remotedesktop 1.9.3__tar.gz → 2.1.0__tar.gz

remotedesktop-2.1.0/.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"06786f54-7244-453c-8fd6-c0ad270c6bfc","pid":25604,"procStart":"639204255108546380","acquiredAt":1784854861122}

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/CLAUDE.md

@@ -49,6 +49,11 @@ running instance holds the CLIP's DLLs locked. Do not set
 `[tool.pyship] run_on_startup` or signing keys in `pyproject.toml` (see the
 comments there).
 
+**No backwards compatibility is required** (per the user): upgrades just
+must not crash. Don't add migration shims, legacy-key/value handling, or
+old-peer fallbacks for new work — old data may be dropped or reset, as long
+as failure is graceful.
+
 ## Commands
 
 Managed with `uv` (hatchling build backend, src layout):
@@ -56,7 +61,7 @@ Managed with `uv` (hatchling build backend, src layout):
 - `uv sync` — create/update the venv with the project and dev dependencies
 - `uv run pytest` — run all tests
 - `uv run pytest tests/test_smoke.py::test_version` — run a single test
-- `uv run remotedesktop` — launch the app. It's a `gui-script`, so it runs detached with no console output; use `uv run python -m remotedesktop` when you need stdout/tracebacks. `--minimized` starts hidden in the tray when sharing is on (what the autostart registration passes).
+- `uv run remotedesktop` — launch the app. It's a `gui-script`, so it runs detached with no console output; use `uv run python -m remotedesktop` when you need stdout/tracebacks. `--minimized` starts hidden in the tray when sharing is on, otherwise minimized to the taskbar (the default autostart registration passes it); `--maximized` starts maximized.
 - `uv build` — build sdist and wheel into `dist/`
 - `uv publish` — publish to PyPI
 - `scripts\make_installer.bat` — build the **signed Windows installer** with pyship
@@ -70,11 +75,11 @@ Managed with `uv` (hatchling build backend, src layout):
 ## Architecture
 
