tabby-rdp 0.5.2 → 0.5.3

package/dist/desktop.service.js

@@ -23,6 +23,7 @@ const url_1 = require("url");
 const targets_1 = require("./targets");
 const deskScript_1 = require("./deskScript");
 const audio_1 = require("./audio");
+const ironrdp_1 = require("./ironrdp");
 const clipboard_1 = require("./clipboard");
 const connectionStatus_1 = require("./connectionStatus");
 const microphone_1 = require("./microphone");
@@ -84,6 +85,7 @@ const STYLE = `
 .trd-overlay { position: absolute; inset: 0; z-index: 30; display: flex; background: #111; }
 .trd-host { flex: auto; min-width: 0; min-height: 0; display: flex; }
 .trd-host iron-remote-desktop { flex: auto; }
+.trd-last-frame { max-width: 100%; max-height: 100%; object-fit: contain; align-self: center; margin: auto; }
 .trd-status { position: absolute; inset: 0; display: flex; flex-direction: column; gap: 14px; align-items: center;
     justify-content: center; padding: 2em; text-align: center; color: #bbb; font-size: 13px; white-space: pre-line;
     pointer-events: none; }
@@ -107,6 +109,10 @@ const STYLE = `
 .trd-overlay.trd-mic-on > .trd-toast { right: 40px; max-width: min(420px, calc(100% - 52px)); }
 .trd-floating-mic-on .trd-overlay.trd-broadcast-on::before { top: 40px; }
 `;
+/** A file's name as it is shown: it comes with the file, and what could reorder or hide part of it shows as �. */
+function showableFileName(raw) {
+    return raw.replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
+}
 /**
  * The name a desktop connected to directly goes by, as its certificate is checked against it (see
  * RDCleanPathOptions.serverName): an address as it is, a host name as it resolves (lower case, punycode, without a
@@ -261,11 +267,24 @@ class DesktopSession {
         /** Keys this desktop was sent and not yet let go of (by `code`): see RemoteDesktopService.broadcastKey. */
         this.keysDown = new Map();
         this.reclaimFocus = (event) => {
-            if (this.visible && !this.overlay.contains(event.target)) {
+            if (!this.visible) {
+                return;
+            }
+            if (!this.overlay.contains(event.target)) {
                 this.focusSoon();
+                return;
+            }
+            // The focus came to the desktop while its pane isn't the one the user is in: IronRDP's canvas takes it as the
+            // pointer passes over it (its `mouseenter`), without a click, and with it the keys typed and this computer's
+            // clipboard (its monitor follows the focus). It goes back where it came from. A click hands it over still:
+            // Tabby makes the pane the one in front on the click, and the pane's focus gives the desktop the keyboard. (The
+            // layer's own fields and buttons, a sign-in form's, send nothing anywhere until they are used.)
+            if (event.target?.tagName === 'IRON-REMOTE-DESKTOP' && !this.inFront()) {
+                this.letGo(event.relatedTarget);
             }
         };
         this.disposers = [];
+        this.connectionDisposers = [];
         this.disposed = new Promise(resolve => { this.markDisposed = resolve; });
         this.overlay = document.createElement('div');
         this.overlay.className = 'trd-overlay';
@@ -304,7 +323,9 @@ class DesktopSession {
     }
     /**
      * Lets go of every key still held on this desktop. For when their keyups won't reach it: view only coming on, or
-     * typing into all going off, by a shortcut whose modifiers are down at that moment. They would stay down there.
+     * typing into all going off, by a shortcut whose modifiers are down at that moment, or the user leaving its pane
+     * by one (see RemoteDesktopService.letGoUnlessInFront). They would stay down there. Sent through IronRDP's
+     * component, which takes a key sent this way whether or not it has the focus.
