remotedesktop 2.1.0__tar.gz → 2.2.0__tar.gz

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/CLAUDE.md

@@ -78,14 +78,14 @@ Managed with `uv` (hatchling build backend, src layout):
 - **The sharing lifecycle** (`server.py` `SharingTab`) lives on the "Connections" tab, arranged as one outer QGroupBox per role, side by side as widgets with "Connection log" full-width below: "Client (viewer)" (left; nests "Connected servers" — `app._SessionsTable`, the client-side twin of the viewers table fed by `_ConnectedServersSource` from the live sessions and `client_performance` — over "Server history", client-role inventory, Forget) and "Server (sharing)" (right; the `SharingTab` summary + viewers table over "Client history", server-role inventory, Revoke). **Each role box is visible only while its role is on** (`_update_connections_groups`); boxes are widgets (not column layouts) so a hidden role frees its space and the other starts at the left edge. **The mode itself is chosen in Preferences**: a three-state radio group (`preferences.py`, `sharingModeChanged` signal) wired by `MainWindow` to `SharingTab.set_mode("off"/"view"/"control")` — `server.py` exposes `SHARING_MODE_*` constants and `load_sharing_mode(settings)`, persisted as the single `sharing_mode` key. View ↔ control switches apply live (`ShareServer.set_input_allowed`) without dropping viewers; off/on tears down / creates the `ShareServer` + `DiscoveryResponder` (a fresh `ShareServer` per enable; `close()` leaves teardown state), so a viewing-only instance binds no ports and never creates TLS credentials (loaded lazily on first enable). The host window calls `restore_sharing()` after wiring `statusMessage`/`peerEvent`/`sharingChanged`, so no startup status message is emitted before anyone listens. `serving` is mode-on AND actually listening. `revoke_client` works even while not sharing (direct `PairedClients.revoke`). The Restart app button also lives in Preferences (`preferences_tab.restart_button` → `MainWindow._restart_app`).
 - **Tray + lifecycle** (`app.py`): while sharing, closing the window hides to a `QSystemTrayIcon` (menu: Show / Restart / Quit) and sharing continues; not sharing → close quits. `main()` sets `setQuitOnLastWindowClosed(False)`, so **every exit path must reach `QApplication.quit()`** (plain close, tray Quit, restart). `tray_available=` is injectable — tests always pass an explicit value and never call `isSystemTrayAvailable()`. `--minimized` starts hidden in the tray when sharing is on, otherwise minimized; `--maximized` starts maximized. `single_instance.py` (`SingleInstance`, QLocalServer-based) enforces one instance per user session; a second launch tells the first to `bring_to_front()` and exits. **Start at login is a four-way start mode** (`autostart.py` `START_MINIMIZED/NORMAL/MAXIMIZED/OFF`): Preferences radios persist it as `autostart_mode` (`load_autostart_mode`, default **minimized** — the recommended setting) and `PreferencesTab` mirrors it into the HKCU Run value `"remotedesktop"` at every construction, so the start-minimized default takes effect on a fresh install and the registered path follows the current installation. The mode is encoded in the registered command's flag (`--minimized` / none / `--maximized`; no value = off, `Autostart.mode()` reads it back). Tests always inject `Autostart(key_path=...)` pointed at an isolated test key — a real `Autostart` in a test would rewrite the developer's actual Run key at tab construction.
 - The remote desktop view is a widget, `ViewerWidget` in `src/remotedesktop/viewer.py`. Screen display and keyboard/mouse/clipboard forwarding belong in this widget, not in the window. **Multiple simultaneous server connections**: each is a `ServerSession` in `client.py` (its own `ShareClient` + `ViewerWidget`, hosted in a `QScrollArea` tab page — `session.page` is the tab widget, `session.viewer` the viewer), shown as a closable tab at the front of `MainWindow`'s central `QTabWidget`, titled with the server's reported hostname (fixed tabs get their close buttons stripped). Fit mode is `widgetResizable(True)`; **View → Actual size** flips the page to non-resizable and the viewer sizes itself to `frame / devicePixelRatio` (1:1 device pixels, the no-resample paint branch; input mapping unchanged because the frame fills the widget). Sessions are keyed by `host:port`; activating an already-known server reconnects in its existing tab, activating a connected one just focuses it. The window title lists the connected server names and a "— sharing" suffix while serving (`_update_window_title`); the status bar's message area follows the currently selected session tab (`status_text` per session) and a permanent right-side label shows "Sharing — N viewer(s)" whenever sharing is on (driven by `SharingTab.viewerCountChanged`). The `ClipboardSync`, inventories, and Connection log are shared across sessions; `client_performance.reset()` is only called when no *other* session is connected (resetting detaches every stream). Per-session status log lines are prefixed `[name]`.
-- **Auto-reconnect** (`app.py`): a session that *was connected* and drops retries `client.connect_to` with exponential backoff (base `reconnect_base_seconds=2.0` kwarg — tests inject ~0.05 — doubling to a 30 s cap), driven by a per-session single-shot QTimer. `ShareClient.connectionFailed` exists because **Qt emits `disconnected` only for sockets that reached ConnectedState** — refused/unreachable attempts fire `errorOccurred` with the socket back in UnconnectedState. The active-timer guard dedupes the errorOccurred+disconnected double-fire. Denial cancels until a manual activation; tab close/forget/quit cancel; retries bypass `_connect_session` on purpose (no perf reset, no tab steal, no inventory attempt spam). **Open session tabs persist** (`open_sessions` JSON in Settings, written on connect/rename/close) and are restored + reconnected at startup with `auto_reconnect` pre-armed, so a not-yet-available server is retried on the backoff loop; deliberately closed tabs are not restored. While no session exists, a non-closable "Server" placeholder tab (instructions) sits at index 0 and swaps with the first session's tab.
+- **Auto-reconnect** (`app.py`): a session that *was connected* and drops retries `client.connect_to` with exponential backoff (base `reconnect_base_seconds=2.0` kwarg — tests inject ~0.05 — doubling to a 30 s cap), driven by a per-session single-shot QTimer. `ShareClient.connectionFailed` exists because **Qt emits `disconnected` only for sockets that reached ConnectedState** — refused/unreachable attempts fire `errorOccurred` with the socket back in UnconnectedState. The active-timer guard dedupes the errorOccurred+disconnected double-fire. Denial cancels until a manual activation; tab close/forget/quit cancel; retries bypass `_connect_session` on purpose (no perf reset, no tab steal, no inventory attempt spam). **Re-discovery follows a moved server**: sessions, tokens, and pins are all keyed by `host:port`, so a DHCP address change across a server reboot would otherwise strand every retry — once `_REDISCOVER_AFTER_ATTEMPTS` (2) direct attempts have failed, each further failure also runs a discovery scan on a worker thread (`rediscover=` kwarg — tests inject a fake, `make_window` defaults it to a no-op so window tests never broadcast; result delivered via the queued `_rediscoveryFinished` signal). A scanned server matching the session's pinned cert fingerprint (discovery replies advertise it as `fp`; display-name match is the fallback for servers too old to send one) at a *different* address migrates the session: the `KnownServers` record is re-keyed (token preserved — no re-approval), the inventory row moves, sessions re-persist, and the connect is immediate with a fresh backoff. This is not background polling — it runs only while a session is failing to reconnect. **Open session tabs persist** (`open_sessions` JSON in Settings, written on connect/rename/close) and are restored + reconnected at startup with `auto_reconnect` pre-armed, so a not-yet-available server is retried on the backoff loop; deliberately closed tabs are not restored. While no session exists, a non-closable "Server" placeholder tab (instructions) sits at index 0 and swaps with the first session's tab.
 - **Menus & shortcuts contract** (`app.py` `_build_menus`, `viewer.py`): File/View/Help menu bar; shortcuts Ctrl+W (close the current session tab or the Preferences tab), Ctrl+, (Preferences), Ctrl+Q (quit), F5 (rescan), F11 (fullscreen). **Preferences and About are not pinned tabs**: File ▸ Preferences… shows `preferences_tab` as an on-demand *closable* tab (the widget is built once at startup — its constructor and signal wiring drive the roles — and `removeTab` on close keeps it alive for the next open); Help ▸ About shows the single modeless `about.AboutDialog` instance (`_about_dialog`, wrapping `AboutPage`). While a viewer shows a frame it **accepts `ShortcutOverride`** so every key forwards to the remote machine — **F11 is the single reserved local key**. Shortcut actions are also `addAction`-ed on the window so they fire with the menu bar hidden (fullscreen). Keep every menu/action as an attribute — PySide6 gives Python ownership of `addMenu`/`addAction` (and `QAction.menu()`) wrappers, and a GC'd local deletes the C++ object. Fullscreen hides menu/status bars, dock, and tab bar and restores them (including pre-fullscreen dock visibility) on exit; `closeEvent` exits fullscreen before persisting layout. Window geometry AND dock layout persist (`window_state.save_state`/`restore_state`, key `main_window_state`; the dock needs its objectName).
