tabby-rdp 0.5.1 → 0.5.3

package/dist/signin.js

@@ -8,10 +8,12 @@ exports.renameCredentials = renameCredentials;
 exports.loadCredentials = loadCredentials;
 exports.hasCredentials = hasCredentials;
 exports.saveCredentials = saveCredentials;
+exports.saveCredentialsIf = saveCredentialsIf;
 exports.forgetMark = forgetMark;
 exports.forgottenSince = forgottenSince;
 exports.forgetCredentials = forgetCredentials;
 exports.forgetCredentialsOrFail = forgetCredentialsOrFail;
+exports.forgetCredentialsIf = forgetCredentialsIf;
 exports.gatewayScope = gatewayScope;
 exports.isFor = isFor;
 exports.forgetCredentialsFor = forgetCredentialsFor;
@@ -50,8 +52,14 @@ function storeName() {
  * back, so two at once (two desktops signing in together) would lose one's change.
  */
 let vaultQueue = Promise.resolve();
+/** Same-origin windows share these locks. Store work holds the lock through its actual completion. */
+async function storeLock(name, work, signal) {
+    const locks = globalThis.navigator?.locks;
+    return locks ? await locks.request(`tabby-rdp.credentials.${name}`, signal ? { signal } : {}, work) : work();
+}
 function queued(work) {
-    const next = vaultQueue.then(work, work);
+    const run = () => storeLock('vault', work);
+    const next = vaultQueue.then(run, run);
     vaultQueue = next.catch(() => null);
     return next;
 }
@@ -90,16 +98,21 @@ function keytar() {
  */
 function keychain(call) {
     const run = () => new Promise((resolve, reject) => {
-        const store = keytar();
-        if (!store) {
-            resolve(undefined);
+        if (keychainStuck) {
+            reject(new Error('the keychain did not answer earlier'));
             return;
         }
+        const abort = new AbortController();
         const timer = setTimeout(() => {
             keychainStuck = true;
+            abort.abort(); // cancels a lock still waiting, never a native call already running
             reject(new Error('the keychain did not answer'));
         }, KEYCHAIN_TIMEOUT_MS);
-        Promise.resolve(call(store)).then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
+        // Timeout is outside the lock: a late native write keeps other windows' writes behind it until it ends.
+        storeLock('keychain', async () => {
+            const store = keytar();
+            return store ? call(store) : undefined;
+        }, abort.signal).then(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
     });
     const next = keychainQueue.then(run, run);
     keychainQueue = next.catch(() => null);
@@ -134,6 +147,8 @@ async function used() {
         onceRunning = doOnce(job).catch(() => undefined).finally(() => { onceRunning = null; });
     }
     await onceRunning;
+    // A previous background pass may have failed before the store became available. This use gets one fresh attempt.
+    await laterRunning;
     if (later.length && !laterRunning) {
         laterRunning = doLater().catch(() => undefined).finally(() => { laterRunning = null; });
     }
@@ -354,19 +369,54 @@ async function hasCredentials(key) {
     }
 }
 async function saveCredentials(key, credentials, label) {
+    await saveCredentialsIf(key, credentials, () => true, label);
+}
+/**
+ * Checks a revision within the store queue/lock, including after an asynchronous write. If invalidated while writing,
+ * removes that write before a newer queued replacement can run. Never schedules a deletion behind a newer write.