      */
     releaseKeys() {
         for (const [code, init] of [...this.keysDown]) {
@@ -334,6 +355,33 @@ class DesktopSession {
     canvas() {
         return this.host.querySelector('iron-remote-desktop')?.shadowRoot?.querySelector('canvas') ?? null;
     }
+    /** Whether the focus is on the desktop: IronRDP's component, its sign-in form, a question's buttons. */
+    holdsFocus() {
+        return this.overlay.contains(document.activeElement);
+    }
+    /**
+     * Takes the focus from the desktop, if it has it, back to `to` (where it came from) when that is still there to
+     * take it, or else to nothing. On IronRDP's component it is its canvas, in the component's shadow root, that has
+     * it, and has to let go. The keys held on the remote stay held: IronRDP lets go of them as the window loses the
+     * focus or the pointer leaves the canvas, not as the canvas loses the focus. Where the focus goes back to the
+     * desktop in front (the pointer passed over this one), their keyups still come from there, copied when typing
+     * into all; where the user left the pane, they don't, and the keys are let go of (see
+     * RemoteDesktopService.letGoUnlessInFront).
+     */
+    letGo(to) {
+        const active = document.activeElement;
+        if (!active || !this.overlay.contains(active)) {
+            return;
+        }
+        const back = to;
+        if (typeof back?.focus === 'function' && back.isConnected !== false && !this.overlay.contains(back)) {
+            back.focus({ preventScroll: true });
+        }
+        if (this.overlay.contains(document.activeElement)) {
+            ;
+            (active.shadowRoot?.activeElement ?? active).blur();
+        }
+    }
     /**
      * Focuses the remote desktop in a moment, if it is still in the pane the user is in then (see inFront). `visible`
      * stays true in a tab in the background, and a focus that was waiting (a retry, or Tabby's re-focus of the terminal
@@ -386,6 +434,58 @@ class DesktopSession {
     onDispose(f) {
         this.disposers.push(f);
     }
+    onConnectionEnd(f) {
+        this.connectionDisposers.push(f);
+    }
+    /** Release browser resources and references to one backend, including when its WASM has trapped. */
+    endConnection(keepPicture = true) {
+        const clean = (f) => {
+            try {
+                f();
+            }
+            catch (error) {
+                this.log.push(`cleanup: ${error?.message ?? error}`);
+            }
+        };
+        let picture = keepPicture ? this.host.querySelector('.trd-last-frame') : null;
+        // Preserve the dimmed disconnect picture as plain pixels, without the component's backend or listeners.
+        clean(() => {
+            const frame = keepPicture ? this.canvas() : null;
+            if (!frame?.width || !frame.height) {
+                return;
+            }
+            const copy = document.createElement('canvas');
+            copy.width = frame.width;
+            copy.height = frame.height;
+            copy.className = 'trd-last-frame';
+            const rect = frame.getBoundingClientRect();
+            copy.style.width = `${rect.width || frame.width}px`;
+            copy.style.height = `${rect.height || frame.height}px`;
+            const ctx = copy.getContext('2d');
+            if (ctx) {
+                ctx.drawImage(frame, 0, 0);
+                picture = copy;
+            }
+        });
+        this.connectionDisposers.splice(0).forEach(clean);
+        clean(() => this.indicator?.setActive(false));
+        clean(() => this.ui?.shutdown());
+        // Removing the component stops its clipboard loop and removes its global listeners.
+        clean(() => this.host.replaceChildren(...picture ? [picture] : []));
+        this.ui = null;
+        this.stopSending = null;
+        clean(() => this.audio?.close());
+        this.audio = null;
+        clean(() => this.h264?.close());
+        this.h264 = null;
+        clean(() => this.mic?.close());
+        this.mic = null;
+        clean(() => this.files?.dispose());
+        this.files = null;
+        clean(() => this.drives?.dispose());
+        this.drives = null;
+        this.remoteSize = null;
+    }
     /** Focuses the remote desktop. IronRDP reveals its canvas asynchronously, so retry for about half a second. */
     focusDesktop(attempts = 30) {
         // While the sign-in form shows, it is what takes focus back (the user name, or the password once filled).
