remotedesktop 1.3.0__tar.gz → 1.4.0__tar.gz

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/CLAUDE.md

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 A Python remote desktop GUI application (PySide6) for Windows computers on the same LAN, per `readme.md`:
 
-- **One app, both roles**: every instance can view other computers, and opts in to *sharing* its own screen via a three-state Screen sharing choice in Preferences — Not shared / view only / full control (persisted; a viewing-only instance binds no ports and creates no TLS credentials). Only one instance runs per user session — a second launch activates the first (`single_instance.py`).
+- **One app, either or both roles**: every instance can view other computers, and opts in to *sharing* its own screen via a three-state Screen sharing choice in Preferences — Not shared / view only / full control (persisted; a viewing-only instance binds no ports and creates no TLS credentials). The **viewer role is opt-out** too: Preferences' "Client (viewer)" checkbox (`viewer_enabled`, default on, `load_viewer_enabled`) — when off, `MainWindow._set_viewer_enabled` closes open sessions and hides all client UI (Server placeholder tab, discovery panel, "Server history" group), disables F5, skips session restore, and refuses activations; discovery never broadcasts. Two **role indicator buttons** at the top of the left dock (no title text — the View menu names it "Servers on LAN panel") (`client_role_button`/`server_role_button` — checkable QPushButtons styled green when on, made purely informational via `WA_TransparentForMouseEvents`; roles change only in Preferences) say what the instance is, updated on viewer toggle and `sharingChanged`. The dock always exists (a server-only instance shows just the indicators) and is **closable but not floatable/movable** (`setFeatures(DockWidgetClosable)`). Only one instance runs per user session — a second launch activates the first (`single_instance.py`).
 - **Autodiscovery and connection** of sharing computers on the LAN.
 - **In scope:** desktop screen, keyboard, mouse, and clipboard.
 - **Out of scope:** shared drives, devices, and multimedia (e.g., audio). Smooth playback of fast-changing full-screen content (video, games) is a non-goal: the screen transfer is lossless and optimized for mostly-static desktop work, not for video bandwidth.
@@ -48,28 +48,28 @@ Managed with `uv` (hatchling build backend, src layout):
 ## Architecture
 
