit was being saved. The newer change was kept.' };
         }
         if (keychainError && !old) {
             // Not added at all: a retry would otherwise make a second account.
@@ -886,7 +1011,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 delete entry.domain;
             }
         }
-        this.config.store.remoteDesktop.accounts = old ? list.map(a => a === old ? entry : a) : [...list, entry];
+        const now = this.accounts();
+        this.config.store.remoteDesktop.accounts = old ? now.map(a => a.id === old.id ? entry : a) : [...now, entry];
         await this.config.save();
         this.changed$.next();
         return { id: entry.id, keychainError };
@@ -923,11 +1049,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         if (response !== 0) {
             return false;
         }
-        await this.removeAccount(id);
-        return true;
+        try {
+            await this.removeAccount(id);
+            return true;
+        }
+        catch (error) {
+            this.notifications.error(`The account could not be fully removed: ${error?.message ?? error}`);
+            return false;
+        }
     }
     /** Removes a saved account and its password; desktops that used it go back to asking. */
     async removeAccount(id) {
+        const revision = this.accountRevisions.change(id);
         const store = this.config.store.remoteDesktop;
         store.accounts = this.accounts().filter(a => a.id !== id);
         if (this.configuredDesktops().some(d => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id))) {
@@ -939,9 +1072,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 if (rest.account === id) {
                     delete rest.account;
                 }
-                // A gateway that signed in with it takes the desktop's sign-in from now on.
+                // Keep the gateway's credentials separate after its saved account is removed.
                 if (rest.gatewayAccount === id) {
-                    delete rest.gatewayAccount;
+                    rest.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
                 }
                 return rest;
             });
@@ -952,19 +1085,23 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 profile.options.account = null;
             }
             if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.gatewayAccount === id) {
-                profile.options.gatewayAccount = null;
+                profile.options.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
             }
         }
-        // A profile group's default for remote desktop profiles, too.
-        for (const group of this.config.store.groups ?? []) {
-            const options = group?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options;
+        // Group and global defaults keep separate gateway authentication for their inheriting profiles, too.
+        const defaults = [this.config.store.profileDefaults, ...(this.config.store.groups ?? []).map((group) => group?.defaults)];
+        for (const entry of defaults) {
+            const options = entry?.[targets_1.RDP_PROFILE_TYPE]?.options;
             if (options?.account === id) {
                 options.account = '';
             }
+            if (options?.gatewayAccount === id) {
+                options.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
+            }
         }
         await this.config.save();
         this.changed$.next();
-        await (0, signin_1.forgetCredentialsOrFail)((0, accounts_1.accountKey)(id)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
+        await (0, signin_1.forgetCredentialsIf)((0, accounts_1.accountKey)(id), () => this.accountRevisions.current(id, revision)).catch(e => this.notifications.error(`The account is removed, but its password could not be: ${e?.message ?? e}`));
     }
     /** `remoteDesktop.desktops`: the desktops configured behind SSH hosts. */
     configuredDesktops() {
@@ -1138,6 +1275,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
         }
     }
+    /** Says that the .rdp file named `rawFileName` is too large to be one (see MAX_RDP_FILE). */
+    refuseLargeRdp(rawFileName, size) {
+        this.notifications.error(`${showableFileName(rawFileName)}: at ${Math.ceil(size / 1024)} KB, far larger than an .rdp file is, so it wasn't imported`);
+    }
     /** "Import an .rdp file…": picks one and adds it as a remote desktop profile (see importRdp). */
     async importRdpFile() {
         const file = await new Promise(resolve => {
@@ -1151,6 +1292,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             input.click();
         });
         if (file) {
+            // Not even read when it is far larger than an .rdp file is (see importRdp).
+            if (file.size > rdpFile_1.MAX_RDP_FILE) {
+                this.refuseLargeRdp(file.name, file.size);
+                return;
+            }
             // A reading or parsing failure is shown, not dropped as an unhandled rejection: this is the user's action.
             try {
                 await this.importRdp(new Uint8Array(await file.arrayBuffer()), file.name);
@@ -1184,8 +1330,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * and opens it; or opens the profile that already has that address, user and domain. Returns the profile, or null.
      */
     async importRdp(data, rawFileName) {
-        // The file's name comes with the file, and is shown: what could reorder or hide part of it shows as �.
-        const fileName = rawFileName.replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
+        const fileName = showableFileName(rawFileName);
+        // Far larger than an .rdp file is: not parsed, on the thread that runs Tabby's window (see MAX_RDP_FILE).