 - One PySide6 GUI app: `src/remotedesktop/app.py` (`MainWindow` + `main()`, wired to the `remotedesktop` GUI script in `pyproject.toml`; `__main__.py` makes `python -m remotedesktop` work — the in-app Restart relaunches that). `client.py` holds the viewing-role widgets (`DiscoveryPanel`, `ServerSession`), `server.py` the sharing-role widgets (`SharingTab`, `ViewersTable`) — neither has a window or entry point of its own anymore.
-- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, arranged as one outer QGroupBox per role, side by side as widgets with "Connection log" full-width below: "Client (viewer)" (left; nests "Connected servers" — `app._SessionsTable`, the client-side twin of the viewers table fed by `_ConnectedServersSource` from the live sessions and `client_performance` — over "Server history", client-role inventory, Forget) and "Server (sharing)" (right; the `SharingTab` summary + viewers table over "Client history", server-role inventory, Revoke). **Each role box is visible only while its role is on** (`_update_connections_groups`); boxes are widgets (not column layouts) so a hidden role frees its space and the other starts at the left edge. **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the two legacy keys `server_enabled` + `allow_remote_input` so old installs migrate for free. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
-- **Tray + lifecycle** (`app.py`): while sharing, closing the window hides to a `QSystemTrayIcon` (menu: Show / Restart / Quit) and sharing continues; not sharing → close quits. `main()` sets `setQuitOnLastWindowClosed(False)`, so **every exit path must reach `QApplication.quit()`** (plain close, tray Quit, restart). `tray_available=` is injectable — tests always pass an explicit value and never call `isSystemTrayAvailable()`. `--minimized` (used by the autostart registration) starts hidden in the tray when sharing is on. `single_instance.py` (`SingleInstance`, QLocalServer-based) enforces one instance per user session; a second launch tells the first to `bring_to_front()` and exits. `autostart.py` registers `remotedesktop.exe --minimized` under HKCU Run value `"remotedesktop"` and migrates the pre-1.0 `"remotedesktop-server"` value at startup (`migrate_legacy`).
+- **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, arranged as one outer QGroupBox per role, side by side as widgets with "Connection log" full-width below: "Client (viewer)" (left; nests "Connected servers" — `app._SessionsTable`, the client-side twin of the viewers table fed by `_ConnectedServersSource` from the live sessions and `client_performance` — over "Server history", client-role inventory, Forget) and "Server (sharing)" (right; the `SharingTab` summary + viewers table over "Client history", server-role inventory, Revoke). **Each role box is visible only while its role is on** (`_update_connections_groups`); boxes are widgets (not column layouts) so a hidden role frees its space and the other starts at the left edge. **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the single `sharing_mode` key. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
+- **Tray + lifecycle** (`app.py`): while sharing, closing the window hides to a `QSystemTrayIcon` (menu: Show / Restart / Quit) and sharing continues; not sharing → close quits. `main()` sets `setQuitOnLastWindowClosed(False)`, so **every exit path must reach `QApplication.quit()`** (plain close, tray Quit, restart). `tray_available=` is injectable — tests always pass an explicit value and never call `isSystemTrayAvailable()`. `--minimized` starts hidden in the tray when sharing is on, otherwise minimized; `--maximized` starts maximized. `single_instance.py` (`SingleInstance`, QLocalServer-based) enforces one instance per user session; a second launch tells the first to `bring_to_front()` and exits. **Start at login is a four-way start mode** (`autostart.py` `START_MINIMIZED/NORMAL/MAXIMIZED/OFF`): Preferences radios persist it as `autostart_mode` (`load_autostart_mode`, default **minimized** — the recommended setting) and `PreferencesTab` mirrors it into the HKCU Run value `"remotedesktop"` at every construction, so the start-minimized default takes effect on a fresh install and the registered path follows the current installation. The mode is encoded in the registered command's flag (`--minimized` / none / `--maximized`; no value = off, `Autostart.mode()` reads it back). Tests always inject `Autostart(key_path=...)` pointed at an isolated test key — a real `Autostart` in a test would rewrite the developer's actual Run key at tab construction.
 - The remote desktop view is a widget, `ViewerWidget` in `src/remotedesktop/viewer.py`. Screen display and keyboard/mouse/clipboard forwarding belong in this widget, not in the window. **Multiple simultaneous server connections**: each is a `ServerSession` in `client.py` (its own `ShareClient` + `ViewerWidget`, hosted in a `QScrollArea` tab page — `session.page` is the tab widget, `session.viewer` the viewer), shown as a closable tab at the front of `MainWindow`'s central `QTabWidget`, titled with the server's reported hostname (fixed tabs get their close buttons stripped). Fit mode is `widgetResizable(True)`; **View → Actual size** flips the page to non-resizable and the viewer sizes itself to `frame / devicePixelRatio` (1:1 device pixels, the no-resample paint branch; input mapping unchanged because the frame fills the widget). Sessions are keyed by `host:port`; activating an already-known server reconnects in its existing tab, activating a connected one just focuses it. The window title lists the connected server names and a "— sharing" suffix while serving (`_update_window_title`); the status bar's message area follows the currently selected session tab (`status_text` per session) and a permanent right-side label shows "Sharing — N viewer(s)" whenever sharing is on (driven by `SharingTab.viewerCountChanged`). The `ClipboardSync`, inventories, and Connection log are shared across sessions; `client_performance.reset()` is only called when no *other* session is connected (resetting detaches every stream). Per-session status log lines are prefixed `[name]`.
 - **Auto-reconnect** (`app.py`): a session that *was connected* and drops retries `client.connect_to` with exponential backoff (base `reconnect_base_seconds=2.0` kwarg — tests inject ~0.05 — doubling to a 30 s cap), driven by a per-session single-shot QTimer. `ShareClient.connectionFailed` exists because **Qt emits `disconnected` only for sockets that reached ConnectedState** — refused/unreachable attempts fire `errorOccurred` with the socket back in UnconnectedState. The active-timer guard dedupes the errorOccurred+disconnected double-fire. Denial cancels until a manual activation; tab close/forget/quit cancel; retries bypass `_connect_session` on purpose (no perf reset, no tab steal, no inventory attempt spam). **Open session tabs persist** (`open_sessions` JSON in Settings, written on connect/rename/close) and are restored + reconnected at startup with `auto_reconnect` pre-armed, so a not-yet-available server is retried on the backoff loop; deliberately closed tabs are not restored. While no session exists, a non-closable "Server" placeholder tab (instructions) sits at index 0 and swaps with the first session's tab.
-- **Menus & shortcuts contract** (`app.py` `_build_menus`, `viewer.py`): File/View/Help menu bar; shortcuts Ctrl+W (close session tab), Ctrl+Q (quit), F5 (rescan), F11 (fullscreen). While a viewer shows a frame it **accepts `ShortcutOverride`** so every key forwards to the remote machine — **F11 is the single reserved local key**. Shortcut actions are also `addAction`-ed on the window so they fire with the menu bar hidden (fullscreen). Keep every menu/action as an attribute — PySide6 gives Python ownership of `addMenu`/`addAction` (and `QAction.menu()`) wrappers, and a GC'd local deletes the C++ object. Fullscreen hides menu/status bars, dock, and tab bar and restores them (including pre-fullscreen dock visibility) on exit; `closeEvent` exits fullscreen before persisting layout. Window geometry AND dock layout persist (`window_state.save_state`/`restore_state`, key `main_window_state`; the dock needs its objectName).
+- **Menus & shortcuts contract** (`app.py` `_build_menus`, `viewer.py`): File/View/Help menu bar; shortcuts Ctrl+W (close the current session tab or the Preferences tab), Ctrl+, (Preferences), Ctrl+Q (quit), F5 (rescan), F11 (fullscreen). **Preferences and About are not pinned tabs**: File ▸ Preferences… shows `preferences_tab` as an on-demand *closable* tab (the widget is built once at startup — its constructor and signal wiring drive the roles — and `removeTab` on close keeps it alive for the next open); Help ▸ About shows the single modeless `about.AboutDialog` instance (`_about_dialog`, wrapping `AboutPage`). While a viewer shows a frame it **accepts `ShortcutOverride`** so every key forwards to the remote machine — **F11 is the single reserved local key**. Shortcut actions are also `addAction`-ed on the window so they fire with the menu bar hidden (fullscreen). Keep every menu/action as an attribute — PySide6 gives Python ownership of `addMenu`/`addAction` (and `QAction.menu()`) wrappers, and a GC'd local deletes the C++ object. Fullscreen hides menu/status bars, dock, and tab bar and restores them (including pre-fullscreen dock visibility) on exit; `closeEvent` exits fullscreen before persisting layout. Window geometry AND dock layout persist (`window_state.save_state`/`restore_state`, key `main_window_state`; the dock needs its objectName).
 - **Privacy toggles**: Preferences' "Sync clipboard" checkbox (`clipboard_sync_enabled`, default on) drives `ClipboardSync.enabled` — while off, local copies aren't sent and peer payloads aren't applied. View-only sharing is the "view" mode of the Screen sharing radios (`ShareServer.set_input_allowed` — a server-side drop, no wire change, that releases held input when switched off). Quitting with ≥1 viewer connected asks for confirmation (declining resets `_quitting`); restart shuts sharing down first so it never double-prompts.
 - **Screen capture** (`app.py`): the dock's "Screen capture" group (Copy / Save…, viewer-role UI hidden with the panel) and the matching File-menu actions (`copy_capture_action`/`save_capture_action`, same handlers) capture the current session tab's last frame at full server resolution (`ViewerWidget.frame_image()` — the lock overlay is display-only and never part of it). Copy goes through `ClipboardSync.copy_image`, which records the content signature *before* setting the clipboard so the capture is never echoed to peers, and works with sync disabled (the preference governs syncing, not local copies). Save is `QFileDialog.getSaveFileName` (tests monkeypatch it) defaulting to `Pictures\<server> <timestamp>.png`, PNG only. All four widgets enable only while the current tab shows a frame — `_update_capture_actions()`, called from tab change, `_on_frame` (unconditionally: auto-reconnect refills a cleared viewer without `_connect_session`), and every `viewer.clear` path (connect/denied/approval-pending/disconnect).
