remotedesktop 1.3.0__tar.gz → 1.5.0__tar.gz

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/.github/workflows/release.yml

@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write # create the tag and the release
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v6
@@ -46,3 +48,28 @@ jobs:
             --title "${{ steps.version.outputs.version }}" \
             --generate-notes \
             dist/*
+
+  # Unsigned installer build (the signing token is local-only). To replace it
+  # with a signed one: run scripts\make_installer.bat locally, then
+  #   gh release upload v<version> installers\remotedesktop_installer_win64.exe --clobber
+  installer:
+    needs: release
+    runs-on: windows-latest # .NET Framework csc.exe is preinstalled (launcher build)
+    permissions:
+      contents: write # upload the installer to the release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Install NSIS
+        # Not preinstalled on windows-latest; choco puts makensis.exe at
+        # C:\Program Files (x86)\NSIS\makensis.exe, pyship's default path.
+        run: choco install nsis -y --no-progress
+      - name: Build installer
+        run: uv run --group ship python -m pyship --noupload
+      - name: Attach installer to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >
+          gh release upload "v${{ needs.release.outputs.version }}"
+          --repo "$env:GITHUB_REPOSITORY" --clobber
+          installers/remotedesktop_installer_win64.exe

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/.gitignore

@@ -10,6 +10,12 @@ dist/
 .venv/
 venv/
 
+# pyship build output (scripts/make_installer.bat); *.nsi is left behind
+# only if makensis fails mid-run
+app/
+installers/
+*.nsi
+
 # Testing
 .pytest_cache/
 .coverage

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/CLAUDE.md

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 A Python remote desktop GUI application (PySide6) for Windows computers on the same LAN, per `readme.md`:
 
-- **One app, both roles**: every instance can view other computers, and opts in to *sharing* its own screen via a three-state Screen sharing choice in Preferences — Not shared / view only / full control (persisted; a viewing-only instance binds no ports and creates no TLS credentials). Only one instance runs per user session — a second launch activates the first (`single_instance.py`).
+- **One app, either or both roles**: every instance can view other computers, and opts in to *sharing* its own screen via a three-state Screen sharing choice in Preferences — Not shared / view only / full control (persisted; a viewing-only instance binds no ports and creates no TLS credentials). The **viewer role is opt-out** too: Preferences' "Client (viewer)" checkbox (`viewer_enabled`, default on, `load_viewer_enabled`) — when off, `MainWindow._set_viewer_enabled` closes open sessions and hides all client UI (Server placeholder tab, discovery panel, "Server history" group), disables F5, skips session restore, and refuses activations; discovery never broadcasts. Two **role indicator buttons** at the top of the left dock (`panel_dock`; headerless — the View menu names it "Panel") (`client_role_button`/`server_role_button` — checkable QPushButtons styled green when on, made purely informational via `WA_TransparentForMouseEvents`; roles change only in Preferences) say what the instance is, updated on viewer toggle and `sharingChanged`. The dock always exists (a server-only instance shows just the indicators) and is **headerless** — no title bar at all (`setTitleBarWidget` with an empty widget, `NoDockWidgetFeatures`); View ▸ Panel is the only way to show/hide it. Only one instance runs per user session — a second launch activates the first (`single_instance.py`).
 - **Autodiscovery and connection** of sharing computers on the LAN.
 - **In scope:** desktop screen, keyboard, mouse, and clipboard.
 - **Out of scope:** shared drives, devices, and multimedia (e.g., audio). Smooth playback of fast-changing full-screen content (video, games) is a non-goal: the screen transfer is lossless and optimized for mostly-static desktop work, not for video bandwidth.
@@ -34,6 +34,21 @@ attached. It is idempotent (skips if the release exists) and can be run
 manually via workflow_dispatch. PyPI publishing stays manual (`uv publish`),
 only on the user's explicit request.
 
+The same workflow's `installer` job (windows-latest) builds the **pyship
+installer** (`uv run --group ship python -m pyship --noupload`) and attaches
+it to the release — **unsigned**, because the signing token is local-only. To
+ship a signed installer, build locally (`scripts\make_installer.bat`) and
+replace the asset:
+`gh release upload v<version> installers\remotedesktop_installer_win64.exe --clobber`.
+The frozen app is a pyship CLIP (a full standalone CPython), so `pythonw.exe
+-m remotedesktop` still works inside it; `autostart.installed_launcher()`
+detects the install (CLIP dir name `remotedesktop_<version>`) and points
+autostart/restart at the launcher exe, which always starts the newest
+installed version. Users must quit the app before running an installer — a
+running instance holds the CLIP's DLLs locked. Do not set
+`[tool.pyship] run_on_startup` or signing keys in `pyproject.toml` (see the
+comments there).
+
 ## Commands
 
 Managed with `uv` (hatchling build backend, src layout):
@@ -44,32 +59,39 @@ Managed with `uv` (hatchling build backend, src layout):
 - `uv run remotedesktop` — launch the app. It's a `gui-script`, so it runs detached with no console output; use `uv run python -m remotedesktop` when you need stdout/tracebacks. `--minimized` starts hidden in the tray when sharing is on (what the autostart registration passes).
 - `uv build` — build sdist and wheel into `dist/`
 - `uv publish` — publish to PyPI
+- `scripts\make_installer.bat` — build the **signed Windows installer** with pyship
+  (`installers\remotedesktop_installer_win64.exe`). Needs the hardware signing token and a
+  local console session (pyship refuses token signing over RDP); set
+  `PYSHIP_SIGNING_CERTIFICATE_PIN` for unattended signing. pyship wipes and rebuilds
+  `dist/`, `app/` (launcher exe + frozen CLIP), and `installers/` — all gitignored.
+  `icon/remotedesktop.ico` is the build-input icon; regenerate with
+  `uv run python tools/make_icon.py` after changing `icon.py` (a test guards it).
 