@@ -417,16 +517,7 @@ class DesktopSession {
         clearTimeout(this.labelTimer);
         this.container.removeEventListener('focusin', this.reclaimFocus, true);
         this.disposers.forEach(f => f());
-        this.indicator?.dispose();
-        try {
-            this.ui?.shutdown();
-        }
-        catch { }
-        this.audio?.close();
-        this.h264?.close();
-        this.mic?.close();
-        this.files?.dispose();
-        this.drives?.dispose();
+        this.endConnection(false);
         this.proxy?.close();
         this.overlay.remove();
     }
@@ -451,7 +542,13 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         /** Emits whenever a pane's desktop is opened, shown, hidden, connected, ended or disconnected. */
         this.changed$ = new rxjs_1.Subject();
         this.sessions = new Map();
-        this.ironrdp = null;
+        this.ironrdp = new ironrdp_1.IronRDPLoader(async () => {
+            const [factory, bytes] = await Promise.all([
+                importESM(vendor('iron-remote-desktop.js')).then(() => importESM(vendor('ironrdp-factory.js'))),
+                fs.promises.readFile(vendorFile('ironrdp_web_bg.wasm')),
+            ]);
+            return { module: await WebAssembly.compile(bytes), createBackend: factory.createBackend };
+        });
         /** Whether the browser decodes H.264 (asked once). */
         this.h264Support = null;
         /** Desktops (session keys) where H.264 decoding failed: they connect without it until Tabby restarts. */
@@ -849,10 +946,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         // Names as text whatever the config holds (see entryText): the accounts list and the question before removing
         // one show them all.
         const desktops = this.configuredDesktops().flatMap((d, i) => (0, desktops_1.isDesktopEntry)(d) && (d.account === id || d.gatewayAccount === id) ? [{ name: (0, desktops_1.entryText)(d).name, desktopIndex: i }] : []);
-        const groups = this.config.store.groups ?? [];
-        const inherited = (p) => p.options?.account === undefined && groups.find(g => g.id === p.group)?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options?.account === id;
         const profiles = (this.config.store.profiles ?? [])
-            .filter((p) => p?.type === targets_1.RDP_PROFILE_TYPE && (p.options?.account === id || p.options?.gatewayAccount === id || inherited(p)))
+            .filter((p) => {
+            if (p?.type !== targets_1.RDP_PROFILE_TYPE) {
+                return false;
+            }
+            const options = this.profiles.getConfigProxyForProfile(p).options;
+            return options?.account === id || options?.gatewayAccount === id;
+        })
             .map((p) => ({ name: (0, desktops_1.configText)(p.name) || (0, desktops_1.configText)(p.options?.host), profileId: (0, desktops_1.configText)(p.id) || undefined }));
         return [...desktops, ...profiles];
     }
@@ -971,9 +1072,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 if (rest.account === id) {
                     delete rest.account;
                 }
-                // A gateway that signed in with it takes the desktop's sign-in from now on.
+                // Keep the gateway's credentials separate after its saved account is removed.
                 if (rest.gatewayAccount === id) {
-                    delete rest.gatewayAccount;
+                    rest.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
                 }
                 return rest;
             });
@@ -984,15 +1085,19 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 profile.options.account = null;
             }
             if (profile?.type === targets_1.RDP_PROFILE_TYPE && profile.options?.gatewayAccount === id) {
-                profile.options.gatewayAccount = null;
+                profile.options.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
             }
         }
-        // A profile group's default for remote desktop profiles, too.
-        for (const group of this.config.store.groups ?? []) {
-            const options = group?.defaults?.[targets_1.RDP_PROFILE_TYPE]?.options;
+        // Group and global defaults keep separate gateway authentication for their inheriting profiles, too.
+        const defaults = [this.config.store.profileDefaults, ...(this.config.store.groups ?? []).map((group) => group?.defaults)];
+        for (const entry of defaults) {
+            const options = entry?.[targets_1.RDP_PROFILE_TYPE]?.options;
             if (options?.account === id) {
                 options.account = '';
             }
+            if (options?.gatewayAccount === id) {
+                options.gatewayAccount = accounts_1.ASK_GATEWAY_ACCOUNT;
+            }
         }
         await this.config.save();
         this.changed$.next();
@@ -1170,6 +1275,10 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             }
         }
     }
+    /** Says that the .rdp file named `rawFileName` is too large to be one (see MAX_RDP_FILE). */
+    refuseLargeRdp(rawFileName, size) {
+        this.notifications.error(`${showableFileName(rawFileName)}: at ${Math.ceil(size / 1024)} KB, far larger than an .rdp file is, so it wasn't imported`);
+    }
     /** "Import an .rdp file…": picks one and adds it as a remote desktop profile (see importRdp). */
     async importRdpFile() {
         const file = await new Promise(resolve => {
@@ -1183,6 +1292,11 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             input.click();
         });
         if (file) {
+            // Not even read when it is far larger than an .rdp file is (see importRdp).