 - One PySide6 GUI app: `src/remotedesktop/app.py` (`MainWindow` + `main()`, wired to the `remotedesktop` GUI script in `pyproject.toml`; `__main__.py` makes `python -m remotedesktop` work — the in-app Restart relaunches that). `client.py` holds the viewing-role widgets (`DiscoveryPanel`, `ServerSession`), `server.py` the sharing-role widgets (`SharingTab`, `ViewersTable`) — neither has a window or entry point of its own anymore.
-- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, a 2×2 QGridLayout of QGroupBox sections: "Sharing this computer" (the `SharingTab`: summary + viewers table), "Servers on LAN" (client-role inventory, Forget), "Clients on LAN" (server-role inventory, Revoke), and "Connection log" (the log pane + both get-log buttons). **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the two legacy keys `server_enabled` + `allow_remote_input` so old installs migrate for free. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
+- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, a 2×2 QGridLayout of QGroupBox sections: "Server (sharing this computer)" (the `SharingTab`: summary + viewers table), "Server history" (client-role inventory, Forget), "Client history" (server-role inventory, Revoke), and "Connection log" (the log pane + both get-log buttons). **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the two legacy keys `server_enabled` + `allow_remote_input` so old installs migrate for free. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
 - **Tray + lifecycle** (`app.py`): while sharing, closing the window hides to a `QSystemTrayIcon` (menu: Show / Restart / Quit) and sharing continues; not sharing → close quits. `main()` sets `setQuitOnLastWindowClosed(False)`, so **every exit path must reach `QApplication.quit()`** (plain close, tray Quit, restart). `tray_available=` is injectable — tests always pass an explicit value and never call `isSystemTrayAvailable()`. `--minimized` (used by the autostart registration) starts hidden in the tray when sharing is on. `single_instance.py` (`SingleInstance`, QLocalServer-based) enforces one instance per user session; a second launch tells the first to `bring_to_front()` and exits. `autostart.py` registers `remotedesktop.exe --minimized` under HKCU Run value `"remotedesktop"` and migrates the pre-1.0 `"remotedesktop-server"` value at startup (`migrate_legacy`).
 - The remote desktop view is a widget, `ViewerWidget` in `src/remotedesktop/viewer.py`. Screen display and keyboard/mouse/clipboard forwarding belong in this widget, not in the window. **Multiple simultaneous server connections**: each is a `ServerSession` in `client.py` (its own `ShareClient` + `ViewerWidget`, hosted in a `QScrollArea` tab page — `session.page` is the tab widget, `session.viewer` the viewer), shown as a closable tab at the front of `MainWindow`'s central `QTabWidget`, titled with the server's reported hostname (fixed tabs get their close buttons stripped). Fit mode is `widgetResizable(True)`; **View → Actual size** flips the page to non-resizable and the viewer sizes itself to `frame / devicePixelRatio` (1:1 device pixels, the no-resample paint branch; input mapping unchanged because the frame fills the widget). Sessions are keyed by `host:port`; activating an already-known server reconnects in its existing tab, activating a connected one just focuses it. The window title lists the connected server names and a "— sharing" suffix while serving (`_update_window_title`); the status bar's message area follows the currently selected session tab (`status_text` per session) and a permanent right-side label shows "Sharing — N viewer(s)" whenever sharing is on (driven by `SharingTab.viewerCountChanged`). The `ClipboardSync`, inventories, and Connection log are shared across sessions; `client_performance.reset()` is only called when no *other* session is connected (resetting detaches every stream). Per-session status log lines are prefixed `[name]`.
 - **Auto-reconnect** (`app.py`): a session that *was connected* and drops retries `client.connect_to` with exponential backoff (base `reconnect_base_seconds=2.0` kwarg — tests inject ~0.05 — doubling to a 30 s cap), driven by a per-session single-shot QTimer. `ShareClient.connectionFailed` exists because **Qt emits `disconnected` only for sockets that reached ConnectedState** — refused/unreachable attempts fire `errorOccurred` with the socket back in UnconnectedState. The active-timer guard dedupes the errorOccurred+disconnected double-fire. Denial cancels until a manual activation; tab close/forget/quit cancel; retries bypass `_connect_session` on purpose (no perf reset, no tab steal, no inventory attempt spam). **Open session tabs persist** (`open_sessions` JSON in Settings, written on connect/rename/close) and are restored + reconnected at startup with `auto_reconnect` pre-armed, so a not-yet-available server is retried on the backoff loop; deliberately closed tabs are not restored. While no session exists, a non-closable "Server" placeholder tab (instructions) sits at index 0 and swaps with the first session's tab.
 - **Menus & shortcuts contract** (`app.py` `_build_menus`, `viewer.py`): File/View/Help menu bar; shortcuts Ctrl+W (close session tab), Ctrl+Q (quit), F5 (rescan), F11 (fullscreen). While a viewer shows a frame it **accepts `ShortcutOverride`** so every key forwards to the remote machine — **F11 is the single reserved local key**. Shortcut actions are also `addAction`-ed on the window so they fire with the menu bar hidden (fullscreen). Keep every menu/action as an attribute — PySide6 gives Python ownership of `addMenu`/`addAction` (and `QAction.menu()`) wrappers, and a GC'd local deletes the C++ object. Fullscreen hides menu/status bars, dock, and tab bar and restores them (including pre-fullscreen dock visibility) on exit; `closeEvent` exits fullscreen before persisting layout. Window geometry AND dock layout persist (`window_state.save_state`/`restore_state`, key `main_window_state`; the dock needs its objectName).
 - **Privacy toggles**: Preferences' "Sync clipboard" checkbox (`clipboard_sync_enabled`, default on) drives `ClipboardSync.enabled` — while off, local copies aren't sent and peer payloads aren't applied. View-only sharing is the "view" mode of the Screen sharing radios (`ShareServer.set_input_allowed` — a server-side drop, no wire change, that releases held input when switched off). Quitting with ≥1 viewer connected asks for confirmation (declining resets `_quitting`); restart shuts sharing down first so it never double-prompts.
-- **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Viewing"/"Sharing" sub-tabs (`MainWindow.performance_pages`); `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
-- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
+- **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Client (viewer)"/"Server (sharing)" sub-tabs (`MainWindow.performance_pages`) — but only for roles that can produce data: the client sub-tab exists only with the viewer role, the server one only while actually serving (`_update_performance_tabs`, driven from the viewer toggle and `sharingChanged`; both off shows an enable-a-role hint). `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
+- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. **Scan robustness**: probes are re-sent every `_PROBE_INTERVAL` (0.3 s) for the whole scan window (a lost broadcast only delays discovery), ICMP port-unreachable resets never abort the scan (Windows `SIO_UDP_CONNRESET` ioctl + `ConnectionResetError` → continue), and the panel passes `client._broadcast_hosts()` — 255.255.255.255 plus every up non-loopback interface's directed broadcast, because Windows routes the limited broadcast out only one interface (VPN/virtual adapters made scans come up empty). A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
 - Discovery tests run over loopback with ephemeral ports (`bind_host`/`discovery_port`/`broadcast_hosts` parameters exist for this), so they never touch the real LAN or fixed ports.