 ## Architecture
 
 - One PySide6 GUI app: `src/remotedesktop/app.py` (`MainWindow` + `main()`, wired to the `remotedesktop` GUI script in `pyproject.toml`; `__main__.py` makes `python -m remotedesktop` work — the in-app Restart relaunches that). `client.py` holds the viewing-role widgets (`DiscoveryPanel`, `ServerSession`), `server.py` the sharing-role widgets (`SharingTab`, `ViewersTable`) — neither has a window or entry point of its own anymore.
-- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, a 2×2 QGridLayout of QGroupBox sections: "Sharing this computer" (the `SharingTab`: summary + viewers table), "Servers on LAN" (client-role inventory, Forget), "Clients on LAN" (server-role inventory, Revoke), and "Connection log" (the log pane + both get-log buttons). **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the two legacy keys `server_enabled` + `allow_remote_input` so old installs migrate for free. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
+- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, arranged as one outer QGroupBox per role, side by side as widgets with "Connection log" full-width below: "Client (viewer)" (left; nests "Connected servers" — `app._SessionsTable`, the client-side twin of the viewers table fed by `_ConnectedServersSource` from the live sessions and `client_performance` — over "Server history", client-role inventory, Forget) and "Server (sharing)" (right; the `SharingTab` summary + viewers table over "Client history", server-role inventory, Revoke). **Each role box is visible only while its role is on** (`_update_connections_groups`); boxes are widgets (not column layouts) so a hidden role frees its space and the other starts at the left edge. **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the two legacy keys `server_enabled` + `allow_remote_input` so old installs migrate for free. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
 - **Tray + lifecycle** (`app.py`): while sharing, closing the window hides to a `QSystemTrayIcon` (menu: Show / Restart / Quit) and sharing continues; not sharing → close quits. `main()` sets `setQuitOnLastWindowClosed(False)`, so **every exit path must reach `QApplication.quit()`** (plain close, tray Quit, restart). `tray_available=` is injectable — tests always pass an explicit value and never call `isSystemTrayAvailable()`. `--minimized` (used by the autostart registration) starts hidden in the tray when sharing is on. `single_instance.py` (`SingleInstance`, QLocalServer-based) enforces one instance per user session; a second launch tells the first to `bring_to_front()` and exits. `autostart.py` registers `remotedesktop.exe --minimized` under HKCU Run value `"remotedesktop"` and migrates the pre-1.0 `"remotedesktop-server"` value at startup (`migrate_legacy`).
 - The remote desktop view is a widget, `ViewerWidget` in `src/remotedesktop/viewer.py`. Screen display and keyboard/mouse/clipboard forwarding belong in this widget, not in the window. **Multiple simultaneous server connections**: each is a `ServerSession` in `client.py` (its own `ShareClient` + `ViewerWidget`, hosted in a `QScrollArea` tab page — `session.page` is the tab widget, `session.viewer` the viewer), shown as a closable tab at the front of `MainWindow`'s central `QTabWidget`, titled with the server's reported hostname (fixed tabs get their close buttons stripped). Fit mode is `widgetResizable(True)`; **View → Actual size** flips the page to non-resizable and the viewer sizes itself to `frame / devicePixelRatio` (1:1 device pixels, the no-resample paint branch; input mapping unchanged because the frame fills the widget). Sessions are keyed by `host:port`; activating an already-known server reconnects in its existing tab, activating a connected one just focuses it. The window title lists the connected server names and a "— sharing" suffix while serving (`_update_window_title`); the status bar's message area follows the currently selected session tab (`status_text` per session) and a permanent right-side label shows "Sharing — N viewer(s)" whenever sharing is on (driven by `SharingTab.viewerCountChanged`). The `ClipboardSync`, inventories, and Connection log are shared across sessions; `client_performance.reset()` is only called when no *other* session is connected (resetting detaches every stream). Per-session status log lines are prefixed `[name]`.
 - **Auto-reconnect** (`app.py`): a session that *was connected* and drops retries `client.connect_to` with exponential backoff (base `reconnect_base_seconds=2.0` kwarg — tests inject ~0.05 — doubling to a 30 s cap), driven by a per-session single-shot QTimer. `ShareClient.connectionFailed` exists because **Qt emits `disconnected` only for sockets that reached ConnectedState** — refused/unreachable attempts fire `errorOccurred` with the socket back in UnconnectedState. The active-timer guard dedupes the errorOccurred+disconnected double-fire. Denial cancels until a manual activation; tab close/forget/quit cancel; retries bypass `_connect_session` on purpose (no perf reset, no tab steal, no inventory attempt spam). **Open session tabs persist** (`open_sessions` JSON in Settings, written on connect/rename/close) and are restored + reconnected at startup with `auto_reconnect` pre-armed, so a not-yet-available server is retried on the backoff loop; deliberately closed tabs are not restored. While no session exists, a non-closable "Server" placeholder tab (instructions) sits at index 0 and swaps with the first session's tab.