+            if (file.size > rdpFile_1.MAX_RDP_FILE) {
+                this.refuseLargeRdp(file.name, file.size);
+                return;
+            }
             // A reading or parsing failure is shown, not dropped as an unhandled rejection: this is the user's action.
             try {
                 await this.importRdp(new Uint8Array(await file.arrayBuffer()), file.name);
@@ -1216,8 +1330,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
      * and opens it; or opens the profile that already has that address, user and domain. Returns the profile, or null.
      */
     async importRdp(data, rawFileName) {
-        // The file's name comes with the file, and is shown: what could reorder or hide part of it shows as �.
-        const fileName = rawFileName.replace(new RegExp(unshowable_1.UNSHOWABLE.source, 'gu'), '�');
+        const fileName = showableFileName(rawFileName);
+        // Far larger than an .rdp file is: not parsed, on the thread that runs Tabby's window (see MAX_RDP_FILE).
+        if (data.length > rdpFile_1.MAX_RDP_FILE) {
+            this.refuseLargeRdp(rawFileName, data.length);
+            return null;
+        }
         const parsed = (0, rdpFile_1.parseRdpFile)(data);
         if (!parsed) {
             this.notifications.error(`${fileName}: no address ("full address") in it`);
@@ -1542,6 +1660,16 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }
             });
             created.onDispose(() => focused.unsubscribe());
+            // The pane is no longer the one the user is in: another tab, another pane of the split. Tabby only moves a
+            // tab it leaves off screen, and a tab that takes no focus of its own (Settings, the welcome tab) leaves the
+            // focus where it was: on the desktop, which would go on taking the keys typed and this computer's
+            // clipboard. It lets go then, of the keys it holds on the remote too: the user left by a shortcut whose
+            // modifier is still down, and its keyup goes where they went. A moment later: Tabby says so before it says
+            // which tab is the active one.
+            const blurred = pane.blurred$.subscribe(() => {
+                setTimeout(() => this.letGoUnlessInFront(created));
+            });
+            created.onDispose(() => blurred.unsubscribe());
             this.connect(pane, target, spec, created);
         }
         if (options.background) {
@@ -1609,10 +1737,29 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     inFront(pane) {
         return (0, targets_1.desktopPaneOf)(this.app.activeTab) === pane;
     }
-    /** Whether `session` is the desktop of the pane the user is in (see inFront). */
+    /**
+     * Whether `session` is the desktop of the pane the user is in (see inFront), and not behind a pane maximized over
+     * it (see behindMaximized).
+     */
     showsInFront(session) {
         const pane = (0, targets_1.desktopPaneOf)(this.app.activeTab);
-        return !!pane && this.sessions.get(pane) === session;
+        return !!pane && this.sessions.get(pane) === session && !this.behindMaximized(pane);
+    }
+    /**
+     * A desktop whose pane stopped being the one the user is in (see showsInFront): the focus is taken from it, if it
+     * has it, and the keys it holds on the remote are let go of. Their keyups go where the user went, whether the
+     * desktop kept the focus until now (a tab that takes none) or lost it to what they went to (a terminal), and
+     * IronRDP lets go of nothing as its canvas loses the focus (see DesktopSession.letGo). With typing broadcast to
+     * every desktop of the tab, leaving the tab leaves all of its panes, so each of them is let go of here too.