 - **Screen sharing** (`sharing.py` + `protocol.py` + `frames.py`) runs entirely on the Qt event loop — no threads or locks. `MessageStream` frames messages over a QTcpSocket (4-byte length + kind byte; JSON control messages, full frames, or inter-frame deltas; malformed input aborts the socket). `ShareServer` owns one QTimer that grabs the primary screen at full resolution via `_capture()` (a seam tests override to drive deterministic frame content) and fans out to all clients, skipping clients whose send buffer is backlogged; the timer only runs while clients are connected. Capture is DXGI desktop duplication (`dxgi.py`, hand-rolled ctypes COM — ~10 ms per changed 4K frame, ~0 when idle, and "unchanged" is signalled by returning the same QImage object so the diff is skipped) with automatic fallback to `QScreen.grabWindow` (~96 ms) whenever duplication is unavailable or lost (secure desktop, RDP, display-mode change, CI); unit tests fake the duplication (`FakeDuplication` in `tests/test_dxgi.py`) and the real-hardware test skips where DXGI is unavailable. **Frame transfer is lossless and inter-frame compressed** (`frames.py`): consecutive captures are diffed in 64-row bands (memoryview compares), and only changed bands ship as PNG in a delta payload the client patches onto its previous frame; an unchanged screen sends nothing. Full PNG keyframes go to clients that just joined, just recovered from a send backlog, or requested one (a `{"type": "keyframe"}` message — sent when a delta fails to apply, so desync self-heals). The capability is negotiated via `"delta": true` in the client hello; clients without it (0.5.0) get full JPEG frames every tick because they force-decode frames as JPEG — never send them PNG. Each variant (legacy JPEG / keyframe PNG / delta) is encoded at most once per tick and shared across clients. `ShareClient` decodes/patches to QImage for the viewer, which displays it scaled with a cached `SmoothTransformation` copy (full resolution is always delivered; scaling happens client-side only).
 - **All persistence is one SQLite database** (`db.py`): `db.connect(path)` opens the DB and ensures every table (`settings`, `paired_clients`, `known_servers`, and the inventory tables). The file lives at `config.default_db_path()` — `platformdirs.user_data_dir("remotedesktop")` (`%LOCALAPPDATA%\remotedesktop\remotedesktop.db` on Windows). **Use `platformdirs` for any new data location; don't hardcode `%APPDATA%`.** Every store (`Settings`, `PairedClients`, `KnownServers`, `ConnectionInventory`) takes a `sqlite3.Connection`; the app opens one connection and shares it. `MainWindow` takes a `connection=` keyword so tests inject a temp-file DB and never touch the real one (see `tests/test_main_window.py` / `test_sharing_tab.py`). Tests pass `db.connect(tmp_path/"x.db")` (or omit for in-memory), and use **separate DB files per simulated machine**.
 - **Trust model plumbing** (`config.py`): the client has a stable UUID identity (`load_client_identity`, in the `settings` table) and the server maps each approved client-id to a token (`PairedClients`). `ShareServer` takes an `approve_client(client_id, name) -> bool` callback; `SharingTab` implements it as a modal stay-on-top QMessageBox. Tests inject stores backed by a temp DB and explicit identities so they never touch real data or prompt.
 - **Status/debug logging is a feature**: `ShareServer`, `ShareClient`, `SharingTab`, and `DiscoveryPanel` emit human-readable `status`/`statusMessage` signals for every connection phase, shown in the window's timestamped "Connection log" pane. When adding connection behavior, emit a status message for each new phase or failure path — there's a test asserting the server's phase messages. Everything the pane shows is also written to a rotating debug log file (`logs.py`; `logs.init_logging("remotedesktop")` is called only by `app.main()`, under `platformdirs.user_log_dir("remotedesktop")` — `%LOCALAPPDATA%\remotedesktop\Logs\remotedesktop.log` on Windows; pre-1.0 `client.log`/`server.log` files just age out). Lower-level detail (socket state changes, protocol aborts, frame-drop/backlog, discovery datagram drops) goes straight to `logging.getLogger("remotedesktop.*")` at debug/warning level — silent failure paths should log there even when a status message would be too noisy. Library code and tests never call `init_logging`; without a handler those loggers are no-ops.
-- **Connection inventory** (`inventory.py`): the Connections tab has two grouped tables ("Clients on LAN" for the sharing role, "Servers on LAN" for the viewing role), each backed by its own `ConnectionInventory` — one `PeerRecord` per peer with attempts count, current state, first/last seen. The sharing side is driven by `ShareServer.peerEvent` (a structured `{key, event, name, address, detail}` signal emitted alongside the status strings at each phase — keep both in sync when adding phases), forwarded through `SharingTab.peerEvent`. The viewing side is driven by `MainWindow`'s own handlers (discovered servers from `DiscoveryPanel.serversFound`, plus attempt/connected/denied/disconnected). Server peers key by client-id; client peers key by `host:port`. **Persisted in SQLite** and reloaded on startup, so it survives restarts.
-- **Revoking access**: `InventoryTab` takes an optional `(action_label, action_callback)`; each row gets its own button labeled `action_label` (in the trailing stretch column) whose callback receives that row's peer key. "Clients on LAN" wires "Revoke" → `SharingTab.revoke_client(client_id)` (via `ShareServer.revoke_client` while sharing — removes the token via `PairedClients.revoke`, disconnects any live stream with a `denied: access revoked`, and `_drop` emits a "revoked" peer event; a `_revoked` set distinguishes it from a plain disconnect — or directly via `PairedClients.revoke` while not sharing). "Servers on LAN" wires "Forget" → `KnownServers.forget(key)` + disconnect + `ConnectionInventory.remove(key)`. **Both delete the peer's row from the table and the DB outright** (`MainWindow._record_server_peer` turns a "revoked" event into a `remove`); a rescan or new connection attempt records the peer afresh. After either, the next connection needs a fresh approval. The roles use *separate tables* (`server_peers` / `client_peers`, selected via the `table=` arg) so they don't commingle; `peers` is the default table used by tests. `ConnectionInventory` never lets a DB error break connectivity (load/save are wrapped).
+- **Connection inventory** (`inventory.py`): the Connections tab has two grouped tables ("Client history" for the sharing role, "Server history" for the viewing role), each backed by its own `ConnectionInventory` — one `PeerRecord` per peer with attempts count, current state, first/last seen. The sharing side is driven by `ShareServer.peerEvent` (a structured `{key, event, name, address, detail}` signal emitted alongside the status strings at each phase — keep both in sync when adding phases), forwarded through `SharingTab.peerEvent`. The viewing side is driven by `MainWindow`'s own handlers (discovered servers from `DiscoveryPanel.serversFound`, plus attempt/connected/denied/disconnected). Server peers key by client-id; client peers key by `host:port`. **Persisted in SQLite** and reloaded on startup, so it survives restarts.
+- **Revoking access**: `InventoryTab` takes an optional `(action_label, action_callback)`; each row gets its own button labeled `action_label` (in the trailing stretch column) whose callback receives that row's peer key. "Client history" wires "Revoke" → `SharingTab.revoke_client(client_id)` (via `ShareServer.revoke_client` while sharing — removes the token via `PairedClients.revoke`, disconnects any live stream with a `denied: access revoked`, and `_drop` emits a "revoked" peer event; a `_revoked` set distinguishes it from a plain disconnect — or directly via `PairedClients.revoke` while not sharing). "Server history" wires "Forget" → `KnownServers.forget(key)` + disconnect + `ConnectionInventory.remove(key)`. **Both delete the peer's row from the table and the DB outright** (`MainWindow._record_server_peer` turns a "revoked" event into a `remove`); a rescan or new connection attempt records the peer afresh. After either, the next connection needs a fresh approval. The roles use *separate tables* (`server_peers` / `client_peers`, selected via the `table=` arg) so they don't commingle; `peers` is the default table used by tests. `ConnectionInventory` never lets a DB error break connectivity (load/save are wrapped).
 - Sharing tests drive real sockets on the GUI thread by pumping `qapp.processEvents()` until a condition holds (see `pump()` in `tests/test_sharing.py`). Use the `make_server`/`make_client` helpers there and the session-scoped `credentials` fixture (one generated cert reused across tests — generating per test is ~100ms each). Tests exercise the real pairing flow (auto-approve), so there is no "pre-approve" shortcut anymore.
 - **Input forwarding**: `ViewerWidget` captures mouse/keyboard events and emits `inputEvent` dicts with coordinates normalized 0..1 over the *displayed* frame rect (letterboxing is reversed via `_display_rect()`; events outside the frame are dropped). Keys carry the client's `nativeVirtualKey()` — since both ends are Windows, the server injects that VK directly with no key-translation table. The client sends these as `{"type": "input", ...}`; `ShareServer` only injects input from streams that completed the hello/approval handshake.