+        if (data.length > rdpFile_1.MAX_RDP_FILE) {
+            this.refuseLargeRdp(rawFileName, data.length);
+            return null;
+        }
         const parsed = (0, rdpFile_1.parseRdpFile)(data);
         if (!parsed) {
             this.notifications.error(`${fileName}: no address ("full address") in it`);
@@ -1510,6 +1660,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }
             });
             created.onDispose(() => focused.unsubscribe());
+            // The pane is no longer the one the user is in: another tab, another pane of the split. Tabby only moves a
+            // tab it leaves off screen, and a tab that takes no focus of its own (Settings, the welcome tab) leaves the
+            // focus where it was: on the desktop, which would go on taking the keys typed and this computer's
+            // clipboard. It lets go then, of the keys it holds on the remote too: the user left by a shortcut whose
+            // modifier is still down, and its keyup goes where they went. A moment later: Tabby says so before it says
+            // which tab is the active one.
+            const blurred = pane.blurred$.subscribe(() => {
+                setTimeout(() => this.letGoUnlessInFront(created));
+            });
+            created.onDispose(() => blurred.unsubscribe());
             this.connect(pane, target, spec, created);
         }
         if (options.background) {
@@ -1577,10 +1737,29 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     inFront(pane) {
         return (0, targets_1.desktopPaneOf)(this.app.activeTab) === pane;
     }
-    /** Whether `session` is the desktop of the pane the user is in (see inFront). */
+    /**
+     * Whether `session` is the desktop of the pane the user is in (see inFront), and not behind a pane maximized over
+     * it (see behindMaximized).
+     */
     showsInFront(session) {
         const pane = (0, targets_1.desktopPaneOf)(this.app.activeTab);
-        return !!pane && this.sessions.get(pane) === session;
+        return !!pane && this.sessions.get(pane) === session && !this.behindMaximized(pane);
+    }
+    /**
+     * A desktop whose pane stopped being the one the user is in (see showsInFront): the focus is taken from it, if it
+     * has it, and the keys it holds on the remote are let go of. Their keyups go where the user went, whether the
+     * desktop kept the focus until now (a tab that takes none) or lost it to what they went to (a terminal), and
+     * IronRDP lets go of nothing as its canvas loses the focus (see DesktopSession.letGo). With typing broadcast to
+     * every desktop of the tab, leaving the tab leaves all of its panes, so each of them is let go of here too.
+     */
+    letGoUnlessInFront(session) {
+        if (this.showsInFront(session)) {
+            return;
+        }
+        if (session.holdsFocus()) {
+            session.letGo();
+        }
+        session.releaseKeys();
     }
     /**
      * Gives a desktop that just connected the keyboard, if it shows in the pane the user is in. Not when another pane is
@@ -2143,7 +2322,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             timer = setTimeout(() => this.followPane(pane, session), 300);
         });
         observer.observe(session.overlay);
-        session.onDispose(() => {
+        session.onConnectionEnd(() => {
             clearTimeout(timer);
             observer.disconnect();
         });
@@ -2618,25 +2797,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return this.sessions.get(pane)?.log ?? [];
     }
     loadIronRDP() {
-        this.ironrdp ??= (async () => {
-            // The WebAssembly ships as its own file (not inlined in the bundle). It is read here and handed to init,
-            // rather than fetched by the bundle from next to itself: fetch() of file:// URLs is up to the Electron
-            // build (a fuse turns it off), and a plain file path needs no URL escaping for spaces or drive letters.
-            const [rdp, wasm] = await Promise.all([
-                importESM(vendor('iron-remote-desktop.js')).then(() => importESM(vendor('iron-remote-desktop-rdp.js'))),
-                fs.promises.readFile(vendorFile('ironrdp_web_bg.wasm')),
-            ]);
-            // Troubleshooting: localStorage.trdLogLevel = 'DEBUG' (or TRACE), then restart Tabby.
-            let level = 'INFO';
-            try {
-                level = localStorage.getItem('trdLogLevel') || level;
-            }
-            catch { }
-            await rdp.init(level, wasm);
-            return rdp;
-        })();
-        this.ironrdp.catch(() => { this.ironrdp = null; });
-        return this.ironrdp;
+        let level = 'INFO';
+        try {
+            level = localStorage.getItem('trdLogLevel') || level;
+        }
+        catch { }
+        return this.ironrdp.create(level);
     }
     /**
      * Where to connect and as whom. The host's own desktop: the setup script (grd, generated credentials), or, where
@@ -2721,6 +2887,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         }
         session.status('');
         const mark = (0, signin_1.forgetMark)();
+        const accountRevision = account && this.accountRevisions.capture(account);
         // The host's own desktops (its own, or its xrdp besides GNOME) and direct ones need no "via". A machine reached
         // with ssh typed in a host's console says which host: that host is what leads there.