 - **Reduce visual effects while sharing** (`visual_effects.py`): animations/fades are a burst of changed frames for the lossless pipeline, so while the preference is on (default on, `reduce_effects_enabled`, `load_reduce_effects_enabled`) **and ≥1 viewer is connected**, `MainWindow` applies `VisualEffectsReducer` and restores it when the last viewer leaves (driven by `SharingTab.viewerCountChanged`; explicit safety-net restore in `closeEvent`). The reduced set: SPI_SETUIEFFECTS off, drop shadows off, client-area + min/max animations off, submenu delay lowered to 50 ms (never raised). All via `SystemParametersInfo` **without** SPIF_UPDATEINIFILE — session-scoped, never persisted, self-heals at logoff; knobs already at the reduced value are left untouched so the user's own choices are never "restored" over. The backend (`SpiBackend`) is injectable — **tests must always inject `FakeSpiBackend`** (the preference defaults on, so a real reducer in a test would change the host's actual Windows settings; `make_window` in `tests/test_main_window.py` injects it for every window test, and real-backend tests may only read).
@@ -82,10 +87,10 @@ Managed with `uv` (hatchling build backend, src layout):
 - **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Client (viewer)"/"Server (sharing)" sub-tabs (`MainWindow.performance_pages`) — but only for roles that can produce data: the client sub-tab exists only with the viewer role, the server one only while actually serving (`_update_performance_tabs`, driven from the viewer toggle and `sharingChanged`; both off shows an enable-a-role hint). `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
 - **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. **Scan robustness**: probes are re-sent every `_PROBE_INTERVAL` (0.3 s) for the whole scan window (a lost broadcast only delays discovery), ICMP port-unreachable resets never abort the scan (Windows `SIO_UDP_CONNRESET` ioctl + `ConnectionResetError` → continue), and the panel passes `client._broadcast_hosts()` — 255.255.255.255 plus every up non-loopback interface's directed broadcast, because Windows routes the limited broadcast out only one interface (VPN/virtual adapters made scans come up empty). A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
 - Discovery tests run over loopback with ephemeral ports (`bind_host`/`discovery_port`/`broadcast_hosts` parameters exist for this), so they never touch the real LAN or fixed ports.
-- **Screen sharing** (`sharing.py` + `protocol.py` + `frames.py`) runs entirely on the Qt event loop — no threads or locks. `MessageStream` frames messages over a QTcpSocket (4-byte length + kind byte; JSON control messages, full frames, or inter-frame deltas; malformed input aborts the socket). `ShareServer` owns one QTimer that grabs the primary screen at full resolution via `_capture()` (a seam tests override to drive deterministic frame content) and fans out to all clients, skipping clients whose send buffer is backlogged; the timer only runs while clients are connected. Capture is DXGI desktop duplication (`dxgi.py`, hand-rolled ctypes COM — ~10 ms per changed 4K frame, ~0 when idle, and "unchanged" is signalled by returning the same QImage object so the diff is skipped) with automatic fallback to `QScreen.grabWindow` (~96 ms) whenever duplication is unavailable or lost (secure desktop, RDP, display-mode change, CI); unit tests fake the duplication (`FakeDuplication` in `tests/test_dxgi.py`) and the real-hardware test skips where DXGI is unavailable. **Frame transfer is lossless and inter-frame compressed** (`frames.py`): consecutive captures are diffed in 64-row bands (memoryview compares), and only changed bands ship as PNG in a delta payload the client patches onto its previous frame; an unchanged screen sends nothing. Full PNG keyframes go to clients that just joined, just recovered from a send backlog, or requested one (a `{"type": "keyframe"}` message — sent when a delta fails to apply, so desync self-heals). The capability is negotiated via `"delta": true` in the client hello; clients without it (0.5.0) get full JPEG frames every tick because they force-decode frames as JPEG — never send them PNG. Each variant (legacy JPEG / keyframe PNG / delta) is encoded at most once per tick and shared across clients. `ShareClient` decodes/patches to QImage for the viewer, which displays it scaled with a cached `SmoothTransformation` copy (full resolution is always delivered; scaling happens client-side only).
+- **Screen sharing** (`sharing.py` + `protocol.py` + `frames.py`) runs entirely on the Qt event loop — no threads or locks. `MessageStream` frames messages over a QTcpSocket (4-byte length + kind byte; JSON control messages, full frames, or inter-frame deltas; malformed input aborts the socket). `ShareServer` owns one QTimer that grabs the primary screen at full resolution via `_capture()` (a seam tests override to drive deterministic frame content) and fans out to all clients, skipping clients whose send buffer is backlogged; the timer only runs while clients are connected. Capture is DXGI desktop duplication (`dxgi.py`, hand-rolled ctypes COM — ~10 ms per changed 4K frame, ~0 when idle, and "unchanged" is signalled by returning the same QImage object so the diff is skipped) with automatic fallback to `QScreen.grabWindow` (~96 ms) whenever duplication is unavailable or lost (secure desktop, RDP, display-mode change, CI); unit tests fake the duplication (`FakeDuplication` in `tests/test_dxgi.py`) and the real-hardware test skips where DXGI is unavailable. **Frame transfer is lossless and inter-frame compressed** (`frames.py`): consecutive captures are diffed in 64-row bands (memoryview compares), and only changed bands ship as PNG in a delta payload the client patches onto its previous frame; an unchanged screen sends nothing. Full PNG keyframes go to clients that just joined, just recovered from a send backlog, or requested one (a `{"type": "keyframe"}` message — sent when a delta fails to apply, so desync self-heals). Every client is assumed delta-capable (no negotiation). Each variant (keyframe PNG / delta) is encoded at most once per tick and shared across clients. `ShareClient` decodes/patches to QImage for the viewer, which displays it scaled with a cached `SmoothTransformation` copy (full resolution is always delivered; scaling happens client-side only).
 - **All persistence is one SQLite database** (`db.py`): `db.connect(path)` opens the DB and ensures every table (`settings`, `paired_clients`, `known_servers`, and the inventory tables). The file lives at `config.default_db_path()` — `platformdirs.user_data_dir("remotedesktop")` (`%LOCALAPPDATA%\remotedesktop\remotedesktop.db` on Windows). **Use `platformdirs` for any new data location; don't hardcode `%APPDATA%`.** Every store (`Settings`, `PairedClients`, `KnownServers`, `ConnectionInventory`) takes a `sqlite3.Connection`; the app opens one connection and shares it. **Boolean settings go through `Settings.get_bool`/`set_bool`** (the `tobool` package's `to_bool_strict`; on-disk form stays the historical `"1"`/`"0"`, junk falls back to the caller's default) — don't hand-roll `!= "0"` comparisons. This applies to binary values stored as strings/ints; ctypes Win32 `BOOL`s keep plain `bool()` (TRUE is "any nonzero", which strict parsing correctly refuses). `MainWindow` takes a `connection=` keyword so tests inject a temp-file DB and never touch the real one (see `tests/test_main_window.py` / `test_sharing_tab.py`). Tests pass `db.connect(tmp_path/"x.db")` (or omit for in-memory), and use **separate DB files per simulated machine**.
 - **Trust model plumbing** (`config.py`): the client has a stable UUID identity (`load_client_identity`, in the `settings` table) and the server maps each approved client-id to a token (`PairedClients`). `ShareServer` takes an `approve_client(client_id, name) -> bool` callback; `SharingTab` implements it as a modal stay-on-top QMessageBox. Tests inject stores backed by a temp DB and explicit identities so they never touch real data or prompt.
-- **Status/debug logging is a feature**: `ShareServer`, `ShareClient`, `SharingTab`, and `DiscoveryPanel` emit human-readable `status`/`statusMessage` signals for every connection phase, shown in the window's timestamped "Connection log" pane. When adding connection behavior, emit a status message for each new phase or failure path — there's a test asserting the server's phase messages. Everything the pane shows is also written to a rotating debug log file (`logs.py`; `logs.init_logging("remotedesktop")` is called only by `app.main()`, under `platformdirs.user_log_dir("remotedesktop")` — `%LOCALAPPDATA%\remotedesktop\Logs\remotedesktop.log` on Windows; pre-1.0 `client.log`/`server.log` files just age out). Lower-level detail (socket state changes, protocol aborts, frame-drop/backlog, discovery datagram drops) goes straight to `logging.getLogger("remotedesktop.*")` at debug/warning level — silent failure paths should log there even when a status message would be too noisy. Library code and tests never call `init_logging`; without a handler those loggers are no-ops.
+- **Status/debug logging is a feature**: `ShareServer`, `ShareClient`, `SharingTab`, and `DiscoveryPanel` emit human-readable `status`/`statusMessage` signals for every connection phase, shown in the window's timestamped "Connection log" pane. **Byte counts in any user-facing string go through `humanize.naturalsize(n, binary=True)`** ("2.0 KiB", "1.3 MiB") — never hand-rolled `// 1024` math (the `humanize` package is a dependency; `performance.format_rate` wraps it for rates). When adding connection behavior, emit a status message for each new phase or failure path — there's a test asserting the server's phase messages. Everything the pane shows is also written to a rotating debug log file (`logs.py`; `logs.init_logging("remotedesktop")` is called only by `app.main()`, under `platformdirs.user_log_dir("remotedesktop")` — `%LOCALAPPDATA%\remotedesktop\Logs\remotedesktop.log` on Windows; pre-1.0 `client.log`/`server.log` files just age out). Lower-level detail (socket state changes, protocol aborts, frame-drop/backlog, discovery datagram drops) goes straight to `logging.getLogger("remotedesktop.*")` at debug/warning level — silent failure paths should log there even when a status message would be too noisy. Library code and tests never call `init_logging`; without a handler those loggers are no-ops.