 - **Modal-loop pump** (`modal_loop.py`): a Windows title-bar drag (or click-and-hold) puts the window's thread into a native modal move/size loop where Qt's dispatcher stops — for a sharing instance this deadlocked when a *remote* click grabbed the window's own title bar (the mouse-up sat unread on the socket). `MainWindow.nativeEvent` feeds `ModalLoopPump`, which runs a native `SetTimer` from `WM_NCLBUTTONDOWN` (a press-and-hold that never moves blocks in DefWindowProc's click tracking without ever sending `WM_ENTERSIZEMOVE`) until `WM_CAPTURECHANGED`/`WM_EXITSIZEMOVE`, whose callback pumps Qt events (user input excluded). The caption buttons (min/max/close) are the exception — their tracking loop dispatches only mouse messages, so no timer can pump inside it; the pump instead performs those via its `caption_action` callback on press and consumes the message (nativeEvent must return True when `handle_native_event` does), so DefWindowProc's button tracking never starts. Tests inject a fake `timers` backend — never let them create real Win32 timers.
 - **Log exchange**: either side can fetch the peer's debug log over the connection (`{"type": "log_request"}` → `{"type": "log", "text": ...}`, admitted streams only). `ShareServer`/`ShareClient` take a `log_provider=` callable (the app passes `logs.read_log_tail("remotedesktop")`, capped at `logs.TAIL_BYTES`); a missing provider/file answers with a placeholder rather than hanging the requester. The Connection log group on the Connections tab has both buttons — "Get server log" asks the server of the current session tab, "Get client log" asks the most recently admitted viewer; the reply opens a `logs.PeerLogDialog`.
 - **Injection is isolated behind `InputInjector`** (`input_injection.py`, Windows `SendInput` via ctypes; inert stub off-Windows). ShareServer takes an `injector=` param so tests pass a recording fake — **never let tests construct a real `InputInjector`, or they will move the host's actual mouse/keyboard.** Normalized 0..1 coords map directly to SendInput's 0..65535 absolute range over the primary monitor.
 - **Transport is TLS + a token handshake** (`tls.py`, `sharing.py`, `config.py`). The Qt SSL backend here is Windows **schannel** (no OpenSSL); it does complete server-side TLS with a `cryptography`-generated self-signed cert loaded from PEM (verified), but be wary of schannel-specific quirks if you change the config. The server persists a self-signed cert/key under the config dir (`tls.load_or_create_credentials`; `ShareServer(credentials=...)`, or ephemeral if omitted). The client connects with `connectToHostEncrypted`, ignores the expected self-signed cert errors (`PeerVerifyMode.VerifyNone`), and pins the cert fingerprint **softly** — a change is logged but does *not* block the connection (robustness over strict security, per the trusted-LAN intent). Authentication: on first connect the server user approves and the server issues a random token (`PairedClients.pair`, stored server-side by client-id; client stores it in `KnownServers` keyed by `host:port` with the fingerprint). On reconnect the client sends the token in its hello and is admitted with no prompt; a missing/invalid token just falls back to re-approval (never hard-fails). **Do not reintroduce hard cert-pinning or challenge-response** — the user explicitly wanted robust connections over maximum security.
-- **Performance monitoring** (`performance.py` + `preferences.py`): `PerformanceMonitor` is an opt-in collaborator (`performance=` on `ShareServer`/`ShareClient`, the `clipboard=` pattern — plain sharing tests leave it off). While admitted streams are attached, a 1 s QTimer samples `MessageStream.bytes_sent/bytes_received` counters into rolling `MetricSeries` (bandwidth, aggregated across streams via per-stream baselines) and pings **every** attached stream (each ping id maps to its stream; a pong is honored only on the stream it was sent to). The graphs' RTT series follow only the *active* (most recently admitted) stream; per-stream send/recv/RTT snapshots come from `metrics_for(stream)` and feed the Server tab's `ViewersTable` (`server.py`; it takes the monitor and follows the current ShareServer via `set_share_server`, empty when None), which joins them with `ShareServer.viewers()` — identity fields (`user`/`host`/`os`) that the client hello reports (`_client_details()`; missing on old clients, shown as dashes). The ping is: `{"type": "ping", "id", "rtt"}` / `{"type": "pong", "id"}` — each side measures its own RTT and piggybacks it on its next ping so both ends graph both directions; peers without the feature ignore pings harmlessly (RTT graphs show "no data"). Ping/pong is admitted-streams-only on the server, like input/clipboard. The "Performance" tab (`PerformanceTab`, custom QPainter graphs, one per role sub-tab) schedules **no paint work while hidden** (gated on `isVisible()`, repaint on `showEvent`); the "Preferences" tab's history-window setting persists via the `Settings` store (`performance_window_seconds`, default 120). The monitor's timer runs only while streams are attached; all timing is `time.monotonic()` with an injectable `clock=` for tests — never monkeypatch `time.monotonic` (the test `pump()` helper depends on it).
+- **Performance monitoring** (`performance.py` + `preferences.py`): `PerformanceMonitor` is an opt-in collaborator (`performance=` on `ShareServer`/`ShareClient`, the `clipboard=` pattern — plain sharing tests leave it off). While admitted streams are attached, a 1 s QTimer samples `MessageStream.bytes_sent/bytes_received` counters into rolling `MetricSeries` (bandwidth, aggregated across streams via per-stream baselines) and pings **every** attached stream (each ping id maps to its stream; a pong is honored only on the stream it was sent to). The graphs' RTT series follow only the *active* (most recently admitted) stream; per-stream send/recv/RTT snapshots come from `metrics_for(stream)` and feed the Server tab's `ViewersTable` (`server.py`; it takes the monitor and follows the current ShareServer via `set_share_server`, empty when None), which joins them with `ShareServer.viewers()` — identity fields the client hello reports (`_client_details()`; `user`/`os` are displayed — `host` is still on the wire but not shown, since the display name defaults to the hostname; missing on old clients, shown as dashes). The ping is: `{"type": "ping", "id", "rtt"}` / `{"type": "pong", "id"}` — each side measures its own RTT and piggybacks it on its next ping so both ends graph both directions; peers without the feature ignore pings harmlessly (RTT graphs show "no data"). Ping/pong is admitted-streams-only on the server, like input/clipboard. The "Performance" tab (`PerformanceTab`, custom QPainter graphs, one per role sub-tab) schedules **no paint work while hidden** (gated on `isVisible()`, repaint on `showEvent`); the "Preferences" tab's history-window setting persists via the `Settings` store (`performance_window_seconds`, default 120). The monitor's timer runs only while streams are attached; all timing is `time.monotonic()` with an injectable `clock=` for tests — never monkeypatch `time.monotonic` (the test `pump()` helper depends on it).
 - **Clipboard sync is bidirectional** (`clipboard.py` `ClipboardSync`): client copy → server and server copy → all clients, as `{"type": "clipboard", "text"/"image_png"}` messages. It's opt-in — `ShareServer`/`ShareClient` take a `clipboard=` param and do nothing with clipboard if it's None, so only the GUI (and clipboard tests) enables it; **plain sharing/input tests must leave it off to avoid touching the real OS clipboard.** The app shares ONE `ClipboardSync` across both roles (one OS clipboard): a real local copy fans out to connected servers and own viewers; a peer-received payload records its signature before applying, so it never re-emits `changed` and cannot loop between the roles. Echo/loop prevention is by *content signature*, not just a guard flag, because Windows fires `QClipboard.dataChanged` asynchronously (after a flag would be cleared); image signatures hash canonical RGBA pixels so a re-encoded PNG round trip doesn't loop. Server only accepts clipboard from streams past the approval handshake. Tests use a `FakeClipboard(QObject)` with a `changed` signal and recording `apply()` so two independent clipboards exist in one process.
 - The package version lives only in `src/remotedesktop/__init__.py` (`__version__`); hatchling reads it from there (`[tool.hatch.version]`), so bump it in that one place. **Versioning is strict semver** (`compat.py`, using the `semver` package): major = client/server compatibility contract, minor = backward-compatible features, patch = bug fixes — bump the major when the wire protocol or behavior breaks older peers. Both sides compare majors on every connection (hello/welcome carry `app_version`) and show a strong warning on mismatch (server status log + ⚠ in the viewers table's Version column; client log + non-modal dialog + status-bar marker) but never block the connection. Peers too old to report a version produce no warning.
 - Widget tests need a `QApplication`; use the session-scoped `qapp` fixture in `tests/conftest.py`.