 - **Menus & shortcuts contract** (`app.py` `_build_menus`, `viewer.py`): File/View/Help menu bar; shortcuts Ctrl+W (close session tab), Ctrl+Q (quit), F5 (rescan), F11 (fullscreen). While a viewer shows a frame it **accepts `ShortcutOverride`** so every key forwards to the remote machine — **F11 is the single reserved local key**. Shortcut actions are also `addAction`-ed on the window so they fire with the menu bar hidden (fullscreen). Keep every menu/action as an attribute — PySide6 gives Python ownership of `addMenu`/`addAction` (and `QAction.menu()`) wrappers, and a GC'd local deletes the C++ object. Fullscreen hides menu/status bars, dock, and tab bar and restores them (including pre-fullscreen dock visibility) on exit; `closeEvent` exits fullscreen before persisting layout. Window geometry AND dock layout persist (`window_state.save_state`/`restore_state`, key `main_window_state`; the dock needs its objectName).
 - **Privacy toggles**: Preferences' "Sync clipboard" checkbox (`clipboard_sync_enabled`, default on) drives `ClipboardSync.enabled` — while off, local copies aren't sent and peer payloads aren't applied. View-only sharing is the "view" mode of the Screen sharing radios (`ShareServer.set_input_allowed` — a server-side drop, no wire change, that releases held input when switched off). Quitting with ≥1 viewer connected asks for confirmation (declining resets `_quitting`); restart shuts sharing down first so it never double-prompts.
-- **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Viewing"/"Sharing" sub-tabs (`MainWindow.performance_pages`); `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
-- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
+- **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Client (viewer)"/"Server (sharing)" sub-tabs (`MainWindow.performance_pages`) — but only for roles that can produce data: the client sub-tab exists only with the viewer role, the server one only while actually serving (`_update_performance_tabs`, driven from the viewer toggle and `sharingChanged`; both off shows an enable-a-role hint). `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
+- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. **Scan robustness**: probes are re-sent every `_PROBE_INTERVAL` (0.3 s) for the whole scan window (a lost broadcast only delays discovery), ICMP port-unreachable resets never abort the scan (Windows `SIO_UDP_CONNRESET` ioctl + `ConnectionResetError` → continue), and the panel passes `client._broadcast_hosts()` — 255.255.255.255 plus every up non-loopback interface's directed broadcast, because Windows routes the limited broadcast out only one interface (VPN/virtual adapters made scans come up empty). A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
 - Discovery tests run over loopback with ephemeral ports (`bind_host`/`discovery_port`/`broadcast_hosts` parameters exist for this), so they never touch the real LAN or fixed ports.
 - **Screen sharing** (`sharing.py` + `protocol.py` + `frames.py`) runs entirely on the Qt event loop — no threads or locks. `MessageStream` frames messages over a QTcpSocket (4-byte length + kind byte; JSON control messages, full frames, or inter-frame deltas; malformed input aborts the socket). `ShareServer` owns one QTimer that grabs the primary screen at full resolution via `_capture()` (a seam tests override to drive deterministic frame content) and fans out to all clients, skipping clients whose send buffer is backlogged; the timer only runs while clients are connected. Capture is DXGI desktop duplication (`dxgi.py`, hand-rolled ctypes COM — ~10 ms per changed 4K frame, ~0 when idle, and "unchanged" is signalled by returning the same QImage object so the diff is skipped) with automatic fallback to `QScreen.grabWindow` (~96 ms) whenever duplication is unavailable or lost (secure desktop, RDP, display-mode change, CI); unit tests fake the duplication (`FakeDuplication` in `tests/test_dxgi.py`) and the real-hardware test skips where DXGI is unavailable. **Frame transfer is lossless and inter-frame compressed** (`frames.py`): consecutive captures are diffed in 64-row bands (memoryview compares), and only changed bands ship as PNG in a delta payload the client patches onto its previous frame; an unchanged screen sends nothing. Full PNG keyframes go to clients that just joined, just recovered from a send backlog, or requested one (a `{"type": "keyframe"}` message — sent when a delta fails to apply, so desync self-heals). The capability is negotiated via `"delta": true` in the client hello; clients without it (0.5.0) get full JPEG frames every tick because they force-decode frames as JPEG — never send them PNG. Each variant (legacy JPEG / keyframe PNG / delta) is encoded at most once per tick and shared across clients. `ShareClient` decodes/patches to QImage for the viewer, which displays it scaled with a cached `SmoothTransformation` copy (full resolution is always delivered; scaling happens client-side only).