+ */
+async function saveCredentialsIf(key, credentials, current, label) {
     await used();
     if (vaultOn()) {
-        await queued(() => vault.addSecret({ type: exports.VAULT_SECRET_TYPE, key: { ...vaultKey(key), description: label ?? vaultName(key) }, value: JSON.stringify(credentials) }));
+        const saved = await queued(async () => {
+            if (!current()) {
+                return false;
+            }
+            await vault.addSecret({ type: exports.VAULT_SECRET_TYPE, key: { ...vaultKey(key), description: label ?? vaultName(key) }, value: JSON.stringify(credentials) });
+            if (!current()) {
+                await vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key));
+                return false;
+            }
+            return true;
+        });
+        if (!saved) {
+            return false;
+        }
         newlySaved(key, true);
         // Not in two places: what the keychain had for it goes.
         try {
-            await keychain(store => store.deletePassword(KEYCHAIN_SERVICE, key));
+            await keychain(async (store) => { if (current()) {
+                await store.deletePassword(KEYCHAIN_SERVICE, key);
+            } });
         }
         catch { }
-        return;
+        return true;
     }
-    await keychain(store => store.setPassword(KEYCHAIN_SERVICE, key, JSON.stringify(credentials)));
-    newlySaved(key, false);
+    const saved = await keychain(async (store) => {
+        if (!current()) {
+            return false;
+        }
+        await store.setPassword(KEYCHAIN_SERVICE, key, JSON.stringify(credentials));
+        if (!current()) {
+            await store.deletePassword(KEYCHAIN_SERVICE, key);
+            return false;
+        }
+        return true;
+    });
+    if (saved) {
+        newlySaved(key, false);
+    }
+    return !!saved;
 }
 /**
  * A password was saved under `key` just now, in the Vault or with `inVault` false the keychain, in place of what a
@@ -423,6 +473,19 @@ async function forgetCredentialsOrFail(key) {
     await used();
     return forgetNow(key);
 }
+/** An account edit/removal must not delete a replacement committed by a later edit. */
+async function forgetCredentialsIf(key, current) {
+    noteForget(k => k === key);
+    await used();
+    if (vaultOn()) {
+        await queued(async () => { if (current()) {
+            await vault.removeSecret(exports.VAULT_SECRET_TYPE, vaultKey(key));
+        } });
+    }
+    await keychain(async (store) => { if (current()) {
+        await store.deletePassword(KEYCHAIN_SERVICE, key);
+    } });
+}
 /** Forgets what is saved under `key`, in both stores. */
 async function forgetNow(key) {
     await forgetIn(true, key);

package/dist/targets.js

@@ -153,7 +153,15 @@ class SystemSSHTarget {
             child.stderr.on('data', d => { stderr = (stderr + d).slice(-4096); });
             const timer = setTimeout(() => stop(new Error('Remote command timed out after 60s')), 60000);
             child.on('error', reject);
-            child.on('exit', code => {
+            // ssh can exit before it reads stdin, or the command may not use it. Its status and stderr say why:
+            // EPIPE on the input pipe must not escape as an uncaught error or replace ssh's own explanation.
+            child.stdin.on('error', (e) => {
+                if (e.code !== 'EPIPE') {
+                    stop(e);
+                }
+            });
+            // All output, and any input pipe error, has arrived only once the process's streams have closed.
+            child.on('close', code => {
                 clearTimeout(timer);
                 if (stopped) {
                     reject(stopped);

package/dist/updates.js

@@ -9,92 +9,95 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateCheck = void 0;
-exports.latestVersion = latestVersion;
+exports.UpdateCheck = exports.newer = void 0;
 exports.installedVersion = installedVersion;
-exports.newer = newer;
+exports.latestVersion = latestVersion;
+const fs_1 = require("fs");
+const path_1 = require("path");
 const core_1 = require("@angular/core");
 const rxjs_1 = require("rxjs");
 const tabby_core_1 = require("tabby-core");
 const help_1 = require("./help");
 const targets_1 = require("./targets");
-const REGISTRY = 'https://registry.npmjs.org/tabby-rdp/latest';
-const RELEASES = 'https://github.com/meanaverage/tabby-rdp/releases';
+const hostCompat_1 = require("./hostCompat");
+const packageChangeDialog_1 = require("./packageChangeDialog");
+const releases_1 = require("./releases");
+var releases_2 = require("./releases");
+Object.defineProperty(exports, "newer", { enumerable: true, get: function () { return releases_2.newer; } });
 const DAY = 24 * 60 * 60 * 1000;
-/**
- * The latest version's number, as npm says, from an answer read for `timeoutMs` and up to `maxBytes` at most (it is
- * that version's package.json, a few KB): whoever answers in npm's name (a proxy that inspects TLS, say) could
- * otherwise keep the request waiting for good, or fill Tabby's memory.