+     */
+    letGoUnlessInFront(session) {
+        if (this.showsInFront(session)) {
+            return;
+        }
+        if (session.holdsFocus()) {
+            session.letGo();
+        }
+        session.releaseKeys();
     }
     /**
      * Gives a desktop that just connected the keyboard, if it shows in the pane the user is in. Not when another pane is
@@ -2175,7 +2322,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             timer = setTimeout(() => this.followPane(pane, session), 300);
         });
         observer.observe(session.overlay);
-        session.onDispose(() => {
+        session.onConnectionEnd(() => {
             clearTimeout(timer);
             observer.disconnect();
         });
@@ -2650,25 +2797,12 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
         return this.sessions.get(pane)?.log ?? [];
     }
     loadIronRDP() {
-        this.ironrdp ??= (async () => {
-            // The WebAssembly ships as its own file (not inlined in the bundle). It is read here and handed to init,
-            // rather than fetched by the bundle from next to itself: fetch() of file:// URLs is up to the Electron
-            // build (a fuse turns it off), and a plain file path needs no URL escaping for spaces or drive letters.
-            const [rdp, wasm] = await Promise.all([
-                importESM(vendor('iron-remote-desktop.js')).then(() => importESM(vendor('iron-remote-desktop-rdp.js'))),
-                fs.promises.readFile(vendorFile('ironrdp_web_bg.wasm')),
-            ]);
-            // Troubleshooting: localStorage.trdLogLevel = 'DEBUG' (or TRACE), then restart Tabby.
-            let level = 'INFO';
-            try {
-                level = localStorage.getItem('trdLogLevel') || level;
-            }
-            catch { }
-            await rdp.init(level, wasm);
-            return rdp;
-        })();
-        this.ironrdp.catch(() => { this.ironrdp = null; });
-        return this.ironrdp;
+        let level = 'INFO';
+        try {
+            level = localStorage.getItem('trdLogLevel') || level;
+        }
+        catch { }
+        return this.ironrdp.create(level);
     }
     /**
      * Where to connect and as whom. The host's own desktop: the setup script (grd, generated credentials), or, where
@@ -2919,35 +3053,35 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     }
     /**
      * The sign-in to a desktop's RD Gateway with the saved account it names: the account's password from the keychain,
-     * or asked for (when none is saved, or `retryError`: the gateway just refused it). Undefined when that account no
-     * longer exists (the desktop's own sign-in is then tried); null when the form was cancelled.
+     * or asked for (when none is saved, or `retryError`: the gateway just refused it). A removed or missing account
+     * always asks for separate credentials; null when the form was cancelled.
      */
     async gatewayAccountFor(spec, session, gateway, retryError) {
         const account = this.accounts().find(a => a.id === spec.gatewayAccount);
         if (!account) {
-            session.log.push('gateway: its saved account no longer exists; signing in with the desktop\'s');
-            return undefined;
+            session.log.push('gateway: asking for a separate account');
         }
-        const signIn = { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account), accountRevision: this.accountRevisions.capture(account) };
-        const saved = retryError ? null : await (0, signin_1.loadCredentials)(signIn.saveKey);
-        if (saved && saved.username === (0, accounts_1.signInName)(account)) {
+        const signIn = account ? { domain: account.domain, saveKey: (0, accounts_1.accountKey)(account.id), saveLabel: `saved account ${account.name}`, saveFor: (0, accounts_1.signInName)(account), accountRevision: this.accountRevisions.capture(account) } : undefined;
+        const saved = !retryError && signIn ? await (0, signin_1.loadCredentials)(signIn.saveKey) : null;
+        if (saved && account && saved.username === (0, accounts_1.signInName)(account)) {
             session.log.push(`gateway: the saved account "${account.name}"`);
             return { ...signIn, credentials: { username: (0, accounts_1.signInName)(account), password: saved.password }, remember: false };
         }
         session.status('');
         const asked = (0, signin_1.askCredentials)(session.overlay, {
             title: `Sign in to the gateway ${gateway.host}, to reach ${spec.name}`,
-            username: (0, accounts_1.signInName)(account),
-            error: [retryError, signIn.accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
-            canRemember: signIn.accountRevision !== undefined,
-            account: account.name,
+            username: account ? (0, accounts_1.signInName)(account) : '',
+            error: [retryError, !account && spec.gatewayAccount !== accounts_1.ASK_GATEWAY_ACCOUNT ? 'The saved gateway account no longer exists. Enter a separate account for the gateway.' : '',
+                account && signIn?.accountRevision === undefined ? accountRevisions_1.ACCOUNT_REMEMBER_UNAVAILABLE : ''].filter(Boolean).join(' '),
+            canRemember: !!signIn && signIn.accountRevision !== undefined,
+            account: account?.name,
         }, session.disposed);
         // Only in the pane in front (see endpointFor).