 - **Connection inventory** (`inventory.py`): the Connections tab has two grouped tables ("Client history" for the sharing role, "Server history" for the viewing role), each backed by its own `ConnectionInventory` — one `PeerRecord` per peer with attempts count, current state, first/last seen. The sharing side is driven by `ShareServer.peerEvent` (a structured `{key, event, name, address, detail}` signal emitted alongside the status strings at each phase — keep both in sync when adding phases), forwarded through `SharingTab.peerEvent`. The viewing side is driven by `MainWindow`'s own handlers (discovered servers from `DiscoveryPanel.serversFound`, plus attempt/connected/denied/disconnected). Server peers key by client-id; client peers key by `host:port`. **Persisted in SQLite** and reloaded on startup, so it survives restarts.
 - **Revoking access**: `InventoryTab` takes an optional `(action_label, action_callback)`; each row gets its own button labeled `action_label` (in the trailing stretch column) whose callback receives that row's peer key. "Client history" wires "Revoke" → `SharingTab.revoke_client(client_id)` (via `ShareServer.revoke_client` while sharing — removes the token via `PairedClients.revoke`, disconnects any live stream with a `denied: access revoked`, and `_drop` emits a "revoked" peer event; a `_revoked` set distinguishes it from a plain disconnect — or directly via `PairedClients.revoke` while not sharing). "Server history" wires "Forget" → `KnownServers.forget(key)` + disconnect + `ConnectionInventory.remove(key)`. **Both delete the peer's row from the table and the DB outright** (`MainWindow._record_server_peer` turns a "revoked" event into a `remove`); a rescan or new connection attempt records the peer afresh. After either, the next connection needs a fresh approval. The roles use *separate tables* (`server_peers` / `client_peers`, selected via the `table=` arg) so they don't commingle; `peers` is the default table used by tests. `ConnectionInventory` never lets a DB error break connectivity (load/save are wrapped).
 - Sharing tests drive real sockets on the GUI thread by pumping `qapp.processEvents()` until a condition holds (see `pump()` in `tests/test_sharing.py`). Use the `make_server`/`make_client` helpers there and the session-scoped `credentials` fixture (one generated cert reused across tests — generating per test is ~100ms each). Tests exercise the real pairing flow (auto-approve), so there is no "pre-approve" shortcut anymore.
@@ -97,7 +102,7 @@ Managed with `uv` (hatchling build backend, src layout):
 - **Injection is isolated behind `InputInjector`** (`input_injection.py`, Windows `SendInput` via ctypes; inert stub off-Windows). ShareServer takes an `injector=` param so tests pass a recording fake — **never let tests construct a real `InputInjector`, or they will move the host's actual mouse/keyboard.** Normalized 0..1 coords map directly to SendInput's 0..65535 absolute range over the primary monitor.
 - **Transport is TLS + a token handshake** (`tls.py`, `sharing.py`, `config.py`). The Qt SSL backend here is Windows **schannel** (no OpenSSL); it does complete server-side TLS with a `cryptography`-generated self-signed cert loaded from PEM (verified), but be wary of schannel-specific quirks if you change the config. The server persists a self-signed cert/key under the config dir (`tls.load_or_create_credentials`; `ShareServer(credentials=...)`, or ephemeral if omitted). The client connects with `connectToHostEncrypted`, ignores the expected self-signed cert errors (`PeerVerifyMode.VerifyNone`), and pins the cert fingerprint **softly** — a change is logged but does *not* block the connection (robustness over strict security, per the trusted-LAN intent). Authentication: on first connect the server user approves and the server issues a random token (`PairedClients.pair`, stored server-side by client-id; client stores it in `KnownServers` keyed by `host:port` with the fingerprint). On reconnect the client sends the token in its hello and is admitted with no prompt; a missing/invalid token just falls back to re-approval (never hard-fails). **Do not reintroduce hard cert-pinning or challenge-response** — the user explicitly wanted robust connections over maximum security.
 - **Performance monitoring** (`performance.py` + `preferences.py`): `PerformanceMonitor` is an opt-in collaborator (`performance=` on `ShareServer`/`ShareClient`, the `clipboard=` pattern — plain sharing tests leave it off). While admitted streams are attached, a 1 s QTimer samples `MessageStream.bytes_sent/bytes_received` counters into rolling `MetricSeries` (bandwidth, aggregated across streams via per-stream baselines) and pings **every** attached stream (each ping id maps to its stream; a pong is honored only on the stream it was sent to). The graphs' RTT series follow only the *active* (most recently admitted) stream; per-stream send/recv/RTT snapshots come from `metrics_for(stream)` and feed the Server tab's `ViewersTable` (`server.py`; it takes the monitor and follows the current ShareServer via `set_share_server`, empty when None), which joins them with `ShareServer.viewers()` — identity fields the client hello reports (`_client_details()`; `user`/`os` are displayed — `host` is still on the wire but not shown, since the display name defaults to the hostname; missing on old clients, shown as dashes). The ping is: `{"type": "ping", "id", "rtt"}` / `{"type": "pong", "id"}` — each side measures its own RTT and piggybacks it on its next ping so both ends graph both directions; peers without the feature ignore pings harmlessly (RTT graphs show "no data"). Ping/pong is admitted-streams-only on the server, like input/clipboard. The "Performance" tab (`PerformanceTab`, custom QPainter graphs, one per role sub-tab) schedules **no paint work while hidden** (gated on `isVisible()`, repaint on `showEvent`); the "Preferences" tab's history-window setting persists via the `Settings` store (`performance_window_seconds`, default 120). The monitor's timer runs only while streams are attached; all timing is `time.monotonic()` with an injectable `clock=` for tests — never monkeypatch `time.monotonic` (the test `pump()` helper depends on it).
-- **Clipboard sync is bidirectional** (`clipboard.py` `ClipboardSync`): client copy → server and server copy → all clients, as `{"type": "clipboard", "text"/"image_png"}` messages. It's opt-in — `ShareServer`/`ShareClient` take a `clipboard=` param and do nothing with clipboard if it's None, so only the GUI (and clipboard tests) enables it; **plain sharing/input tests must leave it off to avoid touching the real OS clipboard.** The app shares ONE `ClipboardSync` across both roles (one OS clipboard): a real local copy fans out to connected servers and own viewers; a peer-received payload records its signature before applying, so it never re-emits `changed` and cannot loop between the roles. Echo/loop prevention is by *content signature*, not just a guard flag, because Windows fires `QClipboard.dataChanged` asynchronously (after a flag would be cleared); image signatures hash canonical RGBA pixels so a re-encoded PNG round trip doesn't loop. Server only accepts clipboard from streams past the approval handshake. Tests use a `FakeClipboard(QObject)` with a `changed` signal and recording `apply()` so two independent clipboards exist in one process.
+- **Clipboard sync is bidirectional** (`clipboard.py` `ClipboardSync`): client copy → server and server copy → all clients, as `{"type": "clipboard", "text"/"image_png"/"files"}` messages. **Files sync by content**: a local file copy (Qt local-file URLs) ships `files: [{name, data-b64}, ...]` capped at `FILES_CAP_BYTES` (32 MB — the batch is one JSON message under the 64 MB protocol cap, sharing the stream's socket) with folders skipped; `apply` sanitizes names to their final component, writes a fresh batch dir under `default_files_dir()` (`%LOCALAPPDATA%\remotedesktop\clipboard`, injectable `files_dir=` for tests), purges older batches best-effort, and puts the written paths on the clipboard as URLs (CF_HDROP → Explorer paste works). When files are present they travel alone — text/image on the same clipboard entry is ignored on both ends. `ClipboardSync.status` feeds the Connection log with **problems only** (skipped folders, over-cap, disk errors); routine traffic is described by the transport's own status lines via `clipboard.describe_payload` (kinds + sizes, never content — e.g. "Sending clipboard to 1 viewer(s): 2 file(s) (1.3 MiB)"), so one copy produces one log line per direction. It's opt-in — `ShareServer`/`ShareClient` take a `clipboard=` param and do nothing with clipboard if it's None, so only the GUI (and clipboard tests) enables it; **plain sharing/input tests must leave it off to avoid touching the real OS clipboard.** The app shares ONE `ClipboardSync` across both roles (one OS clipboard): a real local copy fans out to connected servers and own viewers; a peer-received payload records its signature before applying, so it never re-emits `changed` and cannot loop between the roles. Echo/loop prevention is by *content signature*, not just a guard flag, because Windows fires `QClipboard.dataChanged` asynchronously (after a flag would be cleared); image signatures hash canonical RGBA pixels so a re-encoded PNG round trip doesn't loop, and file signatures hash names + contents (never paths) so the receiving side's temp copies don't loop either. Server only accepts clipboard from streams past the approval handshake. Tests use a `FakeClipboard(QObject)` with a `changed` signal and recording `apply()` so two independent clipboards exist in one process.
 - The package version lives only in `src/remotedesktop/__init__.py` (`__version__`); hatchling reads it from there (`[tool.hatch.version]`), so bump it in that one place. **Versioning is strict semver** (`compat.py`, using the `semver` package): major = client/server compatibility contract, minor = backward-compatible features, patch = bug fixes — bump the major when the wire protocol or behavior breaks older peers. Both sides compare majors on every connection (hello/welcome carry `app_version`) and show a strong warning on mismatch (server status log + ⚠ in the viewers table's Version column; client log + non-modal dialog + status-bar marker) but never block the connection. Peers too old to report a version produce no warning.
 - Widget tests need a `QApplication`; use the session-scoped `qapp` fixture in `tests/conftest.py`.
 