- */
-async function latestVersion(url = REGISTRY, timeoutMs = 15000, maxBytes = 256 * 1024) {
-    const abort = new AbortController();
-    const timer = setTimeout(() => abort.abort(), timeoutMs);
+// Capture the running package before an installer replaces its files on disk.
+const PACKAGE = require('../package.json');
+const RUNNING = PACKAGE.version;
+function installedVersion() { return RUNNING; }
+/** Kept for callers needing only npm's latest version, with the same response bounds. */
+async function latestVersion(url = 'https://registry.npmjs.org/tabby-rdp/latest', timeoutMs = 15000, maxBytes = 256 * 1024) {
+    return String((await (0, releases_1.registryJSON)(url, timeoutMs, maxBytes))?.version ?? '');
+}
+function localStore() {
     try {
-        const response = await fetch(url, { cache: 'no-store', signal: abort.signal });
-        if (!response.body) {
-            throw new Error(`the registry answered ${response.status} with nothing`);
-        }
-        const reader = response.body.getReader();
-        const chunks = [];
-        let size = 0;
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done) {
-                break;
-            }
-            size += value.byteLength;
-            if (size > maxBytes) {
-                throw new Error('the registry\'s answer is too large');
-            }
-            chunks.push(value);
-        }
-        return String(JSON.parse(Buffer.concat(chunks).toString('utf8'))?.version ?? '');
+        return window.localStorage;
     }
-    finally {
-        clearTimeout(timer);
-        // Ends the request, if it is still going (an answer too large).
-        abort.abort();
+    catch {
+        return undefined;
     }
 }
-/** This package's version. */
-function installedVersion() {
+function hasPreferences(storage) {
     try {
-        return require('../package.json').version;
+        return typeof JSON.parse(storage?.getItem(releases_1.RELEASE_STATE_KEY) ?? 'null')?.paused === 'boolean';
     }
     catch {
-        return '0.0.0';
-    }
-}
-/** Whether `a` is a later release than `b` (x.y.z; a version with a pre-release part is never offered). */
-function newer(a, b) {
-    const parse = (v) => /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim())?.slice(1).map(Number);
-    const x = parse(a), y = parse(b);
-    if (!x || !y) {
         return false;
     }
-    for (let i = 0; i < 3; i++) {
-        if (x[i] !== y[i]) {
-            return x[i] > y[i];
-        }
-    }
-    return false;
 }
-/**
- * Tells about a newer tabby-rdp: Tabby only shows plugin upgrades while its Plugins page is open, and never on its own.
- * Once a day (and a little after Tabby starts) it asks npm for the latest version, and nothing else: no identifier,
- * no usage. A newer one gets a note, once per version, over the active pane; an "Update available" item in the
- * menus and a line on the settings page until it's installed. `remoteDesktop.checkUpdates` turns it off.