         const hostOwn = spec.id === desktops_1.OWN_DESKTOP || spec.kind === 'xrdp' && spec.host === '127.0.0.1';
@@ -2729,8 +2896,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             title: spec.hyperv ? `Sign in to ${target.label}${target.via ? ` (via ${target.via})` : ''}, to open ${spec.name}`
                 : hostOwn && !target.via || target.direct ? `Sign in to ${spec.name}` : `Sign in to ${spec.name} (via ${via})`,
             username: account ? (0, accounts_1.signInName)(account) : spec.username,
-            error: retryError,
-            canRemember: true,
+            error: [retryError, account && accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: !account || accountRevision !== undefined,
             account: account?.name,
         }, session.disposed);
         // Only in the pane in front, as when connected (see run()): the form gets the keyboard when its pane does.
@@ -2741,7 +2908,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return entered && {
             host: spec.host, port: spec.port, credentials: entered, remember: entered.remember, domain: account ? account.domain ?? '' : undefined,
             saveKey: account && (0, accounts_1.accountKey)(account.id), saveLabel: account && `saved account ${account.name}`, saveFor: account && (0, accounts_1.signInName)(account),
-            hyperv, mark,
+            hyperv, mark, accountRevision,
         };
     }
     async connect(pane, target, spec, session) {
@@ -2886,35 +3053,35 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     }
     /**
      * The sign-in to a desktop's RD Gateway with the saved account it names: the account's password from the keychain,
-     * or asked for (when none is saved, or `retryError`: the gateway just refused it). Undefined when that account no
-     * longer exists (the desktop's own sign-in is then tried); null when the form was cancelled.
+     * or asked for (when none is saved, or `retryError`: the gateway just refused it). A removed or missing account
+     * always asks for separate credentials; null when the form was cancelled.
      */
     async gatewayAccountFor(spec, session, gateway, retryError) {
         const account = this.accounts().find(a => a.id === spec.gatewayAccount);
         if (!account) {
-            session.log.push('gateway: its saved account no longer exists; signing in with the desktop\'s');
-            return undefined;
+            session.log.push('gateway: asking for a separate account');
         }
-        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account) };
-        const saved = retryError ? null : await (0, signin_1.loadCredentials)(signIn.saveKey);
-        if (saved && saved.username === (0, accounts_1.signInName)(account)) {
+        const signIn = account ? { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account), accountRevision: this.accountRevisions.capture(account) } : undefined;
+        const saved = !retryError && signIn ? await (0, signin_1.loadCredentials)(signIn.saveKey) : null;
+        if (saved && account && saved.username === (0, accounts_1.signInName)(account)) {
             session.log.push(`gateway: the saved account "${account.name}"`);
             return { ...signIn, credentials: { username: (0, accounts_1.signInName)(account), password: saved.password }, remember: false };
         }
         session.status('');
         const asked = (0, signin_1.askCredentials)(session.overlay, {
             title: `Sign in to the gateway ${gateway.host}, to reach ${spec.name}`,
-            username: (0, accounts_1.signInName)(account),
-            error: retryError,
-            canRemember: true,
-            account: account.name,
+            username: account ? (0, accounts_1.signInName)(account) : '',
+            error: [retryError, !account && spec.gatewayAccount !== accounts_1.ASK_GATEWAY_ACCOUNT ? 'The saved gateway account no longer exists. Enter a separate account for the gateway.' : '',
+                account && signIn?.accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: !!signIn && signIn.accountRevision !== undefined,
+            account: account?.name,
         }, session.disposed);
         // Only in the pane in front (see endpointFor).
         if (session.visible && this.showsInFront(session)) {
             setTimeout(() => session.visible && this.showsInFront(session) && session.focusDesktop());
         }
         const entered = await asked;
-        return entered && { ...signIn, credentials: entered, remember: entered.remember };
+        return entered && { ...signIn, credentials: entered, remember: !!signIn && entered.remember };
     }
     /**
      * The proxy's stream to a desktop behind an RD Gateway (see gateway.ts): to the gateway as the SSH host (or this
@@ -2923,17 +3090,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async throughGateway(target, spec, session, gateway, endpoint, signal) {
         session.gatewayRefused = null;
         const own = endpoint.gatewayAccount;
+        if (spec.gatewayAccount && !own) {
+            throw new Error('A separate gateway sign-in is required before connecting.');
+        }
         const credentials = own?.credentials ?? endpoint.credentials;
-        session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its saved account' : 'the desktop\'s sign-in'}`);
+        session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its separate account' : 'the desktop\'s sign-in'}`);
         try {
             const stream = await (0, gateway_1.openThroughGateway)(() => target.openTcp(gateway.host, gateway.port), gateway, { username: credentials.username, password: credentials.password, domain: (own ? own.domain : endpoint.domain ?? spec.domain) || undefined }, { host: endpoint.host, port: endpoint.port }, (fingerprint, valid, reason, details) => this.checkGatewayCertificate(session, gateway, fingerprint, valid, reason, details), { log: m => session.log.push(m), clientName: os.hostname(), signal });
             // Entered a moment ago and taken by the gateway: kept, while the account is still what it was signed in as.