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remotedesktop
-Version: 1.9.3
+Version: 2.1.0
 Summary: Remote desktop app for Windows computers on the same LAN, with autodiscovery. View other computers and optionally share this one — screen, keyboard, mouse, and clipboard, without RDP or Microsoft authentication.
 Project-URL: Homepage, https://github.com/jamesabel/remotedesktop
 Project-URL: Repository, https://github.com/jamesabel/remotedesktop
@@ -16,6 +16,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: System :: Networking
 Requires-Python: >=3.14
 Requires-Dist: cryptography>=49.0.0
+Requires-Dist: humanize>=4.0
 Requires-Dist: platformdirs>=4.10.0
 Requires-Dist: pyside6>=6.11.1
 Requires-Dist: semver>=3.0
@@ -78,13 +79,13 @@ one-click *Forget* / *Revoke*, and the live connection log.
 - ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared, view only* and sharing becomes view-only, switchable live.
 - 🖲️ **Cursor shape mirroring** — the pointer is never burned into the captured frame; instead your own cursor takes the remote cursor's shape (an I-beam over text, resize arrows on a window edge), so it is always crisp and lag-free.
 - 🖼️ **View your way** — each connection scales to fit or shows the remote screen at 1:1 pixels with panning, and F11 goes full screen. While you type into a remote session every key is forwarded — F11 is the one key that stays local.
-- 📋 **Two-way clipboard** — text and images copied on either machine appear on the other; a Preferences toggle turns syncing off entirely.
+- 📋 **Two-way clipboard** — text, images, and files copied on either machine appear on the other (files up to 32 MB per copy, pasted as real local copies; folders aren't synced); a Preferences toggle turns syncing off entirely.
 - 📸 **Screen captures** — grab the remote screen at its full resolution and copy it to the clipboard or save it as a PNG, from the *Screen capture* panel buttons or the File menu.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
 - 🔐 **Honest lock-screen behavior** — a locked server tells viewers so with a clear on-screen notice instead of a frozen frame, and streaming resumes by itself once someone signs in at the machine (see [The Windows lock screen](#the-windows-lock-screen)).
 - 📊 **Built-in performance monitoring** — live bandwidth and round-trip-time graphs with window statistics (mean/min/max/p99/jitter), plus a per-viewer table on the server.
 - 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Connections that were open when the app closed are restored on the next start.
-- 🚀 **Hands-off operation** — optional start-at-login (per-user, no admin rights), close-to-tray while sharing (the screen stays available with the window closed), and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
+- 🚀 **Hands-off operation** — start-at-login (per-user, no admin rights) with a choice of minimized (the default and recommended — sharing resumes after a reboot with no clicks), normal, maximized, or not starting at all; close-to-tray while sharing (the screen stays available with the window closed); and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
 - 🗃️ **Persistent peer inventory** — a SQLite-backed history of every peer seen on the LAN, with one-click *Revoke* / *Forget*.
 - 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts, a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
 