- */
-let UpdateCheck = class UpdateCheck {
-    constructor(config, app, help, platform, zone) {
+/** Daily, opt-out update notes; explicit package changes are handled by ReleaseManager. */
+let UpdateCheck = class UpdateCheck extends releases_1.ReleaseManager {
+    constructor(config, app, help, platform, zone, compat) {
+        const storage = localStore();
+        const migratePreferences = !hasPreferences(storage);
+        const dialog = new packageChangeDialog_1.PackageChangeDialog();
+        super({ running: RUNNING, policy: PACKAGE.tabbyRdp, tabby: compat.info.version ?? '', node: process.versions.node,
+            os: process.platform, cpu: process.arch, storage, fetchCatalog: releases_1.publishedVersions,
+            withLock: async (run) => {
+                if (!navigator.locks) {
+                    throw new Error('This Tabby cannot coordinate version changes between windows. Use Tabby Plugins.');
+                }
+                await navigator.locks.request('tabby-rdp.package-change', run);
+            },
+            diskVersion: () => {
+                try {
+                    return JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'package.json'), 'utf8')).version;
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT') {
+                        return null;
+                    }
+                    throw error;
+                }
+            },
+            install: (name, version) => platform.installPlugin(name, version), uninstall: name => platform.uninstallPlugin(name),
+            confirm: (message, detail, action) => dialog.confirm(message, detail, action),
+            progress: state => dialog.update(state), }, !config.store || config.store.remoteDesktop?.checkUpdates === false);
         this.config = config;
         this.app = app;
         this.help = help;
         this.platform = platform;
         this.zone = zone;
-        /** The newer version, once one is known. */
-        this.available = null;
-        this.changed$ = new rxjs_1.Subject();
+        // Tabby can construct providers before ConfigService has loaded its store.
+        // Keep checks paused until ready, and migrate the old switch only without a saved local preference.
+        if (migratePreferences) {
+            const migrate = () => { void this.setPaused(config.store?.remoteDesktop?.checkUpdates === false); };
+            if (config.store) {
+                migrate();
+            }
+            else {
+                config.ready$.pipe((0, rxjs_1.take)(1)).subscribe(migrate);
+            }
+        }
+        window.addEventListener('storage', event => {
+            if (event.key === releases_1.RELEASE_STATE_KEY) {
+                this.zone.run(() => this.syncFromStorage());
+            }
+        });
     }
     start() {
         this.zone.runOutsideAngular(() => {
@@ -102,41 +105,26 @@ let UpdateCheck = class UpdateCheck {
             this.timer = setInterval(() => this.check().catch(() => null), DAY);
         });
     }
-    get enabled() {
-        return this.config.store.remoteDesktop?.checkUpdates !== false;
-    }
-    /** Asks npm for the latest version (or takes `latest`, for tests), and tells about it if it's newer. */
-    async check(latest) {
-        if (!this.enabled && latest === undefined) {
+    async check() {
+        if (this.state.paused) {
             return null;
         }
-        const version = latest ?? await latestVersion();
+        await this.refreshCatalog();
         this.zone.run(() => {
-            this.available = newer(version, installedVersion()) ? version : null;
-            this.changed$.next();
             if (this.available) {
                 this.noteOnce(this.available);
             }
         });
         return this.available;
     }
-    /**
-     * Asks again now, when a version is known already: the settings page is where it's shown, and a Tabby left open for
-     * days would otherwise offer the version it found first, not the latest (meanaverage/tabby-rdp#17).
-     */
-    refresh() {
-        if (this.available && this.enabled) {
-            this.check().catch(() => null);
+    /** Opening Updates loads published versions even when ordinary prompts are paused. */
+    refresh() { void this.refreshCatalog(); }
+    upgrade() { this.help.open('updates'); }
+    whatsNew(version = this.available ?? this.running) {
+        if ((0, releases_1.releaseVersion)(version)) {
+            this.platform.openExternal(`${releases_1.RELEASES}/tag/v${version}`);
         }
     }
-    /** Settings › Plugins, where Tabby's Upgrade button is. */
-    upgrade() {
-        this.help.openSettings('plugins');
-    }
-    /** The release notes of the newer version. */
-    whatsNew() {
-        this.platform.openExternal(`${RELEASES}/tag/v${this.available ?? ''}`);
-    }
     /** A note over the active pane, once per version (then the menus and the settings page keep saying it). */
     noteOnce(version) {
         const store = this.config.store.remoteDesktop;
@@ -163,5 +151,5 @@ let UpdateCheck = class UpdateCheck {
 exports.UpdateCheck = UpdateCheck;
 exports.UpdateCheck = UpdateCheck = __decorate([
     (0, core_1.Injectable)({ providedIn: 'root' }),
-    __metadata("design:paramtypes", [tabby_core_1.ConfigService, tabby_core_1.AppService, help_1.RemoteDesktopHelp, tabby_core_1.PlatformService, core_1.NgZone])
+    __metadata("design:paramtypes", [tabby_core_1.ConfigService, tabby_core_1.AppService, help_1.RemoteDesktopHelp, tabby_core_1.PlatformService, core_1.NgZone, hostCompat_1.HostCompatibility])
 ], UpdateCheck);

package/docs/desk.md

@@ -0,0 +1,157 @@
+# `desk`: the console, on the desktop
+
+Type `desk` in an SSH console and the tab switches to that machine's desktop, where a maximized terminal is attached
+to the *same* shell: same scrollback, working directory, jobs and running program. Typing on either side shows on
+both. The hotkey or the header button takes you back to the console.