 - **All persistence is one SQLite database** (`db.py`): `db.connect(path)` opens the DB and ensures every table (`settings`, `paired_clients`, `known_servers`, and the inventory tables). The file lives at `config.default_db_path()` — `platformdirs.user_data_dir("remotedesktop")` (`%LOCALAPPDATA%\remotedesktop\remotedesktop.db` on Windows). **Use `platformdirs` for any new data location; don't hardcode `%APPDATA%`.** Every store (`Settings`, `PairedClients`, `KnownServers`, `ConnectionInventory`) takes a `sqlite3.Connection`; the app opens one connection and shares it. `MainWindow` takes a `connection=` keyword so tests inject a temp-file DB and never touch the real one (see `tests/test_main_window.py` / `test_sharing_tab.py`). Tests pass `db.connect(tmp_path/"x.db")` (or omit for in-memory), and use **separate DB files per simulated machine**.
 - **Trust model plumbing** (`config.py`): the client has a stable UUID identity (`load_client_identity`, in the `settings` table) and the server maps each approved client-id to a token (`PairedClients`). `ShareServer` takes an `approve_client(client_id, name) -> bool` callback; `SharingTab` implements it as a modal stay-on-top QMessageBox. Tests inject stores backed by a temp DB and explicit identities so they never touch real data or prompt.
 - **Status/debug logging is a feature**: `ShareServer`, `ShareClient`, `SharingTab`, and `DiscoveryPanel` emit human-readable `status`/`statusMessage` signals for every connection phase, shown in the window's timestamped "Connection log" pane. When adding connection behavior, emit a status message for each new phase or failure path — there's a test asserting the server's phase messages. Everything the pane shows is also written to a rotating debug log file (`logs.py`; `logs.init_logging("remotedesktop")` is called only by `app.main()`, under `platformdirs.user_log_dir("remotedesktop")` — `%LOCALAPPDATA%\remotedesktop\Logs\remotedesktop.log` on Windows; pre-1.0 `client.log`/`server.log` files just age out). Lower-level detail (socket state changes, protocol aborts, frame-drop/backlog, discovery datagram drops) goes straight to `logging.getLogger("remotedesktop.*")` at debug/warning level — silent failure paths should log there even when a status message would be too noisy. Library code and tests never call `init_logging`; without a handler those loggers are no-ops.
-- **Connection inventory** (`inventory.py`): the Connections tab has two grouped tables ("Clients on LAN" for the sharing role, "Servers on LAN" for the viewing role), each backed by its own `ConnectionInventory` — one `PeerRecord` per peer with attempts count, current state, first/last seen. The sharing side is driven by `ShareServer.peerEvent` (a structured `{key, event, name, address, detail}` signal emitted alongside the status strings at each phase — keep both in sync when adding phases), forwarded through `SharingTab.peerEvent`. The viewing side is driven by `MainWindow`'s own handlers (discovered servers from `DiscoveryPanel.serversFound`, plus attempt/connected/denied/disconnected). Server peers key by client-id; client peers key by `host:port`. **Persisted in SQLite** and reloaded on startup, so it survives restarts.
-- **Revoking access**: `InventoryTab` takes an optional `(action_label, action_callback)`; each row gets its own button labeled `action_label` (in the trailing stretch column) whose callback receives that row's peer key. "Clients on LAN" wires "Revoke" → `SharingTab.revoke_client(client_id)` (via `ShareServer.revoke_client` while sharing — removes the token via `PairedClients.revoke`, disconnects any live stream with a `denied: access revoked`, and `_drop` emits a "revoked" peer event; a `_revoked` set distinguishes it from a plain disconnect — or directly via `PairedClients.revoke` while not sharing). "Servers on LAN" wires "Forget" → `KnownServers.forget(key)` + disconnect + `ConnectionInventory.remove(key)`. **Both delete the peer's row from the table and the DB outright** (`MainWindow._record_server_peer` turns a "revoked" event into a `remove`); a rescan or new connection attempt records the peer afresh. After either, the next connection needs a fresh approval. The roles use *separate tables* (`server_peers` / `client_peers`, selected via the `table=` arg) so they don't commingle; `peers` is the default table used by tests. `ConnectionInventory` never lets a DB error break connectivity (load/save are wrapped).
+- **Connection inventory** (`inventory.py`): the Connections tab has two grouped tables ("Client history" for the sharing role, "Server history" for the viewing role), each backed by its own `ConnectionInventory` — one `PeerRecord` per peer with attempts count, current state, first/last seen. The sharing side is driven by `ShareServer.peerEvent` (a structured `{key, event, name, address, detail}` signal emitted alongside the status strings at each phase — keep both in sync when adding phases), forwarded through `SharingTab.peerEvent`. The viewing side is driven by `MainWindow`'s own handlers (discovered servers from `DiscoveryPanel.serversFound`, plus attempt/connected/denied/disconnected). Server peers key by client-id; client peers key by `host:port`. **Persisted in SQLite** and reloaded on startup, so it survives restarts.