 - **Privacy toggles**: Preferences' "Sync clipboard" checkbox (`clipboard_sync_enabled`, default on) drives `ClipboardSync.enabled` — while off, local copies aren't sent and peer payloads aren't applied. View-only sharing is the "view" mode of the Screen sharing radios (`ShareServer.set_input_allowed` — a server-side drop, no wire change, that releases held input when switched off). Quitting with ≥1 viewer connected asks for confirmation (declining resets `_quitting`); restart shuts sharing down first so it never double-prompts.
 - **Screen capture** (`app.py`): the dock's "Screen capture" group (Copy / Save…, viewer-role UI hidden with the panel) and the matching File-menu actions (`copy_capture_action`/`save_capture_action`, same handlers) capture the current session tab's last frame at full server resolution (`ViewerWidget.frame_image()` — the lock overlay is display-only and never part of it). Copy goes through `ClipboardSync.copy_image`, which records the content signature *before* setting the clipboard so the capture is never echoed to peers, and works with sync disabled (the preference governs syncing, not local copies). Save is `QFileDialog.getSaveFileName` (tests monkeypatch it) defaulting to `Pictures\<server> <timestamp>.png`, PNG only. All four widgets enable only while the current tab shows a frame — `_update_capture_actions()`, called from tab change, `_on_frame` (unconditionally: auto-reconnect refills a cleared viewer without `_connect_session`), and every `viewer.clear` path (connect/denied/approval-pending/disconnect).
 - **Reduce visual effects while sharing** (`visual_effects.py`): animations/fades are a burst of changed frames for the lossless pipeline, so while the preference is on (default on, `reduce_effects_enabled`, `load_reduce_effects_enabled`) **and ≥1 viewer is connected**, `MainWindow` applies `VisualEffectsReducer` and restores it when the last viewer leaves (driven by `SharingTab.viewerCountChanged`; explicit safety-net restore in `closeEvent`). The reduced set: SPI_SETUIEFFECTS off, drop shadows off, client-area + min/max animations off, submenu delay lowered to 50 ms (never raised). All via `SystemParametersInfo` **without** SPIF_UPDATEINIFILE — session-scoped, never persisted, self-heals at logoff; knobs already at the reduced value are left untouched so the user's own choices are never "restored" over. The backend (`SpiBackend`) is injectable — **tests must always inject `FakeSpiBackend`** (the preference defaults on, so a real reducer in a test would change the host's actual Windows settings; `make_window` in `tests/test_main_window.py` injects it for every window test, and real-backend tests may only read).
 - **Theme preference** (`preferences.py`): a three-radio group in Preferences — follow the Windows light/dark setting (default) / Light / Dark — persisted as `THEME_KEY` (`"system"`/`"light"`/`"dark"`, `load_theme` falls back to system on junk). `apply_theme` drives `QStyleHints.setColorScheme` (`unsetColorScheme` for system, so OS-side switches keep applying); the radios apply live and `MainWindow.__init__` re-applies the persisted choice before building widgets. Tests that set a non-system theme must restore with `apply_theme(THEME_SYSTEM)` — the color scheme is process-global QApplication state.
 - **Two `PerformanceMonitor`s, never one**: `MainWindow.client_performance` (viewing sessions) and `server_performance` (the SharingTab's viewers). `ShareServer.close()` resets its monitor, so sharing a monitor across roles would wipe the other role's graphs. The Performance tab has "Client (viewer)"/"Server (sharing)" sub-tabs (`MainWindow.performance_pages`) — but only for roles that can produce data: the client sub-tab exists only with the viewer role, the server one only while actually serving (`_update_performance_tabs`, driven from the viewer toggle and `sharingChanged`; both off shows an enable-a-role hint). `PreferencesTab` takes the list of monitors and applies the history-window setting to all.
-- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}`; datagrams with the wrong magic/version/type are dropped. **Scan robustness**: probes are re-sent every `_PROBE_INTERVAL` (0.3 s) for the whole scan window (a lost broadcast only delays discovery), ICMP port-unreachable resets never abort the scan (Windows `SIO_UDP_CONNRESET` ioctl + `ConnectionResetError` → continue), and the panel passes `client._broadcast_hosts()` — 255.255.255.255 plus every up non-loopback interface's directed broadcast, because Windows routes the limited broadcast out only one interface (VPN/virtual adapters made scans come up empty). A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
+- **Autodiscovery** (`src/remotedesktop/discovery.py`) is a stdlib-only UDP probe/response protocol, deliberately not mDNS: the client broadcasts a JSON probe to `DISCOVERY_PORT` (48653) and servers reply with `{name, port}` plus an optional `fp` — the server's TLS cert fingerprint (`ServerInfo.fingerprint`, empty when absent; junk `fp` is blanked, never drops the reply), the stable identity auto-reconnect re-discovery matches on; datagrams with the wrong magic/version/type are dropped. **Scan robustness**: probes are re-sent every `_PROBE_INTERVAL` (0.3 s) for the whole scan window (a lost broadcast only delays discovery), ICMP port-unreachable resets never abort the scan (Windows `SIO_UDP_CONNRESET` ioctl + `ConnectionResetError` → continue), and the panel passes `client._broadcast_hosts()` — 255.255.255.255 plus every up non-loopback interface's directed broadcast, because Windows routes the limited broadcast out only one interface (VPN/virtual adapters made scans come up empty). A sharing instance runs a `DiscoveryResponder` thread while sharing is enabled; the `DiscoveryPanel` (dock in `MainWindow`) calls the blocking `discover_servers()` on a worker thread and delivers results to the GUI via a queued signal. With `auto_scan=True` (the app; tests default to False and never broadcast) it scans **once at startup only** — further scans happen only on manual Refresh/F5 (deliberately no periodic background scanning; the user asked for this), guarded against overlapping scans and preserving the selection across repopulation; it also has a Connect button, a right-click Connect menu, and an empty-state hint. The "(this computer)" entry is not connectable (Connect disabled, activation swallowed, plus a `MainWindow._on_server_activated` guard). `DEFAULT_CONNECT_PORT` is 48654. An instance that shares and scans discovers itself — `DiscoveryPanel`'s `is_self=` callable labels that entry "(this computer)" (never hidden).
 - Discovery tests run over loopback with ephemeral ports (`bind_host`/`discovery_port`/`broadcast_hosts` parameters exist for this), so they never touch the real LAN or fixed ports.
 - **Screen sharing** (`sharing.py` + `protocol.py` + `frames.py`) runs entirely on the Qt event loop — no threads or locks. `MessageStream` frames messages over a QTcpSocket (4-byte length + kind byte; JSON control messages, full frames, or inter-frame deltas; malformed input aborts the socket). `ShareServer` owns one QTimer that grabs the primary screen at full resolution via `_capture()` (a seam tests override to drive deterministic frame content) and fans out to all clients, skipping clients whose send buffer is backlogged; the timer only runs while clients are connected. Capture is DXGI desktop duplication (`dxgi.py`, hand-rolled ctypes COM — ~10 ms per changed 4K frame, ~0 when idle, and "unchanged" is signalled by returning the same QImage object so the diff is skipped) with automatic fallback to `QScreen.grabWindow` (~96 ms) whenever duplication is unavailable or lost (secure desktop, RDP, display-mode change, CI); unit tests fake the duplication (`FakeDuplication` in `tests/test_dxgi.py`) and the real-hardware test skips where DXGI is unavailable. **Frame transfer is lossless and inter-frame compressed** (`frames.py`): consecutive captures are diffed in 64-row bands (memoryview compares), and only changed bands ship as PNG in a delta payload the client patches onto its previous frame; an unchanged screen sends nothing. Full PNG keyframes go to clients that just joined, just recovered from a send backlog, or requested one (a `{"type": "keyframe"}` message — sent when a delta fails to apply, so desync self-heals). Every client is assumed delta-capable (no negotiation). Each variant (keyframe PNG / delta) is encoded at most once per tick and shared across clients. `ShareClient` decodes/patches to QImage for the viewer, which displays it scaled with a cached `SmoothTransformation` copy (full resolution is always delivered; scaling happens client-side only).
 - **All persistence is one SQLite database** (`db.py`): `db.connect(path)` opens the DB and ensures every table (`settings`, `paired_clients`, `known_servers`, and the inventory tables). The file lives at `config.default_db_path()` — `platformdirs.user_data_dir("remotedesktop")` (`%LOCALAPPDATA%\remotedesktop\remotedesktop.db` on Windows). **Use `platformdirs` for any new data location; don't hardcode `%APPDATA%`.** Every store (`Settings`, `PairedClients`, `KnownServers`, `ConnectionInventory`) takes a `sqlite3.Connection`; the app opens one connection and shares it. **Boolean settings go through `Settings.get_bool`/`set_bool`** (the `tobool` package's `to_bool_strict`; on-disk form stays the historical `"1"`/`"0"`, junk falls back to the caller's default) — don't hand-roll `!= "0"` comparisons. This applies to binary values stored as strings/ints; ctypes Win32 `BOOL`s keep plain `bool()` (TRUE is "any nonzero", which strict parsing correctly refuses). `MainWindow` takes a `connection=` keyword so tests inject a temp-file DB and never touch the real one (see `tests/test_main_window.py` / `test_sharing_tab.py`). Tests pass `db.connect(tmp_path/"x.db")` (or omit for in-memory), and use **separate DB files per simulated machine**.