+
+`desk` is off by default, because it changes how SSH logins start on the remote. Turn it on in
+the menu's **Remote Desktop › Settings**, or Tabby's Settings › Remote Desktop (the `remoteDesktop.desk` setting).
+
+<p align="center">
+  <img src="images/console.png" width="49%" alt="A console before desk">
+  <img src="images/desk.png" width="49%" alt="The same shell in a terminal on the desktop">
+</p>
+
+## How it fits together
+
+| Step | What happens | Code |
+|---|---|---|
+| Setup | With `desk` on, the next desktop connect installs `~/.local/share/tabby-rdp/` (`login.sh`, `bin/desk`, `bin/trd-pty`, `tmux.conf`, `backend`, `desk-key`) and one line in `~/.bashrc` / `~/.zshrc`, and tells the plugin desk's key. Turning `desk` off removes exactly that line and those files on the next connect: the rest of each rc file is written back into it byte for byte (a last line without its newline gets one), so links to it, its other names, its mode and its owner stay. A read-only rc file is left as it is, and the desktop's log says so; should writing one fail part way (a full disk), what it should hold stays in `~/.local/share/tabby-rdp/`, and the log says where. | `src/remoteSetup.ts` |
+| Login | Interactive SSH logins start inside a shareable session: `trd-pty` (default) or tmux. | `login.sh` |
+| `desk` | `bin/desk` prints an OSC 7777 sequence (session, socket, working directory, kind, machine, host name, desk's key). | `login.sh`, `bin/desk` |
+| Interception | A `SessionMiddleware` on every terminal session strips the sequence and, if it carries a key a host gave, asks the plugin to open the console on the desktop. | `src/desk.ts`, `src/deskScript.ts` |
+| Desktop | The host's own desktop opens over the pane (or the one already open for that account is shown). | `src/desktop.service.ts` |
+| Terminal | Over an SSH exec channel, in the headless session: `gnome-terminal --maximize -- trd-pty attach <id>` (or `tmux attach`). | `src/deskScript.ts` |
+
+`TABBY_NO_SESSION=1` skips the shared session for one login. `desk` outside a shared session opens a terminal in the
+same folder. Logins that started before the hook was installed need to reconnect.
+
+## Which requests count
+
+`desk` reaches Tabby the way any program's output does, so a file shown with `cat`, a log, or another machine's output
+could print the same sequence. What tells them apart is the key `bin/desk` adds: 128 random bits in
+`~/.local/share/tabby-rdp/desk-key` (0600, in the plugin's 0700 folder), which only the user's own processes on that
+host can read. The setup reports it to the plugin (`RD_DESK`), which keeps its SHA-256 per host account in
+`remoteDesktop.deskKeys` (never the key itself), so `desk` keeps working after Tabby restarts.