+- **Revoking access**: `InventoryTab` takes an optional `(action_label, action_callback)`; each row gets its own button labeled `action_label` (in the trailing stretch column) whose callback receives that row's peer key. "Client history" wires "Revoke" → `SharingTab.revoke_client(client_id)` (via `ShareServer.revoke_client` while sharing — removes the token via `PairedClients.revoke`, disconnects any live stream with a `denied: access revoked`, and `_drop` emits a "revoked" peer event; a `_revoked` set distinguishes it from a plain disconnect — or directly via `PairedClients.revoke` while not sharing). "Server history" wires "Forget" → `KnownServers.forget(key)` + disconnect + `ConnectionInventory.remove(key)`. **Both delete the peer's row from the table and the DB outright** (`MainWindow._record_server_peer` turns a "revoked" event into a `remove`); a rescan or new connection attempt records the peer afresh. After either, the next connection needs a fresh approval. The roles use *separate tables* (`server_peers` / `client_peers`, selected via the `table=` arg) so they don't commingle; `peers` is the default table used by tests. `ConnectionInventory` never lets a DB error break connectivity (load/save are wrapped).
 - Sharing tests drive real sockets on the GUI thread by pumping `qapp.processEvents()` until a condition holds (see `pump()` in `tests/test_sharing.py`). Use the `make_server`/`make_client` helpers there and the session-scoped `credentials` fixture (one generated cert reused across tests — generating per test is ~100ms each). Tests exercise the real pairing flow (auto-approve), so there is no "pre-approve" shortcut anymore.
 - **Input forwarding**: `ViewerWidget` captures mouse/keyboard events and emits `inputEvent` dicts with coordinates normalized 0..1 over the *displayed* frame rect (letterboxing is reversed via `_display_rect()`; events outside the frame are dropped). Keys carry the client's `nativeVirtualKey()` — since both ends are Windows, the server injects that VK directly with no key-translation table. The client sends these as `{"type": "input", ...}`; `ShareServer` only injects input from streams that completed the hello/approval handshake.
 - **Modal-loop pump** (`modal_loop.py`): a Windows title-bar drag (or click-and-hold) puts the window's thread into a native modal move/size loop where Qt's dispatcher stops — for a sharing instance this deadlocked when a *remote* click grabbed the window's own title bar (the mouse-up sat unread on the socket). `MainWindow.nativeEvent` feeds `ModalLoopPump`, which runs a native `SetTimer` from `WM_NCLBUTTONDOWN` (a press-and-hold that never moves blocks in DefWindowProc's click tracking without ever sending `WM_ENTERSIZEMOVE`) until `WM_CAPTURECHANGED`/`WM_EXITSIZEMOVE`, whose callback pumps Qt events (user input excluded). The caption buttons (min/max/close) are the exception — their tracking loop dispatches only mouse messages, so no timer can pump inside it; the pump instead performs those via its `caption_action` callback on press and consumes the message (nativeEvent must return True when `handle_native_event` does), so DefWindowProc's button tracking never starts. Tests inject a fake `timers` backend — never let them create real Win32 timers.
 - **Log exchange**: either side can fetch the peer's debug log over the connection (`{"type": "log_request"}` → `{"type": "log", "text": ...}`, admitted streams only). `ShareServer`/`ShareClient` take a `log_provider=` callable (the app passes `logs.read_log_tail("remotedesktop")`, capped at `logs.TAIL_BYTES`); a missing provider/file answers with a placeholder rather than hanging the requester. The Connection log group on the Connections tab has both buttons — "Get server log" asks the server of the current session tab, "Get client log" asks the most recently admitted viewer; the reply opens a `logs.PeerLogDialog`.
 - **Injection is isolated behind `InputInjector`** (`input_injection.py`, Windows `SendInput` via ctypes; inert stub off-Windows). ShareServer takes an `injector=` param so tests pass a recording fake — **never let tests construct a real `InputInjector`, or they will move the host's actual mouse/keyboard.** Normalized 0..1 coords map directly to SendInput's 0..65535 absolute range over the primary monitor.
 - **Transport is TLS + a token handshake** (`tls.py`, `sharing.py`, `config.py`). The Qt SSL backend here is Windows **schannel** (no OpenSSL); it does complete server-side TLS with a `cryptography`-generated self-signed cert loaded from PEM (verified), but be wary of schannel-specific quirks if you change the config. The server persists a self-signed cert/key under the config dir (`tls.load_or_create_credentials`; `ShareServer(credentials=...)`, or ephemeral if omitted). The client connects with `connectToHostEncrypted`, ignores the expected self-signed cert errors (`PeerVerifyMode.VerifyNone`), and pins the cert fingerprint **softly** — a change is logged but does *not* block the connection (robustness over strict security, per the trusted-LAN intent). Authentication: on first connect the server user approves and the server issues a random token (`PairedClients.pair`, stored server-side by client-id; client stores it in `KnownServers` keyed by `host:port` with the fingerprint). On reconnect the client sends the token in its hello and is admitted with no prompt; a missing/invalid token just falls back to re-approval (never hard-fails). **Do not reintroduce hard cert-pinning or challenge-response** — the user explicitly wanted robust connections over maximum security.