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: remotedesktop
-Version: 2.1.0
+Version: 2.2.0
 Summary: Remote desktop app for Windows computers on the same LAN, with autodiscovery. View other computers and optionally share this one — screen, keyboard, mouse, and clipboard, without RDP or Microsoft authentication.
 Project-URL: Homepage, https://github.com/jamesabel/remotedesktop
 Project-URL: Repository, https://github.com/jamesabel/remotedesktop
@@ -84,10 +84,10 @@ one-click *Forget* / *Revoke*, and the live connection log.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
 - 🔐 **Honest lock-screen behavior** — a locked server tells viewers so with a clear on-screen notice instead of a frozen frame, and streaming resumes by itself once someone signs in at the machine (see [The Windows lock screen](#the-windows-lock-screen)).
 - 📊 **Built-in performance monitoring** — live bandwidth and round-trip-time graphs with window statistics (mean/min/max/p99/jitter), plus a per-viewer table on the server.
-- 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Connections that were open when the app closed are restored on the next start.
+- 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Even a server that comes back on a **different IP address** (a new DHCP lease after a reboot) is found again: reconnection re-scans the LAN, recognizes the server by its certificate identity, and follows it to the new address — pairing intact, so still no prompt. Connections that were open when the app closed are restored on the next start.
 - 🚀 **Hands-off operation** — start-at-login (per-user, no admin rights) with a choice of minimized (the default and recommended — sharing resumes after a reboot with no clicks), normal, maximized, or not starting at all; close-to-tray while sharing (the screen stays available with the window closed); and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
 - 🗃️ **Persistent peer inventory** — a SQLite-backed history of every peer seen on the LAN, with one-click *Revoke* / *Forget*.
-- 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts, a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
+- 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts (Preferences on *File ▸ Preferences*, Ctrl+,; About on the Help menu), a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
 