         if (session.visible && this.showsInFront(session)) {
             setTimeout(() => session.visible && this.showsInFront(session) && session.focusDesktop());
         }
         const entered = await asked;
-        return entered && { ...signIn, credentials: entered, remember: entered.remember };
+        return entered && { ...signIn, credentials: entered, remember: !!signIn && entered.remember };
     }
     /**
      * The proxy's stream to a desktop behind an RD Gateway (see gateway.ts): to the gateway as the SSH host (or this
@@ -2956,14 +3090,18 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     async throughGateway(target, spec, session, gateway, endpoint, signal) {
         session.gatewayRefused = null;
         const own = endpoint.gatewayAccount;
+        if (spec.gatewayAccount && !own) {
+            throw new Error('A separate gateway sign-in is required before connecting.');
+        }
         const credentials = own?.credentials ?? endpoint.credentials;
-        session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its saved account' : 'the desktop\'s sign-in'}`);
+        session.log.push(`gateway: ${gateway.host}:${gateway.port}, signing in with ${own ? 'its separate account' : 'the desktop\'s sign-in'}`);
         try {
             const stream = await (0, gateway_1.openThroughGateway)(() => target.openTcp(gateway.host, gateway.port), gateway, { username: credentials.username, password: credentials.password, domain: (own ? own.domain : endpoint.domain ?? spec.domain) || undefined }, { host: endpoint.host, port: endpoint.port }, (fingerprint, valid, reason, details) => this.checkGatewayCertificate(session, gateway, fingerprint, valid, reason, details), { log: m => session.log.push(m), clientName: os.hostname(), signal });
             // Entered a moment ago and taken by the gateway: kept, while the account is still what it was signed in as.
-            if (own?.remember) {
+            if (own?.remember && own.saveKey) {
                 own.remember = false;
-                (0, signin_1.saveCredentialsIf)(own.saveKey, own.credentials, () => this.accountCurrent(own.saveKey, own.saveFor, own.accountRevision), own.saveLabel).then(saved => session.log.push(saved ? `gateway: saved as the account's password in ${(0, signin_1.storeName)()}` : 'gateway: not saved: the account changed meanwhile'), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
+                const saveKey = own.saveKey;
+                (0, signin_1.saveCredentialsIf)(saveKey, own.credentials, () => this.accountCurrent(saveKey, own.saveFor, own.accountRevision), own.saveLabel).then(saved => session.log.push(saved ? `gateway: saved as the account's password in ${(0, signin_1.storeName)()}` : 'gateway: not saved: the account changed meanwhile'), e => session.log.push(`gateway: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             return stream;
         }
@@ -3421,8 +3559,40 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
     }
     /** One RDP connection attempt, until it ends. */
     async run(pane, target, spec, session, rdp, endpoint) {
+        const attempt = new AbortController();
+        let connectedAt;
+        let unwatch;
+        const trapped = new Promise(resolve => {
+            unwatch = rdp.runtime?.onTrap((error) => {
+                session.log.push(`wasm: this desktop's instance trapped: ${error.message}`);
+                // Drop the socket even if Rust's run() promise can no longer settle after a trap.
+                session.proxy?.close();
+                session.proxy = null;
+                resolve({ connected: session.state === 'connected', error: `WebAssembly instance failed: ${error.message}` });
+            });
+        });
+        try {
+            return await Promise.race([
+                this.runConnection(pane, target, spec, session, rdp, endpoint, attempt.signal, at => { connectedAt = at; }),
+                trapped,
+                session.disposed.then(() => ({ connected: false })),
+            ]);
+        }
+        finally {
+            attempt.abort();
+            unwatch?.();
+            // Rust's run() can stay pending after an asynchronous trap. Account for the completed attempt here,
+            // exactly once, and never update retry state belonging to a replacement session in this pane.