-            if (own?.remember) {
+            if (own?.remember && own.saveKey) {
                 own.remember = false;
-                const accountNow = this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === own.saveKey);
-                if (accountNow && (0, accounts_1.signInName)(accountNow) === own.saveFor) {
-                    (0, signin_1.saveCredentials)(own.saveKey, own.credentials, own.saveLabel).then(() => session.log.push(`gateway: saved as the account's password in ${(0, signin_1.storeName)()}`), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
-                }
+                const saveKey = own.saveKey;
+                (0, signin_1.saveCredentialsIf)(saveKey, own.credentials, () => this.accountCurrent(saveKey, own.saveFor, own.accountRevision), own.saveLabel).then(saved => session.log.push(saved ? `gateway: saved as the account's password in ${(0, signin_1.storeName)()}` : 'gateway: not saved: the account changed meanwhile'), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             return stream;
         }
@@ -3391,8 +3559,40 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     }
     /** One RDP connection attempt, until it ends. */
     async run(pane, target, spec, session, rdp, endpoint) {
+        const attempt = new AbortController();
+        let connectedAt;
+        let unwatch;
+        const trapped = new Promise(resolve => {
+            unwatch = rdp.runtime?.onTrap((error) => {
+                session.log.push(`wasm: this desktop's instance trapped: ${error.message}`);
+                // Drop the socket even if Rust's run() promise can no longer settle after a trap.
+                session.proxy?.close();
+                session.proxy = null;
+                resolve({ connected: session.state === 'connected', error: `WebAssembly instance failed: ${error.message}` });
+            });
+        });
+        try {
+            return await Promise.race([
+                this.runConnection(pane, target, spec, session, rdp, endpoint, attempt.signal, at => { connectedAt = at; }),
+                trapped,
+                session.disposed.then(() => ({ connected: false })),
+            ]);
+        }
+        finally {
+            attempt.abort();
+            unwatch?.();
+            // Rust's run() can stay pending after an asynchronous trap. Account for the completed attempt here,
+            // exactly once, and never update retry state belonging to a replacement session in this pane.
+            if (connectedAt !== undefined && this.sessions.get(pane) === session) {
+                this.reconnectedUntilNow(pane, connectedAt);
+            }
+            session.endConnection?.();
+            rdp.runtime?.dispose?.();
+        }
+    }
+    async runConnection(pane, target, spec, session, rdp, endpoint, signal, onConnected) {
         const credentials = endpoint.credentials;
-        const alive = () => this.sessions.get(pane) === session;
+        const alive = () => !signal.aborted && this.sessions.get(pane) === session;
         session.certificateProblem = null;
         session.gatewayRefused = null;
         session.withoutNla = false;
@@ -3406,7 +3606,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.host.replaceChildren(el);
             // The element only gets ready in the page: one whose desktop was closed meanwhile (the layer gone) never does.
             // Closed as it got ready, it isn't given the clipboard, files and the rest that closing it has ended already.
-            session.ui = await Promise.race([ready, session.disposed.then(() => null)]);
+            session.ui = await Promise.race([ready, session.disposed.then(() => null), new Promise(resolve => {
+                    signal.addEventListener('abort', () => resolve(null), { once: true });
+                })]);
             if (!session.ui || !alive()) {
                 return { connected: false };
             }
@@ -3546,6 +3748,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             if (!alive()) {
                 return { connected: false };
             }
+            const connectedAt = Date.now();
+            onConnected(connectedAt);
             session.ui.setVisibility(true);
             this.applyKeyboardMode(session);
             session.remoteSize = { width, height, scale: 100 };
@@ -3564,11 +3768,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             this.changed$.next();
             // Under a saved account only while that account is still there with the same sign-in name: the prompt may
             // have been open while it was removed or changed in Settings.