+
+- **A request counts only with the key of the host it is for:** the tab's host, or the machine `ssh` typed in its
+  console went to. A request without a key (a `desk` from before keys) or with one no host gave is dropped as the
+  output is read, before anything runs, here or there, and without a word in Tabby's window, `desk` on or off; the
+  developer console counts them, once per 2 s. A request with a key known for another host shows a note saying so.
+- **So `desk` works on hosts whose desktop this Tabby opened with `desk` on:** the setup that runs as the desktop opens
+  reports the key, whether or not the connection that follows gets through (for a machine reached with `ssh` typed in a
+  console, its desktop opened through that host, under whose key it is kept). A setup run with `desk` off gives no key,
+  whatever the host prints, and has Tabby forget the one it had for that host as it starts (so also when the setup then
+  fails or never finishes); one during which `desk` is turned off gives none either, and has Tabby forget it when it
+  ends or fails with `desk` still off; with `desk` on again by then, it changes nothing, so that what a setup since kept
+  (a new key, or none) stays. A setup that finds xrdp or Windows there instead of GNOME has Tabby forget it too. After
+  updating from an earlier version, open each host's desktop once: that installs the new `bin/desk` there and tells
+  Tabby its key. The same goes for a host set up from another computer, unless that computer's Tabby shares this one's
+  config (config sync): the keys' fingerprints are part of it.
+- **Only in the pane in front.** A request from a pane that isn't the focused pane of the active tab, or that stops
+  being it by the time the desktop would show (the plugin first asks the machine which one it is), gets a note in that
+  pane instead of the desktop: shown there, the desktop would take the keyboard, and this computer's clipboard with
+  it, from the pane in use, even from another tab (Tabby keeps those in the page, off screen). A desktop that
+  finishes connecting, a sign-in form or a question that shows up, or the first connection's tip as it closes, takes
+  the keyboard only in the pane in front too.
+- **One at a time:** of the requests with a known key, a terminal passes on one every 2 s (the last one in its chunk
+  of output), and a pane handles one at a time, then none for 2 s. Output full of look-alikes costs about what any
+  output of its size does. With `desk` off, a request with a known key from the pane in front says that `desk` is off,
+  as often as that; from another pane, nothing.
+- **Only sessions of the user's own** get a desktop terminal attached: a trd-pty session by its id (the client checks
+  that the session runs as the same user), or a tmux server whose socket the user owns, in tmux's folder for them
+  (`tmux-<uid>`, no access for others), with no symbolic link on the way and every folder above it root's or the
+  user's and one other users can't write to (or sticky, like `/tmp`), so that nobody else can swap the path before the
+  attach. Anything else opens a terminal in the folder instead.
+- Turning `desk` off and on again (opening the desktop in between) makes a new key.
+- The key tells `desk` apart from look-alike output, not from the host itself, which can always read it: a host
+  whose desktop you opened with `desk` on can open that desktop again from its console, while you are in its pane.
+  Nor from a recording of `desk`'s output (`script`, asciinema, a terminal log), which holds the key: shown again in a
+  pane connected to that machine, it counts as `desk`. Open the desktop of a host you don't trust with `desk` off.
+
+## `trd-pty`: a shared terminal session, not a multiplexer
+
+The shared session only has to do a few things, which is why it isn't tmux by default:
+
+- own the shell's PTY, so the shell survives SSH disconnects;
+- let several terminals attach at once, with output to all of them and input from any;
+- show the current screen to a terminal that attaches late;
+- follow one terminal's size at a time, without flapping;
+- end like a plain SSH login when its last terminal goes.
+
+tmux does all of that, but also takes Ctrl-B, re-renders output (so the terminal's own scrollback needs overrides),
+needs passthrough for OSC sequences such as working-directory reporting, clipboard and `desk` itself, and nests with a
+tmux of your own. `remote/trd-pty.py` (Python 3 standard library, about 510 lines of code) does only the list above:
+
+```
+                 ┌── trd-pty client ◀─▶ Tabby console (SSH PTY → xterm.js)
+login shell ◀─▶ PTY ◀─▶ session owner ──┤
+                 └── trd-pty client ◀─▶ GNOME Terminal on the desktop
+```
+
+- **One owner process per session** holds the PTY (login shell, `TRD_SESSION` / `TRD_SOCKET` in its environment),
+  detached with `setsid`.