 In scope: screen, keyboard, mouse, and clipboard. Out of scope: shared
 drives, devices, and audio — and smooth playback of fast-changing
@@ -119,8 +119,8 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Server (sharing)*
-   to one of the *Shared* modes.
+2. On the computer to share, open *File ▸ Preferences* (Ctrl+,) and set
+   *Server (sharing)* to one of the *Shared* modes.
 3. On the viewing computer, the shared computer appears in the panel on
    the left — double-click it (or select it and click *Connect*).
 4. Approve the connection in the dialog that pops up on the shared
@@ -228,7 +228,8 @@ certificate the server generates and keeps, then simple length-prefixed
 messages on top — JSON for control (hello/welcome, input, clipboard,
 ping/pong for the round-trip-time graphs, log exchange) and binary
 payloads for frames and deltas. Discovery is a UDP broadcast probe that
-every server answers with its name and port (see below).
+every server answers with its name, port, and certificate fingerprint
+(see below).
 
 ## Versioning
 
@@ -248,7 +249,12 @@ not guaranteed. Keep both computers on the same version for best results.
 ## How discovery works
 
 The client broadcasts a small JSON probe over UDP (port 48653); each server
-on the LAN replies with its hostname and connection port. Windows Firewall
+on the LAN replies with its hostname, connection port, and TLS certificate
+fingerprint. The fingerprint is the server's stable identity: when a
+reconnecting client can no longer reach a server at its last known address
+(typically a new DHCP lease after a reboot), it re-scans and matches the
+fingerprint to follow the server to its new address, keeping the stored
+pairing token so no fresh approval is needed. Windows Firewall
 must allow Python to receive inbound UDP on that port for a server to be
 discoverable from other machines.
 