-            const accountNow = endpoint.saveKey ? this.accounts().find(a => (0, accounts_1.accountKey)(a.id) === endpoint.saveKey) : undefined;
-            if (endpoint.remember && endpoint.saveKey && (!accountNow || (0, accounts_1.signInName)(accountNow) !== endpoint.saveFor)) {
-                session.log.push(`sign-in: not saved: the account ${accountNow ? 'changed' : 'was removed'} meanwhile`);
+            if (endpoint.remember && endpoint.saveKey) {
+                const key = endpoint.saveKey;
+                (0, signin_1.saveCredentialsIf)(key, credentials, () => this.accountCurrent(key, endpoint.saveFor, endpoint.accountRevision), endpoint.saveLabel).then(saved => session.log.push(saved ? `sign-in: saved as the account's password in ${(0, signin_1.storeName)()}` : 'sign-in: not saved: the account changed meanwhile'), e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
-            else if (endpoint.remember && !endpoint.saveKey && endpoint.mark !== undefined && (0, signin_1.forgottenSince)(session.credentialKey, endpoint.mark)) {
+            else if (endpoint.remember && endpoint.mark !== undefined && (0, signin_1.forgottenSince)(session.credentialKey, endpoint.mark)) {
                 // Edited (its user name, gateway or address) or removed while the server delayed the sign-in: what was
                 // forgotten then stays forgotten, and the desktop asks the next time.
                 session.log.push('sign-in: not saved: the desktop was changed or removed meanwhile');
@@ -3587,12 +3791,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }, e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             this.focusIfInFront(pane, session);
-            const connectedAt = Date.now();
             let end;
             try {
                 end = await info.run();
             }
             catch (e) {
+                if (!alive()) {
+                    return { connected: false };
+                }
                 if (session.h264?.failed) {
                     // Reconnects (automatically, like any dropped connection) without H.264, unless the browser only
                     // took an idle decoder back (a hidden window): then with it, as a new stream starts with a key frame.
@@ -3613,15 +3819,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }
                 return { connected: true, error };
             }
-            finally {
-                // The server can't close the microphone, or its files, once the connection is gone.
-                session.mic?.close();
-                session.drives?.dispose();
-                if (alive()) {
-                    this.reconnectedUntilNow(pane, connectedAt);
-                }
-            }
-            return { connected: true, reason: end?.reason?.() };
+            return alive() ? { connected: true, reason: end?.reason?.() } : { connected: false };
         }
         catch (e) {
             return { connected: false, error: e?.message ?? String(e) };
@@ -3647,7 +3845,7 @@ exports.RemoteDesktopService = RemoteDesktopService = RemoteDesktopService_1 = _
         tabby_core_1.PlatformService])
 ], RemoteDesktopService);
 let styleInstalled = false;
-function installStyle() {
+function installStyle(compat) {
     if (styleInstalled) {
         return;
     }
@@ -3655,7 +3853,7 @@ function installStyle() {
     const style = document.createElement('style');
     style.textContent = STYLE + signin_1.STYLE + fileTransfer_1.STYLE + connectionStatus_1.STYLE + osd_1.OSD_STYLE + DRAGBAR_STYLE + accountForm_1.STYLE;
     document.head.appendChild(style);
-    keepWindowDraggable();
+    keepWindowDraggable(compat);
 }
 /** A strip the height of the tab bar that stays a window drag region over a dialog (the plugin's, and Tabby's). */
 const DRAGBAR_STYLE = `
@@ -3663,12 +3861,14 @@ const DRAGBAR_STYLE = `
 .modal > .trd-form-dragbar { display: block; position: fixed; left: 0; right: 0; top: 0; height: var(--tabs-height, 38px); -webkit-app-region: drag; }
 `;
 /**
- * Tabby's dialogs (ng-bootstrap modals) cover the whole window, tab bar included, with nothing marked as a drag
- * region, so the window can't be moved while one shows. Each gets a strip where the tab bar is; the dialog box itself
- * is below it. The plugin's own dialogs do the same (see settingsPage.ts).
+ * Older Tabby dialogs cover the tab bar without a drag region. Supply their fallback strip, deferring to the host's
+ * modal pseudo-element when it provides one. The plugin's own dialogs still need their strips (see settingsPage.ts).
  */
-function keepWindowDraggable() {
+function keepWindowDraggable(compat) {
     const strip = (modal) => {
+        if (compat.hasNativeModalDragRegion(modal)) {
+            return;
+        }
         if (!modal.querySelector(':scope > .trd-form-dragbar')) {
             const bar = document.createElement('div');
             bar.className = 'trd-form-dragbar';