-- **Performance monitoring** (`performance.py` + `preferences.py`): `PerformanceMonitor` is an opt-in collaborator (`performance=` on `ShareServer`/`ShareClient`, the `clipboard=` pattern — plain sharing tests leave it off). While admitted streams are attached, a 1 s QTimer samples `MessageStream.bytes_sent/bytes_received` counters into rolling `MetricSeries` (bandwidth, aggregated across streams via per-stream baselines) and pings **every** attached stream (each ping id maps to its stream; a pong is honored only on the stream it was sent to). The graphs' RTT series follow only the *active* (most recently admitted) stream; per-stream send/recv/RTT snapshots come from `metrics_for(stream)` and feed the Server tab's `ViewersTable` (`server.py`; it takes the monitor and follows the current ShareServer via `set_share_server`, empty when None), which joins them with `ShareServer.viewers()` — identity fields (`user`/`host`/`os`) that the client hello reports (`_client_details()`; missing on old clients, shown as dashes). The ping is: `{"type": "ping", "id", "rtt"}` / `{"type": "pong", "id"}` — each side measures its own RTT and piggybacks it on its next ping so both ends graph both directions; peers without the feature ignore pings harmlessly (RTT graphs show "no data"). Ping/pong is admitted-streams-only on the server, like input/clipboard. The "Performance" tab (`PerformanceTab`, custom QPainter graphs, one per role sub-tab) schedules **no paint work while hidden** (gated on `isVisible()`, repaint on `showEvent`); the "Preferences" tab's history-window setting persists via the `Settings` store (`performance_window_seconds`, default 120). The monitor's timer runs only while streams are attached; all timing is `time.monotonic()` with an injectable `clock=` for tests — never monkeypatch `time.monotonic` (the test `pump()` helper depends on it).
+- **Performance monitoring** (`performance.py` + `preferences.py`): `PerformanceMonitor` is an opt-in collaborator (`performance=` on `ShareServer`/`ShareClient`, the `clipboard=` pattern — plain sharing tests leave it off). While admitted streams are attached, a 1 s QTimer samples `MessageStream.bytes_sent/bytes_received` counters into rolling `MetricSeries` (bandwidth, aggregated across streams via per-stream baselines) and pings **every** attached stream (each ping id maps to its stream; a pong is honored only on the stream it was sent to). The graphs' RTT series follow only the *active* (most recently admitted) stream; per-stream send/recv/RTT snapshots come from `metrics_for(stream)` and feed the Server tab's `ViewersTable` (`server.py`; it takes the monitor and follows the current ShareServer via `set_share_server`, empty when None), which joins them with `ShareServer.viewers()` — identity fields the client hello reports (`_client_details()`; `user`/`os` are displayed — `host` is still on the wire but not shown, since the display name defaults to the hostname; missing on old clients, shown as dashes). The ping is: `{"type": "ping", "id", "rtt"}` / `{"type": "pong", "id"}` — each side measures its own RTT and piggybacks it on its next ping so both ends graph both directions; peers without the feature ignore pings harmlessly (RTT graphs show "no data"). Ping/pong is admitted-streams-only on the server, like input/clipboard. The "Performance" tab (`PerformanceTab`, custom QPainter graphs, one per role sub-tab) schedules **no paint work while hidden** (gated on `isVisible()`, repaint on `showEvent`); the "Preferences" tab's history-window setting persists via the `Settings` store (`performance_window_seconds`, default 120). The monitor's timer runs only while streams are attached; all timing is `time.monotonic()` with an injectable `clock=` for tests — never monkeypatch `time.monotonic` (the test `pump()` helper depends on it).
 - **Clipboard sync is bidirectional** (`clipboard.py` `ClipboardSync`): client copy → server and server copy → all clients, as `{"type": "clipboard", "text"/"image_png"}` messages. It's opt-in — `ShareServer`/`ShareClient` take a `clipboard=` param and do nothing with clipboard if it's None, so only the GUI (and clipboard tests) enables it; **plain sharing/input tests must leave it off to avoid touching the real OS clipboard.** The app shares ONE `ClipboardSync` across both roles (one OS clipboard): a real local copy fans out to connected servers and own viewers; a peer-received payload records its signature before applying, so it never re-emits `changed` and cannot loop between the roles. Echo/loop prevention is by *content signature*, not just a guard flag, because Windows fires `QClipboard.dataChanged` asynchronously (after a flag would be cleared); image signatures hash canonical RGBA pixels so a re-encoded PNG round trip doesn't loop. Server only accepts clipboard from streams past the approval handshake. Tests use a `FakeClipboard(QObject)` with a `changed` signal and recording `apply()` so two independent clipboards exist in one process.
 - The package version lives only in `src/remotedesktop/__init__.py` (`__version__`); hatchling reads it from there (`[tool.hatch.version]`), so bump it in that one place. **Versioning is strict semver** (`compat.py`, using the `semver` package): major = client/server compatibility contract, minor = backward-compatible features, patch = bug fixes — bump the major when the wire protocol or behavior breaks older peers. Both sides compare majors on every connection (hello/welcome carry `app_version`) and show a strong warning on mismatch (server status log + ⚠ in the viewers table's Version column; client log + non-modal dialog + status-bar marker) but never block the connection. Peers too old to report a version produce no warning.
 - Widget tests need a `QApplication`; use the session-scoped `qapp` fixture in `tests/conftest.py`.