@@ -209,10 +210,17 @@ still held down (a dragged button, a modifier key) is released
 automatically if the viewer disconnects or loses focus.
 
 **Clipboard.** Both sides watch their local clipboard via Qt and forward
-copies (text, or images as PNG) over the same connection. Echo loops are
-prevented by content signature — an image is hashed by its canonical
-pixels, so a PNG that makes a round trip through the OS clipboard and
-comes back re-encoded is still recognized and not sent again.
+copies (text, images as PNG, or files) over the same connection. A file
+copy ships the file *contents* — a path would be meaningless on another
+machine — capped at 32 MB per copy so a transfer never chokes the screen
+stream; the receiving side materializes the files in a scratch folder and
+puts them on its clipboard, so pasting in Explorer produces real local
+copies (only the newest received batch is kept on disk; folders are
+skipped). Echo loops are prevented by content signature — an image is
+hashed by its canonical pixels and files by their names and contents (not
+their paths), so content that makes a round trip through the OS clipboard
+and comes back re-encoded or re-homed is still recognized and not sent
+again.
 
 **Transport.** Each client talks to the server over a single TCP
 connection: TLS via the Windows schannel backend with a self-signed

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/pyproject.toml

@@ -16,6 +16,7 @@ classifiers = [
 ]
 dependencies = [
     "cryptography>=49.0.0",
+    "humanize>=4.0",
     "platformdirs>=4.10.0",
     "pyside6>=6.11.1",
     "semver>=3.0",
@@ -60,6 +61,12 @@ upload = false
 # run_on_startup deliberately NOT set: it would write an HKLM Run value named
 # "remotedesktop", colliding with the app's own HKCU autostart preference.
 
+[tool.ruff.lint]
+# CI runs the latest ruff (uvx). Ruff 0.16 expanded its default rule set
+# (I, UP, RUF, S, BLE, ...), which the codebase was never linted against —
+# pin the selection to the historical defaults so unrelated PRs stay green.
+select = ["E4", "E7", "E9", "F"]
+
 [tool.ty.environment]
 # The app targets Windows (SendInput via ctypes.windll); type-check as such
 # even when ty runs on a Linux CI runner.

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/readme.md

@@ -54,13 +54,13 @@ one-click *Forget* / *Revoke*, and the live connection log.
 - ⌨️🖱️ **Full input control** — mouse, wheel, and keyboard forwarding that is safe against interruptions: anything still held down is released on the server if the viewer loses focus or disconnects, so no stuck keys. Prefer eyes-only? Choose *Shared, view only* and sharing becomes view-only, switchable live.
 - 🖲️ **Cursor shape mirroring** — the pointer is never burned into the captured frame; instead your own cursor takes the remote cursor's shape (an I-beam over text, resize arrows on a window edge), so it is always crisp and lag-free.
 - 🖼️ **View your way** — each connection scales to fit or shows the remote screen at 1:1 pixels with panning, and F11 goes full screen. While you type into a remote session every key is forwarded — F11 is the one key that stays local.
-- 📋 **Two-way clipboard** — text and images copied on either machine appear on the other; a Preferences toggle turns syncing off entirely.
+- 📋 **Two-way clipboard** — text, images, and files copied on either machine appear on the other (files up to 32 MB per copy, pasted as real local copies; folders aren't synced); a Preferences toggle turns syncing off entirely.
 - 📸 **Screen captures** — grab the remote screen at its full resolution and copy it to the clipboard or save it as a PNG, from the *Screen capture* panel buttons or the File menu.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
 - 🔐 **Honest lock-screen behavior** — a locked server tells viewers so with a clear on-screen notice instead of a frozen frame, and streaming resumes by itself once someone signs in at the machine (see [The Windows lock screen](#the-windows-lock-screen)).
 - 📊 **Built-in performance monitoring** — live bandwidth and round-trip-time graphs with window statistics (mean/min/max/p99/jitter), plus a per-viewer table on the server.
 - 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Connections that were open when the app closed are restored on the next start.
-- 🚀 **Hands-off operation** — optional start-at-login (per-user, no admin rights), close-to-tray while sharing (the screen stays available with the window closed), and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
+- 🚀 **Hands-off operation** — start-at-login (per-user, no admin rights) with a choice of minimized (the default and recommended — sharing resumes after a reboot with no clicks), normal, maximized, or not starting at all; close-to-tray while sharing (the screen stays available with the window closed); and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
 - 🗃️ **Persistent peer inventory** — a SQLite-backed history of every peer seen on the LAN, with one-click *Revoke* / *Forget*.
 - 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts, a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
 
@@ -185,10 +185,17 @@ still held down (a dragged button, a modifier key) is released
 automatically if the viewer disconnects or loses focus.
 
 **Clipboard.** Both sides watch their local clipboard via Qt and forward
-copies (text, or images as PNG) over the same connection. Echo loops are
-prevented by content signature — an image is hashed by its canonical
-pixels, so a PNG that makes a round trip through the OS clipboard and
-comes back re-encoded is still recognized and not sent again.
+copies (text, images as PNG, or files) over the same connection. A file
+copy ships the file *contents* — a path would be meaningless on another
+machine — capped at 32 MB per copy so a transfer never chokes the screen
+stream; the receiving side materializes the files in a scratch folder and
+puts them on its clipboard, so pasting in Explorer produces real local
+copies (only the newest received batch is kept on disk; folders are
+skipped). Echo loops are prevented by content signature — an image is
+hashed by its canonical pixels and files by their names and contents (not
+their paths), so content that makes a round trip through the OS clipboard
+and comes back re-encoded or re-homed is still recognized and not sent
+again.
 
 **Transport.** Each client talks to the server over a single TCP
 connection: TLS via the Windows schannel backend with a self-signed

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/src/remotedesktop/__init__.py

@@ -1,3 +1,3 @@
 """Remote desktop client/server for Windows computers on the same LAN."""
 
-__version__ = "1.9.3"
+__version__ = "2.1.0"

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/src/remotedesktop/about.py

@@ -1,15 +1,21 @@
-"""The "About" tab of the app window.
+"""The "About" dialog (Help ▸ About).
 
 Shows the same metadata the PyPI page shows — summary, author, license,
 Python requirement, links — read from the installed package's metadata via
-importlib.metadata, with static fallbacks so the tab still renders in odd
+importlib.metadata, with static fallbacks so the page still renders in odd
 environments (the version always comes from `remotedesktop.__version__`,
 the single source hatchling packages)."""
 
 from importlib import metadata
 
 from PySide6.QtCore import Qt
-from PySide6.QtWidgets import QLabel, QVBoxLayout, QWidget
+from PySide6.QtWidgets import (
+    QDialog,
+    QDialogButtonBox,
+    QLabel,
+    QVBoxLayout,
+    QWidget,
+)
 
 from remotedesktop import __version__, icon
 
@@ -36,7 +42,7 @@ def _field(name: str) -> str:
     return str(value) if value else _FALLBACKS.get(name, "")
 
 
-class AboutTab(QWidget):
+class AboutPage(QWidget):
     """Package metadata as a rich-text page with clickable links."""
 