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remotedesktop
-Version: 1.3.0
+Version: 1.4.0
 Summary: Remote desktop app for Windows computers on the same LAN, with autodiscovery. View other computers and optionally share this one — screen, keyboard, mouse, and clipboard, without RDP or Microsoft authentication.
 Project-URL: Homepage, https://github.com/jamesabel/remotedesktop
 Project-URL: Repository, https://github.com/jamesabel/remotedesktop
@@ -31,9 +31,9 @@ Description-Content-Type: text/markdown
 
 **Lossless, low-latency remote desktop for Windows computers on your LAN — one app, pure Python, zero configuration.**
 
-Run the same app on every computer. Turn on *Screen sharing* (view only or
+Run the same app on every computer. Turn on *Server (sharing)* (view only or
 full control) in Preferences on the ones you want to reach, and they appear
-automatically in every other instance's *Servers* panel: the first
+automatically in every other instance's left-hand panel: the first
 connection is approved with one click on the shared computer, and from then
 on it reconnects instantly. View several computers at once — each in its own tab — while
 optionally sharing your own screen at the same time; closing the window
@@ -69,7 +69,7 @@ one-click *Forget* / *Revoke*, and the live connection log.
 
 ## Features
 
-- 🧩 **One app, both roles** — every install can view other computers and share its own screen at the same time; sharing is a three-state choice in Preferences (*Not shared* / *view only* / *full control*), and only one instance runs per computer (launching it again just raises the existing window).
+- 🧩 **One app, either or both roles** — every install can view other computers and share its own screen at the same time. Both roles are chosen in Preferences: *Server (sharing)* is a three-state choice (*Not shared* / *view only* / *full control*), and a *Client (viewer)* toggle turns the client side off entirely for dedicated servers — the UI shows only the components for the roles you enabled, with indicators in the left pane saying what this instance is. Only one instance runs per computer (launching it again just raises the existing window).
 - 🔍 **Autodiscovery** — sharing computers announce themselves over UDP; the app lists every one on the LAN at startup, no addresses to type (press *Refresh* or F5 to rescan).
 - 🗂️ **Multiple computers at once** — view and control several computers simultaneously, each in its own tab named for that computer; the window title shows who you're connected to, even minimized.
 - 🖥️ **Lossless screen sharing** — pixel-exact at full resolution, DXGI desktop-duplication capture (~10 ms per 4K frame), and inter-frame delta compression: an unchanged screen sends nothing.
@@ -106,7 +106,7 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Screen sharing*
+2. On the computer to share, open *Preferences* and set *Server (sharing)*
    to one of the *Shared* modes.
 3. On the viewing computer, the shared computer appears in the *Servers*
    panel — double-click it.

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/readme.md

@@ -8,9 +8,9 @@
 
 **Lossless, low-latency remote desktop for Windows computers on your LAN — one app, pure Python, zero configuration.**
 
-Run the same app on every computer. Turn on *Screen sharing* (view only or
+Run the same app on every computer. Turn on *Server (sharing)* (view only or
 full control) in Preferences on the ones you want to reach, and they appear
-automatically in every other instance's *Servers* panel: the first
+automatically in every other instance's left-hand panel: the first
 connection is approved with one click on the shared computer, and from then
 on it reconnects instantly. View several computers at once — each in its own tab — while
 optionally sharing your own screen at the same time; closing the window
@@ -46,7 +46,7 @@ one-click *Forget* / *Revoke*, and the live connection log.
 
 ## Features
 
-- 🧩 **One app, both roles** — every install can view other computers and share its own screen at the same time; sharing is a three-state choice in Preferences (*Not shared* / *view only* / *full control*), and only one instance runs per computer (launching it again just raises the existing window).
+- 🧩 **One app, either or both roles** — every install can view other computers and share its own screen at the same time. Both roles are chosen in Preferences: *Server (sharing)* is a three-state choice (*Not shared* / *view only* / *full control*), and a *Client (viewer)* toggle turns the client side off entirely for dedicated servers — the UI shows only the components for the roles you enabled, with indicators in the left pane saying what this instance is. Only one instance runs per computer (launching it again just raises the existing window).
 - 🔍 **Autodiscovery** — sharing computers announce themselves over UDP; the app lists every one on the LAN at startup, no addresses to type (press *Refresh* or F5 to rescan).
 - 🗂️ **Multiple computers at once** — view and control several computers simultaneously, each in its own tab named for that computer; the window title shows who you're connected to, even minimized.
 - 🖥️ **Lossless screen sharing** — pixel-exact at full resolution, DXGI desktop-duplication capture (~10 ms per 4K frame), and inter-frame delta compression: an unchanged screen sends nothing.
@@ -83,7 +83,7 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Screen sharing*
+2. On the computer to share, open *Preferences* and set *Server (sharing)*
    to one of the *Shared* modes.
 3. On the viewing computer, the shared computer appears in the *Servers*
    panel — double-click it.