+- **Access:** a Unix socket in `$XDG_RUNTIME_DIR/trd-pty/` (directory `0700`, checked; socket `0600`), or
+  `/tmp/trd-pty-<uid>/` without a runtime directory, only while `/tmp` has its sticky bit (otherwise another user
+  could swap the folder). Both ends check that the other runs as the same user (`SO_PEERCRED` on Linux,
+  `LOCAL_PEERCRED` on macOS and the BSDs): a session doesn't take another user's keystrokes, and a terminal doesn't
+  send its own to another user's session. Where the system can't say, neither end goes on, and `trd-pty new` starts
+  no session. No network listener.
+- **Protocol:** framed messages (hello, input, resize, claim, query; output, exit). A malformed or oversized frame drops
+  that client, never the session; a client more than 8 MB behind is dropped.
+- **Output** goes to every terminal byte for byte: colors, titles, OSC sequences and scrollback stay native.
+- **Size:** one terminal at a time is the *controller* and sets the PTY size: the one that attached, typed or got
+  focus last. Clients turn on focus reporting in their own terminal to notice focus; the program only sees focus
+  reports if it asked for them.
+- **Late attach:** the last 256 KB of output is replayed (from a line boundary), then a SIGWINCH makes full-screen
+  programs repaint. Input from the new terminal is ignored for 300 ms, which swallows its automatic answers to
+  replayed queries.
+- **Lifetime:** the shell exiting ends the session. When the last terminal detaches, the shell gets SIGHUP, like a
+  dropped SSH login (`TRD_PTY_LINGER=<seconds>` keeps it for a reattach). `trd-pty ls` lists sessions and removes
+  sockets whose owner is gone.
+- **Fallbacks:** if `trd-pty` can't start a session (no `python3`; or exit code 3: no safe folder for its sockets,
+  one it can't make, or no way to check who is at the other end of a socket), the login falls back to tmux, then to a
+  plain shell. The `remoteDesktop.sessionBackend: tmux` setting uses tmux throughout.
+
+### Alternatives considered
+
+- **dtach / abduco:** multiple attach and raw passthrough, but no size policy or late-attach redraw, and another
+  package to install.
+- **Keeping screen state on the server** (pyte, libvterm, a headless xterm.js): exact late attach, at the cost of a
+  terminal emulator on every host. Replay plus a repaint covers shells and full-screen programs.
+- **Moving the PTY (reptyr):** needs ptrace, which hardened hosts restrict.
+
+## Tests
+
+- `test/unit/trd-pty.py`, run on a Linux host (`npm test -- trd-pty`): creating, attaching and reattaching; output to
+  two views and each keystroke exactly once; the controller following input and focus; Ctrl-C, job control, UTF-8,
+  colors and titles; the alternate screen and repaint on late attach; malformed clients, no network listener, another
+  user refused; shell exit, SIGHUP on last detach, linger, and stale-socket cleanup; another user's session socket
+  neither counted nor attached; neither end going on without peer credentials; the socket folder's checks, and exit
+  code 3 when it is unsafe, can't be made, or no peer can be checked.
+- `test/unit/desk.ts`, `test/unit/desk-service.ts` and `test/unit/remote-scripts.ts` (`npm run test:unit`): requests
+  taken out of the output and their key, the last one with a known key, floods over one chunk or many, one at a time;
+  the terminal's listener with `desk` off; which keys the plugin keeps from which setups, and what a request with no
+  key, another host's, desk off, a machine reached with `ssh` typed in the console or a pane not in front gets; a
+  sign-in form leaving the keyboard in the pane in front; the setup, `bin/desk`, the terminal script and the idle
+  watcher run under `/bin/sh` against a fake host, checking that no command line carries the password or the key, that
+  the login hook is added and removed exactly (through a linked, hard-linked or read-only rc file too, with bytes that
+  aren't text, and when writing fails part way), that two setups at once agree on the key, and which sockets a desktop
+  terminal may attach to.