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/readme.md

@@ -59,10 +59,10 @@ one-click *Forget* / *Revoke*, and the live connection log.
 - 🔒 **TLS + approve-once pairing** — every connection is encrypted; the server user approves a new client once, after which it reconnects with a stored token and no prompt.
 - 🔐 **Honest lock-screen behavior** — a locked server tells viewers so with a clear on-screen notice instead of a frozen frame, and streaming resumes by itself once someone signs in at the machine (see [The Windows lock screen](#the-windows-lock-screen)).
 - 📊 **Built-in performance monitoring** — live bandwidth and round-trip-time graphs with window statistics (mean/min/max/p99/jitter), plus a per-viewer table on the server.
-- 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Connections that were open when the app closed are restored on the next start.
+- 🔁 **Robust connections** — dead connections are detected within seconds, and dropped sessions reconnect automatically with backoff; a server restart heals by itself, no clicks needed. Even a server that comes back on a **different IP address** (a new DHCP lease after a reboot) is found again: reconnection re-scans the LAN, recognizes the server by its certificate identity, and follows it to the new address — pairing intact, so still no prompt. Connections that were open when the app closed are restored on the next start.
 - 🚀 **Hands-off operation** — start-at-login (per-user, no admin rights) with a choice of minimized (the default and recommended — sharing resumes after a reboot with no clicks), normal, maximized, or not starting at all; close-to-tray while sharing (the screen stays available with the window closed); and a *Restart app* button usable from the remote session itself, so you can update the software without visiting the machine.
 - 🗃️ **Persistent peer inventory** — a SQLite-backed history of every peer seen on the LAN, with one-click *Revoke* / *Forget*.
-- 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts, a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
+- 🧭 **Desktop-app niceties** — a real menu bar with standard shortcuts (Preferences on *File ▸ Preferences*, Ctrl+,; About on the Help menu), a status-bar sharing indicator, a confirmation before quitting with viewers connected, and window/panel layout that persists across restarts.
 
 In scope: screen, keyboard, mouse, and clipboard. Out of scope: shared
 drives, devices, and audio — and smooth playback of fast-changing
@@ -94,8 +94,8 @@ it prepares the environment on first use and launches the app.
 ## Quick start
 
 1. Run `remotedesktop` on both computers.
-2. On the computer to share, open *Preferences* and set *Server (sharing)*
-   to one of the *Shared* modes.
+2. On the computer to share, open *File ▸ Preferences* (Ctrl+,) and set
+   *Server (sharing)* to one of the *Shared* modes.
 3. On the viewing computer, the shared computer appears in the panel on
    the left — double-click it (or select it and click *Connect*).
 4. Approve the connection in the dialog that pops up on the shared
@@ -203,7 +203,8 @@ certificate the server generates and keeps, then simple length-prefixed
 messages on top — JSON for control (hello/welcome, input, clipboard,
 ping/pong for the round-trip-time graphs, log exchange) and binary
 payloads for frames and deltas. Discovery is a UDP broadcast probe that
-every server answers with its name and port (see below).
+every server answers with its name, port, and certificate fingerprint
+(see below).
 
 ## Versioning
 
@@ -223,7 +224,12 @@ not guaranteed. Keep both computers on the same version for best results.
 ## How discovery works
 
 The client broadcasts a small JSON probe over UDP (port 48653); each server
-on the LAN replies with its hostname and connection port. Windows Firewall
+on the LAN replies with its hostname, connection port, and TLS certificate
+fingerprint. The fingerprint is the server's stable identity: when a
+reconnecting client can no longer reach a server at its last known address
+(typically a new DHCP lease after a reboot), it re-scans and matches the
+fingerprint to follow the server to its new address, keeping the stored
+pairing token so no fresh approval is needed. Windows Firewall
 must allow Python to receive inbound UDP on that port for a server to be
 discoverable from other machines.
 

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/src/remotedesktop/__init__.py

@@ -1,3 +1,3 @@
 """Remote desktop client/server for Windows computers on the same LAN."""
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/src/remotedesktop/app.py

@@ -15,7 +15,9 @@ import logging
 import re
 import sqlite3
 import sys
+import threading
 import time
+from collections.abc import Callable
 from pathlib import Path
 
 from PySide6.QtCore import QObject, QProcess, QStandardPaths, Qt, QTimer, Signal
@@ -45,10 +47,15 @@ from PySide6.QtWidgets import (
 from remotedesktop import __version__, compat, db, icon, logs, window_state
 from remotedesktop.about import AboutDialog
 from remotedesktop.autostart import Autostart, installed_launcher
-from remotedesktop.client import DiscoveryPanel, ServerSession
+from remotedesktop.client import DiscoveryPanel, ServerSession, _broadcast_hosts
 from remotedesktop.clipboard import ClipboardSync
 from remotedesktop.config import KnownServers, Settings, default_db_path, load_client_identity
-from remotedesktop.discovery import DEFAULT_CONNECT_PORT, DISCOVERY_PORT, ServerInfo
+from remotedesktop.discovery import (
+    DEFAULT_CONNECT_PORT,
+    DISCOVERY_PORT,
+    ServerInfo,
+    discover_servers,
+)
 from remotedesktop.inventory import ConnectionInventory, InventoryTab
 from remotedesktop.logs import PeerLogDialog, read_log_tail
 from remotedesktop.modal_loop import HTCLOSE, HTMAXBUTTON, HTMINBUTTON, ModalLoopPump
@@ -73,6 +80,14 @@ _log = logging.getLogger("remotedesktop.app")
 # Auto-reconnect backoff never waits longer than this between attempts.
 _RECONNECT_CAP_SECONDS = 30.0
 