     def __init__(self, parent: QWidget | None = None) -> None:
@@ -70,3 +76,27 @@ class AboutTab(QWidget):
         layout.addWidget(logo)
         layout.addWidget(body)
         layout.addStretch(1)
+
+
+class AboutDialog(QDialog):
+    """Help ▸ About: the AboutPage in a modeless dialog with a Close button.
+
+    Modeless on purpose — like the rest of the app it stays usable from a
+    remote session, and it must never block streaming or approval prompts.
+    The window keeps one instance and re-shows it (`open_`).
+    """
+
+    def __init__(self, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self.setWindowTitle("About Remote Desktop")
+        buttons = QDialogButtonBox(QDialogButtonBox.StandardButton.Close)
+        buttons.rejected.connect(self.close)
+        layout = QVBoxLayout(self)
+        layout.addWidget(AboutPage(self))
+        layout.addWidget(buttons)
+
+    def open_(self) -> None:
+        """Show (or re-raise) the dialog, modeless."""
+        self.show()
+        self.raise_()
+        self.activateWindow()

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/src/remotedesktop/app.py

@@ -43,7 +43,7 @@ from PySide6.QtWidgets import (
 )
 
 from remotedesktop import __version__, compat, db, icon, logs, window_state
-from remotedesktop.about import AboutTab
+from remotedesktop.about import AboutDialog
 from remotedesktop.autostart import Autostart, installed_launcher
 from remotedesktop.client import DiscoveryPanel, ServerSession
 from remotedesktop.clipboard import ClipboardSync
@@ -162,6 +162,7 @@ class MainWindow(QMainWindow):
         # persisted Preferences opt-out applies from the first moment.
         self._clipboard = ClipboardSync(parent=self)
         self._clipboard.enabled = load_clipboard_sync_enabled(self._settings)
+        self._clipboard.status.connect(self.log)
         self._known_servers = KnownServers(self._db)
         self._identity = load_client_identity(self._db)
         self._tray_available = (
@@ -381,11 +382,14 @@ class MainWindow(QMainWindow):
         self.preferences_tab.viewerModeChanged.connect(self._set_viewer_enabled)
         self.preferences_tab.reduceEffectsChanged.connect(self._on_reduce_effects_changed)
         self.preferences_tab.restart_button.clicked.connect(self._restart_app)
-        self._tabs.addTab(self.preferences_tab, "Preferences")
-        self._about_tab = AboutTab()
-        self._tabs.addTab(self._about_tab, "About")
-        # Only session tabs are closable; strip the buttons the fixed tabs
-        # got from setTabsClosable (styles place them on either side).
+        # Preferences is an on-demand closable tab (File ▸ Preferences…):
+        # the widget exists from startup — its constructor and signal wiring
+        # drive the roles — but it only occupies the tab bar while open.
+        # About is a Help-menu dialog; one instance, re-shown.
+        self._about_dialog = AboutDialog(self)
+        # Only session tabs (and the on-demand Preferences tab) are closable;
+        # strip the buttons the fixed tabs got from setTabsClosable (styles
+        # place them on either side).
         bar = self._tabs.tabBar()
         for index in range(self._tabs.count()):
             for side in (QTabBar.ButtonPosition.LeftSide, QTabBar.ButtonPosition.RightSide):
@@ -454,6 +458,10 @@ class MainWindow(QMainWindow):
         self.save_capture_action.triggered.connect(self._save_screen_capture)
         self.save_capture_action.setEnabled(False)
         self._file_menu.addSeparator()
+        self.preferences_action = self._file_menu.addAction("&Preferences…")
+        self.preferences_action.setShortcut(QKeySequence("Ctrl+,"))
+        self.preferences_action.triggered.connect(self._open_preferences)
+        self._file_menu.addSeparator()
         self.quit_action = self._file_menu.addAction("&Quit")
         self.quit_action.setShortcut(QKeySequence("Ctrl+Q"))
         self.quit_action.triggered.connect(self._quit)
@@ -480,9 +488,7 @@ class MainWindow(QMainWindow):
         self.fullscreen_action.triggered.connect(self._toggle_fullscreen)
         self._help_menu = bar.addMenu("&Help")
         self.about_action = self._help_menu.addAction("&About")
-        self.about_action.triggered.connect(
-            lambda: self._tabs.setCurrentWidget(self._about_tab)
-        )
+        self.about_action.triggered.connect(self._about_dialog.open_)
         # Register shortcut actions on the window itself so they keep firing
         # when the menu bar is hidden (fullscreen). While a viewer has a
         # frame and focus, its ShortcutOverride handling forwards these keys
@@ -492,6 +498,7 @@ class MainWindow(QMainWindow):
             self.quit_action,
             self.refresh_action,
             self.fullscreen_action,
+            self.preferences_action,
         ):
             self.addAction(action)
 
@@ -506,7 +513,8 @@ class MainWindow(QMainWindow):
             "<p>Double-click one — or select it and click <b>Connect</b> — "
             "and this tab becomes your view of that computer.</p>"
             "<p>To make a computer appear in the list, enable "
-            "<b>Server (sharing)</b> in the Preferences tab on that computer.</p>"
+            "<b>Server (sharing)</b> under File&nbsp;▸&nbsp;Preferences on "
+            "that computer.</p>"
         )
         label.setAlignment(Qt.AlignmentFlag.AlignCenter)
         label.setWordWrap(True)
@@ -616,7 +624,9 @@ class MainWindow(QMainWindow):
         if getattr(self, "close_tab_action", None) is None:
             return  # menus are built after the tabs
         session = self._session_for_page(self._tabs.currentWidget())
-        self.close_tab_action.setEnabled(session is not None)
+        self.close_tab_action.setEnabled(
+            session is not None or self._tabs.currentWidget() is self.preferences_tab
+        )
         self.fullscreen_action.setEnabled(session is not None)
         self.actual_size_action.setEnabled(session is not None)
         self.actual_size_action.setChecked(session.actual_size if session else False)
@@ -689,8 +699,25 @@ class MainWindow(QMainWindow):
         else:
             self.log(f"Could not save the screen capture to {path}")
 
+    def _open_preferences(self) -> None:
+        """File ▸ Preferences…: show the on-demand closable Preferences tab."""
+        if self._tabs.indexOf(self.preferences_tab) == -1:
+            self._tabs.addTab(self.preferences_tab, "Preferences")
+        self._tabs.setCurrentWidget(self.preferences_tab)
+
+    def _close_preferences_tab(self) -> None:
+        # removeTab never deletes the widget; the window keeps the reference
+        # (and all its signal wiring) for the next _open_preferences.
+        index = self._tabs.indexOf(self.preferences_tab)
+        if index != -1:
+            self._tabs.removeTab(index)
+
     def _close_current_session_tab(self) -> None:
-        session = self._session_for_page(self._tabs.currentWidget())
+        current = self._tabs.currentWidget()
+        if current is self.preferences_tab:
+            self._close_preferences_tab()
+            return
+        session = self._session_for_page(current)
         if session is not None:
             self._close_session(session)
 