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remotedesktop
-Version: 1.3.0
+Version: 1.5.0
 Summary: Remote desktop app for Windows computers on the same LAN, with autodiscovery. View other computers and optionally share this one — screen, keyboard, mouse, and clipboard, without RDP or Microsoft authentication.
 Project-URL: Homepage, https://github.com/jamesabel/remotedesktop
 Project-URL: Repository, https://github.com/jamesabel/remotedesktop
@@ -31,9 +31,9 @@ Description-Content-Type: text/markdown
 
 **Lossless, low-latency remote desktop for Windows computers on your LAN — one app, pure Python, zero configuration.**
 
-Run the same app on every computer. Turn on *Screen sharing* (view only or
+Run the same app on every computer. Turn on *Server (sharing)* (view only or
 full control) in Preferences on the ones you want to reach, and they appear
-automatically in every other instance's *Servers* panel: the first
+automatically in every other instance's left-hand panel: the first
 connection is approved with one click on the shared computer, and from then
 on it reconnects instantly. View several computers at once — each in its own tab — while
 optionally sharing your own screen at the same time; closing the window
@@ -62,18 +62,18 @@ time with live statistics.
 
 Sharing is turned on in Preferences (*view only* or *full control*). The
 *Connections* tab then shows everything in one place: every connected
-viewer — who they are (login name, computer, OS) and how the connection is
+viewer — who they are (name, login, OS) and how the connection is
 doing (bandwidth, round-trip time with mean/min/max/p99/jitter over the
 recent window) — the history of servers seen and clients paired with
 one-click *Forget* / *Revoke*, and the live connection log.
 
 ## Features
 
-- 🧩 **One app, both roles** — every install can view other computers and share its own screen at the same time; sharing is a three-state choice in Preferences (*Not shared* / *view only* / *full control*), and only one instance runs per computer (launching it again just raises the existing window).
+- 🧩 **One app, either or both roles** — every install can view other computers and share its own screen at the same time. Both roles are chosen in Preferences: *Server (sharing)* is a three-state choice (*Not shared* / *view only* / *full control*), and a *Client (viewer)* toggle turns the client side off entirely for dedicated servers — the UI shows only the components for the roles you enabled, with indicators in the left pane saying what this instance is. Only one instance runs per computer (launching it again just raises the existing window).
 - 🔍 **Autodiscovery** — sharing computers announce themselves over UDP; the app lists every one on the LAN at startup, no addresses to type (press *Refresh* or F5 to rescan).
 - 🗂️ **Multiple computers at once** — view and control several computers simultaneously, each in its own tab named for that computer; the window title shows who you're connected to, even minimized.
 - 🖥️ **Lossless screen sharing** — pixel-exact at full resolution, DXGI desktop-duplication capture (~10 ms per 4K frame), and inter-frame delta compression: an unchanged screen sends nothing.
-- ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared — viewers can watch only* and sharing becomes view-only, switchable live.
+- ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared, view only* and sharing becomes view-only, switchable live.
 - 🖼️ **View your way** — each connection scales to fit or shows the remote screen at 1:1 pixels with panning, and F11 goes full screen. While you type into a remote session every key is forwarded — F11 is the one key that stays local.
 - 📋 **Two-way clipboard** — text and images copied on either machine appear on the other; a Preferences toggle turns syncing off entirely.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
@@ -90,6 +90,13 @@ for mostly-static desktop work.
 
 ## Installation
 
+The easiest way: download `remotedesktop_installer_win64.exe` from the
+[latest release](https://github.com/jamesabel/remotedesktop/releases/latest)
+and run it — no Python required. To upgrade, quit the app first (tray →
+Quit if it's sharing), then run the newer installer.
+
+With Python, from PyPI:
+
 ```
 pip install remotedesktop
 ```
@@ -106,10 +113,10 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Screen sharing*
+2. On the computer to share, open *Preferences* and set *Server (sharing)*
    to one of the *Shared* modes.
-3. On the viewing computer, the shared computer appears in the *Servers*
-   panel — double-click it.
+3. On the viewing computer, the shared computer appears in the panel on
+   the left — double-click it (or select it and click *Connect*).
 4. Approve the connection in the dialog that pops up on the shared
    computer. That's it — future connections from that computer need no
    approval.

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/pyproject.toml

@@ -35,6 +35,10 @@ dev = [
     "pytest>=8",
     "pytest-cov>=7.1.0",
 ]
+# Only for building the Windows installer (scripts/make_installer.bat / release CI).
+ship = [
+    "pyship>=0.7.4",
+]
 
 [build-system]
 requires = ["hatchling"]
@@ -46,6 +50,15 @@ path = "src/remotedesktop/__init__.py"
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 
+[tool.pyship]
+ui = "gui"
+# Never upload to S3, even without --noupload. Code signing stays out of this
+# config on purpose: CI installer builds are unsigned (the signing token is
+# local-only); scripts/make_installer.bat passes the signing flags.
+upload = false
+# run_on_startup deliberately NOT set: it would write an HKLM Run value named
+# "remotedesktop", colliding with the app's own HKCU autostart preference.
+
 [tool.ty.environment]
 # The app targets Windows (SendInput via ctypes.windll); type-check as such
 # even when ty runs on a Linux CI runner.