+# Once this many direct reconnect attempts at the last known address have
+# failed, each further failure also starts a discovery scan: the server may
+# have come back on a different address (DHCP after a reboot), and sessions,
+# tokens, and pins are all keyed by host:port. A re-discovered server is
+# matched by certificate fingerprint (name as the fallback) and the session
+# migrates to the new address — token included, so no re-approval.
+_REDISCOVER_AFTER_ATTEMPTS = 2
+
 
 class _SessionsTable(ViewersTable):
     """The client-side twin of the viewers table: one row per connected
@@ -121,6 +136,9 @@ class _ConnectedServersSource(QObject):
 
 
 class MainWindow(QMainWindow):
+    # A re-discovery scan finished on its worker thread: (session, servers).
+    _rediscoveryFinished = Signal(object, list)
+
     def __init__(
         self,
         *,
@@ -132,10 +150,19 @@ class MainWindow(QMainWindow):
         connect_port: int = DEFAULT_CONNECT_PORT,
         tray_available: bool | None = None,
         reconnect_base_seconds: float = 2.0,
+        rediscover: Callable[[], list[ServerInfo]] | None = None,
         effects_reducer: VisualEffectsReducer | None = None,
     ) -> None:
         super().__init__()
         self._reconnect_base = reconnect_base_seconds
+        # The blocking scan auto-reconnect uses to find a moved server; tests
+        # inject a fake so window tests never broadcast on the LAN.
+        self._rediscover = (
+            rediscover
+            if rediscover is not None
+            else lambda: discover_servers(broadcast_hosts=_broadcast_hosts())
+        )
+        self._rediscoveryFinished.connect(self._on_rediscovery_finished)
         self._auto_scan = auto_scan
         self.setWindowIcon(icon.app_icon("app"))
         # Tests inject a connection to a temp database; the app uses the default.
@@ -1370,6 +1397,10 @@ class MainWindow(QMainWindow):
         session.viewer.clear(message)
         self._set_session_status(session, f"{session.name}: {message}")
         self.log(f"[{session.name}] {message}")
+        # The direct address keeps failing — the server may be back under a
+        # different one. Scan alongside the backoff timer, not instead of it.
+        if session.reconnect_attempts >= _REDISCOVER_AFTER_ATTEMPTS:
+            self._start_rediscovery(session)
 
     def _attempt_reconnect(self, session: ServerSession) -> None:
         if (
@@ -1392,6 +1423,104 @@ class MainWindow(QMainWindow):
             session.reconnect_timer.stop()
         session.reconnect_attempts = 0
 
+    # -------------------------------------------- reconnect re-discovery
+
+    def _start_rediscovery(self, session: ServerSession) -> None:
+        """Scan the LAN for a server that moved to a new address.
+
+        Runs the blocking scan on a worker thread (the DiscoveryPanel
+        pattern) and delivers the result through a queued signal. This is
+        not background polling: it only runs while a session is actively
+        failing to reconnect, and stops the moment it succeeds.
+        """
+        if session.rediscovering:
+            return
+        session.rediscovering = True
+        _log.debug("Re-discovery scan for %s (%s)", session.name, session.key)
+        scan = self._rediscover
+
+        def run() -> None:
+            try:
+                servers = scan()
+            except OSError as error:
+                _log.warning("Re-discovery scan failed: %s", error)
+                servers = []
+            try:
+                self._rediscoveryFinished.emit(session, servers)
+            except RuntimeError:
+                pass  # the window was torn down while the scan ran
+
+        threading.Thread(target=run, name="reconnect-rediscovery", daemon=True).start()
+
+    def _on_rediscovery_finished(self, session: ServerSession, servers: list) -> None:
+        session.rediscovering = False
+        if (
+            session not in self._sessions
+            or session.connected
+            or session.denied
+            or not session.auto_reconnect
+            or self._quitting
+        ):
+            return
+        match = self._match_rediscovered(session, servers)
+        if match is None:
+            _log.debug("Re-discovery: %s not found among %d server(s)", session.name, len(servers))
+            return
+        if f"{match.host}:{match.port}" == session.key:
+            return  # still advertised at the failing address; keep direct retries
+        self._migrate_session(session, match)
+
+    def _match_rediscovered(self, session: ServerSession, servers: list) -> ServerInfo | None:
+        """The discovered server that is `session`'s peer, if any.
+
+        The pinned certificate fingerprint is the identity; the display name
+        is the fallback for servers too old to advertise one (soft matching,
+        like the soft cert pin — robust connections over strict identity).
+        """
+        record = self._known_servers.get(session.key)
+        pinned = (record or {}).get("fingerprint") or ""
+        candidates = [s for s in servers if not self._is_own_server(s)]
+        if pinned:
+            for server in candidates:
+                if server.fingerprint == pinned:
+                    return server
+        for server in candidates:
+            if server.name == session.name:
+                return server
+        return None
+
+    def _migrate_session(self, session: ServerSession, server: ServerInfo) -> None:
+        """Move a session (and its stored pairing) to the server's new
+        address, then reconnect immediately."""
+        old_key, new_key = session.key, f"{server.host}:{server.port}"
+        if self._session_for_key(new_key) is not None:
+            return  # the user already opened a session at the new address
+        record = self._known_servers.get(old_key)
+        if record is not None:
+            # Re-key the pairing so the stored token still applies — the
+            # whole point: no fresh approval just because DHCP moved the
+            # server.
+            self._known_servers.remember(
+                new_key, record.get("fingerprint") or "", record["token"]
+            )
+            self._known_servers.forget(old_key)
+        session.key = new_key
+        session.host, session.port = server.host, server.port
+        # The peer's inventory row moves with it; the stale address would
+        # otherwise linger as a permanently-unreachable duplicate.
+        self.client_inventory.remove(old_key)
+        self.client_inventory.record(
+            new_key, "attempt", name=session.name, address=new_key, detail=new_key
+        )
+        self._persist_sessions()
+        message = f"Found {session.name} at new address {new_key} (was {old_key}) — reconnecting"
+        self._set_session_status(session, message)
+        self.log(f"[{session.name}] {message}")
+        # A new address deserves a fresh backoff; the connect failure path
+        # re-arms it (and further re-discovery) if this address fails too.
+        self._cancel_reconnect(session)
+        session.client.connect_to(server.host, server.port)
+
     def _request_server_log(self) -> None:
         session = self._session_for_page(self._tabs.currentWidget())
         if session is None:

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/src/remotedesktop/client.py

@@ -233,5 +233,8 @@ class ServerSession:
         self.auto_reconnect = False
         self.reconnect_attempts = 0
         self.reconnect_timer: QTimer | None = None
+        # True while a re-discovery scan for this session runs on a worker
+        # thread (the server may have come back on a different address).
+        self.rediscovering = False
         # What the status bar shows while this session's tab is current.
         self.status_text = ""

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/src/remotedesktop/discovery.py

@@ -28,6 +28,10 @@ class ServerInfo:
     name: str
     host: str
     port: int
+    # The server's TLS certificate fingerprint, when it advertises one —
+    # a stable identity that survives address changes (DHCP gave the server
+    # a new IP after a reboot). Empty from servers too old to send it.
+    fingerprint: str = ""
 
 
 def _parse(data: bytes, expected_type: str) -> dict | None:
@@ -58,10 +62,14 @@ class DiscoveryResponder:
         name: str,
         connect_port: int,
         *,
+        fingerprint: str = "",
         discovery_port: int = DISCOVERY_PORT,
         bind_host: str = "",
     ) -> None:
-        self._reply = _encode("reply", name=name, port=connect_port)
+        # The fingerprint (`fp`) is optional in the reply: clients that
+        # predate it simply ignore the extra field.
+        extra = {"fp": fingerprint} if fingerprint else {}
+        self._reply = _encode("reply", name=name, port=connect_port, **extra)
         self._discovery_port = discovery_port
         self._bind_host = bind_host
         self._socket: socket.socket | None = None
@@ -181,6 +189,12 @@ def discover_servers(
             if not isinstance(name, str) or not isinstance(port, int):
                 _log.debug("Ignoring malformed reply from %s: %r", host, message)
                 continue
-            found.setdefault((host, port), ServerInfo(name=name, host=host, port=port))
+            fingerprint = message.get("fp")
+            if not isinstance(fingerprint, str):
+                fingerprint = ""
+            found.setdefault(
+                (host, port),
+                ServerInfo(name=name, host=host, port=port, fingerprint=fingerprint),
+            )
     _log.debug("Discovery scan finished: %d server(s) found", len(found))
     return list(found.values())

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/src/remotedesktop/server.py

@@ -295,8 +295,14 @@ class SharingTab(QWidget):
         self._listening = server.listen(self._connect_port)
         self._discoverable = False
         if self._listening:
+            # Advertising the cert fingerprint lets clients recognize this
+            # server by identity when its IP changes (auto-reconnect
+            # re-discovery), not just by address.
             responder = DiscoveryResponder(
-                self._name, server.port, discovery_port=self._discovery_port
+                self._name,
+                server.port,
+                fingerprint=tls.certificate_fingerprint(self._credentials[0]),
+                discovery_port=self._discovery_port,
             )
             try:
                 responder.start()

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/tests/test_discovery.py

@@ -120,6 +120,48 @@ def test_replies_with_malformed_fields_are_ignored() -> None:
     assert servers == [ServerInfo(name="ok", host=LOOPBACK, port=9)]
 
 
+def test_reply_carries_the_advertised_fingerprint() -> None:
+    port = free_udp_port()
+    fingerprint = "ab" * 32
+    responder = DiscoveryResponder(
+        "fpbox", 2345, fingerprint=fingerprint, discovery_port=port, bind_host=LOOPBACK
+    )
+    responder.start()
+    try:
+        servers = discover_servers(
+            timeout=2.0, discovery_port=port, broadcast_hosts=(LOOPBACK,)
+        )
+    finally:
+        responder.stop()
+    assert servers == [
+        ServerInfo(name="fpbox", host=LOOPBACK, port=2345, fingerprint=fingerprint)
+    ]
+
+
+def test_reply_with_malformed_fingerprint_still_counts() -> None:
+    # A junk `fp` blanks the fingerprint but never costs the discovery —
+    # matching just falls back to the name.
+    port = free_udp_port()
+
+    def fake_server(sock: socket.socket) -> None:
+        _probe, sender = sock.recvfrom(4096)
+        reply = {
+            "magic": "remotedesktop", "version": 1, "type": "reply",
+            "name": "ok", "port": 9, "fp": 12345,
+        }
+        sock.sendto(json.dumps(reply).encode(), sender)
+
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind((LOOPBACK, port))
+        thread = threading.Thread(target=fake_server, args=(sock,), daemon=True)
+        thread.start()
+        servers = discover_servers(
+            timeout=1.0, discovery_port=port, broadcast_hosts=(LOOPBACK,)
+        )
+        thread.join()
+    assert servers == [ServerInfo(name="ok", host=LOOPBACK, port=9, fingerprint="")]
+
+
 def test_probe_send_failure_is_tolerated() -> None:
     servers = discover_servers(
         timeout=0.1,

{remotedesktop-2.1.0 → remotedesktop-2.2.0}/tests/test_main_window.py

@@ -9,7 +9,7 @@ from PySide6.QtGui import QImage
 from PySide6.QtWidgets import QApplication, QListWidgetItem, QMessageBox
 
 from remotedesktop import client as client_module
-from remotedesktop import db
+from remotedesktop import db, tls
 from remotedesktop.app import MainWindow
 from remotedesktop.autostart import START_OFF, Autostart
 from remotedesktop.client import DiscoveryPanel
@@ -37,7 +37,7 @@ def _clean_test_run_key():
 def make_window(
     tmp_path, credentials=None, *, serving=False, viewer=True, tray_available=False,
     db_name="app.db", discovery_port=None, reconnect_base_seconds=2.0,
-    effects_reducer=None,
+    rediscover=None, effects_reducer=None,
 ):
     """A MainWindow on a temp DB with everything injected.
 