@@ -1209,7 +1236,9 @@ class MainWindow(QMainWindow):
         self._sessions_source.notify()
 
     def _on_tab_close_requested(self, index: int) -> None:
-        if index < len(self._sessions):  # fixed tabs carry no close button
+        if self._tabs.widget(index) is self.preferences_tab:
+            self._close_preferences_tab()
+        elif index < len(self._sessions):  # fixed tabs carry no close button
             self._close_session(self._sessions[index])
 
     def _on_approval_pending(self, session: ServerSession) -> None:
@@ -1395,7 +1424,10 @@ class MainWindow(QMainWindow):
 
 
 def main() -> None:  # pragma: no cover - runs the Qt event loop
+    # The autostart registration passes one of these per the start mode
+    # chosen in Preferences (no flag means a normal window).
     minimized = "--minimized" in sys.argv[1:]
+    maximized = "--maximized" in sys.argv[1:]
     log_path = logs.init_logging("remotedesktop")
     icon.set_windows_app_id("remotedesktop")
     app = QApplication(sys.argv)
@@ -1407,13 +1439,17 @@ def main() -> None:  # pragma: no cover - runs the Qt event loop
     if not guard.acquire():
         # The running instance was asked to show itself; nothing to do here.
         raise SystemExit(0)
-    Autostart().migrate_legacy()  # pre-1.0 server-only registration
     window = MainWindow()
     guard.activateRequested.connect(window.bring_to_front)
     window.log(f"Detailed log: {log_path}")
     if minimized and window.sharing_tab.serving and window._tray is not None:
         # Login-started while sharing: live in the tray until summoned.
         window._tray_notified = True  # no balloon for a start nobody clicked
+    elif minimized:
+        # Not sharing (or no tray): a minimized window on the taskbar.
+        window.showMinimized()
+    elif maximized:
+        window.showMaximized()
     else:
         window.show()
     raise SystemExit(app.exec())

{remotedesktop-1.9.3 → remotedesktop-2.1.0}/src/remotedesktop/autostart.py

@@ -2,13 +2,13 @@
 
 Uses the per-user Run registry key (HKCU), so no administrator rights are
 needed and the app starts in the interactive session — which it needs,
-because approving a new client is a GUI prompt. Login-started instances get
-`--minimized`, so an instance that is sharing goes straight to the tray.
-On non-Windows platforms this is an inert stub, like input injection.
-
-Installations upgraded from the separate server app may still carry the old
-"remotedesktop-server" Run value; `migrate_legacy()` (called once at app
-startup) moves that registration to the new value name and command.
+because approving a new client is a GUI prompt. The registration is one of
+four *start modes*: minimized (the default and recommended — a sharing
+instance goes straight to the tray), a normal window, maximized, or off
+(no registration). The mode is encoded in the registered command line
+(`--minimized`, no flag, `--maximized`), so the Run value alone says what
+happens at login. On non-Windows platforms this is an inert stub, like
+input injection.
 """
 
 import re
@@ -21,7 +21,20 @@ if _IS_WINDOWS:
 
 _RUN_KEY = r"Software\Microsoft\Windows\CurrentVersion\Run"
 _VALUE_NAME = "remotedesktop"
-_LEGACY_VALUE_NAME = "remotedesktop-server"  # the pre-1.0 server-only app
+
+# How (and whether) the app starts at login.
+START_MINIMIZED = "minimized"  # the default and recommended mode
+START_NORMAL = "normal"
+START_MAXIMIZED = "maximized"
+START_OFF = "off"
+START_MODES = (START_MINIMIZED, START_NORMAL, START_MAXIMIZED, START_OFF)
+
+# The command-line suffix that makes a login-started instance open that way.
+_MODE_FLAGS = {
+    START_MINIMIZED: " --minimized",
+    START_NORMAL: "",
+    START_MAXIMIZED: " --maximized",
+}
 
 # A pyship CLIP directory: <install dir>\remotedesktop_<version>\pythonw.exe.
 _CLIP_DIR_RE = re.compile(r"remotedesktop_\d+(\.\d+)*", re.IGNORECASE)
@@ -42,16 +55,17 @@ def installed_launcher() -> Path | None:
     return None
 
 
-def app_command() -> str:
+def app_command(mode: str = START_MINIMIZED) -> str:
     """The command line that launches this installation at login."""
+    flag = _MODE_FLAGS[mode]
     launcher = installed_launcher()
     if launcher is not None:
-        return f'"{launcher}" --minimized'
+        return f'"{launcher}"{flag}'
     exe = Path(sys.executable).with_name("remotedesktop.exe")  # venv Scripts dir
     if exe.exists():
-        return f'"{exe}" --minimized'
+        return f'"{exe}"{flag}'
     # Fallback (e.g. running from source without the entry-point exe).
-    return f'"{sys.executable}" -m remotedesktop --minimized'
+    return f'"{sys.executable}" -m remotedesktop{flag}'
 
 
 class Autostart:
@@ -65,20 +79,18 @@ class Autostart:
         *,
         key_path: str = _RUN_KEY,
         value_name: str = _VALUE_NAME,
-        legacy_value_name: str = _LEGACY_VALUE_NAME,
     ) -> None:
         self.available = _IS_WINDOWS
         self._key_path = key_path
         self._value_name = value_name
-        self._legacy_value_name = legacy_value_name
 
-    def _has_value(self, value_name: str) -> bool:
+    def _read_value(self, value_name: str) -> str | None:
         try:
             with winreg.OpenKey(winreg.HKEY_CURRENT_USER, self._key_path) as key:
-                winreg.QueryValueEx(key, value_name)
-            return True
+                value, _kind = winreg.QueryValueEx(key, value_name)
+            return str(value)
         except OSError:
-            return False
+            return None
 
     def _delete_value(self, value_name: str) -> None:
         try:
@@ -89,30 +101,24 @@ class Autostart:
         except OSError:
             pass  # already not registered
 
-    def is_enabled(self) -> bool:
+    def mode(self) -> str:
+        """The registered start mode, read back from the Run value's flag."""
         if not self.available:
-            return False
-        return self._has_value(self._value_name)
-
-    def set_enabled(self, enabled: bool) -> None:
+            return START_OFF
+        command = self._read_value(self._value_name)
+        if command is None:
+            return START_OFF
+        if command.endswith("--minimized"):
+            return START_MINIMIZED
+        if command.endswith("--maximized"):
+            return START_MAXIMIZED
+        return START_NORMAL
+
+    def set_mode(self, mode: str) -> None:
         if not self.available:
             return
-        if enabled:
-            with winreg.CreateKey(winreg.HKEY_CURRENT_USER, self._key_path) as key:
-                winreg.SetValueEx(key, self._value_name, 0, winreg.REG_SZ, app_command())
-            self._delete_value(self._legacy_value_name)  # never leave both
-        else:
+        if mode == START_OFF:
             self._delete_value(self._value_name)
-
-    def migrate_legacy(self) -> None:
-        """Move a pre-1.0 "remotedesktop-server" registration to this app.
-
-        Best-effort: a registry failure must never block startup.
-        """
-        if not self.available:
             return
-        try:
-            if self._has_value(self._legacy_value_name):
-                self.set_enabled(True)
-        except OSError:
-            pass
+        with winreg.CreateKey(winreg.HKEY_CURRENT_USER, self._key_path) as key:
+            winreg.SetValueEx(key, self._value_name, 0, winreg.REG_SZ, app_command(mode))