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/src/remotedesktop/__init__.py

@@ -1,3 +1,3 @@
 """Remote desktop client/server for Windows computers on the same LAN."""
 
-__version__ = "1.3.0"
+__version__ = "1.4.0"

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/src/remotedesktop/app.py

@@ -23,7 +23,6 @@ from PySide6.QtWidgets import (
     QApplication,
     QDockWidget,
     QFrame,
-    QGridLayout,
     QGroupBox,
     QHBoxLayout,
     QLabel,
@@ -55,6 +54,7 @@ from remotedesktop.preferences import (
     PreferencesTab,
     load_clipboard_sync_enabled,
     load_performance_window_seconds,
+    load_viewer_enabled,
 )
 from remotedesktop.server import SharingTab
 from remotedesktop.sharing import ShareClient
@@ -82,10 +82,14 @@ class MainWindow(QMainWindow):
     ) -> None:
         super().__init__()
         self._reconnect_base = reconnect_base_seconds
+        self._auto_scan = auto_scan
         self.setWindowIcon(icon.app_icon("app"))
         # Tests inject a connection to a temp database; the app uses the default.
         self._db = connection if connection is not None else db.connect(default_db_path())
         self._settings = Settings(self._db)
+        # The viewer (client) role is opt-out: a dedicated server turns it
+        # off and loses the client-side UI (Server tab, discovery, history).
+        self._viewer_enabled = load_viewer_enabled(self._settings)
         # One monitor per role: ShareServer.close() resets its monitor, so
         # toggling sharing must not share a monitor with the viewing sessions
         # (and vice versa for _connect_session's reset).
@@ -137,7 +141,8 @@ class MainWindow(QMainWindow):
         self._tabs.tabCloseRequested.connect(self._on_tab_close_requested)
         self._tabs.currentChanged.connect(self._on_current_tab_changed)
         self._no_session_page = self._build_no_session_page()
-        self._tabs.addTab(self._no_session_page, "Server")
+        if self._viewer_enabled:
+            self._tabs.addTab(self._no_session_page, "Server")
         # One "Connections" tab holds everything connection-related in a 2×2
         # grid: sharing status + viewers, both peer inventories, and the
         # connection log.
@@ -156,14 +161,17 @@ class MainWindow(QMainWindow):
         self.get_client_log_button.clicked.connect(self.sharing_tab.request_client_log)
 
         connections_tab = QWidget()
-        grid = QGridLayout(connections_tab)
-        sharing_group = QGroupBox("Sharing this computer")
+        sharing_group = QGroupBox("Server (sharing this computer)")
         QVBoxLayout(sharing_group).addWidget(self.sharing_tab)
-        servers_group = QGroupBox("Servers on LAN")
-        QVBoxLayout(servers_group).addWidget(
+        # Kept as an attribute: hidden when the viewer role is off (a
+        # server-only instance has no server history of its own). "History"
+        # (not "on LAN") — the live discovery list is the Servers on LAN
+        # panel; these tables are the persisted first/last-seen records.
+        self._servers_group = QGroupBox("Server history")
+        QVBoxLayout(self._servers_group).addWidget(
             InventoryTab(self.client_inventory, "Forget", self._forget_server)
         )
-        clients_group = QGroupBox("Clients on LAN")
+        clients_group = QGroupBox("Client history")
         QVBoxLayout(clients_group).addWidget(
             InventoryTab(self.server_inventory, "Revoke", self._revoke_client)
         )
@@ -176,39 +184,81 @@ class MainWindow(QMainWindow):
         log_layout.addLayout(log_buttons)
         log_layout.addWidget(self.connection_log)
         # Left column: this computer (sharing status, log). Right column:
-        # the LAN peer tables.
-        grid.addWidget(sharing_group, 0, 0)
-        grid.addWidget(log_group, 1, 0)
-        grid.addWidget(servers_group, 0, 1)
-        grid.addWidget(clients_group, 1, 1)
-        for index in (0, 1):
-            grid.setColumnStretch(index, 1)
-            grid.setRowStretch(index, 1)
+        # the LAN peer tables. Column-level vboxes so a hidden group lets
+        # its neighbor take the full column.
+        left_column = QVBoxLayout()
+        left_column.addWidget(sharing_group)
+        left_column.addWidget(log_group)
+        right_column = QVBoxLayout()
+        right_column.addWidget(self._servers_group)
+        right_column.addWidget(clients_group)
+        columns = QHBoxLayout(connections_tab)
+        columns.addLayout(left_column, 1)
+        columns.addLayout(right_column, 1)
+        if not self._viewer_enabled:
+            self._servers_group.hide()
         self._tabs.addTab(connections_tab, "Connections")
+        # The Performance sub-tabs follow the roles: "Viewing" exists only
+        # with the viewer role, "Sharing" only while actually serving —
+        # a role that produces no data gets no sub-tab. The pages are kept
+        # as attributes so _update_performance_tabs can re-insert them.
         self.performance_pages = QTabWidget()
-        self.performance_pages.addTab(
-            PerformanceTab(self.client_performance, local="client", remote="server"),
-            "Viewing",
+        self._viewing_perf_page = PerformanceTab(
+            self.client_performance, local="client", remote="server"
         )
-        self.performance_pages.addTab(
-            PerformanceTab(self.server_performance, local="server", remote="client"),
-            "Sharing",
+        self._sharing_perf_page = PerformanceTab(
+            self.server_performance, local="server", remote="client"
         )
+        self._performance_hint = QLabel(
+            "Nothing to measure — enable the Client (viewer) or "
+            "Server (sharing) role in the Preferences tab"
+        )
+        self._performance_hint.setAlignment(Qt.AlignmentFlag.AlignCenter)
+        self._performance_hint.hide()
         performance_tab = QWidget()
         performance_layout = QVBoxLayout(performance_tab)
-        performance_layout.addWidget(self.performance_pages)
+        performance_layout.addWidget(self.performance_pages, 1)
+        performance_layout.addWidget(
+            self._performance_hint, 1, Qt.AlignmentFlag.AlignCenter
+        )
         self._tabs.addTab(performance_tab, "Performance")
         self.setCentralWidget(self._tabs)
 