@@ -63,6 +63,9 @@ def make_window(
         connect_port=0,
         tray_available=tray_available,
         reconnect_base_seconds=reconnect_base_seconds,
+        # Auto-reconnect re-discovery must never broadcast on the LAN from a
+        # test: without an injected fake it stays a no-op.
+        rediscover=rediscover if rediscover is not None else (lambda: []),
         effects_reducer=(
             effects_reducer
             if effects_reducer is not None
@@ -961,6 +964,115 @@ def test_auto_reconnect_backs_off_while_server_stays_down(qapp, credentials, tmp
         server.close()
 
 
+def test_auto_reconnect_follows_server_to_new_address(qapp, credentials, tmp_path):
+    """The server comes back on a different port (the moved-DHCP-address
+    stand-in): re-discovery matches it by certificate fingerprint and the
+    session migrates — stored token included, so no re-approval prompt."""
+    server = make_share_server(credentials, tmp_path)
+    discovered: list[ServerInfo] = []
+    window = make_window(
+        tmp_path, reconnect_base_seconds=0.05, rediscover=lambda: list(discovered)
+    )
+    try:
+        window._on_server_activated(ServerInfo(name="box", host="127.0.0.1", port=server.port))
+        session = window._sessions[0]
+        pump(qapp, lambda: session.connected)
+        old_key = session.key
+        server.close()
+        pump(qapp, lambda: not session.connected)  # the drop must land first
+
+        # Any approval request would be denied: the migrated token must make
+        # the reconnect promptless.
+        replacement = ShareServer(
+            approve_client=lambda *_: False,
+            credentials=credentials,
+            paired=PairedClients(db.connect(tmp_path / "server.db")),
+        )
+        assert replacement.listen(0)
+        try:
+            # The name deliberately differs: the fingerprint is the identity.
+            discovered.append(
+                ServerInfo(
+                    name="not-the-display-name",
+                    host="127.0.0.1",
+                    port=replacement.port,
+                    fingerprint=tls.certificate_fingerprint(credentials[0]),
+                )
+            )
+            pump(qapp, lambda: session.connected, timeout=15.0)
+            new_key = f"127.0.0.1:{replacement.port}"
+            assert session.key == new_key
+            assert (session.host, session.port) == ("127.0.0.1", replacement.port)
+            # The pairing moved with the session: token at the new key only.
+            record = window._known_servers.get(new_key)
+            assert record is not None and record["token"]
+            assert window._known_servers.get(old_key) is None
+        finally:
+            replacement.close()
+    finally:
+        window.close()
+        server.close()
+
+
+def test_rediscovery_falls_back_to_the_name_for_old_servers(qapp, credentials, tmp_path):
+    # A server too old to advertise a fingerprint is matched by its display
+    # name (which a connected session tracks from the welcome message — the
+    # server's reported hostname).
+    server = make_share_server(credentials, tmp_path)
+    discovered: list[ServerInfo] = []
+    window = make_window(
+        tmp_path, reconnect_base_seconds=0.05, rediscover=lambda: list(discovered)
+    )
+    try:
+        window._on_server_activated(ServerInfo(name="box", host="127.0.0.1", port=server.port))
+        session = window._sessions[0]
+        pump(qapp, lambda: session.connected)
+        assert session.name == socket.gethostname()  # renamed by the welcome
+        server.close()
+        pump(qapp, lambda: not session.connected)  # the drop must land first
+
+        replacement = ShareServer(
+            approve_client=lambda *_: False,
+            credentials=credentials,
+            paired=PairedClients(db.connect(tmp_path / "server.db")),
+        )
+        assert replacement.listen(0)
+        try:
+            discovered.append(
+                ServerInfo(name=session.name, host="127.0.0.1", port=replacement.port)
+            )
+            pump(qapp, lambda: session.connected, timeout=15.0)
+            assert session.key == f"127.0.0.1:{replacement.port}"
+        finally:
+            replacement.close()
+    finally:
+        window.close()
+        server.close()
+
+
+def test_rediscovery_ignores_unrelated_servers(qapp, credentials, tmp_path):
+    server = make_share_server(credentials, tmp_path)
+    discovered = [
+        ServerInfo(name="someone-else", host="127.0.0.1", port=59999, fingerprint="ff" * 32)
+    ]
+    window = make_window(
+        tmp_path, reconnect_base_seconds=0.05, rediscover=lambda: list(discovered)
+    )
+    try:
+        window._on_server_activated(ServerInfo(name="box", host="127.0.0.1", port=server.port))
+        session = window._sessions[0]
+        pump(qapp, lambda: session.connected)
+        old_key = session.key
+        server.close()
+        # Enough failures for several re-discovery scans to have run.
+        pump(qapp, lambda: session.reconnect_attempts >= 4, timeout=15.0)
+        assert session.key == old_key
+        assert not session.connected
+    finally:
+        window.close()
+        server.close()
+
+
 def test_denial_stops_auto_reconnect(qapp, credentials, tmp_path, monkeypatch):
     server = make_share_server(credentials, tmp_path)
     window = make_window(tmp_path, reconnect_base_seconds=0.05)

remotedesktop-2.1.0/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"06786f54-7244-453c-8fd6-c0ad270c6bfc","pid":25604,"procStart":"639204255108546380","acquiredAt":1784854861122}