+- `test/suites/desk.ts` (`npm test -- desk`, with `TRD_TEST_BACKEND=native` or `tmux`): logins inside the session,
+  `desk` to the desktop with the same session attached, typing reaching the shell once, requests without the key
+  ignored, RDP and SSH disconnects keeping the session, and turning `desk` off and on leaving `~/.bashrc` as it was.
+
+Typical timings on a local network: `desk` to the desktop about 0.4 s; the terminal attached after about 1 s, mostly
+GNOME Terminal starting.
+
+## Limitations
+
+- A late attach replays output rather than restoring exact screen state. A program that ignores SIGWINCH shows the
+  replay until it next redraws.
+- Terminals that aren't the controller draw the stream at their own width, so long lines wrap differently there until
+  that terminal takes over.
+- Typing in the first 300 ms after a late attach is dropped.
+- Tabby keeps a closed tab's remote shell while other tabs share its SSH connection, so that terminal stays attached
+  until the connection closes.
+- Needs `python3` on the remote (for `trd-pty`) and GNOME Terminal on the desktop.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tabby-rdp",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Remote desktops in Tabby's SSH tabs: Linux (GNOME) and Windows, through the SSH connection, with clipboard, files and sound. Built on IronRDP.",
   "keywords": [
     "tabby-plugin",
@@ -30,7 +30,9 @@
     "vendor",
     "remote",
     "LICENSE",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "TROUBLESHOOTING.md",
+    "docs/desk.md"
   ],
   "engines": {
     "node": ">=18"
@@ -41,21 +43,28 @@
     "typecheck": "tsc -p tsconfig.json --noEmit && npm run typecheck:test",
     "typecheck:test": "tsc -p tsconfig.test.json",
     "test": "tsx test/run.ts",
+    "test:smoke": "tsx test/run.ts --packed --hidden smoke-host smoke-rdp direct",
     "test:unit": "tsx --test test/unit/*.ts",
     "build:ironrdp": "scripts/build-ironrdp.sh",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "semver": "^7.8.5",
     "ws": "^8.21.1"
   },
   "devDependencies": {
     "@angular/core": "15.2.10",
     "@types/node": "^20.19.0",
+    "@types/semver": "^7.8.0",
     "rxjs": "7.8.2",
     "tabby-core": "1.0.231-nightly.0",
     "tabby-settings": "1.0.231-nightly.0",
     "tabby-terminal": "1.0.231-nightly.0",
     "tsx": "^4.23.15",
     "typescript": "~5.9.3"
+  },
+  "tabbyRdp": {
+    "minimumTabbyVersion": "1.0.236",
+    "rollbackFloor": "0.5.3"
   }
 }

package/vendor/SHA256SUMS

@@ -24,3 +24,4 @@ d67aa6029edb142daa1e5069fa79ab1917687474a89a61bd221081f204ba8e12  ironrdp/patche
 538641d863e52972074b032c111a67cfa02d06290bff0601423f3dfd25ad563b  vendor/iron-remote-desktop-rdp.js
 5a6363b9140a5a2abf0218aa39edb38f10445e8d7e9c5a798c321772e1f07c11  vendor/iron-remote-desktop.js
 31f961cc5fc60f6a3dc580333f871bf9b380950dc849395465844dcc90f871f3  vendor/ironrdp_web_bg.wasm
+82470ad2980db3fe48787cb821e231fc44811b046f7820555f6e25f2b4ccce28  vendor/ironrdp-factory.js