-        # auto_scan=False (tests) never broadcasts on the LAN and starts no
-        # rescan timer; the app scans at startup and every 15 s while visible.
+        # auto_scan=False (tests) never broadcasts on the LAN; the app scans
+        # once at startup — and not at all without the viewer role.
         self.discovery_panel = DiscoveryPanel(
-            self, is_self=self._is_own_server, auto_scan=auto_scan
+            self,
+            is_self=self._is_own_server,
+            auto_scan=auto_scan and self._viewer_enabled,
         )
-        self.servers_dock = QDockWidget("Servers", self)
+        # The dock holds the role indicators (always) and the discovery
+        # panel (viewer role only). The indicators are button-shaped for
+        # visibility but purely informational: mouse events pass straight
+        # through, and the roles are changed only in Preferences.
+        self.client_role_button = self._make_role_button()
+        self.server_role_button = self._make_role_button()
+        dock_body = QWidget()
+        self._dock_layout = QVBoxLayout(dock_body)
+        self._dock_layout.addWidget(self.client_role_button)
+        self._dock_layout.addWidget(self.server_role_button)
+        self._dock_layout.addWidget(self.discovery_panel)
+        # A permanent trailing spacer: it takes the leftover height while
+        # the discovery panel is hidden (keeping the indicators pinned to
+        # the top), and collapses to nothing while the panel is visible
+        # (the stretch factors swap in _update_dock_layout).
+        self._dock_layout.addStretch(0)
+        if not self._viewer_enabled:
+            self.discovery_panel.hide()
+        self._update_dock_layout()
+        # No title text: the indicators and server list are self-explanatory.
+        # (The View menu still names it "Servers on LAN panel" for reopening.)
+        self.servers_dock = QDockWidget("", self)
         # An object name is required for saveState() to persist the dock.
         self.servers_dock.setObjectName("servers_dock")
-        self.servers_dock.setWidget(self.discovery_panel)
+        # Closable (the X) but never floatable/movable: the panel lives on
+        # the left, and the View menu brings it back.
+        self.servers_dock.setFeatures(QDockWidget.DockWidgetFeature.DockWidgetClosable)
+        self.servers_dock.setWidget(dock_body)
         self.addDockWidget(Qt.DockWidgetArea.LeftDockWidgetArea, self.servers_dock)
 
         self.preferences_tab = PreferencesTab(
@@ -218,9 +268,10 @@ class MainWindow(QMainWindow):
             clipboard=self._clipboard,
         )
         self.preferences_tab.statusMessage.connect(self.log)
-        # Preferences drives the sharing lifecycle (the three-state choice
-        # lives there); SharingTab owns persistence and the ShareServer.
+        # Preferences drives both roles: the sharing lifecycle (the
+        # three-state choice) and the viewer role's UI.
         self.preferences_tab.sharingModeChanged.connect(self.sharing_tab.set_mode)
+        self.preferences_tab.viewerModeChanged.connect(self._set_viewer_enabled)
         self.preferences_tab.restart_button.clicked.connect(self._restart_app)
         self._tabs.addTab(self.preferences_tab, "Preferences")
         self._about_tab = AboutTab()
@@ -260,6 +311,8 @@ class MainWindow(QMainWindow):
         # that were open when the app last ran.
         self.sharing_tab.restore_sharing()
         self._restore_sessions()
+        self._update_role_indicators()
+        self._update_performance_tabs()
 
     # ------------------------------------------------------------- logging
 
@@ -290,11 +343,12 @@ class MainWindow(QMainWindow):
         self._view_menu = bar.addMenu("&View")
         # The dock's own toggle action: the way back after closing the panel.
         self.servers_panel_action = self.servers_dock.toggleViewAction()
-        self.servers_panel_action.setText("&Servers panel")
+        self.servers_panel_action.setText("&Servers on LAN panel")
         self._view_menu.addAction(self.servers_panel_action)
         self.refresh_action = self._view_menu.addAction("&Refresh server list")
         self.refresh_action.setShortcut(QKeySequence("F5"))
         self.refresh_action.triggered.connect(self.discovery_panel.refresh)
+        self.refresh_action.setEnabled(self._viewer_enabled)
         self._view_menu.addSeparator()
         self.actual_size_action = self._view_menu.addAction("&Actual size")
         self.actual_size_action.setCheckable(True)
@@ -330,12 +384,12 @@ class MainWindow(QMainWindow):
         label = QLabel(
             "<h3>No server connected</h3>"
             "<p>Computers sharing their screen appear automatically in the "
-            "<b>Servers</b> panel on the left<br>(View&nbsp;▸&nbsp;Servers "
-            "panel if it is hidden).</p>"
+            "panel on the left<br>"
+            "(View&nbsp;▸&nbsp;Servers on LAN panel if it is hidden).</p>"
             "<p>Double-click one — or select it and click <b>Connect</b> — "
             "and this tab becomes your view of that computer.</p>"
-            "<p>To make a computer appear in the list, turn on "
-            "<b>Screen sharing</b> in the Preferences tab on that computer.</p>"
+            "<p>To make a computer appear in the list, enable "
+            "<b>Server (sharing)</b> in the Preferences tab on that computer.</p>"
         )
         label.setAlignment(Qt.AlignmentFlag.AlignCenter)
         label.setWordWrap(True)
@@ -352,11 +406,86 @@ class MainWindow(QMainWindow):
 
     def _ensure_placeholder(self) -> None:
         """Re-show the "Server" instructions tab once no session remains."""
-        if self._sessions or self._tabs.indexOf(self._no_session_page) != -1:
+        if (
+            not self._viewer_enabled
+            or self._sessions
+            or self._tabs.indexOf(self._no_session_page) != -1
+        ):
             return
         self._tabs.insertTab(0, self._no_session_page, "Server")
         self._strip_tab_buttons(0)  # a fresh insert grows new close buttons
 