+            if (connectedAt !== undefined && this.sessions.get(pane) === session) {
+                this.reconnectedUntilNow(pane, connectedAt);
+            }
+            session.endConnection?.();
+            rdp.runtime?.dispose?.();
+        }
+    }
+    async runConnection(pane, target, spec, session, rdp, endpoint, signal, onConnected) {
         const credentials = endpoint.credentials;
-        const alive = () => this.sessions.get(pane) === session;
+        const alive = () => !signal.aborted && this.sessions.get(pane) === session;
         session.certificateProblem = null;
         session.gatewayRefused = null;
         session.withoutNla = false;
@@ -3436,7 +3606,9 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             session.host.replaceChildren(el);
             // The element only gets ready in the page: one whose desktop was closed meanwhile (the layer gone) never does.
             // Closed as it got ready, it isn't given the clipboard, files and the rest that closing it has ended already.
-            session.ui = await Promise.race([ready, session.disposed.then(() => null)]);
+            session.ui = await Promise.race([ready, session.disposed.then(() => null), new Promise(resolve => {
+                    signal.addEventListener('abort', () => resolve(null), { once: true });
+                })]);
             if (!session.ui || !alive()) {
                 return { connected: false };
             }
@@ -3576,6 +3748,8 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
             if (!alive()) {
                 return { connected: false };
             }
+            const connectedAt = Date.now();
+            onConnected(connectedAt);
             session.ui.setVisibility(true);
             this.applyKeyboardMode(session);
             session.remoteSize = { width, height, scale: 100 };
@@ -3617,12 +3791,14 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }, e => session.log.push(`sign-in: ${(0, signin_1.storeName)()}: ${e?.message ?? e}`));
             }
             this.focusIfInFront(pane, session);
-            const connectedAt = Date.now();
             let end;
             try {
                 end = await info.run();
             }
             catch (e) {
+                if (!alive()) {
+                    return { connected: false };
+                }
                 if (session.h264?.failed) {
                     // Reconnects (automatically, like any dropped connection) without H.264, unless the browser only
                     // took an idle decoder back (a hidden window): then with it, as a new stream starts with a key frame.
@@ -3643,15 +3819,7 @@ let RemoteDesktopService = RemoteDesktopService_1 = class RemoteDesktopService {
                 }
                 return { connected: true, error };
             }
-            finally {
-                // The server can't close the microphone, or its files, once the connection is gone.
-                session.mic?.close();
-                session.drives?.dispose();
-                if (alive()) {
-                    this.reconnectedUntilNow(pane, connectedAt);
-                }
-            }
-            return { connected: true, reason: end?.reason?.() };
+            return alive() ? { connected: true, reason: end?.reason?.() } : { connected: false };
         }
         catch (e) {
             return { connected: false, error: e?.message ?? String(e) };

package/dist/desktopForm.js

@@ -110,13 +110,13 @@ function askDesktop(pane, options) {
         account.hidden = account.options.length < 2;
     }
     ownAccount();
-    // The gateway's own account: offered once there is a gateway and a saved account to choose.
+    // The gateway's own account, including a separate prompt when no saved account is chosen.
     const gateway = field('gateway');
     const gatewayAccount = field('gatewayAccount');
     gateway.value = (0, desktops_1.configText)(initial.gateway);
-    gatewayAccount.append(new Option('Gateway account: the same as the desktop\'s', ''), ...accounts.map(a => new Option(`Gateway account: ${a.name} (${(0, accounts_1.signInName)(a)})`, a.id)));
+    gatewayAccount.append(new Option('Gateway account: the same as the desktop\'s', ''), new Option('Gateway account: ask when connecting', accounts_1.ASK_GATEWAY_ACCOUNT), ...accounts.map(a => new Option(`Gateway account: ${a.name} (${(0, accounts_1.signInName)(a)})`, a.id)));
     const initialGatewayAccount = (0, desktops_1.configText)(initial.gatewayAccount);
-    if (initialGatewayAccount && !accounts.some(a => a.id === initialGatewayAccount)) {
+    if (initialGatewayAccount && initialGatewayAccount !== accounts_1.ASK_GATEWAY_ACCOUNT && !accounts.some(a => a.id === initialGatewayAccount)) {
         gatewayAccount.append(new Option('(a saved account that no longer exists)', initialGatewayAccount));
     }
     gatewayAccount.value = initialGatewayAccount;

package/dist/ironrdp.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IronRDPLoader = void 0;
+/** Loads and compiles once; every connection attempt gets fresh glue, classes, memory and allocator. */
+class IronRDPLoader {
+    constructor(load) {
+        this.load = load;
+        this.source = null;
+    }
+    async create(level) {
+        const pending = this.source ??= this.load();
+        let source;
+        try {
+            source = await pending;
+        }
+        catch (error) {
+            if (this.source === pending) {
+                this.source = null;
+            }
+            throw error;
+        }
+        // A failed/trapped instance does not invalidate shared compiled code or another desktop's instance.