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/readme.md

@@ -8,9 +8,9 @@
 
 **Lossless, low-latency remote desktop for Windows computers on your LAN — one app, pure Python, zero configuration.**
 
-Run the same app on every computer. Turn on *Screen sharing* (view only or
+Run the same app on every computer. Turn on *Server (sharing)* (view only or
 full control) in Preferences on the ones you want to reach, and they appear
-automatically in every other instance's *Servers* panel: the first
+automatically in every other instance's left-hand panel: the first
 connection is approved with one click on the shared computer, and from then
 on it reconnects instantly. View several computers at once — each in its own tab — while
 optionally sharing your own screen at the same time; closing the window
@@ -39,18 +39,18 @@ time with live statistics.
 
 Sharing is turned on in Preferences (*view only* or *full control*). The
 *Connections* tab then shows everything in one place: every connected
-viewer — who they are (login name, computer, OS) and how the connection is
+viewer — who they are (name, login, OS) and how the connection is
 doing (bandwidth, round-trip time with mean/min/max/p99/jitter over the
 recent window) — the history of servers seen and clients paired with
 one-click *Forget* / *Revoke*, and the live connection log.
 
 ## Features
 
-- 🧩 **One app, both roles** — every install can view other computers and share its own screen at the same time; sharing is a three-state choice in Preferences (*Not shared* / *view only* / *full control*), and only one instance runs per computer (launching it again just raises the existing window).
+- 🧩 **One app, either or both roles** — every install can view other computers and share its own screen at the same time. Both roles are chosen in Preferences: *Server (sharing)* is a three-state choice (*Not shared* / *view only* / *full control*), and a *Client (viewer)* toggle turns the client side off entirely for dedicated servers — the UI shows only the components for the roles you enabled, with indicators in the left pane saying what this instance is. Only one instance runs per computer (launching it again just raises the existing window).
 - 🔍 **Autodiscovery** — sharing computers announce themselves over UDP; the app lists every one on the LAN at startup, no addresses to type (press *Refresh* or F5 to rescan).
 - 🗂️ **Multiple computers at once** — view and control several computers simultaneously, each in its own tab named for that computer; the window title shows who you're connected to, even minimized.
 - 🖥️ **Lossless screen sharing** — pixel-exact at full resolution, DXGI desktop-duplication capture (~10 ms per 4K frame), and inter-frame delta compression: an unchanged screen sends nothing.
-- ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared — viewers can watch only* and sharing becomes view-only, switchable live.
+- ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared, view only* and sharing becomes view-only, switchable live.
 - 🖼️ **View your way** — each connection scales to fit or shows the remote screen at 1:1 pixels with panning, and F11 goes full screen. While you type into a remote session every key is forwarded — F11 is the one key that stays local.
 - 📋 **Two-way clipboard** — text and images copied on either machine appear on the other; a Preferences toggle turns syncing off entirely.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
@@ -67,6 +67,13 @@ for mostly-static desktop work.
 
 ## Installation
 
+The easiest way: download `remotedesktop_installer_win64.exe` from the
+[latest release](https://github.com/jamesabel/remotedesktop/releases/latest)
+and run it — no Python required. To upgrade, quit the app first (tray →
+Quit if it's sharing), then run the newer installer.
+
+With Python, from PyPI:
+
 ```
 pip install remotedesktop
 ```
@@ -83,10 +90,10 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Screen sharing*
+2. On the computer to share, open *Preferences* and set *Server (sharing)*
    to one of the *Shared* modes.
-3. On the viewing computer, the shared computer appears in the *Servers*
-   panel — double-click it.
+3. On the viewing computer, the shared computer appears in the panel on
+   the left — double-click it (or select it and click *Connect*).
 4. Approve the connection in the dialog that pops up on the shared
    computer. That's it — future connections from that computer need no
    approval.

remotedesktop-1.5.0/scripts/make_installer.bat

@@ -0,0 +1,27 @@
+@echo off
+setlocal
+cd /d "%~dp0.."
+
+rem Build the signed Windows installer with pyship.
+rem Requirements: the hardware signing token plugged in, a LOCAL console
+rem session (pyship refuses to sign over RDP - failed PIN attempts can lock
+rem the token), and optionally PYSHIP_SIGNING_CERTIFICATE_PIN set for
+rem unattended signing (otherwise the token middleware prompts for the PIN).
+rem CI builds the same installer unsigned; replace the release asset with
+rem this signed one via:
+rem   gh release upload v<version> installers\remotedesktop_installer_win64.exe --clobber
+
+uv sync --group ship
+if errorlevel 1 (
+    echo Failed to create the environment.
+    exit /b 1
+)
+
+rem pyship rebuilds dist\ (wheel), app\ (launcher + frozen CLIP), and installers\.
+uv run --group ship python -m pyship --noupload --code-sign --certificate-auto-select
+if errorlevel 1 (
+    echo Installer build FAILED.
+    exit /b 1
+)
+
+echo Installer: installers\remotedesktop_installer_win64.exe

{remotedesktop-1.3.0 → remotedesktop-1.5.0}/src/remotedesktop/__init__.py

@@ -1,3 +1,3 @@
 """Remote desktop client/server for Windows computers on the same LAN."""
 
-__version__ = "1.3.0"
+__version__ = "1.5.0"