+    @staticmethod
+    def _make_role_button() -> QPushButton:
+        button = QPushButton()
+        button.setCheckable(True)
+        button.setStyleSheet(
+            "QPushButton { padding: 4px 8px; }"
+            "QPushButton:checked { background-color: #2e7d32; color: white; "
+            "border: 1px solid #1b5e20; border-radius: 3px; }"
+        )
+        # Indicator only: clicks fall through, nothing toggles from here.
+        button.setAttribute(Qt.WidgetAttribute.WA_TransparentForMouseEvents, True)
+        button.setFocusPolicy(Qt.FocusPolicy.NoFocus)
+        return button
+
+    def _update_performance_tabs(self) -> None:
+        """Show a Performance sub-tab per role that can produce data."""
+        pages = self.performance_pages
+
+        def sync(page: QWidget, title: str, wanted: bool, front: bool) -> None:
+            index = pages.indexOf(page)
+            if wanted and index == -1:
+                pages.insertTab(0 if front else pages.count(), page, title)
+            elif not wanted and index != -1:
+                pages.removeTab(index)
+
+        sync(self._viewing_perf_page, "Client (viewer)", self._viewer_enabled, front=True)
+        sync(self._sharing_perf_page, "Server (sharing)", self.sharing_tab.serving, front=False)
+        empty = pages.count() == 0
+        pages.setVisible(not empty)
+        self._performance_hint.setVisible(empty)
+
+    def _update_dock_layout(self) -> None:
+        """Give the dock's leftover height to the panel or the spacer."""
+        panel_visible = self._viewer_enabled
+        self._dock_layout.setStretch(2, 1 if panel_visible else 0)  # panel
+        self._dock_layout.setStretch(3, 0 if panel_visible else 1)  # spacer
+
+    def _update_role_indicators(self) -> None:
+        self.client_role_button.setChecked(self._viewer_enabled)
+        self.client_role_button.setText(
+            "Client (viewer): " + ("on" if self._viewer_enabled else "off")
+        )
+        serving = self.sharing_tab.serving
+        self.server_role_button.setChecked(serving)
+        self.server_role_button.setText(
+            "Server (sharing): " + ("on" if serving else "off")
+        )
+
+    def _set_viewer_enabled(self, enabled: bool) -> None:
+        """Show or hide the client-side UI as the viewer role toggles."""
+        self._viewer_enabled = enabled
+        if not enabled:
+            for session in list(self._sessions):
+                self._close_session(session)  # drops any open connections
+            placeholder_index = self._tabs.indexOf(self._no_session_page)
+            if placeholder_index != -1:
+                self._tabs.removeTab(placeholder_index)
+            self.discovery_panel.hide()
+            self._servers_group.hide()
+        else:
+            self.discovery_panel.show()
+            self._servers_group.show()
+            self._ensure_placeholder()
+            self._tabs.setCurrentIndex(0)
+            if self._auto_scan:
+                self.discovery_panel.refresh()  # becoming a viewer: scan now
+        self.refresh_action.setEnabled(enabled)
+        self._update_dock_layout()
+        self._update_role_indicators()
+        self._update_performance_tabs()
+
     def _on_current_tab_changed(self, _index: int) -> None:
         self._refresh_status_bar()
         if getattr(self, "close_tab_action", None) is None:
@@ -508,6 +637,8 @@ class MainWindow(QMainWindow):
             self._tray.deleteLater()
             self._tray = None
         self._update_window_title()
+        self._update_role_indicators()
+        self._update_performance_tabs()
 
     def _quit(self) -> None:
         self._quitting = True
@@ -659,6 +790,8 @@ class MainWindow(QMainWindow):
         self._settings.set("open_sessions", json.dumps(entries))
 
     def _restore_sessions(self) -> None:
+        if not self._viewer_enabled:
+            return
         raw = self._settings.get("open_sessions")
         if not raw:
             return
@@ -738,6 +871,9 @@ class MainWindow(QMainWindow):
             )
 
     def _on_server_activated(self, server: ServerInfo) -> None:
+        if not self._viewer_enabled:
+            self.log("Viewer role is off — enable it in Preferences to connect")
+            return
         if self._is_own_server(server):
             # Viewing your own screen through yourself is a hall of mirrors;
             # the panel already blocks this, but guard the entry point too.

{remotedesktop-1.3.0 → remotedesktop-1.4.0}/src/remotedesktop/client.py

@@ -12,6 +12,7 @@ from collections.abc import Callable
 
 from PySide6.QtCore import Qt, QTimer, Signal
 from PySide6.QtGui import QPainter
+from PySide6.QtNetwork import QNetworkInterface
 from PySide6.QtWidgets import (
     QListWidget,
     QListWidgetItem,
@@ -29,11 +30,33 @@ from remotedesktop.viewer import ViewerWidget
 _log = logging.getLogger("remotedesktop.client")
 
 
+def _broadcast_hosts() -> tuple[str, ...]:
+    """The limited broadcast plus every interface's directed broadcast.
+
+    Windows routes 255.255.255.255 out only one interface; on a machine
+    with a VPN or virtual adapters that can be the wrong one, making every
+    scan come up empty. Directed subnet broadcasts (e.g. 192.168.1.255)
+    reach each attached network explicitly.
+    """
+    hosts = {"255.255.255.255"}
+    for interface in QNetworkInterface.allInterfaces():
+        flags = interface.flags()
+        if not (flags & QNetworkInterface.InterfaceFlag.IsUp) or (
+            flags & QNetworkInterface.InterfaceFlag.IsLoopBack
+        ):
+            continue
+        for entry in interface.addressEntries():
+            broadcast = entry.broadcast()
+            if not broadcast.isNull() and broadcast.toString():
+                hosts.add(broadcast.toString())
+    return tuple(sorted(hosts))
+
+
 class _ServerList(QListWidget):
     """Server list that paints a hint while empty."""
 
     placeholder_text = (
-        "No servers found yet — turn on Screen sharing in the Preferences "
+        "No servers found yet — enable Server (sharing) in the Preferences "
         "tab on the computer to share"
     )
 
@@ -112,7 +135,7 @@ class DiscoveryPanel(QWidget):
         # thread. Any failure must still emit, or the button stays disabled.
         servers: list[ServerInfo] = []
         try:
-            servers = discover_servers()
+            servers = discover_servers(broadcast_hosts=_broadcast_hosts())
         except Exception:
             pass
         self._scanFinished.emit(servers)