+        return source.createBackend(source.module, level);
+    }
+}
+exports.IronRDPLoader = IronRDPLoader;

package/dist/keyboard.js

@@ -117,7 +117,18 @@ let DesktopKeyboard = class DesktopKeyboard {
     route(event) {
         const pane = this.startedOn.has(event) ? this.startedOn.get(event) : this.coveredPane();
         const focused = document.activeElement;
-        if (!pane || focused?.tagName !== 'IRON-REMOTE-DESKTOP' || !pane.element.nativeElement.contains(focused)) {
+        if (focused?.tagName !== 'IRON-REMOTE-DESKTOP') {
+            return;
+        }
+        if (!pane || !pane.element.nativeElement.contains(focused)) {
+            // A desktop has the focus though its pane isn't the one the user is in (see
+            // RemoteDesktopService.letGoUnlessInFront, which takes it back a moment after the pane is left): IronRDP,
+            // whose listener comes after this one and only looks at the focus, would send it the key, view only or not.
+            // It goes nowhere instead, a keyup too: IronRDP lets go of nothing as its canvas loses the focus (only as
+            // the window does, or as the pointer leaves the canvas), so the keys the desktop still holds on the remote
+            // are let go of as the focus is taken back, this one among them.
+            event.stopImmediatePropagation();
+            event.preventDefault();
             return;
         }
         this.routing = pane;

package/dist/rdcleanpath.js

@@ -527,6 +527,8 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
     }
     const raw = await openUpstream(destination, signal);
     track(raw);
+    // What this handshake opened, in order, for destroyAll if it fails.
+    const opened = [raw];
     try {
         if (gone()) {
             throw new Error('the client left');
@@ -556,6 +558,7 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
             ...name ? { host: name, ca: (0, authorities_1.certificateAuthorities)(), ...(0, net_1.isIP)(name) ? {} : { servername: name } } : {},
             ...legacyTls ? KEY_ENCIPHERMENT_ONLY_TLS : {}, ...options.tls,
         });
+        opened.push(upstream);
         track(upstream);
         // An error after the one the handshake below waits for (the stream under it failing as the socket is destroyed,
         // which a TLS socket over a stream passes on as its own) would have no listener until the relay is up, and an
@@ -571,10 +574,22 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
         return { raw, upstream, x224 };
     }
     catch (e) {
-        raw.destroy();
+        destroyAll(opened);
         throw e;
     }
 }
+/**
+ * Destroys streams opened one over the other (the stream to the server, then TLS over it), the last opened first. TLS
+ * over a socket works inside the socket's own handle (Node's TLSWrap), and a socket destroyed under TLS still using it
+ * frees what TLS then reads: right after the handshake, where a certificate refused at once ends the connection, that
+ * crashed Tabby's window (a segmentation fault, in Node as in Electron). TLS destroyed first is done with the socket
+ * before the socket goes. (Over a stream of JavaScript, an SSH channel or a gateway's tunnel, the order did no harm.)
+ */
+function destroyAll(streams) {
+    for (const stream of [...streams].reverse()) {
+        stream.destroy();
+    }
+}
 /** Whether `given` is the secret, compared in a time that doesn't tell how much of it was right. */
 function sameSecret(given, secret) {
     const bytes = Buffer.from(given);
@@ -666,9 +681,7 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
             closed = true;
             leaving.abort();
             clearTimeout(deadline);
-            for (const stream of streams) {
-                stream.destroy();
-            }
+            destroyAll(streams);
             // What was handed to this connection went with it: the next starts with all the room.
             if (flowClient === ws) {
                 flowClient = null;